Page 1 ___________________ 1200 Programmable controller Preface ___________________ Product overview STEP 7 programming ___________________ software ___________________ Installation SIMATIC ___________________ PLC concepts ___________________ Device configuration S7-1200 Programmable controller ___________________ Programming concepts ___________________ Basic instructions System Manual ___________________ Extended instructions ___________________ Technology instructions ___________________ Communication ___________________ Web server...
Page 2 Note the following: WARNING Siemens products may only be used for the applications described in the catalog and in the relevant technical documentation. If products and components from other manufacturers are used, these must be recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance are required to ensure that the products operate safely and without any problems.
Page 3: Preface
Siemens products that you are using, they can provide the fastest and most efficient answers to any problems you might encounter.
Page 4 STEP 7. With My Documentation Manager, you can drag and drop topics from various documents to create your own custom manual. The customer support entry portal (http://support.automation.siemens.com) provides a link to My Documentation Manager under mySupport. ● The customer support web site also provides podcasts, FAQs, and other helpful documents for S7-1200 and STEP 7.
Page 5: Table Of Contents
Table of contents Preface ..............................3 Product overview ............................. 17 Introducing the S7-1200 PLC.......................17 Expansion capability of the CPU....................20 S7-1200 modules.........................22 New features for S7-1200 and STEP 7 V11 ................23 Basic HMI panels .........................25 STEP 7 programming software........................ 27 System requirements ........................27 Different views to make the work easier ..................28 Easy-to-use tools .........................29 2.3.1...
Page 6 Table of contents 3.3.8.4 Installing the TS adapter on a wall....................56 Wiring guidelines......................... 56 PLC concepts ............................61 Execution of the user program ....................61 4.1.1 Operating modes of the CPU ...................... 63 4.1.2 Processing the scan cycle in RUN mode..................66 4.1.3 Organization blocks (OBs) ......................
Page 7 Table of contents 5.6.4 Assigning Internet Protocol (IP) addresses ................123 5.6.4.1 Assigning IP addresses to programming and network devices ..........123 5.6.4.2 Checking the IP address of your programming device ..............125 5.6.4.3 Assigning an IP address to a CPU online..................125 5.6.4.4 Configuring an IP address for a CPU in your project..............127 5.6.5 Testing the PROFINET network ....................129...
Page 8 Table of contents 7.4.2 In-range and Out-of-range instructions ..................184 7.4.3 OK and Not OK instructions ...................... 185 Math ............................186 7.5.1 Calculate instruction........................186 7.5.2 Add, subtract, multiply and divide instructions ................187 7.5.3 Modulo instruction ........................188 7.5.4 Negation instruction ........................
Page 9 Table of contents Extended instructions ..........................233 Date and time-of-day .........................233 8.1.1 Date and time instructions ......................233 8.1.2 Set and read system clock......................235 8.1.3 Run-time meter instruction......................237 8.1.4 SET_TIMEZONE instruction ......................238 String and character........................240 8.2.1 String data overview ........................240 8.2.2 S_MOVE instruction........................240 8.2.3 String conversion instructions ....................241...
Page 10 Table of contents 8.7.2.4 DataLogWrite ..........................298 8.7.2.5 DataLogNewFile........................300 8.7.3 Working with data logs ......................302 8.7.4 Limits to the size of data log files ....................303 8.7.5 Data log example program......................305 Data block control ........................310 8.8.1 READ_DBL, WRIT_DBL (Read from or write to a DB in load memory) ........
Page 11 Table of contents 10.2.2.3 Ad hoc mode ..........................400 10.2.2.4 TCP and ISO on TCP ........................401 10.2.2.5 UDP............................415 10.2.2.6 T_CONFIG ..........................421 10.2.2.7 Common parameters for instructions..................427 10.2.3 Communication with a programming device................429 10.2.3.1 Establishing the hardware communications connection............429 10.2.3.2 Configuring the devices ......................430 10.2.3.3 Assigning Internet Protocol (IP) addresses ................431 10.2.3.4 Testing your PROFINET network ....................431 10.2.4...
Page 12 Features restricted when JavaScript is disabled ..............489 11.2.11.2 Features restricted when cookies are not allowed............... 490 11.2.11.3 Importing the Siemens security certificate ................490 11.2.11.4 Importing CSV format data logs to non-USA/UK versions of Microsoft Excel..... 491 11.3 User-defined web pages ......................492 11.3.1...
Page 13 Table of contents Communication processor ........................529 12.1 Using the RS232 and RS485 communication interfaces............529 12.2 Biasing and terminating an RS485 network connector..............530 12.3 Point-to-Point (PtP) communication...................531 12.3.1 Point-to-Point instructions ......................532 12.3.1.1 Common parameters for Point-to-Point instructions..............532 12.3.1.2 PORT_CFG instruction ......................534 12.3.1.3 SEND_CFG instruction ......................535 12.3.1.4 RCV_CFG instruction.........................537 12.3.1.5 SEND_PTP instruction.......................541...
Page 14 Table of contents 12.6 Telecontrol and TeleService with the CP 1242-7..............618 12.6.1 Connection to a GSM network ....................618 12.6.2 Applications of the CP 1242-7 ....................619 12.6.3 Other properties of the CP ......................621 12.6.4 Accessories ..........................622 12.6.5 Configuration examples for telecontrol ..................
Page 15 Table of contents A.2.4 Wiring diagrams .........................670 CPU 1212C ..........................671 A.3.1 General specifications and features ..................671 A.3.2 Digital inputs and outputs......................675 A.3.3 Analog inputs ..........................676 A.3.3.1 Step response of the built-in analog inputs of the CPU.............677 A.3.3.2 Sample time for the built-in analog ports of the CPU ..............677 A.3.3.3 Measurement ranges of the analog inputs for voltage ..............678 A.3.4...
Page 16 Table of contents A.9.3.4 Output (AQ) measurement ranges for voltage and current (SB and SM)......... 733 A.9.4 Thermocouple SBs........................734 A.9.4.1 SB 1231 1 analog thermocouple input specifications ............... 734 A.9.4.2 Basic operation for a thermocouple ..................736 A.9.5 RTD SBs ........................... 738 A.9.5.1 SB 1231 1 analog RTD input specifications................
Page 17: Product Overview
Product overview Introducing the S7-1200 PLC The S7-1200 controller provides the flexibility and power to control a wide variety of devices in support of your automation needs. The compact design, flexible configuration, and powerful instruction set combine to make the S7-1200 a perfect solution for controlling a wide variety of applications.
Page 18 94BProduct overview 1.1 Introducing the S7-1200 PLC Table 1- 1 Comparing the CPU models Feature CPU 1211C CPU 1212C CPU 1214C Physical size (mm) 90 x 100 x 75 90 x 100 x 75 110 x 100 x 75 User memory Work 25 Kbytes 25 Kbytes...
Page 19 94BProduct overview 1.1 Introducing the S7-1200 PLC Table 1- 2 Blocks, timers and counters supported by S7-1200 Element Description Blocks Type OB, FB, FC, DB Size 25 Kbytes (CPU 1211C and CPU 1212C) 50 Kbytes (CPU 1214C) Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs) Address range for FBs, FCs, 1 to 65535 (such as FB 1 to FB 65535) and DBs...
Page 20: Expansion Capability Of The Cpu
94BProduct overview 1.2 Expansion capability of the CPU Expansion capability of the CPU The S7-1200 family provides a variety of modules and plug-in boards for expanding the capabilities of the CPU with additional I/O or other communication protocols. For detailed information about a specific module, see the technical specifications (Page 657).
Page 21 94BProduct overview 1.2 Expansion capability of the CPU Table 1- 4 Analog signal modules and signal boards Type Input only Output only Combination In/Out ③ 1 x 12 bit Analog In 1 x Analog Out   analog SB 1 x 16 bit RTD ...
Page 22: S7-1200 Modules
94BProduct overview 1.3 S7-1200 modules S7-1200 modules Table 1- 6 S7-1200 expansion modules Type of module Description ① The CPU supports one plug-in Status LEDs on expansion board: the SB ② Removable user A signal board (SB) provides  wiring connector additional I/O for your CPU.
Page 23: New Features For S7-1200 And Step 7 V11
94BProduct overview 1.4 New features for S7-1200 and STEP 7 V11 New features for S7-1200 and STEP 7 V11 STEP 7 V11 and the S7-1200 CPU firmware V2.2 provide additional capabilities and features. ● To allow you more control of how you define the data in your user program, S7-1200 provides additional data types, such as pointers, indexed arrays, and structures.
Page 24 94BProduct overview 1.4 New features for S7-1200 and STEP 7 V11 ● You can copy-protect (Page 156) your user program or code blocks by binding them to a specific CPU or memory card. ● You can capture the values of a DB (Page 644) to set those values as the start values. ●...
Page 25: Basic Hmi Panels
94BProduct overview 1.5 Basic HMI panels New modules for the S7-1200 A variety of new modules expand the power of the S7-1200 CPU and to provide the flexibility to meet your automation needs: ● New I/O signal modules (SMs) including a new SM 1222 DQ8 RLY Changeover ●...
Page 26 94BProduct overview 1.5 Basic HMI panels Basic HMI Panel Description Technical data 6" touch screen with 6 tactile keys 500 tags  Color (TFT, 256 colors) or Mono  50 process screens  (STN, gray scales) 200 alarms  115.2 mm x 86.4 mm (5.7") ...
Page 27: Step 7 Programming Software
STEP 7 programming software STEP 7 provides a user-friendly environment to develop, edit, and monitor the logic needed to control your application, including the tools for managing and configuring all of the devices in your project, such as controllers and HMI devices. To help you find the information you need, STEP 7 provides an extensive online help system.
Page 28: Different Views To Make The Work Easier
95BSTEP 7 programming software 2.2 Different views to make the work easier Different views to make the work easier STEP 7 provides a user-friendly environment to develop controller logic, configure HMI visualization, and setup network communication. To help increase your productivity, STEP 7 provides two different views of the project: a task-oriented set of portals that are organized on the functionality of the tools (Portal view), or a project-oriented view of the elements within the project (Project view).
Page 29: Easy-To-Use Tools
95BSTEP 7 programming software 2.3 Easy-to-use tools Easy-to-use tools 2.3.1 Inserting instructions into your user program STEP 7 provides task cards that contain the instructions for your program. The instructions are grouped according to function. To create your program, you drag instructions from the task card onto a network.
Page 30: Creating A Complex Equation With A Simple Instruction
95BSTEP 7 programming software 2.3 Easy-to-use tools 2.3.3 Creating a complex equation with a simple instruction The Calculate instruction lets you create a math function that operates on multiple input parameters to produce the result, according to the equation that you define. In the Basic instruction tree, expand the Math functions folder.
Page 31: Adding Inputs Or Outputs To A Lad Or Fbd Instruction
95BSTEP 7 programming software 2.3 Easy-to-use tools (in1) Analog input value value (in2) Upper limit for the scaled input value high (in3) Lower limit for the scaled input value (in4) Upper limit for the scaled output value high (in5) Lower limit for the scaled ouput value In the "Edit Calculate"...
Page 32: Expandable Instructions
95BSTEP 7 programming software 2.3 Easy-to-use tools ● To add an input or output, click the "Create" icon or right-click on an input stub for one of the existing IN or OUT parameters and select the "Insert input" command. ● To remove an input or output, right-click on the stub for one of the existing IN or OUT parameters (when there are more than the original two inputs) and select the "Delete"...
Page 33: Modifying The Appearance And Configuration Of Step 7
95BSTEP 7 programming software 2.3 Easy-to-use tools 2.3.7 Modifying the appearance and configuration of STEP 7 You can select a variety of settings, such as the appearance of the interface, language, or the folder for saving your work. Select the "Settings" command from the "Options"...
Page 34: Changing The Operating Mode Of The Cpu
95BSTEP 7 programming software 2.3 Easy-to-use tools To display two editors at one time, use the "Split editor" menu commands or buttons in the toolbar. To toggle between the editors that have been opened, click the icons in the editor bar. 2.3.9 Changing the operating mode of the CPU The CPU does not have a physical switch for changing the operating mode (STOP or RUN).
Page 35 95BSTEP 7 programming software 2.3 Easy-to-use tools You can capture up to 10 block states in your project. Block states are still accessible after the project has been saved. However, closing the project removes any captured block states. The ability to capture and restore the state of the program block is more powerful than the "Undo"...
Page 36: Changing The Call Type For A Db
95BSTEP 7 programming software 2.3 Easy-to-use tools 2.3.11 Changing the call type for a DB STEP 7 allows you to easily create or change the association of a DB for an instruction or an FB that is in an FB. ...
Page 37: Temporarily Disconnecting Devices From A Network
95BSTEP 7 programming software 2.3 Easy-to-use tools 2.3.12 Temporarily disconnecting devices from a network You can disconnect individual network devices from the subnet. Because the configuration of the device is not removed from the project, you can easily restore the connection to the device.
Page 38: Virtual Unplugging Of Devices From The Configuration
95BSTEP 7 programming software 2.3 Easy-to-use tools 2.3.13 Virtual unplugging of devices from the configuration STEP 7 provides a storage area for "unplugged" modules. You can drag a module from the rack to save the configuration of that module. These unplugged modules are saved with your project, allowing you to reinsert the module in the future without having to...
Page 39: Installation
The small size of the S7-1200 allows you to make efficient use of space. WARNING The SIMATIC S7-1200 PLCs are Open Type Controllers. It is required that you install the S7-1200 in a housing, cabinet, or electric control room. Entry to the housing, cabinet, or electric control room should be limited to authorized personnel.
Page 40: Power Budget
96BInstallation 3.2 Power budget ① ③ Side view Vertical installation ② ④ Horizontal installation Clearance area Power budget Your CPU has an internal power supply that provides power for the CPU, the signal modules, signal board and communication modules and for other 24 VDC user power requirements.
Page 41 96BInstallation 3.2 Power budget If you require an external 24 VDC power supply, ensure that the power supply is not connected in parallel with the sensor supply of the CPU. For improved electrical noise protection, it is recommended that the commons (M) of the different power supplies be connected.
Page 42: Installation And Removal Procedures
96BInstallation 3.3 Installation and removal procedures Installation and removal procedures 3.3.1 Mounting dimensions for the S7-1200 devices Table 3- 1 Mounting dimensions (mm) S7-1200 Devices Width A Width B CPU 1211C and CPU 1212C 90 mm 45 mm CPU 1214C 110 mm 55 mm Signal modules...
Page 43 96BInstallation 3.3 Installation and removal procedures A 25 mm thermal zone must be provided above and below the unit for free air circulation. Installing and removing the S7-1200 devices The CPU can be easily installed on a standard DIN rail or on a panel. DIN rail clips are provided to secure the device on the DIN rail.
Page 44: Installing And Removing The Cpu
96BInstallation 3.3 Installation and removal procedures Always ensure that whenever you replace or install an S7-1200 device you use the correct module or equivalent device. WARNING Incorrect installation of an S7-1200 module may cause the program in the S7-1200 to function unpredictably.
Page 45 96BInstallation 3.3 Installation and removal procedures Table 3- 2 Installing the CPU on a DIN rail Task Procedure 1. Install the DIN rail. Secure the rail to the mounting panel every 75 mm. 2. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power.
Page 46: Installing And Removing An Sb Or A Cb
96BInstallation 3.3 Installation and removal procedures 3.3.3 Installing and removing an SB or a CB Table 3- 4 Installing an SB or a CB Task Procedure 1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power. 2.
Page 47: Installing And Removing An Sm
96BInstallation 3.3 Installation and removal procedures 3.3.4 Installing and removing an SM Table 3- 6 Installing an SM Task Procedure Install your SM after installing the CPU. 1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power. 2.
Page 48: Installing And Removing A Cm Or Cp
96BInstallation 3.3 Installation and removal procedures Table 3- 7 Removing an SM Task Procedure You can remove any SM without removing the CPU or other SMs in place. 1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power.
Page 49 96BInstallation 3.3 Installation and removal procedures Table 3- 9 Removing a CM or CP Task Procedure Remove the CPU and CM as a unit from the DIN rail or panel. 1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power.
Page 50: Removing And Reinstalling The S7-1200 Terminal Block Connector
96BInstallation 3.3 Installation and removal procedures 3.3.6 Removing and reinstalling the S7-1200 terminal block connector The CPU, SB and SM modules provide removable connectors to make connecting the wiring easy. Table 3- 10 Removing the connector Task Procedure Prepare the system for terminal block connector removal by removing the power from the CPU and opening the cover above the connector.
Page 51: Installing And Removing The Expansion Cable
96BInstallation 3.3 Installation and removal procedures 3.3.7 Installing and removing the expansion cable The S7-1200 expansion cable provides additional flexibility in configuring the layout of your S7-1200 system. Only one expansion cable is allowed per CPU system. You install the expansion cable either between the CPU and the first SM, or between any two SMs.
Page 52: Ts (Teleservice) Adapter
96BInstallation 3.3 Installation and removal procedures Table 3- 14 Removing the female connector of the expansion cable Task Procedure 1. Ensure that the CPU and all S7-1200 equipment are disconnected from electrical power. 2. Unlock the connector: – Place a screwdriver beside the tab on the top of the signal module.
Page 53: Installing The Sim Card
96BInstallation 3.3 Installation and removal procedures CAUTION ④ The TS module can be damaged if you touch the contacts of the plug connector of the TS module. Follow ESD guidelines in order to avoid damaging the TS module through electrostatic discharge. Before connecting a TS module and TS Adapter, make sure that both are in an idle state.
Page 54: Installing The Ts Adapter Unit
96BInstallation 3.3 Installation and removal procedures Table 3- 15 Installing the SIM card Procedure Task Use a sharp object to press the eject button of the SIM card tray (in the direction of the arrow) and remove the SIM card tray. ①...
Page 55 96BInstallation 3.3 Installation and removal procedures Table 3- 16 Installing and removing the TS Adapter Task Procedure Installation: ① ② 1. Hook the TS Adapter with attached TS module on the DIN rail 2. Rotate the unit back until it engages. 3.
Page 56: Installing The Ts Adapter On A Wall
96BInstallation 3.4 Wiring guidelines 3.3.8.4 Installing the TS adapter on a wall Prerequisites: You must have connected the TS Adapter and TS module. ① 1. Move the attachment slider to the backside of the TS Adapter and TS module in the direction of the arrow until it engages.
Page 57 96BInstallation 3.4 Wiring guidelines Ensure that you follow all applicable electrical codes when wiring the S7-1200 and related equipment. Install and operate all equipment according to all applicable national and local standards. Contact your local authorities to determine which codes and standards apply to your specific case.
Page 58 96BInstallation 3.4 Wiring guidelines To maintain the safe character of the S7-1200 low voltage circuits, external connections to communications ports, analog circuits, and all 24 V nominal power supply and I/O circuits must be powered from approved sources that meet the requirements of SELV, PELV, Class 2, Limited Voltage, or Limited Power according to various standards.
Page 59 96BInstallation 3.4 Wiring guidelines All S7-1200 modules have removable connectors for user wiring. To prevent loose connections, ensure that the connector is seated securely and that the wire is installed securely into the connector. To avoid damaging the connector, be careful that you do not over-tighten the screws.
Page 60 96BInstallation 3.4 Wiring guidelines Typical suppressor circuit for DC or relay outputs that switch DC inductive loads In most applications, the addition of a diode (A) across a DC inductive load is suitable, but if your application requires faster turn-off times, then the addition of a Zener diode (B) is recommended.
Page 61: Plc Concepts
PLC concepts Execution of the user program The CPU supports the following types of code blocks that allow you to create an efficient structure for your user program: ● Organization blocks (OBs) define the structure of the program. Some OBs have predefined behavior and start events, but you can also create OBs with custom start events.
Page 62 97BPLC concepts 4.1 Execution of the user program ● Inserting or removing a module in the central rack under power (hot) is not supported. Never insert or remove a module from the central rack when the CPU has power.. WARNING Insertion or removal of a module (SM, SB, CD, CM or CP) from the central rack when the CPU has power could cause unpredictable behavior, resulting in damage to equipment and/or injury to personnel.
Page 63: Operating Modes Of The Cpu
97BPLC concepts 4.1 Execution of the user program You can specify whether digital and analog I/O points are to be automatically updated and stored in the process image. If you insert a module in the device view, its data is located in the process image of the CPU (default).
Page 64 97BPLC concepts 4.1 Execution of the user program A memory reset clears all work memory, clears retentive and non-retentive memory areas, and copies load memory to work memory. A memory reset does not clear the diagnostics buffer or the permanently saved values of the IP address. Note When you download one or more DBs from STEP 7 V11 to an S7-1200 V2 CPU, the retentive and non-retentive values of those DBs are set to their start values.
Page 65 97BPLC concepts 4.1 Execution of the user program STARTUP ① Clears the I (image) memory area Writes Q memory to the physical outputs ② Initializes the outputs with either the Copies the state of the physical inputs to I last value or the substitute value memory ③...
Page 66: Processing The Scan Cycle In Run Mode
97BPLC concepts 4.1 Execution of the user program After the execution of the startup OBs finishes, the CPU goes to RUN mode and processes the control tasks in a continuous scan cycle. 4.1.2 Processing the scan cycle in RUN mode For each scan cycle, the CPU writes the outputs, reads the inputs, executes the user program, updates communication modules, and responds to user interrupt events and communication requests.
Page 67 97BPLC concepts 4.1 Execution of the user program Specific events in the CPU trigger the execution of an organization block. OBs cannot call each other or be called from an FC or FB. Only a start event, such as a diagnostic interrupt or a time interval, can start the execution of an OB.
Page 68: Event Execution Priorities And Queuing
97BPLC concepts 4.1 Execution of the user program 4.1.4 Event execution priorities and queuing The CPU processing is controlled by events. An event triggers an interrupt OB to be executed. You can specify the interrupt OB for an event during the creation of the block, during the device configuration, or with an ATTACH or DETACH instruction.
Page 69 97BPLC concepts 4.1 Execution of the user program The time and diagnostic error interrupt events are triggered when the CPU detects an error. These events are at a higher priority class that the other interrupt events and can interrupt the execution of the time delay, cyclic and hardware interrupt events. One interrupt OB can be specified for each of the time error and diagnostic error interrupt events.
Page 70 97BPLC concepts 4.1 Execution of the user program Event OB number Quantity allowed Start event OB priority Diagnostic error OB 82 1 event (only if OB 82 was Module transmits an error loaded) Time error OB 80 1 event (only if OB 80 was Maximum cycle time was ...
Page 71 97BPLC concepts 4.1 Execution of the user program The queue overflow occurred condition results if the interrupts are occurring faster than they can be processed. The number of pending (queued) events is limited using a different queue for each event type. If an event occurs when the corresponding queue is full, a time error event is generated.
Page 72 97BPLC concepts 4.1 Execution of the user program Diagnostic error events trigger the execution of OB 82 if it exists. If OB 82 does not exist, then the CPU ignores the error. No diagnostic error interrupt OB 82 is present when you create a new project.
Page 73: Monitoring The Cycle Time
97BPLC concepts 4.1 Execution of the user program 4.1.5 Monitoring the cycle time The cycle time is the time that the CPU operating system requires to execute the cyclic phase of the RUN mode. The CPU provides two methods of monitoring the cycle time: ●...
Page 74 97BPLC concepts 4.1 Execution of the user program Table 4- 5 Range for the cycle time Cycle time Range (ms) Default Maximum scan cycle time 1 to 6000 150 ms Fixed minimum scan cycle time 1 to maximum scan cycle time Disabled The maximum scan cycle time is always enabled.
Page 75: Cpu Memory
97BPLC concepts 4.1 Execution of the user program 4.1.6 CPU memory Memory management The CPU provides the following memory areas to store the user program, data, and configuration: ● Load memory is non-volatile storage for the user program, data and configuration. When a project is downloaded to the CPU, it is first stored in the Load memory area.
Page 76 97BPLC concepts 4.1 Execution of the user program Retentive memory Data loss after power failure can be avoided by marking certain data as retentive. The following data can be configured to be retentive: ● Bit memory(M): You can define the precise width of the memory for bit memory in the PLC tag table or in the assignment list.
Page 77 97BPLC concepts 4.1 Execution of the user program Diagnostics buffer The CPU supports a diagnostic buffer which contains an entry for each diagnostic event. Each entry includes a date and time the event occurred, an event category, and an event description.
Page 78: System And Clock Memory
97BPLC concepts 4.1 Execution of the user program 4.1.6.1 System and clock memory You use the CPU properties to enable bytes for "system memory" and "clock memory". Your program logic can reference the individual bits of these functions by their tag names. ●...
Page 79 97BPLC concepts 4.1 Execution of the user program Table 4- 6 System memory Reserved Always off Always on Diagnostic status First scan indicator indicator Value 0 Value 0 Value 1 1: First scan after  1: Change  startup 0: No change ...
Page 80: Configuring The Outputs On A Run-To-Stop Transition
97BPLC concepts 4.2 Data storage, memory areas, I/O and addressing 4.1.6.2 Configuring the outputs on a RUN-to-STOP transition You can configure the behavior of the digital and analog outputs when the CPU is in STOP mode. For any output of a CPU, SB or SM, you can set the outputs to either freeze the value or use a substitute value: ●...
Page 81 97BPLC concepts 4.2 Data storage, memory areas, I/O and addressing Each different memory location has a unique address. Your user program uses these addresses to access the information in the memory location. References to the input (I) or output (Q) memory areas, such as I0.3 or Q1.7, access the process image. To immediately access the physical input or output, append the reference with ":P"...
Page 82 97BPLC concepts 4.2 Data storage, memory areas, I/O and addressing Memory area identifier Bytes of the memory area Byte address: byte 3 Bits of the selected byte Separator ("byte.bit") Bit location of the byte (bit 4 of 8) In the example, the memory area and byte address (M = bit memory area, and 3 = Byte 3) are followed by a period (".") to separate the bit address (bit 4).
Page 83 97BPLC concepts 4.2 Data storage, memory areas, I/O and addressing I_:P accesses are also restricted to the size of inputs supported by a single CPU, SB, or SM, rounded up to the nearest byte. For example, if the inputs of a 2 DI / 2 DQ SB are configured to start at I4.0, then the input points can be accessed as I4.0:P and I4.1:P or as IB4:P.
Page 84 97BPLC concepts 4.2 Data storage, memory areas, I/O and addressing Table 4- 13 Absolute addressing for M memory M[byte address].[bit address] M26.7 Byte, Word, or Double Word M[size][starting byte address] MB20, MW30, MD50 Temp (temporary memory): The CPU allocates the temp memory on an as-needed basis. The CPU allocates the temp memory for the code block at the time when the code block is started (for an OB) or is called (for an FC or FB).
Page 85: Processing Of Analog Values
97BPLC concepts 4.3 Processing of analog values Configuring the I/O in the CPU and I/O modules When you add a CPU and I/O modules to your configuration screen, I and Q addresses are automatically assigned. You can change the default addressing by selecting the address field in the configuration screen and typing new numbers.
Page 86: Data Types
97BPLC concepts 4.4 Data types Data types Data types are used to specify both the size of a data element as well as how the data are to be interpreted. Each instruction parameter supports at least one data type, and some parameters support multiple data types.
Page 87: Bool, Byte, Word, And Dword Data Types
97BPLC concepts 4.4 Data types Table 4- 15 Size and range of the BCD format Format Size (bits) Numeric Range Constant Entry Examples BCD16 -999 to 999 123, -123 BCD32 -9999999 to 9999999 1234567, -1234567 4.4.1 Bool, Byte, Word, and DWord data types Table 4- 16 Bit and bit sequence data types Data...
Page 88: Integer Data Types
97BPLC concepts 4.4 Data types 4.4.2 Integer data types Table 4- 17 Integer data types (U = unsigned, S = short, D= double) Data type Bit size Number Range Constant examples Address examples USInt 0 to 255 78, 2#01001110 MB0, DB1.DBB4, Tag_name SInt -128 to 127...
Page 89: Time And Date Data Types
97BPLC concepts 4.4 Data types 4.4.4 Time and Date data types Table 4- 19 Time and date data types Data type Size Range Constant Entry Examples Time 32 bits T#-24d_20h_31m_23s_648ms to T#5m_30s T#24d_20h_31m_23s_647ms T#1d_2h_15m_30s_45ms TIME#10d20h30m20s630ms Stored as: -2,147,483,648 ms to +2,147,483,647 500h10000ms 10d20h30m20s630ms Date...
Page 90 97BPLC concepts 4.4 Data types DTL (Date and Time Long) data type uses a12 byte structure that saves information on date and time. You can define DTL data in either the Temp memory of a block or in a DB. A value for all components must be entered in the "Start value"...
Page 91 97BPLC concepts 4.4 Data types String The CPU supports the String data type for storing a sequence of single-byte characters. The String data type contains a total character count (number of characters in the string) and the current character count. The String type provides up to 256 bytes for storing the maximum total character count (1 byte), the current character count (1 byte), and up to 254 characters, with each character stored in 1 byte.
Page 92: Data Structure Data Type
97BPLC concepts 4.4 Data types To create an array from the block interface editor, name the array and choose data type "Array [lo .. hi] of type", then edit "lo", "hi", and "type" as follows: ● lo - the starting (lowest) index for your array ●...
Page 93: Plc Data Type
97BPLC concepts 4.4 Data types A Struct variable begins at an even-byte address and uses the memory to the next word boundary. 4.4.6 PLC data type The PLC data type editor lets you define data structures that you can use multiple times in your program.
Page 94: Pointer" Pointer Data Type
97BPLC concepts 4.4 Data types 4.4.7.1 "Pointer" pointer data type The data type Pointer points to a particular variable. It occupies 6 bytes (48 bits) in memory and can include the following information: ● DB number or 0 if the data is not stored in a DB ●...
Page 95: Any" Pointer Data Type
97BPLC concepts 4.4 Data types 4.4.7.2 "Any" pointer data type The pointer data type ANY ("Any") points to the beginning of a data area and specifies its length. The ANY pointer uses 10 bytes in memory and can include the following information: ●...
Page 96: Variant" Pointer Data Type
97BPLC concepts 4.4 Data types Hexadecimal code Data type Description b#16#06 DWord 32-bit double word b#16#07 DInt 32-bit double integer b#16#36 UDInt 32-bit-unsigned double integer b#16#08 Real 32-Bit floating point b#16#0B Time Time b#16#13 String Character string Table 4- 30 Memory area encoding in the ANY pointer: Hexadecimal code Memory area...
Page 97 97BPLC concepts 4.4 Data types ● "<Data block name>".<tag name>.bn (byte access) ● "<Data block name>".<tag name>.wn (word access) A double word-sized tag can be accessed by bits 0 - 31, bytes 0 - 3, or word 0 - 1. A word- sized tag can be accessed by bits 0 - 15, bytes 0 - 2, or word 0.
Page 98: Accessing A Tag With An At Overlay
97BPLC concepts 4.4 Data types 4.4.9 Accessing a tag with an AT overlay The AT tag overlay allows you to access an already-declared tag of a standard access block with an overlaid declaration of a different data type. You can, for example, address the individual bits of a tag of a Byte, Word, or DWord data type with an Array of Bool.
Page 99: Using A Memory Card
97BPLC concepts 4.5 Using a memory card The overlay types can be addressed directly in the program logic: IF #AT[1] THEN END_IF; IF (#DW1_Struct.S1 = W#16#000C) THEN END_IF; out1 := #DW1_Struct.S2; See SCL (Page 145) for syntax for addressing local variables and PLC tags. Rules ●...
