s Preface Contents SIMATIC System Software for S7-300/400 System and Standard Functions Volume 1/2 Reference Manual Organization Blocks 1 Common Parameters for SFCs 2 Copy and Block Functions SFCs for Controlling Program Execution SFCs for Handling the System Clock SFCs for Handling Run-Time Meters SFCs/SFBs for Transferring Data Records DPV1 SFBs According to PNO AK 1131 SFCs for Handling Time-of-Day Interrupts SFCs for Handling Time-Delay Interrupts SFCs for Handling Synchronous Errors SFCs for Han
Safety Guidelines This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring to property damage only have no safety alert symbol. The notices shown below are graded according to the degree of danger. Danger ! indicates that death or severe personal injury will result if proper precautions are not taken.
Preface Purpose This manual provides you with a comprehensive overview of the organization blocks (OB), system functions (SFC), system and standard function blocks (SFC), and IEC functions contained in the operating systems of the CPUs of the S7-300 and S7-400, diagnostic data, system status lists (SZL), and events.
Preface STEP 7 Documentation Packages The following table displays an overview of the STEP 7 documentation: Documentation Purpose STEP 7 Basic Information with Basic information for technical 6ES7810-4CA08-8BW0 personnel describing the methods of implementing control tasks with STEP 7 and the S7-300/400 programmable controllers.
Preface Online Help The manual Volume 1 and Volume 2 is complemented by an online help which is integrated in the software. This online help is intended to provide you with detailed support when using the software. The help system is integrated in the software via a number of interfaces: • There are several menu commands which you can select in the Help menu: The Contents command opens the index for the Help on STEP 7. • Using Help provides detailed instructions on using the online help.
Preface How to Use this Manual This manual covers the following topics: • Chapter 1 explains the functions of all the organization blocks. • Chapter 2 describes the common parameters RET_VAL, REQ and BUSY. • Chapters 3 to 29 describe the SFCs, SFBs and IEC-FCs. • The Chapters sections 30 to 35 contain a description of the structure of the diagnostic data, an overview of the SZL-IDs, the possible events, lists of the SFCs, SFBs and FCs described in this manual, an overview of the SDBs.
Preface Technical Support You can reach the Technical Support for all A&D products • Via the Web formula for the Support Request http://www.siemens.com/automation/support-request • Phone: + 49 180 5050 222 • Fax: + 49 180 5050 223 Additional information about our Technical Support can be found on the Internet pages http://www.siemens.com/automation/service Service & Support on the Internet In addition to our documentation, we offer our Know-how online on the internet at: http://www.siemens.
Preface viii System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
Contents 1 Organization Blocks 1.1 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18 1.19 1.20 1.21 1.22 1.23 1.24 1.25 1.26 1.27 1.28 2 3 Overview of the Organization Blocks (OBs) ..................................................... 1-3 Program Cycle Organization Block (OB1) ........................................................ 1-3 Time-of-Day Interrupt Organization Blocks (OB10 to OB17) ...........................
Contents 3.6 3.7 3.8 3.9 3.10 3.11 3.12 4 SFCs for Controlling Program Execution 4.1 4.2 4.3 4.4 4.5 5 7 8 9 x 8-3 Reading a Data Record with SFB 52 "RDREC" ............................................... 8-3 Writing a Data Record with SFB 53 "WRREC"................................................. 8-3 Receiving an Interrupt with SFB 54 "RALRM".................................................. 8-3 Sending an Interrupt to the DP Master with SFB 75 "SALRM" ........................
Contents 10 SFCs for Handling Time-Delay Interrupts 10.1 10.2 10.3 10.4 11 12 12.3 12.4 12.5 13.5 13.6 13.7 14 14.4 14.5 14.6 14.7 15 15.2 15.3 15.4 15.5 14-3 Updating the Process Image Input Table with SFC 26 "UPDAT_PI" ............. 14-3 Updating the Process Image Output Table with SFC 27 "UPDAT_PO" ........ 14-3 Updating the Process Image Partition Input Table in a Synchronous Cycle with SFC 126 "SYNC_PI" ...............................................
Contents 16 SFCs for Distributed I/Os or PROFINET IO 16.1 16.2 16.3 16.4 16.5 16.6 17 17.3 17.4 18 17-3 Background Information on SFCs 112, 113 and 114 ..................................... 17-3 Updating the Inputs of the User Program Interface for the PROFInet Component with SFC 112 "PN_IN" ............................................... 17-3 Updating the Outputs of the PROFInet Interface for the PROFInet Component with SFC 113 "PN_OUT" ...........................................
1 Organization Blocks 1.1 Overview of the Organization Blocks (OBs) What Are Organization Blocks? Organization Blocks (OBs) are the interface between the operating system of the CPU and the user program. OBs are used to execute specific program sections: • At the startup of the CPU • In a cyclic or clocked execution • Whenever errors occur • Whenever hardware interrupts occur. Organization blocks are executed according to the priority they are allocated.
Organization Blocks Where to Find More Information? Refer to the online help and the following manuals for more information: • /70/: this manual contains the technical data that describe the capabilities of the different S7-300 CPUs. • /101/: this manual contains the technical data that describe the capabilities of the different S7-400 CPUs. The following table contains the start event belonging to each OB as well as the default priority class.
Organization Blocks OB Start Event Default Priority Class Explanation OB 61 Synchronous Cycle Interrupt 1 25 OB 62 Synchronous Cycle Interrupt 2 25 Synchronous Cycle Interrupt OB 63 Synchronous Cycle Interrupt 3 25 OB 64 Synchronous Cycle Interrupt 4 25 OB 65 Technology synchronization interrupt 25 Technology synchronization interrupt OB70 I/O redundancy error (only in H CPUs) 25 OB72 CPU redundancy error (only in H CPUs) 28 Redundancy error interrupts OB 73 Communication redun
Organization Blocks 1.2 Program Cycle Organization Block (OB1) Description The operating system of the S7 CPU executes OB1 periodically. When OB1 has been executed, the operating system starts it again. Cyclic execution of OB1 is started after the startup has been completed. You can call other function blocks (FBs, SFBs) or functions (FCs, SFCs) in OB1.
Organization Blocks Local Data for OB1 The following table describes the temporary (TEMP) variables for OB1. The variable names are the default names of OB1.
Organization Blocks 1.3 Time-of-Day Interrupt Organization Blocks (OB10 to OB17) Description STEP 7 provides up to eight OBs (OB10 to OB17) which can be run once or periodically. You can assign parameters for CPU using SFCs or STEP 7 so that these OBs are processed at the following intervals: • Once • Every minute • Hourly • Daily • Weekly • Monthly • At the end of each month Note For monthly execution of a time-of-day interrupt OBs, only the days 1, 2, ... 28 can be used as a starting date.
Organization Blocks Understanding the Operation of Time-of-Day Interrupt OBs To start a time-of-day interrupt, you must first set and then activate the interrupt. The three following start possibilities exist: • Automatic start of the time-of-day interrupt. This occurs once you have set and then activated the time-of-day interrupt with STEP 7. The following table shows the basic possibilities for activating a time-of-day interrupt with STEP 7.
Organization Blocks Conditions That Affect Time-of-Day Interrupt OBs Since a time-of-day interrupt occurs only at specified intervals, certain conditions can affect the operation of the OB during the execution of your program. The following table shows some of these conditions and describes the effect on the execution of the time-of-day interrupt OB. Condition Result Your program calls SFC29 (CAN_TINT) and cancels a time-of-day interrupt.
Organization Blocks Local Data for Time-of-Day Interrupt OBs The following table describes the temporary (TEMP) variables for a time-of-day interrupt OB. The variable names are the default names of OB10.
Organization Blocks 1.4 Time-Delay Interrupt Organization Blocks (OB20 to OB23) Description S7 provides up to four OBs (OB20 to OB23) which are executed after a specified delay. Every time-delay OB is started by calling SFC32 (SRT_DINT). The delay time is an input parameter of the SFC. When your program calls SFC32 (SRT_DINT), you provide the OB number, the delay time, and a user-specific identifier. After the specified delay, the OB starts.
Organization Blocks Local Data for Time-Delay Interrupt OBs The following table describes the temporary (TEMP) variables for a time-delay interrupt OB. The variable names are the default names of OB20.
Organization Blocks 1.5 Cyclic Interrupt Organization Blocks (OB30 to OB38) Description S7 provides up to nine cyclic interrupt OBs (OB30 to OB38) which interrupt your program at fixed intervals. The following table shows the default intervals and priority classes for the cyclic interrupt OBs.
Organization Blocks Local Data for Cyclic Interrupt OBs The following table describes the temporary (TEMP) variables for a cyclic interrupt OB. The variable names are the default names of OB35.
Organization Blocks 1.6 Hardware Interrupt Organization Blocks (OB40 to OB47) Description S7 provides up to eight independent hardware interrupts each with its own OB. By assigning parameters with STEP 7, you specify the following for each signal module that will trigger hardware interrupts: • Which channels trigger a hardware interrupt under what conditions. • Which hardware interrupt OB is assigned to the individual groups of channels (as default, all hardware interrupts are processed by OB40).
Organization Blocks If a hardware interrupt is triggered and its OB is currently active due to a hardware interrupt from another module, the new request is recorded and the OB processed when it is free. You can disable or delay and re-enable hardware interrupts using SFCs 39 to 42. You can assign parameters for the hardware interrupts of a module not only with STEP 7 but also with SFCs 55 to 57.
Organization Blocks 1.7 Status Interrupt OB (OB 55) Note A status interrupt OB (OB 55) is only available for DPV1 capable CPUs. Description The CPU operating system calls OB55 if a status interrupt was triggered via the slot of a DPV1 slave. This might be the case if a component (module or rack) of a DPV1 slaves changes its operating mode, for example from RUN to STOP. For precise information on events that trigger a status interrupt, refer to the documentation of the DPV1 slave‘s manufacturer.
Organization Blocks 1.8 Update Interrupt OB (OB 56) Note A update interrupt OB (OB 56) is only available for DPV1 capable CPUs. Description The CPU operating system calls OB56 if an update interrupt was triggered via the slot of a DPV1 slave. This can be the case if you have changed the parameters for the slot of a DPV1 slave (via local or remote access). For precise information on events that trigger an update interrupt, refer to the documentation of the DPV1 slave‘s manufacturer.
Organization Blocks 1.9 Manufacturer Specific Interrupt OB (OB57) Note An OB for manufacturer specific interrupts(OB57) is only available for DPV1 capable CPUs. Description The CPU operating system calls OB57 if an manufacturer specific interrupt was triggered via the slot of a DPV1 slave. Local data of the OB for manufacturer specific interrupts The table below contains the temporary (TEMP) variables of the OB for manufacturer specific interrupt interrupts.
Organization Blocks 1.10 Multicomputing Interrupt Organization Block (OB60) Description Using the multicomputing interrupt, you can make sure that the reaction of the CPUs is synchronized to an event during multicomputing. In contrast to hardware interrupts triggered by signal modules, the multicomputing interrupt can only be output by CPUs. Understanding the Operation of Multicomputing Interrupt OBs A multicomputing interrupt is triggered by calling SFC35 "MP_ALM.
Organization Blocks Local Data for Multicomputing Interrupt OBs The following table describes the temporary (TEMP) variables of the multicomputing interrupt OB. The variable names are the default names of OB60.
Organization Blocks 1.11 Synchronous Cycle Interrupt OBs (OB 61 to OB 64) Description Synchronous cycle interrupts give you the option of starting programs in synchronous cycle with the DP cycle. OB 61 serves as an interface OB to the synchronous cycle interrupt TSAL1. You can set the priority for OB 61 between 0 (OB deselected) and from 2 to 26. ! Caution For direct access with L or T commands (e.g.
Organization Blocks 1.12 Technology Synchronization Interrupt OB (OB 65) Note The technology synchronization interrupt OB (OB 65) only applies to Technology CPUs. Description The technology synchronization interrupt provides the option of starting a program at the same time the technology blocks are updated. the technology synchronization interrupt OB is started after the technology blocks are updated.
Organization Blocks 1.13 I/O Redundancy Error OB (OB70) Note The I/O redundancy error OB (OB70) can only be used with H CPUs. Description The operating system of the H CPU calls OB70 when there is a loss of redundancy on PROFIBUS DP (for example, a bus failure for the active DP master or when an error occurs in the interface module of the DP slave) or when the active DP master of DP slaves with connected I/Os changes.
Organization Blocks The variables that depend on the error code have the following significance: Error code • • Bit Meaning B#16#A2 - OB70_INFO_1: Logical base address of the affected DP master - OB70_INFO_2: Reserved - OB70_INFO_3: 0 to 7: Reserved 8 to 15: DP master system ID of the affected DP master B#16#A3 - OB70_INFO_1: - OB70_INFO_2: - OB70_INFO_3 Logical base address of the DP master Affected DP Slave: 0 to 14: Logical base address, if an S7 slave is used, or diagnostic addre
Organization Blocks 1.14 CPU Redundancy Error OB (OB72) Note The CPU redundancy error OB (OB72) exists only with H CPUs. Description The operating system of the H CPU calls OB72 when one of the following events occurs: • Loss of CPU redundancy • Reserve-master switchover • Synchronization error • Error in a SYNC module • Updating aborted • Comparison error (for example, RAM, PIQ) OB72 is executed by all CPUs that are in the RUN or STARTUP mode following a suitable start event.
Organization Blocks Variable Type OB72_RESERVED_1 WORD Description Only for error code B#16#03: • • OB72_INFO_1 WORD • WORD OB72_INFO_3 WORD 1-26 - B#16#C4: Transition to redundant mode after troubleshooting mode was carried out with standby-master switch-over (if OB72_INFO_3=W#16#0001) or without standby-master switch-over (if OB72_INFO_3=W#16#0002). OB72_INFO_2 is reserved.
Organization Blocks The following table shows which event caused OB72 to be started.
Organization Blocks 1.15 Communication Redundancy Error OB (OB73) Note The communications redundancy error OB (OB73) is only available in firmware version V2.0.x for the CPU 417-4H. Description The operating system of the H CPU calls OB73 when the first loss of redundancy occurs in a fault-tolerant S7 connection (Fault-tolerant S7 connections only exist for S7 communication. For more information, see "S7-400 H Programmable Controller, Fault-Tolerant Systems.").
Organization Blocks 1.16 Time Error Organization Block (OB80) Description The operating system of the S7-300 CPU calls OB80 whenever an error occurs while executing an OB. Such errors include: exceeding the cycle time, an acknowledgement error when executing an OB, moving the time forward so that the start time for the OB is skipped, resume RUN mode after CiR.
Organization Blocks The variables dependent on the error code have the following meaning: Error code • • Bit Meaning Cycle time exceeded. B#16#01 - OB80_ERROR_INFO: Run time of last scan cycle (ms). - OB80_ERR_EV_CLASS: Class of the event that triggered the interrupt. - OB80_ERR_EV_NUM: Number of the event that triggered the interrupt. - OB80_OB_PRIORITY: Priority class of the OB which was being executed when the error occurred.
Organization Blocks Error code • B#16#0A - • OB80_ERROR_INFO: B#16#0B Bit Meaning Resume RUN after CiR CiR synchronization time in ms Technology synchronization interrupt - OB80_ERR_EV_NUM: Number of the event that triggered the interrupt: W#16#116A - OB80_OB_PRIORITY: Priority class of the OB that was being processed when the error occurred.
Organization Blocks 1.17 Power Supply Error Organization Block (OB81) Description The operating system of the S7-300 CPU calls OB81 whenever an event occurs that is triggered by an error or fault related to the power supply (only on an S7-400) or the back-up battery (when entering and when outgoing event). In S7-400, OB81 is only called in the event of a battery fault if the battery test function has been activated with the BATT.INDIC switch.
Organization Blocks The variables OB81_RESERVED_i, 3 ≤ i ≤ 6 indicate the expansion racks on which the battery backup (error code B#16#31), the back-up voltage (error code B#16#32) or the 24-V power supply (error code B#16#33) has failed or returned. The following table shows what bit is assigned to which expansion rack in the variables OB81_RESERVED_i, 3 ≤ i ≤ 6.
Organization Blocks 1.18 Diagnostic Interrupt Organization Block (OB82) Description If a module with diagnostic capability for which you have enabled the diagnostic interrupt detects an error, it outputs a request for a diagnostic interrupt to the CPU (when entering and outgoing event). The operating system then calls OB82. The local variables of OB82 contain the logical base address as well as four bytes of diagnostic data of the defective module (see the following table).
Organization Blocks Variable Type Description OB82_MDL_STOP BOOL Operating mode (0: RUN, 1: STOP) OB82_WTCH_DOG_FLT BOOL Watchdog timer responded OB82_INT_PS_FLT BOOL Internal power supply failed OB82_PRIM_BATT_FLT BOOL Battery exhausted OB82_BCKUP_BATT_FLT BOOL Entire backup failed OB82_RESERVED_2 BOOL Reserved OB82_RACK_FLT BOOL Expansion rack failure OB82_PROC_FLT BOOL Processor failure OB82_EPROM_FLT BOOL EPROM fault OB82_RAM_FLT BOOL RAM fault OB82_ADU_FLT BOOL ADC/D
Organization Blocks 1.19 Insert / Remove Module Interrupt Organization Block (OB83) Description The CPU operating system calls OB 83 in following situations: • after insertion / removal of a configured module • after modifications of module parameters under STEP 7 and download of changes to the CPU during RUN You can disable/delay/enable the insert/remove interrupt OB with the help of SFCs 39 to 42.
Organization Blocks Reconfiguring modules You can reassign the parameters to existing modules when you modify your system configuration during runtime (CiR). This reassignment of parameters is performed by transferring the required parameter data records to the modules. This is the procedure: 1. OB 83 will be started (Start event W#16#3367) after you have assigned new parameters to a module under STEP 7 and downloaded this configuration to the CPU in RUN mode.
Organization Blocks Variable Type Description OB83_RACK_NUM WORD • • OB83_MDL_TYPE • WORD If OB83_RESERVED_1 =B#16#A0: number of submodule/interface submodule (low byte) If OB83_RESERVED_1 = B#16#C4: - central: rack number - distributed PROFIBUS DP: number of DP station (low byte) and DP master system ID (high byte) - distributed PROFINET IO: physical address: identifier bit (bit 15, 1 = PROFINET IO), IO system ID (bits 11 to 14) and device number (bits 0 to 10) Central or distributed PROFIB
Organization Blocks OB83_EV_CLASS OB83_FLT_ID Meaning B#16#39 B#16#66 Module not responding, load voltage error B#16#38 B#16#66 Module responds again, load voltage error corrected B#16#33 B#16#67 Start of module reconfiguration B#16#32 B#16#67 End of module reconfiguration B#16#39 B#16#68 Module reconfiguration terminated with error B#16#38 B#16#84 Interface module inserted B#16#39 B#16#84 Interface module removed Note If you are using a DPV1- or PROFINET-capable CPU you can obtain
Organization Blocks 1.20 CPU Hardware Fault Organization Block (OB84) Description The OS in the CPU calls OB84 in the following cases: • After memory errors have been detected and corrected • For S7-400H: if there is reduced performance of the redundant link between the two CPUs • For WinAC RTX: Error in operating system (e.g. "blue screen") You can use SFCs 39 to 42 to disable or delay the CPU hardware error OB and then enable it again.
Organization Blocks 1.21 Priority Class Error Organization Block (OB85) Description The operating system of the CPU calls OB85 whenever one of the following events occurs: • Start event for an OB that has not been loaded (except OB81). • Error when the operating system accesses a module. • I/O access error during update of the process image by the system (if the OB85 call was not suppressed due to the configuration).
Organization Blocks If you want to program OB85 dependent on the possible error codes, we recommend that you organize the local variables as follows: Variable Type OB85_EV_CLASS BYTE OB85_FLT_ID BYTE OB85_PRIORITY BYTE OB85_OB_NUMBR BYTE OB85_DKZ23 BYTE OB85_RESERVED_2 BYTE OB85_Z1 WORD OB85_Z23 DWORD OB85_DATE_TIME DATE_AND_TIME The following table shows the event that started OB85: OB85_EV_CLASS OB85_FLT_ID Meaning B#16#35 As a result of your configuration created with STEP 7, your
Organization Blocks OB85_EV_CLASS OB85_FLT_ID B#16#39 B#16#B1 Meaning I/O access error when updating the process image of the inputs • • • B#16#39 B#16#B2 OB85_DKZ23: ID of the type of process image transfer during which the I/O access error has occurred - B#16#10: Byte access - B#16#20: Word access - B#16#30: DWord access - B#16#57: Transmitting a configured consistency range OB85_Z1: Reserved for internal use by the CPU: logical base address of the module If OB85_RESERVED_2 has the value B
Organization Blocks OB85_EV_CLASS OB85_FLT_ID Meaning B#16#39/B#16#38 B#16#B4 I/O access error when updating the process image of the outputs, incoming/outgoing event OB85_DKZ23, OB85_Z1, OB85_Z23 as for OB85_FLT_ID=B#16#B3 You obtain the error codes B#16#B3 and B#16#B4 if you configured the OB85 call of I/O access errors entering and outgoing event for process image table updating by the system.
Organization Blocks 1.22 Rack Failure Organization Block (OB86) Description The operating system of the CPU calls OB86 whenever the failure of a central expansion rack (not with S7-300), a DP master system, or a station is detected in the distributed I/Os (PROFIBUS DP or PROFINET IO) (both when entering and outgoing event). If OB86 has not been programmed, the CPU changes to the STOP mode when this type of error is detected. You can disable or delay and re-enable OB86 using SFCs 39 to 42.
Organization Blocks If you want to program OB86 dependent on the possible error codes, we recommend that you organize the local variables as follows: Variable Type OB86_EV_CLASS BYTE OB86_FLT_ID BYTE OB86_PRIORITY BYTE OB86_OB_NUMBR BYTE OB86_RESERVED_1 BYTE OB86_RESERVED_2 BYTE OB86_MDL_ADDR WORD OB86_Z23 DWORD OB86_DATE_TIME DATE_AND_TIME The following table show the event started OB86: OB86_EV_CLASS OB86_FLT_ID Meaning B#16#39 Expansion rack failure B#16#38 B#16#C1 B#16#C1 •
Organization Blocks OB86_EV_CLASS OB86_FLT_ID Meaning B#16#39 Distributed I/O devices: failure of a DP master system Only incoming event causes the start of OB 86, with error code B#16#C3.
Organization Blocks OB86_EV_CLASS OB86_FLT_ID Meaning B#16#38 Return of a DP station, however discrepancy in configured and actual configuration B#16#39 B#16#39/38 B#16#C8 B#16#CA B#16#CB • OB86_MDL_ADDR: Logical base address of the DP master • OB86_Z23: Address of the affected DP slave: B#16#CC Bit 16 to 30: Logical base address of the DP slave - Bit 31: I/O identifier OB86_MDL_ADDR: logical base address of the IO controller OB86_Z23: - Bit 0 to 10: 0 (station number) - Bit 11 to 14: I
Organization Blocks OB86_EV_CLASS OB86_FLT_ID Meaning B#16#38 PROFINET IO station return, error in module configuration parameters B#16#CE • OB86_MDL_ADDR: logical base address of the IO controller • OB86_Z23: - Bit 0 to 10: Device number - Bit 11 to 14: IO system ID - Bit 15: 1 - Bit 16 to 30: Logical base address of the station - Bit 31: I/O identifier Note If you are using a DPV1 capable CPU you can obtain additional information on the interrupt with the help of SFB54 "RALRM" which exc
Organization Blocks 1.23 Communication Error Organization Block (OB87) Description The operating system of the CPU calls OB87 whenever an event occurs that was caused by a communication error. The CPU does not change to the STOP mode if OB87 has not been programmed. You can disable or delay and re-enable the communication error OB using SFCs 39 to 42. Local Data for OB87 The following table describes the temporary (TEMP) variables for the communication error OB.
Organization Blocks The variables dependent on the error code have the following meaning: Error code Byte/Word • B#16#D2: • B#16#D3 • B#16#D4: • Transmission of diagnostic entries currently not possible. Synchronization messages cannot be transmitted (master). B#16#D5 - OB87_RESERVED_3: - OB87_RESERVED_4: Meaning Illegal time-of-day jump due to clock synchronization. Error when receiving synchronization time (slave). Contains no further information. Contains no further information.
Organization Blocks 1.24 Processing Interrupt OB (OB 88) Description The CPU operating system calls OB 88 after a program block execution is been aborted. Examples of possible causes for this interruption may be: • the nesting depth of synchronous errors is too high • the nesting depth of block calls (U-Stack) is too high • Error during allocation of local data If you have not programmed OB 88 and a program block execution is aborted, the CPU goes into STOP mode (Event ID W#16#4570).
Organization Blocks Variable Data type OB88_BLK_TYPE BYTE Description Type of block at which the error has occurred: • B#16#88: OB • B#16#8C: FC • B#16#8E: FB • B#16##00: Could not determine interrupt source OB88_RESERVED_1 BYTE Reserved OB88_FLT_PRIORITY BYTE Priority class of the OB that has caused the error OB88_FLT_OB_NUMBR BYTE Number of the OB that has caused the error OB88_BLK_NUM WORD Number of the block with the MC7 instruction that has caused the error OB88_PRG_ADDR WORD
Organization Blocks 1.25 Background Organization Block (OB90) Description With STEP 7, you can monitor a maximum scan cycle time and can guarantee a minimum scan cycle time. If the execution time of OB1 including all the nested interrupts and system activities is less than the minimum scan cycle time that you have specified, the operating system reacts as follows: • It calls the background OB (providing it exists on the CPU). • It delays the next OB1 start (if OB90 does not exist on the CPU).
Organization Blocks Local Data for OB90 The following table describes the temporary (TEMP) variables of OB90. The variable names are the default names of OB90.
Organization Blocks 1.26 Startup Organization Blocks (OB100, OB101 and OB102) Types of Startup A distinction is made between the following types of startup • Hot restart (not with the S7-300 and the S7-400H) • Warm restart • Cold restart In the following table, you can see which OB is called by the operating system during startup.
Organization Blocks Local Data for Startup OBs The following table describes the temporary (TEMP) variables for a startup OB. The variable names are the default names of OB100.
Organization Blocks The following table shows the variables OB100_STR_INFO and OB101_STR_INFO. Bit No.
Organization Blocks Bit No.
Organization Blocks Bit No.
Organization Blocks 1.27 Programming Error Organization Block (OB121) Description The operating system of the CPU calls OB121 whenever an event occurs that is caused by an error related to the processing of the program. For example, if your program calls a block that has not been loaded on the CPU, OB121 is called. Understanding the Operation of the Programming Error OB OB121 is executed in the same priority class as the interrupted block.
Organization Blocks Variable Type Description OB121_BLK_NUM WORD Number of the block with the MC7 command that caused the error (no valid number is entered here for an S7-300) OB121_PRG_ADDR WORD Relative address of the MC7 command that caused the error (no valid value is entered here for an S7-300) OB121_DATE_TIME DATE_AND_TIME DATE_AND_TIME of day when the OB was called The variables dependent on the error code have the following meaning: Error code Meaning B#16#21: BCD conversion error O
Organization Blocks Error code Meaning B#16#30: Write access to a write-protected global DB B#16#31: Write access to a write-protected instance DB B#16#32: DB number error accessing a global DB B#16#33: DB number error accessing an instance DB OB121_FLT_REG: Illegal DB number B#16#34: FC number error in FC call B#16#35: FB number error in FB call B#16#3A: Access to a DB that has not been loaded; the DB number is in the permitted range OB121_FLT_REG: B#16#3C: OB121_FLT_REG: B#16#3D: OB121_
Organization Blocks 1.28 I/O Access Error Organization Block (OB122) Description The operating system of the CPU calls OB122 whenever an error occurs while accessing data on a module. For example, if the CPU detects a read error when accessing data on an I/O module, the operating system calls OB122. Understanding the Operation of the I/O Access Error OB OB122 is executed in the same priority class as the interrupted OB. If OB122 is not programmed, the CPU changes from the RUN mode to the STOP mode.
Organization Blocks Local Data for the I/O Access Error OB The following table describes the temporary (TEMP) variables for the I/O access error OB. The variable names are the default names of OB122.
Organization Blocks 1-66 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
2 Common Parameters for SFCs 2.1 Evaluating Errors with Output Parameter RET_VAL Types of Error Information A system function (SFC) executed in your user program indicates whether or not the CPU was able to execute the function of the SFC successfully.
Common Parameters for SFCs Reactions to Error Information There are two different types of error code in RET_VAL as follows: • A general error code, that all system functions can output and • A specific error code, that the system function can output and which relates to its specific function. You can write your program so that it reacts to the errors that occur during execution of a system function. This way you prevent further errors occurring as a result of the first error.
Common Parameters for SFCs General Error Information The general error code indicates errors that can occur in any system function. A general error code consists of the following two numbers: • A parameter number from 1 to 111, where 1 indicates the first parameter, 2 indicates the second parameter of the SFC, etc. • An event number from 0 to 127. The event number indicates that a synchronous error occurred. The following table lists the codes for general errors and an explanation of each error.
Common Parameters for SFCs General Error Codes The following table explains the general error codes of a return value. The error code is shown in hexadecimal format. The letter x in each code number is simply a place holder and represents the number of the system function parameter that caused the error. Error Code (W#16#...) Explanation 8x7F Internal error This error code indicates an internal error at parameter x. This error was not caused by the user and cannot be eliminated by the user.
Common Parameters for SFCs Error Code (W#16#...) Explanation 8x44 Error in the nth (n > 1) read access after an error occurred. 8x45 Error in the nth (n > 1) write access after an error occurred. This error code indicates that access to the required parameter is denied.
Common Parameters for SFCs 2.2 Meaning of the Parameters REQ, RET_VAL and BUSY with Asynchronous SFCs Asynchronous SFCs SFCs that operate asynchronously are SFCs that are called more than once before they complete their functions.
Common Parameters for SFCs Identifying the Job If you trigger a hardware interrupt, output control commands to DP slaves, start a data transfer, or abort a non-configured connection with one of the SFCs listed above and then call the same SFC again before the current job is completed, the reaction of the SFC will depend on whether or not the second call involves the same job. The following table explains which input parameters specify the job for each of these SFCs.
Common Parameters for SFCs Output Parameters RET_VAL and BUSY The status of the job execution is indicated by the output parameters RET_VAL and BUSY. Refer also to the note in Evaluating Errors with the Output Parameter RET_VAL. • In Case 1 (first call with REQ=1), W#16#7001 is entered in RET_VAL if system resources are free and the input parameters are correct. BUSY is then set.
Common Parameters for SFCs Overview The following table provides you with an overview of the relationships explained above. In particular, it shows the possible values of the output parameters if the execution of the job is not completed after an SFC has been called. Note Following every call, you must evaluate the relevant output parameters in your program. Relationship between Call, REQ, RET, RET_VAL, and BUSY during the execution of a job.
Common Parameters for SFCs 2-10 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
3 Copy and Block Functions 3.1 Copying Memory Area with SFC 20 "BLKMOV" Description You use SFC 20 "BLKMOV" (block move) to copy the contents of a memory area (= source area) to another memory area (= destination area).
Copy and Block Functions Interruptability As long as the source area is not part of a data block that only exists in the load memory, there is no limit to the nesting depth. If, however, SFC 20 is interrupted while copying from a DB that is not relevant to program execution, the execution of SFC 20 can no longer be nested. Parameter Declaration Data Type Memory Area Description SRCBLK INPUT ANY I, Q, M, D, L Specifies the memory area to be copied (source area).
Copy and Block Functions Error Information Error Code (W#16#...) Explanation 0000 No error 8091 Nesting depth exceeded. 8092 The SFC 20 "BLKMOV" cannot be executed because a non-executable block was being accessed. Use SFC 83 to do this.
Copy and Block Functions 3.2 Uninterruptible Copying of Variables with SFC 81 "UBLKMOV" Description With SFC 81 "UBLKMOV" (uninterruptible block move), you can copy the contents of a memory area (= source area) consistently to a different memory area (= destination area). The copy operation cannot be interrupted by other operating system activities.
Copy and Block Functions Note The source and destination areas must not overlap. If the specified destination area is larger than the source area, the function only copies as much data to the destination area as is contained in the source area. If the specified destination area is smaller than the source area, the function only copies as much data as can be written to the destination area.
Copy and Block Functions 3.3 Initializing a Memory Area with SFC 21 "FILL" Description With SFC 21 "FILL," you can initialize a memory area (destination area) with the contents of another memory area (source area). The SFC copies the contents of the specified destination area until the memory area is completely full. Note The source and destination field must not overlap.
Copy and Block Functions Exceptions The following cannot be used as the source field: • Counters • Timers You cannot write values to the following using SFC 21: • The following block types: FB, SFB, FC, SFC, SDB, • Counters, • Timers, • Memory areas of the peripheral I/O area.
Copy and Block Functions 3.4 Creating a Data Block with SFC 22 "CREAT_DB" Description With SFC 22 "CREAT_DB" (create data block), you create a data block that does not contain initialized values. Instead, it contains random data. The SFC creates a data block of a selectable length with a block number taken from a specified range. The SFC assigns the lowest possible number to the DB from the specified range.
Copy and Block Functions Error Information Error Code Explanation (W#16#...) 0000 No error occurred. 8091 You have called SFC 22 nested. 8092 The "create DB" function cannot be executed currently because 80A1 80A2 • The "compress user memory" function is currently active • The number of DBs in the CPU has already reached the maximum possible number. • The H CPU is running coupling or update functions.
Copy and Block Functions 3.5 Deleting a Data Block with SFC 23 "DEL_DB" Description With SFC 23 "DEL_DB" (delete data block) you delete a data block located in the work memory and, if present, in the load memory of the CPU. The DB to be deleted must not be open in the current or in any lower priority class, in other words, it must not be entered in either of the two DB registers or in the B stack. Otherwise the CPU starts OB°121 when SFC 23 is called.
Copy and Block Functions Error Information Error Code (W#16#...) Explanation 0000 No error occurred. 8091 SFC 23 calls were nested and the maximum nesting level of the CPU used was exceeded. 8092 The "delete DB" function cannot be executed currently because 80A1 • The "compress user memory" function is currently active. • You are copying the DB to be deleted from the CPU to an offline project. • The H CPU is running coupling or update functions.
Copy and Block Functions 3.6 Testing a Data Block with SFC 24 "TEST_DB" Description With SFC 24 "TEST_DB" (test data block), you obtain information about a data block located in the work memory of the CPU. The SFC queries the number of data bytes in the selected DB and checks whether or not the DB is read only.
Copy and Block Functions 3.7 Compressing the User Memory with SFC 25 "COMPRESS" Gaps in Memory Gaps can occur in the load memory and in the work memory if data blocks are deleted and reloaded several times. These gaps reduce the effective memory area. Description With SFC 25 "COMPRESS," you start compression of the RAM section of both the load memory and the work memory. The compression function is the same as when started externally in the RUN-P mode (mode selector setting).
Copy and Block Functions Error Information Error Code (W#16#...) Explanation 0000 No error occurred. The compression function was started by SFC 25. Evaluation of the output parameters BUSY and DONE by the user program (see above) only provides useful information when this is the case. 8091 The compression function was started externally and is still active.
Copy and Block Functions 3.8 Transferring a Substitute Value to Accumulator 1 with SFC 44 "REPL_VAL" Description With SFC 44 "REPL_VAL" (replace value), you transfer a value to accumulator 1 of the priority class that caused the error. Restriction: Only in Synchronous Error OBs You can only call SFC 44 "REPL_VAL" in a synchronous error OB (OB121, OB122).
Copy and Block Functions 3.9 Generating Data Blocks in Load Memory with SFC 82 "CREA_DBL" Description With SFC 82 "CREA_DBL" (create data block in load memory) you can create a new data block in the load memory (Micro Memory Card). The SFC 82 generates a default size data block using a number from a specified range and. The SFC 82 assigns the smallest possible number to the DB.
Copy and Block Functions Operating principle The SFC 82 "CREA_DBL" operates asynchronously, that is, processing covers multiple SFC calls. Start the job by calling SFC 82 with REQ = 1. Th job status is displayed via the output parameters RET_VAL and BUSY.
Copy and Block Functions Error Information Error code (W#16#...): Description 0000 No error 0081 The target range is larger than the source range. The source area is written completely to the target area. The remaining bytes of the target area are filled with 0. 7000 First call with REQ=0: no data transfer active; BUSY has the value 0. 7001 First call with REQ=1: no data transfer active; BUSY has the value 1.
Copy and Block Functions 3.10 Reading from a Data Block In Load Memory with SFC 83 "READ_DBL" Description Use SFC 83 "READ_DBL" (read data block in load memory) to copy a DB or an area from a DB in load memory (Micro Memory Card) to the data area of a target DB. The target DB must be relevant for execution; that is, it must not be created with the attribute UNLINKED. The content of the load memory is not changed during the copy process.
Copy and Block Functions Working method The SFC 83 "READ_DBL" is an asynchronous operating SFC, that is, processing covers multiple SFC calls. Start the job by calling SFC 83 with REQ = 1. The job status is displayed via the output parameters RET_VAL and BUSY.
Copy and Block Functions 3.11 Writing a Data Block in Load Memory with SFC 84 "WRIT_DBL" Description With the SFC 84 "WRIT_DBL" (write data block in load memory) you can transfer the contents of a DB or a DB area from the work memory to a DB or a DB area in the Micro Memory Card. The source DB must be process relevant; that is, it must not have been created with the attribute UNLINKED. However, it may also be generated with SFC 22 "CREAT_DB".
Copy and Block Functions Operating principle The SFC 84 "WRIT_DBL" operates asynchronously, that is, processing covers multiple SFC calls. Start the job by calling SFC 84 with REQ = 1. The job status is displayed via the output parameters RET_VAL and BUSY.
Copy and Block Functions 3.12 Creating a Data Block with SFC 85 "CREA_DB" Description With SFC 85 "CREA_DB" (create data block) you create a data block with no default values in the user program. Instead, the DB contains random data. The SFC creates a data block with a number from a specified area and with a default size. The SFC assigns the smallest possible number from this area to the DB. To create a DB with a specific number, enter the same number for the upper and lower limits of the default area.
Copy and Block Functions Error Information Error Code (W#16#...) Description 0000 No error 8091 You have called SFC 85 nested. 8092 The "Create a DB" function is currently unavailable because • The "Compress User Memory" function is currently active • The WinAC software CPU has detected an error in the OS of the computer on which WinAC is installed.
4 SFCs for Controlling Program Execution 4.1 Re-triggering Cycle Time Monitoring with SFC 43 "RE_TRIGR" Description With SFC 43 "RE_TRIGR" (re-trigger watchdog), you can re-trigger the cycle time monitoring. Parameters SFC 43 "RE_TRIGR" has no parameters. Error Information SFC 43 "RE_TRIGR" does not provide any error information. 4.2 Changing the CPU to STOP with SFC 46 "STP" Description With SFC 46 "STP" (stop), you change the CPU to the STOP mode.
SFCs for Controlling Program Execution 4.3 Delaying Execution of the User Program with SFC 47 "WAIT" Description With SFC 47 "WAIT," you program delays or waiting times in your user program. You can program waiting times up to 32767 µs. The smallest possible waiting time depends on the particular CPU and is the same as the execution time of SFC 47. Interrupt ability SFC 47 "WAIT" can be interrupted by higher priority OBs.
SFCs for Controlling Program Execution 4.4 Triggering a Multicomputing Interrupt with SFC 35 "MP_ALM" Description Calling SFC 35 "MP_ALM" during multicomputing triggers the multicomputing interrupt. This leads to a synchronized start of OB 60 on all CPUs involved. In the single processor mode and when operating with a segmented rack, OB 60 is only started on the CPU that called SFC 35. You can indicate the cause of the multicomputing interrupt using the JOB input parameter.
SFCs for Controlling Program Execution 4.5 Controlling CiR with SFC 104 "CiR" Description You can use SFC 104 "CiR" to influence a reconfiguration in RUN mode as follows: • You can disable CiR completely. In this case, the download of a modified configuration from the PG to the CPU is always rejected. The lock is maintained until you reset it with SFC 104 "CiR". • You can specify a high limit for the CiR synchronization time to disable CiR conditionally.
SFCs for Controlling Program Execution Error information Error code (W#16#...) Explanation 0000 The job was executed without error. (This error code is only available when MODE=1 or MODE=2 or MODE=3.) 0001 CiR is enabled. (This error code is only available when MODE=0.) 0002 CiR is disabled completely. (This error code is only available when MODE=0.) 0003 CiR is disabled conditionally. (This error code is only available when MODE=0.) 8001 The CPU is not ready for a CiR operation.
SFCs for Controlling Program Execution 4-6 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
5 SFCs for Handling the System Clock 5.1 Setting the TOD with SFC 0 "SET_CLK" Description With SFC 0 "SET_CLK" (set system clock), you set the time and the date of the CPU clock. The SFC 0 call starts the clock. The clock then runs starting from the set time and set date. If the clock is a master clock, the CPU also starts to synchronize the time when SFC 0 is called. You set the synchronization intervals using STEP 7.
SFCs for Handling the System Clock 5.2 Reading the Time with SFC 1 "READ_CLK" Description With SFC 1 "READ_CLK" (read system clock), you read the current date or current time of the system clock of the CPU. Parameter Declaration Data Type Memory Area Description RET_VAL OUTPUT INT I, Q, M, D, L If an error occurs during the execution of the function, the return value contains an error code. CDT OUTPUT DT D,L The current date and current time are output at the CDT output.
SFCs for Handling the System Clock 5.3 Synchronizing Slave Clocks with SFC 48 "SNC_RTCB" Definition: Synchronizing Slave Clocks Synchronizing slave clocks refers to the transmission of the date and time from the master clock of a bus segment (for example, the S7-400 K-bus, MPI, or S7 backplane bus) to all clock slaves of the bus segment.
SFCs for Handling the System Clock 5.4 Setting the Time-of-Day and the TOD Status with SFC 100 "SET_CLKS" Description Set the TOD and the TOD status for your CPU with SFC 100 "SET_CLKS". Caution Only use SFC 100 if the TOD for your CPU is not going to synchronized. Otherwise, with every synchronization the master’s TOD status would be applied. This would overwrite the value specified per SFC. Via the MODE parameter you can specify whether to change only the TOD, only the TOD status or both.
SFCs for Handling the System Clock Parameters Declaration Data type Memory Area Description MODE INPUT BYTE I, Q, M, D, L, constant Operating mode Possible values: B#16#01: Setting the TOD B#16#02: Setting the TOD status B#16#03: Setting the TOD and the TOD status PDT INPUT DT D, L Default TOD CORR INPUT INT I, Q, M, D, L, constant Correction value (in 0.
SFCs for Handling the System Clock 5-6 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
6 SFCs for Handling Run-Time Meters 6.1 Runtime Meters Introduction The CPUs have a number of runtime meters (refer to the data sheets of your CPUs). • If your CPU is equipped with 16-bit runtime meters, you can set, start, stop or read them with the SFCs 2, 3 and 4. • If your CPU is equipped with 32-bit runtime meters, you can set, start, stop or read them with SFC 101 "RTM". Note SFCs 2, 3 and 4 can also be used for 32-bit runtime meters.
SFCs for Handling Run-Time Meters 6.2 Handling Runtime meters with SFC 101 "RTM" Description Call SFC 101 "RTM" (runtime meter) to set, start, stop and read a 32-bit runtime meter of your CPU. To fetch the values of all 32-bit runtime meters of your CPU, call SFC 51 "RDSYSST" with SZL_ID=W#16#0132 and INDEX=W#16#000B (for runtime meters 0 … 7) or INDEX=W#16#000C (for runtime meters 8 … 15). (See also Data Record of the Partial List Extract with SSL-ID W#16#0132 Index W#16#000B.
SFCs for Handling Run-Time Meters Error information Error code W#16#...) Explanation 0000 No error 8080 Wrong runtime meter number 8081 A negative value was passed to parameter PV. 8082 Overflow of the runtime meter. 8091 Illegal value in input parameter MODE.
SFCs for Handling Run-Time Meters 6.3 Setting the Runtime Meter with SFC 2 "SET_RTM" Description With SFC 2 "SET_RTM" (set runtime meter), you set a runtime meter of the CPU to a selected value. The number of runtime meters you can set depends on the particular CPU you are using. Parameter Declaration Data Type Memory Area Description NR INPUT BYTE I, Q, M, D, L, constant Input NR contains the number of the runtime meter you want to set (possible values: 0 to 7).
SFCs for Handling Run-Time Meters 6.4 Starting and Stopping a Run-time Meter with SFC 3 "CTRL_RTM" Description With SFC 3 "CTRL_RTM" (control runtime meter), you can start or stop a runtime meter of the CPU. Parameter Declaration Data Type Memory Area Description NR INPUT BYTE I, Q, M, D, L, constant Input NR contains the number of the runtime meter you want to start or stop (possible values: 0 to 7). S INPUT BOOL I, Q, M, D, L, constant Input S starts or stops the runtime meter.
SFCs for Handling Run-Time Meters 6.5 Reading a Runtime Meter with SFC 4 "READ_RTM" Description With SFC 4 "READ_RTM" (read runtime meter), you read a runtime meter. SFC 4 provides the current run time as output data and the status of the counter, for example, "stopped" or "counting." If the runtime meter runs for longer than 32767 hours, it stops at the count 32767 and outputs the error message "overflow.
SFCs for Handling Run-Time Meters 6.6 Reading the System Time with SFC 64 "TIME_TCK" Description With SFC 64 "TIME_TCK" (time tick), you can read the system time of the CPU. The system time is a "time counter" counting cyclically from 0 to a maximum of 2147483647 ms. In case of an overflow the system time is counted again starting with 0. The resolution and the accuracy of the system time are 1 ms for the S7-400 and CPU 318 and 10 ms for all other S7-300 CPUs.
SFCs for Handling Run-Time Meters 6-8 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
7 SFCs/SFBs for Transferring Data Records 7.1 Writing and Reading Data Records Principle Some modules have a write-only system data area to which your program can transfer data records. This area contains data records with numbers from 0 to a maximum of 240. Not every module contains all of the data records (see following table). Other modules have a read-only system data area in which your program can read data records. This area contains data records with numbers from 0 to a maximum of 240.
SFCs/SFBs for Transferring Data Records Write-Only System Data Area The following table shows the structure of the write-only system data area. This table also shows how long the data records can be and with which SFCs the data records can be written.
SFCs/SFBs for Transferring Data Records System Resources If you start several asynchronous data record transfers one after the other with only short intervals between them, the allocation of system resources by the operating system ensures that all the jobs are executed and that they do not interfere with each other. If all the available system resources are being used, this is indicated in RET_VAL. You can remedy this temporary error situation by simply repeating the job.
SFCs/SFBs for Transferring Data Records 7.2 Reading Defined Parameters with SFC 54 "RD_DPARM" Description With SFC 54 "RD_DPARM" (read defined parameter), you read the data record with the number RECNUM of the addressed module from system data configured with STEP 7. The data record that is read is entered in the destination area opened by the parameter RECORD.
SFCs/SFBs for Transferring Data Records 7.3 Reading Predefined Parameters with SFC 102 "RD_DPARA" Description With SFC 102 "RD_DPARA" you can read the data record with the number RECNUM of a selected module from system data configured with STEP7. The read data record is entered into the target area opened with the parameter RECORD. Operating principle The SFC 102 "RD_DPARA" operates asynchronously, that is, processing covers multiple SFC calls. Start the job by calling SFC 102 with REQ = 1.
SFCs/SFBs for Transferring Data Records 7.4 Writing Dynamic Parameters with SFC 55 "WR_PARM" Description With SFC 55 "WR_PARM" (write parameter), you transfer the data record RECORD to the addressed module. Parameters transferred to the module do not overwrite parameters configured with STEP7. Requirements • The data record to be transferred must not be static. (Refer to /71/ and /101/ for more information on static data records.
SFCs/SFBs for Transferring Data Records 7.5 Writing Default Parameters with SFC 56 "WR_DPARM" Description With SFC 56 "WR_DPARM" (write default parameter), you transfer the data record with the number RECNUM from STEP 7 configuration data to the addressed module. With this function, it is irrelevant whether the data record is static or dynamic.
SFCs/SFBs for Transferring Data Records 7.6 Assigning Parameters to a Module with SFC 57 "PARM_MOD" Description With SFC 57 "PARM_MOD" (assign parameters to a module) you transfer all the data records of a module that you configured with STEP 7 to the module. With this function, it is irrelevant whether the data records are static or dynamic.
SFCs/SFBs for Transferring Data Records Note If you transfer data records to a DPV1 Slave with SFCs 55, 56 or 57 and if this slave operates in DPV1 mode the DP master evaluates the error information it has received from this slave as follows: If the error information lies within the range from W#16#8000 to W#16#80FF or W#16#F000 to W#16#FFFF the DP master passes the error information to the SFC. If it lies out of this range, the CPU passes the value W#16#80A2 to the SFC and suspends the slave.
SFCs/SFBs for Transferring Data Records Error Code (W#16#...) Explanation Restriction 80C1 The data of the previous write job for the same data record on the module have not yet been processed by the module. 1) 80C2 The module is currently processing the maximum possible number of jobs for a CPU. 1) 80C3 The required resources (memory, etc.) are currently occupied. 1) 80C4 Internal temporary error. The job could not be processed. 1) • Repeat the job.
SFCs/SFBs for Transferring Data Records 7.7 Writing a Data Record with SFC 58 "WR_REC" Description With SFC 58 "WR_REC" (write record), you transfer the data record contained in RECORD to the addressed module. You start the write job by assigning the value 1 to the input parameter REQ when SFC 58 is called. If the write job could be executed immediately, the SFC returns the value 0 at the output parameter BUSY. If BUSY has the value 1, writing is not yet completed.
SFCs/SFBs for Transferring Data Records Error Information Reading a Data Record with SFC 59 "RD_REC" Note If the general error W#16#8544 occurs, this only indicates that access to at least one byte of the I/O memory area containing the data record was denied. The data transfer was continued.
SFCs/SFBs for Transferring Data Records 7.8 Reading a Data Record with SFC 59 "RD_REC" Description With SFC 59 "RD_REC" (read record), you read the data record with the number RECNUM from the addressed module. You start the read job by calling SFC 59 and assigning the value 1 to the input parameter REQ. If the read job could be executed immediately, the SFC returns the value 0 in the BUSY output parameter. If BUSY has the value 1, the read job is not yet completed.
SFCs/SFBs for Transferring Data Records Parameter Declaration Data Type Memory Area Description RECORD I, Q, M, D, L OUTPUT ANY Destination area for the data record read. With asynchronous execution of SFC 59, make sure that the actual parameters of RECORD have the same length information for all calls. Only data type BYTE is permitted. Output Parameter RET_VAL • If an error occurred while the function was being executed, the return value contains an error code.
SFCs/SFBs for Transferring Data Records Using Old S7-300 FMs and CPs with Data Record Numbers > 1 If you want to read out a data record with a number higher than 1 from an old S7-300 FM or old S7-300 CP using SFC 59 "RD_REC," remember the following points: • If the destination area is larger than the actual length of the required data record, no data are entered in RECORD. RET_VAL has the value W#16#80B1.
SFCs/SFBs for Transferring Data Records Error Code (W#16#...) Explanation Restriction 0000 No error - 7000 First call with REQ=0: No data transfer active; BUSY has the value 0. - 7001 First call with REQ=1: No data transfer active; BUSY has the value 1. Distributed I/Os 7002 Interim call (REQ irrelevant): Data transfer already active; BUSY has the value 1. Distributed I/Os 8090 Specified logical base address invalid: There is no assignment in SDB1/SDB2x or there is no base address.
SFCs/SFBs for Transferring Data Records Error Code (W#16#...) Explanation Restriction 80B1 The length specified in the RECORD parameter is incorrect. • SFC 58 "WR_REC": Length incorrect • SFC 59 "RD_REC" (only when using old S7-300 FMs and S7300 CPs): specified length > record length • With SFC 13 "DPNRM_DG": specified length > record length 80B2 The configured slot is not occupied.
SFCs/SFBs for Transferring Data Records 7.10 Reading Predefined Parameters with SFB 81 "RD_DPAR" Description SFB 81 "RD_DPAR" (read device parameter) lets you read the data record with the INDEX number of the component addressed from the system data configured with STEP 7. This can be a centrally inserted module or a distributed component (PROFIBUS DP or PROFINET IO). The value TRUE for the VALID output parameter indicates that the data record was successfully transferred to the RECORD destination area.
8 DPV1 SFBs According to PNO AK 1131 8.1 Reading a Data Record with SFB 52 "RDREC" Note The SFB 52 "RDREC" interface is identical to the FB "RDREC" defined in the standard "PROFIBUS Guideline PROFIBUS Communication and Proxy Function Blocks according to IEC 61131-3". Description With the SFB 52 "RDREC" (read record) you read a data record with the number INDEX from a DP slave/PROFINET IO device component (module or submodule) that has been addressed via ID.
DPV1 SFBs According to PNO AK 1131 Operating principle The SFC 52 "RDREC" operates asynchronously, that is, processing covers multiple SFC calls. Start the job by calling SFC 52 with REQ = 1. The job status is displayed via the output parameter BUSY and bytes 2 and 3 of output parameter STATUS. Here, the STATUS bytes 2 and 3 correspond with the output parameter RET_VAL of the asynchronously operating SFCs (see also Meaning of the Parameters REQ, RET_VAL and BUSY with Asynchronous SFCs).
DPV1 SFBs According to PNO AK 1131 8.2 Writing a Data Record with SFB 53 "WRREC" Note The SFB 52 "WRREC" interface is identical to the FB "WRREC" defined in the standard "PROFIBUS Guideline PROFIBUS Communication and Proxy Function Blocks according to IEC 61131-3" Description With the SFB 52 "WRREC" (write record) you transfer a data record with the number INDEX to a DP slave/PROFINET IO device component (module or submodule) that has been addressed via ID.
DPV1 SFBs According to PNO AK 1131 Operating principle The SFC 53 "WRREC" operates asynchronously, that is, processing covers multiple SFC calls. Start the job by calling SFC53 with REQ = 1. The job status is displayed via the output parameter BUSY and bytes 2 and 3 of output parameter STATUS. Here, the STATUS bytes 2 and 3 correspond with the output parameter RET_VAL of the asynchronously operating SFCs (see also Meaning of the Parameters REQ, RET_VAL and BUSY with Asynchronous SFCs).
DPV1 SFBs According to PNO AK 1131 8.3 Receiving an Interrupt with SFB 54 "RALRM" Note The SFB 52 "RALRM" interface is identical to the FB "RALRM" defined in the standard "PROFIBUS Guideline PROFIBUS Communication and Proxy Function Blocks according to IEC 61131-3" Description The SFB "RALRM" receives an interrupt with all corresponding information from a peripheral module (centralized structure) or from a DP slave or PROFINET IO device component. It supplies this information to its output parameters.
DPV1 SFBs According to PNO AK 1131 Parameters Declaration Data type Memory Area Description MODE INPUT INT I, Q, M, D, L, constant Operating mode F_ID INPUT DWORD I, Q, M, D, L, constant Logical start address of the component (module) from which interrupts are to be received MLEN INPUT INT I, Q, M, D, L, constant maximum length in bytes of the data interrupt information to be received NEW OUTPUT BOOL I, Q, M, D, L A new interrupt was received.
DPV1 SFBs According to PNO AK 1131 Structure of the address (bytes 20 and 21) The address contains: • In a central configuration, the rack number (0-31). • In a distributed configuration with PROFIBUS DP - The DP master system ID (1-31) - The station number (0-127). • In a distributed configuration with PROFINET IO: - The last two position in the PROFINET IO system ID (0-15). To obtain the complete PROFINET IO system ID, you must add 100 (decimal) to it. - The station number (0-2047).
DPV1 SFBs According to PNO AK 1131 Structure of the Management Information for Bytes 20 to 25 Byte no.
DPV1 SFBs According to PNO AK 1131 Byte no.
DPV1 SFBs According to PNO AK 1131 Data Structure of the Target Area AINFO with Interrupts from PROFINET DP or Central IO Devices The information for PROFINET IO are found further below.
DPV1 SFBs According to PNO AK 1131 Data Structure of the Target Area AINFO with Interrupts from PROFINET IO Byte Meaning 0 to 25 Header information, for an exact description, see below 26 to 1431 Additional interrupt information: standardized diagnostic data for each interrupt: ARRAY[0] to ARRAY[1405] Note: The additional interrupt information may also be omitted.
DPV1 SFBs According to PNO AK 1131 Byte Data type 24 to 25 WORD Meaning Interrupt specifier: • Bits 0 to 10: Sequence number (range of values: 0 to 2047) • Bit 11: Channel diagnostics: 0: No channel diagnostics available 1: Channel diagnostics available • Bit 12: Status of manufacturer-specific diagnostics : 0: No manufacturer-specific status information available 1: Manufacturer-specific status information available • Bit 13: Status of diagnostics for interface module: 0: No status information
DPV1 SFBs According to PNO AK 1131 Structure of Additional Interrupt Information with Interrupts from PROFINET IO, Case 2 The additional interrupt information for PROFINET IO depends on the format identifier. If information on channel diagnostics is to be transmitted, the IO device uses the format identifier W#16#8000. The channel diagnosis is output in blocks of 6 bytes each. The additional interrupt information (with out format identifier) is only output for faulty channels.
DPV1 SFBs According to PNO AK 1131 Byte Data type 6 to 7 WORD Meaning Type of error: • W#16#0000: reserved • W#16#0001: short circuit • W#16#0002: undervoltage • W#16#0003: overload • W#16#0004: overload • W#16#0005: excessive temperature • W#16#0006: line break • W#16#0007: upper limit value overshot • W#16#0008: lower limit value undershot • W#16#0009: error • W#16#000A to W#16#000F: reserved • W#16#0010 to W#16#001F: manufacturer-specific • W#16#0020 to W#16#00FF: reserved
DPV1 SFBs According to PNO AK 1131 Structure of Additional Interrupt Information with Interrupts from PROFINET IO, Case 3 The additional interrupt information for PROFINET IO depends on the format identifier. If different types of diagnostic information is to be transmitted, the IO device uses the format identifier W#16#8001 (MULTIPLE). In this case, the additional interrupt information is transmitted as blocks of variable length.
DPV1 SFBs According to PNO AK 1131 Target Area TINFO and AINFO Dependent on the respective OB in which SFB54 is called, the target areas TINFO and AINFO are only partially written. Refer to the table below for information on which info is entered respectively.
DPV1 SFBs According to PNO AK 1131 Error Information The output parameter STATUS contains information. It is interpreted as ARRAY[1...4] OF BYTE the error information has the following structure: Field element Name: Meaning STATUS[1] Function_Num • B#16#00, if no error • Function ID from DPV1-PDU: In error case B#16#80 is OR linked. If no DPV1 protocol element is used: B#16#C0.
DPV1 SFBs According to PNO AK 1131 STATUS[3] can have the following values: Error_Decode Error_Code_1 Explanation (B#16#...) (B#16#...
DPV1 SFBs According to PNO AK 1131 Error_Decode Error_Code_1 Explanation (B#16#...) (B#16#...) according to DVP1 Meaning AA to AF user specific DP slave or module reports a manufacturer-specific error in its application. Please check the documentation from the manufacturer of the DP slave or module.
DPV1 SFBs According to PNO AK 1131 Error_Decode Error_Code_1 Explanation (B#16#...) (B#16#...) according to DVP1 Meaning 81 00 to FF Error in the initial call parameter (with SFB54: MODE) 00 Illegal operating mode 00 to FF Error in the second call parameter : : : 88 00 to FF Error in the eighth call parameter (with SFB54: TINFO) 82 89 01 Wrong syntax ID 23 Quantity frame exceeded or target area too small 24 Wrong range ID 32 DB/DI no. out of user range 3A DB/DI no.
DPV1 SFBs According to PNO AK 1131 8.4 Sending an Interrupt to the DP Master with SFB 75 "SALRM" Note The SFB 75 "SALRM" interface is identical to the FB "SALRM" defined in the standard "PROFIBUS Guideline PROFIBUS Communication and Proxy Function Blocks according to IEC 61131-3" Description SFB 75 "SALRM" sends an interrupt for a slot from the user program of an intelligent slave to the associated DP master, which accesses it in the transitional area (virtual slot).
DPV1 SFBs According to PNO AK 1131 Identifying the job When you initiate the transfer of an interrupt to the DP masters with SFB 75 and then call this SFB once again before the current job has been completed, the further response of this SFB will depend on whether or not the new call is identical to the previous one. If the parameters ID and TYPE match a still unfinished job, the new call of the SFB call will be treated in sequential order.
DPV1 SFBs According to PNO AK 1131 ATYPE parameter The following table shows all permissible values for ATYPE, which OB is started in the associated master, and in which DP mode the given interrupt type is permitted.
DPV1 SFBs According to PNO AK 1131 LEN parameters The LEN parameter specifies the length in bytes of the additional interrupt information to be sent. The maximum permitted range of values is 0 to 16. For all possible interrupt types, the following table shows the values LEN can have for the individual modes of an intelligent slave.
DPV1 SFBs According to PNO AK 1131 Effect of the SFB75 call on the module status information and the group error LED (SF) As for any CPU, the slot properties for an intelligent slave are stored in the module status information (see SSL-ID W#16#xy91 - Module Status Information) When you use SFB 75 to send a diagnostic interrupt, the operating system at the intelligent slave influences the slave-local module status information and the SF LED based on bit 0 in byte 0 in AINFO (this bit is added to the status
DPV1 SFBs According to PNO AK 1131 Note All the above-mentioned differences between the module status information at the master and the I slave can only occur at those slots that receive diagnostic interrupts by means of SFB 75. This means that the remedies discussed above only apply to such slots. Error information The STATUS output parameter contains error information. If it is interpreted as ARRAY[1 ...
DPV1 SFBs According to PNO AK 1131 ERROR STATUS[2,3] (W#16# ...) Explanation 1 80C5 Distributed I/O device is not available at this time (i.e. station failure) 1 80C8 The function is not permitted in the current DP master operating mode (the DP master is an S7 master and is in STOP mode).
DPV1 SFBs According to PNO AK 1131 8-28 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
9 SFCs for Handling Time-of-Day Interrupts 9.1 Handling Time-of-Day Interrupts Definition A time-of-day interrupt results in one of the time-of-day interrupt OBs (OB10 to OB 17) being called. Conditions for the Call Before a time-of-day interrupt OB can be called by the operating system, the following conditions must be met: • The time-of-day interrupt OB must have parameters assigned to it (start date and time, execution) using either - STEP 7 or - SFC 28 "SET_TINT" in the user program.
SFCs for Handling Time-of-Day Interrupts 9.2 Characteristics of SFCs 28 to 31 What Happens If... The following table lists a number of different situations and explains the effect they have on a time-of-day interrupt. If ... Then ... A time-of-day interrupt is set (by calling SFC 28; The current time-of-day interrupt is canceled. SET_TINT) The time-of-day interrupt is canceled (by calling The start date and time are cleared.
SFCs for Handling Time-of-Day Interrupts Executing the Time-of-Day Interrupt OBs The following table shows the different effects of the "execution" parameter. You set this parameter with STEP 7 or with SFC 28 "SET_TINT" (input parameter PERIOD). Execution of the Time-of-Day Reaction Interrupt OBs None (can only be set with STEP 7) The time-of-day interrupt OB is not executed even when it exists in the CPU.
SFCs for Handling Time-of-Day Interrupts 9.3 Setting a Time-of-Day Interrupt with SFC 28 "SET_TINT" Description With SFC 28 "SET_TINT" (set time-of-day interrupt), you set the start date and time of time-of-day interrupt organization blocks. The seconds and milliseconds of the specified start time are ignored and set to 0. Parameter Declaration Data Type Memory Area Description OB_NR INPUT INT I, Q, M, D, L, constant Number of the OB started at the time SDT + multiple of PERIOD (OB 10 to OB 17).
SFCs for Handling Time-of-Day Interrupts 9.4 Canceling a Time-of-Day Interrupt with SFC 29 "CAN_TINT" Description With SFC 29 "CAN_TINT" (cancel time-of-day interrupt), you cancel an activated time-of-day organization block Parameter Declaration Data Type Memory Area Description OB_NR INPUT INT I, Q, M, D, L, constant Number of the OB, in which the start date and time will be canceled (OB 10 to OB 17).
SFCs for Handling Time-of-Day Interrupts 9.5 Activating a Time-of-Day Interrupt with SFC 30 "ACT_TINT" Description With SFC 30 "ACT_TINT" (activate time-of-day interrupt), you can activate a timeof-day interrupt organization block. Parameter Declaration Data Type Memory Area Description OB_NR INPUT INT I, Q, M, D, L, constant Number of the OB to be activated (OB10 to OB17).
SFCs for Handling Time-of-Day Interrupts 9.6 Querying a Time-of-Day Interrupt with SFC 31 "QRY_TINT" Description Using the system function SFC 31 "QRY_TINT" (query time-of-day interrupt), you can display the status of a time-of-day interrupt organization block at the output parameter STATUS. Parameter Declaration Data Type Memory Area Description OB_NR INPUT INT I, Q, M, D, L, constant Number of the OB, whose status will be queried (OB10 to OB17).
10 SFCs for Handling Time-Delay Interrupts 10.1 Handling Time-Delay Interrupts Definition After you have called SFC 32 "SRT_DINT," the operating system generates an interrupt after the specified delay time has elapsed, in other words, the selected time-delay interrupt OB is called. This interrupt is known as a time-delay interrupt.
SFCs for Handling Time-Delay Interrupts What Happens if... The following table lists a number of different situations and explains the effect they have on a time-delay interrupt. If ... and ... Then ... A time-delay interrupt is started (by calling SFC 32 "SRT_DINT"). The time-delay interrupt has already started. The delay time is overwritten; the time-delay interrupt is started again. The time-delay interrupt OB does not exist at the time of the call.
SFCs for Handling Time-Delay Interrupts 10.2 Starting a Time-Delay Interrupt with SFC 32 "SRT_DINT" Description With SFC 32 "SRT_DINT" (start time-delay interrupt), you start a time-delay interrupt that calls a time-delay interrupt organization block once the delay time has elapsed (parameter DTIME). With the SIGN parameter, you can enter an identifier that identifies the start of the time-delay interrupt.
SFCs for Handling Time-Delay Interrupts 10.3 Querying a Time-Delay Interrupt with SFC 34 "QRY_DINT" Description With SFC 34 "QRY_DINT" (query time-delay interrupt), you can query the status of a time-delay interrupt OB. Time-delay interrupts are managed by organization blocks OB20 to OB23. Parameter Declaration Data Type Memory Area Description OB_NR INPUT INT I, Q, M, D, L, constant Number of the OB, whose STATUS will be queried (OB20 to OB23).