Page 100: Inserting A Memory Card In The Cpu
CPU, then STEP 7 applies the force values only to the external load memory on the program card. You also use a memory card when downloading firmware updates from customer support (http://www.siemens.com/automation/support-request). A firmware update requires a 24 MB memory card. 4.5.1...
Page 101 97BPLC concepts 4.5 Using a memory card CAUTION If you insert a memory card (whether configured as a program or transfer card) into a running CPU, the CPU goes immediately to STOP mode, which might result damage to the equipment or to the process being controlled. Before inserting or removing a memory card, always ensure that the CPU is not actively controlling a machine or process.
Page 102: Configuring The Startup Parameter Of The Cpu Before Copying The Project To The Memory Card
97BPLC concepts 4.5 Using a memory card 4.5.2 Configuring the startup parameter of the CPU before copying the project to the memory card When you copy a program to a transfer card or a program card, the program includes the startup parameter for the CPU.
Page 103 97BPLC concepts 4.5 Using a memory card 4. In the "Memory card" dialog, select "Transfer" from the "Card type" drop-down menu. At this point, STEP 7 creates the empty transfer card. If you are creating an empty transfer card, such as to recover from a lost CPU password (Page 107), remove the transfer card from the card reader.
Page 104: Program Card
97BPLC concepts 4.5 Using a memory card To transfer the program to a CPU, follow these steps: 1. Insert the transfer card into the CPU (Page 100). If the CPU is in RUN, the CPU will go to STOP mode. The maintenance (MAINT) LED flashes to indicate that the memory card needs to be evaluated.
Page 105 97BPLC concepts 4.5 Using a memory card Creating a program card When used as a program card, the memory card is the external load memory of the CPU. If you remove the program card, the internal load memory of the CPU is empty. Note If you insert a blank memory card into the CPU and perform a memory card evaluation by either power cycling the CPU, performing a STOP to RUN transition, or performing a...
Page 106 97BPLC concepts 4.5 Using a memory card 6. In the "Load preview" dialog, click the "Load" button to copy the CPU device to the memory card. 7. When the dialog displays a message that the CPU device (program) has been loaded without errors, click the "Finish"...
Page 107: Recovery From A Lost Password
97BPLC concepts 4.6 Recovery from a lost password Recovery from a lost password If you have lost the password for a password-protected CPU, use an empty transfer card to delete the password-protected program. The empty transfer card erases the internal load memory of the CPU.
Page 108 97BPLC concepts 4.6 Recovery from a lost password S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 109: Device Configuration
Device configuration You create the device configuration for your PLC by adding a CPU and additional modules to your project. ① Communication module (CM) or communication processor (CP): Up to 3, inserted in slots 101, 102, and 103 ② CPU: Slot 1 ③...
Page 110: Inserting A Cpu
98BDevice configuration 5.1 Inserting a CPU Inserting a CPU You create your device configuration by inserting a CPU into your project. Selecting the CPU from the "Add new device" dialog creates the rack and CPU. "Add new device" dialog Device view of the hardware configuration Selecting the CPU in the Device view displays the CPU...
Page 111: Detecting The Configuration For An Unspecified Cpu
98BDevice configuration 5.2 Detecting the configuration for an unspecified CPU Detecting the configuration for an unspecified CPU If you are connected to a CPU, you can upload the configuration of that CPU, including any modules, to your project. Simply create a new project and select the "unspecified CPU"...
Page 112: Adding Modules To The Configuration
98BDevice configuration 5.3 Adding modules to the configuration Adding modules to the configuration Use the hardware catalog to add modules to the CPU: ● Signal module (SM) provides additional digital or analog I/O points. These modules are connected to the right side of the CPU. ●...
Page 113 98BDevice configuration 5.3 Adding modules to the configuration Table 5- 1 Adding a module to the device configuration Module Select the module Insert the module Result SB or CB CM or CP S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 114: Configuring The Operation Of The Cpu
98BDevice configuration 5.4 Configuring the operation of the CPU Configuring the operation of the CPU To configure the operational parameters for the CPU, select the CPU in the Device view (blue outline around whole CPU), and use the "Properties" tab of the inspector window.
Page 115: Configuring The Parameters Of The Modules
98BDevice configuration 5.5 Configuring the parameters of the modules Property Description Protection (Page 153) Sets the read/write protection and password for accessing the CPU Connection resources Provides a summary of the communication connections that are available for the CPU and (Page 394) the number of connections that have been configured.
Page 116 98BDevice configuration 5.5 Configuring the parameters of the modules Configuring a communication interface (CM, CP or CB) Depending on the type of communication interface, you configure the parameters for the network. S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 117: Configuring The Cpu For Communication
98BDevice configuration 5.6 Configuring the CPU for communication Configuring the CPU for communication 5.6.1 Creating a network connection Use the "Network view" of Device configuration to create the network connections between the devices in your project. After creating the network connection, use the "Properties" tab of the inspector window to configure the parameters of the network.
Page 118: Configuring The Local/Partner Connection Path
98BDevice configuration 5.6 Configuring the CPU for communication 5.6.2 Configuring the Local/Partner connection path The inspector window displays the properties of the connection whenever you have selected any part of the instruction. Specify the communication parameters in the "Configuration" tab of the "Properties"...
Page 119 98BDevice configuration 5.6 Configuring the CPU for communication Table 5- 5 Configuring the connection path for S7 communication (Device configuration) S7 communication (GET and PUT) Connection properties For S7 communication, use the "Devices & networks" editor of the network to configure the Local/Partner connections.
Page 120: Parameters For The Profinet Connection
98BDevice configuration 5.6 Configuring the CPU for communication Parameter Definition TSAP and Subnet ID: ISO on TCP (RFC 1006) and S7 communication: Local and partner CPU TSAPs in ASCII and hexadecimal formats When configuring a connection with an S7-1200 CPU for ISO-on-TCP, use only ASCII characters in the TSAP extension for the passive communication partners.
Page 121 98BDevice configuration 5.6 Configuring the CPU for communication Byte Parameter and data type Description active_est Bool ID for the type of connection: TCP and ISO-on-TCP:  – FALSE: Passive connection – TRUE: Active connection (default) UDP: FALSE  local_device_id USInt ID for the local PROFINET or Industrial Ethernet interface: 1 (default) local_tsap_id_len...
Page 122 98BDevice configuration 5.6 Configuring the CPU for communication Byte Parameter and data type Description 34 … 39 rem_staddr Array [1..6] of TCP and ISO-on-TCP only: IP address of the partner end point. USInt (Not relevant for passive connections.) For example, IP address 192.168.002.003 is stored in the following elements of the array: rem_staddr[1] = 192 rem_staddr[2] = 168...
Page 123: Assigning Internet Protocol (Ip) Addresses
98BDevice configuration 5.6 Configuring the CPU for communication 5.6.4 Assigning Internet Protocol (IP) addresses 5.6.4.1 Assigning IP addresses to programming and network devices If your programming device is using an on-board adapter card connected to your plant LAN (and possibly the world-wide web), the IP Address Network ID and subnet mask of your CPU and the programming device's on-board adapter card must be exactly the same.
Page 124 98BDevice configuration 5.6 Configuring the CPU for communication Table 5- 8 Assigning Ethernet addresses Programming Device Network Type Internet Protocol (IP) Address Subnet Mask Adapter Card On-board adapter Connected to Network ID of your CPU and the The subnet mask of your CPU and the card your plant LAN programming device's on-board...
Page 125: Checking The Ip Address Of Your Programming Device
98BDevice configuration 5.6 Configuring the CPU for communication 5.6.4.2 Checking the IP address of your programming device You can check the MAC and IP addresses of your programming device with the following menu selections: 1. In the "Project tree", expand "Online access". 2.
Page 126 98BDevice configuration 5.6 Configuring the CPU for communication 3. In the "Online & diagnostics" dialog, make the following menu selections:  "Functions"  "Assign IP address" 4. In the "IP address" field, enter your new IP address, and click the "Assign IP address" button. 5.
Page 127: Configuring An Ip Address For A Cpu In Your Project
98BDevice configuration 5.6 Configuring the CPU for communication 5.6.4.4 Configuring an IP address for a CPU in your project Configuring the PROFINET interface To configure parameters for the PROFINET interface, select the green PROFINET box on the CPU. The "Properties" tab in the inspector window displays the PROFINET port. ①...
Page 128 98BDevice configuration 5.6 Configuring the CPU for communication IP addresses properties: In the Properties window, select the "Ethernet addresses" configuration entry. STEP 7 displays the Ethernet address configuration dialog, which associates the software project with the IP address of the CPU that will receive that project.
Page 129: Testing The Profinet Network
98BDevice configuration 5.6 Configuring the CPU for communication Table 5- 9 Parameters for the IP address Parameter Description Subnet Name of the Subnet to which the device is connected. Click the "Add new subnet" button to create a new subnet. "Not connected" is the default. Two connection types are possible: The "Not connected"...
Page 130: Locating The Ethernet (Mac) Address On The Cpu
98BDevice configuration 5.6 Configuring the CPU for communication Using the "Extended download to device" dialog to test for connected network devices The S7-1200 CPU "Download to device" function and its "Extended download to device" dialog can show all accessible network devices and whether or not unique IP addresses have been assigned to all devices.
Page 131: Configuring Network Time Protocol Synchronization
98BDevice configuration 5.6 Configuring the CPU for communication ① MAC address Initially, the CPU has no IP address, only a factory-installed MAC address. PROFINET communications requires that all devices be assigned a unique IP address. Use the CPU "Download to device"...
Page 132: Profinet Device Start-Up Time, Naming, And Address Assignment
98BDevice configuration 5.6 Configuring the CPU for communication In NTP mode, it is generally UTC (Universal Time Coordinated) that is transferred; this corresponds to GMT (Greenwich Mean Time). In the Properties window, select the "Time synchronization" configuration entry. STEP 7 displays the Time synchronization configuration dialog: Note All IP addresses are configured when you download the project.
Page 133 98BDevice configuration 5.6 Configuring the CPU for communication PROFINET device naming and addressing in STEP 7 All PROFINET devices must have a Device Name and an IP Address. Use STEP 7 to define the Device Names and to configure the IP addresses. Device names are downloaded to the IO devices using PROFINET DCP (Discovery and Configuration Protocol).
Page 134 98BDevice configuration 5.6 Configuring the CPU for communication S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 135: Programming Concepts
Programming concepts Guidelines for designing a PLC system When designing a PLC system, you can choose from a variety of methods and criteria. The following general guidelines can apply to many design projects. Of course, you must follow the directives of your own company's procedures and the accepted practices of your own training and location.
Page 136: Structuring Your User Program
99BProgramming concepts 6.2 Structuring your user program Recommended steps Tasks Create the Based on the requirements of the functional specification, create configuration drawings of the configuration drawings control equipment: Overview drawing that shows the location of each PLC in relation to the process or machine. ...
Page 137 99BProgramming concepts 6.2 Structuring your user program Linear structure: Modular structure: By creating generic code blocks that can be reused within the user program, you can simplify the design and implementation of the user program. Using generic code blocks has a number of benefits: ●...
Page 138: Using Blocks To Structure Your Program
99BProgramming concepts 6.3 Using blocks to structure your program Using blocks to structure your program By designing FBs and FCs to perform generic tasks, you create modular code blocks. You then structure your program by having other code blocks call these reusable modules. The calling block passes device-specific parameters to the called block.
Page 139 99BProgramming concepts 6.3 Using blocks to structure your program The program cycle OB contains your main program. You can include more than one program cycle OB in your user program. During RUN mode, the program cycle OBs execute at the lowest priority level and can be interrupted by all other types of program processing.
Page 140: Function (Fc)
99BProgramming concepts 6.3 Using blocks to structure your program Configuring the operation of an OB You can modify the operational parameters for an OB. For example, you can configure the time parameter for a time-delay OB or for a cyclic OB. 6.3.2 Function (FC) A function (FC) is a code block that typically performs a specific operation on a set of input...
Page 141: Data Block (Db)
99BProgramming concepts 6.3 Using blocks to structure your program By designing the FB for generic control tasks, you can reuse the FB for multiple devices by selecting different instance DBs for different calls of the FB. An FB stores the Input, Output, and InOut, and Static parameters in an instance DB. Assigning the start value in the instance DB The instance DB stores both a default value and a start value for each parameter.
Page 142 99BProgramming concepts 6.3 Using blocks to structure your program The data stored in a DB is not deleted when the execution of the associated code block comes to an end. There are two types of DBs: ● A global DB stores data for the code blocks in your program. Any OB, FB, or FC can access the data in a global DB.
Page 143: Understanding Data Consistency
99BProgramming concepts 6.4 Understanding data consistency Understanding data consistency The CPU maintains the data consistency for all of the elementary data types (such as Words or DWords) and all of the system-defined structures (for example, IEC_TIMERS or DTL). The reading or writing of the value cannot be interrupted. (For example, the CPU protects the access to a DWord value until the four bytes of the DWord have been read or written.) To ensure that the program cycle OBs and the interrupt OBs cannot write to the same memory location at the same time, the CPU does not execute an interrupt OB until the read or write...
Page 144: Programming Language
99BProgramming concepts 6.5 Programming language Programming language STEP 7 provides the following standard programming languages for S7-1200: ● LAD (ladder logic) is a graphical programming language. The representation is based on circuit diagrams (Page 144). ● FBD (Function Block Diagram) is a programming language that is based on the graphical logic symbols used in Boolean algebra (Page 145).
Page 145: Function Block Diagram (Fbd)
Structured Control Language (SCL) is a high-level, PASCAL-based programming language for the SIMATIC S7 CPUs. SCL supports the block structure of STEP 7 (Page 138). You can also include program blocks written in SCL with program blocks written in LAD and FBD.
Page 146 99BProgramming concepts 6.5 Programming language SCL instructions use standard programming operators, such as for assignment (:=), mathematical functions (+ for addition, - for subtraction, * for multiplication, and / for division). SCL also uses standard PASCAL program control operations, such as IF-THEN-ELSE, CASE, REPEAT-UNTIL, GOTO and RETURN.
Page 147 99BProgramming concepts 6.5 Programming language In the section of the SCL code block you can declare the following types of parameters: ● Input, Output, InOut, and Ret_Val: These parameters define the input tags, output tags, and return value for the code block. The tag name that you enter here is used locally during the execution of the code block.
Page 148 99BProgramming concepts 6.5 Programming language Type Operation Operator Priority Modulo Addition Subtraction Comparison Less than < Less than or equal to <= Greater than > Greater than or equal to >= Equal to Not equal to <> Bit logic Negation (unary) AND logic operation AND or &...
Page 149 99BProgramming concepts 6.5 Programming language A single statement typically occupies one line of code. You can enter multiple statements on one line, or you can break a statement into several lines of code to make the code easier to read. Separators (such as tabs, line breaks and extra spaces) are ignored during the syntax check.
Page 150 99BProgramming concepts 6.5 Programming language Symbolic addressing Tag in PLC tag table "PLC_Tag_1" Tag in a data block "Data_block_1".Tag_1 Array element in a data block array "Data_block_1".MyArray[#i] Indexed addressing with PEEK and POKE instructions SCL also provides PEEK and POKE instructions to allow you to read from or write to data areas with variables that provide specific byte offsets or bit offsets for the operation.
Page 151 99BProgramming concepts 6.5 Programming language Writes the Boolean value to the referenced POKE_BOOL(area:=_in_, bitOffset and byteOffset of the referenced dbNumber:=_in_, data block, I/O or memory area byteOffset:=_in_, bitOffset:=_in_, Example: POKE_BOOL(area:=16#84, value:=_in_); dbNumber:=2, byteOffset:=3, bitOffset:=5, value:=0); Writes "count" number of bytes starting at the POKE_BLK(area_src:=_in_, referenced byte Offset of the referenced dbNumber_src:=_in_,...
Page 152: En And Eno For Lad, Fbd And Scl
99BProgramming concepts 6.5 Programming language You can also drag blocks from the navigation tree to the SCL program editor, and complete the parameter assignment. 6.5.4 EN and ENO for LAD, FBD and SCL Determining "power flow" (EN and ENO) for an instruction Certain instructions (such as the Math and the Move instructions) provide parameters for EN and ENO.
Page 153: Protection
99BProgramming concepts 6.6 Protection Effect of Ret_Val or Status parameters on ENO Some instructions, such as the communication instructions or the string conversion instructions, provide an output parameter that contains information about the processing of the instruction. For example, some instructions provide a Ret_Val (return value) parameter, which is typically an Int data type that contains status information in a range from -32768 to +32767.
Page 154: Know-How Protection
99BProgramming concepts 6.6 Protection Each level allows certain functions to be accessible without a password. The default condition for the CPU is to have no restriction and no password-protection. To restrict access to a CPU, you configure the properties of the CPU and enter the password. Entering the password over a network does not compromise the password protection for the CPU.
Page 155 99BProgramming concepts 6.6 Protection 1. In the Properties for the code block, click the "Protection" button to display the "Know-how protection" dialog. 2. Click the "Define" button to enter the password. After entering and confirming the password, click "OK". S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 156: Copy Protection
99BProgramming concepts 6.6 Protection 6.6.3 Copy protection An additional security feature allows you to bind the program or code blocks for use with a specific memory card or CPU. This feature is especially useful for protecting your intellectual property. When you bind a program or block to a specific device, you restrict the program or code block for use only with a specific memory card or CPU.
Page 157: Downloading The Elements Of Your Program
99BProgramming concepts 6.7 Downloading the elements of your program Downloading the elements of your program You can download the elements of your project from the programming device to the CPU. When you download a project, the CPU stores the user program (OBs, FCs, FBs and DBs) in permanent memory.
Page 158: Using The Compare Function
99BProgramming concepts 6.8 Uploading from the CPU To upload the program blocks from the online CPU to the offline project, follow these steps: 1. Click the "Program blocks" folder in the offline project. 2. Click the "Go online" button. 3. Click the "Upload" button. 4.
Page 159: Debugging And Testing The Program
99BProgramming concepts 6.9 Debugging and testing the program Debugging and testing the program 6.9.1 Monitor and modify data in the CPU As shown in the following table, you can monitor and modify values in the online CPU. Table 6- 5 Monitoring and modifying data with STEP 7 Editor Monitor...
Page 160: Cross Reference To Show Usage
99BProgramming concepts 6.9 Debugging and testing the program STEP 7 also provides a force table for "forcing" a tag to a specific value. For more information about forcing, see the section on forcing values in the CPU (Page 648) in the "Online and Diagnostics"...
Page 161: Call Structure To Examine The Calling Hierarchy
99BProgramming concepts 6.9 Debugging and testing the program Column Description Access Type of access, whether access to the operand is read access (R) and/or write access (W) Address Address of the operand Type Information on the type and language used to create the object Path Path of object in project tree 6.9.4...
Page 162 99BProgramming concepts 6.9 Debugging and testing the program S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 163: Basic Instructions
Basic instructions Bit logic 7.1.1 Bit logic contacts and coils LAD and FBD are very effective for handling Boolean logic. While SCL is especially effective for complex mathematical computation and for project control structures, you can use SCL for Boolean logic. LAD contacts Table 7- 1 Normally open and normally closed contacts...
Page 164 100BBasic instructions 7.1 Bit logic FBD AND, OR, and XOR boxes In FBD programming, LAD contact networks are transformed into AND (&), OR (>=1), and exclusive OR (x) box networks where you can specify bit values for the box inputs and outputs.
Page 165 100BBasic instructions 7.1 Bit logic NOT logic inverter Table 7- 5 NOT Logic inverter Description For FBD programming, you can drag the "Negate binary input" tool from the "Favorites" toolbar or instruction tree and then drop it on an input or output to create a logic inverter on that box connector. The LAD NOT contact inverts the logical state of power flow input.
Page 166: Set And Reset Instructions
100BBasic instructions 7.1 Bit logic Table 7- 7 Data types for the parameters Parameter Data type Description Bool Assigned bit ● If there is power flow through an output coil or an FBD "=" box is enabled, then the output bit is set to 1.
Page 167 100BBasic instructions 7.1 Bit logic Set and Reset Bit Field Table 7- 10 SET_BF and RESET_BF instructions Description Not available When SET_BF is activated, a data value of 1 is assigned to "n" bits starting at address OUT. When SET_BF is not activated, OUT is not changed.
Page 168: Positive And Negative Edge Instructions
100BBasic instructions 7.1 Bit logic Table 7- 13 Data types for the parameters Parameter Data type Description S, S1 Bool Set input; 1 indicates dominance R, R1 Bool Reset input; 1 indicates dominance Bool Assigned bit output "OUT" Bool Follows state of "OUT" bit The OUT parameter specifies the bit address that is set or reset.
Page 169 100BBasic instructions 7.1 Bit logic Description Not available LAD: The assigned bit "OUT" is TRUE when a positive transition (OFF-to- ON) is detected on the power flow entering the coil. The power flow in state always passes through the coil as the power flow out state. The P coil can be located anywhere in the network.
Page 170: Timers
100BBasic instructions 7.2 Timers All edge instructions use a memory bit (M_BIT) to store the previous state of the input signal being monitored. An edge is detected by comparing the state of the input with the state of the memory bit. If the states indicate a change of the input in the direction of interest, then an edge is reported by writing the output TRUE.
Page 171 100BBasic instructions 7.2 Timers LAD / FBD boxes LAD coils Description The TONR timer sets output Q to ON after a "IEC_Timer_0_DB".TONR ( preset time delay. Elapsed time is accumulated IN:=_bool_in_, over multiple timing periods until the R input is R:=_bool_in_ used to reset the elapsed time.
Page 172 100BBasic instructions 7.2 Timers Table 7- 19 Effect of value changes in the PT and IN parameters Timer Changes in the PT and IN box parameters and the corresponding coil parameters Changing PT has no effect while the timer runs. ...
Page 173 100BBasic instructions 7.2 Timers Reset timer -(RT)- and Preset timer -(PT)- coils These coil instructions can be used with box or coil timers and can be placed in a mid-line position. The coil output power flow status is always the same as the coil input status. When the -(RT)- coil is activated, the ELAPSED time element of the specified IEC_Timer DB data is reset to 0.
Page 174 100BBasic instructions 7.2 Timers Timer Timing diagram TOF: OFF-delay timer The TOF timer resets output Q to OFF after a preset time delay. TONR: ON-delay Retentive timer The TONR timer sets output Q to ON after a preset time delay. Elapsed time is accumulated over multiple timing periods until the R input is used to reset the elapsed time.
Page 175 100BBasic instructions 7.2 Timers A timer update is performed when and only when: ● A timer instruction (TP, TON, TOF, or TONR) is executed ● The "ELAPSED" member of the timer structure in DB is referenced directly by an instruction ●...
Page 176 100BBasic instructions 7.2 Timers Time data retention after a RUN-STOP-RUN transition or a CPU power cycle If a run mode session is ended with stop mode or a CPU power cycle and a new run mode session is started, then the timer data stored in the previous run mode session is lost, unless the timer data structure is specified as retentive (TP, TON, TOF, and TONR timers).
Page 177 100BBasic instructions 7.2 Timers Assign a multi-instance DB to store timer data as retentive data This option only works if you place the timer in an FB. This option depends upon whether the FB was created with "Optimized" block access (allows symbolic access only).
Page 178: Counters
100BBasic instructions 7.3 Counters Counters Table 7- 22 Counter instructions LAD / FBD Description Use the counter instructions to count internal program events and "IEC_Counter_0_DB".CTU( external process events. Each counter uses a structure stored in a CU:=_bool_in, data block to maintain counter data. You assign the data block when R:=_bool_in, the counter instruction is placed in the editor.
Page 179 100BBasic instructions 7.3 Counters ● For SInt or USInt data types, the counter instruction uses 3 bytes. ● For Int or UInt data types, the counter instruction uses 6 bytes. ● For DInt or UDInt data types, the counter instruction uses 12 bytes. These instructions use software counters whose maximum counting rate is limited by the execution rate of the OB in which they are placed.
Page 180 100BBasic instructions 7.3 Counters Table 7- 26 Operation of the CTUD counter Counter Operation The CTUD counter counts up or down by 1 on the 0 to 1 transition of the count up (CU) or count down (CD) inputs. The CTUD timing diagram shows the operation for an unsigned integer count value (where PV =...
Page 181 100BBasic instructions 7.3 Counters Assign a global DB to store timer data as retentive data This option works regardless of where the counter is placed (OB, FC, or FB). 1. Create a global DB: – Double-click "Add new block" from the Project tree –...
Page 182 100BBasic instructions 7.3 Counters This option depends upon whether the FB was created as symbolic access only. Once the FB has been created, you cannot change the checkbox for "Symbolic access only"; it must be chosen correctly when the FB is created, on the first screen after selecting "Add new block"...
Page 183: Compare
100BBasic instructions 7.4 Compare Type shown in counter instruction (for preset Corresponding structure Type shown in FB and count values) interface IEC_Counter SINT IEC_SCounter DINT IEC_DCounter UINT IEC_UCounter USINT IEC_USCounter UDINT IEC_UDCounter 1. Open the block that will use this FB. 2.
Page 184: In-Range And Out-Of-Range Instructions
100BBasic instructions 7.4 Compare Table 7- 29 Comparison descriptions Relation type The comparison is true if ... IN1 is equal to IN2 <> IN1 is not equal to IN2 >= IN1 is greater than or equal to IN2 <= IN1 is less than or equal to IN2 >...
Page 185: Ok And Not Ok Instructions
100BBasic instructions 7.4 Compare 7.4.3 OK and Not OK instructions Table 7- 32 OK and Not OK instructions Description Not available Tests whether an input data reference is a valid real number according to IEEE specification 754. For SCL, OK allows you to check the errors in the execution of a statement.
Page 186: Math
100BBasic instructions 7.5 Math You can configure the SCL compiler to write the value of OK to the output parameter ENO after the execution of the code block finishes. Refer to the section on EN and ENO (Page 152). Math 7.5.1 Calculate instruction Table 7- 36...
Page 187: Add, Subtract, Multiply And Divide Instructions
100BBasic instructions 7.5 Math Note You also must create an input for any constants in your function. The constant value would then be entered in the associated input for the CALCULATE instruction. By entering constants as inputs, you can copy the CALCULATE instruction to other locations in your user program without having to change the function.
Page 188: Modulo Instruction
100BBasic instructions 7.5 Math Table 7- 40 ENO status Description No error The Math operation result value would be outside the valid number range of the data type selected. The least significant part of the result that fits in the destination size is returned. Division by 0 (IN2 = 0): The result is undefined and zero is returned.
Page 189: Negation Instruction
100BBasic instructions 7.5 Math 7.5.4 Negation instruction Table 7- 44 NEG instruction LAD / FBD Description The NEG instruction inverts the arithmetic sign of the value at parameter IN and stores -(in); the result in parameter OUT. For LAD and FBD: Click the "???" and select a data type from the drop-down menu. Table 7- 45 Data types for parameters Parameter...
Page 190: Absolute Value Instruction
100BBasic instructions 7.5 Math Table 7- 48 Data types for parameters Parameter Data type Description IN/OUT SInt, Int, DInt, USInt, UInt, UDInt Math operation input and output Table 7- 49 ENO status Description No error The resulting value is outside the valid number range of the selected data type. Example for SInt: INC (+127) results in +128, which exceeds the data type maximum.
Page 191: Minimum And Maximum Instructions
100BBasic instructions 7.5 Math 7.5.7 Minimum and Maximum instructions Table 7- 53 MIN and MAX instructions LAD / FBD Description The MIN instruction compares the value of two parameters IN1 out:= MIN( and IN2 and assigns the minimum (lesser) value to parameter in1:=_variant_in_, OUT.
Page 192: Limit Instruction
100BBasic instructions 7.5 Math 7.5.8 Limit instruction Table 7- 56 LIMIT instruction LAD / FBD Description The Limit instruction tests if the value of parameter IN is inside the LIMIT(MIN:=_variant_in_, value range specified by parameters MIN and MAX and if not, IN:=_variant_in_, clamps the value at MIN or MAX.
Page 193 100BBasic instructions 7.5 Math ● EXP: Natural exponential (e =OUT), where base e = 2.71828182845904523536 ● EXPT: General exponential (IN1 = OUT) EXPT parameters IN1 and OUT are always the same data type, for which you must select Real or LReal. You can select the data type for the exponent parameter IN2 from among many data types.
Page 194: Move
100BBasic instructions 7.6 Move Instruction Condition Result (OUT) IN is +/- INF (infinity) or +/- NaN +/- INF or +/- NaN IN is 0.0, negative, -INF, or -NaN -NaN IN is +INF or +NaN +INF or +NaN Result exceeds valid Real/LReal range +INF IN is +/- NaN +/- NaN...
Page 195 100BBasic instructions 7.6 Move Table 7- 62 MOVE, MOVE_BLK and UMOVE_BLK instructions LAD / FBD Description Copies a data element stored at a specified address to a new address out1 := in; or multiple addresses. Interruptible move that copies a block of data elements to a new out := MOVE_BLK( address.
Page 196 100BBasic instructions 7.6 Move Note Rules for data copy operations  To copy the Bool data type, use SET_BF, RESET_BF, R, S, or output coil (LAD) (Page 166)  To copy a single elementary data type, use MOVE  To copy an array of an elementary data type, use MOVE_BLK or UMOVE_BLK ...
Page 197: Fieldread And Fieldwrite Instructions
100BBasic instructions 7.6 Move 7.6.2 FieldRead and FieldWrite instructions Note STEP 7 V10.5 did not support a variable reference as an array index or multi-dimensional arrays. The FieldRead and FieldWrite instructions were used to provide variable array index operations for a one-dimensional array. STEP 7 V11 does support a variable as an array index and multi-dimensional arrays.
Page 198 100BBasic instructions 7.6 Move The enable output ENO = 0, if one of the following conditions applies: ● The EN input has signal state "0" ● The array element specified at the INDEX parameter is not defined in the array referenced at MEMBER parameter ●...
Page 199: Fill Instructions
100BBasic instructions 7.6 Move 7.6.3 Fill instructions Table 7- 68 FILL_BLK and UFILL_BLK instructions LAD / FBD Description Interruptible fill instruction: Fills an address range with copies of a out := FILL_BLK( specified data element in:=_variant_in, count:=int, out=>_variant_out); Uninterruptible fill instruction: Fills an address range with copies of a out := UFILL_BLK( specified data element in:=_variant_in,...
Page 200: Swap Instruction
100BBasic instructions 7.6 Move Table 7- 70 ENO status Condition Result No error The IN element was successfully copied to all COUNT destinations. The destination (OUT) range exceeds Elements that fit are copied. No partial the available memory area elements are copied. 7.6.4 Swap instruction Table 7- 71...
Page 201: Convert
100BBasic instructions 7.7 Convert Convert 7.7.1 CONV instruction Table 7- 73 Convert (CONV) instruction LAD / FBD Description Converts a data element from one out := <data type in>_TO_<data type out>(in); data type to another data type. For LAD and FBD: Click the "???" and select the data types from the drop-down menu. For SCL: Construct the conversion instruction by identifying the data type for the input parameter (in) and output parameter (out).
Page 202: Conversion Instructions For Scl
100BBasic instructions 7.7 Convert 7.7.2 Conversion instructions for SCL Conversion instructions for SCL Table 7- 76 Conversion from a Byte, Word, or DWord Data type Instruction Result Byte The value is transferred to the low byte of the target data BYTE_TO_WORD, BYTE_TO_DWORD type.
Page 203 100BBasic instructions 7.7 Convert Table 7- 78 Conversion from an integer (Int or UInt) Data type instruction Result The value is converted. INT_TO_BYTE, INT_TO_DWORD, INT_TO_SINT, INT_TO_USINT, INT_TO_UINT, INT_TO_UDINT, INT_TO_REAL, INT_TO_LREAL, INT_TO_CHAR, INT_TO_STRING The value is transferred to the target data type. INT_TO_WORD The value is transferred to the low byte of the target data INT_TO_DINT...