SFCs for Handling Time-Delay Interrupts 10.4 Canceling a Time-Delay Interrupt with SFC 33 "CAN_DINT" Description With SFC 33 "CAN_DINT" (cancel time-delay interrupt), you cancel a time-delay interrupt that has already started (see Section Starting a Time-Delay Interrupt with SFC 32 "SRT_DINT"). The time-delay interrupt OB is then not called. Parameter Declaration Data Type Memory Area Description OB_NR INPUT INT I, Q, M, D, L, constant Number of the OB to be canceled (OB20 to OB23).
SFCs for Handling Time-Delay Interrupts 10-6 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
11 SFCs for Handling Synchronous Errors 11.1 Masking Synchronous Errors Introduction Synchronous errors are programming and access errors. Such errors occur as a result of programming with incorrect address areas, numbers, or incorrect addresses. Masking these synchronous errors means the following: • Masked synchronous errors do not trigger an error OB call and do not lead to a programmed alternative reaction. • The CPU "records" the masked errors that have occurred in an error register.
SFCs for Handling Synchronous Errors Handling Errors in General If programming and access errors occur in a user program, you can react to them in different ways: • You can program an error OB that is called by the operating system when the corresponding error occurs. • You can disable the error OB call individually for each priority class. In this case, the CPU does not change to STOP when an error of this type occurs in the particular priority class. The CPU enters the error in an error register.
SFCs for Handling Synchronous Errors Programming Error Filter The following figure shows the bit pattern of the error filter for programming errors. The error filter for programming errors is located in the parameters PRGFLT_... Refer to the Possible Error Causes for Programming Errors, Low Word or the Possible Error Causes for Programming Errors High Word Note Bits 29 ("SFC not loaded") and 31 ("SFB not loaded") in the high word of the programming error filter are only relevant for S7-400 and CPU 318.
SFCs for Handling Synchronous Errors Access Error Filter for all CPUs The following figure shows you the bit pattern of the error filter for access errors for all CPUs except CPU 417 and CPU 417H. The error filter for access errors is in the parameters ACCFLT_... For an explanation of the access errors, refer to the table "Possible Causes of Errors for all CPUs 31x except the CPU 318" or "Possible Causes of Errors for all CPUs CPUs 41x and CPU 318.
SFCs for Handling Synchronous Errors Programming Error Low Word The following table lists the errors assigned to the low word of the error filter for programming errors. The table also shows the possible causes of the errors. Possible Causes of Programming Errors, Low Word Error Event ID Error Occurs ... (W#16#...
SFCs for Handling Synchronous Errors Programming Error High Word The following table lists the errors assigned to the high word of the error filter for programming errors. The possible causes of errors are also listed. Possible Causes of Programming Errors, High Word Error Event ID Error Occurs ... (W#16#...) Write error data block 2530 ... when the data block to be written to is read only. Write error instance data block 2531 ... when the instance data block to be written to is read only.
SFCs for Handling Synchronous Errors 11.2 Masking Synchronous Errors with SFC 36 "MSK_FLT" Description With SFC 36 "MSK_FLT" (mask synchronous errors), you can control the reaction of the CPU to synchronous errors. With this SFC, you can mask the synchronous errors using the error filter (see Masking Synchronous Errors). When you call SFC 36, you mask the synchronous errors in the current priority class.
SFCs for Handling Synchronous Errors 11.3 Unmasking Synchronous Errors with SFC 37 "DMSK_FLT" Description With SFC 37 "DMSK_FLT" (unmask synchronous errors), you unmask the errors masked with SFC 36 "MSK_FLT." To do this, you must set the corresponding bits of the error filter to "1" in the input parameters. With the SFC 37 call, you unmask the corresponding synchronous errors of the current priority class. At the same time, the entries are cleared in the error register.
SFCs for Handling Synchronous Errors 11.4 Reading the Error Register with SFC 38 "READ_ERR" Description Using SFC 38 "READ_ERR" (read error register), you can read the error register. The structure of the error register corresponds to that of the programming and access error filters which you can program as input parameters with SFC 36 and SFC 37. In the input parameters, you enter the synchronous errors you want to read from the error register.
SFCs for Handling Synchronous Errors 11-10 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
12 SFCs for Handling Interrupts and Asynchronous Errors 12.1 Delaying and Disabling Interrupt and Asynchronous Errors Purpose of SFC 39 to SFC 42 With these SFCs, you can achieve the following: • Disable interrupts and asynchronous errors with SFC 39 "DIS_IRT" for all subsequent CPU cycles. • Delay higher priority classes with SFC 41 "DIS_AIRT" until the end of the OB. • Enable interrupts and asynchronous errors with SFC 40 "EN_IRT" or SFC 42 "EN_AIRT.
SFCs for Handling Interrupts and Asynchronous Errors Interrupt Classes The interrupts are divided into various classes. The following table lists all the interrupt classes and the corresponding OBs.
SFCs for Handling Interrupts and Asynchronous Errors 12.2 Disabling the Processing of New Interrupts and Asynchronous Errors with SFC 39 "DIS_IRT" Description With SFC 39 "DIS_IRT" (disable interrupt), you disable the processing of new interrupts and asynchronous errors.
SFCs for Handling Interrupts and Asynchronous Errors MODE MODE Meaning 00 All newly occurring interrupts and asynchronous errors are disabled. (Synchronous errors are not disabled.) Assign the OB_NR parameter the value 0. Entries continue to be made in the diagnostic buffer. 01 All newly occurring events belonging to a specified interrupt class are disabled.
SFCs for Handling Interrupts and Asynchronous Errors 12.3 Enabling the Processing of New Interrupts and Asynchronous Errors with SFC 40 "EN_IRT" Description With SFC 40 "EN_IRT" (enable interrupt), you enable the processing of new interrupts and asynchronous errors that you previously disabled with SFC 39 "DIS_IRT." This means that if an interrupt event occurs, the operating system of the CPU reacts in one of the following ways: • It calls an interrupt OB or asynchronous error OB.
SFCs for Handling Interrupts and Asynchronous Errors Error Information Error Code (W#16#...) Explanation 0000 No error occurred. 8090 The input parameter OB_NR contains an illegal value. 8091 The input parameter MODE contains an illegal value.
SFCs for Handling Interrupts and Asynchronous Errors 12.4 Delaying the Processing of Higher Priority Interrupts and Asynchronous Errors with SFC 41 "DIS_AIRT" Description With SFC 41 "DIS_AIRT" (disable alarm interrupts), you delay the processing of interrupt OBs and asynchronous error OBs which have a higher priority than that of the current OB. You can call SFC 41 more than once in an OB. The SFC 41 calls are counted by the operating system.
SFCs for Handling Interrupts and Asynchronous Errors 12.5 Enabling the Processing of Higher Priority Interrupts and Asynchronous Errors with SFC 42 "EN_AIRT" Description With SFC 42 "EN_AIRT" (enable alarm interrupts), you enable the processing of higher priority interrupts and asynchronous errors that you previously disabled with SFC 41 "DIS_AIRT." Each SFC 41 call must be canceled by an SFC 42 call.
13 SFCs for Diagnostics 13.1 System Diagnostics The CPUs maintain internal data about the status of the programmable logic controller. With the system diagnostics functions, you can read out the most important data. Some of the data can be displayed on the programming device using STEP 7. You can also access the data required for system diagnostics in your program, by using the SFCs "RD_SINFO" and "RDSYSST." 13.
SFCs for Diagnostics TOP_SI and START_UP_SI The output parameters TOP_SI and START_UP_SI are two structures with identical elements (see following table).
SFCs for Diagnostics Example The OB that was called last and that has not yet been completely processed serves as OB 80. The start-up OB that was started last serves as OB 100. The following table shows the assignment of the structure elements of parameter TOP_SI of SFC 6 "RD_SINFO" and the respective local variables of OB 80.
SFCs for Diagnostics 13.3 Reading a System Status List or Partial List with SFC 51 "RDSYSST" Description With system function SFC 51 "RDSYSST" (read system status), you read a system status list or a partial system status list. You start the reading by assigning the value 1 to the input parameter REQ when SFC 51 is called. If the system status could be read immediately, the SFC returns the value 0 at the BUSY output parameter. If BUSY has the value 1, the read function is not yet completed.
SFCs for Diagnostics SSL_HEADER The SSL_HEADER parameter is a structure defined as follows: SSL_HEADER: STRUCT LENTHDR: WORD N_DR: WORD END_STRUCT LENTHDR is the length of a data record of the SSL list or the SSL partial list. • If you have only read out the header information of an SSL list, N_DR contains the number of data records belonging to it. • Otherwise, N_DR contains the number of data records transferred to the destination area. Error Information Error Code (W#16#...
SFCs for Diagnostics SSL_IDs Note For the partial lists that can be read out with SFC 51 "RDSYSST" refer to • /72/ for the S7-300 • The following table for the S7-400. SSL_ID (W#16#...) Partial List INDEX (W#16#...
SFCs for Diagnostics SSL_ID (W#16#...) Partial List INDEX (W#16#...
SFCs for Diagnostics SSL_ID (W#16#...) Partial List INDEX (W#16#...
SFCs for Diagnostics SSL_ID (W#16#...) Partial List INDEX (W#16#...
SFCs for Diagnostics 13.4 Writing a User-Defined Diagnostic Event to the Diagnostic Buffer with SFC 52 "WR_USMSG" Description With SFC 52 "WR_USMSG" (write user element in diagnostic buffer), you write a user-defined diagnostic event to the diagnostic buffer. You can also send the corresponding diagnostic message to all stations logged on for this purpose (by setting the input parameter SEND = TRUE). If an error occurs, the output parameter RET_VAL provides the error information.
SFCs for Diagnostics Station Not Logged On If a user-defined diagnostic message is to be sent (SEND = TRUE) and no station is logged on, • The user-defined diagnostic event is entered in the diagnostic buffer, • The parameter RET_VAL indicates that no station is logged on (RET_VAL = W#16#8091 or W#16#8091. The value W#16#8091 appears with older versions of the CPU).
SFCs for Diagnostics SEND If SEND = TRUE, the user-defined diagnostic message is sent to all logged-on stations. The message is only sent if the station is logged on and if the send buffer is not full. The sending of the element is asynchronous to the user program. EVENTN The EVENTN parameter contains the event ID of the user event. You can enter event IDs of the types W#16#8xyz, W#16#9xyz, W#16#Axyz, W#16#Bxyz.
SFCs for Diagnostics Error Information Error Code (W#16#...) Explanation 0000 No error 0091 No station logged on (diagnostic event entered in the diagnostic buffer) 8083 Data type of INFO1 not permitted 8084 Data type of INFO2 not permitted 8085 EVENTN not permitted 8086 Length of INFO1 not permitted 8087 Length of INFO2 not permitted 8091 (This error code appears only with older versions of the CPU.) No station logged on (diagnostic event entered in the diagnostic buffer).
SFCs for Diagnostics 13.5 Determining the OB Program Runtime with SFC 78 "OB_RT" Description With SFC 78 ”OB_RT” you can determine the run times for individual OBs over different time periods. Note SFC 78 returns the last recorded time values for the required OB, regardless of whether or not this OB is currently being loaded. SFC 78 data are not deleted or overwritten but are rather reset only after a restart (warm start).
SFCs for Diagnostics Parameter Declaration Data type Memory area Meaning LAST_RT OUTPUT DINT I, Q, M, D, L Runtime (in microseconds) of the most recent execution of the specified OB. If the OB for which you request the runtimes is currently being processed: After the first call of SFC 78 during the current execution of the required OB, LAST_RT outputs the last total execution runtime of the OB.
SFCs for Diagnostics Parameter Declaration Data type Memory area Meaning CUR_RT OUTPUT DINT I, Q, M, D, L Expired execution runtime (microseconds) of the specified OB. CUR_RT = 0 if the OB is not or not yet being processed. After processing, the runtime data are applied in LAST_RT and CUR_RT is set to zero. Note: Interrupt times caused by OBs with higher priority are not included in CUR_RT.
SFCs for Diagnostics Error information Event class Error code Explanation 1 to 102 Number of the OB to which information is being transferred. W#16#8080 OB_NR parameter contains an illegal value.
SFCs for Diagnostics 13.6 Diagnosis of the Current Connection Status with SFC 87 "C_DIAG" Description You can use SFC 87 "C_DIAG" to determine the current status of all S7 connections and of all fault-tolerant S7 connections (or their partial connection). Suitable evaluation of these connection data lets you recognize failures of S7 connections as well as of current S7 connections and report these, should the occasion arise, to an operating and visualization system.
SFCs for Diagnostics How Do You Call the SFC 87? The SFC 87 "C_DIAG" offers four possible operating modes which are explained in the table below. MODE (B#16#...
SFCs for Diagnostics Parameters Declaration Data Type Memory Area Description REQ I, Q, M, D, L, constant. Control parameter request to activate I, Q, M, D, L, constant. Job designation MODE INPUT INPUT BOOL BYTE REQ=1: Initialize the job, if not already started Possible values: • B#16#00: The SFC does not copy connection data, but merely transfers an acknowledgement information to the operating system .
SFCs for Diagnostics Organizing the Target Area CON_ARR The read target area is a structure field. A structure is assigned to each connection. Initially, the field does not need to be occupied with valid entries and it may contain invalid entries between two valid entries. The connections are not sorted by connection reference.
SFCs for Diagnostics Parameters Data Type Description DIS_PCON BOOL Transitions of W#16#12 -> W#16#13 and W#16#13 -> W#16#12 of CON_ARR[i].STAT_CON since the last SFC call set CON_ARR[i].DIS_PCON to 1. All other connection status changes do not affect CON_ARR[i].DIS_PCON. Node: • When MODE=B#16#01 and 02, the operating system bit that corresponds with DIS_PCON is reset when connection data are copied to the target area.
SFCs for Diagnostics 13.7 Identifying the Bus Topology of a DP Master System with SFC 103 "DP_TOPOL" Description Call SFC 103 "DP_TOPOL" with its diagnostics repeaters to initiate the identification of the bus topology of a selected a DP master system. All diagnostics repeaters connected to a DP master system are addressed when SFC 103 is called. Note The topology of only one DP master system can be identified at a given time.
SFCs for Diagnostics Operating method SFC 103 "DP_TOPOL" operates asynchronously, that is, its execution requires several SFC calls. Call SFC 103 with REQ = 1 to initiate identification of the DP bus topology and call SFC 103 with R=1 to abort the process. The job status is indicated at the output parameters RET_VAL and BUSY, see also Meaning of the Parameters REQ, RET_VAL and BUSY with Asynchronous SFCs. Note It may take several minutes to identify the topology.
SFCs for Diagnostics Error information When looking at the "real" error information (error codes W#16#8xyz) in the following table, we distinguish between two types of event: • Temporary errors (error codes W#16#80A2 to 80A4, 80C3, 80C5): This type of error is possibly eliminated without user action, meaning it is helpful to call the SFC again (multiple calls, if necessary). Example of a temporary error: Resources required are currently in use (W#16#80C3).
SFCs for Diagnostics 13-26 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
14 SFCs and SFBs for Updating the Process Image and Processing Bit Fields 14.1 Updating the Process Image Input Table with SFC 26 "UPDAT_PI" Description With SFC 26 "UPDAT_PI" (update process image), you update the OB1 process image input table ( = process image section 0) or a process image input section defined with STEP 7. If you configured the repeated signaling of I/O access errors for the system process image table update, the selected process image table will be updated constantly by SFC 26.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields The updating of the OB1 process image input table and the process image input sections that you assigned to an interrupt OB is not influenced by SFC 26 calls. Parameter Declaration Data Type Memory Area Description PART INPUT BYTE I, Q, M, D, L, constant Number of the process image input section to be updated.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields 14.2 Updating the Process Image Output Table with SFC 27 "UPDAT_PO" Description With SFC 27 "UPDAT_PO" (update process outputs), you transfer the signal states of the OB1 process image output table (=process image section 0) or a process image section defined with STEP 7 to the output modules.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields 14.3 Updating the Process Image Partition Input Table in a Synchronous Cycle with SFC 126 "SYNC_PI" Description With SFC 126 "SYNC_PI” you can update a process image partition input table in a synchronous cycle. A user program linked to a DP cycle can use this SFC to consistently and synchronously update input data located in a process image partition. SFC 126 can be interrupted and can only be called in OBs 61, 62, 63 and 64.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields Error information Event class Error code Explanation W#16#8090 Illegal value at parameter PART or and update of the specified process image partition input table is not a not permitted in this OB. The process image partition input table was not updated. W#16#8091 The specified process image partition was still not defined or is not located in a accessible process image area on the CPU.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields 14.4 Updating the Process Image Partition in a Synchronous Cycle with SFC 127 "SYNC_PO" Description With SFC 127 "SYNC_PO” you can update a process image partition output table in a synchronous cycle. A user program linked to a DP cycle can use this SFC to synchronously update output data located in a process image partition and consistently transmit them to I/O devices.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields Error information Event class Error code Explanation W#16#0001 Consistency warning. The update of the process image partition table was distributed over two DP cycles. However, the data in one slave were consistently transferred. W#16#8090 Illegal value at parameter PART or and update of the specified process image partition output table is not a not permitted in this OB. Outputs were not transferred to the I/O devices.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields 14.5 Setting a Bit Field in the I/O Area with SFC 79 "SET" Description Calling SFC 79 "SET" (set range of outputs) has the following effect: • The bit field in the peripheral I/O area selected with the parameters N and SA is set. • The corresponding bits in the process image output table are also set regardless of whether or not they are in a process image section.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields 14.6 Resetting a Bit Field in the I/O Area with SFC 80 "RSET" Description Calling SFC 80 "RSET" (reset range of outputs) has the following effect: • The bit field in the peripheral I/O area selected with the parameters N and SA is reset. • The corresponding bits in the process image output table are also reset regardless of whether or not they are in a process image section.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields 14.7 Implementing a Sequencer with SFB 32 "DRUM" Description SFB 32 "DRUM" implements a sequencer with a maximum of 16 steps. You specify the number of the first step with the DSP parameter and the number of the last step with the LST_STEP parameter. During each step, all 16 output bits OUT0 to OUT15 and the output parameter OUT_WORD (in which the output bits are collected together) are written.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields When the block is called for the first time, you must set 1 at the RESET input. When the sequencer is in the last step (DSC has the value LST_STEP) and when the execution time for this step has expired, outputs Q and EOD are set and the SFB remains in the last step until you set 1 at the RESET input. A DRUM timer runs only in the STARTUP and RUN modes.
SFCs and SFBs for Updating the Process Image and Processing Bit Fields Parameter Declaration Data Type Memory Area Description PREV_TIME VAR DWORD I, Q, M, D, L, constant (Not relevant for the user: system time of the previous SFB call) S_PRESET VAR ARRAY of WORD I, Q, M, D, L, constant One-dimensional array with the time factor for each step. A sensible selection of the indices would be: [1 to 16].In this case, S_PRESET [x] has the time factor of step x.
15 System Functions for Addressing Modules 15.1 Querying the Logical Base Address of a Module with SFC 5 "GADR_LGC" Description Based on the channel of a signal module, the corresponding module slot and the offset user data address area of the module are known. With SFC 5 "GARD_LGC" (convert geographical address to logical address), you can obtain the corresponding logical address of the module, i.e. the least input or output address.
System Functions for Addressing Modules Error Information Error Code (W#16#...) Explanation 0000 No error occurred. 8094 No subnet was configured with the specified SUBNETID. 8095 Illegal value for the RACK parameter. 8096 Illegal value for the SLOT parameter. 8097 Illegal value for the SUBSLOT parameter. 8098 Illegal value for the SUBADDR parameter. 8099 The slot is not configured or occupied by a submodule with packed addresses (ET 200S).
System Functions for Addressing Modules 15.2 Querying the Module Slot Belonging to a Logical Address with SFC 49 "LGC_GADR" Description With SFC 49 "LGC_GADR" (convert logical address to geographical address), you obtain the module slot belonging to a logical address and the offset in the user data address area of the module. Note SFC 49 "LGC_GADR" can not be used on submodule with packed addresses (ET 200S).
System Functions for Addressing Modules Output Parameter AREA The output parameter AREA specifies how the output parameters RACK, SLOT and SUBADDR must be interpreted (see following table). Value of AREA System Meaning of RACK, SLOT and SUBADDR 0 S7-400 RACK : Module rack no. SLOT : Slot no. SUBADDR : Difference between logical address and logical base address 1 S7-300 RACK: Module rack no. SLOT : Slot no.
System Functions for Addressing Modules 15.3 Querying all Logical Addresses of a Module with SFC 50 "RD_LGADR" Description You start with one logical address of a module. With SFC 50 "RD_LGADR" (read module logical addresses), you obtain all the declared logical addresses of this module. You have already assigned addresses to modules previously with STEP 7. SFC 50 enters the logical addresses obtained in the field PEADDR or in the field PAADDR in ascending order.
System Functions for Addressing Modules 15.4 Determining the Start Address of a Module with SFC 70 "GEO_LOG" Description Assumption: the associated module slot of the module is known from the channel of a signal module. With SFC 70 "GEO_LOG" (convert geographical address to logical address) you can determine the associated start address of the module, that is, the smallest I address or Q address.
System Functions for Addressing Modules Error Information Error Code (W#16#...) Explanation 0000 No error occurred. 8094 No subnet was configured with the specified SUBNETID. 8095 Invalid value for STATION parameter 8096 Invalid value for SLOT parameter 8097 Invalid value for SUBSLOT parameter 8099 The slot is not configured. 809A The interface module address is not configured for the selected slot.
System Functions for Addressing Modules 15.5 Determining the Slot Belonging to a Logical Address with SFC 71 "LOG_GEO" Description SFC 71 "LOG_GEO" (convert logical address to geographical address) lets you determine the module slot belonging to a logical address as well as the offset in the user data area of the module.
System Functions for Addressing Modules AREA Output Parameter Value of AREA System Meaning of RACK, SLOT and SUBADDR 0 S7-400 MASTER: 0 STATION: Rack no. SLOT: Slot no. SUBSLOT: 0 OFFSET: Difference between the logical address and the logical base address. 1 S7-300 MASTER: 0 STATION: Rack no. SLOT: Slot no. SUBSLOT: 0 OFFSET: Difference between the logical address and the logical base address. 2 PROFIBUS DP MASTER: DP master system ID STATION: Station number SLOT: Slot no.
System Functions for Addressing Modules Error Information Error Code (W#16#...) Explanation 0000 No error occurred.
16 SFCs for Distributed I/Os or PROFINET IO 16.1 Triggering a Hardware Interrupt on the DP Master with SFC 7 "DP_PRAL" Description With SFC 7 "DP_PRAL," you trigger a hardware interrupt on the DP master from the user program of an intelligent slave. This interrupt starts OB40 on the DP master. Using the input parameter AL_INFO, you can identify the cause of the hardware interrupt.
SFCs for Distributed I/Os or PROFINET IO Identifying a Job The input parameters IOID and LADDR uniquely specify the job.
SFCs for Distributed I/Os or PROFINET IO Error Information Error Code (W#16#...) Explanation 0000 The job was executed without errors. 7000 First call with REQ=0. No hardware interrupt request is active; BUSY has the value 0. 7001 First call with REQ=1. A hardware interrupt request has already been sent to the DP master; BUSY has the value 1. 7002 Interim call (REQ irrelevant): the triggered hardware interrupt has not yet been acknowledged by the DP master; BUSY has the value 1.
SFCs for Distributed I/Os or PROFINET IO 16.2 Synchronizing Groups of DP Slaves with SFC 11 "DPSYC_FR" Description With SFC 11 "DPSYC_FR," you can synchronize one or more groups of DP slaves.
SFCs for Distributed I/Os or PROFINET IO Writing Outputs of DP Modules The writing of outputs of DP modules is triggered as follows: • By transfer commands to the DP I/Os, • By writing the process image output table to the modules (by the operating system at the end of OB1 or by calling SFC 27 "UPDAT_PO"), • By calling SFC 15 "DPWR_DAT." In normal operation, the DP master transfers the output bytes cyclically (within the cycle of the PROFIBUS DP bus) to the outputs of the DP slaves.
SFCs for Distributed I/Os or PROFINET IO What are the Effects of FREEZE? With the FREEZE control command, the DP slaves involved are switched to the Freeze mode, in other words the DP master instructs the DP slaves to freeze the current state of the inputs. It then transfers the frozen data to the input area of the CPU. Following each FREEZE control command, the DP slaves freeze the state of their inputs again.
SFCs for Distributed I/Os or PROFINET IO SFC 11 "DPSYC_FR" and Startup The user alone must take responsibility for sending the SYNC and FREEZE control commands in the startup OBs. If you want the outputs of one or more groups to be in the Sync mode when the user program starts, you must initialize these outputs during startup and execute SFC 11 "DPSYC_FR" with the SYNC control command completely.
SFCs for Distributed I/Os or PROFINET IO Parameter Declaration Data Type Memory Area Description MODE INPUT I, Q, M, D, L, constant BYTE Job ID (coding complying with EN 50 170 Volume 2, PROFIBUS) Bit 0: reserved (value 0) Bit 1: reserved (value 0) Bit 2 = 1: UNFREEZE is executed = 0: no meaning Bit 3 Bit 4 Bit 5 = 1: FREEZE is executed = 0: no meaning = 1: UNSYNC is executed = 0: no meaning = 1: SYNC is executed = 0: no meaning Bit 6: reserved (value 0) Bit 7: reserved (val
SFCs for Distributed I/Os or PROFINET IO Error Information Note If you access DPV1 slaves, error information from these slaves can be forwarded from the DP master to the SFC. For details on this error information, see Receiving an Interrupt with SFB 54 "RALRM" STATUS[3]. Error Code (W#16#...) Explanation 0000 The job was completed without errors. 7000 First call with REQ=0. The job specified with LADDR, GROUP and MODE is not active; BUSY has value 0. 7001 First call with REQ=1.
SFCs for Distributed I/Os or PROFINET IO 16.3 Deactivating and Activating DP Slaves/PROFINET IO Devices with SFC 12 "D_ACT_DP" Description With SFC 12 "D_ACT_DP, you can specifically deactivate and reactivate configured DP slaves/PROFINET IO devices. In addition, you can determine whether each assigned DP slave or PROFINET IO device is currently activated or deactivated. If you use SFC 12 to deactivate an IE/PB Link PN IO, then all subordinate PROFINET IO devices will also cease to function.
SFCs for Distributed I/Os or PROFINET IO How the SFC Operates SFC 12 ”D_ACT_DP” operates asynchronously, in other words, it is executed over several SFC calls. You start the request by calling SFC 12 with REQ=1. The status of the job is indicated by the output parameters RET_VAL and BUSY; see also Meaning of the Parameters REQ, RET_VAL and BUSY with Asynchronous SFCs.
SFCs for Distributed I/Os or PROFINET IO Activating DP Slaves/PROFINET IO devices When you reactivate a DP slave/PROFINET IO device with SFC 12, this compoent is configured and assigned parameters by the designated DP master/PROFINET IO controller (as with the return of a failed DP station/PROFINET IO station). This activation is completed when the component is able to transfer user data.
SFCs for Distributed I/Os or PROFINET IO Parameters Parameter REQ MODE Declaration Data Type Memory Area INPUT BOOL I, Q, M, D, L, constant. INPUT BYTE I, Q, M, D, L, constant Description Level-triggered control parameter REQ=1: execute activation or deactivation Job ID.
SFCs for Distributed I/Os or PROFINET IO Error code (W#16#...) 80A1 Explanation The addressed component could not be assigned parameters (this error code is possible only with MODE = 1.) Note: The CPU supplies this information only if the activated slave fails again during parameter assignment. If parameter assignment of a single module was unsuccessful, the SFC returns the error information W#16#0000. 80A2 The addressed DP slave does not return an acknowledgement.
SFCs for Distributed I/Os or PROFINET IO 16.4 Reading Diagnostic Data of a DP Slave with SFC 13 "DPNRM_DG" (Slave Diagnostics) Slave Diagnostics Each DP slave provides slave diagnostic data structured in accordance with EN 50 170 Volume 2, PROFIBUS. To read out this diagnostic data, you require SFC 13 "DPNRM_DG." Refer to the following table for the basic structure of the slave diagnostic data and to the manuals of the DP slaves for further information.
SFCs for Distributed I/Os or PROFINET IO Function The read job is executed asynchronously, in other words it requires several SFC 13 calls. The status of the job is indicated by the output parameters RET_VAL and BUSY, also refer to Meaning of the Parameters REQ, RET_VAL and BUSY with Asynchronous SFCs.
SFCs for Distributed I/Os or PROFINET IO Input Parameter RECORD The CPU evaluates the actual length of the diagnostic data that were read as following: • If the length specified for RECORD is less than the number of data bytes supplied, the data are discarded and a corresponding error code is entered in RET_VAL.
SFCs for Distributed I/Os or PROFINET IO System Resources for S7-400 When SFC 13 "DPNRM_DG" is called for a job that is not currently being processed, resources of the CPU (memory space) are occupied on the S7-400. You can call SFC 13 in quick succession for several DP slaves providing that you do not exceed the maximum number of "simultaneously" active SFC 13 jobs for your CPU. You will find the maximum number of such jobs in /101/.
SFCs for Distributed I/Os or PROFINET IO 16.5 Reading Consistent Data of a DP Standard Slave//PROFINET IO Device with SFC 14 "DPRD_DAT" Data Consistency Refer to the section Overview of S7 Communication and S7 Basic Communication - Data Consistency. Purpose of SFC 14 You require SFC 14 "DPRD_DAT" because you can only read out a maximum of four continuous bytes using load instructions that access the I/Os or the process image input table.
SFCs for Distributed I/Os or PROFINET IO If you read from a DP standard slave with a modular design or with several DP identifiers, you can only access the data of one module/DP identifier per SFC 14 call specifying the configured start address. Parameter Declaration Data Type Memory Area Description LADDR INPUT I, Q, M, D, L, constant Configured start address from the I area of the module from which the data will be read. WORD Note: Addresses have to be entered in hexadecimal format.
SFCs for Distributed I/Os or PROFINET IO Error Code (W#16#...) Explanation 80C2 System error with external DP interface module. 80Fx System error with external DP interface module. 87xy System error with external DP interface module. 808x System error with external DP interface module.
SFCs for Distributed I/Os or PROFINET IO 16.6 Writing Consistent Data to a DP Standard Slave/PROFINET IO Device with SFC 15 "DPWR_DAT" Data Consistency Refer to the section: Overview of S7 Communication and S7 Basic Communication – Data Consistency . Purpose of SFC 15 You require SFC 15 "DPWR_DAT" because you can only write a maximum of four continuous bytes using the transfer instructions that access the I/Os or the process image input table.
SFCs for Distributed I/Os or PROFINET IO If the DP standard slave has a modular design, you can only access one module of the DP slave. Parameter Declaration Data Type Memory Area Description LADDR WORD I, Q, M, D, L, constant Configured start address from the process image output area of the module to which the data will be written. INPUT Note: Addresses have to be entered in hexadecimal format. For example, diagnostic address 100 means: LADDR:=W#16#64.
SFCs for Distributed I/Os or PROFINET IO Error Code (W#16#...) Explanation 80C1 The data of the previous write job on the module have not yet been processed by the module. 80C2 System error with external DP interface module. 80Fx System error with external DP interface module. 85xy System error with external DP interface module.
17 PROFInet 17.1 Background Information on SFCs 112, 113 and 114 Note By default, the operating system updates the PROFInet interface as well as the DP interconnections at the scan cycle check point. However, if you have disabled the automatic updates in your configuration (e.g. to have better influence on the timing in the CPU), you have to perform the updates yourself. To do this, call SFCs 112 to 114 at suitable times. The updates mentioned here can only be disabled as a group in the configuration.
PROFInet Updating the PROFInet Interface The data consistency provided by the use of the shadow memory means that updating the PROFInet interface takes place in the following two steps: • The inputs in the shadow memory interface DB are copied to the inputs before your program for the PROFInet component starts • The outputs of the interface DB are copied to the outputs of the shadow memory after your program for the PROFInet component has run The PROFInet interface is updated by either the operating system
PROFInet If you perform the update by means of SFCs 112 and 113, then call SFC 112 at the start of the OB containing the program associated with the PROFInet component and call SFC 113 at the end of this OB. This procedure is shown using OB 30 as an example the following illustration.
PROFInet 17.2 Updating the Inputs of the User Program Interface for the PROFInet Component with SFC 112 "PN_IN" Description Using SFC 112 "PN_IN", you copy the input data in PROFInet from the shadow memory of the PROFInet components to the associated interface DB. After the SFC is completed, your application has the current input data available to it. Parameter Declaration Data Type Memory Area Description DBNO INPUT WORD I, Q, M, D, L, constant DB no.
PROFInet 17.3 Updating the Outputs of the PROFInet Interface for the PROFInet Component with SFC 113 "PN_OUT" Description Using SFC 113 "PN_OUT", you copy the output data generated in your application from the interface DB of the PROFInet component to the associated shadow memory. After the SFC is completed, the other PROFInet components have the current input data available to them. Parameter Declaration Data Type Memory Area Description DBNO INPUT WORD I, Q, M, D, L, constant DB no.
PROFInet 17.4 Updating DP Interconnections with SFC 114 "PN_DP" Description With SFC 114 "PN_DP" you update all of the following: • Interconnections between PROFInet components on the local PROFIBUS • Interconnections with cyclical transmission between PROFInet components on the local PROFIBUS and external PROFInet components. The interconnections apply between networks (between Industrial Ethernet and PROFIBUS DP). Function SFC 114 "PN_DP" functions asynchronously.