Page 204: Round And Truncate Instructions
100BBasic instructions 7.7 Convert Table 7- 81 Conversion from Time, DTL, TOD or Date Data type Instruction Result Time The value is transferred to the target data type. TIME_TO_DINT The value is converted. DTL_TO_DATE, DTL_TO_TOD The value is converted. TOD_TO_UDINT Date The value is converted.
Page 205: Ceiling And Floor Instructions
100BBasic instructions 7.7 Convert Table 7- 84 Data types for the parameters Parameter Data type Description Real, LReal Floating point input SInt, Int, DInt, USInt, UInt, UDInt, Real, LReal Rounded or truncated output Table 7- 85 ENO status Description Result OUT No error Valid result IN is +/- INF or +/- NaN...
Page 206: Scale And Normalize Instructions
100BBasic instructions 7.7 Convert 7.7.5 Scale and normalize instructions Table 7- 89 SCALE_X and NORM_X instructions LAD / FBD Description Scales the normalized real parameter VALUE out :=SCALE_X(min:=_in_, where ( 0.0 <= VALUE <= 1.0 ) in the data type value:=_in_, and value range specified by the MIN and MAX max:=_in_);...
Page 207 100BBasic instructions 7.7 Convert Note SCALE_X parameter VALUE should be restricted to ( 0.0 <= VALUE <= 1.0 ) If parameter VALUE is less than 0.0 or greater than 1.0:  The linear scaling operation can produce OUT values that are less than the parameter MIN value or above the parameter MAX value for OUT values that fit within the value range of the OUT data type.
Page 208 100BBasic instructions 7.7 Convert Example (LAD): normalizing and scaling an analog input value An analog input from an analog signal module or signal board using input in current is in the range 0 to 27648 for valid values. Suppose an analog input represents a temperature where the 0 value of the analog input represents -30.0 degrees C and 27648 represents 70.0 degrees C.
Page 209: Program Control
100BBasic instructions 7.8 Program control Program control 7.8.1 Overview of SCL program control statements Structured Control Language (SCL) provides three types of program control statements for structuring your user program: ● Selective statements: A selective statement enables you to direct program execution into alternative sequences of statements.
Page 210: If-Then Statement
100BBasic instructions 7.8 Program control 7.8.2 IF-THEN statement The IF-THEN statement is a conditional statement that controls program flow by executing a group of statements, based on the evaluation of a Bool value of a logical expression. You can also use brackets to nest or structure the execution of multiple IF-THEN statements. Table 7- 93 Elements of the IF-THEN statement Description...
Page 211: Case Statement
100BBasic instructions 7.8 Program control 7.8.3 CASE statement Table 7- 95 Elements of the CASE statement Description The CASE statement executes one of several CASE "Test_Value" OF groups of statements, depending on the value "ValueList": Statement[; Statement, ...] of an expression. "ValueList": Statement[;...
Page 212: For Statement
100BBasic instructions 7.8 Program control END_CASE 7.8.4 FOR statement Table 7- 97 Elements of the FOR statement Description A FOR statement is used to repeat a sequence of FOR "control_variable" := "begin" TO "end" statements as long as a control variable is within [BY "increment"] DO the specified range of values.
Page 213: While-Do Statement
100BBasic instructions 7.8 Program control 7.8.5 WHILE-DO statement Table 7- 99 WHILE statement Description The WHILE statement performs a series of statements until a given condition is WHILE "condition" DO TRUE. Statement; Statement; You can nest WHILE loops. The END_WHILE statement refers to the last executed WHILE instruction.
Page 214: Repeat-Until Statement
100BBasic instructions 7.8 Program control 7.8.6 REPEAT-UNTIL statement Table 7- 101 REPEAT instruction Description The REPEAT statement executes a group of statements until a given condition is REPEAT TRUE. Statement; You can nest REPEAT loops. The END_REPEAT statement always refers to the last executed Repeat instruction.
Page 215: Exit Statement
100BBasic instructions 7.8 Program control The CONTINUE statement executes according to the following rules: ● This statement immediately terminates execution of a loop body. ● Depending on whether the condition for repeating the loop is satisfied or not the body is executed again or the iteration statement is exited and the statement immediately following is executed.
Page 216: Goto Statement
100BBasic instructions 7.8 Program control 7.8.9 GOTO statement Table 7- 105 GOTO statement Description The GOTO statement skips over statements by jumping to a label in the same GOTO JumpLabel block. Statement; ... ; The jump label ("JumpLabel") and the GOTO statement must be in the same block. The name of a jump label can only be assigned once within a block.
Page 217: Jump And Label Instructions
100BBasic instructions 7.8 Program control 7.8.11 Jump and label instructions Table 7- 107 JMP, JMPN, and LABEL instruction Description See the GOTO (Page 216) If there is power flow to a JMP coil (LAD), or if the statement. JMP box input is true (FBD), then program execution continues with the first instruction following the specified label.
Page 218: Switch Instruction
100BBasic instructions 7.8 Program control Table 7- 110 Data types for parameters Parameter Data type Description UInt Jump distributor control value DEST0, DEST1, .., Program Labels Jump destination labels corresponding to specific K parameter values: DESTn. If the value of K equals 0, then a jump occurs to the program label assigned to the DEST0 output.
Page 219 100BBasic instructions 7.8 Program control Table 7- 112 Data types for parameters Parameter Data type Description SInt, Int, DInt, USInt, UInt, UDInt, Real, Common comparison value input LReal, Byte, Word, DWord, Time, TOD, Date ==, <>, <, <=, >. >= SInt, Int, DInt, USInt, UInt, UDInt, Real, Separate comparison value inputs for specific comparison LReal, Byte, Word, DWord, Time, types...
Page 220: Ret Execution Control Instruction
100BBasic instructions 7.8 Program control Table 7- 113 SWITCH box data type selection and allowed comparison operations Data type Comparison Operator syntax Byte, Word, DWord Equal Not equal <> SInt, Int, DInt, USInt, UInt, Equal UDInt, Real, LReal, Time, TOD, Not equal <>...
Page 221: Re-Trigger Scan Cycle Watchdog Instruction
100BBasic instructions 7.8 Program control Sample steps for using the RET instruction inside an FC code block: 1. Create a new project and add an FC: 2. Edit the FC: – Add instructions from the instruction tree. – Add a RET instruction, including one of the following for the "Return_Value" parameter: TRUE, FALSE, or a memory location that specifies the required return value.
Page 222: Stop Scan Cycle Instruction
100BBasic instructions 7.8 Program control Setting the PLC maximum cycle time Configure the value for maximum scan cycle time in the Device configuration for "Cycle time". Table 7- 117 Cycle time values Cycle time monitor Minimum value Maximum value Default value Maximum cycle time 1 ms 6000 ms...
Page 223 100BBasic instructions 7.8 Program control GetError Table 7- 119 GetError instruction LAD / FBD Description Not available Indicates that a local program block execution error has occurred and fills a predefined error data structure with detailed error information. Table 7- 120 Data types for the parameters Parameter Data type Description...
Page 224 100BBasic instructions 7.8 Program control Structure components Data type Description PtrNo. Area DB no. Offset /Acc PtrNo. / Slot No. / Area DB no. Offset Scope OPERAND_NUMBER UInt Operand number of the machine command POINTER_NUMBER_ UInt (A) Internal pointer LOCATION SLOT_NUMBER_SCOPE UInt (B) Storage area in internal memory...
Page 225 100BBasic instructions 7.8 Program control ERROR_ID ERROR_ID Program block execution error Hexadecimal Decimal 2525 9509 Invalid area write error 2528 9512 Data alignment read error (incorrect bit alignment) 2529 9513 Data alignment write error (incorrect bit alignment) 2530 9520 DB write protected 253A 9530 Global DB does not exist...
Page 226: Word Logic Operations
100BBasic instructions 7.9 Word logic operations GetError and GetErrorID can be used to send error information from the currently executing block (called block) to a calling block. Place the instruction in the last network of the called block program to report the final execution status of the called block. Word logic operations 7.9.1 AND, OR, and XOR instructions...
Page 227: Invert Instruction
100BBasic instructions 7.9 Word logic operations 7.9.2 Invert instruction Table 7- 127 INV instruction LAD / FBD Description Calculates the binary one's complement of the parameter IN. The one's Not available complement is formed by inverting each bit value of the IN parameter (changing each 0 to 1 and each 1 to 0).
Page 228: Select, Multiplex, And Demultiplex Instructions
100BBasic instructions 7.9 Word logic operations Table 7- 131 OUT parameter for ENCO Condition Result (OUT) No error Valid bit number IN is zero OUT is set to zero The DECO parameter OUT data type selection of a Byte, Word, or DWord restricts the useful range of parameter IN.
Page 229 100BBasic instructions 7.9 Word logic operations Table 7- 134 Data types for the SEL instruction Parameter Data type Description Bool 0 selects IN0  1 selects IN1  IN0, IN1 SInt, Int, DInt, USInt, UInt, UDInt, Real, LReal, Byte, Word, DWord, Inputs Time, Char SInt, Int, DInt, USInt, UInt, UDInt, Real, LReal, Byte, Word, DWord,...
Page 230 100BBasic instructions 7.9 Word logic operations Table 7- 137 DEMUX (Demultiplex) instruction LAD / FBD Description DEMUX copies the value of the location assigned to parameter IN to out := DEMUX( one of many outputs. The value of the K parameter selects which k:=_unit_in, output selected as the destination of the IN value.
Page 231: Shift And Rotate
100BBasic instructions 7.10 Shift and Rotate Table 7- 139 ENO status for the MUX and DEMUX instructions Condition Result OUT No error MUX: Selected IN value is copied to OUT DEMUX: IN value is copied to selected OUT MUX: K is greater than the number of inputs -1 No ELSE provided: OUT is unchanged, ...
Page 232: Rotate Instructions
100BBasic instructions 7.10 Shift and Rotate Table 7- 142 SHL example for Word data Shift the bits of a Word to the left by inserting zeroes from the right (N = 1) 1110 0010 1010 1101 OUT value before first shift: 1110 0010 1010 1101 After first shift left: 1100 0101 0101 1010...
Page 233: Extended Instructions
Extended instructions Date and time-of-day 8.1.1 Date and time instructions Use the date and time instructions to program calendar and time calculations. ● T_CONV converts the data type of a time value: (Time to DInt) or (DInt to Time) ● T_ADD adds Time and DTL values: (Time + Time = Time) or (DTL + Time = DTL) ●...
Page 234 101BExtended instructions 8.1 Date and time-of-day Table 8- 3 T_ADD (Time Add) and T_SUB (Time Subtract) instructions LAD / FBD Description T_ADD adds the input IN1 value (DTL or Time data types) with the input out := T_ADD( IN2 Time value. Parameter OUT provides the DTL or Time value result. in1:=_variant_in, Two data type operations are possible: in2:=_time_in);...
Page 235: Set And Read System Clock
101BExtended instructions 8.1 Date and time-of-day Condition codes: ENO = 1 means no error occurred. ENO = 0 and parameter OUT = 0 errors: ● Invalid DTL value ● Invalid Time value Table 8- 7 T_COMBINE (combine time values) instruction LAD / FBD Description T_COMBINE combines a Date value and a...
Page 236 101BExtended instructions 8.1 Date and time-of-day Table 8- 10 Data types for the parameters Parameter and type Data type Description Time of day to set in the CPU system clock RET_VAL Execution condition code RD_SYS_T: Current CPU system time RD_LOC_T: Current local time. including any adjustment for daylight saving time, if configured ●...
Page 237: Run-Time Meter Instruction
101BExtended instructions 8.1 Date and time-of-day 8.1.3 Run-time meter instruction Table 8- 12 RTM instruction LAD / FBD Description The RTM (Run Time Meter) instruction can set, start, stop, and read the RTM(NR:=_uint_in_, run-time hour meters in the CPU. MODE:=_byte_in_, PV:=_dint_in_, CQ=>_bool_out_, CV=>_dint_out_);...
Page 238: Set_Timezone Instruction
101BExtended instructions 8.1 Date and time-of-day Your program can also use RTM execution mode 7 to save the run-time meter values in a memory card. The states of all timers at the instant RTM mode 7 is executed are stored in the memory card.
Page 239 101BExtended instructions 8.1 Date and time-of-day Table 8- 16 Data types for the parameters Parameter and type Data type Description Bool REQ=1: execute function Timezone TimeTransformationRule Rules for the transformation from system time to local time DONE Bool Function complete BUSY Bool Function busy...
Page 240: String And Character
101BExtended instructions 8.2 String and character Parameter Data type Description StandardStartHour USInt Hour of the winter time Time Zone Name STRING [80] Name of the zone: (GMT +01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna String and character 8.2.1 String data overview String data type String data is stored as a 2-byte header followed by up to 254 character bytes of ASCII character codes.
Page 241: String Conversion Instructions
101BExtended instructions 8.2 String and character Table 8- 19 Data types for the parameters Parameter Data type Description String Source string String Target address If the actual length of the string at the input IN exceeds the maximum length of a string stored at output OUT, then the part of the IN string which can fit in the OUT string is copied.
Page 242 101BExtended instructions 8.2 String and character Conversion of the string parameter IN starts at the first character and continues until the end of the string, or until the first character is encountered that is not "0" through "9", "+", "-", or ".".
Page 243 101BExtended instructions 8.2 String and character Output String format rules: ● Values written to parameter OUT do not use a leading "+" sign. ● Fixed-point representation is used (no exponential notation). ● The period character "." is used to represent the decimal point when parameter IN is the Real data type.
Page 244 101BExtended instructions 8.2 String and character Table 8- 26 Format of the STRG_VAL instruction Bit 8 Bit 7 Bit 0 f = Notation format 1= Exponential notation 0 = Fixed point notation r = Decimal point format 1 = "," (comma character) 0 = "."...
Page 245 101BExtended instructions 8.2 String and character Table 8- 29 Data types for the VAL_STRG instruction Parameter and type Data type Description SInt, Int, DInt, USInt, UInt, Value to convert UDInt, Real, LReal SIZE USInt Number of characters to be written to the OUT string PREC USInt The precision or size of the fractional portion.
Page 246 101BExtended instructions 8.2 String and character Table 8- 31 Values of the FORMAT parameter FORMAT (WORD) Number sign character Notation format Decimal point representation W#16#0000 "-" only Fixed point "." W#16#0001 "," W#16#0002 Exponential "." W#16#0003 "," W#16#0004 "+" and "-" Fixed Point "."...
Page 247 101BExtended instructions 8.2 String and character Conditions reported by ENO When an error is encountered during the conversion operation, the following results will be returned: ● ENO is set to 0. ● OUT is set to 0, or as shown in the examples for string to value conversion. ●...
Page 248 101BExtended instructions 8.2 String and character Table 8- 34 Examples of S_CONV value to string conversion Data type IN value OUT string UInt "123" TRUE UInt "0" TRUE UDInt 12345678 "12345678" TRUE Real -INF "INF" FALSE Real +INF "INF" FALSE Real "NaN"...
Page 249: String-To-Characters And Characters-To-String Conversions
101BExtended instructions 8.2 String and character The following examples of VAL_STRG conversions are based on an OUT string initialized as follows: " " Current Temp = xxxxxxxxxx C where the " " character represents space characters allocated for the converted value. Table 8- 36 Examples of VAL_STRG conversion Data type...
Page 250 101BExtended instructions 8.2 String and character Table 8- 37 Chars_TO_Strg instruction LAD / FBD Description All or part of an array of characters is copied to a string. Chars_TO_Strg( Chars:=_variant_in_, The output string must be declared before Chars_TO_Strg is pChars:=_dint_in_, executed.
Page 251: Ascii To Hex And Hex To Ascii Conversions
101BExtended instructions 8.2 String and character Parameter and type Data type Description Chars IN_OUT Variant The Chars parameter is a pointer to zero based array [0..n] of characters copied from the input string. The array can be declared in a DB or as local variables in the block interface. Example: "DB1".MyArray points to MyArray [0..10] of Char element values in DB1.
Page 252 101BExtended instructions 8.2 String and character The IN and OUT parameters specify byte arrays and not hexadecimal String data. ASCII characters are converted and placed in the hexadecimal output in the same order as they are read. If there are an odd number of ASCII characters, then zeros are put in the right- most nibble of the last converted hexadecimal digit.
Page 253: String Operation Instructions
101BExtended instructions 8.2 String and character Table 8- 48 Examples of hexadecimal -to- ASCII (HTA) conversion IN value OUT character bytes ENO (ENO always TRUE after HTA execution) W#16#0123 '0123' TRUE DW#16#123AF012 '123AF012' TRUE Table 8- 49 ATH and HTA condition codes RET_VAL Description (W#16#..)
Page 254: Concat
101BExtended instructions 8.2 String and character Table 8- 51 Data types for the parameters Parameter and type Data type Description String Input string Int, DInt, Real, LReal Number of valid characters of IN string Table 8- 52 ENO status Condition No invalid string condition Valid string length Current length of IN exceeds maximum length of IN...
Page 255: Left, Right, And Mid
101BExtended instructions 8.2 String and character Condition Maximum length of IN1 or IN2 is 255, or the maximum length of OUT is 0 or 255 8.2.4.3 LEFT, RIGHT, and MID Table 8- 56 Left, right and middle substring operations LAD / FBD Description LEFT (Left substring) provides a substring made of the first L out := LEFT(in, L);...
Page 256: Delete
101BExtended instructions 8.2 String and character Table 8- 58 ENO status Condition No errors detected Valid characters Current length is set to 0 L or P is less than or equal to 0  P is greater than maximum length of IN ...
Page 257: Insert
101BExtended instructions 8.2 String and character Table 8- 61 ENO status Condition No errors detected Valid characters P is greater than current length of IN IN is copied to OUT with no characters deleted Resulting string after characters are deleted is larger than maximum length Resulting string characters are of OUT string copied until the maximum length...
Page 258: Replace
101BExtended instructions 8.2 String and character Condition Resulting string after insertion is larger than maximum length of Resulting string characters are copied OUT string until the maximum length of OUT is reached Current length of IN1 exceeds maximum length of IN1, current Current length is set to 0 length of IN2 exceeds maximum length of IN2, or current length of OUT exceeds maximum length of OUT (invalid string)
Page 259: Find
101BExtended instructions 8.2 String and character Table 8- 67 ENO status Condition No errors detected Valid characters P is greater than length of IN1 IN2 is concatenated with IN1 immediately following the last IN1 character P points within IN1, but fewer than L characters remain in IN1 IN2 replaces the end characters of IN1 beginning at position P Resulting string after replacement is larger than maximum length of...
Page 260: Distributed I/O (Profinet, Profibus, Or As-I)
101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Table 8- 70 ENO status Condition No errors detected Valid character position IN2 is larger than IN1 Character position is set to 0 Current length of IN1 exceeds maximum length of IN1, or current length of IN2 exceeds maximum length of IN2 (invalid string) Maximum length of IN1 or IN2 does not fit within allocated memory range...
Page 261 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Table 8- 72 RDREC and WRREC data types for the parameters Parameter and type Data type Description Bool REQ = 1: Transfer data record HW_IO (Word) Logical address of the DP slave/PROFINET IO component (module or submodule): For an output module, bit 15 must be set (for example, for ...
Page 262 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Parameter and type Data type Description OUT (RDREC) UInt Length of the fetched data record information (RDREC)  IN (WRREC) Maximum byte length of the data record to be transferred  (WRREC) RECORD IN_OUT...
Page 263: Ralrm
101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) 8.3.2 RALRM You can use the RALRM (Read alarm) instruction with PROFINET and PROFIBUS. Table 8- 73 RALRM instruction LAD / FBD Description Use the RALRM (read alarm) instruction to read diagnostic "RALRM_DB"( interrupt information from a DP slave or PROFINET I/O device.
Page 264 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Parameter and type Data type Description HW_IO (Word) Logical start address of the component (module) from which an interrupt was received. Bit 15 contains the I/O ID: 0 for an input address ...
Page 265: Status Parameter For Rdrec, Wrrec, And Ralrm
101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Note If you assign a destination area for TINFO or AINFO that is too short, RALRM cannot return the full information. Refer to the online information system of STEP 7 for immediate access to information on how to interpret the TINFO and AINFO returned buffers.
Page 266 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Error_decode Error_code_1 Explanation (DVP1) Description (B#16#..) (B#16#..) Reserved, pass The DP component addressed via ID or F_ID is not configured. The "RALRM (Page 263)" cannot supply the OB start information, management information, header information, or additional interrupt information.
Page 267 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Error_decode Error_code_1 Explanation (DVP1) Description (B#16#..) (B#16#..) Invalid type DP slave or module reports an invalid type: With "RDREC (Page 260)": Buffer too small (subsets  cannot be read) With "WRREC (Page 260)": Buffer too small (subsets ...
Page 268 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Error_decode Error_code_1 Explanation (DVP1) Description (B#16#..) (B#16#..) 00 to FF Error in the eighth call parameter (with "RALRM (Page 263)": TINFO) Note: Refer to the online information system of STEP 7 for immediate access to information on how to interpret the "TINFO"...
Page 269: Dprd_Dat And Dpwr_Dat
101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) 8.3.4 DPRD_DAT and DPWR_DAT You can use the DPRD_DAT (Read consistent data) and DPWR_DAT (Write consistent data) instructions with PROFINET and PROFIBUS. Table 8- 79 DPRD_DAT and DPWR_DAT instructions LAD / FBD Description Use the DPRD_DAT instruction to read the consistent ret_val := DPRD_DAT(...
Page 270 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) DPRD_DAT operations The destination area must have the same length as configured for the selected module with STEP 7. If no error occurs during the data transfer, the data that have been read are entered into the destination area identified by RECORD.
Page 271: Dpnrm_Dg
101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Refer to "Extended instructions, Distributed I/O: Error information for RDREC, WRREC, and RALRM" (Page 265) for more information on general error codes. Note If you access DPV1 slaves, error information from these slaves can be forwarded from the DP master to the instruction.
Page 272 101BExtended instructions 8.3 Distributed I/O (PROFINET, PROFIBUS, or AS-i) Table 8- 84 Slave diagnostic data structure Byte Description Station status 1 Station status 2 Station status 3 Master station number Vendor ID (high byte) Vendor ID (low byte) 6 ... Additional slave-specific diagnostic information Table 8- 85 DPNRM_DG instruction error codes...
Page 273: Interrupts
101BExtended instructions 8.4 Interrupts Error code Description Restriction 80C2 The module is currently processing the maximum possible number of jobs for a CPU. 80C3 The required resources (memory, etc.) are currently occupied. 80C4 Internal temporary error. The job could not be processed. Repeat the job.
Page 274 101BExtended instructions 8.4 Interrupts Table 8- 87 Data types for the parameters Parameter and type Data type Description OB_NR OB_ATT Organization block identifier: Select from the available hardware interrupt OBs that were created using the "Add new block" feature. Double-click on the parameter field, then click on the helper icon to see the available OBs.
Page 275 101BExtended instructions 8.4 Interrupts Check box options within the PLC device configuration: ● Digital input – Enable rising edge detection – Enable falling edge detection ● High-speed counter (HSC) – Enable this high-speed counter for use – Generate interrupt for counter value equals reference value count –...
Page 276: Cyclic Interrupts
101BExtended instructions 8.4 Interrupts You have the option to attach or detach an OB to an enabled event at configuration time. To attach an OB to an event at configuration time, you must use the "HW interrupt:" drop-down list (click on the down arrow on the right) and select an OB from the list of available hardware-interrupt OBs.
Page 277 101BExtended instructions 8.4 Interrupts Table 8- 90 Data types for the parameters Parameter and type Data type Description OB_NR OB_CYCLIC OB number (accepts symbolic name) CYCLE UDInt Time interval, in microseconds PHASE UDInt Phase shift, in microseconds RET_VAL Execution condition code Time parameter examples: ●...
Page 278: Qry_Cint (Query Cyclic Interrupt)
101BExtended instructions 8.4 Interrupts Table 8- 91 Condition codes RET_VAL (W#16#..) Description 0000 No error 8090 OB does not exist or is of wrong type 8091 Invalid cycle time 8092 Invalid phase shift time 80B2 OB has no attached event 8.4.2.2 QRY_CINT (Query cyclic interrupt) Table 8- 92...
Page 279: Time Delay Interrupts
101BExtended instructions 8.4 Interrupts Value Description Other Bits Always 0 If an error occurs, RET_VAL displays the appropriate error code and the parameter STATUS = 0. Table 8- 95 RET_VAL parameter RET_VAL (W#16#..) Description 0000 No error 8090 OB does not exist or is of wrong type. 80B2 OB has no attached event.
Page 280 101BExtended instructions 8.4 Interrupts Parameter and type Data type Description SIGN Word Not used by the S7-1200: Any value is accepted. A value must be assigned to prevent errors. RET_VAL Execution condition code STATUS Word QRY_DINT instruction: Status of the specified time-delay interrupt OB, see the table below Only for SRT_DINT Operation...
Page 281: Asynchronous Event Interrupts
101BExtended instructions 8.4 Interrupts Value Description An OB with an OB number given in OB_NR does not exist. An OB with an OB number given in OB_NR exists. Other bits Always 0 Condition codes Table 8- 99 Condition codes for SRT_DINT, CAN_DINT, and QRY_DINT RET_VAL (W#16#...) Description 0000...
Page 282: Diagnostics (Profinet Or Profibus)
101BExtended instructions 8.5 Diagnostics (PROFINET or PROFIBUS) After the interrupt events are enabled again, the interrupts that occurred while DIS_AIRT was in effect are processed, or the interrupts are processed as soon as the current OB has been executed. Parameter RET_VAL indicates the number of times that interrupt processing was disabled, which is the number of queued DIS_AIRT executions.
Page 283: Devicestates Instruction
101BExtended instructions 8.5 Diagnostics (PROFINET or PROFIBUS) RET_VAL (W#16#...) Description Color 2 On (Solid) Color 1 flashing at 2 Hz Color 2 flashing 2 Hz Color 1 & 2 flashing alternatively at 2 Hz Color 1 on (Tx/Rx) Color 2 on (Tx/Rx) State of the LED is not available 8091 Device identified by LADDR does not exist...
Page 284: Modulestates Instruction
101BExtended instructions 8.5 Diagnostics (PROFINET or PROFIBUS) After execution, the STATE parameter contains the error state of each I/O device as a bit list (for the specified LADDR and MODE). The data type used for the STATE parameter can be any bit type (Bool, Byte, Word, or DWord) or an array of a bit type.
Page 285: Get_Diag Instruction
101BExtended instructions 8.5 Diagnostics (PROFINET or PROFIBUS) Parameter and type Data type Description RET_VAL Status (condition code) STATE InOut Variant Buffer containing the error status of each device Summary bit: Bit 0 =1, if one of the state bits of the I/O devices ...
Page 286 101BExtended instructions 8.5 Diagnostics (PROFINET or PROFIBUS) Input LADDR selects the hardware device. The type of the delivered diagnostic information is selected by the input MODE. Table 8- 113 MODE parameter MODE input DIAG output CNT_DIAG output DETAIL output Bit list of supported modes as DWord Nothing Diagnostic state as diagnostic information Nothing...
Page 287: Pulse
101BExtended instructions 8.6 Pulse Pulse 8.6.1 CTRL_PWM instruction Table 8- 117 CTRL_PWM (Pulse Width Modulation) instruction LAD / FBD Description Provides a fixed cycle time output with a variable duty "CTRL_PWM_DB"( cycle. The PWM output runs continuously after being PWM:=_word_in_, started at the specified frequency (cycle time).
Page 288 101BExtended instructions 8.6 Pulse The pulse width will be set to the initial value configured in device configuration when the CPU first enters RUN mode. You write values to the Q-word location specified in device configuration ("Output addresses" / "Start address:") as needed to change the pulse width. You use an instruction such as a move, convert, math, or PID box to write the desired pulse width to the appropriate Q word.
Page 289: Operation Of The Pulse Outputs
101BExtended instructions 8.6 Pulse 8.6.2 Operation of the pulse outputs Pulse width can be expressed as hundredths of the cycle time (0 to 100), as thousandths (0 to 1000), as ten thousandths (0 to 10000), or as S7 analog format. The pulse width can vary from 0 (no pulse, always off) to full scale (no pulse, always on).
Page 290: Configuring A Pulse Channel For Pwm
101BExtended instructions 8.6 Pulse Table 8- 121 Default output assignments for the pulse generators Description Pulse Direction PTO 1 Onboard CPU Q0.0 Q0.1 Signal board Q4.0 Q4.1 PWM 1 Onboard CPU Q0.0 Signal board Q4.0 PTO 2 Onboard CPU Q0.2 Q0.3 Signal board Q4.2...
Page 291: Data Logging
101BExtended instructions 8.7 Data logging ● Cycle time: Enter your cycle time value. This value can only be changed in Device configuration. ● Initial pulse width: Enter your initial pulse width value. The pulse width value can be changed during runtime. Enter the start address to configure the output addresses.
Page 292 101BExtended instructions 8.7 Data logging DATA parameter for the DataLogCreate instruction The DATA parameter points to memory used as a temporary buffer for a new log record and must be assigned to an M or DB location. You can assign an entire DB (derived from a PLC data type that you assign when the DB is created) or part of a DB (the specified DB element can be any data type, data type structure, PLC data type, or data array).
Page 293: Program Instructions That Control Data Logs
101BExtended instructions 8.7 Data logging 8.7.2 Program instructions that control Data logs 8.7.2.1 DataLogCreate Table 8- 122 DataLogCreate instruction LAD/FBD Description Creates and initializes a data log file. The "DataLogCreate_DB"( file is created in the PLC \DataLogs req:=_bool_in_, directory, named by the NAME records:=_udint_in_, parameter, and implicitly opened for write format:=_uint_in_,...
Page 294 101BExtended instructions 8.7 Data logging Parameter and type Data type Description In/Out DWord Data log numeric identifier: You store this generated value for use with other Data log instructions. The ID parameter is only used as an output with the DataLogCreate instruction.
Page 295 101BExtended instructions 8.7 Data logging Memory resource usage: ● The data logs consume only load memory. ● There is no set limit for the total number of data logs. The size of all data logs combined is limited by the available resources of load memory. Only eight data logs may be open at one time.
Page 296: Datalogopen
101BExtended instructions 8.7 Data logging 8.7.2.2 DataLogOpen Table 8- 125 DataLogOpen instruction LAD / FBD Description Opens a pre-existing data log file. A data log must be "DataLogOpen_DB"( opened before you can write new records to the log. Data req:=_bool_in_, logs can be opened and closed individually.
Page 297: Datalogclose
101BExtended instructions 8.7 Data logging The NAME must be the name of a data log created by the DataLogCreate instruction. If only the NAME is provided and the NAME specifies a valid data log, then the corresponding ID will be returned (ID parameter as an output). Note General usage of data log files ...
Page 298: Datalogwrite
101BExtended instructions 8.7 Data logging Table 8- 129 Data types for the parameters Parameter and type Data type Description Bool A low to high (positive edge) signal starts the operation. (Default value: False) In/Out DWord Numeric identifier of a data log. Only used as an input for the DataLogClose instruction.
Page 299 101BExtended instructions 8.7 Data logging Table 8- 132 Data types for the parameters Parameter and type Data type Description Bool A low to high (positive edge) signal starts the operation. (Default value: False) In/Out DWord Numeric data log identifier. Only used as an input for the DataLogWrite instruction.
Page 300: Datalognewfile
101BExtended instructions 8.7 Data logging 8.7.2.5 DataLogNewFile Table 8- 134 DataLogNewFile instruction LAD / FBD Description Allows your program to create a new data "DataLogNewFile_DB"( log file based upon an existing data log file. req:=_bool_in_, records=:_udint_in_, STEP 7 automatically creates the associated instance DB when you insert the instruction.
Page 301 101BExtended instructions 8.7 Data logging You can execute the DataLogNewFile instruction when a data log becomes full or is deemed completed and you do not want to lose any data that is stored in the data log. A new empty data log file can be created based on the structure of the full Data log file.
Page 302: Working With Data Logs
101BExtended instructions 8.7 Data logging 8.7.3 Working with data logs The data log files are stored as comma separated value format (*.csv) in persistent flash memory. You can view the data logs by using the PLC Web server feature or by removing the PLC memory card and inserting it in a standard PC card reader.
Page 303: Limits To The Size Of Data Log Files
101BExtended instructions 8.7 Data logging Viewing data logs from a Web browser Even if you do not use the Web server feature, you can view data logs directly from a Web browser such as Internet Explorer or Mozilla Firefox. Simply enter the following text into the address bar of your browser using the IP address of your CPU and the actual name of the data log file you provided in STEP 7 instead of "MyDataLog": http://192.168.0.1/DataLog.html?FileName=MyDataLog.csv...
Page 304 101BExtended instructions 8.7 Data logging Determine the size of load memory free space 1. Establish an online connection between STEP 7 and the target S7-1200 PLC. 2. Download the program to which you want to add data log operations. 3. Create any optional user-defined web pages that you need. (The standard web pages that give you access to data logs are stored in PLC firmware and do not use load memory).
Page 305: Data Log Example Program
101BExtended instructions 8.7 Data logging The DataLogCreate DATA parameter points to a structure that specifies the number of data fields and the data type of each data field for one data log record. The table above gives the bytes required in the CSV file for each data type. Multiply the number of occurrences of a given data type by the number of bytes it requires.
Page 306 101BExtended instructions 8.7 Data logging Example Data log program Example data log names, header text, and the MyData structure are created in a data block. The three MyData variables temporarily store new sample values. The process sample values at these DB locations are transferred to a data log file by executing the DataLogWrite instruction.
Page 307 101BExtended instructions 8.7 Data logging Network 3 A positive edge signal triggers when to store new process values in the MyData structure. Network 4 The EN input state is based upon when the DataLogCreate operation is complete. A create operation extends over many scan cycles and must be complete before executing a write operation.
Page 308 101BExtended instructions 8.7 Data logging Network 6 A positive signal edge DataLogOpen REQ input simulates the user pushing a button on an HMI that opens a data log file. If you open a Data log file that has all records filled with process data, then the next DataLogWrite operation will overwrite the oldest record.
Page 309 101BExtended instructions 8.7 Data logging Data log files created by the example program viewed with the S7-1200 CPU Webserver Table 8- 139 Downloaded .csv file examples viewed with Microsoft Excel Two records written in a five record maximum file Five records in a Data log file with a five record maximum After one additional record is written to the file above which is full, the sixth write...
Page 310: Data Block Control
101BExtended instructions 8.8 Data block control Data block control 8.8.1 READ_DBL, WRIT_DBL (Read from or write to a DB in load memory) Table 8- 140 READ_DBL and WRIT_DBL instructions LAD / FBD Description Copies DB start values or part of the READ_DBL( values, from load memory to a target req:=_bool_in_,...
Page 311 101BExtended instructions 8.8 Data block control Typically, a DB is stored in both load memory (flash) and work memory (RAM). The start values (initial values) are always stored in load memory, and the current values are always stored in work memory. READ_DBL can be used to copy a set of start values from load memory to the current values of a DB in work memory that is referenced by your program.
Page 312 101BExtended instructions 8.8 Data block control SRCBLK and DSTBLK parameter restrictions: ● A data block must have been previously created before it can be referenced. ● The length of a VARIANT pointer of type BOOL must be divisible by 8. ●...
Page 313: Common Error Codes For The "Extended" Instructions
101BExtended instructions 8.9 Common error codes for the "Extended" instructions Common error codes for the "Extended" instructions Table 8- 143 Common condition codes for the extended instructions Condition code (W#16#..) Description 8022 Area too small for input 8023 Area too small for output 8024 Illegal input area 8025...
Page 314 101BExtended instructions 8.9 Common error codes for the "Extended" instructions S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 315: Technology Instructions
Technology instructions High-speed counter Table 9- 1 CTRL_HSC instruction LAD / FBD Description Each CTRL_HSC instruction uses a structure stored in "CTRL_HSC_0_DB" ( a DB to maintain data. You assign the DB when the hsc:=_hw_hsc_in_, CTRL_HSC instruction is placed in the editor. dir:=_bool_in_, cv:=_bool_in_, rv:=_bool_in_,...
Page 316 102BTechnology instructions 9.1 High-speed counter You configure the parameters for each HSC in the device configuration for the CPU: counting mode, I/O connections, interrupt assignment, and operation as a high-speed counter or as a device to measure pulse frequency. Some of the parameters for the HSC can be modified by your user program to provide program control of the counting process: ●...
Page 317: Operation Of The High-Speed Counter
102BTechnology instructions 9.1 High-speed counter 9.1.1 Operation of the high-speed counter The high-speed counter (HSC) counts events that occur faster than the OB execution rate. If the events to be counted occur within the execution rate of the OB, you can use CTU, CTD, or CTUD counter instructions.
Page 318 102BTechnology instructions 9.1 High-speed counter Selecting the functionality for the HSC All HSCs function the same way for the same counter mode of operation. There are four basic types of HSC: ● Single-phase counter with internal direction control ● Single-phase counter with external direction control ●...
Page 319 102BTechnology instructions 9.1 High-speed counter Input addresses for the HSC Note The digital I/O points used by high-speed counter devices are assigned during device configuration. When digital I/O point addresses are assigned to these devices, the values of the assigned I/O point addresses cannot be modified by the force function in a watch table. When you configure the CPU, you have the option to enable and configure each HSC.
Page 320 102BTechnology instructions 9.1 High-speed counter CPU on-board input (0.x) SB input (default 4.x) HSC 6 1-phase 2-phase AB-phase HSC 1 and HSC 2 can be configured for either the on-board inputs or for an SB. HSC 5 and HSC 6 are available only with an SB. HSC 6 is available only with a 4-input SB. An SB with only 2 digital inputs provides only the 4.0 and 4.1 inputs.
Page 321 102BTechnology instructions 9.1 High-speed counter The following two tables show the HSC input assignments for the on-board I/O of the CPU 1214C and for an optional SB, if installed. ● For single-phase: C is the Clock input, [d] is the optional direction input, and [R] is an optional external reset input.
Page 322 102BTechnology instructions 9.1 High-speed counter SB inputs (default: 4.x) HSC 5 1-phase 2-phase AB-phase HSC 6 1-phase 2-phase AB-phase For CPU 1214C: HSC 1, HSC 2, HSC 5 and HSC 6 can be configured for either the on-board inputs or for an SB. An SB with only 2 digital inputs provides only the 4.0 and 4.1 inputs.
Page 323: Configuration Of The Hsc
102BTechnology instructions 9.1 High-speed counter 9.1.2 Configuration of the HSC The CPU allows you to configure up to 6 high-speed counters. You edit the "Properties" of the CPU to configure the parameters of each individual HSC. Use the CTRL_HSC instruction in your user program to control the operation of the HSC.
Page 324: Pid Control
102BTechnology instructions 9.2 PID control PID control STEP 7 provides the following PID instructions for the S7-1200 CPU: ● The PID_Compact instruction is used to control technical processes with continuous input- and output variables. ● The PID_3Step instruction is used to control motor-actuated devices, such as valves that require discrete signals for open- and close actuation.
Page 325: Inserting The Pid Instruction And Technological Object
102BTechnology instructions 9.2 PID control The PID controller uses the following formula to calculate the output value for the PID_Compact instruction. · s y = K (b · w - x) + (w - x) + (c · w - x) ·...
Page 326 102BTechnology instructions 9.2 PID control Table 9- 11 Inserting the PID instruction and the technological object When you insert a PID instruction into your user program, STEP 7 automatically creates a technology object and an instance DB for the instruction. The instance DB contains all of the parameters that are used by the PID instruction.
Page 327 102BTechnology instructions 9.2 PID control Table 9- 12 (Optional) Creating a technological object from the project navigator You can also create technological objects for your project before inserting the PID instruction. By creating the technological object before inserting a PID instruction into your user program, you can then select the technological object when you insert the PID instruction.
Page 328: Pid_Compact Instruction
102BTechnology instructions 9.2 PID control 9.2.2 PID_Compact instruction The PID controller uses the following formula to calculate the output value for the PID_Compact instruction. · s y = K (b · w - x) + (w - x) + (c · w - x) ·...
Page 329 102BTechnology instructions 9.2 PID control Parameter and type Data type Description Input_PER Word Analog process value (optional). Default value: W#16#0 You must also set sPid_Cmpt.b_Input_PER_On = TRUE. ManualEnable Bool Enables or disables the manual operation mode. Default value: FALSE On the edge of the change from FALSE to TRUE, the PID controller ...
Page 330 102BTechnology instructions 9.2 PID control Figure 9-1 Operation of the PID_Compact controller Figure 9-2 Operation of the PID_Compact controller as a PIDT1 controller with anti-windup S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 331: Pid_3Step Instruction
102BTechnology instructions 9.2 PID control 9.2.3 PID_3STEP instruction The PID controller uses the following formula to calculate the output value for the PID_3Step instruction. · s Δ y = K · s · (b · w - x) + (w - x) + (c ·...
Page 332 102BTechnology instructions 9.2 PID control Table 9- 16 Data types for the parameters Parameter and type Data type Description Setpoint Real Setpoint of the PID controller in automatic mode. Default value: 0.0 Input Real Process value. Default value: 0.0 You must also set Config.InputPEROn = FALSE. Input_PER Word Analog process value (optional).
Page 333 102BTechnology instructions 9.2 PID control Parameter and type Data type Description Actuator_L Bool If Actuator_L = TRUE, the valve is at the lower end stop and is no longer moved in this direction. Default value: FALSE Reset Bool Restarts the PID controller. Default value: FALSE If Reset = TRUE: "Inactive"...
Page 334 102BTechnology instructions 9.2 PID control Figure 9-3 Operation of the PID_3Step controller as a PIDT1 controller with anti-windup S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 335 102BTechnology instructions 9.2 PID control Figure 9-4 Operation of the PID_3Step controller without position feedback S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 336 102BTechnology instructions 9.2 PID control Figure 9-5 Operation of the PID_3Step controller the position feedback enabled S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 337: Configuring The Pid Controller
102BTechnology instructions 9.2 PID control If several errors are pending, the values of the error codes are displayed by means of binary addition. The display of error code 0003, for example, indicates that the errors 0001 and 0002 are also pending. Table 9- 17 ErrorBit parameters ErrorBit (DW#16#...)
Page 338 102BTechnology instructions 9.2 PID control Figure 9-6 Configuration editor for PID_Compact (Basic settings) Table 9- 18 Sample configuration settings for the PID_Compact instruction Settings Description Basic Controller type Selects the engineering units. Invert the control logic Allows selection of a reverse-acting PID loop. If not selected, the PID loop is in direct-acting mode and the output of PID loop ...
Page 339 102BTechnology instructions 9.2 PID control Table 9- 19 Sample configuration settings for the PID_3Step instruction Settings Description Basic Controller type Selects the engineering units. Invert the control logic Allows selection of a reverse-acting PID loop. If not selected, the PID loop is in direct-acting mode, and the output of PID loop ...
Page 340: Commissioning The Pid Controller
102BTechnology instructions 9.3 Basic motion control 9.2.5 Commissioning the PID controller Use the commissioning editor to configure the PID controller for autotuning at startup and for autotuning during operation. To open the commissioning editor, click the icon on either the instruction or the project navigator. Table 9- 20 Sample configuration screen (PID_3Step) Measurement: To display the setpoint, the...
Page 341 102BTechnology instructions 9.3 Basic motion control ① PROFINET ② Pulse and direction outputs ③ Power section for stepper motor ④ Power section for servo motor The DC/DC/DC variants of the CPU S7-1200 have onboard outputs for direct control of drives. The relay variants of the CPU require the signal board with DC outputs for drive control.
Page 342 102BTechnology instructions 9.3 Basic motion control Table 9- 22 Limit frequencies of pulse outputs Pulse output Frequency Onboard 2 Hz ≤ f ≤ 100 KHz Standard SB 2 Hz ≤ f ≤ 20 KHz High-speed (200 KHz) SBs MC V2 instructions: 2 Hz ≤ f ≤ 200 KHz MC V1 instructions: 2 Hz ≤...
Page 343: Configuration Of The Axis
102BTechnology instructions 9.3 Basic motion control Note The CPU calculates motion tasks in "slices" or segments of 10 ms. As one slice is being executed, the next slice is waiting in the queue to be executed. If you interrupt the motion task on an axis (by executing another new motion task for that axis), the new motion task may not be executed for a maximum of 20 ms (the remainder of the current slice plus the queued slice).
Page 344 102BTechnology instructions 9.3 Basic motion control Table 9- 23 STEP 7 tools for motion control Tool Description Configuration Configures the following properties of the "Axis" technology object: Selection of the PTO to be used and configuration of the drive interface ...
Page 345 102BTechnology instructions 9.3 Basic motion control Configure the properties for the drive signals, drive mechanics, and position monitoring (hardware and software limit switches). Do not deselect the options for a hardware limit or a reference point configuration unless the input point is no longer assigned as a hardware limit or a reference point.
Page 346: Motion Control Instructions
102BTechnology instructions 9.3 Basic motion control 9.3.2 Motion control instructions Note The CPU calculates motion tasks in "slices" or segments of 10 ms. As one slice is being executed, the next slice is waiting in the queue to be executed. If you interrupt the motion task on an axis (by executing another new motion task for that axis), the new motion task may not be executed for a maximum of 20 ms (the remainder of the current slice plus the queued slice).
Page 347 102BTechnology instructions 9.3 Basic motion control Parameter and type Data type Description StopMode 0: Emergency stop - If a request to disable the axis is pending, the  axis brakes at the configured emergency deceleration. The axis is disabled after reaching standstill. 1: Immediate stop - If a request to disable the axis is pending, this axis is disabled without deceleration.
Page 348 102BTechnology instructions 9.3 Basic motion control ① An axis is enabled and then disabled again. After the drive has signaled "Drive ready" back to the CPU, the successful enable can be read out via "Status_1". ② Following an axis enable, an error has occurred that caused the axis to be disabled. The error is eliminated and acknowledged with "MC_Reset".
Page 349: Mc_Reset Instruction
102BTechnology instructions 9.3 Basic motion control 9.3.2.2 MC_Reset instruction Table 9- 26 MC_Reset instruction LAD / FBD Description Use the MC_Reset instruction to acknowledge "MC_Reset_DB"( "Operating error with axis stop" and Axis:=_multi_fb_in_, "Configuration error". The errors that require Execute:=_bool_in_, acknowledgement can be found in the "List of Done=>_bool_out_, ErrorIDs and ErrorInfos"...
Page 350: Mc_Home Instruction
102BTechnology instructions 9.3 Basic motion control 9.3.2.3 MC_Home instruction Table 9- 28 MC_Home instruction LAD / FBD Description Use the MC_Home instruction to match "MC_Home_DB"( the axis coordinates to the real, physical Axis:=_multi_fb_in_, drive position. Homing is required for Execute:=_bool_in_, absolute positioning of the axis: Position:=_real_in_, In order to use the MC_Home instruction,...
Page 351 102BTechnology instructions 9.3 Basic motion control Parameter and type Data type Description Mode Homing mode 0: Direct homing absolute  New axis position is the position value of parameter "Position". 1: Direct homing relative  New axis position is the current axis position + position value of parameter "Position".
Page 352: Mc_Halt Instruction
102BTechnology instructions 9.3 Basic motion control Table 9- 30 Override response Mode Description 0 or 1 The MC_Home task cannot be aborted by any other motion control task. The new MC_Home task does not abort any active motion control tasks. Position-related motion tasks are resumed after homing according to the new homing position (value at the Position input parameter).
Page 353 102BTechnology instructions 9.3 Basic motion control Parameter and type Data type Description CommandAborted Bool TRUE = During execution the task was aborted by another task. Error Bool TRUE = An error has occurred during execution of the task. The cause of the error can be found in parameters "ErrorID" and "ErrorInfo".
Page 354: Mc_Moveabsolute Instruction
102BTechnology instructions 9.3 Basic motion control 9.3.2.5 MC_MoveAbsolute instruction Table 9- 33 MC_MoveAbsolute instruction LAD / FBD Description Use the MC_MoveAbsolute "MC_MoveAbsolute_DB"( instruction to start a positioning Axis:=_multi_fb_in_, motion of the axis to an absolute Execute:=_bool_in_, position. Position:=_real_in_, In order to use the Velocity:=_real_in_, MC_MoveAbsolute instruction, the Done=>_bool_out_,...
Page 355 102BTechnology instructions 9.3 Basic motion control The following values were configured in the "Dynamics > General" configuration window: Acceleration = 10.0 and Deceleration = 10.0 ① An axis is moved to absolute position 1000.0 with a MC_MoveAbsolute task. When the axis reaches the target position, this is signaled via "Done_1".
Page 356: Mc_Moverelative Instruction
102BTechnology instructions 9.3 Basic motion control 9.3.2.6 MC_MoveRelative instruction Table 9- 35 MC_MoveRelative instruction LAD / FBD Description Use the MC_MoveRelative "MC_MoveRelative_DB"( instruction to start a positioning Axis:=_multi_fb_in_, motion relative to the start position. Execute:=_bool_in_, In order to use the Distance:=_real_in_, MC_MoveRelative instruction, the Velocity:=_real_in_,...
Page 357 102BTechnology instructions 9.3 Basic motion control The following values were configured in the "Dynamics > General" configuration window: Acceleration = 10.0 and Deceleration = 10.0 ① The axis is moved by an MC_MoveRelative task by the distance ("Distance") 1000.0. When the axis reaches the target position, this is signaled via "Done_1".
Page 358: Mc_Movevelocity Instruction
102BTechnology instructions 9.3 Basic motion control 9.3.2.7 MC_MoveVelocity instruction Table 9- 37 MC_MoveVelocity instruction LAD / FBD Description Use the MC_MoveVelocity "MC_MoveVelocity_DB"( instruction to move the axis Axis:=_multi_fb_in_, constantly at the specified velocity. Execute:=_bool_in_, In order to use the Velocity:=_real_in_, MC_MoveVelocity instruction, the Direction:=_int_in_, axis must first be enabled.
Page 359 102BTechnology instructions 9.3 Basic motion control Parameter and type Data type Description InVelocity Bool TRUE: If "Current" = FALSE: The velocity specified in parameter  "Velocity" was reached. If "Current" = TRUE: The axis travels at the current velocity at ...
Page 360: Mc_Movejog Instruction
102BTechnology instructions 9.3 Basic motion control Override response The MC_MoveVelocity task can be aborted The new MC_MoveVelocity task aborts the by the following motion control tasks: following active motion control tasks:  MC_Home Mode = 3  MC_Home Mode = 3 ...
Page 361 102BTechnology instructions 9.3 Basic motion control Table 9- 40 Parameters for the MC_MoveJog instruction Parameter and type Data type Description Axis TO_Axis_1 Axis technology object JogForward Bool As long as the parameter is TRUE, the axis moves in the positive direction at the velocity specified in parameter "Velocity".
Page 362: Mc_Commandtable Instruction
102BTechnology instructions 9.3 Basic motion control Override response The MC_MoveJog task can be aborted by The new MC_MoveJog task aborts the the following motion control tasks: following active motion control tasks:  MC_Home Mode = 3  MC_Home Mode = 3 ...
Page 363 102BTechnology instructions 9.3 Basic motion control Parameter and type Data type Initial value Description Busy Bool FALSE Operation in progress CommandAborted Bool FALSE The task was aborted during processing by another task. Error Bool FALSE An error ocurred during processing. The cause is indicated by the parameters ErrorID and ErrorInfo.
Page 364 102BTechnology instructions 9.3 Basic motion control Command type Description Velocity setpoint Moves the axis at the given velocity. Wait Waits until the given period is over. "Wait" does not stop an active traversing motion. Separator Adds a "Separator" line above the selected line. The separator line acts as a range limit for the graphic display of the trend view.
Page 365: Mc_Changedynamic
102BTechnology instructions 9.3 Basic motion control 9.3.2.10 MC_ChangeDynamic Table 9- 44 MC_ChangeDynamic instruction LAD / FBD Description Changes the dynamic settings of "MC_ChangeDynamic_DB"( a motion control axis.: Execute:=_bool_in_, ChangeRampUp:=_bool_in_, Value for acceleration change  RampUpTime:=_real_in_, Value for delay change  ChangeRampDown:=_bool_in_, Value for emergency stop- ...
Page 366 102BTechnology instructions 9.3 Basic motion control Parameter and type Data type Description ChangeJerkEnable Bool TRUE = Change the jerk limitation according to the input parameter JerkEnable. Inital value: FALSE JerkEnable Bool TRUE = Enable the jerk limitation. Inital value: FALSE Status of the affected variable stored in: <Axisname>.
Page 367: Operation Of Motion Control For S7-1200
102BTechnology instructions 9.3 Basic motion control 9.3.3 Operation of motion control for S7-1200 9.3.3.1 CPU outputs used for motion control The CPU provides one pulse output and one direction output for controlling a stepper motor drive or a servo motor drive with pulse interface. The pulse output provides the drive with the pulses required for motor motion.
Page 368: Hardware And Software Limit Switches For Motion Control
102BTechnology instructions 9.3 Basic motion control Drive interface For motion control, you can optionally configure a drive interface for "Drive enabled" and "Drive ready". When using the drive interface, the digital output for the drive enable and the digital input for "drive ready" can be freely selected. Note The firmware will take control via the corresponding pulse and direction outputs if the PTO (Pulse Train Output) has been selected and assigned to an axis.
Page 369 102BTechnology instructions 9.3 Basic motion control When the hardware limit switches are approached, the axis brakes to a standstill at the configured emergency deceleration. The specified emergency deceleration must be sufficient to reliably stop the axis before the mechanical stop. The following diagram presents the behavior of the axis after it approaches the hardware limit switches.
Page 370 102BTechnology instructions 9.3 Basic motion control ① The axis brakes to a standstill at the configured deceleration. [Velocity] Working range Distance Lower software limit switch Upper software limit switch Use additional hardware limit switches if a mechanical endstop is located after the software limit switches and there is a risk of mechanical damage.
Page 371: Homing
102BTechnology instructions 9.3 Basic motion control 9.3.3.3 Homing Homing refers to the matching of the axis coordinates to the real, physical drive position. (If the drive is currently at position x, the axis will be adjusted to be in position x.) For position- controlled axes, the entries and displays for the position refer exactly to these axis coordinates.
Page 372 102BTechnology instructions 9.3 Basic motion control ● Mode 2 - Passive Referencing: When the axis is moving and passes the Reference Point Switch the current position is set as the home position. This feature will help account for normal machine wear and gear backlash and prevent the need for manual compensation for wear.
Page 373 102BTechnology instructions 9.3 Basic motion control Table 9- 47 Configuration parameters for homing the axis Parameter Description Input reference point switch Select the digital input for the reference point switch from the drop-down list box. The input must be interrupt-capable. The onboard CPU inputs and inputs of an inserted (Active and passive homing) signal board can be selected as inputs for the reference point switch.
Page 374 102BTechnology instructions 9.3 Basic motion control Parameter Description Reduced velocity Specify the velocity at which the axis approaches the reference point switch for homing. (Active homing only) Limit values (independent of the selected user unit): Start/stop velocity ≤ reduced velocity ≤ maximum velocity Home position offset If the desired reference position deviates from the position of the reference point switch, the home position offset can be specified in this field.
Page 375 102BTechnology instructions 9.3 Basic motion control Table 9- 49 Velocity characteristics of MC homing Operation Notes Approach velocity Reduced velocity Home position coordinate Home position offset ① Search phase (blue curve segment): When active homing starts, the axis accelerates to the configured "approach velocity"...
Page 376: Jerk Limit
102BTechnology instructions 9.3 Basic motion control 9.3.3.4 Jerk limit With the jerk limit you can reduce the stresses on your mechanics during an acceleration and deceleration ramp. The value for the acceleration and deceleration is not changed abruptly when the step limiter is active; it is adapted in a transition phase. The figure below shows the velocity and acceleration curve without and with jerk limit.
Page 377: Commissioning
102BTechnology instructions 9.3 Basic motion control 9.3.4 Commissioning "Status and error bits" diagnostic function Use the "Status and error bits" diagnostic function to monitor the most important status and error messages for the axis. The diagnostic function display is available in online mode in "Manual control"...
Page 378 102BTechnology instructions 9.3 Basic motion control Status Description Constant velocity The axis travels at constant velocity. (Tag of technology object: <Axis name>.StatusBits.ConstantVelocity) Decelerating The axis decelerates (slows down). (Tag of technology object: <Axis name>.StatusBits.Deceleration) Table 9- 54 Status of the motion mode Status Description Positioning...
Page 379 102BTechnology instructions 9.3 Basic motion control "Motion status" diagnostic function Use the "Motion status" diagnostic function to monitor the motion status of the axis. The diagnostic function display is available in online mode in "Manual control" mode and in "Automatic control" when the axis is active. Table 9- 56 Motion status Status...
Page 380: Monitoring Active Commands
102BTechnology instructions 9.3 Basic motion control 9.3.5 Monitoring active commands 9.3.5.1 Monitoring MC instructions with a "Done" output parameter Motion control instructions with the output parameter "Done" are started by the input parameter "Execute" and have a defined conclusion (for example, with motion control instruction "MC_Home": Homing was successful).
Page 381 102BTechnology instructions 9.3 Basic motion control Table 9- 58 Example 1 - Complete execution of task If "Execute" = FALSE during the processing of the task If "Execute" = FALSE after completion of the task ① The task is started with a positive edge at the input parameter "Execute". Depending on the programming, "Execute" can still be reset to the value FALSE during the task, or the value TRUE can be retained until after completion of the task.
Page 382 102BTechnology instructions 9.3 Basic motion control Table 9- 59 Example 2 - Aborting the task Abort Abort If "Execute" = FALSE after the task is aborted If "Execute" = FALSE before the task is aborted ① The task is started with a positive edge at the input parameter "Execute". Depending on the programming, "Execute" can still be reset to the value FALSE during the task, or the value TRUE can be retained until after completion of the task.
Page 383 102BTechnology instructions 9.3 Basic motion control Table 9- 60 Example 3 - Error during task execution Error Error If "Execute" = FALSE before the error occurs If "Execute" = FALSE after the error occurs ① The task is started with a positive edge at the input parameter "Execute". Depending on the programming, "Execute" can still be reset to the value FALSE during the task, or the value TRUE can be retained until after completion of the task.
Page 384: Monitoring The Mc_Velocity Instruction
102BTechnology instructions 9.3 Basic motion control 9.3.5.2 Monitoring the MC_Velocity instruction The tasks of motion control instruction "MC_MoveVelocity" constantly at the specified velocity. ● The tasks of motion control instruction "MC_MoveVelocity" do not have a defined end. The task objective is fulfilled when the parameterized velocity is reached for the first time and the axis travels at constant velocity.
Page 385 102BTechnology instructions 9.3 Basic motion control Table 9- 61 Example 1 - If the parameterized velocity is reached If "Execute" = FALSE before the configured velocity is If "Execute" = FALSE after the configured velocity is reached reached ① The task is started with a positive edge at the input parameter "Execute". Depending on the programming, "Execute" can be reset to the value FALSE event before the parameterized velocity is reached, or alternatively only after it has been reached.
Page 386 102BTechnology instructions 9.3 Basic motion control Table 9- 62 Example 2 - If the task is aborted prior to reaching the parameterized velocity Abort Abort If "Execute" = FALSE before the task is aborted If "Execute" = FALSE after the task is aborted ①...
Page 387 102BTechnology instructions 9.3 Basic motion control Table 9- 63 Example 3 - If an error occurs prior to reaching the parameterized velocity Error Error If "Execute" = FALSE before the error occurs If "Execute" = FALSE after the error occurs ①...
Page 388: Monitoring The Mc_Movejog Instruction
102BTechnology instructions 9.3 Basic motion control 9.3.5.3 Monitoring the MC_MoveJog instruction The tasks of motion control instruction "MC_MoveJog" implement a jog operation. ● The motion control tasks "MC_MoveJog" do not have a defined end. The task objective is fulfilled when the parameterized velocity is reached for the first time and the axis travels at constant velocity.
Page 389 102BTechnology instructions 9.3 Basic motion control Table 9- 64 Example 1 - If the parameterized velocity is reached and maintained JogForward JogBackward ① The task is started with a positive edge at the input parameter "JogForward" or "JogBackward". ② While the task is active, the output parameter "Busy" indicates the value TRUE. ③...
Page 390 102BTechnology instructions 9.3 Basic motion control Table 9- 65 Example 2 - If the task is aborted during execution Abort Abort JogForward JogBackward ① The task is started with a positive edge at the input parameter "JogForward" or "JogBackward". ② While the task is active, the output parameter "Busy"...
Page 391 102BTechnology instructions 9.3 Basic motion control Table 9- 66 Example 3 - If an error has occurred during task execution Error Error JogBackward JogForward ① The task is started with a positive edge at the input parameter "JogForward" or "JogBackward". ②...
Page 392 102BTechnology instructions 9.3 Basic motion control S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 393: Communication
Communication The S7-1200 offers several types of communication between CPUs and programming devices, HMIs, and other CPUs: ● PROFINET (for exchanging data through the user program with other communications partners via Ethernet): – For PROFINET and PROFIBUS, the CPU supports a total of 16 devices and 256 submodules, with a maximum of 8 PROFINET IO devices and 128 submodules (if eight or less PROFIBUS slaves or submodules are configured).
Page 394: Number Of Asynchronous Communication Connections Supported
103BCommunication 10.1 Number of asynchronous communication connections supported 10.1 Number of asynchronous communication connections supported The CPU supports the following maximum number of simultaneous, asynchronous communication connections for PROFINET and PROFIBUS: ● 8 connections for Open User Communications (active or passive): TSEND_C, TRCV_C, TCON, TDISCON, TSEND, and TRCV.
Page 395 103BCommunication 10.2 PROFINET The CPU can communicate with other CPUs, with programming devices, with HMI devices, and with non-Siemens devices using standard TCP communications protocols. Programming device connected to the HMI connected to the CPU A CPU connected to another CPU The PROFINET port on the CPU does not contain an Ethernet switching device.
Page 396: Open User Communication
103BCommunication 10.2 PROFINET 10.2.2 Open user communication 10.2.2.1 Connection IDs for the PROFINET instructions When you insert the TSEND_C, TRCV_C or TCON PROFINET instructions into your user program, STEP 7 creates an instance DB to configure the communications channel (or connection) between the devices (Page 118).
Page 397 103BCommunication 10.2 PROFINET The following example shows the communication between two CPUs that utilize 2 separate connections for sending and receiving the data. ● The TSEND_C instruction in CPU_1 links to the TRCV_V in CPU_2 over the first connection ("connection ID 1" on both CPU_1 and CPU_2). ●...