18 FBs for Cyclical Access to User Data according to the PNO 18.1 Introduction to the FBs for Cyclical Access to User Data according to the PNO Overview The FBs for cyclical access to user data according to the PNO (PROFIBUS Nutzerorganisation e.V.
FBs for Cyclical Access to User Data according to the PNO 18.2 Read All Inputs of a DP Standard Slave/PROFINET IO Device with FB 20 "GETIO" Description With the FB 20 "GETIO" you consistently read out all inputs of a DP standard slave/PROFINET IO device. In doing so, FB 20 calls the SFC 14 "DPRD_DAT". If there was no error during the data transmission, the data that have been read are entered in the target area indicated by INPUTS.
FBs for Cyclical Access to User Data according to the PNO 18.3 Write All Outputs of a DP Standard Slave/PROFINET IO Device with FB 21 "SETIO" Description With the FB 21 "SETIO" you consistently transfer the data from the source area indicated by OUTPUTS to the addressed DP standard slave/PROFINET IO device, and, if necessary, to the process image (in the case where you have configured the affected address area for the DP standard slave as a consistency area in a process image).
FBs for Cyclical Access to User Data according to the PNO 18.4 Read a Part of the Inputs of a DP Standard Slave/PROFINET IO Device with FB 22 "GETIO_PART" Description With the FB 22 "GETIO_PART" you consistently read a part of the process image area belonging to a DP standard slave/PROFINET IO device. In doing so, FB 22 calls the SFC 81 "UBLKMOV". Note You must assign a process image partition for inputs to the OB in which FB 22 "GETIO_PART" is called.
FBs for Cyclical Access to User Data according to the PNO Parameter Declaration Data Type Memory Area Description ID INPUT DWORD I, Q, M, D, L constant • Low word: logical address of the DP slave/ PROFINET IO component (module or submodule) • High word: irrelevant OFFSET INPUT INT I, Q, M, D, L constant Number of the first byte to be read in the process image for the component (smallest possible value: 0) LEN INPUT INT I, Q, M, D, L constant Amount of bytes to be read STATUS OUTPUT
FBs for Cyclical Access to User Data according to the PNO 18.5 Write a Part of the Outputs of a DP Standard Slave/PROFINET IO Device with FB 23 "SETIO_PART" Description With the FB 23 "SETIO_PART" you transfer data from the source area indicated by OUTPUTS into a part of the process image area belonging to a DP standard slave/PROFINET IO device. In doing so, FB 23 calls the SFC 81 "UBLKMOV". Note You must assign a process image partition for outputs to the OB in which FB 23 "SETIO_PART" is called.
FBs for Cyclical Access to User Data according to the PNO Parameter Declaration Data Type Memory Area Description ID INPUT DWORD I, Q, M, D, L, constant • Low word: logical address of the DP slave/PROFINET IO component (module or submodule) • High word: irrelevant OFFSET INPUT INT I, Q, M, D, L, constant Number of the first byte to be written in the process image for the component (smallest possible value: 0) LEN INPUT INT I, Q, M, D, L, constant Amount of bytes to be written STATUS
FBs for Cyclical Access to User Data according to the PNO 18-8 System Software for S7-300/400 System and Standard Functions - Volume 1/2 A5E00709327-01
s SFCs for Global Data Communication Overview over the S7 Communication and the S7 Basic Communication SIMATIC System Software for S7-300/400 System and Standard Functions Volume 2/2 Reference Manual S7 Communication Communication SFCs for NonConfigured S7 Connections Open Communication via Industrial Ethernet Generating Block-Related Messages 22 23 24 IEC Functions 26 SFBs for Integrated Control 27 SFBs for Compact CPUs 28 29 30 Plastics Techology 31 Diagnostic Data 32 System Status Lists (S
Safety Guidelines This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring to property damage only have no safety alert symbol. The notices shown below are graded according to the degree of danger. Danger ! indicates that death or severe personal injury will result if proper precautions are not taken.
Contents 19 SFCs for Global Data Communication 19.1 19.2 20 20.2 20.3 20.4 21 21.2 21.3 21.4 21.5 21.6 21.7 21.8 21.9 21.10 21.11 21.12 21.13 21.14 21.15 21.16 21.17 21.18 22.3 22.4 22.5 22.6 21-3 Common Parameters of the SFBs/FBs and SFCs/FCs for S7 Communication .................................................................................... 21-3 Startup Routine of SFBs for Configured S7 Connections .............................. 21-3 How SFBs React to Problems .................................
Contents 22.7 22.8 22.9 22.10 23 Open Communication via Industrial Ethernet 23.1 23.2 23.3 23.4 23.5 23.6 23.7 23.8 23.9 23.10 23.11 23.12 24 24.3 24.4 24.5 24.6 24.7 24.8 24.9 24.10 24.11 24.12 24.13 24.14 24.15 24.16 24.17 23-3 Overview......................................................................................................... 23-3 Function of FBs for Open Communication via Industrial Ethernet .................
Contents 25 IEC Timers and IEC Counters 25.1 25.2 25.3 25.4 25.5 25.6 26 27 29 30 29-3 Controlling Operation in H Systems with SFC 90 "H_CTRL" ......................... 29-3 Integrated Functions (for CPUs with integrated I/Os) 30.1 30.2 30.3 30.4 28-3 Positioning With Analog Output Using SFB 44 "Analog"................................ 28-3 Positioning with Digital Output Using SFB 46 "DIGITAL"............................... 28-3 Controlling the Counter with SFB 47 "COUNT".........................
Contents 31 Plastics Techology 31.1 32 32-3 Overview of the Structure of Diagnostic Data................................................. 32-3 Diagnostic Data .............................................................................................. 32-3 Structure of Channel-Specific Diagnostic Data .............................................. 32-3 System Status Lists (SSL) 33.1 33.2 33.3 33.4 33.5 33.6 33.7 33.8 33.9 33.10 33.11 33.12 33.13 33.14 33.15 33.16 33.17 33.18 33.19 33.20 33.21 33.
Contents 34 Events 34.1 34.2 34.3 34.4 34.5 34.6 34.7 34.8 34.9 34.10 34.11 34.12 35 34-3 Events and Event ID ....................................................................................... 34-3 Event Class 1 - Standard OB Events ............................................................. 34-3 Event Class 2 - Synchronous Errors .............................................................. 34-3 Event Class 3 - Asynchronous Errors.............................................................
Contents viii System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
19 SFCs for Global Data Communication 19.1 Sending a GD Packet with SFC 60 "GD_SND" Description With SFC 60 "GD_SND" (global data send), the data of a GD packet are collected and then sent on the path specified in the GD packet. The GD packet must already have been configured with STEP 7. SFC 60 "GD_SND" can be called at any point in the user program. The scan rate and the collection and sending of the data by the system at the cycle checkpoint are not influenced by SFC 60 calls.
SFCs for Global Data Communication Ensuring Consistency for an Entire GD Packet A GD packet on the CPU sending the data has a structure that does not automatically guarantee that the collected data are consistent. This is, for example, the case when the packet consists of an array of bytes and the number of bytes exceeds the maximum length for the specific CPU.
SFCs for Global Data Communication Error Information Error Code (W#16#...) Explanation 0000 No error occurred. 8081 The GD packet selected with the parameters CIRCLE_ID and BLOCK_ID is not configured. 8082 Illegal value for the parameters CIRCLE_ID or BLOCK_ID or for both parameters. 8083 An error occurred during the execution of the SFC. The type of error is entered in the variable configured for the status information. This can be evaluated by your program.
SFCs for Global Data Communication 19.2 Programmed Acceptance of a Received GD Packet with SFC 61 "GD_RCV" Description With SFC 61 "GD_RCV" (global data receive), the data from an incoming GD frame for exactly one GD packet are retrieved and entered in the received GD packet. This must already have been configured with STEP 7. SFC 61 "GD_SND" can be called at any point in the user program.
SFCs for Global Data Communication Ensuring Consistency for an Entire GD Packet A GD packet on a receiving CPU has a structure that does not automatically guarantee that its data originate from one and the same frame. This is, for example, the case when the packet consists of three GD elements.
SFCs for Global Data Communication Error Information Error Code (W#16#...) Explanation 0000 8081 8082 8083 8084 8085 8xyy No error occurred. The GD packet selected with the parameters CIRCLE_ID and BLOCK_ID is not configured. Illegal value for the parameters CIRCLE_ID or BLOCK_ID or for both parameters. An error occurred during the execution of the SFC. The type of error is entered in the variable configured for the status information. This can be evaluated by your program.
20 Overview over the S7 Communication and the S7 Basic Communication 20.
Overview over the S7 Communication and the S7 Basic Communication Criteria Communication SFCs for NonConfigured S7 Connections Communication SFBs for Configured S7 Connections The number of communication partners that Number of communication partners can be reached one after the other is not restricted by the connection resources available (see /70/, /101/). (The connections can be established and terminated again while the program is running.
Overview over the S7 Communication and the S7 Basic Communication Realization of the IEC 61131-5 with S7-400 The IEC standard 61131-5 is realized with the following blocks: • USEND(SFB 8)/URCV(SFB 9) • BSEND(SFB 12)/BRCV(SFB 13) • PUT(SFB 15)/GET(SFB 14) corresponds to READ/WRITE • STATUS(SFB 22)/USTATUS(SFB 23) • ALARM(SFB 33) • NOTIFY(SFB 36) • START (SFB 19), STOP (SFB 20) and RESUME (SFB 21) realizes a call interface for the program control functions.
Overview over the S7 Communication and the S7 Basic Communication 20.2 Data Consistency Definition The size of the data area which can be modified simultaneously by concurrent processes is called the consistent data area. Data areas which are larger than the consistent data area can thus be falsified as a whole. This means that a data area which belongs together and which is larger than consistent data area can consist in part of new and of old consistent data blocks at the same time.
Overview over the S7 Communication and the S7 Basic Communication In the S7-400 by contrast the communication data are not processed in the cycle checkpoint, but in fixed time slices during the program cycle. The consistency of a variable is ensured by the system. These communication areas can then be accessed consistently using the PUT/GET functions or reading/writing of variables, for example by an OP on an OS.
Overview over the S7 Communication and the S7 Basic Communication 20.3 Overview of the S7 Communication Blocks Classification For S7 communication, connection configuration is needed. The integrated communication functions are called up with the SFBs/FBs or an SFC/FC from within the application. These blocks can be classified in the following categories: • SFBs/FBs for data exchange • SFBs for changing the operating status • SFBs for querying the operating status. • SFC/FC for querying the connection.
Overview over the S7 Communication and the S7 Basic Communication SFBs for Changing the Operating Status With SFBs for changing the operating status, you can control the operating status of a remote device. Data exchange with the SFBs for changing the operating status is unilateral. Block S7-400 Brief Description SFB 19 START Trigger the RESTART of an S7/M7-300/400 or C7-300 CPU, if it is in the STOP operating mode.
Overview over the S7 Communication and the S7 Basic Communication 20.4 Overview of the Blocks for the S7 Basic Communication Classification of the SFCs for the S7 Basic Communication Connection configuration is not required for the S7 basic communication. The integrated communication functions are called via SFCs in the user program.
Overview over the S7 Communication and the S7 Basic Communication SFCs for Internal Communication Block Brief Description SFC 72 I_GET Reading a variable of a communication partner without your having to place a corresponding SFC on the communication partner. This functionality is implemented in the communication partner of the operating system. SFC 73 I_PUT Writing a variable into a communication partner without your having to place a corresponding SFC on the communication partner.
Overview over the S7 Communication and the S7 Basic Communication Existing connections of communication SFBs for configured S7 connections cannot be used by the communication SFCs for non-configured S7 connections. Once you have triggered a job, the connection established for the job can only be used for this particular job. Other jobs involving the same communication partner can then only be executed after the current job is completed.
Overview over the S7 Communication and the S7 Basic Communication Client Changes to STOP If the CPU that initiated a job (and therefore established the connection) changes to STOP during a data transfer, all the connections it established are terminated. Making Program Changes All parts of your program that immediately affect the calls for communication SFCs for non-configured S7 connections must only be modified in the STOP mode.
Overview over the S7 Communication and the S7 Basic Communication 20-12 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
21 S7 Communication 21.1 Common Parameters of the SFBs/FBs and SFCs/FCs for S7 Communication Classification The parameters of communication SFBs/FBs for configured S7 connections can be divided into the following five categories according to their functions: 1. Control parameters are used to activate a block. 4. Addressing parameters are used to address the remote communication partner. 5. Send parameters point to the data areas that are to be sent to the remote partner. 6.
S7 Communication Addressing Parameters Parameter Description ID Reference to the local connection description (specified by the STEP 7 configuration of the connection). R_ID Use the R_ID parameter to specify that a send and a receive SFB belong together: The R_ID parameter must be identical at the SFB/FB on the send end and at the SFB on the receive end. This allows the communication of several SFB/FB pairs via the same logic connection. • R_ID must be specified in the form DW#16#wxyzWXYZ.
S7 Communication Send and Receive Parameters If you do not use all send or receive parameters of an SFB/FB, the first unused parameter must be a NIL pointer (see /232/) and the parameters used must be located one after the other and without any gaps. Note for S7-400 During the first call, the ANY pointer specifies the maximum amount of user data that can be transferred for the job. That is to say, a communication buffer is created in the work memory of the CPU to ensure data consistency.
S7 Communication The guaranteed minimum size of the user data for an SFB/FB with 1–4 variables is listed in the following table: Block Partner: S7-300 Partner: S7-400 PUT / GET 160 bytes 400 bytes USEND / URCV 160 bytes 440 bytes BSEND / BRCV 32768/65534 bytes 65534 bytes Further information on the user data size can be found in the technical data of the respective CPU.
S7 Communication 21.2 Startup Routine of SFBs for Configured S7 Connections Requirements In the following description for S7-400, it is assumed that: • The connection descriptions (SDBs) exist on the modules. • The configured connections have been established. • The actual parameter for the ID matches the configured connection ID for each SFB. Warm Restart and Cold Restart During a warm and a cold restart all SFBs are set to the NO_INIT status.
S7 Communication Warm Restart and Cold Restart with SFBs for Unilateral Data Exchange It is assumed that the server on the communication partner is operational after the connections have been established, in other words that it can process jobs or output messages at any time. SFBs that send out jobs and expect acknowledgements react to a complete restart as follows: The current processing is aborted and the CFB branches to the NO_INIT status immediately afterwards.
S7 Communication 21.3 How SFBs React to Problems The following section describes how SFBs for S7 communication in S7-400 react to problems. Connection Terminated The connections allocated to the SFB instances are monitored. If a connection is terminated, the reaction of the SFB depends on its internal status.
S7 Communication Error Interface to the User Program If an error occurs during the processing of a communication SFB, it always changes to the ERROR status. At the same time the ERROR output parameter is set to 1 and the corresponding error ID is entered in the STATUS output parameter. You can evaluate this error information in your program. Examples of possible errors: • Error when collecting send data.
S7 Communication 21.4 Uncoordinated Sending of Data with SFB 8/FB 8 "USEND" Description SFB/FB 8 "USEND" sends data to a remote partner SFB/FB of the type "URCV". The send process is carried out without coordination with the SFB/FB partner. This means that the data transfer is carried out without acknowledgement by the partner SFB/FB. S7-300: The data is sent on a rising edge at REQ. The parameters R_ID, ID and SD_1 are transferred on each rising edge at REQ.
S7 Communication Parameter Declaration Data Type Memory Area Description ERROR OUTPUT BOOL I, Q, M, D, L STATUS OUTPUT WORD I, Q, M, D, L ERROR and STATUS state parameters, error display: ERROR=0 STATUS has the value: 0000H: neither warning nor error <> 0000H: Warning, STATUS supplies detailed information ERROR=1 There is an error. STATUS supplies detailed information on the type of error.
S7 Communication ERROR STATUS (Decimal) Explanation 1 18 • • R_ID exists already in the connection ID. Additional for S7-300: 1 1 20 27 The instances were overloaded at CPU RUN (STOP-RUN transition of the CPU or CP required.) • S7-400: Not enough work memory available. If there is still enough total work memory available, then the solution is to compress the work memory.
S7 Communication 21.5 Uncoordinated Receiving of Data with SFB/FB 9 "URCV" Description SFB/FB 9 "URCV" receives data asynchronously from a remote partner SFB/FB of the type "USEND" and copies them into the configured receive ranges. The block is ready to receive then there is a logical 1 at the EN_R input. An active job can be cancelled with EN_R=0. S7-300: The parameters R_ID, ID and RD_1 are applied with every positive edge on EN_R.
S7 Communication Parameter Declaration Data Type Memory Area Description ERROR OUTPUT BOOL I, Q, M, D, L STATUS OUTPUT WORD I, Q, M, D, L ERROR and STATUS state parameters, error display: ERROR=0 STATUS has the value: 0000H: neither warning nor error <> 0000H: Warning, STATUS supplies detailed information ERROR=1 There is an error. STATUS supplies detailed information on the type of error.
S7 Communication ERROR STATUS (Decimal) Explanation 1 18 • • R_ID already exists in the connection ID. Additional for S7-300: - The instances were overloaded at CPU-RUN (STOP-RUN transition of the CPU or CP required.) 1 19 The corresponding SFB/FB "USEND" is sending data faster than the SFB/FB "URCV" can copy them to the receive areas ." 1 20 • S7-400: Not enough work memory available. If there is still enough total work memory available, then the solution is to compress the work memory.
S7 Communication 21.6 Sending Segmented Data with SFB/FB 12 "BSEND" Description SFB/FB 12 "BSEND" sends data to a remote partner SFB/FB of the type "BRCV". With this type of data transfer, more data can be transported between the communications partners than is possible with all other communication SFBs/FBs for configured S7 connections: • 32768 bytes for S7-300 via SIMATIC-Net CPs • 65534 bytes for S7-400 and S7-300 via an integrated interface The data area to be transmitted is segmented.
S7 Communication Due to the asynchronous data transmission, a new transmission can only be initiated if the previous data have been retrieved by the call of the partner SFB/FB. Until the data are retrieved, the status value 7 (see below) will be given when the SFB/FB "BSEND" is called. Parameter Declaration Data Type Memory Area Description REQ INPUT BOOL I, Q, M, D, L Control parameter request, activates the data exchange at a rising edge.
S7 Communication Error Information The following table contains all the error information specific to SFB/FB 12 that can be output with the parameters ERROR and STATUS. ERROR STATUS (Decimal) 0 11 0 25 1 1 Explanation Warning: • New job cannot take effect since previous job is not yet completed. • The job is now being processed in a priority class having lower priority. Communication has started. The job is being processed.
S7 Communication ERROR STATUS (Decimal) Explanation 1 20 • S7-400: Not enough work memory available. If there is still enough total work memory available, then the solution is to compress the work memory. • H system: a first call of SFB is not possible during an update since the communication buffer in the work memory is being created. Measures that change the work memory are not possible during an update.
S7 Communication 21.7 Receiving Segmented Data with SFB/FB 13 "BRCV" Description SFB/FB 13 "BRCV" receives data from a remote partner SFB/FB of the type "BSEND". After each received data segment an acknowledgement is sent to the partner SFB/FB and the LEN parameter is updated. After it has been called and the value 1 is applied at the control input EN_R, the block is ready to receive data. An active job can be cancelled with EN_R=0.
S7 Communication Parameter Declaration Data Type Memory Area Description ERROR OUTPUT BOOL I, Q, M, D, L STATUS OUTPUT WORD I, Q, M, D, L ERROR and STATUS state parameters, error display: ERROR=0 STATUS has the value: 0000H: neither warning nor error <> 0000H: Warning, STATUS supplies detailed information ERROR=1 There is an error. STATUS supplies detailed information on the type of error. RD_1 IN_OUT ANY S7-300: M, D S7-400: I, Q, M, D, T, C Pointer to the receive area.
S7 Communication Error Information The following table contains all the error information specific to SFB/FB 13 that can be output with the parameters ERROR and STATUS. ERROR STATUS (Decimal) Explanation 0 11 Warning: The receive data are now being processed in a priority class having lower priority. 0 17 Warning: block receiving data asynchronously. The LEN parameter shows the amount of data already received in bytes.
S7 Communication Data Consistency The data are received consistently if you remember the following point: • Evaluate the last used receive areas (RD_1) completely before you call the block again with the value 1 at control input EN_R).
S7 Communication 21.8 Writing Data to a Remote CPU with SFB/FB 15 "PUT" Description With SFB/FB 15 "PUT," you can write data to a remote CPU. S7-300: The data is sent on a rising edge at REQ. The parameters ID, ADDR_1 and SD_1 are transferred on each rising edge at REQ. After a job has been completed, you can assign new values to the ID, ADDR_1 and SD_1 parameters. S7-400: The SFB is started on a rising edge at control input REQ.
S7 Communication Parameter Declaration Data Type Memory Area Description S7-300: M, D Pointers to the areas on the partner CPU in which the data is to be written. IN_OUT ANY ADDR_1 S7-400: I, Q, M, D, T, C ADDR_i (1≤ i ≤4) S7-300: IN_OUT ANY S7-300: M, D SD_1 S7-400 I, Q, M, D, T, C S7-400: Pointers to the areas on the local CPU which contain the data to be sent.
S7 Communication ERROR STATUS (Decimal) Explanation 1 20 • S7-400: Not enough work memory available. If there is still enough total work memory available, then the solution is to compress the work memory. • H system: a first call of SFB is not possible during an update since the communication buffer in the work memory is being created. Measures that change the work memory are not possible during an update.
S7 Communication 21.9 Read Data from a Remote CPU with SFB/FB 14 "GET" Description You can read data from a remote CPU with SFB/FB 14 "GET". S7-300: The data is read on a rising edge at REQ. The parameters ID, ADDR_1 and RD_1 are transferred on each rising edge at REQ. After a job has been completed, you can assign new values to the ID, ADDR_1 and RD_1 parameters. S7-400: The SFB is started with a rising edge at control input REQ.
S7 Communication Parameter Declaration Data Type S7-300: IN_OUT ANY Memory Area Description S7-300: Pointers to the areas on the partner CPU that are to be read. ADDR_1 M, D S7-400: S7-400: ADDR_i I, Q, M, D, T, C (1≤ i ≤4) S7-300: IN_OUT ANY RD_1 S7-300: M, D S7-400: S7-400: RD_i I, Q, M, D, T, C (1≤ i ≤4) Pointers to the areas on the local CPU in which the read data are entered.
S7 Communication ERROR STATUS (Decimal) Explanation 1 20 • S7-400: Not enough work memory available. If there is still enough total work memory available, then the solution is to compress the work memory. • H system: a first call of SFB is not possible during an update since the communication buffer in the work memory is being created. Measures that change the work memory are not possible during an update.
S7 Communication 21.10 Sending Data to a Printer with SFB 16 "PRINT" Description SFB 16 "PRINT" sends data and a formatting instruction to a remote printer, for example, via the CP 441. When there is a rising edge at control input REQ, the format description (FORMAT) and the data (SD_i) are sent to the printer selected with ID and PRN_NR.
S7 Communication In_out Parameter FORMAT The FORMAT character string contains printable characters and format elements. It has the following structure: Characters Conversion instruction Control instruction For each send area to be printed (SD_1 to SD_4) there must be one conversion instruction in FORMAT. The conversion instructions are applied to the send areas (SD_i) in the order in which they are formulated. Characters and instructions can follow each other in any order.
S7 Communication Element of a Conversion Instruction Meaning Flags • None: right-justified output • -: left-justified output • None: output in standard representation • n: exactly n characters are output. If the output is rightjustified, this may be preceded by blanks, with leftjustified output the blanks come after the characters. Width Precision The precision is only relevant for representations A, D, F and R (see following table).
S7 Communication Representation Possible Data Types Example Length Comments WORD - 2 147 483 648 max. 11 N, n WORD Text output - The corresponding send area SD_i contains a reference (number) to a text to be printed. The text is on the module (for example, CP 441) that creates a printable string. If no text is found under the specified number, ****** is output. R, r REAL 0.12E-04 8 - DWORD S, s STRING Text output - T, t TIME 2d_3h_10m_5s_ 250ms max. 21 BYTE 255 max.
S7 Communication • Control Instruction Using the control instruction you can do the following: \ - Print the characters % and \ - Change the printer settings.
S7 Communication If you attempt to disable, for example, a font that is not enabled or execute a function that the printer does not recognize, the control instruction is ignored. The following table contains the errors that may occur with the FORMAT in/out parameter. Error Printer Output Conversion instruction cannot be executed * characters are output according to the (maximum) length of the default representation or the specified width.
S7 Communication Number of Transferable Data The amount of data that can be transferred to a remote printer must not exceed a maximum length. This maximum data length is calculated as follows: maxleng = 420 - format Format is the current length of the FORMAT parameter in bytes. The data to be printed can be distributed on one or more send areas.
S7 Communication 21.11 Initiating a Warm or Cold Restart on a Remote Device with SFB 19 "START" Description If there is a rising edge at control input REQ, SFB 19 "START," this activates a warm or cold restart on the remote device addressed by the ID. If the remote system is a fault-tolerant system, the effect of the restart request depends on the parameter PI_NAME: the start request is valid either for exactly one CPU or for all CPUs of this system.
S7 Communication Parameter Declaration Data Type Memory Area Description PI_NAME I, Q, M, D, T, C Pointer to the memory area in which the name of the program (ASCII code) to be started is located. This name must not contain more than 32 characters. IN_OUT ANY With an S7 PLC, it must be P_PROGRAM. With an H system, the following names are possible: ARG IN_OUT ANY IO_STATE IN_OUT BYTE I, Q, M, D, T, C I, Q, M, D, L • P_PROGRAM (the start job is valid for all CPUs in the H system.
S7 Communication ERROR STATUS (Decimal) Explanation 1 12 When the SFB was called, 1 21-38 20 • An instance DB was specified that does not belong to SFB 19 • No instance DB was specified, but rather a shared DB. • No instance DB found (loading a new instance DB from the PG). • S7-400: Not enough work memory available. If there is still enough total work memory available, then the solution is to compress the work memory.
S7 Communication 21.12 Changing a Remote Device to the STOP State with SFB 20 "STOP" Description If there is a rising edge at control input REQ, SFB 20 "STOP," this activates a change to the STOP mode on the remote device addressed by the ID. The mode change is possible when the device is in the RUN, HOLD or STARTUP modes.
S7 Communication Parameter Declaration Data Type Memory Area Description IO_STATE IN_OUT I, Q, M, D, L BYTE Not currently relevant. Do not assign a value to this parameter if your communication partner is an S7 programmable controller. Error Information The following table contains all the error information specific to SFB 20 that can be output with the parameters ERROR and STATUS.
S7 Communication • The CPU must be in the STOP mode. • The key switch of the CPU must be set to "RUN" or "RUN-P." • When you created the configuration with STEP 7, you allowed for a manual hot restart. • There must be no condition preventing a hot restart. Once the hot restart has been completed, the device changes to the RUN mode and sends a positive execution acknowledgement. When the positive acknowledgement is evaluated, the status parameter DONE is set to 1.
S7 Communication Error Information The following table contains all the error information specific to SFB 21 that can be output with the parameters ERROR and STATUS. ERROR STATUS (Decimal) 0 11 Explanation Warning: • New job cannot take effect since previous job is not yet completed. • The job is now being processed in a priority class having lower priority. 0 25 Communication has started. The job is being processed.
S7 Communication 21.14 Querying the Status of a Remote Partner with SFB 22 "STATUS" Description Using SFB 22 "STATUS," you can query the status of a remote communications partner. If there is a rising edge at control input REQ, a job is sent to the remote partner. The reply is evaluated to determine whether problems have occurred. If no errors occurred, the received status is copied to the variables PHYS, LOG and LOCAL with the next SFB call.
S7 Communication In/Out Parameter LOCAL If the communications partner is an S7 CPU, the in/out parameter LOCAL contains its current status. The first byte is reserved, the second byte contains an ID for the status.
S7 Communication 21.15 Receiving the Status Change of a Remote Device with SFB 23 "USTATUS" Description SFB 23 "USTATUS" receives the device status change of a remote communication partner. The partner sends its status unsolicited when a change occurs if this is configured in STEP 7. If the value 1 is applied to the control input EN_R when the CFB is called and there is a frame from the partner, the status information is entered in the variables PHYS, LOG and LOCAL the next time the SFB is called.
S7 Communication In/Out Parameter LOCAL If the communications partner is an S7 CPU, the in/out parameter LOCAL contains its current status. The first byte is reserved, the second byte contains an ID for the status.
S7 Communication 21.16 Querying the Status of the Connection Belonging to an SFB Instance with SFC 62 "CONTROL" Description With SFC 62 "CONTROL," you can query for S7-400 the status of a connection belonging to a local communication SFB instance. After calling the system function with the value 1 at control input EN_R, the current status of the connection belonging to the communication SFB instance selected with I_DB is queried.
S7 Communication Output Parameter I_TYP The following table lists the different SFB types and the corresponding identifiers SFB Type Identifier (W#16#...
S7 Communication 21.17 Querying the Connection Status with FC 62 "C_CNTRL" Description Query a connection status for S7-300 with FC 62 "C_CNTRL". The current status of the communication that has been determined via ID is queried after the system function has been called with value 1 at the control input EN_R. Parameters Declaration Data Type Memory Area Description EN_R INPUT BOOL I, Q, M, D, L, const. Control parameter enabled to receive, signals ready to receive if the input is set.
S7 Communication Error Information The output parameter RET_VAL can assume the following values at FC 62 "C_CNTRL": • 0000H: No error when FC was executed. • 8000H: Error when FC was executed. Note The output parameters ERROR and STATUS are to be evaluated regardless of the output parameter RET_VAL showing the value 0000H. ERROR STATUS (Decimal) Description 1 10 CP access error. Another job is currently running. Repeat job later. 1 27 There is no function code in the CPU for this block.
S7 Communication 21.18 Work Memory Requirements of the S7 Communication SFBs/FBs To function smoothly, the S7 communication SFBs/FBs require a temporary memory area within the CPU work memory dependent on the user data (code area).
S7 Communication 21-52 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
22 Communication SFCs for Non-Configured S7 Connections 22.1 Common Parameters of the Communication SFCs Input Parameter REQ The input parameter REQ (request to activate) is a level-triggered control parameter. It is used to trigger the job (the data transfer or the connection abort): • If you call the SFC for a job that is not currently active, you trigger the job with REQ=1.
Communication SFCs for Non-Configured S7 Connections Input Parameter CONT The input parameter CONT (continue) is a control parameter. Using this parameter, you decide whether or not a connection to the communication partner remains established after the job is completed. • If you select CONT=0 at the first call, the connection is terminated again after the data transfer is completed. The connection is then available again for data exchange with a new communication partner.
Communication SFCs for Non-Configured S7 Connections 22.2 Error Information of the Communication SFCs for Non-Configured S7 Connections Error Information The "real" error information for SFCs 65 to 74 as shown in the table "Specific Error Information for SFCs 65 to 74" can be classified as follows: Error Code(W#16# ...
Communication SFCs for Non-Configured S7 Connections Error Code (W#16# ...) Explanation (General) Explanation (for Specific SFC) 8090 Specified destination address of the communication partner is invalid, for example: - 8092 • Wrong IOID • Wrong base address exists • Wrong MPI address (> 126) Error in SD or RD, for example: addressing the local data area is not permitted.
Communication SFCs for Non-Configured S7 Connections Error Code (W#16# ...) Explanation (General) Explanation (for Specific SFC) 80B2 Hardware error: module does not exist Possible with SFC 67 "X_GET" and SFC 68 "X_PUT" and SFC 72 "I_GET" and SFC 73 "I_PUT" • The configured slot is not occupied. • Actual module type does not match expected type • Distributed peripheral I/Os not available. • No entry for the module in the corresponding SDB.
Communication SFCs for Non-Configured S7 Connections Error Code (W#16# ...) Explanation (General) Explanation (for Specific SFC) 80C1 Lack of resources on the CPU on which the SFC is executed, for example: The maximum number of different send jobs is already being executed on the module. The connection resource is in use, for example, to receive data.
Communication SFCs for Non-Configured S7 Connections 22.3 Sending Data to a Communication Partner outside the Local S7 Station with SFC 65 "X_SEND" Description With SFC 65 "X_SEND," you send data to a communication partner outside the local S7 station. The data are received on the communication partner using SFC 66 "X_RCV." The data is sent after calling the SFC with REQ=1.
Communication SFCs for Non-Configured S7 Connections 22.4 Receiving Data from a Communication Partner outside the Local S7 Station with SFC 66 "X_RCV" Description With SFC 66 "X_RCV," you receive the data sent by one or more communication partners outside the local S7 station using SFC 65 "X_SEND." With SFC 66 "X_RCV," • You can check whether data have been sent and are waiting to be copied. The data were entered in an internal queue by the operating system.
Communication SFCs for Non-Configured S7 Connections Parameter Declaration Data Type Memory Area Description RD I, Q, M, D Reference to the received data area. The following data types are allowed: BOOL, BYTE, CHAR, WORD, INT, DWORD, DINT, REAL, DATE, TOD, TIME,S5_TIME, DATE_AND_TIME and arrays of these data types except for BOOL. OUTPUT ANY If you want to discard the oldest block of data in the queue, assign the value NIL to RD.
Communication SFCs for Non-Configured S7 Connections Entering Data in the Receive Area with EN_DT=1 When you call SFC 66 "X_RCV" with EN_DT=1, the oldest block of data in the queue is copied to the area of the work memory specified by RD. RD must be larger or the same size as the send area of the corresponding SFC 65 "X_SEND" defined by the SD parameter. If the input parameter SD is of the BOOL data type, RD must also be the BOOL data type.