Page 398 103BCommunication 10.2 PROFINET The following example shows the communication between two CPUs that utilize 1 connection for both sending and receiving the data. ● Each CPU uses a TCON instruction to configure the connection between the two CPUs. ● The TSEND instruction in CPU_1 links to the TRCV instruction in CPU_2 by using the connection ID ("connection ID 1") that was configured by the TCON instruction in CPU_1.
Page 399: Protocols
103BCommunication 10.2 PROFINET As shown in the following example, you can also use individual TSEND and TRCV instruction to communication over a connection created by a TSEND_C or TRCV_C instruction. The TSEND and TRCV instructions do not themselves create a new connection, so must use the DB and connection ID that was created by a TSEND_C, TRCV_C or TCON instruction.
Page 400: Ad Hoc Mode
103BCommunication 10.2 PROFINET Table 10- 1 Protocols and communication instructions for each Protocol Usage examples Entering data in the Communication Addressing type receive area instructions CPU-to-CPU Ad hoc mode Only TRCV_C, and Assigns port numbers to communication TRCV the Local (active) and Partner (passive) Transport of frames Data reception with...
Page 401: Tcp And Iso On Tcp
103BCommunication 10.2 PROFINET 10.2.2.4 TCP and ISO on TCP Transport Control Protocol (TCP) is a standard protocol described by RFC 793: Transmission Control Protocol. The primary purpose of TCP is to provide reliable, secure connection service between pairs of processes. This protocol has the following features: ●...
Page 402 103BCommunication 10.2 PROFINET The minimum size of data that you can transmit (TSEND_C) or receive (TRCV_C) is one byte; the maximum size is 8192 bytes. TSEND_C does not support the transmission of data from boolean locations, and TRCV_C will not receive data into boolean locations. For information transferring data with these instructions, see the section on data consistency (Page 143).
Page 403 103BCommunication 10.2 PROFINET Table 10- 3 TSEND_C and TRCV_C data types for the parameters Parameter and type Data type Description Bool Control parameter REQ starts the send job with the connection described in CONNECT on a rising edge. (TSEND_C) EN_R Bool Control parameter enabled to receive: When EN_R = 1, TRCV_C is ready to receive.
Page 404 103BCommunication 10.2 PROFINET Note The default setting of the LEN parameter (LEN = 0) uses the DATA parameter to determine the length of the data being transmitted. Ensure that the DATA transmitted by the TSEND_C instruction is the same size as the DATA parameter of the TRCV_C instruction. TSEND_C operations The following functions describe the operation of the TSEND_C instruction: ●...
Page 405 103BCommunication 10.2 PROFINET Note Ad hoc mode The "ad hoc mode" exists with the TCP and ISO on TCP protocol variants. You set "ad hoc mode" by assigning "65535" to the LEN parameter. The receive area is identical to the area formed by DATA.
Page 406 103BCommunication 10.2 PROFINET Error and Status Parameters Table 10- 6 TSEND_C and TRCV_C condition codes for ERROR and STATUS ERROR STATUS Description 0000 Job executed without error 7000 No job processing active 7001 Start job processing, establishing connection, waiting for connection partner 7002 Data being sent or received 7003...
Page 407 103BCommunication 10.2 PROFINET ERROR STATUS Description 80B4 When using the ISO on TCP (connection_type = B#16#12) to establish a passive connection, condition code 80B4 alerts you that the TSAP entered did not conform to one of the following address requirements: For a local TSAP length of 2 and a TSAP ID value of either E0 or E1 (hexadecimal) ...
Page 408 103BCommunication 10.2 PROFINET TCON, TDISCON, TSEND, AND TRCV Ethernet communication using TCP and ISO on TCP protocols Note TSEND_C and TRCV_C instructions To help simplify the programming of PROFINET/Ethernet communication, the TSEND_C instruction and the TRCV_C instruction combine the functionality of the TCON, TDISCON. TSEND and TRCV instructions: ...
Page 409 103BCommunication 10.2 PROFINET TCON and TDISCON Note Initializing the communication parameters After you insert the TCON instruction, use the "Properties" of the instruction (Page 118) to configure the communication parameters. As you enter the parameters for the communication partners in the inspector window, STEP 7 enters the corresponding data in the instance DB for the instruction.
Page 410 103BCommunication 10.2 PROFINET Parameter and type Data type Description DONE Bool 0: Job is not yet started or still running.  1: Job completed without error.  BUSY Bool 0: Job is completed.  1: Job is not yet completed. A new job cannot be ...
Page 411 103BCommunication 10.2 PROFINET ERROR STATUS Description 80B4 TCON: When using the ISO on TCP (connection_type = B#16#12) to establish a passive connection, condition code 80B4 alerts you that the TSAP entered did not conform to one of the following address requirements: For a local TSAP length of 2 and a TSAP ID value of either E0 or E1 (hexadecimal) ...
Page 412 103BCommunication 10.2 PROFINET TSEND and TRCV Table 10- 11 TSEND and TRCV instructions LAD / FBD Description TCP and ISO on TCP: TSEND sends data "TSEND_DB"( through a communication connection from the req:=_bool_in_, CPU to a partner station. ID:=_word_in_, len:=_uint_in_, done=>_bool_out_, busy=>_bool_out_, error=>_bool_out_,...
Page 413 103BCommunication 10.2 PROFINET Parameter and type Data type Description DONE Bool TSEND: 0: Job not yet started or still running.  1: Job executed without error.  Bool TRCV: NDR = 0: Job not yet started or still running.  NDR = 1: Job successfully completed.
Page 414 103BCommunication 10.2 PROFINET Table 10- 13 Entering the data into the receive area Protocol Entering the data in the Parameter Value of the LEN parameter Value of the RCVD_LEN variant receive area "connection_type" parameter (bytes) Ad hoc mode B#16#11 65535 1 to 1472 Data reception with B#16#11...
Page 415: Udp
103BCommunication 10.2 PROFINET ERROR STATUS Description 7002 Follow-on instruction execution (REQ irrelevant), job being processed: The  operating system accesses the data in the DATA send area during this processing (TSEND). Follow-on instruction execution, receive job being processed: Data is written to the ...
Page 416 103BCommunication 10.2 PROFINET ● UDP is a simpler transport control protocol than TCP, with a thin layer that yields low overheads ● Can be used very flexibly with many third-party systems ● Routing-capable ● Uses port numbers to direct the datagrams ●...
Page 417 103BCommunication 10.2 PROFINET TCON, TDISCON, TUSEND, and TURCV operate asynchronously, which means that the job processing extends over multiple instruction executions. Table 10- 16 TUSEND and TURCV data types for the parameters Parameter and type Data type Description Bool Starts the send job on a rising edge. The data is transferred from the area specified by DATA and LEN.
Page 418 103BCommunication 10.2 PROFINET Parameter and type Data type Description DATA IN_OUT Variant Address of the sender area (TUSEND) or receive area (TURCV): The process image input table  The process image output table  A memory bit  A data block ...
Page 419 103BCommunication 10.2 PROFINET ERROR STATUS Description 7001 Start of job processing, data being sent (TUSEND): During this processing, the  operating system accesses the data in the DATA send area. Block is ready to receive, receive job was activated (TURCV). ...
Page 420 103BCommunication 10.2 PROFINET Connection Ethernet protocols Every CPU has an integrated PROFINET port, which supports standard PROFINET communications. The TUSEND and TURCV instructions support the UDP Ethernet protocol. Refer to "Configuring the Local/Partner connection path" (Page 118)" in the "Device configuration"...
Page 421: T_Config
103BCommunication 10.2 PROFINET 10.2.2.6 T_CONFIG The T_CONFIG instruction changes the IP configuration parameters of the PROFINET port from the user program, allowing the permanent change or setting of the following features: ● Station name ● IP address ● Subnet mask ●...
Page 422 103BCommunication 10.2 PROFINET Table 10- 22 Data types for the parameters Parameter and type Data type Description Input Bool Starts the instruction on the rising edge. INTERFACE Input HW_Interface ID of network interface CONF_DATA Input Variant Reference to the structure of the configuration data; CONF_DATA is defined by a System Data Type (SDT).
Page 423 103BCommunication 10.2 PROFINET ERROR STATUS Description C0808900 The parameters of the CONF_DATA data block field_type_id are invalid or have been used several times. C0808A00 LEN length of the IP configuration parameters or subfield_cnt errors C0808B00 The IP configuration ID parameter is invalid or unsupported. C0808C00 The Sub-block of the IP configuration is incorrectly placed (Sub-block wrong, wrong order, or used multiple times).
Page 424 103BCommunication 10.2 PROFINET The configuration data of CONF_DB consists of a field that contains a header (IF_CONF_Header) and several subfields. IF_CONF_Header provides the following elements: ● field_type_id (data type UInt): Zero ● field_id (data type UInt): Zero ● subfield_cnt (data type UInt): Number of subfields Each subfield consists of a header (subfield_type_id, subfield_length, subfield_mode) and the subfield-specific parameters.
Page 425 103BCommunication 10.2 PROFINET Name Data type Start value Description Default router DefaultRouter IP_V4 ADDR Array [1..4] of Byte ADDR[1] Byte b#16#C8 Router high byte: 200 ADDR[2] Byte b#16#0C Router high byte: 12 ADDR[3] Byte b#16#01 Router low byte: 1 ADDR[4] Byte b#16#01 Router low byte: 1...
Page 426 103BCommunication 10.2 PROFINET How to change IP parameters In the following example, in the "addr" subfield, the "InterfaceAddress" (IP address), "SubnetMask", and "DefaultRouter" (IP router) are changed. In the CPU "Properties", "Ethernet address" page, the "Set IP address using a different method" radio button must be clicked to enable you to change the IP address using the "T_CONFIG"...
Page 427: Common Parameters For Instructions
103BCommunication 10.2 PROFINET How to change IP parameters and PROFINET IO device names In the following example, both the "addr" and "nos" (Name of station) subfields are changed. In the CPU "Properties", "Ethernet address" page, the "Set PROFINET device name using a different method"...
Page 428 103BCommunication 10.2 PROFINET ID input parameter This is a reference to the "Local ID (hex)" on the "Network view" of "Devices and networks" in STEP 7 and is the ID of the network that you want to use for this communication block. The ID must be identical to the associated parameter ID in the local connection description.
Page 429: Communication With A Programming Device
103BCommunication 10.2 PROFINET Restricted TSAPs and port numbers for passive ISO and TCP communication If you use the "TCON" instruction to set up and establish a passive communications connection, the following port addresses are restricted and should not be used: ●...
Page 430: Configuring The Devices
103BCommunication 10.2 PROFINET Follow the steps below to create the hardware connection between a programming device and a CPU: 1. Install the CPU (Page 44). 2. Plug the Ethernet cable into the PROFINET port shown below. 3. Connect the Ethernet cable to the programming device. ①...
Page 431: Assigning Internet Protocol (Ip) Addresses
103BCommunication 10.2 PROFINET 10.2.3.3 Assigning Internet Protocol (IP) addresses Assigning the IP addresses In a PROFINET network, each device must also have an Internet Protocol (IP) address. This address allows the device to deliver data on a more complex, routed network: ●...
Page 432: Configuring Logical Network Connections Between Two Devices
103BCommunication 10.2 PROFINET ● The HMI configuration information is part of the CPU project and can be configured and downloaded from within the project. ● No Ethernet switch is required for one-to-one communications; an Ethernet switch is required for more than two devices in a network. Note The rack-mounted CSM1277 4-port Ethernet switch can be used to connect your CPUs and HMI devices.
Page 433: Plc-To-Plc Communication
103BCommunication 10.2 PROFINET To create a PROFINET connection, click the green (PROFINET) box on the first device, and drag a line to the PROFINET box on the second device. Release the mouse button and your PROFINET connection is joined. Refer to "Device Configuration: Creating a network connection" (Page 117) for more information.
Page 434: Configuring Logical Network Connections Between Two Devices
103BCommunication 10.2 PROFINET Step Task Configuring transmit (send) and receive parameters You must configure TSEND_C and TRCV_C instructions in both CPUs to enable communications between them. Refer to "Configuring communications between two CPUs: Configuring transmit (send) and receive parameters" (Page 434) for more information. Testing the PROFINET network You must download the configuration for each CPU.
Page 435 103BCommunication 10.2 PROFINET Configuring the TSEND_C instruction transmit (send) parameters TSEND_C instruction The TSEND_C instruction (Page 401) creates a communications connection to a partner station. The connection is set up, established, and automatically monitored until it is commanded to disconnect by the instruction. The TSEND_C instruction combines the functions of the TCON, TDISCON and TSEND instructions.
Page 436 103BCommunication 10.2 PROFINET Configuring General parameters You specify the parameters in the Properties configuration dialog of the TSEND_C instruction. This dialog appears near the bottom of the page whenever you have selected any part of the TSEND_C instruction. Configuring the TRCV_C instruction receive parameters TRCV_C instruction The TRCV_C instruction (Page 401) creates a communications connection to a partner station.
Page 437: Configuring A Cpu And Profinet Io Device
103BCommunication 10.2 PROFINET You can assign tag memory locations to the inputs and outputs, as shown in the following figure: Configuring the General parameters You specify the parameters in the Properties configuration dialog of the TRCV_C instruction. This dialog appears near the bottom of the page whenever you have selected any part of the TRCV_C instruction.
Page 438 103BCommunication 10.2 PROFINET You can now connect the PROFINET IO device to the CPU: 1. Right-click the "Not assigned" link on the device and select "Assign new IO controller" from the context menu to display the "Select IO controller" dialog. 2.
Page 439 103BCommunication 10.2 PROFINET Assigning the IP addresses In a PROFINET network, each device must also have an Internet Protocol (IP) address. This address allows the device to deliver data on a more complex, routed network: ● If you have programming or other network devices that use an on-board adapter card connected to your plant LAN or an Ethernet-to-USB adapter card connected to an isolated network, you must assign IP addresses to them.
Page 440: Diagnostics
103BCommunication 10.2 PROFINET Table 10- 33 Configuring the ET200S PROFINET IO cycle time ET200 S PROFINET IO device ET200S PROFINET IO cycle dialog ① PROFINET port 10.2.7 Diagnostics Diagnostic interrupt organization block (OB82) If a module with diagnostic capability with diagnostic interrupt enabled detects a change in its diagnostic status, it sends a diagnostic interrupt request to the CPU for the following situations: ●...
Page 441: Distributed I/O Instructions
103BCommunication 10.2 PROFINET IO access errors These errors are written to the diagnostics buffer. The CPU does not take any action or switch to STOP. 10.2.8 Distributed I/O Instructions The following Distributed I/O instructions (Page 260) can be used as indicated with PROFINET: ●...
Page 442: Diagnostic Events For Distributed I/O
103BCommunication 10.3 PROFIBUS 10.2.10 Diagnostic events for distributed I/O Note With a PROFINET IO system, after a download or power cycle, the CPU will go to RUN mode unless the hardware compatibility is set to allow acceptable substitute modules (Page 114) and one or more modules is missing or is not an acceptable substitute for the configured module.
Page 443 103BCommunication 10.3 PROFIBUS A PROFIBUS master forms an "active station" on the network. PROFIBUS DP defines two classes of masters. A class 1 master (normally a central programmable controller (PLC) or a PC running special software) handles the normal communication or exchange of data with the slaves assigned to it.
Page 444: Communications Modules Profibus
103BCommunication 10.3 PROFIBUS 10.3.1 Communications modules PROFIBUS 10.3.1.1 Connecting to PROFIBUS Connecting the S7-1200 to PROFIBUS DP The S7-1200 can be connected to a PROFIBUS fieldbus system with the following communications modules: ● CM 1242-5 Operates as DP slave ● CM 1243-5 Operates as DP master class 1 If a CM 1242-5 and a CM 1243-5 are installed together, an S7-1200 can perform the following tasks simultaneously:...
Page 445 ● CM 1242-5 The CM 1242-5 (DP slave) can be the communications partner of the following DP V0/V1 masters: – SIMATIC S7-1200, S7-300, S7-400, S7 Modular Embedded Controller – DP master modules and the distributed IO SIMATIC ET200 – SIMATIC PC stations –...
Page 446: Other Properties Of The Profibus Cms
If you want to configure the module in a third-party system, there is a GSD file available for the CM 1242-5 (DP slave) on the CD that ships with the module and on Siemens Automation Customer Support pages on the Internet.
Page 447: Configuration Examples For Profibus
Further information You will find detailed information on the PROFIBUS CMs in the manuals of the devices. You will find these on the Internet on the pages of Siemens Industrial Automation Customer Support under the following entry IDs: ● CM 1242-5: 49852105 (http://support.automation.siemens.com/WW/view/en/49852105)
Page 448: Configuring A Dp Master And Slave Device
103BCommunication 10.3 PROFIBUS 10.3.2 Configuring a DP master and slave device 10.3.2.1 Adding the CM 1243-5 (DP master) module and a DP slave Use the hardware catalog to add PROFIBUS modules to the CPU. These modules are connected to the left side of the CPU. To insert a module into the hardware configuration, select the module in the hardware catalog and either double-click or drag the module to the highlighted slot.
Page 449: Configuring Logical Network Connections Between Two Profibus Devices
● Address 0: Reserved for network configuration and/or programming tools attached to the ● Address 1: Reserved by Siemens for the first master ● Address 126: Reserved for devices from the factory that do not have a switch setting and must be re-addressed through the network ●...
Page 450 103BCommunication 10.3 PROFIBUS Thus, the addresses that may be used for PROFIBUS operational devices are 2 through 125. In the Properties window, select the "PROFIBUS address" configuration entry. STEP 7 displays the PROFIBUS address configuration dialog, which is used to assign the PROFIBUS address of the device.
Page 451: Distributed I/O Instructions
103BCommunication 10.3 PROFIBUS 10.3.3 Distributed I/O Instructions The following Distributed I/O instructions (Page 260) can be used with PROFIBUS: ● RDREC instruction (Page 260): You can read a data record with the number INDEX from a component. ● WRREC instruction (Page 260): You can transfer a data record with the number INDEX to a DP slave component defined by ID.
Page 452: As-I
103BCommunication 10.4 AS-i Table 10- 39 Handling of diagnostic events for PROFINET and PROFIBUS Type of error Diagnostic information for Entry in the diagnostic CPU operating mode the station? buffer? Diagnostic error Stays in RUN mode Rack or station failure Stays in RUN mode I/O access error Stays in RUN mode...
Page 453: Configuring An As-I Master And Slave Device
103BCommunication 10.4 AS-i 10.4.1 Configuring an AS-i master and slave device 10.4.1.1 Adding the CM 1243-2 AS-i Master module and AS-i slave Use the hardware catalog to add CM1243-2 AS-i Master modules to the CPU. These modules are connected to the left side of the CPU. To insert a module into the hardware configuration, select the module in the hardware catalog and either double-click or drag the module to the highlighted slot.
Page 454: Assigning As-I Addresses To The Cm 1243-2 As-I Master Module And As-I Slave
103BCommunication 10.4 AS-i In the Devices and Networks portal, use the "Network view" to create the network connections between the devices in your project. To create the AS-i connection, select the yellow (AS-i) box on the first device. Drag a line to the AS-i box on the second device. Release the mouse button and your AS-i connection is joined.
Page 455: Exchanging Data Between The User Program And As-I Slaves
103BCommunication 10.4 AS-i Table 10- 43 Parameters for the AS-i address Parameter Description Subnet Name of the Subnet to which the device is connected. Parameters Address Assigned AS-i address for the slave device in range of 1(A or B) to 31(A or B) for a total of up to 62 slave devices Transmission rate Transmission rate of the configured AS-i network is 10 ms.
Page 456 103BCommunication 10.4 AS-i The digital input module (AS-i SM-U, 4DI) in the AS-i network above has been assigned I/O address 2. By clicking on the digital input module, the Properties for this AS-i slave device are shown below. All AS-i slave I/O addresses are shown when viewing the Properties of the CM 1243-2. You can access the data of the AS-i slaves in the user program by using the displayed I/O addresses with the appropriate bit logic operations (for example, "AND") or bit assignments.
Page 457: Configuring Slaves Without Step 7
(Page 457) ("ACTUAL -> EXPECTED") will be overwritten. Further information You will find detailed information on the AS-i CM 1243-2 in the "CM 1243-2 and AS-i data decoupling unit DCM 1271 for SIMATIC S7-1200" Manual. 10.4.2.2 Configuring slaves without STEP 7 If the parameter "System assignment"...
Page 458: Distributed I/O Instructions
"ACTUAL > EXPECTED" of the TIA Portal. Further information You will find detailed information on the AS-i CM 1243-2 in the "CM 1243-2 and AS-i data decoupling unit DCM 1271 for SIMATIC S7-1200" Manual. 10.4.3 Distributed I/O Instructions The following Distributed I/O instructions (Page 260) can be used as indicated with AS-i: ●...
Page 459 103BCommunication 10.4 AS-i There are two AS-i operational modes: ● Protection mode: – You cannot change AS-i slave device and CPU I/O addresses. – The green "CM" LED is OFF. ● Configuration mode: – You can make required changes in your AS-i slave device and CPU I/O addresses. –...
Page 460: S7 Communication
103BCommunication 10.5 S7 communication Configuration error When the yellow "CER" LED is ON, there is an error in the AS-i slave device configuration. Select the "ACTUAL > EXPECTED" button to overwrite the CM 1243-2 AS-i master module slave device configuration with the AS-i field network slave device configuration. 10.5 S7 communication 10.5.1...
Page 461 103BCommunication 10.5 S7 communication Table 10- 44 GET and PUT instructions LAD / FBD Description Use the GET instruction to read data from "GET_DB"( a remote S7 CPU. The remote CPU can req:=_bool_in_, be in either RUN or STOP mode. ID:=_word_in_, STEP 7 automatically creates the DB ndr=>_bool_out_,...
Page 462 103BCommunication 10.5 S7 communication Parameter and type Data type Description ERROR Output Bool ERROR=0  STATUS Output Word STATUS value: – 0000H: neither warning nor error – <> 0000H: Warning, STATUS supplies detailed information ERROR=1  There is an error. STATUS supplies detailed information about the nature of the error.
Page 463 103BCommunication 10.5 S7 communication On the rising edge of the REQ parameter, the read operation (GET) or write operation (PUT) loads the ID, ADDR_1, and RD_1 (GET) or SD_1 (PUT) parameters. ● For GET: The remote CPU returns the requested data to the receive areas (RD_x), starting with the next scan.
Page 464: Creating An S7 Connection
103BCommunication 10.5 S7 communication ERROR STATUS Description (decimal) Exceeded the maximum number of parallel jobs/instances  The instances were overloaded at CPU-RUN  This status is possible for first execution of the GET or PUT instruction There is no corresponding GET or PUT instruction in the CPU. 10.5.2 Creating an S7 connection The connection type that you select creates a communication connection to a partner...
Page 465: Get/Put Connection Parameter Assignment
103BCommunication 10.5 S7 communication 10.5.4 GET/PUT connection parameter assignment The GET/PUT instructions connection parameter assignment is a user aid for configuring CPU-to-CPU S7 communication connections. After inserting a GET or PUT block, the GET/PUT instructions connection parameter assignment is started: The inspector window displays the properties of the connection whenever you have selected any part of the instruction.
Page 466 103BCommunication 10.5 S7 communication Table 10- 47 Connection parameter: General definitions Parameter Definition Connection End point "Local End point": Name assigned to the Local CPU parameter: "Partner End point": Name assigned to the Partner (remote) CPU General Note: In the "Partner End point" dropdown list, the system displays all potential S7 connection partners of the current project as well as the option "unspecified".
Page 467 103BCommunication 10.5 S7 communication Connection ID parameter There are three ways to change the system-defined connection IDs: 1. The user can change the current ID directly on the GET/PUT block. If the new ID belongs to an already existing connection, the connection is changed. 2.
Page 468: Configuring A Cpu-To-Cpu S7 Connection
103BCommunication 10.5 S7 communication 10.5.4.2 Configuring a CPU-to-CPU S7 connection Given the configuration of PLC_1, PLC_2, and PLC_3 as shown in the figure below, insert GET or PUT blocks for "PLC_1". For the GET or PUT instruction, the "Properties" tab is automatically displayed in the inspector window with the following menu selections: ●...
Page 469 103BCommunication 10.5 S7 communication Configuring a PROFINET S7 connection For the "Partner End point", select "PLC_3". The system reacts with the following changes: Table 10- 48 Connection parameter: General values Parameter Definition Connection End point "Local End point" contains "PLC_1" as read-only. parameter: "Partner End point"...
Page 470 103BCommunication 10.5 S7 communication Parameter Definition Connection name "Connection name" contains the default connection name (for example, "S7_Connection_1"); control is enabled. Active connection Checked and enabled to select the Local CPU as the active connection. establishment One-way Read-only and unchecked. Note: "PLC_1"...
Page 471 103BCommunication 10.5 S7 communication Configuring a PROFIBUS S7 connection For the "Partner End point", select "PLC_3". The system reacts with the following changes: Table 10- 49 Connection parameter: General values Parameter Definition Connection End point "Local End point" contains "PLC_1" as read-only. parameter: "Partner End point"...
Page 472 103BCommunication 10.5 S7 communication Parameter Definition Connection name "Connection name" contains the default connection name (for example, "S7_Connection_1"); control is enabled. Active connection Read-only, checked, and enabled to select the Local CPU as the active establishment connection. One-way Read-only and checked. Note: "PLC_3"...
Page 473: Web Server
Web server The Web server for the S7-1200 provides Web page access to data about your CPU and process data within the CPU. Standard Web pages The S7-1200 includes standard Web pages that you can access from your PC from a Web browser (Page 474): ●...
Page 474: Enabling The Web Server
104BWeb server 11.1 Enabling the Web server 11.1 Enabling the Web server You enable the Web server in STEP 7 from Device Configuration for the CPU to which you intend to connect. To enable the Web server, follow these steps: 1.
Page 475 "Yes" to proceed to the standard Web pages. To avoid the security warning with each secure access, you can import the Siemens software certificate to your Web browser (Page 490). S7-1200 Programmable controller...
Page 476: Layout Of The Standard Web
104BWeb server 11.2 Standard web pages 11.2.2 Layout of the standard Web pages Each of the standard Web pages has a common layout with navigational links and page controls as shown below: ① Web server header ② Log in or log out ③...
Page 477 You are now logged in as the "admin" user. If you encounter any errors logging in, return to the Introduction page (Page 478) and download the Siemens security certificate (Page 490). You can then log in with no errors. Logging out To log out the "admin"...
Page 478: Introduction
From this page, you click "Enter" to access the S7-1200 standard Web pages. At the top of the screen are links to useful Siemens Web sites, as well as a link to download the Siemens security certificate (Page 490).
Page 479: Start
104BWeb server 11.2 Standard web pages 11.2.4 Start The Start page displays a representation of the CPU to which you are connected and lists general information about the CPU. If you log in as the "admin" user, you can also change the operating mode of the CPU and flash the LEDs.
Page 480: Identification
104BWeb server 11.2 Standard web pages 11.2.5 Identification The Identification page displays identifying characteristics of the CPU: ● Serial number ● Order numbers ● Version information The Identification page does not vary with the "admin" login. 11.2.6 Diagnostic Buffer The diagnostic buffer page displays diagnostic events. From the selector, you can choose what range of diagnostic buffer entries to display, either 1 to 25 or 26 to 50.
Page 481: Module Information
104BWeb server 11.2 Standard web pages The Diagnostic buffer page does not vary with the "admin" login. 11.2.7 Module Information The module information page provides information about all the modules in the local rack. The top section of the screen shows a summary of the modules, and the bottom section shows status and identification of the selected module.
Page 482 104BWeb server 11.2 Standard web pages Identification display Drilling down You can select a link in the top section to drill down to the module information for that particular module. Modules with submodules have links for each submodule. The type of information that is displayed varies with the module selected.
Page 483: Communication
104BWeb server 11.2 Standard web pages Filtering the module information You can filter any field in the module information list. From the drop-down list, select the field name for which you want to filter the data. Enter text in the associated text box and click the Filter link.
Page 484: Variable Status
104BWeb server 11.2 Standard web pages Communication: Statistics display The communication page does not vary with the "admin" login. 11.2.9 Variable Status The Variable Status page allows you to view any of the I/O or memory data in your CPU. You can enter a direct address (such as I0.0), a PLC tag name, or a tag from a specific data block.
Page 485 104BWeb server 11.2 Standard web pages ① The "Modify Value" functionality is only visible and accessible when you are logged in as the "admin" user. If you leave the Variable Status page and return, the Variable Status page does not retain your entries.
Page 486: Data Logs
104BWeb server 11.2 Standard web pages Limitations on the Variable Status page: ● The maximum number of variable entries per page is 50. ● The maximum number of characters for the URL corresponding to the Variable Status page is 2083. You can see the URL that represents your current variable page in the address bar of your browser.
Page 487 104BWeb server 11.2 Standard web pages ① The "Download & Clear" option is not available if you are not logged in as the "admin" user. ② The "Delete" option is not available if you are not logged in as the "admin" user. Note The data log file is in USA/UK comma-separated values format (CSV).
Page 488: Constraints
104BWeb server 11.2 Standard web pages Downloading and clearing a log file To download a log file and then clear all the data records, you must be logged in as the "admin" user. Then click the "Download & Clear" icon corresponding to a specific log file. You will be prompted by Microsoft Windows to open or save the log file.
Page 489: Features Restricted When Javascript Is Disabled
"ww.xx.yy.zz" represents the IP address of the CPU. ● Siemens provides a security certificate for secure access to the Web server. From the Introduction standard Web page (Page 478), you can download and import the certificate into the Internet options of your Web browser (Page 490).
Page 490: Features Restricted When Cookies Are Not Allowed
11.2.11.3 Importing the Siemens security certificate You can import the Siemens security certificate into your Internet options so that you won't be prompted for security verification when you enter https://ww.xx.yy.zz in your Web browser, where "ww.xx.yy.zz" is the IP address of the CPU. If you use an http:// URL and not an https:// URL, then you do not need to download and install the certificate.
Page 491: Importing Csv Format Data Logs To Non-Usa/Uk Versions Of Microsoft Excel
Other browsers Follow the conventions of your Web browser to import and install the Siemens certificate. After you have installed the Siemens security certificate "SIMATIC CONTROLLER" in the Internet options for your Web browser content, you will not be required to verify a security prompt when you access the Web server with https:// ww.xx.yy.zz.
Page 492: User-Defined Web
● Creating HTML pages with an HTML editor, such as Microsoft Frontpage (Page 493) ● Including AWP commands in HTML comments in the HTML code (Page 494):The AWP commands are a fixed set of commands that Siemens provides for accessing CPU information.
Page 493: Creating Html
104BWeb server 11.3 User-defined web pages This process is illustrated below: ① HTML files with embedded AWP commands 11.3.1 Creating HTML pages You can use the software package of your choice to create your own HTML pages for use with the Web server. Be sure that your HTML code is compliant to the HTML standards of the W3C (World Wide Web Consortium).
Page 494: Awp Commands Supported By The S7-1200 Web Server
104BWeb server 11.3 User-defined web pages Refreshing user-defined Web pages User-defined Web pages do not automatically refresh. It is your choice whether to program the HTML to refresh the page or not. For pages that display PLC data, refreshing periodically keeps the data current.
Page 495: Reading Variables
104BWeb server 11.3 User-defined web pages AWP command summary The details for using each AWP command are in the topics to follow, but here is a brief summary of the commands: Reading variables :=<Varname>: Writing variables  This AWP command merely declares the variable in the Name clause to be writable.