Communication SFCs for Non-Configured S7 Connections Connection Abort If the connection is terminated a job belonging to the connection that is already in the queue is discarded. Exception: If this job is the oldest in the queue, and you have already detected its presence by calling SFC 66 "X_RCV" with EN_DT=0, you can enter it in the receive area with EN_DT=1.
Communication SFCs for Non-Configured S7 Connections 22.5 Writing Data to a Communication Partner outside the Local S7 Station with SFC 68 "X_PUT" Description With SFC 68 "X_PUT," you write data to a communication partner that is not in the same local S7 station. There is no corresponding SFC on the communication partner. The write job is activated after calling the SFC with REQ=1. Following this, you continue to call the SFC until the acknowledgment is received with BUSY=0.
Communication SFCs for Non-Configured S7 Connections Changing to the STOP Mode If the CPU changes to the STOP mode, the connection established by SFC 68 "X_PUT" is terminated. Data can no longer be sent. If the send data have already been copied to the internal buffer when the CPU changes mode, the contents of the buffer are discarded. Communication Partner Changes to the STOP Mode If the CPU of the communication partner changes to the STOP mode, this does not affect the data transfer with SFC 68 "X_PUT.
Communication SFCs for Non-Configured S7 Connections 22.6 Reading Data from a Communication Partner outside the Local S7 Station with SFC 67 "X_GET" Description With SFC 67 "X_GET," you can read data from a communication partner that is not in the local S7 station. There is no corresponding SFC on the communication partner. The read job is activated after calling the SFC with REQ=1. Following this, you continue to call the SFC until the data reception is indicated by BUSY=0.
Communication SFCs for Non-Configured S7 Connections Parameter Declaration Data Type Memory Area Description RD OUTPUT I, Q, M, D ANY Reference to the receive area (receive data area). The following data types are allowed: BOOL, BYTE, CHAR, WORD, INT, DWORD, DINT, REAL, DATE, TOD, TIME,S5_TIME, DATE_AND_TIME and arrays of these data types except for BOOL. The receive area RD must be at least as long as the data are read VAR_ADDR at the communication partner.
Communication SFCs for Non-Configured S7 Connections 22.7 Aborting an Existing Connection to a Communication Partner outside the Local S7 Station with SFC 69 "X_ABORT" Description With SFC 69 "X_ABORT," you terminate a connection that was established by SFCs X_SEND, X_GET or X_PUT to a communication partner that is not in the same local S7 station.
Communication SFCs for Non-Configured S7 Connections 22.8 Writing Data to a Communication Partner within the Local S7 Station with SFC 73 "I_PUT" Description With SFC 73 "I_PUT," you write data to a communication partner that is in the same local S7 station. The communication partner can be in the central rack, in an expansion rack or distributed. Make sure that you assign distributed communication partners to the local CPU with STEP 7. There is no corresponding SFC on the communication partner.
Communication SFCs for Non-Configured S7 Connections Parameter Declaration Data Type Memory Area Description SD INPUT I, Q, M, D ANY Reference to the area on the local CPU that contains the data to be sent. The following data types are allowed: BOOL, BYTE, CHAR, WORD, INT, DWORD, DINT, REAL, DATE, TOD, TIME, S5TIME, DATE_AND_TIME as well as arrays of these types except for BOOL. SD must be the same length as the parameter VAR_ADDR at the communication partner.
Communication SFCs for Non-Configured S7 Connections 22.9 Reading Data from a Communication Partner within the Local S7 Station with SFC 72 "I_GET" Description With SFC 72 "I_GET," you can read data from a communication partner in the same local S7 station. The communication partner can be in the central rack, in an expansion rack or distributed. Make sure that you assign distributed communication partners to the local CPU with STEP 7. There is no corresponding SFC on the communication partner.
Communication SFCs for Non-Configured S7 Connections Parameter Declaration Data Type Memory Area Description RD OUTPUT I, Q, M, D ANY Reference to the receive area (receive data area). The following data types are allowed: BOOL, BYTE, CHAR, WORD, INT, DWORD, DINT, REAL, DATE, TOD, TIME,S5_TIME, DATE_AND_TIME as well as arrays of these data types except for BOOL. The receive area RD must be at least as long as the read VAR_ADDR at the communication partner.
Communication SFCs for Non-Configured S7 Connections 22.10 Aborting an Existing Connection to a Communication Partner within the Local S7 Station with SFC 74 "I_ABORT" Description With SFC 74 "I_ABORT," you terminate a connection that was established by SFC 72 "I_GET" or SFC 73 "I_PUT" to a communication partner in the same local S7 station. If the job belonging to I_GET or I_PUT is completed (BUSY = 0), the connection resources used at both ends are released after SFC 74 "I_ABORT" is called.
Communication SFCs for Non-Configured S7 Connections Changing to the STOP Mode If the CPU changes to the STOP mode, the connection abort started with SFC 74 "I_ABORT" is completed. Communication Partner Changes to the STOP Mode If the CPU of the communication partner changes to the STOP mode, this does not affect the connection abort with SFC 74 "I_ABORT." The connection is terminated.
23 Open Communication via Industrial Ethernet 23.
Open Communication via Industrial Ethernet 23.2 Function of FBs for Open Communication via Industrial Ethernet Connection-oriented and Connectionless Protocols The following types of protocols are distinguished in the data communication: • Connection-oriented protocols: These establish a logical connection to the communication partner before data transmission is started. After the data transmission is complete, they then terminate the connection, if necessary.
Open Communication via Industrial Ethernet TCP native During data transmission, no information about the length or about the start and end of a message is transmitted. This is not a problem during sending because the sender knows how many data bytes it will be sending. However, the receiver has no means of detecting where one message ends in the data stream and the next one begins.
Open Communication via Industrial Ethernet UDP Unlike with the TCP native and ISO on TCP protocols, with UDP you do not establish a connection. In this case, when calling the sending block FB 67 "TUSEND" you have to specify the address parameters of the receiver (IP address and port number). Similarly, after the conclusion of the receiving block FB 68 "TURCV", you will receive a reference to the address parameters of the sender (IP address and port number).
Open Communication via Industrial Ethernet 23.3 Assigning Parameters for Communications Connections with TCP native and ISO on TCP Data Block for Assigning Parameters To be able to assign parameters for TCP native and ISO on TSP for communications connections, create a DB that contains the data structure from the UDT 65 "TCON_PAR". This data structure contains the parameters necessary for configuring the connection. You will need such a data structure for every connection.
Open Communication via Industrial Ethernet Byte Parameter Data Type Start Value Description 9 rem_staddr_len BYTE B#16#00 10 rem_tsap_id_len BYTE B#16#00 11 next_staddr_len BYTE 12 to 27 local_tsap_id ARRAY B#16#00 ... [1..16] of BYTE 28 to 33 23-6 rem_subnet_id ARRAY [1..6] of BYTE B#16#00 B#16#00 ... Length of address for the remote connection transmission point: • 0: unspecified, i.e. parameter rem_staddr is irrelevant.
Open Communication via Industrial Ethernet Byte Parameter Data Type Start Value Description 34 to 39 rem_staddr ARRAY [1..6] of BYTE B#16#00 ... 40 to 55 56 to 61 62 to 63 rem_tsap_id next_staddr spare With connection_type = ARRAY B#16#00 ... [1..16] of BYTE ARRAY [1..6] of BYTE WORD IP address for the remote connection transmission point:, e.g. 192.168.002.003: B#16#00 ...
Open Communication via Industrial Ethernet CPU Dependencies for Connection Types The following list specifies which connection type you can use for which CPU: • connection_type=B#16#11 (TCP native): CPUs 31x-2 PN/DP as of firmware version V2.4, WinAC RTX as of V4.2 (WinAC RTX 2005) • connection_type=B#16#12 (ISO on TCP): CPUs 31x-2 PN/DP as firmware version V2.4, S7-400 CPUs (without CPU 414-4H and CPU 417-4H) as of firmware version V4.
Open Communication via Industrial Ethernet 23.4 Assigning Parameters for the Local Communications Access Point with UDP Data Block for Assigning Parameters for the Local Communications Access Point To assign parameters for the local communications access point, create a DB that contains the data structure from the UDT 65 "TCON_PAR". This data structure contains the parameters necessary for configuring the connection between the user program and the communications level of the operating system.
Open Communication via Industrial Ethernet Byte Parameter Data Type Start Value Description 12 to 27 local_tsap_id ARRAY B#16#00 ... [1..16] of BYTE • Local port no. (possible values: 2000 to 5000), local_tsap_id[1] = high byte of port no. in hexadecimal representation, local_tsap_id[2] = low byte of port no. in hexadecimal representation, local_tsap_id[3-16] = irrelevant Note: Make sure that each value of local_tsap_id that you use in your CPU is unique. 28 to 33 rem_subnet_id ARRAY [1..
Open Communication via Industrial Ethernet 23.5 Structure of the Address Information for the Remote Partner with UDP Overview With FB 67 "TUSEND", at the parameter ADDR you transfer the address of the receiver. This address information must have structure specified below. With FB 68 "TURCV", in the parameter ADDR you get the address of the sender of the data that were received. This address information must have structure specified below.
Open Communication via Industrial Ethernet 23.6 Examples of Parameters for Communications Connections Example 1: Two S7-400-CPUs via CP 443-1 Adv. Both communications partners are two CPUs 414-2 with firmware version V4.1.0. The communication occurs via two CPs 443-1 Adv. with firmware version V2.2. The following table shows the most important data for both communications partners: Property Communications Partner A: CPU 414-2 (FW V4.1.0) with CP 443-1 Adv. (FW V2.
Open Communication via Industrial Ethernet Parameter Data Type local_tsap_id ARRAY • [1..16] of • BYTE • rem_staddr rem_tsap_id next_staddr ARRAY [1..
Open Communication via Industrial Ethernet The following table shows the parameter entries in the DB relevant for passive establishment of a connection by communications partner B: Parameter Data Type Value in Example Description id WORD W#16#0416 Reference to this connection connection_type BYTE B#16#12 Connection type: ISO on TCP active_est BOOL FALSE Passive connection establishment local_device_id BYTE B#16#00 Communication AS-internal via CP local_tsap_id_len BYTE B#16#07 Length
Open Communication via Industrial Ethernet Parameter Data Type rem_tsap_id ARRAY • [1..16] of • BYTE • next_staddr ARRAY [1..
Open Communication via Industrial Ethernet Example 2: Two S7-300 CPUs with integrated PROFINET interface Both communications partners are two CPUs 319-3 PN/DP with firmware version V2.4.0. The following table shows the most important data for both communications partners: Property Communications Partner A: CPU 319-3 PN/DP (FW V2.4.0) Communications Partner B: CPU 319-3 PN/DP (FW V2.4.0) Establish connection Active Passive IP address 192.168.3.142 192.168.3.125 Local port no.
Open Communication via Industrial Ethernet The following table shows the parameter entries in the DB relevant for passive establishment of a connection by communications partner B: Parameter Data Type Value in Example Description id WORD W#16#000F Reference to this connection connection_type BYTE B#16#11 Connection type: TCP/IP native active_est BOOL FALSE Passive connection establishment local_device_id BYTE B#16#02 Communication via the integrated Ethernet interface local_tsap_id_len
Open Communication via Industrial Ethernet Example 3: Two S7-300 CPUs with integrated PROFINET interface (example for communication via UDP) Both communications partners are two CPUs 319-3 PN/DP with firmware version V2.4.0. The following table shows the most important data for both communications partners: Property Communications Partner A: CPU 319-3 PN/DP (FW V2.4.0) Communications Partner B: CPU 319-3 PN/DP (FW V2.4.0) Sender/receiver Sender Receiver IP address 192.168.3.142 192.168.3.
Open Communication via Industrial Ethernet The following table shows the parameter entries in the DB relevant for the receiver (communications partner B) for assigning parameters to the local communications access point: Parameter Data Type Value in Example Description id WORD W#16#000F Reference to this connection between the application program and the communication level of the operating system.
Open Communication via Industrial Ethernet When FB 68 "TURCV" is called at the receiver, you receive the following address parameters for the sender in the DB: Parameter Data Type Value in Example Description rem_ip_addr ARRAY [1..4] of BYTE • rem_ip_addr[1] = B#16#C0 (192) IP address of the sender: 192.168.3.
Open Communication via Industrial Ethernet 23.7 Establishing a Connection with FB 65 "TCON" Use with TCP native and ISO on TCP Both communications partners call FB 65 "TCON" to establish the communications connection. In the parameters you specify which partner is the active communications transmission point and which is the passive one. For information on the number of possible connections, please refer to the technical data for your CPU.
Open Communication via Industrial Ethernet Parameters Parameter Declaration Data Type Memory Area Description REQ INPUT BOOL I, Q, M, D, L Control parameter REQUEST, initiates establishing the connection at rising edge. ID INPUT WORD M, D, constant Reference to the connection to be established to the remote partner or between the user program and the communications level of the operating system. ID must be identical to the associated parameter ID in the local connection description.
Open Communication via Industrial Ethernet Error Information ERROR STATUS (W#16#...) Explanation 0 0000 Connection was able to be established 0 7000 Call with REQ=0, establishment of connection not initiated 0 7001 First call with REQ=1, connection being established 0 7002 Follow-on call (REQ irrelevant), connection being established 1 8086 The ID parameter must not have value of zero.
Open Communication via Industrial Ethernet 23.8 Terminating a Connection with FB 66 "TDISCON" Use with TCP native and ISO on TCP FB 66 "TDISCON" terminates a communications connection from the CPU to a communications partner. Use with UDP The FB 66 "TDISCON" closes the local communications access point. The connection between the user program and the communications level of the operating system is terminated.
Open Communication via Industrial Ethernet Parameters Parameter Declaration Data Type Memory Area Description REQ INPUT BOOL I, Q, M, D, L ID INPUT WORD M, D, constant DONE OUTPUT BOOL I, Q, M, D, L BUSY OUTPUT BOOL I, Q, M, D, L ERROR OUTPUT BOOL I, Q, M, D, L STATUS OUTPUT WORD M, D Control parameter REQUEST, initiates terminating the connection specified by the ID. Initiation occurs at rising edge.
Open Communication via Industrial Ethernet 23.9 Sending Data via TCP native and ISO on TCP with FB 63 "TSEND" Description FB 63 "TSEND" sends data over an existing communications connection. Function FB 63 "TSEND" is an asynchronously functioning FB, which means that its processing extends over several FB calls. To start sending data, call FB 63 with REQ = 1. The job status is indicated at the output parameters BUSY and STATUS.
Open Communication via Industrial Ethernet Parameters Parameter Declaration Data Type Memory Area Description REQ INPUT I, Q, M, D, L Control parameter REQUEST, initiates the transmission at rising edge. BOOL At the first call with REQ=1, data are transmitted from the area specified by the DATA parameter. ID INPUT WORD M, D, constant Reference to the connection to be terminated. ID must be identical to the associated parameter ID in the local connection description.
Open Communication via Industrial Ethernet Error Information ERROR STATUS (W#16#...) Explanation 0 0000 Send job completed without error 0 7000 First call with REQ=0, sending not initiated 0 7001 First call with REQ=1, sending initiated 0 7002 Follow-on call (REQ irrelevant ), job being processed Note: during this processing the operating system accesses the data in the DATA send buffer.
Open Communication via Industrial Ethernet 23.10 Receiving Data via TCP native and ISO on TCP with FB 64 "TRCV" Description FB 64 "TRCV" receives data over an existing communication connection. The are two variants available for receiving and processing the data: • Variant 1: Received data block is processed immediately. • Variant 2: Received data block is stored in a receive buffer and is only processed when the buffer is full.
Open Communication via Industrial Ethernet Function FB 64 "TRCV" is an asynchronously functioning FB, which means that its processing extends over several FB calls. To start receiving data, call FB 64 with REQ = 1. The job status is indicated at the output parameters BUSY and STATUS. STATUS corresponds to the RET_VAL output parameter of asynchronously functioning SFCs (see also Meaning of the Parameters REQ, RET_VAL and BUSY with Asynchronous SFCs).
Open Communication via Industrial Ethernet Parameters Parameter Declaration Data Type Memory Area Description EN_R INPUT BOOL I, Q, M, D, L Control parameter enabled to receive: when EN_R = 1, FB 64 "TRCV" is ready to receive. ID INPUT WORD M, D, constant Reference to the connection to be terminated. ID must be identical to the associated parameter ID in the local connection description.
Open Communication via Industrial Ethernet Error Information ERROR STATUS (W#16#...) Explanation 0 0000 New data were accepted. The current length of the received data is shown in RCVD_LEN. 0 7000 First call with REQ=0, receiving not initiated 0 7001 Block is ready to receive. 0 7002 Follow-on call, job being processed Note: during this processing the operating system writes the operating system data to the DATA receive buffer.
Open Communication via Industrial Ethernet 23.11 Sending Data via UDP with FB 67 "TUSEND" Description FB 67 "TUSEND" sends data via UDP to the remote partner specified by the parameter ADDR. Note When sending separate data in sequence to different partners, you only need to adjust the parameter ADDR when calling FB 67 "TUSEND". It is not necessary to call FBs 65 "TCON" and 66 "TDISCON" again.
Open Communication via Industrial Ethernet Parameters Parameter Declaration Data Type Memory Area Description REQ INPUT I, Q, M, D, L Control parameter REQUEST, initiates the transmission at rising edge. BOOL At the first call with REQ=1, bytes are transmitted from the area specified by the DATA parameter. ID INPUT WORD M, D, constant Reference to the associated connection between the user program and the communication level of the operating system.
Open Communication via Industrial Ethernet Error Information ERROR STATUS (W#16#...) Explanation 0 0000 Send job completed without error 0 7000 First call with REQ=1, sending not initiated 0 7001 First call with REQ=1, sending initiated 0 7002 Follow-on call (REQ irrelevant ), job being processed Note: during this processing the operating system accesses the data in the DATA send buffer.
Open Communication via Industrial Ethernet 23.12 Receiving Data via UDP with FB 68 "TURCV" Description FB 68 "TURCV" receives data via UDP. After successful completion of FB 68 "TURCV" the parameter ADDR will show you the address of the remote partner (the sender). Function FB 68 "TURCV" is an asynchronously functioning FB, which means that its processing extends over several FB calls. To start sending data, call FB 68 with REQ = 1. The job status is indicated at the output parameters RET_VAL and BUSY.
Open Communication via Industrial Ethernet Parameters Parameter Declaration Data Type Memory Area Description EN_R INPUT BOOL I, Q, M, D, L Control parameter enabled to receive: when EN_R = 1, FB 68 "TURCV" is ready to receive. ID INPUT WORD M, D, constant Reference to the associated connection between the user program and the communication level of the operating system. ID must be identical to the associated parameter ID in the local connection description.
Open Communication via Industrial Ethernet Error Information ERROR STATUS (W#16#...) Explanation 0 0000 New data were accepted. The current length of the received data is shown in RCVD_LEN. 0 7000 First call with REQ=0, receiving not initiated 0 7001 Block is ready to receive. 0 7002 Follow-on call, job being processed Note: during this processing the operating system writes the operating system data to the DATA receive buffer.
24 Generating Block-Related Messages 24.
Generating Block-Related Messages Logging On Display Devices Before SFBs for generating block-related messages can send a message when a signal transition is detected, at least one display device (e.g. WinCC) must be logged on for block-related messages. Parameter STATUS = 1 if no login exists. Signal transition detection One message memory with two memory blocks is available for each instance of a message block. This message memory is initially cleared.
Generating Block-Related Messages Acknowledging Messages with SFBs 33 "ALARM", 34 "ALARM_8" and 35 "ALARM_8P" A centralized acknowledgment concept is used. When you have acknowledged the message at a display device, the acknowledgment information is first sent to the CPU that generated the message. From here, the acknowledgment information is distributed to all stations logged on for this purpose. You acknowledge a signal and not an individual message.
Generating Block-Related Messages Amount of Transferable Data The data transferred with the associated values SD_i of the NOTIFY, NOTIFY_8P, ALARM and ALARM_8P SFBs must not exceed a maximum length.
Generating Block-Related Messages 24.2 Generating Block-Related Messages without Acknowledgment with SFB 36 "NOTIFY" Description SFB 36 "NOTIFY" monitors a signal. It generates a message both on a rising edge (event entering state) and on a falling edge (event leaving state). You can have up to ten associated values sent with the message. The message is sent to all stations logged on for this purpose. When the SFB is first called, a message with the current signal state is sent.
Generating Block-Related Messages Parameter Declaration Data Type Memory Area Description SD_i, IN_OUT I, Q, M, D, T, C i-th associated value ANY 1≤i ≤10 Only the following data types are permissible: BOOL (not allowed: bit field), BYTE, CHAR, WORD, INT, DWORD, DINT, REAL, DATE, TOD, TIME, S5TIME, DATE_AND_TIME. Note: If the ANY pointer accesses an DB, the DB must always be specified (for example: P# DB10.DBX5.0 Byte 10).
Generating Block-Related Messages 24.3 Generating Block Related Messages without Acknowledgement Display with SFB 31 "NOTIFY_8P" Description SFB 31 "NOTIFY_8P" represents an extension of SFB 36 "NOTIFY" to eight signals. A message is generated if at least one signal transition has been detected. A message is always generated at the initial call of SFB 31. All eight signal are allocated a common message number that is split into eight sub-messages on the displaying device.
Generating Block-Related Messages Parameter Declaration Data type Memory area Description SEVERITY INPUT WORD constant (I, Q, M, D, L) Weighting of the event Possible: 0 to 127 (value 0 = highest weighting); Default value: 64 This parameter is irrelevant for processing the message. DONE OUTPUT BOOL I, Q, M, D, L Status parameter DONE: Message generation completed. ERROR OUTPUT BOOL I, Q, M, D, L Status parameter ERROR ERROR=TRUE indicates that an error has occurred during processing.
Generating Block-Related Messages ERROR STATUS (decimal) Explanation 1 10 No access to local user memory (e.g. attempt to access a deleted DB) 1 12 At the call of the SFB 1 18 1 20 • an instance DB was specified that does not belong to SFB 31 • a global DB was specified instead of an instance DB EV_ID was already in use by one of the SFBs 31 or 33 to 36. Out of working memory. H-System: Call of the SFB during an update 1 21 The message with the specified EV_ID is locked.
Generating Block-Related Messages 24.4 Generating Block-Related Messages with Acknowledgment with SFB 33 "ALARM" Description SFB 33 "ALARM" monitors a signal. Default mode (that is, acknowledgement triggered reporting is disabled): The block generates a message both on a positive edge (event entering state) and on a negative edge (event leaving state). You can have up to ten associated values sent with the message.
Generating Block-Related Messages Parameter Declaration Data Type Memory Area Description EV_ID INPUT I, Q, M, D, L, constant Message number (0 not permitted) EV_ID is only evaluated at the first call. Subsequently, the message number used for the first call applies to every call of SFB 33 with the corresponding instance DB. DWORD STEP 7 assigns the message number automatically to ensure consistency of the message numbers. The message numbers within a user program must be unique.
Generating Block-Related Messages Error Information The following table contains all the error information specific to SFB 33 that can be output with the ERROR and STATUS parameters. ERROR STATUS (Decimal) Explanation 0 11 Warning: Message lost, signal transition/message could not be sent.
Generating Block-Related Messages 24.5 Generating Block-Related Messages with Associated Values for Eight Signals with SFB 35 "ALARM_8P" Description SFB 35 "ALARM_8P" represents a linear extension of SFB 33 "ALARM" to eight signals. As long as you have not enabled acknowledgement triggered reporting, a message will always be generated when a signal transition is detected at one or more signals (exception: a message is always sent at the first block call).
Generating Block-Related Messages Parameters Declaration Data Type Memory Area Description DONE OUTPUT BOOL I, Q, M, D, L DONE status parameter: Generation of message completed ERROR OUTPUT BOOL I, Q, M, D, L ERROR status parameter ERROR=TRUE indicates that an error has occurred during processing. For details refer to parameter STATUS.
Generating Block-Related Messages Error Information The following table contains all the error information specific to SFB 35 that can be output with the ERROR and STATUS parameters. ERROR STATUS (Decimal) Explanation 0 11 Warning: Message lost, at least one signal transition/message could not be sent.
Generating Block-Related Messages 24.6 Generating Block-Related Messages without Associated Values for Eight Signals with SFB 34 "ALARM_8" Description SFB 34 "ALARM_8" is identical to SFB 35 "ALARM_8P" except that it does not have the associated values SD_1 through SD_10.
Generating Block-Related Messages Parameter Declaration Data Type Memory Area Description ACK_STAT E OUTPUT WORD I, Q, M, D, L Bit field with the current acknowledgment status of all eight messages: (1: Event acknowledged, 0: Event not acknowledged): • Bits 0 to 7 are mapped to the incoming event of SIG_1 to SIG_8 • Bits 8 to 15 are mapped to the outgoing event of SIG_1 to SIG_8 • Initialization status: W#16#FFFF, that is, all incoming and outgoing events have been acknowledged Error Inform
Generating Block-Related Messages 24.7 Sending Archive Data with SFB 37 "AR_SEND" Description SFB 37 "AR_SEND" sends archive data to operator interface systems logged on for this purpose. These systems inform the CPU of the relevant archive number in the logon message. Depending on the memory available on the CPU and the address area used, the archive data can be up to 65534 bytes long.
Generating Block-Related Messages Error Information The following table contains all the error information that is specific to SFB 37 and can be output via the ERROR and STATUS parameters. ERROR STATUS(Decimal) Explanation 0 11 Warning: New job not active because the previous job is still busy. 0 25 Communication has started. The job is being processed. 1 1 Communications problems 1 2 Negative acknowledgment, function cannot be executed 1 3 There is no logon for the specified AR_ID.
Generating Block-Related Messages 24.8 Disabling Block-Related, Symbol-Related and Group Status Messages with SFC 10 "DIS_MSG" Description With SFC 10 "DIS_MSG" (disable message) you can disable block-related messages generated with SFBs, symbol-related messages (SCAN) and group status messages. You select messages to be disabled using the input parameters MODE and MESGN.
Generating Block-Related Messages MODE Input Parameter The table below shows the permitted values for the MODE input parameter: Value Meaning 0 All block-related, all symbol-related and all group status messages of the CPU generated with SFBs 1 All block-related messages of the CPU generated with SFBs, in other words all messages generated by the "NOTIFY", "NOTIFY_8P", "ALARM", "ALARM_8P" and "ALARM_8" SFBs 2 All group status messages of the CPU 3 All symbol-related messages of the CPU (SCAN) 5
Generating Block-Related Messages 24.9 Enabling Block-Related, Symbol-Related, and Group Status Messages with SFC 9 "EN_MSG" Description With SFC 9 "EN_MSG" (enable message), you can enable block-related, symbolrelated and group status messages that were previously disabled. You disabled the messages either at a display device or using SFC 10 "DIS_MSG." You specify the messages to be enabled using the MODE and MESGN input parameters.
Generating Block-Related Messages MODE Input Parameter The following table shows the permitted values for the MODE input parameter.
Generating Block-Related Messages 24.10 Startup Behavior of the SFBs for Generating BlockRelated Messages Restart (Warm Restart) During a warm restart, the instance DBs of the SFBs for generating block-related messages are set to the not initialized NO_INIT status. The actual parameters stored in the instance DBs are unchanged. The parameter ID and EV_ID will be evaluated at the next block call.
Generating Block-Related Messages 24.11 How the SFBs for Generating Block-Related Messages React to Problems Connection Breakdown The connections assigned to the SFB instances are monitored for breakdown. If a connection breaks down, the stations involved are removed from the internal CPU list of stations logged on for block-related messages. Any messages pending for these stations are deleted. If other stations are still logged on following a connection breakdown, they continue to receive messages.
Generating Block-Related Messages 24.12 Introduction to Generating Block-Related Messages with SFCs SFCs for Generating Block-Related Messages You can generate a block-related message with the following SFCs: • SFC 17 "ALARM_SQ" • SFC 18 "ALARM_S" • SFC 107 "ALARM_DQ" • SFC 108 "ALARM_D" These SFCs have the following properties: • The messages sent by SFC 17 "ALARM_SQ" and SFC 107 "ALARM_DQ" when the signal state is 1 can be acknowledged at a logged on display device.
Generating Block-Related Messages Message Storage To avoid messages being lost when there is a lot of traffic on the communications system, the SFCs 17, 18, 107 and 108 can both buffer two messages. If, however, messages are lost, you are informed in RET_VAL. The logged on display devices are informed of this the next time a message can be sent.
Generating Block-Related Messages Amount of transferable data The amount of data transferable using the accompanying value SD for SFCs ALARM_S, ALARM_SQ, ALARM_D and ALARM_DQ cannot exceed a maximum length.
Generating Block-Related Messages 24.13 Generating Acknowledgeable Block-Related Messages with SFC 17 "ALARM_SQ" and Permanently Acknowledged Block-Related Messages with SFC 18 "ALARM_S" Note Newly created programs should only use SFCs 107 and 108 (if your CPU supports SFCs 107 and 108) since they provide improved options for managing system resources. Description Each time they are called, SFC 17 "ALARM_SQ" and SFC 18 "ALARM_S" generate a message to which you can add associated values.
Generating Block-Related Messages Acknowledging Messages You can acknowledge messages sent by SFC 17 "ALARM_SQ" when the state of the monitored signal is 1. You can query the acknowledgment status of the last "entering event message" and the signal state at the last SFC call using SFC 19 "ALARM_SC." Messages you have sent with SFC 18 "ALARM_S" are always implicitly acknowledged. You can query the signal state at the last SFC 18 call using SFC 19 "ALARM_SC.
Generating Block-Related Messages Instance Overflow If the number of SFC 17 or SFC 18 calls is higher than the maximum amount of CPU system resources, this may result in a lack of resources (instance overflow). This is indicated both by the information in RET_VAL as well as by indications at the logged on display devices. The maximum number of SFC 17 or SFC 18 calls depends on the particular CPU. You will find this information in /70/ and /101/ .
Generating Block-Related Messages 24.
Generating Block-Related Messages 24.15 Generating Acknowledgeable and Permanently Acknowledged Block Related Messages with SFCs 107 "ALARM_DQ" and 108 "ALARM_D" Description With every call the SFCs 107 "ALARM_DQ" and 108 "ALARM_D" generate a message to which you can append an associated value. Thus, you correspond with SFCs 17 "ALARM_SQ" and 18 "ALARM_S".
Generating Block-Related Messages The SFCs 107 and 108 contain one parameter more than the SFCs 17 and 18, namely the input CMP_ID. Use this input to assign the messages generated with SFCs 107 and 108 to logical areas, for example to parts of the system. If you call SFC 107/SFC 108 in an FB the obvious thing to do is to assign the number of the corresponding instance DB to CMP_ID.
Generating Block-Related Messages Error Information Error code (W#16#...): Explanation 0000 No error occurred. 0001 • The length of the associated value exceeds the maximum permissible length, or • Access to user memory not possible (for example, access to deleted DB) The activated message is sent. • The associated value points to a value in the local data area. The message is sent. 0002 Warning: The last free message acknowledge memory was occupied.
Generating Block-Related Messages 24.16 Reading Dynamic System Resources with SFC 105 "READ_SI" How dynamically occupied system resources develop when generating messages with the SFCs 107 and 108 When messages are generated with SFCs 107 "ALARM_DQ" and 108 "ALARM_D", the operating system occupies temporarily system memory space. For example, if you do not delete a FB that exists in the CPU with SFC 107 or SFC 108 calls it may happen that corresponding system resources stay permanently occupied.
Generating Block-Related Messages Operating principle If you have not selected a sufficiently large SYS_INST target area when you called the SFC 105 in MODE=1 or MODE=3, it contains the content of all currently occupied system resources selected via MODE parameter. High system load on resources will cause a correspondingly high SFC runtime. That is, a high load on CPU performance may result in overshoot of the maximum configurable cycle monitoring time.
Generating Block-Related Messages Parameters Declaration Data type Memory Area MODE I, Q, M, D, L, Const. Job identifier INPUT INT Description Permissible values SI_ID INPUT DWORD • 1: Read all system resources • 2. Read the system resource that was occupied with EV_ID = ev_id when SFC 107-/SFC 108 was called • 3: Read the system resources that were occupied with CMP_ID = cmp_id when SFC 107-/SFC 108 was called • 0: subsequent call I, Q, M, D, L, Const.
Generating Block-Related Messages 24.17 Reading Dynamic System Resources with SFC 106 "DEL_SI" How dynamic system resources develop when generating messages with the SFCs 107 and 108 When messages are generated with SFCs 107 "ALARM_DQ" and 108 "ALARM_D", the operating system occupies temporarily system memory space. For example, if you do not delete a FB that exists in the CPU with SFC 107 or SFC 108 calls it may happen that corresponding system resources stay permanently occupied.
Generating Block-Related Messages Error Information Error code (W#16#...): Explanation 0000 No error occurred. 8081 (only with MODE=2 or 3) You have assigned the value 0 to SI_ID. 8082 (only with MODE=1) You have assigned one of 0 different values to SI_ID. 8084 You have assigned an illegal value to MODE. 8085 SFC 106 is currently being processed. 8086 Not all selected system resources could be deleted because at least one of them was being processed when SFC 106 was called.
25 IEC Timers and IEC Counters 25.1 Generating a Pulse with SFB 3 "TP" Description SFB 3 "TP" generates a pulse with the length PT. The timer runs only in the STARTUP and RUN modes. A rising signal edge at input IN starts the pulse. Output Q remains set for the time PT regardless of changes in the input signal (in other words even when the IN input changes back from 0 to 1 before the time PT has expired).The ET output provides the time for which output Q has already been set.