Page 496: Writing Variables
104BWeb server 11.3 User-defined web pages Examples :="Conveyor_speed"::="My_Data_Block".flag1: :=I0.0: :=MW100: Example reading an aliased variable  :=flag1: Note Defining alias names for PLC tags and data block tags is described in the topic Using an alias for a variable reference (Page 500). If a tag name or data block name includes special characters, you must use additional quotation marks or escape characters as described in the topic Handling tag names that contain special characters (Page 505).
Page 497: Reading Special Variables
104BWeb server 11.3 User-defined web pages For both Name clauses and Use clauses, the complete name must be enclosed in single quotation marks. Within the single quotes, use double quotation marks around a PLC tag and double quotation marks around a data block name. The data block name is within the double quotes but not the data block tag name.
Page 498 104BWeb server 11.3 User-defined web pages Syntax  Parameters <Type> The type of special variable and is one of the following: HEADER COOKIE_VALUE COOKIE_EXPIRES <Name> Refer to HTTP documentation for a list of all the names of HEADER variables. A few examples are listed below: Status: response code Location: path for redirection...
Page 499: Writing Special Variables
104BWeb server 11.3 User-defined web pages 11.3.2.4 Writing special variables The Web server provides the ability to write values to the CPU from special variables in the HTTP request header. For example, you can store information in STEP 7 about the cookie associated with a user-defined Web page, the user that is accessing a page, or header information.
Page 500: Using An Alias For A Variable Reference
104BWeb server 11.3 User-defined web pages Note Only an admin user can write data to the CPU. The commands are ignored if the user has not logged in as the admin user. If a tag name or data block name includes special characters, you must use additional quotation marks or escape characters as described in the topic "Handling tag names that contain special characters (Page 505)".
Page 501: Defining Enum Types
104BWeb server 11.3 User-defined web pages If a tag name or data block name includes special characters, you must use additional quotation marks or escape characters as described in the topic Handling tag names that contain special characters (Page 505). 11.3.2.6 Defining enum types You can define enum types in your user-defined pages and assign the elements in an AWP...
Page 502 104BWeb server 11.3 User-defined web pages Parameters <Varname> Name of PLC tag or data block tag to associate with the enum type, or the name of the alias name for a PLC tag (Page 500) if declared. Varname must be enclosed in single quotation marks. Within the single quotes, use double quotation marks around a PLC tag or data block name.
Page 503: Creating Fragments
104BWeb server 11.3 User-defined web pages <form method="POST"> <p><input type="hidden" name='"Alarm"' value="Tank is full" /></p> <p><input type="submit" value='Set Tank is full' /><p> </form> Because the enum type defintion (Page 501) assigns "Tank is full" to the numerical value 1, the value 1 is written to the alias "Alarm" which corresponds to the PLC tag named "Motor1.Alarm"...
Page 504: Importing Fragments
104BWeb server 11.3 User-defined web pages Manual fragments If you create a manual fragment for a user-defined Web page or portion of a page, then your STEP 7 program must control when the fragment is sent. The STEP 7 program must set appropriate parameters in the control DB for a user-defined page under manual control and then call the WWW instruction with the control DB as modified.
Page 505: Handling Tag Names That Contain Special Characters
104BWeb server 11.3 User-defined web pages Examples  <--! AWP_Out_Variable Name='HEADER:Status', Use='"Status"', Name='HEADER:Location', Use="Location", Name='COOKIE_VALUE:name', Use="my_cookie" -->  11.3.2.11 Handling tag names that contain special characters When specifying variable names in user-defined Web pages, you must take special care if tag names contain characters that have special meanings.
Page 506 104BWeb server 11.3 User-defined web pages Data block name Tag name Read command Data_block_1 ABC:DEF  :=special_tag: DB A' B C D$ E :="DB A' B C D$ E".Tag: DB:DB Tag:Tag  :=my_tag: Name and Use clauses The AWP commands AWP_In_Variable, AWP_Out_Variable, AWP_Enum_Def, AWP_Enum_Ref, AWP_Start_Fragment and AWP_Import_Fragment have Name clauses.
Page 507: Configuring Use Of User-Defined Web Pages
104BWeb server 11.3 User-defined web pages 11.3.3 Configuring use of user-defined Web pages To configure user-defined Web pages from STEP 7, follow these steps: 1. Select the CPU in the Device Configuration view. 2. Display the "Web server" properties in the inspector window for the CPU. 3.
Page 508: Programming The Www Instruction For User-Defined Web Pages
104BWeb server 11.3 User-defined web pages Generating program blocks When you click the "Generate blocks" button, STEP 7 generates data blocks from the HTML pages in the HTML source directory that you specified and a control data block for the operation of your Web pages.
Page 509: Downloading The Program Blocks To The Cpu
104BWeb server 11.3 User-defined web pages You must provide the control data block input parameter (CTRL_DB) which corresponds to the integer DB number of the control DB. You can find this control DB block number (called Web DB Number) in the Web Server properties of the CPU after you create the blocks for the user-defined Web pages.
Page 510: Accessing The User-Defined Web Pages From The Pc
104BWeb server 11.3 User-defined web pages 11.3.6 Accessing the user-defined web pages from the PC You access your user-defined Web pages from the standard Web pages (Page 474). The standard Web pages display a link for "User Pages" on the left side menu where the links to the other pages appear.
Page 511: Example Of A User-Defined Web Page
104BWeb server 11.3 User-defined web pages You can check the amount of load memory space that is used and the amount that is available from the Online and Diagnostic tools in STEP 7. You can also look at the properties for the individual blocks that STEP 7 generates from your user-defined Web pages and see the load memory consumption.
Page 512 104BWeb server 11.3 User-defined web pages Description In this application, each wind turbine in a wind turbine farm is equipped with an S7-1200 for control of the turbine. Within the STEP 7 program, each wind turbine has a data block with data specific to that wind turbine and location.
Page 513: Reading And Displaying Controller Data
104BWeb server 11.3 User-defined web pages The following sections allow for manual control of the turbine, overriding the normal automatic control by the S7-1200. These types are as follows:  Manual override: enables manual override of the turbine. The STEP 7 user program requires that the manual override setting be true before enabling the use of any of the manual settings for turbine speed, or yaw or...
Page 514: Using An Enum Type
104BWeb server 11.3 User-defined web pages <tr style="height:2%;"> <td> <p>Power output:</p> </td> <td> <p style="margin-bottom:5px;"> :="Data_block_1".PowerOutput: KW</p> </td> </tr> 11.3.8.3 Using an enum type %The "Remote Wind Turbine Monitor" HTML page uses enum types for the three instances where HTML page displays "ON" or "OFF" for a Boolean value, and for where the user sets a Boolean value.
Page 515: Writing User Input To The Controller
104BWeb server 11.3 User-defined web pages <select name='"Data_block_1".ManualOverrideEnable'> <option value=':"Data_block_1".ManualOverrideEnable:'> </option> <option value="On">Yes</option> <option selected value="Off">No</option> </select> The select list is included within a form on the HTML page. When the user clicks the submit button, the page posts the form, which writes a value of "1" to the Boolean ManualOverrideEnable in Data_block_1 if the user had selected "Yes", or "0"...
Page 516: Writing A Special Variable
104BWeb server 11.3 User-defined web pages Note Note that if a user-defined page has a data entry field for a writable data block tag that is a string data type, the user must enclose the string in single quotation marks when entering the string value in the field.
Page 517 104BWeb server 11.3 User-defined web pages Location: String TurbineNumber: Int WindSpeed: Real WindDirection: Real Temperature: Real PowerOutput: Real ManualOverrideEnable: Bool TurbineSpeed: Real YawOverride: Bool Yaw: Real PitchOverride: Bool Pitch: Real Braking: Real The user-defined Web page displays current values for the PLC data, and provides a select list to set the three booleans using an enumerated type assignment.
Page 518 104BWeb server 11.3 User-defined web pages <tr style="height: 2%;"><td style="width: 24%;"><p>Wind speed:</p></td> <td><p> :="Data_block_1".WindSpeed: km/h</p></td> </tr> <tr style="height: 2%;"> <td style="width: 24%;"><p>Wind direction:</p></td> <td><p> :="Data_block_1".WindDirection: deg.</p></td> </tr> <tr style="height: 2%;"><td style="width: 24%;"><p>Temperature:</p></td> <td><p> :="Data_block_1".Temperature: deg. C</p></td> </tr> <tr style="height: 2%;"> <td style="width: 24%;"><p>Power output:</p></td>...
Page 519 104BWeb server 11.3 User-defined web pages <option value=':="Data_block_1".YawOverride:'> </option> <option value="On">Yes</option> <option value="Off">No</option> </select> </td> </tr> <tr style="vertical-align: top; height: 2%;"> <td style="width: 24%;"> <p>Turbine yaw:</p> </td> <td> <p style="margin-bottom:5px;"><input name='"Data_block_1".Yaw' size="10" value=':="Data_block_1".Yaw:' type="text"> deg.</p> </td> </tr> <tr style="vertical-align: top; height: 2%;"> <td style="width: 24%;">...
Page 520: Configuration In Step 7 Of The Example Web Page
104BWeb server 11.3 User-defined web pages <p> <input name='"Data_block_1".Braking' size="10" value=':="Data_block_1".Braking:' type="text"> %</p> </form> </td> </tr> <tr><td></td></tr> </table> </body> </html> Wind_turbine.css H2 { font-family: Arial; font-weight: bold; font-size: 14.0pt; color: #FFFFFF; margin-top:0px; margin-bottom:10px; font-family: Arial; font-weight: bold; color: #FFFFFF; font-size: 12.0pt; margin-top:0px;...
Page 521 104BWeb server 11.3 User-defined web pages Access the CPU Properties for the S7-1200 that controls the wind turbine, and enter the configuration information in the User-defined web pages properties of the Web Server: Configuration fields ● HTML directory: This field specifies the fully-qualified pathname to the folder where the default page (home page or start page) is located on the computer.
Page 522: Setting Up User-Defined Web Pages In Multiple Languages
104BWeb server 11.3 User-defined web pages Final steps To use the Remote Wind Turbine Monitor as configured, generate the blocks, program the WWW instruction (Page 508) with the number of the generated control DB as an input parameter, download the program blocks, and put the CPU in run mode. When an operator subsequently accesses the standard Web pages for the S7-1200 that controls the wind turbine, the "Remote Wind Turbine Monitor"...
Page 523: Programming The Language Switch
104BWeb server 11.3 User-defined web pages 11.3.9.2 Programming the language switch The Web server performs switching between languages through the use of a cookie named "siemens_automation_language". This is a cookie defined and set in the HTML pages, and interpreted by the Web server to display a page in the appropriate language from the language folder of the same name.
Page 524 104BWeb server 11.3 User-defined web pages HTML for "langswitch.html" in "de" folder The header for the German langswitch.html page is the same as English, except the language is set to German. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="Content-Language"...
Page 525: Configuring Step 7 To Use A Multi-Language Page Structure
104BWeb server 11.3 User-defined web pages function DoLocalLanguageChange(oSelect) { SetLangCookie(oSelect.value); top.window.location.reload(); function SetLangCookie(value) { var strval = "siemens_automation_language="; // This is the cookie by which the Web server // detects the desired language // This name is required by the Web server. strval = strval + value;...
Page 526: Advanced User-Defined Web
104BWeb server 11.3 User-defined web pages 11.3.10 Advanced user-defined Web page control When you generate data blocks for your user-defined Web pages, STEP 7 creates a control DB that it uses to control display of and interaction with the user-defined pages. STEP 7 also creates a set of fragment DBs that represent the individual pages.
Page 527 104BWeb server 11.3 User-defined web pages Block tag Data type Description requesttab ARRAY [ 1 .. 4 ] OF STRUCT Array of structures for individual fragment DB control. The Web server can process up to four fragments at a time. The array index for a particular fragment is arbitrary when the Web server is processing multiple fragments or fragments from multiple...
Page 528 104BWeb server 11.3 User-defined web pages Possible techniques for using the fragment_index include: ● Processing the current fragment: Leave fragment_index unchanged and set the continue command. ● Skip the current fragment: Set fragment_index to 0 and set the continue command. ●...
Page 529: Communication Processor
Communication processor 12.1 Using the RS232 and RS485 communication interfaces Three communication modules (CMs) and one communication board (CB) provide the interface for PtP communications: ● CM 1241 RS232 (Page 755) ● CM 1241 RS485 (Page 754) ● CM 1241 RS422/485 (Page 756) ●...
Page 530: Biasing And Terminating An Rs485 Network Connector
12.2 Biasing and terminating an RS485 network connector Siemens provides an RS485 network connector (Page 766) that you can use to easily connect multiple devices to an RS485 network. The connector has two sets of terminals that allow you to attach the incoming and outgoing network cables. The connector also includes switches for selectively biasing and terminating the network.
Page 531: Point-To-Point (Ptp) Communication
105BCommunication processor 12.3 Point-to-Point (PtP) communication Table 12- 2 Termination and bias for the CB 1241 Terminating device (bias ON) Non-terminating device (bias OFF) ① Connect M to the cable shield ② A = TxD/RxD - (Green wire / Pin 8) ③...
Page 532: Point-To-Point Instructions
105BCommunication processor 12.3 Point-to-Point (PtP) communication 12.3.1 Point-to-Point instructions 12.3.1.1 Common parameters for Point-to-Point instructions Table 12- 3 Common input parameters for the PTP instructions Parameter Description Many of the PtP instructions use the REQ input to initiate the operation on a low to high transition.
Page 533 105BCommunication processor 12.3 Point-to-Point (PtP) communication Note The DONE, NDR, and ERROR parameters are set for one execution only. Your program logic must save temporary output state values in data latches, so you can detect state changes in subsequent program scans. Table 12- 5 Common condition codes STATUS (W#16#..)
Page 534: Port_Cfg Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication 12.3.1.2 PORT_CFG instruction Table 12- 7 PORT_CFG (Port Configuration) instruction LAD / FBD Description PORT_CFG allows you to change port parameters "PORT_CFG_DB"( such as baud rate from your program. REQ:=_bool_in_, PORT:=_uint_in_, You can set up the initial static configuration of the port in the device configuration properties, or just use PROTOCOL:=_uint_in_, the default values.
Page 535: Send_Cfg Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication Parameter and type Data type Description FLOWCTRL UInt Flow control (Default value: 0): 1 = No flow control, 2 = XON/XOFF, 3 = Hardware RTS always ON, 4 = Hardware RTS switched XONCHAR Char Specifies the character that is used as the XON character.
Page 536 105BCommunication processor 12.3 Point-to-Point (PtP) communication You can set up the initial static configuration of the port in the device configuration properties, or just use the default values. You can execute the SEND_CFG instruction in your program to change the configuration. The SEND_CFG configuration changes are not permanently stored in the CPU.
Page 537: Rcv_Cfg Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication 12.3.1.4 RCV_CFG instruction Table 12- 13 RCV_CFG (Receive Configuration) instruction LAD / FBD Description RCV_CFG performs dynamic configuration of "RCV_CFG_DB"( serial receiver parameters for a PtP REQ:=_bool_in_, communication port. This instruction configures the PORT:=_uint_in_, conditions that signal the start and end of a CONDITIONS:=_struct_in_, received message.
Page 538 105BCommunication processor 12.3 Point-to-Point (PtP) communication See the topic "Configuring receive parameters (Page 553)" for a description of the message start conditions. Parameter CONDITIONS data type structure part 1 (start conditions) Table 12- 15 CONDITIONS structure for start conditions Parameter and type Data type Description STARTCOND...
Page 539 105BCommunication processor 12.3 Point-to-Point (PtP) communication Example Consider the following received hexadecimal coded message: "68 10 aa 68 bb 10 aa 16" and the configured start sequences shown in the table below. Start sequences begin to be evaluated when the first 68H character is successfully received. Upon successfully receiving the fourth character (the second 68H), then start condition 1 is satisfied.
Page 540 105BCommunication processor 12.3 Point-to-Point (PtP) communication Parameter CONDITIONS data type structure part 2 (end conditions) Table 12- 17 CONDITIONS structure for end conditions Parameter Parameter type Data type Description ENDCOND UInt This parameter specifies message end condition: 01H - Response time ...
Page 541: Send_Ptp Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication Parameter Parameter type Data type Description ENDSEQ1CTL Byte Sequence 1 ignore/compare control for each character: B#16#0 These are the enabling bits for each character for the end sequence. Character 1 is bit 0, character 2 is bit 1, …, character 5 is bit 4.
Page 542 When transmitting a complex structure, always use a length of 0. PTRCL Bool This parameter selects the buffer as normal point-to-point or specific Siemens- provided protocols that are implemented within the attached CM or CB. (Default value: False) FALSE = user program controlled point-to-point operations. (only valid option)
Page 543 105BCommunication processor 12.3 Point-to-Point (PtP) communication The following diagram shows the relationship of DONE, ERROR and STATUS parameters when there is an error. The DONE, ERROR and STATUS values are only valid until SEND_PTP executes again with the same instance DB. Table 12- 21 Condition codes STATUS (W#16#..) Description...
Page 544: Rcv_Ptp Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication You can always set the LENGTH parameter to 0 and ensure that SEND_PTP sends the entire data structure represented by the BUFFER parameter. If you only want to send part of a data structure in the BUFFER parameter, you can set LENGTH as follows: Table 12- 22 LENGTH and BUFFER parameters LENGTH BUFFER...
Page 545 105BCommunication processor 12.3 Point-to-Point (PtP) communication Table 12- 24 Data types for the parameters Parameter and type Data type Description EN_R Bool When this input is TRUE and a message is available, the message is transferred from the CM or CB to the BUFFER. When EN_R is FALSE, the CM or CB is checked for messages and NDR, ERROR and STATUS output are updated, but the message is not transferred to the BUFFER.
Page 546: Rcv_Rst Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication STATUS (W#16#...) Description 0099 Message terminated because of end sequence was satisfied 833A The DB for the BUFFER parameter does not exist. 12.3.1.7 RCV_RST instruction Table 12- 26 RCV_RST (Receiver Reset) instruction LAD / FBD Description RCV_RST clears the receive buffers in the CM or CB.
Page 547: Sgn_Get Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication 12.3.1.8 SGN_GET instruction Table 12- 28 SGN_GET (Get RS232 signals) instruction LAD / FBD Description SGN_GET reads the current states of RS232 "SGN_GET_DB"( communication signals. REQ:=_bool_in_, PORT:=_uint_in_, This function is valid only for the RS232 CM. NDR=>_bool_out_, ERROR=>_bool_out_, STATUS=>_word_out_,...
Page 548: Sgn_Set Instruction
105BCommunication processor 12.3 Point-to-Point (PtP) communication 12.3.1.9 SGN_SET instruction Table 12- 31 SGN_SET (Set RS232 signals) instruction LAD / FBD Description SGN_SET sets the states of RS232 communication "SGN_SET_DB"( signals. REQ:=_bool_in_, PORT:=_uint_in_, This function is valid only for the RS232 CM. SIGNAL:=_byte_in_, RTS:=_bool_in_, DTR:=_bool_in_,...
Page 549: Configuring The Communication Ports
105BCommunication processor 12.3 Point-to-Point (PtP) communication Table 12- 33 Condition codes STATUS (W#16#..) Description 80F0 CM or CB is RS485 and no signals can be set 80F1 Signals cannot be set because of Hardware flow control 80F2 Cannot set DSR because module is DTE 80F3 Cannot set DTR because module is DCE 12.3.2...
Page 550: Managing Flow Control
105BCommunication processor 12.3 Point-to-Point (PtP) communication The STEP 7 user program can also configure the port or change the existing configuration with the PORT_CFG instruction (Page 534). Note Parameter values set from the PORT_CFG instruction in the user program override port configuration settings set from the device configuration.
Page 551 105BCommunication processor 12.3 Point-to-Point (PtP) communication Hardware flow control: RTS switched If you enable RTS switched hardware flow control for an RS232 CM, the module sets the RTS signal active to send data. It monitors the CTS signal to determine whether the receiving device can accept data.
Page 552: Configuring The Transmit (Send) And Receive Parameters
105BCommunication processor 12.3 Point-to-Point (PtP) communication Software flow control requires full-duplex communication, as the receiving partner must be able to send XOFF to the transmitting partner while a transmission is in progress. Software flow control is only possible with messages that contain only ASCII characters. Binary protocols cannot utilize sofware flow control.
Page 553: Configuring Receive Parameters
105BCommunication processor 12.3 Point-to-Point (PtP) communication Parameter Definition Send break at message start Specifies that upon the start of each message, a break will be sent after the RTS On delay (if configured) has expired and CTS is active. Number of bit times in a break You specify how many bit times constitute a break where the line is held in a spacing condition.
Page 554 105BCommunication processor 12.3 Point-to-Point (PtP) communication Parameter Definition Start on Any Character The Any Character condition specifies that any successfully received character indicates the start of a message. This character is the first character within a message. Line Break The Line Break conditions specifies that a message receive operation starts after a break character is received.
Page 555 105BCommunication processor 12.3 Point-to-Point (PtP) communication Sample configuration - start message on one of two character sequences Consider the following start message condition configuration: S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 556 105BCommunication processor 12.3 Point-to-Point (PtP) communication With this configuration, the start condition is satisfied when either pattern occurs: ● When a five-character sequence is received where the first character is 0x6A and the fifth character is 0x1C. The characters at positions 2, 3, and 4 can be any character with this configuration.
Page 557 105BCommunication processor 12.3 Point-to-Point (PtP) communication Parameter Definition Recognize message end by The message end occurs when the configured amount of time to wait for the message end message timeout has expired. The message timeout period begins when a start condition has been satisfied. The default is 200 ms and the range is 0 to 65535 ms.
Page 558 105BCommunication processor 12.3 Point-to-Point (PtP) communication Parameter Definition Recognize message end by The message end occurs when the maximum configured timeout between any two inter-character gap consecutive characters of a message has expired. The default value for the inter-character gap is 12 bit times and the maximum number is 65535 bit times, up to a maximum of eight seconds.
Page 559 105BCommunication processor 12.3 Point-to-Point (PtP) communication Sample configuration - end message with a character sequence Consider the following end message condition configuration: In this case, the end condition is satisfied when two consecutive 0x7A characters are received, followed by any two characters. The character preceding the 0x7A 0x7A pattern is not part of the end character sequence.
Page 560: Programming The Ptp Communications
105BCommunication processor 12.3 Point-to-Point (PtP) communication Example 1: Consider a message structured according to the following protocol: Characters 3 to 14 counted by the length INDEX 0x0C xxxx xxxx xxxx xxxx xxxx Configure the receive message length parameters for this message as follows: ●...
Page 561: Polling Architecture
105BCommunication processor 12.3 Point-to-Point (PtP) communication Configuration instructions Before your user program can engage in PtP communication, you must configure the communication interface port and the parameters for sending data and receiving data. You can perform the port configuration and message configuration for each CM or CB through the device configuration or through these instructions in your user program: ●...
Page 562: Example: Point-To-Point Communication
105BCommunication processor 12.3 Point-to-Point (PtP) communication 3. When the SEND_PTP instruction indicates that the transmission is complete, the user code can prepare to receive the response. 4. The RCV_PTP instruction is executed repeatedly to check for a response. When the CM or CB has collected a response message, the RCV_PTP instruction copies the response to the CPU and indicates that new data has been received.
Page 563: Configuring The Communication Module
105BCommunication processor 12.3 Point-to-Point (PtP) communication You must connect the communication interface of the CM 1241 RS232 module to the RS232 interface of the PC, which is normally COM1. Because both of these ports are Data Terminal Equipment (DTE), you must switch the receive and transmit pins (2 and 3) when connecting the two ports, which you can accomplish by either of the following methods: ●...
Page 564 105BCommunication processor 12.3 Point-to-Point (PtP) communication ● Receive message start configuration: Configure the CM 1241 to start receiving a message when the communication line is inactive for at least 50 bit times (about 5 milliseconds at 9600 baud = 50 * 1/9600): ●...
Page 565: Programming The Step 7 Program
105BCommunication processor 12.3 Point-to-Point (PtP) communication 12.3.5.2 Programming the STEP 7 program The example program uses a global data block for the communication buffer, a RCV_PTP instruction (Page 544) to receive data from the terminal emulator, and a SEND_PTP instruction (Page 541) to echo the buffer back to the terminal emulator. To program the example, add the data block configuration and program OB1 as described below.
Page 566: Configuring The Terminal Emulator
105BCommunication processor 12.3 Point-to-Point (PtP) communication Network 3: Enable the SEND_PTP instruction when the M20.0 flag is set. Also use this flag to set the REQ input to TRUE for one scan. The REQ input tells the SEND_PTP instruction that a new request is to be transmitted. The REQ input must only be set to TRUE for one execution of SEND_PTP.
Page 567: Running The Example Program
105BCommunication processor 12.4 Universal serial interface (USS) communication 12.3.5.4 Running the example program To exercise the example program, follow these steps: 1. Download the STEP 7 program to the CPU and ensure that it is in RUN mode. 2. Click the "connect" button on the terminal emulator to apply the configuration changes and open a terminal session to the CM 1241.
Page 568: Requirements For Using The Uss Protocol
105BCommunication processor 12.4 Universal serial interface (USS) communication 12.4.1 Requirements for using the USS protocol The four USS instructions use 1 FB and 3 FCs to support the USS protocol. One USS_PORT instance data block (DB) is used for each USS network. The USS_PORT instance data block contains temporary storage and buffers for all drives on that USS network.
Page 569 105BCommunication processor 12.4 Universal serial interface (USS) communication The USS_PORT function handles the actual communication between the CPU and the drives via the Point-to-Point (PtP) RS485 communication port. Each call to this function handles one communication with one drive. Your program must call this function fast enough to prevent a communication timeout by the drives.
Page 570: Uss_Drv Instruction
105BCommunication processor 12.4 Universal serial interface (USS) communication Baud rate Calculated minimum USS_PORT call Drive message interval timeout per Interval ( milliseconds ) drive ( milliseconds ) 4800 212.5 9600 116.3 19200 68.2 38400 44.1 57600 36.1 115200 28.1 12.4.2 USS_DRV instruction Table 12- 35 USS_DRV instruction LAD / FBD...
Page 571 105BCommunication processor 12.4 Universal serial interface (USS) communication Table 12- 36 Data types for the parameters Parameter and type Data type Description Bool Drive start bit: When true, this input enables the drive to run at the preset speed. When RUN goes to false while a drive is running, the motor will be ramped down to a stop.
Page 572 105BCommunication processor 12.4 Universal serial interface (USS) communication Parameter and type Data type Description SPEED Real Drive Current Speed (scaled value of drive status word 2): The value of the speed of the drive as a percentage of configured speed. STATUS1 Word Drive Status Word 1: This value contains fixed status bits of a drive.
Page 573: Uss_Port Instruction
105BCommunication processor 12.4 Universal serial interface (USS) communication 12.4.3 USS_PORT instruction Table 12- 38 USS_PORT instruction LAD / FBD Description The USS_PORT instruction handles communication USS_PORT( over a USS network. PORT:=_uint_in_, BAUD:=_dint_in_, ERROR=>_bool_out_, STATUS=>_word_out_, USS_DB:=_fbtref_inout_); Table 12- 39 Data types for the parameters Parameter and type Data type Description...
Page 574: Uss_Rpm Instruction
105BCommunication processor 12.4 Universal serial interface (USS) communication 12.4.4 USS_RPM instruction Table 12- 40 USS_RPM instruction LAD / FBD Description The USS_RPM instruction reads a parameter from USS_RPM(REQ:=_bool_in_, a drive. All USS functions associated with one USS DRIVE:=_usint_in_, network and PtP communication port must use the PARAM:=_uint_in_, same data block.
Page 575: Uss_Wpm Instruction
105BCommunication processor 12.4 Universal serial interface (USS) communication Parameter type Data type Description ERROR Bool Error occurred: When true, ERROR indicates that an error has occurred and the STATUS output is valid. All other outputs are set to zero on an error.
Page 576: Uss Status Codes
105BCommunication processor 12.4 Universal serial interface (USS) communication Parameter and type Data type Description PARAM UInt Parameter number: PARAM designates which drive parameter is written. The range of this parameter is 0 to 2047. On some drives, the most significant byte can access PARAM values greater than 2047. See your drive manual for details on how to access an extended range.
Page 577 105BCommunication processor 12.4 Universal serial interface (USS) communication STATUS Description (W#16#..) 8182 The user supplied a Word for a parameter value and received a DWord or Real from the drive in the response. 8183 The user supplied a DWord or Real for a parameter value and received a Word from the drive in the response.
Page 578: General Drive Setup Information
105BCommunication processor 12.4 Universal serial interface (USS) communication Network 1 "PortStatus" port status and "USS_DRV_DB".USS_Extended_Error extended error code values are only valid for one program scan. The values must be captured for later processing. Network 2 The "PortError" contact triggers the storage of the "PortStatus" value in "LastPortStatus"...
Page 579 12.4 Universal serial interface (USS) communication Connecting a MicroMaster drive This information about SIEMENS MicroMaster drives is provided as an example. For other drives, refer to the drive's manual for setup instructions. To make the connection to a MicroMaster Series 4 (MM4) drive, insert the ends of the RS- 485 cable into the two caged-clamp, screw-less terminals provided for USS operation.
Page 580 105BCommunication processor 12.4 Universal serial interface (USS) communication If the drive is configured as the terminating MM420 node in the network, then termination and bias resistors must also be wired to the 120 ohm appropriate terminal connections. This 1.5K ohm 470 ohm diagram shows examples of the MM4 drive connections necessary for termination and...
Page 581: Modbus Communication
105BCommunication processor 12.5 Modbus communication 10. Set the baud rate of the RS-485 serial interface: P2010 Index 0= 4 (2400 baud) 5 (4800 baud) 6 (9600 baud) 7 (19200 baud 8 (38400 baud) 9 (57600 baud) 12 (115200 baud) 11. Enter the Slave address. P2011 Index 0=(0 to 31) Each drive (a maximum of 31) can be operated over the bus.
Page 582 105BCommunication processor 12.5 Modbus communication Table 12- 46 Write data functions: Write remote I/O and modify program data Modbus function code Write slave (server) functions - standard addressing Write one output bit: 1 bit per request Write one holding register: 1 word per request Write one or more output bits: 1 to 1968 bits per request Write one or more holding registers: 1 to 123 words per request ●...
Page 583 105BCommunication processor 12.5 Modbus communication Modbus TCP communication Modbus TCP (Transmission Control Protocol) is a standard network communication protocol that uses the PROFINET connector on the CPU for TCP/IP communication. No additional communication hardware module is required. Modbus TCP uses Open User Communications (OUC) connections as a Modbus communication path.
Page 584: Modbus Tcp
105BCommunication processor 12.5 Modbus communication 12.5.2 Modbus TCP 12.5.2.1 MB_CLIENT (Modbus TCP) Table 12- 49 MB_CLIENT instruction LAD / FBD Description MB_CLIENT communicates as a "MB_CLIENT_DB"( Modbus TCP client through the REQ:=_bool_in_, PROFINET connector on the S7- DISCONNECT:=_bool_in_, 1200 CPU. No additional CONNECT_ID=_uint_in_, communication hardware module IP_OCTET_1:=_byte_in_,...
Page 585 105BCommunication processor 12.5 Modbus communication Parameter and type Data type Description MB_MODE USInt Mode Selection: Assigns the type of request (read, write, or diagnostic). See the Modbus functions table below for details. MB_DATA_ADDR UDInt Modbus starting Address: Assigns the starting address of the data to be accessed by MB_CLIENT.
Page 586 105BCommunication processor 12.5 Modbus communication MB_MODE and MB_DATA_ADDR parameters select the Modbus communication function MB_DATA_ADDR assigns the starting Modbus address of the data to be accessed. The MB_CLIENT instruction uses a MB_MODE input rather than a function code input. The combination of MB_MODE and MB_DATA_ADDR values determine the function code that is used in the actual Modbus message.
Page 587 105BCommunication processor 12.5 Modbus communication MB_MODE Modbus Data length Operation and data MB_DATA_ADDR function Reset server event counter using data diagnostic code 0x000A 1 word per request 3 to 10, Reserved 12 to 79, 82 to 255 Note MB_DATA_PTR assigns a buffer to store data read/written to/from a Modbus TCP server The data buffer can be in a standard global DB or M memory address.
Page 588 105BCommunication processor 12.5 Modbus communication ● Complex DB elements can be assigned by MB_DATA_PTR, such as – Standard arrays – Named structures where each element is unique. – Named complex structures where each element has a unique name and a 16 or 32 bit data type.
Page 589 105BCommunication processor 12.5 Modbus communication Table 12- 53 MB_CLIENT protocol errors STATUS Response code to Modbus protocol errors (W#16#) Modbus client (B#16#) 8381 Function code not supported 8382 Data length error 8383 Data address error or access outside the bounds of the MB_HOLD_REG address area 8384 Data value error 8385...
Page 590: Mb_Server (Modbus Tcp)
105BCommunication processor 12.5 Modbus communication 12.5.2.2 MB_SERVER (Modbus TCP) Table 12- 55 MB_SERVER instruction LAD / FBD Description MB_SERVER communicates as a "MB_SERVER_DB"( Modbus TCP server through the DISCONNECT:=_bool_in_, PROFINET connector on the S7-1200 CONNECT_ID:=_uint_in_, CPU. No additional communication IP_PORT:=_uint_in_, hardware module is required.
Page 591 105BCommunication processor 12.5 Modbus communication MB_SERVER allows incoming Modbus function codes (1, 2, 4, 5, and 15) to read or write bits and words directly in the input process image and output process image of the S7-1200 CPU. For data transfer function codes (3, 6, and 16), the MB_HOLD_REG parameter must be defined as a data type larger than a byte.
Page 592 105BCommunication processor 12.5 Modbus communication A Modbus TCP server can support concurrent connections up to the maximum number of Open User Communications connections allowed by the PLC. The total number of connections for a PLC, including Modbus TCP Clients and Servers, must not exceed the maximum number of supported Open User Communications connections (Page 394).
Page 593 105BCommunication processor 12.5 Modbus communication Variable Data type Default Description value Exception_Count Word Modbus specific errors that require a returned exception Success_Count Word The number of requests received for this specific server that have no protocol errors. Connected Bool Indicates whether the connection to the assigned client is connected or disconnected: 1=connected, 0=disconnected Your program can write values to the HR_Start_Offset and control Modbus server operations.
Page 594 105BCommunication processor 12.5 Modbus communication For example, after MB_SERVER is placed in a LAD network, you can go to a previous network and assign the HR_Start_Offset value. The value must be assigned prior to execution of MB_SERVER. Entering a Modbus server variable using the default DB name: 1.
Page 595: Mb_Server Example: Multiple Tcp Connections
105BCommunication processor 12.5 Modbus communication See also TCON, TDISCON, TSEND, AND TRCV (Page 408) 12.5.2.3 MB_SERVER example: Multiple TCP connections You can have multiple Modbus TCP server connections. To accomplish this, MB_SERVER must be independently executed for each connection. Each connection must use an independent instance DB, connection ID, and IP port.
Page 596: Mb_Client Example 1: Multiple Requests With Common Tcp Connection
105BCommunication processor 12.5 Modbus communication 12.5.2.4 MB_CLIENT example 1: Multiple requests with common TCP connection Multiple Modbus client requests can be sent over the same connection. To accomplish this, use the same instance DB, connection ID, and port number. Only 1 client can be active at any given time. Once a client completes its execution, the next client begins execution.
Page 597: Mb_Client Example 2: Multiple Requests With Different Tcp Connections
105BCommunication processor 12.5 Modbus communication 12.5.2.5 MB_CLIENT example 2: Multiple requests with different TCP connections Modbus client requests can be sent over different connections. To accomplish this, different instance DBs, IP addresses, and connection IDs must be used. The port number must be different if the connections are established to the same Modbus server.
Page 598: Mb_Client Example 3: Output Image Write Request
105BCommunication processor 12.5 Modbus communication 12.5.2.6 MB_CLIENT example 3: Output image write request This example shows a Modbus client request to write the S7-1200 output image. Network 1: Modbus function 15 - Write S7-1200 output image bits 12.5.2.7 MB_CLIENT example 4: Coordinating multiple requests You must ensure that each individual Modbus TCP request finishes execution.
Page 599: Modbus Rtu
105BCommunication processor 12.5 Modbus communication Network 2: Modbus function 3 - Read holding register words 12.5.3 Modbus RTU There are two versions of the Modbus RTU instructions available in STEP 7: ● Version 1 was initially available in STEP 7 Basic V10.5. ●...
Page 600: Mb_Comm_Load
105BCommunication processor 12.5 Modbus communication 12.5.3.1 MB_COMM_LOAD Table 12- 63 MB_COMM_LOAD instruction LAD / FBD Description The MB_COMM_LOAD instruction configures a "MB_COMM_LOAD_DB"( PtP port for Modbus RTU protocol REQ:=_bool_in, communications. Modbus port hardware options: PORT:=_uint_in_, Install up to three CMs (RS485 or RS232), plus BAUD:=_udint_in_, one CB (R4845).
Page 601 105BCommunication processor 12.5 Modbus communication Parameter and type Data type Description RTS_ON_DLY UInt RTS ON delay selection: 0 – (default) No delay from RTS active until the first character of the  message is transmitted 1 to 65535 – Delay in milliseconds from RTS active until the first ...
Page 602 105BCommunication processor 12.5 Modbus communication MB_COMM_LOAD data block variables The following table shows the public static variables stored in the instance DB for the MB_COMM_LOAD that can be used in your program. Table 12- 65 Static variables in the instance DB Variable Data type Description...
Page 603: Mb_Master
105BCommunication processor 12.5 Modbus communication 12.5.3.2 MB_MASTER Table 12- 67 MB_MASTER instruction LAD / FBD Description The MB_MASTER instruction communicates as a "MB_MASTER_DB"( Modbus master using a port that was configured by REQ:=_bool_in_, a previous execution of the MB_COMM_LOAD MB_ADDR:=_uint_in_, instruction.
Page 604 105BCommunication processor 12.5 Modbus communication Modbus master communication rules ● MB_COMM_LOAD must be executed to configure a port before a MB_MASTER instruction can communicate with that port. ● If a port is to be used to initiate Modbus master requests, that port should not be used by MB_SLAVE .
Page 605 105BCommunication processor 12.5 Modbus communication The MB_MASTER instruction uses a MODE input rather than a Function Code input. The combination of MODE and Modbus address determine the Function Code that is used in the actual Modbus message. The following table shows the correspondence between parameter MODE, Modbus function code, and Modbus address range.
Page 606 105BCommunication processor 12.5 Modbus communication DATA_PTR parameter The DATA_PTR parameter points to the DB or M address that is written to or read from. If you use a data block, then you must create a global data block that provides data storage for reads and writes to Modbus slaves.
Page 607 105BCommunication processor 12.5 Modbus communication Modbus master data block variables The following table shows the public static variables stored in the instance DB for MB_MASTER that can be used in your program. Table 12- 70 Static variables in the instance DB Variable Data type Initial value Description...
Page 608: Mb_Slave
105BCommunication processor 12.5 Modbus communication Table 12- 72 MB_MASTER execution condition codes (Modbus protocol errors) STATUS (W#16#) Response code from Modbus protocol errors slave 8380 CRC error 8381 Function code not supported 8382 Data length error 8383 Data address error or address outside the valid range of the DATA_PTR area 8384 Greater than 03...
Page 609 105BCommunication processor 12.5 Modbus communication Table 12- 74 Data types for the parameters Parameter and type Data type Description MB_ADDR V1.0: USInt The station address of the Modbus slave: Standard addressing range (1 to 247) V2.0: UInt Extended addressing range (0 to 65535) MB_HOLD_REG Variant Pointer to the Modbus Holding Register DB: The Modbus holding...
Page 610 105BCommunication processor 12.5 Modbus communication The following table shows examples of Modbus address to holding register mapping that is used for Modbus function codes 03 (read words), 06 (write word), and 16 (write words). The actual upper limit of DB addresses is determined by the maximum work memory limit and M memory limit, for each CPU model.
Page 611 105BCommunication processor 12.5 Modbus communication Modbus slave communication rules ● MB_COMM_LOAD must be executed to configure a port, before a MB_SLAVE instruction can communicate through that port. ● If a port is to respond as a slave to a Modbus master, then do not program that port with the MB_MASTER instruction.
Page 612 105BCommunication processor 12.5 Modbus communication Modbus slave variables This table shows the public static variables stored in the MB_SLAVE instance data block that can be used in your program Table 12- 78 Modbus slave variables Variable Data type Description HR_Start_Offset Word Specifies the starting address of the Modbus Holding register (default = 0) Extended_Addressing...
Page 613 105BCommunication processor 12.5 Modbus communication For example, after MB_SLAVE is placed in a LAD network, you can go to a previous network and assign the HR_Start_Offset value. The value must be assigned prior to execution of MB_SLAVE. Entering a Modbus slave variable using the default DB name: 1.
Page 614 105BCommunication processor 12.5 Modbus communication Condition codes Table 12- 82 MB_SLAVE execution condition codes (communication and configuration errors) STATUS (W#16#) Description 80D1 The receiver issued a flow control request to suspend an active transmission and never re- enabled the transmission during the specified wait time. This error is also generated during hardware flow control when the receiver does not assert CTS within the specified wait time.
Page 615: Modbus Rtu Master Example Program
105BCommunication processor 12.5 Modbus communication 12.5.3.4 Modbus RTU master example program MB_COMM_LOAD is initialized during start-up by using the first scan flag. Execution of MB_COMM_LOAD in this manner should only be done when the serial port configuration will not change at runtime. Network 1 Initialize the RS-485 module parameters only once during the first scan.
Page 616 105BCommunication processor 12.5 Modbus communication Network 3 This is an optional network that just shows the values of the first 3 words once the read operation is done. Network 4 Write 64 bits to the output image register starting at slave address Q2.0. S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 617: Modbus Rtu Slave Example Program
105BCommunication processor 12.5 Modbus communication 12.5.3.5 Modbus RTU slave example program MB_COMM_LOAD shown below is initialized each time "Tag_1" is enabled. Execution of MB_COMM_LOAD in this manner should only be done when the serial port configuration will change at runtime, as a result of HMI configuration. Network 1 Initialize the RS-485 module parameters each time they are changed by an HMI device.
Page 618: Telecontrol And Teleservice With The Cp 1242-7
105BCommunication processor 12.6 Telecontrol and TeleService with the CP 1242-7 12.6 Telecontrol and TeleService with the CP 1242-7 12.6.1 Connection to a GSM network IP-based WAN communication via GPRS Using the CP 1242-7 communications processor, the S7-1200 can be connected to GSM networks.
Page 619: Applications Of The Cp 1242-7
105BCommunication processor 12.6 Telecontrol and TeleService with the CP 1242-7 Requirements The equipment used in the stations or the control center depends on the particular application. ● For communication with or via a central control room, the control center requires a PC with Internet access.
Page 620 105BCommunication processor 12.6 Telecontrol and TeleService with the CP 1242-7 Telecontrol applications ● Sending messages by SMS Via the CP 1242-7, the CPU of a remote S7-1200 station can receive SMS messages from the GSM network or send messages by SMS to a configured mobile phone or an S7-1200.
Page 621: Other Properties Of The Cp
105BCommunication processor 12.6 Telecontrol and TeleService with the CP 1242-7 12.6.3 Other properties of the CP Other services and functions of the CP 1242-7 ● Time-of-day synchronization of the CP via the Internet You can set the time on the CP as follows: –...
Page 622: Accessories
12.6 Telecontrol and TeleService with the CP 1242-7 Further information The CP 1242-7 manual contains detailed information. You will find this on the Internet on the pages of Siemens Industrial Automation Customer Support under the following entry ID: 42330276 (http://support.automation.siemens.com/WW/view/en/42330276) 12.6.4...
Page 623: Configuration Examples For Telecontrol
Sending messages by SMS Figure 12-3 Sending messages by SMS from an S7-1200 station A SIMATIC S7-1200 with a CP 1242-7 can send messages by SMS to a configured mobile phone or a configured S7-1200 station. S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 624 Figure 12-4 Communication between S7-1200 stations and a control center In telecontrol applications, SIMATIC S7-1200 stations with a CP 1242-7 communicate with a control center via the GSM network and the Internet. The TELECONTROL SERVER BASIC application is installed on the telecontrol server in the master station. This results in the following use cases: ●...
Page 625 Figure 12-5 Direct communication between two S7-1200 stations In this configuration, two SIMATIC S7-1200 stations communicate directly with each other using the CP 1242-7 via the GSM network. Each CP 1242-7 has a fixed IP address. The relevant service of the GSM network provider must allow this.
Page 626 In TeleService via GPRS, an engineering station on which STEP 7 is installed communicates via the GSM network and the Internet with a SIMATIC S7-1200 station with a CP 1242-7. The connection runs via a telecontrol server that serves as an intermediary and is connected to the Internet.
Page 627: Teleservice Communication (Smtp E-Mail)
Teleservice communication (SMTP e-mail) 13.1 TM_Mail transfer e-mail instruction Table 13- 1 TM_MAIL instruction LAD / FBD Description The TM_MAIL instruction sends an "TM_MAIL_DB"( e-mail message using the SMTP REQ:=_bool_in_, (Simple Mail Transfer Protocol) via a ID:=_int_in_, CPU Industrial Ethernet connection TO_S:=_string_in_, to the optional teleservice adapter.
Page 628 106BTeleservice communication (SMTP e-mail) 13.1 TM_Mail transfer e-mail instruction If the CPU is changed to STOP mode while TM_MAIL is active, then the communication connection to the mail server is terminated. The communication connection to the mail server is also lost if problems occur in CPU communication on the Industrial Ethernet bus. In these cases, the send process is suspended and the e-mail does not reach the recipient.
Page 629 106BTeleservice communication (SMTP e-mail) 13.1 TM_Mail transfer e-mail instruction Parameter and type Data types Description String CC copy to recipient addresses (optional): STRING data with a maximum length of 240 characters SUBJECT String Subject name of the e-mail: STRING data with a maximum length 240 characters.
Page 630 106BTeleservice communication (SMTP e-mail) 13.1 TM_Mail transfer e-mail instruction SMTP authentication TM_MAIL supports the SMTP AUTH LOGIN authentication method that is required by most mail servers. For information on the authentication method used by your mail server, please refer to the manual of the mail server or the website of your Internet Service Provider. The AUTH LOGIN authentication method uses the TM_MAIL USERNAME and PASSWORD parameters to access the mail server.
Page 631 106BTeleservice communication (SMTP e-mail) 13.1 TM_Mail transfer e-mail instruction Table 13- 4 Condition codes STATUS SFC_STATUS Description (W#16#...): (W#16#...): 0000 The TM_MAIL operation completed without error. This zero STATUS code does not guarantee that an e-mail was actually sent (See the first item in the note following this table).
Page 632 106BTeleservice communication (SMTP e-mail) 13.1 TM_Mail transfer e-mail instruction Note Possible unreported e-mail transmission errors  Incorrect entry of a recipient address does not generate a STATUS error for TM_MAIL. In this case, there is no guarantee that additional recipients (with correctly specified e-mail addresses), will receive the e-mail.
Page 633: Online And Diagnostic Tools
Online and diagnostic tools 14.1 Status LEDs The CPU and the I/O modules use LEDs to provide information about either the operational status of the module or the I/O. Status LEDs on a CPU The CPU provides the following status indicators: ●...
Page 634 107BOnline and diagnostic tools 14.1 Status LEDs Description STOP/RUN ERROR MAINT Yellow / Green Yellow Defective hardware On (yellow) LED test or defective CPU firmware Flashing Flashing Flashing (alternating yellow and green) The CPU also provides two LEDs that indicate the status of the PROFINET communications. Open the bottom terminal block cover to view the PROFINET LEDs.
Page 635: Going Online And Connecting To A Cpu
107BOnline and diagnostic tools 14.2 Going online and connecting to a CPU 14.2 Going online and connecting to a CPU An online connection between the programming device and CPU is required for loading programs and project engineering data as well as for activities such as the following: ●...
Page 636: Assigning A Name To A Profinet Io Device Online
107BOnline and diagnostic tools 14.3 Assigning a name to a PROFINET IO device online 14.3 Assigning a name to a PROFINET IO device online The devices on your PROFINET network must have an assigned name before you can connect with the CPU. Use the "Devices & networks" editor to assign names to your PROFINET devices if the devices have not already been assigned a name or if the name of the device is to be changed.
Page 637 107BOnline and diagnostic tools 14.3 Assigning a name to a PROFINET IO device online 1. In the "Devices & networks" editor, right-click on the required PROFINET IO device, and select "Online & diagnostics". 2. In the "Online & diagnostics" dialog, make the following menu selections: ...
Page 638: Setting The Ip Address And Time Of Day
107BOnline and diagnostic tools 14.4 Setting the IP address and time of day 14.4 Setting the IP address and time of day You can set the IP address and time of day in the online CPU. After accessing "Online & diagnostics"...
Page 639: Cpu Operator Panel For The Online Cpu
107BOnline and diagnostic tools 14.6 CPU operator panel for the online CPU Procedure To reset a CPU to its factory settings, follow these steps: 1. Open the Online and Diagnostics view of the CPU. 2. Select "Reset to factory settings" from the "Functions" folder. 3.
Page 640: Monitoring The Cycle Time And Memory Usage
107BOnline and diagnostic tools 14.7 Monitoring the cycle time and memory usage 14.7 Monitoring the cycle time and memory usage You can monitor the cycle time and memory usage of an online CPU. After connecting to the online CPU, open the Online tools task card to view the following measurements: ...
Page 641: Comparing Offline And Online Cpus
107BOnline and diagnostic tools 14.9 Comparing offline and online CPUs The first entry contains the latest event. Each entry in the diagnostic buffer contains the date and time the event was logged, and a description. The maximum number of entries is dependent on the CPU.
Page 642: Monitoring And Modifying Values In The Cpu
107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU Right-click an object in the "Compare to" column and select "Start detailed comparison" button to show the code blocks side-by-side. The detailed comparison highlights the differences between the code blocks of online CPU and the code blocks of the CPU in your project.
Page 643: Displaying Status In The Program Editor
107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU When you have connected to the CPU, STEP 7 turns the headers of the work areas orange. The project tree displays a comparison of the offline project and the online CPU.
Page 644: Capturing The Online Values Of A Db To Reset The Start Values
107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU The network in the program editor displays power flow in green. You can also right-click on the instruction or parameter to modify the value for the instruction. 14.10.3 Capturing the online values of a DB to reset the start values You can capture the current values being monitored in an online CPU to become the start values for a global DB.
Page 645: Using A Watch Table To Monitor And Modify Values In The Cpu
107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU 14.10.4 Using a watch table to monitor and modify values in the CPU A watch table allows you to perform monitoring and control functions on data points as the CPU executes your program.
Page 646: Using A Trigger When Monitoring Or Modifying Plc Tags
107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU To monitor the tags, you must have an online connection to the CPU. The various functions can be selected using the buttons at the top of the watch table. Enter the tag name to monitor and select a display format from the dropdown selection.
Page 647: Enabling Outputs In Stop Mode
107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU 14.10.4.2 Enabling outputs in STOP mode The watch table allows you to write to the outputs when the CPU is in STOP mode. This functionality allows you to check the wiring of the outputs and verify that the wire connected to an output pin initiates a high or low signal to the terminal of the process device to which it is connected.
Page 648: Operation Of The Force Function
107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU In the "Force value" cell, enter the value for the input or output to be forced. You can then use the check box in the "Force" column to enable forcing of the input or output. Use the "Start or replace forcing"...
Page 649 107BOnline and diagnostic tools 14.10 Monitoring and modifying values in the CPU If the CPU is executing the user program from a write-protected memory card, you cannot initiate or change the forcing of I/O from a watch table because you cannot override the values in the write-protected user program.
Page 650: Downloading In Run Mode
107BOnline and diagnostic tools 14.11 Downloading in RUN mode 14.11 Downloading in RUN mode The CPU supports "Download in RUN mode". This capability is intended to allow you to make small changes to a user program with minimal disturbance to the process being controlled by the program.
Page 651: Prerequisites For "Download In Run Mode
107BOnline and diagnostic tools 14.11 Downloading in RUN mode 14.11.1 Prerequisites for "Download in RUN mode" You cannot download your program changes to a CPU that is in RUN mode unless you have met these prerequisites: ● Your program must compile successfully. ●...
Page 652: Downloading Selected Blocks
107BOnline and diagnostic tools 14.11 Downloading in RUN mode 3. STEP 7 prompts you to load your program or cancel the operation. 4. If you click "Load", STEP 7 downloads the program to the CPU. 14.11.3 Downloading selected blocks The focus is on the Program blocks folder, selection of blocks, or one single block. 1.
Page 653: Downloading A Single Selected Block With A Compile Error In Another Block
107BOnline and diagnostic tools 14.11 Downloading in RUN mode 3. If the user attempts to download in RUN, but the system detects that this is not possible prior to the actual download, then the Stop modules category line appears in the dialog. 4.
Page 654: System Reaction If The Download Process Fails
107BOnline and diagnostic tools 14.11 Downloading in RUN mode 14.11.5 System reaction if the download process fails During the initial Download in RUN operation, if a network connection failure occurs, a "Load preview" dialog will result as shown in the figure below. 14.11.6 Downloading the program in RUN mode Before downloading the program in RUN mode, consider the effect of a RUN-mode...
Page 655 107BOnline and diagnostic tools 14.11 Downloading in RUN mode ● Any logic that is conditional on the state of the first scan bit will not be executed until the next power cycle or transition from STOP to RUN mode. The first scan bit is set only by the transition to RUN mode and is not affected by a download in RUN mode.
Page 656 107BOnline and diagnostic tools 14.11 Downloading in RUN mode In all cases the RLO output from the instruction will be false when the error occurs. The error is temporary. If it occurs, the instruction should be retried later. Note You must not retry the operation in the current execution of the OB. S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 657: Technical Specifications
● EC Directive 94/9/EC (ATEX) "Equipment and Protective Systems Intended for Use in Potentially Explosive Atmosphere" – EN 60079-15:2005: Type of Protection 'n' The CE Declaration of Conformity is held on file available to competent authorities at: Siemens AG IA AS RD ST PLC Amberg Werner-von-Siemens-Str. 50 D92224 Amberg...
Page 658 ● Canadian Standards Association: CSA C22.2 Number 142 (Process Control Equipment) NOTICE The SIMATIC S7-1200 series meets the CSA standard. The cULus logo indicates that the S7-1200 has been examined and certified by Underwriters Laboratories (UL) to standards UL 508 and CSA 22.2 No. 142.
Page 659 Maritime approval The S7-1200 products are periodically submitted for special agency approvals related to specific markets and applications. Consult your local Siemens representative if you need additional information related to the latest listing of exact approvals by part number. Classification societies: ●...
Page 660 553BTechnical specifications A.1 General Technical Specifications Electromagnetic compatibility Electromagnetic Compatibility (EMC) is the ability of an electrical device to operate as intended in an electromagnetic environment and to operate without emitting levels of electromagnetic interference (EMI) that may disturb other electrical devices in the vicinity. Table A- 2 Immunity per EN 61000-6-2 Electromagnetic compatibility - Immunity per EN 61000-6-2...
Page 661 553BTechnical specifications A.1 General Technical Specifications Table A- 5 Operating conditions Environmental conditions - Operating Ambient temperature range 0° C to 55° C horizontal mounting (Inlet Air 25 mm below unit) 0° C to 45° C vertical mounting 95% non-condensing humidity Atmospheric pressure 1080 to 795 hPa (corresponding to an altitude of -1000 to 2000m) Concentration of contaminants...
Page 662 553BTechnical specifications A.1 General Technical Specifications NOTICE When a mechanical contact turns on output power to the S7-1200 CPU, or any digital signal module, it sends a "1" signal to the digital outputs for approximately 50 microseconds. This could cause unexpected machine or process operation which could result in death or serious injury to personnel and/or damage to equipment.
Page 663: Cpu 1211C
553BTechnical specifications A.2 CPU 1211C Relay electrical service life The typical performance data supplied by relay vendors is shown below. Actual performance may vary depending upon your specific application. An external protection circuit that is adapted to the load will enhance the service life of the contacts. ①...
Page 664 553BTechnical specifications A.2 CPU 1211C Table A- 9 CPU features Technical data Description User memory Work 25 Kbytes Load 1 Mbytes Retentive 2 Kbytes On-board digital I/O 6 inputs/4 outputs On-board analog I/O 2 inputs Process image size 1024 bytes of inputs (I) /1024 bytes of outputs (Q) Bit memory (M) 4096 bytes Temporary (local) memory...
Page 665 553BTechnical specifications A.2 CPU 1211C Table A- 11 Blocks, timers and counters supported by S7-1200 Element Description Blocks Type OB, FB, FC, DB Size 25 Kbytes (CPU 1211C and CPU 1212C) 50 Kbytes (CPU 1214C) Quantity Up to 1024 blocks total (OBs + FBs + FCs + DBs) Address range for FBs, FCs, 1 to 65535 (such as FB 1 to FB 65535) and DBs...
Page 666 553BTechnical specifications A.2 CPU 1211C Technical data Description Data rates 10/100 Mb/s Isolation (external signal to PLC logic) Transformer isolated, 1500 VDC Cable type CAT5e shielded The CPU provides dedicated HMI connections to support up to 3 HMI devices. (You can have up to 2 SIMATIC Comfort panels.) The total number of HMI is affected by the types of HMI panels in your configuration.
Page 667: Digital Inputs And Outputs
553BTechnical specifications A.2 CPU 1211C A.2.2 Digital inputs and outputs Table A- 15 Digital inputs Technical data CPU 1211C AC/DC/Relay, DC/DC/Relay, and DC/DC/DC Number of inputs Type Sink/Source (IEC Type 1 sink) Rated voltage 24 VDC at 4 mA, nominal Continuous permissible voltage 30 VDC, max.
Page 668: Analog Inputs
553BTechnical specifications A.2 CPU 1211C Technical data CPU 1211C AC/DC/Relay and CPU 1211C DC/DC/Relay DC/DC/DC Maximum relay switching frequency 1 Hz Switching delay (Qa.0 to Qa.3) 10 ms max. 1.0 μs max., off to on 3.0 μs max., on to off Pulse Train Output rate Not recommended 100 KHz max.,...
Page 669: Step Response Of The Built-In Analog Inputs Of The Cpu
553BTechnical specifications A.2 CPU 1211C A.2.3.1 Step response of the built-in analog inputs of the CPU Table A- 18 Step Response (ms), 0V to 10V measured at 95% Smoothing selection (sample averaging) Rejection frequency (Integration time) 60 Hz 50 Hz 10 Hz None (1 cycle): No averaging 63 ms...
Page 670: Wiring Diagrams
553BTechnical specifications A.2 CPU 1211C A.2.4 Wiring diagrams Table A- 21 CPU 1211C AC/DC/Relay (6ES7 211-1BD30-0XB0) ① 24 VDC Sensor Power For additional noise immunity, connect "M" to chassis ground even if not using sensor supply. ② For sinking inputs, connect "-"...
Page 671: Cpu 1212C
553BTechnical specifications A.3 CPU 1212C Table A- 23 CPU 1211C DC/DC/DC (6ES7 211-1AD30-0XB0) ① 24 VDC Sensor Power For additional noise immunity, connect "M" to chassis ground even if not using sensor supply. ② For sinking inputs, connect "-" to "M" (shown).
Page 672 553BTechnical specifications A.3 CPU 1212C Technical data CPU 1212C CPU 1212C CPU 1212C AC/DC/Relay DC/DC/Relay DC/DC/DC Current available (24 VDC) 300 mA max. 300 mA max. 300 mA max. (sensor power) (sensor power) (sensor power) Digital input current consumption (24 4 mA/input used 4 mA/input used 4 mA/input used...
Page 673 553BTechnical specifications A.3 CPU 1212C Table A- 26 Performance Type of instruction Execution speed Boolean 0.1 μs/instruction Move Word 12 μs/instruction Real math 18 μs/instruction Table A- 27 Blocks, timers and counters supported by S7-1200 Element Description Blocks Type OB, FB, FC, DB Size 25 Kbytes (CPU 1211C and CPU 1212C) 50 Kbytes (CPU 1214C)
Page 674 553BTechnical specifications A.3 CPU 1212C Table A- 28 Communication Technical data Description Number of ports Type Ethernet HMI device Programming device (PG) Connections 8 for Open User Communication (active or passive): TSEND_C,  TRCV_C, TCON, TDISCON, TSEND, and TRCV 3 for server GET/PUT (CPU-to-CPU) S7 communication ...
Page 675: Digital Inputs And Outputs
553BTechnical specifications A.3 CPU 1212C Technical data CPU 1212C CPU 1212C CPU 1212C AC/DC/Relay DC/DC/Relay DC/DC/DC Maximum ripple noise (<10 MHz) < 1 V peak to peak Same as input line Same as input line Isolation (CPU logic to sensor power) Not isolated Not isolated Not isolated...
Page 676: Analog Inputs
553BTechnical specifications A.3 CPU 1212C Technical data CPU 1212C AC/DC/Relay CPU 1212C and DC/DC/Relay DC/DC/DC Isolation (field side to logic) 1500 VAC for 1 minute (coil to contact) 500 VAC for 1 minute None (coil to logic) Isolation resistance 100 MΩ min. when new Isolation between open contacts 750 VAC for 1 minute Isolation groups...
Page 677: Step Response Of The Built-In Analog Inputs Of The Cpu
553BTechnical specifications A.3 CPU 1212C Technical data Description Smoothing None, Weak, Medium, or Strong See the table for step response (ms) for the analog inputs of the CPU (Page 677). Noise rejection 10, 50, or 60 Hz Impedance ≥100 KΩ Isolation (field side to logic) None Accuracy (25°C / 0 to 55°C)
Page 678: Measurement Ranges Of The Analog Inputs For Voltage
553BTechnical specifications A.3 CPU 1212C A.3.3.3 Measurement ranges of the analog inputs for voltage Table A- 36 Analog input representation for voltage System Voltage Measuring Range Decimal Hexadecimal ±10 V ±5 V ±2.5 V 0 to 10 V 32767 7FFF 11.851 V 5.926 V 2.963 V...
Page 679: Wiring Diagrams
553BTechnical specifications A.3 CPU 1212C A.3.4 Wiring diagrams Table A- 37 CPU 1212C AC/DC/Relay (6ES7 212-1BD30-0XB0) ① 24 VDC Sensor Power For additional noise immunity, connect "M" to chassis ground even if not using sensor supply. ② For sinking inputs, connect "-"...
Page 680: Cpu 1214C
553BTechnical specifications A.4 CPU 1214C Table A- 39 CPU 1212C DC/DC/DC (6ES7-212-1AD30-0XB0) ① 24 VDC Sensor Power For additional noise immunity, connect "M" to chassis ground even if not using sensor supply. ② For sinking inputs, connect "-" to "M" (shown).