IEC Timers and IEC Counters Parameter Declaration Data Type Memory Area Description IN INPUT BOOL I, Q, M, D, L, constant Start input PT INPUT TIME I, Q, M, D, L, constant Duration of the pulse. PT must be positive.
IEC Timers and IEC Counters 25.2 Generating an On Delay with SFB 4 "TON" Description SFB 4 "TON" delays a rising signal edge by the time PT. The timer runs only in the STARTUP and RUN modes. A rising edge at the IN input causes a rising edge at output Q after the time PT has expired. Q then remains set until the IN input changes to 0 again. If the IN input changes to 0 before the time PT has expired, output Q remains set to 0.
IEC Timers and IEC Counters 25.3 Generating an Off Delay with SFB 5 "TOF" Description SFB 5 "TOF" delays a falling edge by the time PT. The timer runs only in the STARTUP and RUN modes. A rising edge at the IN input causes a rising edge at output Q. A falling edge at the IN input causes a falling edge at output Q delayed by the time PT. If the IN input changes back to 1 before the time PT has expired, output Q remains set to 1.
IEC Timers and IEC Counters 25.4 Counting Up with SFB 0 "CTU" Description You can count up with SFB 0 "CTU." The counter is incremented by 1 by a rising edge at the CU input (compared with the last SFB call). If the counted value reaches the upper limit of 32767, it is no longer incremented. Each subsequent rising edge at the CU input no longer has an effect. Signal level 1 at the R input resets the counter to the value 0 regardless of the value currently at the CU input.
IEC Timers and IEC Counters 25.5 Counting Down with SFB 1 "CTD" Description You can count down with SFB 1 "CTD." The counter decrements at a rising edge on the CD input (compared with the last SFB call). If the count value reaches the lower limit of -32768, it no longer decrements. Any further rising edge at the CD input then has no further effect. Signal level 1 at the LOAD input sets the counter to the preset value PV regardless of the value at the CD input.
IEC Timers and IEC Counters 25.6 Up / Down Count with SFB 2 "CTUD" Description You can count up and down with SFB 2 "CTUD." The count value is changed by a rising edge, compared with the last SFB call as follows: • At input CU it is incremented by 1 • At input CD it decrements by 1. If the count value reaches the limits, the counter reacts as follows: • The lower limit of -32768, it is no longer decrements • The upper limit of 32767, it is no longer incremented.
IEC Timers and IEC Counters The operating system resets SFB 2 "CTUD" during a cold restart. If you want SFB 2 "CTUD" to be initialized following a warm restart, you must call SFB 2 in OB100 as follows: • With R = 1 when using the block to count up • With R = 0 and LOAD = 1 and PV = required initial value for CV when using the block to count down • If instances of this SFB are located within another block, you can reset these instances, for example, by initializing the higher-level block.
26 IEC Functions 26.1 Overview You can copy the following International Electrotechnical Commission (IEC) functions from the STEP 7 library "S7libs\Stdlib30" to your program directory.
IEC Functions Name IEC Block Family Function FC11 FIND String Find in a STRING variable FC1 AD_DT_TM Floating Point Math Add duration to a time FC35 SB_DT_TM Floating Point Math Subtract duration from a time FC34 SB_DT_DT Floating Point Math Subtract two time values FC22 LIMIT Floating Point Math Limit FC25 MAX Floating Point Math Select maximum FC27 MIN Floating Point Math Select minimum FC36 SEL Floating Point Math Binary selection For more information on the IEC conform communication
IEC Functions 26.2 Technical Data of the IEC Functions Memory Requirements The following table shows how much work memory and how much load memory is required for each of the International Electrotechnical Commission (IEC) functions, and the number of bytes of local data required for each IEC function. FC No. Name Size (No.
IEC Functions FC No. Name FC34 SB_DT_DT 992 1178 30 FC22 LIMIT 426 600 12 FC25 MAX 374 532 8 FC27 MIN 374 532 8 FC36 SEL 374 560 8 26-4 Size (No.
IEC Functions 26.3 Date and Time as Complex Data Types Actual Parameters for DATE_AND_TIME The DATE_AND_TIME data type falls into the category of complex data types, along with ARRAY, STRING, and STRUCT. The permissible memory areas for complex data types are the data block (D) and local data (L) areas.
IEC Functions 26.4 Time-of-Day Functions Description FC1 AD_DT_TM The function FC1 adds a duration (format TIME) to a time (format DT) and provides a new time (format DT) as the result. The time (parameter T) must be in the range from DT#1990-01-01-00:00:00.000 to DT#2089-12-31-23:59:59.999. The function does not run an input check. If the result of the addition is not within the valid range, the result is limited to the corresponding value and the binary result (BR) bit of the status word is set to “0".
IEC Functions Description FC6 DT_DATE The function FC6 extracts the data type format DATE from the format DATE_AND_TIME. The DATE value must be between the limits DATE#1990-1-1 and DATE#2089-12-31. The function does not report any errors. Parameter Declaration Data Type Memory Area Description IN INPUT DATE_AND_TIME D, L Input variable in format DT RET_VAL OUTPUT DATE I, Q, M, D, L Return value in format DATE You can assign only a symbolically defined variable for this input.
IEC Functions Description FC8 DT_TOD The function FC8 extracts the data type format TIME_OF_DAY from the format DATE_AND_TIME. The function does not report any errors. Parameter Declaration Data Type Memory Area Description IN INPUT DATE_AND_TIME D, L Input variable in format DT RET_VAL OUTPUT TIME_OF_DAY I, Q, M, D, L Return value in format TOD You can assign only a symbolically defined variable for this input.
IEC Functions Description FC35 SB_DT_TM The function FC35 subtracts a duration (format TIME) from a time (format DT) and provides a new time (format DT) as the result. The time (parameter T) must be between DT#1990-01-01-00:00:00.000 and DT#2089-12-31-23:59:59.999. The function does not run an input check. If the result of the subtraction is not within the valid range, the result is limited to the corresponding value and the binary result (BR) bit of the status word is set to “0".
IEC Functions 26.5 Comparing DATE_AND_TIME Variables Description FC9 EQ_DT The function FC9 compares the contents of two variables in the data type format DATE_AND_TIME to find out if they are equal and outputs the result of the comparison as a return value. The return value has the signal state “1" if the time at parameter DT1 is the same as the time at parameter DT2. The function does not report any errors.
IEC Functions Description FC14 GT_DT The function FC14 compares the contents of two variables in the data type format DATE_AND_TIME to find out if one is greater than the other and outputs the result of the comparison as a return value. The return value has the signal state “1" if the time at parameter DT1 is greater (more recent) than the time at parameter DT2. The function does not report any errors.
IEC Functions Description FC23 LT_DT The function FC23 compares the contents of two variables in the data type format DATE_AND_TIME to find out if one is smaller than the other and outputs the result of the comparison as a return value. The return value has the signal state “1" if the time at parameter DT1 is smaller (less recent) than the time at parameter DT2. The function does not report any errors.
IEC Functions 26.6 Comparing STRING Variables Description FC10 EQ_STRNG The function FC10 compares the contents of two variables in the data type format STRING to find out if they are equal and outputs the result of the comparison as a return value. The return value has the signal state “1" if the string at parameter S1 is the same as the string at parameter S2. The function does not report any errors.
IEC Functions Description FC15 GT_STRNG The function FC15 compares the contents of two variables in the data type format STRING to find out if the first is greater than the other and outputs the result of the comparison as a return value. The return value has the signal state “1" if the string at parameter S1 is greater than the string at parameter S2. The characters are compared by their ASCII code (for example, 'a' is greater than 'A'), starting from the left.
IEC Functions Description FC24 LT_STRNG The function FC24 compares the contents of two variables in the data type format STRING to find out if the first is smaller than the other and outputs the result of the comparison as a return value. The return value has the signal state “1" if the string at parameter S1 is smaller than the string at parameter S2. The characters are compared by their ASCII code (for example, 'a' is smaller than 'A'), starting from the left.
IEC Functions 26.7 Editing Number Values Description FC22 LIMIT The function FC22 limits the number value of a variable to limit values which can have parameters assigned. Variables of the data types INT, DINT, and REAL are permitted as input values. All variables with parameters assigned must be of the same data type. The variable type recognized by the ANY pointer. The lower limit value (parameter MN) must be smaller than/equal to the upper limit value (parameter MX).
IEC Functions 26.8 Example in STL CALL FC 25 IN1 IN2 IN3 RET_VAL = := P#M 10.0 DINT 1 := MD20 := P#DB1.DBX 0.0 DINT 1 := P#M 40.0 DINT 1 M 0.0 Note: The admitted data types INT, DINT and REAL must be entered in the ANY pointer. Such parameters as “MD20“ are also admitted, but you must define the corresponding data type of “MD20“ in “Symbol“. Description FC27 MIN The function FC27 selects the smallest of three numerical variable values.
IEC Functions 26.9 Example in STL CALL FC 27 IN1 IN2 IN3 RET_VAL = := P#M 10.0 DINT 1 := MD20 := P#DB1.DBX 0.0 DINT 1 := P#M 40.0 DINT 1 M 0.0 Note: The admitted data types INT, DINT and REAL must be entered in the ANY pointer. Such parameters as “MD20“ are also admitted, but you must define the corresponding data type of “MD20“ in “Symbol“. Description FC36 SEL The function FC36 selects one of two variable values depending on a switch (parameter G).
IEC Functions 26.10 Editing STRING Variables Description FC2 CONCAT The function FC2 concatenates two STRING variables together to form one string. If the resulting string is longer than the variable given at the output parameter, the result string is limited to the maximum set length and the binary result (BR) bit of the status word set to “0".
IEC Functions Description FC11 FIND The function FC11 provides the position of the second string (IN2) within the first string (IN1). The search starts on the left; the first occurrence of the string is reported. If the second string is not found in the first, zero is returned. The function does not report any errors.
IEC Functions Description FC20 LEFT The function FC20 provides the first L characters of a string (where L stands for a number). If L is greater than the current length of the STRING variables, the input value is returned. With L = 0 and with a blank string as the input value, a blank string is returned. If L is negative, a blank string is returned and the binary result (BR) bit of the status word is set to “0".
IEC Functions Description FC26 MID The function FC26 provides the middle part of a string (L characters from the character P inclusive). If the sum of L and P exceeds the current length of the STRING variables, a string is returned from the character P to the end of the input value. In all other cases (P is outside the current length, P and/or L are equal to zero or negative), a blank string is returned and the binary result (BR) bit of the status word is set to “0".
IEC Functions Description FC32 RIGHT The function FC32 provides the last L characters of a string (where L stands for a number). If L is greater than the current length of the STRING variables, the input value is returned. With L = 0 and with a blank string as the input value, a blank string is returned. If L is negative, a blank string is returned and the binary result (BR) bit of the status word is set to “0".
IEC Functions 26.11 Converting Data Type Formats Description FC5 DI_STRNG The function FC5 converts a variable in DINT data type format to a string. The string is shown preceded by a sign. If the variable given at the return parameter is too short, no conversion takes place and the binary result (BR) bit of the status word is set to “0". Parameter Declaration Data Type Memory Area Description I INPUT DINT I, Q, M, D, L, Const.
IEC Functions Description FC30 R_STRNG The function FC30 converts a variable in REAL data type format to a string. The string is shown with 14 digits: ±v.nnnnnnnE±xx ± Sign v decimal point 1 digit before the n decimal point 7 digits after the x 2 exponential digits If the variable given at the return parameter is too short or if no valid floating-point number is given at parameter IN, no conversion takes place and the binary result (BR) bit of the status word is set to “0".
IEC Functions Description FC38 STRNG_I The function FC38 converts a string to a variable in INT data type format. The first character in the string may be a sign or a number, the characters which then follow must be numbers. If the length of the string is equal to zero or greater than 6, or if invalid characters are found in the string, no conversion takes place and the binary result (BR) bit of the status word is set to “0".
27 SFBs for Integrated Control 27.1 Continuous Control with SFB 41/FB 41 "CONT_C" Introduction SFB/FB "CONT_C" (continuous controller) is used on SIMATIC S7 programmable logic controllers to control technical processes with continuous input and output variables. During parameter assignment, you can activate or deactivate subfunctions of the PID controller to adapt the controller to the process.
SFBs for Integrated Control Description Apart from the functions in the setpoint and process value branches, the SFB/FB implements a complete PID controller with continuous manipulated variable output and the option of influencing the manipulated value manually. In the following, you will find a detailed description of the sub-functions: Setpoint Branch The setpoint is entered in floating-point format at the SP_INT input.
SFBs for Integrated Control Manipulated Value The manipulated value can be limited to a selected value using the LMNLIMIT function. Signaling bits indicate when a limit is exceeded by the input variable. The LMN_NORM function normalizes the output of LMNLIMIT according to the following formula: LMN = (output of LMNLIMIT) * LMN_FAC + LMN_OFF LMN_FAC has the default 1 and LMN_OFF the default 0. The manipulated value is also available in the peripheral format.
SFBs for Integrated Control CONT_C Block Diagram SP_INT PVPER_ON GAIN PV_IN DEADBAND + - 0 CRP_IN PV_NORM X 1 PV_PER DEADB_W % 1 INT ER PV PV_FAC, PV_OFF P_SEL LMN_P 0.0 0 I_SEL DISV 1 0.0 TI, INT_HOLD, I_ITL_ON, I_ITLVAL + + 0 LMN_I DIF 1 0.
SFBs for Integrated Control Input Parameters The following table contains the description of the input parameters for SFB 41/FB 41 "CONT_C." Parameter Data Type Range of Values Default Description COM_RST BOOL FALSE COMPLETE RESTART The block has an initialization routine that is processed when the input COM_RST is set. MAN_ON BOOL TRUE MANUAL VALUE ON If the input "manual value on" is set, the control loop is interrupted. A manual value is set as the manipulated value.
SFBs for Integrated Control Parameter Data Type PV_PER WORD MAN REAL GAIN REAL TI TIME TD Range of Values Default Description W#16#000 PROCESS VARIABLE PERIPHERAL 0 The process variable in the I/O format is connected to the controller at the "process variable peripheral" input. 0.0 MANUAL VALUE The "manual value" input is used to set a manual value using the operator interface functions. 2.0 PROPORTIONAL GAIN The "proportional value" input specifies the controller gain.
SFBs for Integrated Control Parameter Data Type Range of Values Default I_ITLVAL REAL -100.0 to +100.0 (%) 0.0 INITIALIZATION VALUE OF THE INTEGRAL ACTION The output of the integrator can be set at input I_ITL_ON. The initialization value is applied to the input "initialization value of the integral action." 0.0 DISTURBANCE VARIABLE For feed forward control, the disturbance variable is connected to input "disturbance variable." or phys. Value 2) DISV REAL -100.0 to +100.0 (%) or phys.
SFBs for Integrated Control Output Parameters The following table contains the description of the output parameters for SFB 41/FB41 "CONT_C." Parameter Data Type Range of Values Default Description LMN REAL 0.0 MANIPULATED VALUE The effective manipulated value is output in floating point format at the "manipulated value" output. LMN_PER WORD W#16#0000 MANIPULATED VALUE PERIPHERAL The manipulated value in the I/O format is connected to the controller at the "manipulated value peripheral" output.
SFBs for Integrated Control 27.2 Step Control with SFB 42/FB 42 "CONT_S" Introduction SFB/FB "CONT_S" (step controller) is used on SIMATIC S7 programmable logic controllers to control technical processes with digital manipulated value output signals for integrating actuators. During parameter assignment, you can activate or deactivate sub-functions of the PI step controller to adapt the controller to the process.
SFBs for Integrated Control Description Apart from the functions in the process value branch, the SFB implements a complete PI controller with a digital manipulated value output and the option of influencing the manipulated value manually. The step controller operates without a position feedback signal. In the following you will find the description of the partial functions: Setpoint Branch The setpoint is entered in floating-point format at the SP_INT input.
SFBs for Integrated Control Error Information The error output parameter RET_VAL is not used. Block Diagram SP_INT PVPER_ON GAIN PV_IN DEADBAND + - 0 CRP_IN PV_NORM X 1 PV_PER DEADB_W % ER PV PV_FAC PV_OFF INT LMNR_HS LMNLI MIT LMNR_SIM LMNR_LS PULSEOUT 1 DISV THREE_ST adapti 0 QLMNUP AND AND QLMNDN 1 + AND AND - PULSE_TM, BREAK_TM 0 MTR_TM 100.0 , 0.0 LMNRS_ON, LMNRSVAL LMNU P LMND N LMNS_ON 1 100.0 0 0.0 1 -100.0 + 0 0.0 OR LMNS_ON 1 1/TI 0.0 X + INT 0 0.
SFBs for Integrated Control Input Parameters The following table contains the description of the input parameters for SFB 42/FB 42 "CONT_S." Parameter Data Type Values Default Description COM_RST BOOL FALSE COMPLETE RESTART The block has an initialization routine that is processed when the input COM_RST is set. LMNR_HS BOOL FALSE HIGH LIMIT OF POSITION FEEDBACK SIGNAL The "actuator at upper limit stop" signal is connected to the "high limit of position feedback signal" input.
SFBs for Integrated Control Parameter Data Type Values Default Description PV_IN REAL 0.0 PROCESS VARIABLE IN An initialization value can be set at the "process variable in" input or an external process variable in floating point format can be connected. -100.0 ... +100.0 (%) or phys. value 1) PV_PER WORD W#16#0000 PROCESS VARIABLE PERIPHERAL The process variable in the I/O format is connected to the controller at the "process variable peripheral" input. GAIN REAL 2.
SFBs for Integrated Control Output Parameters The following table contains the description of the output parameters for SFB 42/FB 42 "CONT_S." Parameter Data Type QLMNUP Default Description BOOL FALSE ACTUATING SIGNAL UP If the output "actuating signal up" is set, the actuating valve is opened. QLMNDN BOOL FALSE ACTUATING SIGNAL DOWN If the output "actuating signal down" is set, the actuating valve is opened. PV REAL 0.
SFBs for Integrated Control 27.3 Pulse Generation with SFB 43/FB 43 "PULSEGEN" Introduction SFB 43 "PULSEGEN" (pulse generator) is used to structure a PID controller with pulse output for proportional actuators. The electronic manual is found under Documentation > English > STEP7 PID Control. Application Using SFB/FB "PULSEGEN," PID two or three step controllers with pulse duration modulation can be configured. The function is normally used in conjunction with the continuous controller "CONT_C.
SFBs for Integrated Control Description The PULSEGEN function transforms the input variable INV ( = manipulated value of the PID controller) by modulating the pulse duration into a pulse train with a constant period, corresponding to the cycle time at which the input variable is updated and which must be assigned in PER_TM. The duration of a pulse per period is proportional to the input variable. The cycle assigned to PER_TM is not identical to the processing cycle of the SFB/FB "PULSEGEN.
SFBs for Integrated Control Block Diagram POS_P_ON NEG_P_ON SYN_ON, STEP3_ON, ST2BI_ON MAN_ON 1 # QPOS_P INV QNEG_P 0 PER_TM, P_B_TM, RATIOFAC Accuracy of the Manipulated Value With a "sampling ratio" of 1:10 (CONT_C calls to PULSEGEN calls) the accuracy of the manipulated value in this example is restricted to 10%, in other words, set input values INV can only be simulated by a pulse duration at the QPOS output in steps of 10 %.
SFBs for Integrated Control If INV changes and if the block call is not in the first or last two call cycles of a period, the synchronization is performed. The pulse duration is recalculated and in the next cycle is output with a new period. LMN = INV = 30.0 LMN = INV = 80.0 LMN = INV = 50.0 Processing of CONT_C .... t CYCLE of CONT_C Period start 1 1 1 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 0 0 1 1 ....
SFBs for Integrated Control Modes Depending on the parameters assigned to the pulse generator, PID controllers with a three-step output or with a bipolar or unipolar two-step output can be configured. The following table illustrates the setting of the switch combinations for the possible modes. Switch Mode MAN_ON STEP3_ON ST2BI_ON Three-step control FALSE TRUE Any Two-step control with bipolar control range (-100 % to +100 %) FALSE FALSE TRUE Two-step control with unipolar control range (0 % ..
SFBs for Integrated Control The duration of the positive or negative pulses is calculated from the input variable (in %) multiplied by the period time. IPeriod time = INV 100 ∗ PER_TM The following figure shows a symmetrical curve of a three-step controller (ratio factor = 1). Duration of pos. pulse th Continuous On PER_TM PER_TM - P_ B_TM P_B_TM -100 % 100 % Continuous Off Duration of the neg.
SFBs for Integrated Control The following figure shows the asymmetric curve of the three-step controller (ratio factor = 0.5): Duration of the pos. pulse PER_TM PER_TM – P_B_TM P_B_TM -200% P_B_TM 100% PER_TM – P_B_TM PER_TM Duration of the neg. pulse Ratio Factor > 1 The pulse duration at the positive pulse output calculated from the input variable multiplied by the period time is reduced by the ratio factor. Dur. of negative pulse = Dur.
SFBs for Integrated Control Two-Step Control In two-step control, only the positive pulse output QPOS_P of PULSEGEN is connected to the on/off actuator. Depending on the manipulated value range being used, the two-step controller has a bipolar or a unipolar manipulated value range. Two-Step Control with Bipolar Manipulated Variable Range (-100% to 100%) Duration of the pos. pulse Continuously On PER_TM PER_TM - P_B_TM Continuously Off P_B_TM 0.0 % -100.0 % 100.
SFBs for Integrated Control Manual Mode in Two/Three-Step Control In the manual mode (MAN_ON = TRUE), the binary outputs of the three-step or two-step controller can be set using the signals POS_P_ON and NEG_P_ON regardless of INV.
SFBs for Integrated Control Input Parameters Parameter Data Type Range of Values Default Description INV REAL -100.0...100.0 (%) 0.0 INPUT VARIABLE An analog manipulated value is connected to the input parameter "input variable." PER_TM TIME >=20*CYCLE T#1s PERIOD TIME The constant period of pulse duration modulation is input with the "period time" input parameter. This corresponds to the sampling time of the controller.
SFBs for Integrated Control Parameter Data Type NEG_P_ON Range of Values Default Description BOOL FALSE NEGATIVE PULSE ON In the manual mode with three-step control, the output signal QNEG_P can be set at the input parameter "negative pulse on." In the manual mode with two-step control, QNEG_P is always set inversely to QPOS_P.
SFBs for Integrated Control 27.4 Example of the PULSEGEN Block Control Loop With the continuous controller CONT_C and the pulse generator PULSEGEN, you can implement a fixed setpoint controller with a switching output for proportional actuators. The following figure shows the signal flow of the control loop.
SFBs for Integrated Control Calling the Block and Connecting it The fixed setpoint controller with switching output for proportional actuators PULS_CTR consists of the blocks CONT_C and PULSEGEN. The block call is implemented so that CONT_C is called every 2 seconds (=CYCLE*RED_FAC) and PULSEGEN every 10 ms (=CYCLE). The cycle time of OB35 is set to 10 ms. The interconnection can be seen in the following figure.
SFBs for Integrated Control STL Program for FB PULS_CTR Address Declaration Name Type Comment 0.0 in SP_INT REAL Setpoint 4.0 in PV_PER WORD Process variable peripheral 6.0 in RED_FAC INT Call reduction factor 8.0 in COM_RST BOOL Complete restart 10.0 in CYCLE TIME Sampling time 14.0 out QPOS_P BOOL Actuating signal 16.0 stat DI_CONT_C FB-CONT_C Counter 142.0 stat DI_PULSEGEN FB-PULSEGEN Counter 176.0 stat SCount INT Counter 0.
28 SFBs for Compact CPUs 28.1 Positioning With Analog Output Using SFB 44 "Analog" Description To control the positioning functions via the user program, use SFB ANALOG (SFB 44). A fixed assigned analog output controls the power stage with a voltage (voltage signal) of ±10 V or with a current (current signal) of ±20 mA. • After the acceleration phase (RAM_UP) the drive approaches the target with the speed (VSetpoint).
SFBs for Compact CPUs Parameter Declarat ion Data type Address (Instance DB) LADDR INPUT WORD 0 Range of values Default Description CPU specific W#16#0310 The I/O address of your submodule, specified by you in "HW Config". If the E and A addresses are not equal, the lower one of the two must be specified. CHANNEL INPUT INT 2 0 0 Channel number STOP INPUT BOOL 4.4 TRUE/FALSE FALSE Stop run With STOP = TRUE you can stop/interrupt the run prematurely. ERR_A INPUT BOOL 4.
SFBs for Compact CPUs Parameter Declarat ion Data type Address (Instance DB) ERR OUTPUT WORD 24 Range of values Default Description Every bit "0" or "1": 0 External error: Bit 2: Zero point monitoring Bit 11: Travel range monitoring (always 1) Bit 12: operating range monitoring Bit 13: actual value monitoring Bit 14: Target home monitoring Bit 15: target range monitoring The remaining bits are reserved ST_ENBLD OUTPUT BOOL 26.0 ERROR OUTPUT BOOL STATUS OUTPUT WORD 28.0 26.
SFBs for Compact CPUs Parameters not assigned to the block (Statistical local data): Parameter Declaration Data type Address Range of (Instance values DB) Default Description ACCEL STATIC DINT 30 100 Acceleration 1 to 100,000 pulses/s DECEL STATIC DINT 34 1 to 100,000 pulses/s CHGDIFF_P STATIC DINT 38 2 0 to +10 pulses Change during run not possible. 100 2 8 Deceleration Change during run not possible.
SFBs for Compact CPUs Parameter Declaration Data type Address Range of (Instance values DB) Default Description DIR STATIC BOOL 54.1 FALSE Actual/last sense of direction TRUE/FALSE FALSE = forward (in plus direction) TRUE = reverse (in minus direction) CUTOFF STATIC BOOL 54.2 TRUE/FALSE FALSE Drive in cut-off range (as off the cut-off point to the start of the next run) CHGOVER STATIC BOOL 54.
SFBs for Compact CPUs Parameters for "Jog" Mode Parameter Declaration DRV_EN INPUT BOOL 4.0 TRUE/FALSE FALSE Drive enable DIR_P INPUT BOOL 4.2 TRUE/FALSE FALSE Jogging in plus direction (positive edge) DIR_M INPUT BOOL 4.3 TRUE/FALSE FALSE Jogging in minus direction (positive edge) MODE_IN INPUT INT 6 0, 1, 3, 4, 5 1 Operating mode, 1 = jogging WORKING OUTPUT BOOL 16.
SFBs for Compact CPUs Parameters for "Relative Step Approach" Mode Parameter Declaration DRV_EN INPUT BOOL 4.0 TRUE/FALSE FALSE Drive enable DIR_P INPUT BOOL 4.2 TRUE/FALSE FALSE Run in plus direction (positive edge) DIR_M INPUT BOOL 4.3 TRUE/FALSE FALSE Run in minus direction (positive edge) MODE_IN INPUT INT 6 0, 1, 3, 4, 5 1 Operating mode, 4 = Relative Step Approach TARGET INPUT DINT 8 1000 Distance in pulses (only positive values allowed) WORKING OUTPUT BOOL 16.
SFBs for Compact CPUs Parameters for "Absolute Step Approach" Parameter Declaration Data type Address (Instance DB) Range of values Default Description DRV_EN START INPUT BOOL 4.0 TRUE/FALSE FALSE Drive enable INPUT BOOL 4.1 TRUE/FALSE FALSE Start run (positive edge) DIR_P INPUT BOOL 4.2 TRUE/FALSE FALSE Run in plus direction (positive edge) DIR_M INPUT BOOL 4.
SFBs for Compact CPUs Parameters For The Job "Set Reference Point" Parameter Declaration Data type Address (Instance DB) Range of values Default Description SYNC OUTPUT BOOL 16.3 TRUE/FALSE FALSE Axis is synchronized Parameters not assigned to the block (Statistical local data): Parameter Declaration Data type Address (Instance DB) Range of values Default Description JOB_REQ STATIC BOOL 76.0 TRUE/FALSE FALSE Job initialization (positive edge) JOB_DONE STATIC BOOL 76.
SFBs for Compact CPUs Parameters for "Length Measurement" Operation This operation is started at the positive edge on the digital input. There are no specific input parameters. Parameter Declaration Data type Address (Instance DB) Range of values Default Description MSR_DONE OUTPUT BOOL 16.
SFBs for Compact CPUs Error Information Operating mode error (ERROR = TRUE) The output parameter ERROR is set TRUE if an error is detected. The parameter STATUS shows the cause of the error. Event class Error code Explanation W#16#2002 Wrong SFB, use SFB 44 W#16#2004 Wrong channel number (CHANNEL). Set channel "0" W#16#3001 Run job rejected because of job error in the same SFB call.
SFBs for Compact CPUs Event class Error code Explanation W#16#3402 Wrong target setting. For a rotary axis the target setting must be greater than 0 and lower than the rotary axis end value. W#16#3403 Wrong distance setting. The travel distance setpoint for the Relative Step Approach must be positive. W#16#3404 Wrong distance setting. The result, the absolute target coordinate, must be greater than 8 -5x10 . W#16#3405 Wrong distance setting.
SFBs for Compact CPUs Job Error (JOB_ERR = TRUE) The output parameter JOB_ERROR is set TRUE if an error is detected. The parameter JOB_STAT shows the cause of the error. Event class Error code Explanation W#16#4001 Axis not parameterized. Parameterize the "Positioning" submodule via HWConfig W#16#4002 Job not possible because positioning is still in progress. Wait until WORKING = FALSE, then repeat the job. W#16#4004 Unknown job. Check the job ID and then repeat the job.
SFBs for Compact CPUs 28.2 Positioning with Digital Output Using SFB 46 "DIGITAL" Description Use SFB DIGITAL ( SFB 46) to control the positioning functions via user program. The four 24-V digital outputs are assigned fixed to drive. They control the power stage. Dependent on the control mode configuration, the digital outputs control the direction and speed stages (rapid/creep speed). The distance is measured via an asymmetrical 24-V incremental transducer with two phases offset at 90 degrees.
SFBs for Compact CPUs Basic Parameters: Here we describe the SFB parameters. They apply to all operating modes. The parameters specific to the operating mode are described with the individual operating modes. Parameter Declaration Data type Address (Instance DB) Range of values Default Description LADDR INPUT WORD 0 CPU specific W#16#0310 The I/O address of your submodule, specified by you in "HW Config". If the E and A addresses are not equal, the lower one of the two must be specified.
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Description ERR OUTPUT WORD 22 Every bit "0" or "1": 0 External error: Bit2: Zero mark monitoring Bit11: Travel range monitoring (always 1) Bit12: Operating range monitoring Bit12: Actual value monitoring Bit12: Target position monitoring Bit15: Target position monitoring. The remaining bits are reserved ST_ENBLD OUTPUT BOOL 24.
SFBs for Compact CPUs Parameters not assigned to the block (Statistical local data): Parameter Declaration Data type Address (Instance DB) CHGDIFF_P STATIC DINT 28 Range of values 0 to +10 pulses 8 Default Description 1000 Switch-over difference plus: The "Changeover difference plus" defines the point at which the drive continues its forward run with creep speed.
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Description CHGOVER STATIC BOOL 44.
SFBs for Compact CPUs Parameters for "Reference run" Mode Parameter Declaration Data type Address (Instance DB) Range of values Default Description DRV_EN DIR_P INPUT BOOL 4.0 TRUE/FALSE FALSE Drive enable INPUT BOOL 4.2 TRUE/FALSE FALSE Reference run in plus direction (positive edge) DIR_M INPUT BOOL 4.3 TRUE/FALSE FALSE Reference run in minus direction (positive edge) MODE_IN INPUT INT 6 0, 1, 3, 4, 5 1 Operating mode, 3 = "Reference run" WORKING OUTPUT BOOL 14.
SFBs for Compact CPUs Parameters for " Absolute Step Approach " Parameter Declaration Data type Address (Instance DB) Range of values Default Description DRV_EN START INPUT BOOL 4.0 TRUE/FALSE FALSE Drive enable INPUT BOOL 4.1 TRUE/FALSE FALSE Start run (positive edge) DIR_P INPUT BOOL 4.2 TRUE/FALSE FALSE Run in plus direction (positive edge) DIR_M INPUT BOOL 4.
SFBs for Compact CPUs Parameters for The Job "Set Reference Point" Parameter Declaration Data type Address (Instance DB) Range of values Default Description SYNC OUTPUT BOOL 14.3 TRUE/FALSE FALSE Axis is synchronized Parameters not assigned to the block (Statistical local data): Parameter Declaration Data type Address (Instance DB) Range of values Default Description JOB_REQ STATIC BOOL 66.0 TRUE/FALSE FALSE Job initialization (positive edge) JOB_DONE STATIC BOOL 66.
SFBs for Compact CPUs Parameters for the "Length Measurement" Function This operation is started at the positive edge on the digital input. There are no specific input parameters. Parameter Declaration Data type Address (Instanc e DB) Range of values Default Description MSR_DONE OUTPUT BOOL 14.
SFBs for Compact CPUs Error Information Operating mode error (ERROR = TRUE) The output parameter ERROR is set TRUE if an error is detected. The parameter STATUS shows the cause of the error. Event class Error code Explanation W#16#2001 Wrong SFB, use SFB 46 W#16#2004 Wrong channel number (CHANNEL). Set channel "0" W#16#3001 Run job rejected because of job error in the same SFB call.
SFBs for Compact CPUs Event class Error code Explanation W#16#3404 Wrong distance setting. The result, the absolute target coordinate, must be greater 8 than -5x10 . W#16#3405 Wrong distance setting. The result, the absolute target coordinate, must be lower than 8 5x10 . W#16#3406 Wrong distance setting. The result, the absolute target coordinate, must lie within the working range (+/- half of the target range) W#16#3501 Travel distance too long.
SFBs for Compact CPUs External Error (ERR) The technical circuit monitors the run, travel distance and the connected peripheral devices. Prerequisite is that you have switched on monitoring in the "Drive", "Axis" and "Encoder" parameter screen forms. An external fault is reported when the monitoring unit is triggered. External errors can occur independent on the started operations. You must always clear external errors with ERR_A = TRUE. A set bit in the SFB parameter ERR (WORD) the external errors.
SFBs for Compact CPUs 28.3 Controlling the Counter with SFB 47 "COUNT" Description To control the positioning functions via the user program, use SFB COUNT (SFB 47).
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Description JOB_ID INPUT WORD 6 W#16#0000 Job without function W#16#0000 Job number 0 Value for write jobs.
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Description STS_C_UP OUTPUT BOOL 12.5 TRUE/FALSE FALSE Status forward direction Displayed is always the last direction of count. The value of STS_C_DN is TRUE after the first call of the SFB. COUNTVAL OUTPUT DINT 14 LATCHVAL OUTPUT DINT 18 JOB_DONE OUTPUT BOOL 22.
SFBs for Compact CPUs Parameters not assigned to the block (Statistical local data): Parameter Declaration Data type Address (Instance DB) Range of values Default Description STS_CMP STATIC BOOL 26.3 TRUE/FALSE FALSE Status comparator. Reset with RES_STS. The status bit STS_CMP indicates that the conditions for comparison for the comparator is met or has been met. STS_CMP also indicates that the output was set (STS_DO = TRUE) STS_OFLW STATIC BOOL 26.
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Description RES_STS STATIC BOOL 32.2 TRUE/FALSE FALSE Reset status bits. Resets the status bits STS_CMP, STS_OFLW, STS_UFLW and STS_ZP. Two calls of the SFB are required to reset the status bits. Note For further information on the use of SFB 47, see the manual S7-300 Programmable Controller CPU 31xC Technological Functions.
SFBs for Compact CPUs System Error BIE = False is set after a system error occurs. Event class Error code Explanation W#16#8001 Wrong operating mode or faulty parameters. Set the correct operating mode in "Configure Hardware" or use an SFB that matches the set operating mode W#16#8009 Illegal channel number. Set a channel number ≤ 3 (CPU specific value).
SFBs for Compact CPUs 28.4 Controlling the Frequency Measurement with SFB 48 "FREQUENC" Description You can operate the frequency counter via user program. In this case you must use SFB FREQUENC (SFB48).
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Description JOB_REQ INPUT BOOL 4.3 TRUE/FALSE FALSE Job initialization (positive edge) JOB_ID INPUT WORD 6 W#16#0000 = Job without function 0 Job number 0 Value for write jobs.
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Description STS_C_UP OUTPUT BOOL 12.4 TRUE/FALSE FALSE Status forward direction Displayed is always the last direction of count. The value of STS_C_UP is TRUE after the first call of the SFB. MEAS_VAL OUTPUT DINT 14 COUNTVAL OUTPUT DINT 18 JOB_DONE OUTPUT BOOL 22.
SFBs for Compact CPUs Parameters not assigned to the block (Statistical local data): Parameter Declaration Data type Address (Instance DB) Range of values Default Description STS_CMP STATIC BOOL 26.3 TRUE/FALSE FALSE Status end of measurement. Reset with RES_STS. The measured value is updated after every expired time interval. Here, the end of measurement is reported by the status bit STS_CMP STS_OFLW STATIC BOOL 26.5 TRUE/FALSE FALSE Status overflow. Reset with RES_STS.
SFBs for Compact CPUs Job Error JOB_ERR = TRUE if a job error occurs. The precise error cause is displayed in JOB_STAT. Event class Error code Explanation W#16#0221 Integration time too low. W#16#0222 Integration time too high. W#16#0231 Lower limit of the frequency is too low. W#16#0232 Upper limit of the frequency is too high. W#16#0241 Upper limit of the frequency is too low. W#16#0242 Upper limit of the frequency is too high. W#16#02FF Illegal job number.
SFBs for Compact CPUs 28.5 Controlling Pulse Width Modulation with SFB 49 "PULSE" Description To control pulse width modulation via the user program, use SFB ANALOG (SFB 49).
SFBs for Compact CPUs Parameter Declaration Data type Address (Instance DB) Range of values Default Meaning OUTP_VAL INPUT INT 6.0 in ppm: 0 to 1,000 0 Default output value if you enter an output value > 1 000 or 27648 the CPU limits it to 1,000 or 27,648 as S7 analog value: 0 to 27,648 JOB_REQ INPUT BOOL 8.0 TRUE/FALSE FALSE Job initialization (positive edge) JOB_ID INPUT WORD 10 W#16#0000 = Job without function W#16#0000 Job number 0 Value for write jobs.
SFBs for Compact CPUs Parameters not assigned to the block (Statistical local data): Parameter Declaration Data type JOB_OVAL OUTPUT DINT Address (Instance DB) 20 Range of values -2 2 31 31 up to Default Description 0 Output value for read jobs. -1 Note For further information on the use of SFB 49, see the manual S7-300 Programmable Controller CPU 31xC Technological Functions. Job Error JOB_ERR = TRUE if a job error occurs. The precise error cause is displayed in JOB_STAT.
SFBs for Compact CPUs 28.6 Sending Data (ASCII, 3964(R)) with SFB 60 "SEND_PTP" Description You can transmit a data block from a DB via SFB SEND_PTP (SFB 60). The send operation is executed after the block is called and a positive edge on control input REQ. The range of data to be transmitted is determined in SD_1 (DB number and start address). The length of the data block is determined in LEN. To enable the SFB to process the job, you must call it with R(Reset)=FALSE.
SFBs for Compact CPUs Parameters Parameters Declaration Data type Range of values Default Description REQ INPUT BOOL TRUE/FALSE FALSE Control parameter "Request": activates data exchange at the positive edge. R INPUT BOOL TRUE/FALSE FALSE Control parameter "Reset". Job is aborted. Transmission is locked. LADDR INPUT WORD CPU specific W#16#03FF The I/O address of your submodule, specified by you in "HW Config".
SFBs for Compact CPUs Parameters Declaration Data type Range of values Default Description SD_1: INPUT/ OUTPUT ANY CPU specific 0 Send parameters: Here you enter the following values: 5. The number of the DB from which the data are to be transmitted. 6. The data byte number as of which data are to be transmitted. for example: DB 10 as of byte 2 -> DB10.DBB2 LEN INPUT/ OUTPUT INT 1 to 1024 1 Here you declare the length of the data block that is to be transmitted.
SFBs for Compact CPUs 28.7 Receiving Data (ASCII, 3964(R)) with SFB 61 "RCV_PTP" Description With the SFB RCV_PTP (SFB 61) you receive data and then file them in a data block. The block is ready to receive data after it is called and when the control input EN_R is TRUE. You can cancel the current transmission by setting the signal status of parameter EN_R to FALSE. A cancelled job is terminated with an error message (STATUS output).
SFBs for Compact CPUs Parameters Parameters Declaration Data type Range of values Default Description EN_R INPUT BOOL TRUE/FALSE FALSE R INPUT BOOL TRUE/FALSE FALSE LADDR INPUT WORD CPU specific W#16#03FF NDR OUTPUT BOOL FALSE Control parameter "Enable to receive": Receive enable Control parameter "Reset". Job is aborted. The I/O address of your submodule, specified by you in "HW Config".
SFBs for Compact CPUs Data Consistency Data consistency is limited to 206 bytes. If you want consistent data transmission to exceed these 206 bytes, you must take the following points into account: Do not access the receive DB until the data have been completely received (NDR = TRUE). Then, lock the receiving DB (EN_R = FALSE) until you have processed the data.
SFBs for Compact CPUs 28.8 Deleting the Receive Buffer (ASCII, 3964(R)) with SFB 62 "RES_RCVB" Description You can clear the entire input buffer of the module, using the SFB RES_RECV (SFB 62). All stored telegrams are discarded. An incoming message frame is stored when the SFB RES_RCVB is being called. The job is activated after the block is called and at the positive edge on control input REQ. The job can run across multiple calls (program cycles).
SFBs for Compact CPUs Parameters Parameters Declaration Data type Range of values Default Description REQ INPUT BOOL TRUE/FALSE FALSE Control parameter "Request": Activates the job at the positive edge. R INPUT BOOL TRUE/FALSE FALSE Control parameter "Reset": Job is aborted. LADDR INPUT WORD CPU specific W#16#03FF I/O address of your submodule that you have set in HW Config.
SFBs for Compact CPUs 28.9 Sending Data (512(R)) with SFB 63 "SEND_RK" Description You can send a data from a data block via SFB SEND_PTP (SFB 63). The send operation is executed after the block is called and a positive edge on control input REQ. The range of data to be transmitted is determined in SD_1 (DB number and start address). The length of the data block is determined in LEN. In the SFB you also declare the receive range of the partner station.
SFBs for Compact CPUs Special Features for Sending Data Take the following special features into account when "Sending Data": • With RK512 you can only send an even number of data. If you declare an odd length (LEN) of data an additional fill byte with the value "0" is appended to the transmitted data. • In RK512 you can only declare an even offset. If you declare an odd offset the data are stored in the partner station as of the next lower even offset.
SFBs for Compact CPUs Parameters Declaration Data type Range of values Default Description DONE OUTPUT BOOL TRUE/FALSE FALSE Status parameter (This parameter is only set for the duration of one call): 1. FALSE Job has not been started or is still being executed. 2. TRUE Job has been executed error-free.
SFBs for Compact CPUs Declarations in the Message Frame The table below shows the declarations in the message frame header of the RK 512 message frame.
SFBs for Compact CPUs 28.10 Fetching Data (RK 512) with SFB 64 "FETCH RK" Description SFB FETCH_RK (SFB 64) is used to fetch a data block from a partner and store them in a data block. The send operation is executed after the block is called and a positive edge on control input REQ. The area in which the fetched data is stored is declared in RD_1 (DB number and start address). The length of the data block is declared in LEN. In the SFB you also specify the partner area from which the data are fetched.
SFBs for Compact CPUs Instance DB The SFB FETCH_RK operates in combination with an instance DB. The DB number is passed on with the call. Access to the data in the instance DB is not allowed. Special Features for (Expanded) Data Blocks Note the following special features when "Fetching Data" from a data block or an expanded data block: • With RK512 you can only send an even number of data. An additional byte is transmitted if you enter an odd length (LEN).
SFBs for Compact CPUs Parameters Declaration Data type Range of values Default Description R_TYPE INPUT CHAR ’D’, ’X’, ’M’, ’E’, ’A’, ’Z’, ’T’ ‘D’ Address type on the partner CPU ‘D’: Data block ’X’: Expanded data block ’M’: Memory bit ’E’: Inputs ’A’: Outputs ’Z’: Counters ’T’: Times R_DBNO INPUT INT 0 to 255 0 Data block number on the partner CPU R_OFFSET INPUT INT Refer to the table: ”Parameter in the FB for data source (Partner CPU)” 0 Data byte number on the partner CPU R_CF_BY
SFBs for Compact CPUs Parameters Declaration Data type Range of values Default Description STATUS OUTPUT WORD W#16#0000 to W#16#FFFF W#16#0000 Status parameter (This parameter is only set for the duration of one call): To display the status, you should copy STATUS to a free data area) STATUS has the following meaning, dependent on the ERROR bit: RD_1 INPUT/ OUTPUT ANY CPU specific 0 • ERROR=FALSE: STATUS has the value W#16#0000: Neither the warning nor the error STATUS have the value <> W
SFBs for Compact CPUs Parameter in the SFB for Data Source (Partner CPU) The table below shows the data types which can be transmitted. The value for R_OFFSET is determined by the partner CPU.
SFBs for Compact CPUs Data Consistency Data consistency is limited to 128 bytes. If you want to consistent data transmission exceeding these 128 bytes, you must take the following into account: Do not write to the currently used section of the send range SD_1 unless the transmission has been terminated. This is the case when the state parameter DONE value is set to TRUE.
SFBs for Compact CPUs 28.11 Receiving and Providing Data (RK 512) with SFB 65 "SERVE_RK" Description Use the SFB SERVE_RK (SFB 65) to receive and provide data. • Receiving data: The data are stored in the area that is specified by the partner in the RK512 message frame header. A call of the SFB is required when the communication partner executes a "Send Data" (SEND jobs) job. • Providing Data: The data are fetched from the area that is specified by the partner in the RK512 message frame header.
SFBs for Compact CPUs Instance DB The SFB SERVE_RK operates in combination with an instance DB. The DB number is passed on with the call. Access to the data in the instance DB is not allowed. How to Use Connection Memory Bits You can lock or enable SEND and FETCH jobs of your communication partner via connection memory bit. Thus, you can prevent overwriting or reading of data that have not been processed yet. You can specify a connection memory bit for every job.
SFBs for Compact CPUs Example: SEND_RK with connection memory bit In this example the communication partner transmits data to DB 101 on your CPU 1. In your CPU, set the connection memory bit 100.6 to FALSE. 9. In your communication partner, specify connection memory bit 100.6 (parameters R_CF_BYT, R_CF_BIT) for the SEND job. The connection memory bit is transferred to your CPU in the RK 512 message frame header.
SFBs for Compact CPUs Parameters Note: In this SFB the range of values are all represented in the German memory conventions. Parameters Declaration Data type Range of values Default Description SYNC_DB INPUT INT CPU specific 0 Number of the DB in which the common data for the synchronization of the RK-SFBs are stored (minimum length = 240 bytes). EN_R INPUT BOOL TRUE/FALSE FALSE Control parameter "Enable to receive" Job enable R INPUT BOOL TRUE/FALSE FALSE Control parameter "Reset".
SFBs for Compact CPUs Parameters Declaration Data type Range of values Default Description STATUS OUTPUT WORD W#16#0000 to W#16#FFFF W#16#0000 Status parameter (This parameter is only set for the duration of one call): To display the status, you should copy STATUS to a free data area) STATUS has the following meaning, dependent on the ERROR bit: L_TYPE OUTPUT CHAR ‘D’ • ERROR=FALSE: STATUS has the value W#16#0000: Neither the warning nor the error STATUS have the value <> W#16#0000: Warnin
SFBs for Compact CPUs Parameters Declaration Data type Range of values Default Description L_CF_BYT OUTPUT INT 0 to 255 0 Connection memory byte on local CPU. This parameter is only set for the duration of one call. (255: Means: no connection memory) L_CF_BIT OUTPUT INT 0 to 7 0 Connection memory bit on local CPU. This parameter is only set for the duration of one call.
SFBs for Compact CPUs 28.12 Additional Error Information of the SFBs 60 to 65 Error Information The table below shows the diverse event classes and event IDs. Error in the SFB parameter configuration" Event class Error code Event Remedy W#16#0301 Source/destination data type illegal or does not exist. Verify the parameterization and correct it if required. Illegal range (start address, length). DB illegal or does not exist. Partner delivers illegal parameters in the message frame header.
SFBs for Compact CPUs Error in the SFB parameter configuration" W#16#051D W#16#0522 Send/receive job aborted by Repeat the call of the communication block. • Reset of the communication block • Re-assigning parameters A new SEND job was started even though the previous job has not yet been completed yet. Do not start the new SEND job unless the previous send job is terminated with DONE or ERROR.
SFBs for Compact CPUs Error in the SFB parameter configuration" W#16#0703 Only for 3964(R): Confirmation time (QVZ) exceeded: After the transmission of STX the partner did not respond within the confirmation delay time. The partner device is too slow or not ready to receive, or the data link is interrupted. Prove the faulty behavior of the partner if required by hooking up an interface tester to the data link.
SFBs for Compact CPUs Error in the SFB parameter configuration" W#16#070C Only for 3964(R): Initialization conflict cannot be solved because both partners are set to low priority. Event class Error code Event Remedy W#16#0801 Only for 3964(R): Expecting the first repetition: An error was detected when the message frame was received and the CPU requested a repetition with a negative confirmation (NCC) from the partner. A repetition does not represent an error.
SFBs for Compact CPUs Error in the SFB parameter configuration" W#16#0809 Only for 3964(R): The delay time for block repetition has expired Declare the same block delay time in the parameters for the communication partner and your module. Prove the faulty behavior of the partner if required by hooking up an interface tester to the data link. W#16#080A There is no free input buffer: There was no cleared input buffer available for receiving. The SFB RCV must be called more frequently.
SFBs for Compact CPUs Error in the SFB parameter configuration" "Receiving a reaction message frame with error or an error message frame from the communication partner" Event class Error code Event W#16#0902 Only for RK 512: Memory access error Check whether the partner is equipped with in the partner station (memory does not the required data range and whether it is of a sufficient size or check the parameters of the exist) called SFB.
SFBs for Compact CPUs Error in the SFB parameter configuration" W#16#090D Only for RK 512: Up to now there is no Restart the partner PLC or set the operating restart at the partner. mode selection switch to RUN. W#16#090E Only for RK 512: Received unknown error number in the response message frame. Check whether the error is the result if disturbances or faulty partner behavior. Prove this with the help of an interface tester you hook up into the data link.
29 SFCs for H CPUs 29.1 Controlling Operation in H Systems with SFC 90 "H_CTRL" Description With SFC 90 "H_CTRL," you can influence H systems as follows: • You can prevent the standby link-up in the master CPU. This is then disabled until you cancel the setting with SFC 90 "H_CTRL" or the H system goes into STOP mode. Any request from the standby CPU to link-up with the master is stored. • You can disable updating on the master CPU.
SFCs for H CPUs The following table explains the permitted combinations of the input parameters MODE and SUBMODE. Job MODE Input SUBMODE Input Disable link-up 3 0 Re-enable link-up 4 0 Disable updating 1 0 Re-enable updating 2 0 Remove the test component specified in the SUBMODE from the cyclical self- 20 test. 0.1,...5 A test component can only be removed once. Add the test component specified in the SUBMODE to the cyclical self-test again. 21 0.1,...5 22 0.1,...
SFCs for H CPUs Identifying A Job The input parameters MODE and SUBMODE specify the job. If these match a job that is not yet completed, the SFC call is a follow-on call. Parameters Parameter Declaration Data Type Memory Area Description REQ INPUT BOOL I, Q, M, D, L, const. Level-triggered control parameter REQ=1: Triggers the job MODE INPUT BYTE I, Q, M, D, L, const. Job SUBMODE INPUT WORD I, Q, M, D, L, const.
SFCs for H CPUs Example of Using SFC 90 With SFC 90 "H_CTRL," you can make sure that no link-up and no updating is started at times when the maximum resources of the CPU are required.
30 Integrated Functions (for CPUs with integrated I/Os) 30.1 SFB 29 (HS_COUNT) Description With SFB 29 "HS_COUNT" (counter), you can influence the integrated counter function of a CPU with integrated I/Os, as follows: • Set and enter a start value. • Select and set comparison values. • Enable counters. • Enable digital outputs. • Read current counted values and current comparison values. • Query the relationship between the counted value and the comparison value.
Integrated Functions (for CPUs with integrated I/Os) Parameters Parameter Declaration Data Type Memory Area Description PRES_COUNT INPUT DINT I, Q, M, D, L, constant Start value for the counter PRES_COMP_A INPUT DINT I, Q, M, D, L, constant New comparison value COMP_A PRES_COMP_B INPUT DINT I, Q, M, D, L, constant New comparison value COMP_B EN_COUNT INPUT I, Q, M, D, L Enable the counter EN_DO INPUT BOOL I, Q, M, D, L, constant Enable the digital outputs SET_COUNT INPUT BOOL
Integrated Functions (for CPUs with integrated I/Os) 30.2 SFB 30 (FREQ_MES) Description With SFB 30 "FREQ_MES" (frequency meter), you can influence the integrated frequency meter function of a CPU with integrated I/Os, as follows: • Select and set comparison values. • Output the measured frequency. • Read the current comparison values. • Query the relationship of the measured frequency to the comparison value.
Integrated Functions (for CPUs with integrated I/Os) 30.
Integrated Functions (for CPUs with integrated I/Os) 30.4 SFB 39 (POS) Description With SFB 39 (POS), you can influence the integrated positioning function of a CPU with integrated inputs/outputs. SFB 39 (POS) provides the following functions: • Synchronization • Execution of the inching mode • Positioning SFB 39 (POS) for the integrated positioning function reads or writes data from the user program to the instance DB of the integrated function.
Integrated Functions (for CPUs with integrated I/Os) Parameter Declaration Data Type Memory Area Description ENO OUTPUT I, Q, M, D, L BOOL Error handling: 1 : no error in execution 0 : error in execution ACTUAL_POS OUTPUT DINT I, Q, M, D, L Current actual value POS_READY (status message) OUTPUT BOOL I, Q, M, D, L Positioning / inching completed if POS_READY=1 REF_VALID (status message) OUTPUT BOOL I, Q, M, D, L Reference point switch reached or not POS_VALID (status message) OUTPUT
31 Plastics Techology 31.1 SFC 63 (AB_CALL) Description SFC 63 (AB_CALL) calls an assembly code block. Assembly code blocks are logic blocks that were written in the programming language "C" or in Assembler and then compiled. Application You can only use assembly code blocks for the CPU 614. Further Information The meaning of the individual parameters of SFC 63 is explained in detail in the documentation for the CPU 614. There is a separate programming guide for programming assembly code blocks.
Plastics Techology 31-2 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
32 Diagnostic Data 32.1 Overview of the Structure of Diagnostic Data Data Record 0 and 1 of the System Data The diagnostic data of a module are located in data records 0 and 1 of the system data area (see Writing and Reading Data Records). • Data record 0 contains 4 bytes of diagnostic data that describe the current status of a signal module. • Data record 1 contains - The 4 bytes of diagnostic data, also located in data record 0 and - The diagnostic data specific to the module.
Diagnostic Data 32.
Diagnostic Data Byte Bit Meaning Remarks Data Record 4 Channel type B#16#70: Digital input B#16#72: Digital output B#16#71: Analog input B#16#73: Analog output B#16#74: FM-POS B#16#75: FM-REG B#16#76: FM-ZAEHL B#16#77: FM-TECHNO B#16#78: FM-NCU B#16#79 to B#16#7D: reserved B#16#7E: US300 B#16#7F: reserved 1 7 Further channel type exists? 0: No 0 Number of diagnostic bits output per channel by a module.
Diagnostic Data 32.3 Structure of Channel-Specific Diagnostic Data Channel-Specific Errors Starting at the byte immediately following the channel error vector, the channelspecific errors are indicated for each channel of the module. The tables below show the structure of channel-specific diagnostic data for the different channel types.
Diagnostic Data Digital Input Channel Diagnostic byte for a digital input channel: Bit Meaning Remarks 0 Configuration/parameter assignment error Can be signaled by SFC 52 and EVENTN = W#16#8x70 1 Ground error Can be signaled by SFC 52 and EVENTN = W#16#8x71 2 P short circuit (sensor) Can be signaled by SFC 52 and EVENTN = W#16#8x72 3 M short circuit Can be signaled by SFC 52 and EVENTN = W#16#8x73 4 Wire break Can be signaled by SFC 52 and EVENTN = W#16#8x74 5 No sensor power supply Ca
Diagnostic Data 32-6 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
33 System Status Lists (SSL) 33.1 Overview of the System Status Lists (SSL) This chapter describes all the partial lists of the system status list that relate to the following: • CPUs • Modules whose partial lists are not module-specific (for example, SSL-IDs W#16#00B1, W#16#00B2, W#16#00B3). Module-specific partial lists, for example, for CPs and FMs are included in the descriptions of the particular modules.
System Status Lists (SSL) Module Status Data Module status data describe the current status of the components monitored by system diagnostic functions. Diagnostic Data on Modules The modules with diagnostic capabilities assigned to a CPU have diagnostic data that are stored directly on the module. Diagnostic Buffer The diagnostic buffer contains diagnostic entries in the order in which they occur.
System Status Lists (SSL) 33.2 Structure of a Partial SSL List Basics You can read partial lists and partial list extracts using SFC 51 "RDSYSST." You specify what you want to read using the parameters SSL_ID and INDEX. Structure A partial list consists of the following: • A header and • The data records. Header The header of a partial list consists of the following: • SSL-ID • Index • Length of a data record of the partial list in bytes • Number of data records contained in the partial list.
System Status Lists (SSL) 33.3 SSL-ID SSL-ID Every partial system status list has a number. You can output a complete partial list or an extract from it. The possible partial list extracts are predefined and are identified by a number. The SSL-ID consists of the number of the partial list, the number of the partial list extract, and the module class. Structure The SSL-ID is one word long.
System Status Lists (SSL) 33.4 Possible Partial System Status Lists Subset Any one module only has a subset of all the possible partial lists. Which partial lists are available depends on the particular module. Possible SSL Partial Lists The following table lists all the possible partial lists with the number contained in the SSL-ID.
System Status Lists (SSL) 33.5 SSL-ID W#16#xy11 - Module Identification Purpose If you read the system status list with SSL-ID W#16#xy11, you obtain the module identification of this module.
System Status Lists (SSL) 33.6 SSL-ID W#16#xy12 - CPU Characteristics Purpose CPU modules have different characteristics depending on the hardware being used. Each characteristic is assigned an ID. If you read the partial list with SSL-ID W#16#xy12, you obtain the characteristics of the module.
System Status Lists (SSL) Characteristics Identifier The following table lists all the characteristics identifiers.
System Status Lists (SSL) Identifier Meaning W#16#0314 Memory bit edge instructions for data blocks (DI) W#16#0315 Memory bit edge instructions for local data (L) W#16#0316 Dynamic evaluation of the FC bit W#16#0317 Dynamic local data area with the corresponding instructions W#16#0318 Reserved W#16#0319 Reserved W#16#0401 SFC 87 "C_DIAG" is available W#16#0402 SFC 88 "C_CNTRL" is available System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01 33-9
System Status Lists (SSL) 33.7 SSL-ID W#16#xy13 - Memory Areas Purpose If you read the partial list with SSL-ID W#16#xy13, you obtain information about the memory areas of the module. Header The header of partial list SSL-ID W#16#xy13 is structured as follows: Contents Meaning SSL-ID The SSL-ID of the partial list extract W#16#0113: data record for one memory area You specify the memory area with the INDEX parameter.
System Status Lists (SSL) 33.8 SSL-ID W#16#xy14 - System Areas Purpose If you read the partial list with SSL-ID W#16#xy14, you obtain information about the system areas of the module.
System Status Lists (SSL) Name Length Meaning Code 1 word Memory type W#16#0001: volatile memory (RAM) W#16#0002: non-volatile memory (FEPROM) W#16#0003: mixed memory (RAM and FEPROM) Quantity 1 word Number of elements of the system area Reman 1 word Number of retentive elements 33-12 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
System Status Lists (SSL) 33.9 SSL-ID W#16#xy15 - Block Types Purpose If you read the partial list with SSL-ID W#16#xy15, you obtain the block types that exist on the module.
System Status Lists (SSL) 33.10 SSL-ID W#16#xy19 - Status of the Module LEDs Purpose If you read the partial list with SSL-ID W#16#xy19, you obtain the status of the module LEDs. Note If you want to read out the partial list W#16#16#xy19 for an H CPU, remember that this is only possible in the non-redundant H operating modes.
System Status Lists (SSL) Data Record A data record of the partial list with SSL-ID W#16#xy19 has the following structure: Name Length Meaning Index 1 word LED ID (only relevant for SSL-ID W#16#0119) W#16#0001: SF (group error) W#16#0002: INTF (internal error) W#16#0003: EXTF (external error) W#16#0004: RUN W#16#0005: STOP W#16#0006: FRCE (force) W#16#0007: CRST (restart) W#16#0008: BAF (battery fault/overload, short circuit of battery voltage on bus) W#16#0009: USR (user-defined) W#16#000A: USR1 (use
System Status Lists (SSL) 33.11 SSL-ID W#16#xy1C - Component Identification Purpose If you read the partial list with SSL-ID W#16#xy1C, you can identify the CPU or the PLC.
System Status Lists (SSL) Data Record A data record of the partial list with SSL-ID W#16#xy1C has the following structure: • INDEX = W#16#0001 Name Length Meaning Index 1 word • For a standard CPU and the partial list extract W#16#011C: component ID: W#16#0001 • For H CPUs and the partial list extracts W#16#021C and W#16#031C: Byte 0: bits 0 to 2: rack no.; bit 3: 0 = reserve CPU, 1 = master CPU; bits 4 to 7: 1111 Byte 1: component ID: B#16#01 Name 12 words Name of the PLC (max.
System Status Lists (SSL) • INDEX = W#16#0004 Name Length Meaning Index 1 word • For a standard CPU and the partial list extract W#16#011C: component ID: W#16#0004 • For H CPUs and the partial list extracts W#16#021C and W#16#031C: Byte 0: bits 0 to 2: rack no.
System Status Lists (SSL) • INDEX = W#16#0008 Name Length Meaning index 1 word • For a standard CPU and the partial list extract W#16#011C: component ID: W#16#0008 • For H CPUs and the partial list extracts W#16#021C and W#16#031C: Byte 0: bits 0 to 2: rack no.; bit 3: 0 = reserve CPU, 1 = master CPU; bits 4 to 7: 1111 Byte 1: component ID: B#16#08 sn_mc/mmc 16 words Serial number of the Memory Card/Micro Memory Card; character string with a max. length of 32 characters.
System Status Lists (SSL) • INDEX = W#16#000A Name Length Meaning index 1 word • For a standard CPU and the partial list extract W#16#011C: component ID: W#16#000A • For H CPUs and the partial list extracts W#16#021C and W#16#031C: Byte 0: bits 0 to 2: rack no.; bit 3: 0 = reserve CPU, 1 = master CPU; bits 4 to 7: 1111 Byte 1: component ID: B#16#0A oem_copyright_string 13 words OEM Copyright ID; character string with a max. length of 20 characters. Shorter names are filled with B#16#00.
System Status Lists (SSL) 33.12 SSL-ID W#16#xy22 - Interrupt Status Purpose The partial list with SSL ID W#16#xy22 contains information about the current status of interrupt processing and interrupt generation in the module. Header The header of the partial list with SSL-ID W#16#xy22 has the following structure: Contents Meaning SSL-ID The SSL-ID of the partial list extract: W#16#0222 INDEX Data record on the specified interrupt. The interrupt (OB no.) is specified in the INDEX parameter. OB no.
System Status Lists (SSL) Data Record A data record of partial list extract SSL-ID W#16#xy22 has the following structure: Name Length info 10 words al 1 al 2 al 3 1 word 1 word 2 words Meaning Start info for the given OB, with following exceptions: • OB 1 provides the current minimum (in bytes 8 and 9) and maximum cycle time (in bytes 10 and 11) (time base: ms, byte count begins at 0).
System Status Lists (SSL) 33.13 SSL ID W#16#xy25 - Assignment of Process Image Partitions to OBs Purpose The partial list with SSL ID W#16#xy25 shows you how process image partitions are assigned to the OBs. This list provides information about • Process image partitions you have assigned to specific OBs for update by the system • Process image partitions you have assigned to specific clock synchronization interrupt OBs (OBs 61 to 64).
System Status Lists (SSL) Data Record A data record of partial list extract SSL-ID W#16#xy25 has the following structure: Name Length Meaning tpa_nr 1 byte Partial process image ID tpa_use 1 byte Type of assignment between process image partitions and the OB: • Bit 0 = 1: The process image partition of the inputs is assigned to the specified OB for update by the system. • Bit 1 = 1: The process image partition of the outputs is assigned to the specified OB for update by the system.
System Status Lists (SSL) Example of the significance of data records Call parameters of SFC Returned variables 51 Explanation SZL_ID = W#16#0125, INDEX = W#16#0008 tpa_nr = B#16#08, tpa_use = B#16#03, ob_nr = B#16#15 A data record is returned. The input/output process images 8 are assigned to OB 21 for the update of the process image by the system. SZL_ID = W#16#0125, INDEX = W#16#0009 – No data record is returned. Thus: Process image partition 9 is not assigned to any OB.
System Status Lists (SSL) 33.14 SSL-ID W#16#xy32 - Communication Status Data Purpose If you read the partial list with SSL-ID W#16#xy32 you obtain the status data of module communication. Header The header of partial list SSL-ID W#16#xy32 is structured as follows: Contents Meaning SSL-ID The SSL ID of the partial list extract W#16#0132: Status data for one communication section of the CPU (always one data record). You specify the communication section of the CPU with the INDEX parameter.
System Status Lists (SSL) 33.15 Data Record of the Partial List Extract with SSL-ID W#16#0132 Index W#16#0005 Contents The partial list extract with SSL-ID W#16#0132 and index W#16#0005 contains information about the status of the diagnostics on the module.
System Status Lists (SSL) 33.16 Data Record of the Partial List Extract with SSL-ID W#16#0132 Index W#16#0008 Contents The partial list extract with SSL-ID W#16#0132 and index W#16#0008 contains information about the status of the time system on the module.
System Status Lists (SSL) Status Bit Default Value Description 15 0 Sign for the correction value (0: positive, 1: negative) 14 to 10 00000 Correction value This parameter allows the basic time in the frame to be corrected to local time: Local time = basic time ± correction value * 0.5 h This correction takes into account the time zone and the time difference in summer time (daylight savings time) and winter time (standard time).
System Status Lists (SSL) 33.17 Data Record of the Partial List Extract with SSL-ID W#16#0132 Index W#16#000B Contents The partial list extract with SSL ID W#16#0132 and index W#16#000B contains information about the status of the 32-bit run-time meters 0 … 7 of the module. Note The partial list extract with SSL ID W#16#0132 and index W#16#0008 displays these run-time meters in 16-bit mode.
System Status Lists (SSL) 33.18 Data Record of the Partial List Extract with SSL-ID W#16#0132 Index W#16#000C Contents The partial list extract with SSL ID W#16#0132 and index W#16#000C contains information about the status of the 32-bit run-time meters 8 … 15 of the module.
System Status Lists (SSL) 33.19 Data Record of the Partial List Extract with SSL-ID W#16#0232 Index W#16#0004 Contents The partial list extract with SSL-ID W#16#0232 and index W#16#0004 contains information about the CPU protection level and the settings of the operator mode switch and version identifications/checksums of the hardware configuration and the user program. In an H system in the RUN-REDUNDANT mode, one data record per redundant CPU is returned.
System Status Lists (SSL) 33.20 SSL-ID W#16#xy37 - Ethernet - Details of a Module Purpose The partial list with SSL-ID W#16#xy37 contains information about the configuration of the TCP/IP stack, the MAC address specified by the manufacturer and the connection properties on layer 2.
System Status Lists (SSL) Data Record A data record of partial list with SSL-ID W#16#xy37 has the following structure: Name Length Meaning logaddr 2 bytes Logical base address of the interface ip_addr 4 bytes IP address The IP address is stored in the following format (example. a.b.c.d): offset x: a, offset x+1: b, offset x+2: c, offset x+3: d subnetmask 4 bytes Subnet mask The subnet mask is stored in the following format (example. a.b.c.
System Status Lists (SSL) Name Length Meaning phys_mode 5 1 byte Status of port 5 (configured like phys_mode1) phys_mode 6 1 byte Status of port 6 (configured like phys_mode1) phys_mode 7 1 byte Status of port 7 (configured like phys_mode1) phys_mode 8 1 byte Status of port 8 (configured like phys_mode1) phys_mode 9 1 byte Status of port 9 (configured like phys_mode1) phys_mode 10 1 byte Status of port 10 (configured like phys_mode1) phys_mode 11 1 byte Status of port 11 (configured
System Status Lists (SSL) 33.21 SSL-ID W#16#xy71 - H CPU Group Information Purpose The partial list extract with SSL-ID W#16#xy71 contains information about the current status of the H system.
System Status Lists (SSL) Contents Length Meaning Mwstat2 1 byte Status byte 2 Bit 0: Bit 1: Bit 2: Bit 3: Bit 4: Bit 5: Bit 6: Bit 7: Status of the synchronization link-up 01: Synchronization between CPU 0 and CPU 1 =0: not possible =1: possible 0 0 reserved =0: CPU not inserted in rack 0 =1: CPU inserted in rack 0 (in redundant mode: bit 4 = 0) =0: CPU not inserted in rack 1 =1: CPU inserted in rack 1 (in redundant mode: bit 5 = 0) reserved Standby-master switchover since last Re-enable =0: no =
System Status Lists (SSL) Contents Length hsync_f 1 byte Meaning Status of connection quality (only valid if bit 0 is set in mwstat2) • Bit 0: Fiber optics connection quality of the synchronization modules in the upper receptacle is limited. • Bit 1: Fiber optics connection quality of the synchronization modules in the lower receptacle is limited.
System Status Lists (SSL) 33.22 SSL-ID W#16#xy74 - Status of the Module LEDs Purpose If you read the partial list SSL-ID W#16#xy74, with standard CPUs (if present) and with the H CPUs, you obtain the status of the module LEDs. If the H CPUs are in a non-redundant H mode, you obtain the LED status of the CPU addressed. If the H CPUs are in the RUN-REDUNDANT mode, the LED status of all redundant H CPUs is returned.
System Status Lists (SSL) Data Record A data record of partial list extract SSL-ID W#16#0074 has the following structure: Name Length cpu_led_ID 1 word Meaning • Byte 0 - Standard CPU: B#16#00 - H-CPU: Bits 0 to 2: rack number Bit 3: 0=standby CPU, 1=master CPU Bits 4 to 7: 1111 Byte 1: LED ID led_on 1 byte Status of the LED: 0: off 1: on led_blink 1 byte Flashing status of the LED: 0: not flashing 1: flashing normally (2 Hz) 2: flashing slowly (0.
System Status Lists (SSL) 33.23 SSL-ID W#16#xy75 - Switched DP Slaves in the H System Purpose If you read the partial list SSL-ID W#16#xy75, with CPUs of an H system in a redundant H operating mode, you obtain the status information on the communication between the H system and the switched DP slaves. The partial list tells you in which rack the DP master system interface module currently being used for communication with a DP slave is inserted.
System Status Lists (SSL) Name Length Slavestatus 1 word 33-42 Meaning Communication status: • Bit 0 = 1: No access to DP the slave interface module whose DP master interface module is inserted in rack 0 • Bit 1 = 1: No access to DP the slave interface module whose DP master interface module is inserted in rack 1 • Bits 2 to 7: Reserved (each = 0) • Bit 8 = 1: Both communication channels functioning properly; communication currently taking place via the DP master interface module in rack 0 •
System Status Lists (SSL) 33.24 SSL-ID W#16#xy90 - DP Master System Information Purpose If you read the partial list SSL-ID W#16#xy90, you obtain the status information of all DP master systems known to the CPU.
System Status Lists (SSL) Data Record A data record of partial list ID W#16#xy90 has the following structure: Name Length Meaning dp_m_id 1 byte DP master system ID rack_dp_m 1 byte Rack number of the DP master • with a standard CPU: 0 • with a H system: 0 or 1 Steckpl_dp_m 1 byte Slot of the DP master or slot of the CPU (with integrated DP interface) Subm_dp_m 1 byte • • with integrated DP interface: interface number of the DP master: - 1: X2 - 2: X1 - 3: IF1 - 4: IF2 with exte
System Status Lists (SSL) 33.25 SSL-ID W#16#xy91 - Module Status Information Purpose If you read the partial list SSL-ID W#16#xy91, you obtain the status information of modules assigned to the CPU. Note An evaluation of the SSL-ID W#16#xy91 is not possible for a submodule with packed addresses (ET 200S).
System Status Lists (SSL) Contents Meaning INDEX • For the partial list extract with SSL-ID W#16#0C91: - S7-400:bits 0 to 14: logical base address of the module Bit 15: 0 = input, 1 = output - S7-300:bits 0 to 14: any logical base address of the module Bit 15: 0 = input, 1 = output • For the partial list extract with SSL-ID W#16#4C91 (S7-400 only): Bits 0 to 14 : logical base address of the module Bit 15 : 0 = input, 1 = output • For the partial list extract with SSL-IDs W#16#0091, W#16#0191,W#
System Status Lists (SSL) A data record of partial list ID W#16#xy91 has the following structure: Name Length Meaning Adr1 1 word • For a central configuration: number of the rack • For a distributed configuration with PROFIBUS DP: DP master system ID, station number • For a distributed configuration with PROFINET IO: bit 15 = 1 (PROFINET IO identifier) the last two places in the PROFINET IO system ID, station number Note: A PROFINET interface is always handled as an "interface module in the cent
System Status Lists (SSL) Name Length Meaning Ber_bgbr 1 word Area ID/module width Bit 0 to bit 2 : module width Bit 3: reserved Bit 4 to bit 6 : area ID 0 = S7-400 1 = S7-300 2 = ET area 3 = P area 4 = Q area 5 = IM3 area 6 = IM4 area Bit 7: reserved At certain modules the following values are indicated in the record: Name PS CPU IFM-CPU Rack (only S7-400) (S7-300) (only S7-400) Adr1 Number of the rack Standard information as described above Standard information as described above Number
System Status Lists (SSL) Parameter adr1 The parameter adr1 contains: • For a central configuration, the rack number (0-31). • For a distributed configuration with PROFIBUS DP: - The DP master system ID (1-31) - The station number (0-127). • For a distributed configuration with PROFINET IO - Identifier bit for PROFINET IO (bit 15) - The last two places of the PROFINET IO system ID (0-15). To obtain the full PROFINET IO system ID, you have to add 100 (decimal) to it - The station number (0-2047).
System Status Lists (SSL) Parameter adr2 The parameter adr2 contains: • For a central configuration and for distributed configuration with PROFIBUS DP, the slot number and the submodule slot number. • For a distributed configuration with PROFINET IO, the slot number. Solltyp (expected type) and Isttyp (actual type) parameters for PROFINET IO Type ID Meaning (W#16#...
System Status Lists (SSL) 33.26 SSL-ID W#16#xy92 - Rack / Station Status Information Purpose If you read the partial list SSL-ID W#16#xy92, you obtain information about the expected and the current hardware configuration of centrally installed racks and stations of a DP master system. Reading out the SSL with SFC51 “RDSYSST” using a S7-400 CPU If you read out the partial list with SFC51 you must see to the fact that the parameters SSL_ID and INDEX of SFC51 match each other.
System Status Lists (SSL) Header The header of partial list SSL-ID W#16#xy92 is structured as follows: Contents SZL-ID Meaning SSL-ID of the partial list extract: • W#16#0092: Expected status of the central racks/stations of a DP master system connected via an integrated DP interface • W#16#4092: Expected status of the stations of a DP master system connected via an external DP interface • W#16#0192: Actual status of the central racks/stations of a DP master system connected via an integrated DP inte
System Status Lists (SSL) Data Record A data record of the partial list with the ID W#16#xy92 has the following structure: Contents Length Meaning status_0 to status_15 16 bytes Rack status/ station status or backup status.
System Status Lists (SSL) Contents Length Meaning status_4 1 byte Bit 0: Bit 7: 0 : : 0 or station 33 0 : : 0 or station 121 or station 40 : : status_15 1 byte Bit 0: Bit 7: or station 128 Information on Multicomputing (only S7-400) All the partial lists only supply information on the modules which are assigned to a CPU. In multicomputing mode you must therefore sample all the CPUs in order to obtain the data of all the connected modules.
System Status Lists (SSL) 33.27 SSL-ID W#16#0x94 - Status Information for Rack/Station Purpose The partial list with SSL-ID W#16#0x94 contains information about the expected and actual configuration of module racks in central configurations and stations of a PROFIBUS DP master system/PROFINET IO controller system.
System Status Lists (SSL) Data Record A data record of the partial list with ID W#16#0y94 has the following structure: Contents Length Meaning index 1 word 0: central module 1-31: distributed module on PROFIBUS DP 100-115: distributed module on PROFINET IO status_0 BOOL Group information 1: at least one of the following status bits has the value 1 0: all the following status bits have the value 0 status_1 BOOL Status, station 1 1: station 1 faulty (only applies to 0694) 0: station 1 OK (only app
System Status Lists (SSL) 33.28 SSL-ID W#16#xy95 - Extended DP Master System Information Purpose The partial list with the SSL ID W#16#xy95 supplies you with extended status information on all DP master systems known to the CPU. Compared to the partial list with SSL ID W#16#xy90, this list contains additional information about the clock synchronism of a DP master system.
System Status Lists (SSL) Data record A data record of the partial list with the ID W#16#xy95 is structured as follows: Name Length Meaning dp_m_id 1 byte DP master system ID/PROFINET IO system ID rack_dp_m 1 byte Module rack number of the DP master • For standard CPU: 0 • For H system: 0 or 1 steckpl_dp_m 1 byte Slot of the DP master or slot of the CPU (with integrated DP interface) subm_dp_m 1 byte • • with integrated DP interface: Interface ID of the DP master: - 1: X2 - 2: X1 -
System Status Lists (SSL) 33.29 SSL-ID W#16#xy96 - PROFINET IO and PROFIBUS DP Module Status Information Purpose The partial list with SSL-ID W#16#xy96 contains status information on all the modules assigned to the CPU. The information in the partial list with SSL-ID W#16#xy96 supplements SSL-ID W#16#xy91 and provides additional status data on submodules and interface modules. It provides information specific to PROFINET IO as well as information on PROFIBUS DP modules and central modules.
System Status Lists (SSL) Data Record A data record of the partial list with ID W#16#xy96 has the following structure: Contents Length Meaning logadr 1 word Bits 0 to 14: address of the module Bit 15: 0 = input, 1 = output System 1 word Identifier for the central module/DP master system ID /PROFINET IO system ID: 0: central module 1-31: distributed module on PROFIBUS DP 100-115: distributed module on PROFINET IO API 2 words Configured application profile (Application Process Instance = API) for
System Status Lists (SSL) Contents Length Eastat 1 word Meaning I/O status Bit 0 = 1: module fault (recognized by diagnostic interrupt) Bit 1 = 1: module available Bit 2 = 1: module not available Bit 3 = 1: module deactivated Bit 4 = 1: fault in station (substitute slot only) Bit 5 = 1: M7: module can be host module for interface module S7: A CiR process is currently active or still not complete for this module/station.
System Status Lists (SSL) 33.30 SSL-ID W#16#xyA0 - Diagnostic Buffer Purpose If you read the partial list SSL-ID W#16#xyA0, you obtain the entries in the diagnostic buffer of the module. Note S7-300-CPUs supply a maximum of 10 data records; S7-400-CPUs supply a maximum of 21 data records.
System Status Lists (SSL) 33.31 SSL-ID W#16#00B1 - Module Diagnostic Information Purpose If you read the partial list SSL-ID W#16#00B1, you obtain the first 4 diagnostic bytes of a module with diagnostic capability.
System Status Lists (SSL) Name Length Meaning byte4 1 byte Bit 0: Bit 1: Bit 2: Bit 3: Bit 4: Bit 5: Bit 6: Bit 7: Expansion rack failure (detected by IM) Processor failure EPROM error RAM error ADC/DAC error Fuse blown Hardware error lost Reserve (initialized with 0) Information on Multicomputing (only S7-400) All the partial lists only supply information on the modules which are assigned to a CPU.
System Status Lists (SSL) 33.32 SSL-ID W#16#00B2 - Diagnostic Data Record 1 with Physical Address Purpose If you read the partial list with SSL-ID W#16#00B2, you obtain diagnostic data record 1 of a module in a central rack (not for DP or submodules). You specify the number using the rack and slot number. Header The header of partial list SSL-ID W#16#00B2 is structured as follows: Contents Meaning SSL-ID W#16#00B2 INDEX W#16#xxyy: LENTHDR The length of the data record depends on the module.
System Status Lists (SSL) 33.33 SSL-ID W#16#00B3 - Module Diagnostic Data with Logical Base Address Purpose If you read the partial list SSL-ID W#16#00B3, you obtain all the diagnostic data of a module. You can also obtain this information for DP and submodules. You select the module using its logical base address.
System Status Lists (SSL) 33.34 SSL-ID W#16#00B4 - Diagnostic Data of a DP Slave Purpose If you read the partial list SSL-ID W#16#00B4, you obtain the diagnostic data of a DP slave. This diagnostic data is structured in compliance with EN 50 170 Volume 2, PROFIBUS. You select the module using the diagnostic address you configured.
System Status Lists (SSL) 33-68 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
34 Events 34.1 Events and Event ID Event All events are numbered within the SIMATIC S7 programmable logic controller. This allows you to relate a message text to an event. Event ID An event ID is assigned to every event. The event ID is structured as follows: 15 14 13 12 11 10 Event Class 9 8 IDs 7 6 5 4 3 2 1 0 Event Number Structure of the Event ID.
Events Identifier The identifier is used to distinguish the type of events. The four bits have the following significance: Bit No.
Events 34.
Events 34.
Events 34.4 Event Class 3 - Asynchronous Errors Event ID Event OB W#16#3501 Cycle time exceeded.
Events Event ID Event OB W#16#3961 Module/interface module removed, cannot be addressed OB 83 W#16#3863 Module/interface module plugged in, but wrong module type OB 83 W#16#3864 Module/interface module plugged in, but causing problem (type ID unreadable) OB 83 W#16#3865 Module plugged in, but error in module parameter assignment OB 83 W#16#3866 Module can be addressed again, load voltage error removed OB 83 W#16#3966 Module cannot be addressed, load voltage error OB 83 W#16#3367 Start
Events Event ID Event OB W#16#38C4 Distributed I/Os: station failure, leaving state OB 86 W#16#39C5 Distributed I/Os: station fault, entering state OB 86 W#16#38C5 Distributed I/Os: station fault, leaving state OB 86 W#16#38C6 Expansion rack operational again, but error(s) in module parameter assignment OB 86 W#16#38C7 DP: station operational again, but error(s) in module parameter OB 86 assignment W#16#38C8 DP: station operational again, but mismatch between setpoint and actual configura
Events 34.
Events Event ID Event W#16#494E W#16#494F W#16#4550 W#16#4555 W#16#4556 W#16#4357 W#16#4358 W#16#4959 W#16#4562 W#16#4563 W#16#4567 W#16#4568 W#16#456A W#16#456B STOP caused by power failure STOP caused by configuration error DEFECTIVE: internal system error No restart possible, monitoring time elapsed STOP: memory reset request from communication system / due to data inconsistency Module watchdog started All modules are ready for operation One or more modules not ready for operation STOP caused by prog
Events Event ID Event W#16#43B0 W#16#49B1 W#16#49B2 W#16#49B3 W#16#43B4 W#16#43B6 W#16#49D0 W#16#49D1 W#16#49D2 W#16#43D3 W#16#49D4 W#16#45D5 W#16#45D6 W#16#49D7 W#16#45D8 W#16#45D9 W#16#45DA W#16#43DC Firmware update was successful Firmware update data incorrect Firmware update: hardware version does not match firmware Firmware update: module type does not match firmware Error in firmware fuse Firmware updates canceled by redundant modules LINK-UP aborted due to violation of coordination rules LINK-UP/
Events 34.6 Event Class 5 - Mode Run-time Events Event ID Event W#16#530D New startup information in the STOP mode W#16#510F A problem as occurred with WinLC. This problem has caused the CPU to go into STOP mode or has caused a fault in the CPU.
Events 34.
Events 34.
Events Event ID Event OB W#16#75DF/74DF Start / end of F program initialization - W#16#75E1 Safety program: Error in FB "F_PLK" or "F_PLK_O" or F_CYC_CO" or "F_TEST" or "F_TESTC" W#16#7934 Standby-master switchover due to connection problem at the SYNC module OB 72 W#16#7950 Synchronization module missing OB 72 W#16#7951 Change at the SYNC module without Power On OB 72 W#16#7952/7852 SYNC module removed/inserted OB 72 W#16#7953 Change at the SYNC-module without reset OB 72 W#16#7954
Events 34.
Events Event ID Event Module type W#16#8x70 Configuration/parameter assignment error Digital input W#16#8x71 Chassis ground fault W#16#8x72 Short circuit to phase (sensor) W#16#8x73 Short circuit to ground (sensor) W#16#8x74 Wire break W#16#8x75 No sensor power supply W#16#8x80 Configuration/parameter assignment error W#16#8x81 Chassis ground fault W#16#8x82 Short circuit to phase W#16#8x83 Short circuit to ground W#16#8x84 Wire break W#16#8x85 Fuse tripped W#16#8x86 No load vo
Events 34.
Events Event ID Event W#16#9x53 Lower limit of measuring range LMR W#16#9x54 Upper alarm limit UAL W#16#9x55 Upper warning limit UWL W#16#9x56 Upper tolerance limit UTL W#16#9x57 Lower tolerance limit LTL W#16#9x58 Lower warning limit LWL W#16#9x59 Lower alarm limit LAL W#16#9x60 GRAPH7 step entering/leaving W#16#9x61 GRAPH7 interlock error W#16#9x62 GRAPH7 execution error W#16#9x63 GRAPH7 error noted W#16#9x64 GRAPH7 error acknowledged W#16#9x70 Trend exceeded in positive direct
Events 34.11 Event Classes A and B - Free User Events Event ID Event W#16#Axyz Events available for user W#16#Bxyz 34.
Events 34-20 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
35 List of SFCs, and SFBs 35.1 List of SFCs, Sorted Numerically No.
List of SFCs, and SFBs No.
List of SFCs, and SFBs No.
List of SFCs, and SFBs 35.2 Short Name List of SFCs, Sorted Alphabetically No.
List of SFCs, and SFBs Short Name No.
List of SFCs, and SFBs Short Name No.
List of SFCs, and SFBs 35.3 List of SFBs, Sorted Numerically No.
List of SFCs, and SFBs No. Short Name Function SFB 61 RECV_PTP 2) SFB 62 RES_RECV 2) SFB 63 SEND_RK 2) Receiving Data (ASCII, 3964(R)) Deleting the Receive Buffer (ASCII, 3964(R)) Sending Data (RK 512) SFB 64 FETCH_RK 2) SFB 65 SERVE_RK 2) SFB 75 SALRM Send interrupt to DP master SFB 81 RD_DPAR Read Predefined Parameter * Fetching Data (RK 512) Receiving and Providing Data (RK 512) SFB 29 "HS_COUNT" and SFB 30 "FREQ_MES" only exist on the CPU 312 IFM and CPU 314 IFM.
List of SFCs, and SFBs 35.4 List of SFBs, Sorted Alphabetically Short Name No.
List of SFCs, and SFBs Short Name No. Function TOF SFB 5 Generate an Off Delay TON SFB 4 Generate an On Delay TP SFB 3 Generate a Pulse URCV SFB 9 Uncoordinated Receiving of Data USEND SFB 8 Uncoordinated Sending of Data USTATUS SFB 23 Receive the Status of a Remote Device WRREC SFB 53 Write Data Record * SFB 29 "HS_COUNT" and SFB 30 "FREQ_MES" only exist for CPU 312 IFM and CPU 314 IFM. SFBs 38 "HSC_A_B" and 39 "POS" only exist on the CPU 314 IFM.
Bibliography /30/ Getting Started: Working with STEP 7 V5.4 /70/ Manual: S7-300 Programmable Controller Hardware and Installation /71/ Reference Manual: S7–300, M7–300 Programmable Controllers Module Specifications /72/ Instructions List: S7–300 Programmable Controller /101/ Reference Manual: S7–400, M7–400 Programmable controllers Module Specifications /102/ Instructions List: S7–400 Programmable Controller /231/ Manual: Configuring Hardware and Communication Connections, STEP 7 V5.
Bibliography Bibliography-2 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
Glossary Accompanying Value A value that can be output along with a message and provided information about the status of a variable or and address at the time the message was generated. ACCU (Accumulator) Accumulators are registers in the CPU and serve as buffers for load and transfer operations, as well as for comparison, math, and conversion operations.
Glossary Blending Control Blending control involves a controller structure in which the setpoint for the total amount SP is converted to percentages of the individual components. The total of the blending factors FAC must be 1 (= 100 %). SP1 SP1 FAC1 LMN1 Controller 1 PV1 Process 1 - SP4 LMN4 PV4 Process 4 Controller 4 FAC4 - Block-Related Message A message that is configured for a message-capable block (FB or DB).
Glossary Closed-Loop Controller A closed-loop controller is a device in which the error signal is continuously calculated and an actuating signal generated with the aim of eliminating the error signal quickly and without overshoot. Communication, Bilateral When using communication SFBs for data exchange, a distinction is made between unilateral and bilateral communication.
Glossary Continuous Controller A continuous controller is a controller in which every change in the error signal produces a change in the manipulated variable. This can adopt any value within the range of the manipulated variable. Control Device The entire device used to determine the process variable. It consists of a controller, a controlled device (i.e. actuator), and a sensor (measuring device).
Glossary Diagnostic Entry A diagnostic event is described in the diagnostic buffer using a diagnostic entry. Diagnostic Interrupt Diagnostic modules report recognized system errors using diagnostic interrupts to the CPU. Diagnostic Message The diagnostic message consists of a processed diagnostic event and is sent from the CPU to the display unit. Diagnostics Diagnostic functions incorporate all the system diagnostics and include the recognition, interpretation and reporting of errors within the PLC.
Glossary Error, Synchronous Synchronous errors are run-time errors assigned to a particular place in the user program (for example, error accessing an I/O module). When these errors occur, the operating system calls the corresponding organization blocks in which the user can program a reaction. Error, System Error System errors are errors which may occur within a PLC (not in the process). System errors can be, for example program errors in the CPU and faults in modules.
Glossary Integral Component Integral component of the controller. After a step change in the process variable (or error signal) the output variable changes with a ramp function over time at a rate of change proportional to the integral-action factor KI (= 1/TI). The integral component in a closed control loop has the effect of correcting the controller output variable until the error signal becomes zero.
Glossary Logic Block In SIMATIC S7, a logic block is a block that contains part of the STEP 7 user program. The other type of block is a data block which contains only data. The following list shows the types of logic blocks: • Organization block (OB) • Function block (FB) • Function (FC) • System function block (SFB) • System function (SFC) Message The report of the occurrence of a event.
Glossary OB Priority The operating system of the CPU differentiates between various priority classes, for example, cyclic program processing, hardware interrupt- controlled program processing. Organization blocks (OB) are assigned to each priority class, in which the S7 user can program a reaction. The OBs have different priorities, which allow them to be processed in the correct sequence when two occur at the same time and allow OBs with higher priority to interrupt those with lower priority.
Glossary Parameter, Dynamic Dynamic parameters of modules, in contrast to static parameters, can be changed by the user program during operation by calling an SFC, for example, limit values of an analog module. Parameter, Static Static parameters of modules, in contrast to dynamic parameters, cannot be changed by the user program, but only using STEP 7, for example, the input delay of a digital input module.
Glossary Priority When you assign a priority to an organization block, you determine the interrupt ability of the currently active user program so that high-priority events interrupt lower-priority events. Priority Class The operating system of a CPU has a maximum of 28 priority classes, to which the various organization blocks are assigned. The priority classes decide which OBs can interrupt other OBs.
Glossary Ratio Control • Single loop ratio controller A single loop ratio controller is used when the ratio of two process variables is more important than the absolute values of the variables. SP Controller LMN Process Ratio PV1 PV2 Quotient • Multi-loop ratio controller In a multi-loop ratio controller, the ratio of the two process variables PV1 and PV2 must be kept constant. To do this, the setpoint of the 2nd control loop is calculated from the process variable of the 1st control loop.
Glossary Run-time Error Errors which occur during execution of the user program in the PLC (not in the process). SCAN An operating system function integrated in the CPU that is used to scan for and detect a signal at set intervals in order to determine if a signal change has occurred. Standard Function Standard functions are function blocks available from SIEMENS for implementing complex tasks.
Glossary Statement List The Statement List is the assembly language of STEP 7. When a program is processed in STL, the individual instructions correspond to the sequence with which the CPU processes the program. STEP 7 Programming software for creating user programs for SIMATIC S7 controllers. STEP 7 Programming Language Programming language for SIMATIC S7 controllers. The S7 programmer can use STEP 7 in different representation types: a) Statement List, b) Control System Flowchart, c) Ladder Logic.
Glossary System Diagnostic Event An entry which is made in the diagnostic buffer of the CPU and is used to initialize operating system. System Function (SFC) A system function (SFC) is a function which is integrated in the CPU operating system and can be called in the STEP 7 user program as required. System Function Block (SFB) A system function block (SFB) is a function block integrated in the CPU operating system which can be called in the STEP 7 user program when required.
Glossary User Program The user program contains all the statements and declarations and the data for signal processing with which a system or process can be controlled. It is assigned to a programmable module (module, programmable) and can be structured in smaller units known as blocks. User Program Error Errors which may occur during the processing of the user program in a SIMATIC S7 PLC (in contrast to process errors).
Index " "DPRD_DAT"...................................... 16-19 A Aborting an Existing Connection to a Communication Partner outside the Local S7 Station with SFC 69 "X_ABORT" ....................... 22-16 Aborting an Existing Connection to a Communication Partner within the Local S7 Station with SFC 74 "I_ABORT"......................... 22-21 Access error ......................................... 11-1 Access error filter .................................
Index Changing the CPU to STOP with SFC 46 "STP" ..................................... 4-1 Channel ....................................... 32-2, 32-3 error .................................................. 32-2 information ........................................ 32-2 Characteristics of SFCs 28 to 31............ 9-2 CiR................................................... 4-4, 4-5 CiR Operation.......................................
Index Current below measuring range ........... 32-4 analog input module ......................... 32-4 CV........................................................... 6-6 Cycle time monitoring........................... 32-2 Cyclic Interrupt Organization Blocks (OB30 to OB38) ................................ 1-12 Cyclic interrupts ........................... 1-12, 12-2 OB35........................................ 1-12, 1-13 D D_TOD_DT........................................... 26-6 Data ...................
Index DPNRM_DG: ...................................... 16-15 DPRD_DAT ........................................ 16-19 DPSYC_FR: ......................................... 16-4 DPWR_DAT ....................................... 16-22 DRUM................................................. 14-11 DSTBLK.................................................. 3-2 DT_DATE ............................................. 26-7 DT_DAY ............................................... 26-7 DT_TOD ...................................
Index FB 65 "TCON" .................................... 23-21 FB 66 "TDISCON" .............................. 23-24 FB 67 "TUSEND"................................ 23-33 FB 68 "TURCV" ....................... 23-36, 23-37 FB 8 USEND ........................................ 21-9 FB 9 URCV......................................... 21-12 FBs for Cyclical Access to User Data Introduction ....................................... 18-1 FC1....................................................... 26-6 FC10...............
Index GT_DT................................................ 26-11 GT_STRNG ........................................ 26-14 H H/F events: ......................................... 34-13 H_CTRL................................................ 29-1 Handling Runtime meters with SFC 101 "RTM".................................................. 6-2 Handling Time-Delay Interrupts............ 10-1 Handling Time-of-Day Interrupts ............ 9-1 Hardware interrupt....................... 12-1, 32-2 lost: .............
Index Masking ................................................ 11-1 errors................................................. 11-1 Masking Synchronous Errors ............... 11-1 Masking Synchronous Errors with SFC 36 "MSK_FLT" .................. 11-7 Master clock: .......................................... 5-1 MAX.................................................... 26-16 Meaning of the Parameters REQ RET_VAL and BUSY with Asynchronous SFCs ................ 2-6 Measuring range exceeded..................
Index Processing Interrupt OB (OB 88)...... 1-52 Status Interrupt OB (OB 55) ............. 1-16 Time-delay interrupt OBs (OB20 to OB23) ............................................ 1-10 types of OB35 ............................................. 1-12 OB80 ............................................. 1-29 OB81 ............................................. 1-32 OB82 ............................................. 1-34 OB85 ............................................. 1-41 Update Interrupt OB (OB 56) ........
Index PRGFLT_SET_MASK .......................... 11-7 PRINT................................................. 21-33 Priority class ...............1-9, 1-10, 1-12, 1-25, ........... 1-30, 1-31, 1-32, 1-34, 1-41, 1-52, ..................... 1-53, 1-61, 1-64, 1-65, 11-9 types of OB OB121 ........................................... 1-61 OB122 ........................................... 1-64 OB35 ............................................. 1-12 OB80 ............................................. 1-29 OB81 .....
Index with SFC 51 RDSYSST .................... 13-4 Reading a Data Record with SFC 59 "RD_REC"......................................... 7-13 Reading a Runtime Meter with SFC 4 "READ_RTM"...................................... 6-6 Reading a System Status List or Partial List with SFC 51 "RDSYSST" 13-4 Reading Data from a Communication Partner outside the Local S7 Station with SFC 67 "X_GET"..................... 22-14 Reading Data from a Communication Partner within the Local S7 Station with SFC 72 "I_GET" ..
Index S S: ............................................................ 6-5 S5TI_TIM.............................................. 26-8 SALRM ................................................. 8-21 SB_DT_DT ........................................... 26-8 SB_DT_TM........................................... 26-9 SDT ........................................................ 9-4 SEL..................................................... 26-18 SEND..................................................
Index SFB DIGITAL...................................... 28-14 SFB FETCH RK.................................. 28-52 SFB FREQUENC ............................... 28-32 SFB PULSE........................................ 28-37 SFB RCV_PTP ................................... 28-43 SFB RES_RCVB ................................ 28-46 SFB SEND_PTP...................... 28-40, 28-48 SFB SERVE_RK ..................... 28-58, 28-59 SFBs..... 21-2, 21-3, 21-5, 21-6, 21-7, 21-47 parameter classification ................
Index SFC 82 CREA_DBL ............................. 3-16 SFC 83 READ_DBL ............................. 3-19 SFC 84 WRIT_DBL .............................. 3-21 SFC 85 CREA_DB ............................... 3-23 SFC 87 C_DIAG ................................. 13-18 SFC 9 EN_MSG ................................. 24-22 SFC 90 H_CTRL .................................. 29-1 Shadow Memory ......................... 17-1, 17-2 SIGN:.................................................... 10-3 Slave clocks............
Index Clock: .................................................. 5-1 Synchronization: ..................................... 5-1 Synchronizing Groups of DP Slaves with SFC 11 "DPSYC_FR" ............... 16-4 Synchronizing Slave Clocks with SFC 48 "SNC_RTCB"......................... 5-3 Synchronous Cycle Interrupt OBs (OB61 to OB 64) ............................... 1-21 Synchronous errors ...........1-61, 1-64, 11-1, ................................................. 11-7, 11-8 masking with SFC 36 MSK_FLT......
Index UPDAT_PO: ......................................... 14-3 Update Interrupt ................................... 1-17 Update Interrupt OB (OB 56)................ 1-17 Updating DP Interconnections.............. 17-6 Updating the process image input table14-1 Updating the Process Image Input Table with SFC 26 "UPDAT_PI" ....... 14-1 Updating the process image output table ....................................... 14-3 Updating the Process Image Output Table with SFC 27 "UPDAT_PO" ...............
Index Index-16 System Software for S7-300/400 System and Standard Functions - Volume 2/2 A5E00739858-01