Page 681 553BTechnical specifications A.4 CPU 1214C Technical data CPU 1214C CPU 1214C CPU 1214C AC/DC/Relay DC/DC/Relay DC/DC/DC Current available (24 VDC) 400 mA max. 400 mA max. 400 mA max. (sensor power) (sensor power) (sensor power) Digital input current consumption 4 mA/input used 4 mA/input used 4 mA/input used (24VDC)
Page 682 553BTechnical specifications A.4 CPU 1214C Table A- 42 Performance Type of instruction Execution speed Boolean 0.1 μs/instruction Move Word 12 μs/instruction Real math 18 μs/instruction Table A- 43 Blocks, timers and counters supported by S7-1200 Element Description Blocks Type OB, FB, FC, DB Size 25 Kbytes (CPU 1211C and CPU 1212C) 50 Kbytes (CPU 1214C)
Page 683 553BTechnical specifications A.4 CPU 1214C Table A- 44 Communication Technical data Description Number of ports Type Ethernet HMI device Programming device (PG) Connections 8 for Open User Communication (active or passive): TSEND_C,  TRCV_C, TCON, TDISCON, TSEND, and TRCV 3 for server GET/PUT (CPU-to-CPU) S7 communication ...
Page 684: Digital Inputs And Outputs
553BTechnical specifications A.4 CPU 1214C Technical data CPU 1214C CPU 1214C CPU 1214C AC/DC/Relay DC/DC/Relay DC/DC/DC Maximum ripple noise (<10 MHz) < 1 V peak to peak Same as input line Isolation (CPU logic to sensor power) Not isolated A.4.2 Digital inputs and outputs Table A- 47 Digital inputs...
Page 685: Analog Inputs
553BTechnical specifications A.4 CPU 1214C Technical data CPU 1214C AC/DC/Relay CPU 1214C and DC/DC/Relay DC/DC/DC Isolation (field side to logic) 1500 VAC for 1 minute (coil to contact) 500 VAC for 1 minute None (coil to logic) Isolation resistance 100 MΩ min. when new Isolation between open contacts 750 VAC for 1 minute Isolation groups...
Page 686: Step Response Of The Built-In Analog Inputs Of The Cpu
553BTechnical specifications A.4 CPU 1214C Technical data Description Smoothing None, Weak, Medium, or Strong See the table for step response (ms) for the analog inputs of the CPU (Page 686). Noise rejection 10, 50, or 60 Hz Impedance ≥100 KΩ Isolation (field side to logic) None Accuracy (25°C / 0 to 55°C)
Page 687: Measurement Ranges Of The Analog Inputs For Voltage
553BTechnical specifications A.4 CPU 1214C A.4.3.3 Measurement ranges of the analog inputs for voltage Table A- 52 Analog input representation for voltage System Voltage Measuring Range Decimal Hexadecimal ±10 V ±5 V ±2.5 V 0 to 10 V 32767 7FFF 11.851 V 5.926 V 2.963 V...
Page 688 553BTechnical specifications A.4 CPU 1214C Table A- 54 CPU 1214C DC/DC/Relay (6ES7 214-1HE30-0XB0) ① 24 VDC Sensor Power For additional noise immunity, connect "M" to chassis ground even if not using sensor supply. ② For sinking inputs, connect "-" to "M" (shown).
Page 689: Digital Signal Modules (Sms)
553BTechnical specifications A.5 Digital signal modules (SMs) Digital signal modules (SMs) A.5.1 SM 1221 Digital Input Specifications Table A- 56 General specifications Model SM 1221 DI 8 x 24 VDC SM 1221 DI 16 x 24 VDC Order number 6ES7 221-1BF30-0XB0 6ES7 221-1BH30-0XB0 Dimensions W x H x D (mm) 45 x 100 x 75...
Page 690: Sm 1222 8-Point Digital Output Specifications
553BTechnical specifications A.5 Digital signal modules (SMs) Table A- 58 Wiring diagrams for the digital input SMs SM 1221 DI 8 x 24 VDC (6ES7 221-1BF30-0XB0) SM 1221 DI 16 x 24 VDC (6ES7 221-1BH30-0XB0) ① For sinking inputs, connect "-" to "M" (shown). For sourcing inputs, connect "+" to "M". A.5.2 SM 1222 8-Point Digital Output Specifications Table A- 59...
Page 691 553BTechnical specifications A.5 Digital signal modules (SMs) Table A- 60 Digital outputs Model SM 1222 SM 1222 DQ8 RLY SM 1222 DQ 8 x Relay Changeover DQ 8 x 24 VDC Number of outputs Type Relay, dry contact Relay change over Solid state - MOSFET contact (sourcing)
Page 692: Sm 1222 16-Point Digital Output Specifications
553BTechnical specifications A.5 Digital signal modules (SMs) A.5.3 SM 1222 16-Point Digital Output Specifications Table A- 61 General specifications Model SM 1222 DQ 16 x Relay SM 1222 DQ 16 x 24 VDC Order number 6ES7 222-1HH30-0XB0 6ES7 222-1BH30-0XB0 Dimensions W x H x D (mm) 45 x 100 x 75 45 x 100 x 75 Weight...
Page 693 553BTechnical specifications A.5 Digital signal modules (SMs) Model SM1222 SM1222 DQ 16 x Relay DQ 16 x 24 VDC Number of outputs on simultaneously Cable length (meters) 500 m shielded, 150 m unshielded 500 m shielded, 150 m unshielded Table A- 63 Wiring diagrams for the 8-point digital output SMs SM 1222 DQ 8 x Relay (6ES7 222-1HF30-0XB0) SM 1222 DQ 8 x 24 VDC (6ES7 222-1BF30-0XB0)
Page 694 553BTechnical specifications A.5 Digital signal modules (SMs) Table A- 64 Wiring diagram for the 8-point digital output relay changeover SM SM 1222 DQ 8 x Relay Changeover (6ES7 222-1XF30- 0XB0) Table A- 65 Wiring diagrams for the 16-point digital output SMs SM 1222 DQ 16 x Relay (6ES7 222-1HH30-0XB0) SM 1222 DQ 16 x 24 VDC (6ES7 222-1BH30-0XB0) S7-1200 Programmable controller...
Page 695: Sm 1223 Digital Input/Output Vdc Specifications
553BTechnical specifications A.5 Digital signal modules (SMs) A.5.4 SM 1223 Digital Input/Output VDC Specifications Table A- 66 General specifications SM 1223 SM 1223 SM 1223 Model SM 1223 DI 8 x 24 VDC, DQ DI 16 x 24 VDC, DI 8 x 24 VDC, DQ DI 16 x 24 VDC, 8 x Relay DQ 16 x Relay...
Page 696 553BTechnical specifications A.5 Digital signal modules (SMs) Model SM 1223 SM 1223 SM 1223 SM 1223 DI 8 x 24 VDC, DQ DI 16 x 24 VDC, DI 8 x 24 VDC, DQ DI 16 x 24 VDC, DQ 8 x Relay DQ 16 x Relay 8 x 24 VDC 16 x 24 VDC...
Page 697 553BTechnical specifications A.5 Digital signal modules (SMs) Table A- 69 Wiring diagrams for the digital input VDC/output relay SMs SM 1223 DI 8 x 24 VDC, DQ 8 x Relay SM 1223 DI 16 x 24 VDC, DQ 16 x Relay Notes (6ES7 223-1PH30-0XB0) (6ES7 223-1PL30-0XB0)
Page 698: Sm 1223 Digital Input/Output Ac Specifications
553BTechnical specifications A.5 Digital signal modules (SMs) A.5.5 SM 1223 Digital Input/Output AC Specifications Table A- 71 General specifications Model SM 1223 DI 8 x120/230 VAC / DQ 8 x Relay Order number 6ES7 223-1QH30-0XB0 Dimensions W x H x D (mm) 45 x 100 x 75 mm Weight 190 grams...
Page 699 553BTechnical specifications A.5 Digital signal modules (SMs) Table A- 73 Digital outputs Model SM 1223 DI 8 x 120/230 VAC / DQ 8 x Relay Number of outputs Type Relay, dry contact Voltage range 5 to 30 VDC or 5 to 250 VAC Logic 1 signal at max.
Page 700: Analog Signal Modules (Sms)
553BTechnical specifications A.6 Analog signal modules (SMs) Table A- 74 SM 1223 DI 8 x 120/230 VAC, DQ 8 x Relay (6ES7 223-1QH30-0XB0) Analog signal modules (SMs) A.6.1 SM 1231 analog input module specifications Table A- 75 General specifications Model SM 1231 AI 4 x 13 bit SM 1231 AI 8 x 13 bit Order number...
Page 701 553BTechnical specifications A.6 Analog signal modules (SMs) Table A- 76 Analog inputs Model SM 1231 AI 4 x 13 bit SM 1231 AI 8 x 13 bit Number of inputs Type Voltage or current (differential): Selectable in groups of 2 Range ±10 V, ±5 V, ±2.5 V, or 0 to 20 mA Full scale range (data word)
Page 702: Sm 1232 Analog Output Module Specifications
553BTechnical specifications A.6 Analog signal modules (SMs) Table A- 78 Wiring diagrams for the analog input SMs SM 1231 AI 4 x 13 bit (6ES7 231-4HD30-0XB0) SM 1231 AI 8 x 13 bit (6ES7 231-4HF30-0XB0) Note Unused analog inputs should be shorted. When the inputs are configured for "current"...
Page 703 553BTechnical specifications A.6 Analog signal modules (SMs) Table A- 80 Analog outputs Technical data SM 1232 AQ 2 x 14 bit SM 1232 AQ 4 x 14 bit Number of outputs Type Voltage or current Voltage or current Range ±10 V or 0 to 20 mA ±10 V or 0 to 20 mA Resolution Voltage: 14 bits...
Page 704: Sm 1234 Analog Input/Output Module Specifications
553BTechnical specifications A.6 Analog signal modules (SMs) Table A- 82 Wiring diagrams for the analog output SMs SM 1232 AQ 2 x 14 bit (6ES7 232-4HB30-0XB0) SM 1232 AQ 4 x 14 bit (6ES7 232-4HD30-0XB0) A.6.3 SM 1234 analog input/output module specifications Table A- 83 General specifications Technical data...
Page 705 553BTechnical specifications A.6 Analog signal modules (SMs) Model SM 1234 AI 4 x 13 bit / AQ 2 x 14 bit Full scale range (data word) -27,648 to 27,648 Overshoot/undershoot range Voltage: 32,511 to 27,649 / -27,649 to -32,512 (data word) Current: 32,511 to 27,649 / 0 to -4864 Refer to the section on input ranges for voltage and current (Page 708).
Page 706 553BTechnical specifications A.6 Analog signal modules (SMs) Table A- 86 Diagnostics Model SM 1234 AI 4 x 13 bit / AQ 2 x 14 bit Overflow/underflow Short to ground (voltage mode only) Yes on outputs Wire break (current mode only) Yes on outputs 24 VDC low voltage If a voltage greater than +30 VDC or less than -15 VDC is applied to the input, the resulting value will be unknown and...
Page 707: Step Response Of The Analog Inputs
553BTechnical specifications A.6 Analog signal modules (SMs) A.6.4 Step response of the analog inputs Table A- 88 Step response (ms), 0 to full-scale measured at 95% Smoothing selection (sample averaging) Noise reduction/rejection frequency (Integration time selection) 400 Hz (2.5 ms) 60 Hz (16.6 ms) 50 Hz (20 ms) 10 Hz (100 ms)
Page 708: Measurement Ranges Of The Analog Inputs For Voltage
553BTechnical specifications A.6 Analog signal modules (SMs) A.6.6 Measurement ranges of the analog inputs for voltage Table A- 90 Analog input representation for voltage System Voltage Measuring Range Decimal Hexadecimal ±10 V ±5 V ±2.5 V 0 to 10 V 32767 7FFF 11.851 V...
Page 709: Thermocouple And Rtd Signal Modules (Sms)
553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) Table A- 92 Analog output representation for voltage System Voltage Output Range Decimal Hexadecimal ± 10 V 32767 7FFF See note 1 Overflow 32512 7F00 See note 1 32511 7EFF 11.76 V Overshoot range 27649 6C01...
Page 710 553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) Table A- 94 Analog inputs Model SM 1231 AI 4 x 16 bit TC SM 1231 AI 8 x 16 bit TC Number of inputs Range See Thermocouple selection table See Thermocouple selection table (Page 712).
Page 711: Basic Operation For A Thermocouple
553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) The SM 1231 Thermocouple (TC) analog signal module measures the value of voltage connected to the module inputs. The temperature measurement type can be either "Thermocouple" or "Voltage". ● "Thermocouple": The value will be reported in degrees multiplied by ten (for example, 25.3 degrees will be reported as decimal 253).
Page 712: Selection Tables For The Sm 1231 Thermocouple
553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) When you connect a thermocouple to the SM 1231 Thermocouple module, the two dissimilar metal wires are attached to the module at the module signal connector. The place where the two dissimilar wires are attached to each other forms the sensor thermocouple. Two more thermocouples are formed where the two dissimilar wires are attached to the signal connector.
Page 713 553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) Type Under-range Nominal range Nominal range Over-range Normal range Normal range 3, 4 1, 2 minimum low limit high limit maximum accuracy @ 25°C accuracy 0°C to 55°C TXK/XK(L) -200.0°C -150.0°C 800.0°C 1050.0°C ±0.6°C...
Page 714: Sm 1231 Rtd
553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) Representation of analog values for Thermocouple Type J A representation of the analog values of thermocouples type J is shown in the table below. Table A- 99 Representation of analog values of thermocouples type J Type J in °C Units Type J in °F...
Page 715 553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) Technical data SM 1231 AI 4 x RTD x 16 bit SM 1231 AI 8 x RTD x16 bit Range See RTD Sensor selection table See RTD Sensor selection table (Page 717). (Page 717).
Page 716 553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) The SM 1231 RTD analog signal module measures the value of resistance connected to the module inputs. The measurement type can be selected as either "Resistor" or "Thermal resistor". ● "Resistor": The nominal range full scale value will be decimal 27648. ●...
Page 717: Selection Tables For The Sm 1231 Rtd
553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) A.7.2.1 Selection tables for the SM 1231 RTD Table A- 104 Ranges and accuracy for the different sensors supported by the RTD modules Temperature RTD type Under range Nominal Nominal Over range Normal Normal coefficient...
Page 718 553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) Table A- 105 Resistance Range Under range Nominal range Nominal range Over range Normal range Normal range minimum low limit high limit maximum accuracy accuracy @ 25°C 0°C to 55°C 150 Ω 0 (0 Ω) 27648 (150 Ω) 176.383 Ω...
Page 719 553BTechnical specifications A.7 Thermocouple and RTD signal modules (SMs) NOTICE After power is applied, the module performs internal calibration for the analog-to-digital converter. During this time the module reports a value of 32767 on each channel until valid data is available on that channel. Your user program may need to allow for this initialization time.
Page 720: Digital Signal Boards (Sbs)
553BTechnical specifications A.8 Digital signal boards (SBs) Digital signal boards (SBs) A.8.1 SB 1221 200 kHz digital input specifications Table A- 108 General specifications Technical data SB 1221 DI 4 x 24 VDC, 200 kHz SB 1221 DI 4 x 5 VDC, 200 kHz Order number 6ES7 221-3BD30-0XB0 6ES7 221-3AD30-0XB0...
Page 721 553BTechnical specifications A.8 Digital signal boards (SBs) NOTICE When switching frequencies above 20 kHz, it is important that the digital inputs receive a square wave. Consider the following options to improve the signal quality to the inputs:  Minimize the cable length ...
Page 722: Sb 1222 200 Khz Digital Output Specifications
553BTechnical specifications A.8 Digital signal boards (SBs) A.8.2 SB 1222 200 kHz digital output specifications Table A- 111 General specifications Technical data SB 1222 DQ 4 x 24 VDC, 200 kHz SB 1222 DQ 4 x 5 VDC, 200 kHz Order number 6ES7 222-1BD30-0XB0 6ES7 222-1AD30-0XB0...
Page 723 553BTechnical specifications A.8 Digital signal boards (SBs) NOTICE When switching frequencies above 20 kHz, it is important that the digital inputs receive a square wave. Consider the following options to improve the signal quality to the inputs:  Minimize the cable length ...
Page 724: Sb 1223 200 Khz Digital Input / Output Specifications
553BTechnical specifications A.8 Digital signal boards (SBs) A.8.3 SB 1223 200 kHz digital input / output specifications Table A- 114 General specifications Technical data SB 1223 DI 2 x 24 VDC / SB 1223 DI 2 x 5 VDC / DQ 2 x 24 VDC, 200 kHz DQ 2 x 5 VDC, 200 kHz Order number...
Page 725 553BTechnical specifications A.8 Digital signal boards (SBs) Technical data SB 1223 DI 2 x 24 VDC / SB 1223 DI 2 x 5 VDC / DQ 2 x 24 VDC, 200 kHz DQ 2 x 5 VDC, 200 kHz Current (max.) 0.1 A 0.1 A Lamp load...
Page 726: Sb 1223 2 X 24 Vdc Input / 2 X 24 Vdc Output Specifications
553BTechnical specifications A.8 Digital signal boards (SBs) Table A- 117 Wiring diagrams for the 200 kHz digital input/output SBs SB 1223 DI 2 x 24 VDC/DQ 2 x 24 VDC, SB 1223 DI 2 x 5 VDC / DQ 2 x 5 VDC, 200 kHz (6ES7 223-3BD30-0XB0) 200 kHz (6ES7 223-3AD30-0XB0) ①...
Page 727 553BTechnical specifications A.8 Digital signal boards (SBs) Technical Data SB 1223 DI 2 x 24 VDC, DQ 2 x 24 VDC Rated voltage 24 VDC at 4 mA, nominal Continuous permissible voltage 30 VDC, max. Surge voltage 35 VDC for 0.5 sec. Logic 1 signal (min.) 15 VDC at 2.5 mA Logic 0 signal (max.)
Page 728: Analog Signal Boards (Sbs)
553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 121 Wiring diagram for the digital input/output SB SB 1223 DI 2 x 24 VDC, DQ 2 x 24 VDC (6ES7 223-0BD30-0XB0) ① Supports sinking inputs only Analog signal boards (SBs) A.9.1 SB 1231 1 analog input specifications Note...
Page 729 553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 123 Analog inputs Technical data SB 1231 AI 1x12 bit Number of inputs Type Voltage or current (differential) Range ±10V, ±5V, ±2.5 or 0 to 20 mA Resolution 11 bits + sign bit Full scale range (data word) -27,648 to 27,648 Over/Under range (data word)
Page 730: Sb 1232 1 Analog Output Specifications
553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 125 Wiring diagram for the analog input SB SB 1231 AI x 12 bit (6ES7 231-4HA30-0XB0) ① Connect "R" and "0+" for current A.9.2 SB 1232 1 analog output specifications Table A- 126 General specifications Technical data SB 1232 AQ 1 x 12 bit Order number...
Page 731 553BTechnical specifications A.9 Analog signal boards (SBs) Technical data SB 1232 AQ 1 x 12 bit Full scale range (data word) Voltage: -27,648 to 27,648 Refer to the output ranges for voltage and current Current: 0 to 27,648 (Page 733). Accuracy (25°C / 0 to 55°C) ±0.5% / ±1% of full scale Settling time (95% of new value)
Page 732: Measurement Ranges For Analog Inputs And Outputs
553BTechnical specifications A.9 Analog signal boards (SBs) A.9.3 Measurement ranges for analog inputs and outputs A.9.3.1 Step response of the analog inputs Table A- 130 Step response (ms), 0V to 10V measured at 95% Smoothing selection (sample averaging) Integration time selection 400 Hz (2.5 ms) 60 Hz (16.6 ms) 50 Hz (20 ms)
Page 733: Measurement Ranges Of The Analog Inputs For Voltage
553BTechnical specifications A.9 Analog signal boards (SBs) A.9.3.3 Measurement ranges of the analog inputs for voltage Table A- 132 Analog input representation for voltage System Voltage Measuring Range Decimal Hexadecimal ±10 V ±5 V ±2.5 V 0 to 10 V 32767 7FFF 11.851 V...
Page 734: Thermocouple Sbs
553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 134 Analog output representation for voltage System Voltage Output Range Decimal Hexadecimal ± 10 V 32767 7FFF See note 1 Overflow 32512 7F00 See note 1 32511 7EFF 11.76 V Overshoot range 27649 6C01 27648...
Page 735 553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 136 Analog inputs Technical data SB 1231 AI 1x16 bit Thermocouple Number of inputs Type Floating TC and mV Range See Thermocouple filter selection table (Page 736). Nominal range (data word) ...
Page 736: Basic Operation For A Thermocouple
553BTechnical specifications A.9 Analog signal boards (SBs) A.9.4.2 Basic operation for a thermocouple Thermocouples are formed whenever two dissimilar metals are electrically bonded to each other. A voltage is generated that is proportional to the junction temperature. This voltage is small;...
Page 737 553BTechnical specifications A.9 Analog signal boards (SBs) Thermocouple Under range Nominal Nominal range Over range Normal range Normal range Type minimum range low limit high limit maximum accuracy @ 25°C accuracy 0°C to 55°C TXK/XK(L) -200.0°C -150.0°C 800.0°C 1050.0°C ±0.6°C ±1.2°C Voltage -32511...
Page 738: Rtd Sbs
553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 140 Wiring diagram for the analog input thermocouple SB SB 1231 AI 1 x 16 bit thermocouple (6ES7 231-5QA30-0XB0) A.9.5 RTD SBs A.9.5.1 SB 1231 1 analog RTD input specifications Note To use this SB, your CPU firmware must be V2.0 or higher.
Page 739 553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 142 Analog inputs Technical data SB 1231 AI 1 x 16 bit RTD Number of inputs Type Module referenced RTD and Ohms Range See Selection tables (Page 740). Nominal range (data word) ...
Page 740: Selection Tables For The Sb 1231 Rtd
553BTechnical specifications A.9 Analog signal boards (SBs) Table A- 144 Wiring diagram for SB 1231 AI 1 x 16 bit RTD SB 1213 AI 1 x 16 bit RTD (6ES7 231-5PA30-0XB0) AI0 - ① Loop-back unused RTD input ② 2-wire RTD ③...
Page 741 553BTechnical specifications A.9 Analog signal boards (SBs) Temperature RTD type Under range Nominal Nominal Over range Normal Normal coefficient minimum range range maximum range range low limit high limit accuracy @ accuracy 25°C 0°C to 55°C Pt 0.003910 Pt 10 -273.2°C -240.0°C 1100.0°C...
Page 742 553BTechnical specifications A.9 Analog signal boards (SBs) Note The module reports 32767 on any activated channel with no sensor connected. If open wire detection is also enabled, the module flashes the appropriate red LEDs. When 500 Ω and 1000 Ω RTD ranges are used with other lower value resistors, the error may increase to two times the specified error.
Page 743: Communication Interfaces
553BTechnical specifications A.10 Communication interfaces A.10 Communication interfaces A.10.1 PROFIBUS Note S7-1200 PROFIBUS CMs and the GPRS CP are not approved for Maritime applications The following modules do not have Maritime approval:  CM 1242-5 PROFIBUS Slave module  CM 1243-5 PROFIBUS Master module ...
Page 744 553BTechnical specifications A.10 Communication interfaces Technical specifications Type of power supply Power supply from the backplane bus Current consumption (typical) 150 mA Effective power loss (typical) 0.75 W Dimensions and weights Width 30 mm   Height 100 mm  ...
Page 745 553BTechnical specifications A.10 Communication interfaces Technical specifications Ambient temperature during storage -40 °C to 70 °C   during transportation -40 °C to 70 °C   during operation with a vertical installation (DIN rail 0 °C to 55 °C ...
Page 746: Gprs
553BTechnical specifications A.10 Communication interfaces PROFIBUS interface Table A- 151 Pinout of the D-sub socket Description Description - not used - VP: Power supply +5 V only for bus terminating resistors; not for supplying external devices - not used - - not used - RxD/TxD-P: Data line B RxD/TxD-N: Data line A...
Page 747 553BTechnical specifications A.10 Communication interfaces A.10.2.1 CP 1242-7 Table A- 152 Technical specifications of the CP 1242-7 Technical specifications Order number 6GK7 242-7KX30-0XE0 Wireless interface Antenna connector SMA socket Nominal impedance 50 ohms Wireless connection Maximum transmit power GSM 850, class 4: +33 dBm ±2dBm ...
Page 748 553BTechnical specifications A.10 Communication interfaces Technical specifications 24 V DC power supply Min. cable cross section min.: 0.14 mm (AWG 25)   Max. cable cross section max.: 1.5 mm (AWG 15)   Tightening torque of the screw terminals 0.45 Nm (4 lb-in) ...
Page 749: Cm 1243-2 As-I Master
553BTechnical specifications A.10 Communication interfaces ANT794-4MR Weight Antenna incl. cable 310 g   Fittings 54 g   Installation With supplied bracket Technical specifications of the flat antenna ANT794-3M Order number 6NH9870-1AA00 Mobile wireless networks GSM 900 GSM 1800/1900 Frequency ranges 890 - 960 MHz 1710 - 1990 MHz...
Page 750: Electrical Connections Of The As-I Master Cm 1243-2
553BTechnical specifications A.10 Communication interfaces Technical data Conductor cross-section 0.2 mm² (AWG 24) ... 3.3 mm² (AWG 12) ASI connector tightening torque 0.56 Nm Permissible ambient conditions Ambient temperature During storage -40 °C ... 70 °C During transport -40 °C ... 70 °C During the operating phase, with vertical installation (horizontal standard mounting rail) 0 °C ...
Page 751 You will find additional information on connecting the AS-i cable in the section "Installation, connection and commissioning of the modules" in the manual “AS-i Master CM 1243-2 and AS-i data decoupling unit DCM 1271 for SIMATIC S7-1200”. Terminal assignment: Label...
Page 752: Rs232, Rs422, And Rs485
553BTechnical specifications A.10 Communication interfaces Additional information on the electrical connections Read section Auto hotspot for instructions on connecting the electrical connections. You can find technical details on the electrical connections in section Auto hotspot. A.10.4 RS232, RS422, and RS485 A.10.4.1 CB 1241 RS485 Specifications Note...
Page 753 553BTechnical specifications A.10 Communication interfaces Technical data CB 1241 RS485 Parity No parity (default), even, odd, Mark (parity bit always set to 1), Space (parity bit always set to 0) Number of stop bits 1 (default), 2 Flow control Not supported Wait time 0 to 65535 ms Table A- 156 Power supply...
Page 754: Cm 1241 Rs485 Specifications
553BTechnical specifications A.10 Communication interfaces A.10.4.2 CM 1241 RS485 Specifications Table A- 157 General specifications Technical data CM 1241 RS485 Order number 6ES7 241-1CH30-0XB0 Dimensions 30 x 100 x 75 mm Weight 150 grams Table A- 158 Transmitter and receiver Technical data CM 1241 RS485 Type...
Page 755: Cm 1241 Rs232 Specifications
553BTechnical specifications A.10 Communication interfaces Table A- 160 RS485 connector (female) Description Connector Description (female) Not connected 6 PWR +5V with 100 ohm series resistor: Output Not connected Not connected 3 TxD+ Signal B (RxD/TxD+): Input/Output 8 TXD- Signal A (RxD/TxD-): Input/Output 4 RTS Request to send (TTL level): Output Not connected...
Page 756: Cm 1241 Rs422/485 Specifications
553BTechnical specifications A.10 Communication interfaces Table A- 163 Power supply Technical data CM 1241 RS232 Power loss (dissipation) 1.1 W From +5 VDC 220 mA Table A- 164 RS232 connector (male) Description Connector Description (male) 1 DCD Data carrier detect: Input 6 DSR Data set ready: Input 2 RxD...
Page 757 553BTechnical specifications A.10 Communication interfaces Technical data CM 1241 RS422/485 Receiver threshold/sensitivity +/- 0.2 V min., 60 mV typical hysteresis Isolation 500 VAC, 1 minute RS485 signal to chassis ground RS485 signal to CPU logic common Cable length, shielded 1000 m max. (baud rate dependent) Baud rate 300 baud, 600 baud, 1.2 kbits, 2.4 kbits, 4.8 kbits, 9.6 kbits (default), 19.2 kbits, 38.4 kbits, 57.6 kbits, 76.8 kbits, 115.2 kbits,...
Page 758: Teleservice (Ts Adapter And Ts Adapter Modular)
553BTechnical specifications A.11 TeleService (TS Adapter and TS Adapter modular) A.11 TeleService (TS Adapter and TS Adapter modular) The following manuals contain the technical specification for the TS Adapter IE Basic and the TS Adapter modular: ● Industrial Software Engineering Tools Modular TS Adapter ●...
Page 759: I/O Expansion Cable
553BTechnical specifications A.14 I/O expansion cable 8 Position Simulator (6ES7 274-1XF30-0XA0) ① 24 VDC sensor power out 14 Position Simulator (6ES7 274-1XF30-0XA0) ① 24 VDC sensor power out A.14 I/O expansion cable Technical Data Order number 6ES7 290-6AA30-0XA0 Cable length Weight 200 g Refer to the installation section (Page 51) for information about installing and removing the...
Page 760: Companion Products
A.15 Companion products A.15.1 PM 1207 power module The PM 1207 is a power supply module for the SIMATIC S7-1200. It provides the following features: ● Input 120/230 VAC, output 24 VDC/2.5A ● Order number 6ESP 332-1SH71 For more information about this product and for the product documentation, refer to the customer support web site (http://www.siemens.com/automation/support-request).
Page 761: Calculating A Power Budget
Calculating a power budget The CPU has an internal power supply that provides power for the CPU itself, for any expansion modules, and for other 24 VDC user power requirements. There are four types of expansion modules: ● Signal modules (SM) are installed on the right-side of the CPU. Each CPU allows a maximum number of signal modules possible without regard to the power budget.
Page 762 554BCalculating a power budget Some of the 24V power input ports in the PLC system are interconnected, with a logic common circuit connecting multiple M terminals. The CPU 24V power supply input, the SM relay coil power input, and a non-isolated analog power supply input are examples of circuits that are interconnected when designated as not isolated in the data sheets.
Page 763 554BCalculating a power budget Table B- 1 Sample power budget CPU power budget 5 VDC 24 VDC CPU 1214C AC/DC/Relay 1600 mA 400 mA Minus System requirements 5 VDC 24 VDC CPU 1214C, 14 inputs 14 * 4 mA = 56 mA 1 SB 1223 2 x 24 VDC Input/ 2 x 24 50 mA 2 * 4 mA = 8 mA...
Page 764 554BCalculating a power budget S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 765: Order Numbers
Order numbers CPU modules Table C- 1 S7-1200 CPUs CPU models Order Number CPU 1211C CPU 1211C DC/DC/DC 6ES7 211-1AD30-0XB0 CPU 1211C AC/DC/Relay 6ES7 211-1BD30-0XB0 CPU 1211C DC/DC/Relay 6ES7 211-1HD30-0XB0 CPU 1212C CPU 1212C DC/DC/DC 6ES7 212-1AD30-0XB0 CPU 1212C AC/DC/Relay 6ES7 212-1BD30-0XB0 CPU 1212C DC/DC/Relay 6ES7 212-1HD30-0XB0...
Page 766: Communication
555BOrder numbers C.3 Communication Table C- 3 Signal modules (SMs) Signal modules Order Number Digital input SM 1221 8 x 24 VDC Input (Sink/Source) 6ES7 221-1BF30-0XB0 SM 1221 16 x 24 VDC Input (Sink/Source) 6ES7 221-1BH30-0XB0 Digital output SM 1222 8 x 24 VDC Output (Source) 6ES7 222-1BF30-0XB0 SM 1222 16 x 24 VDC Output (Source) 6ES7 222-1BH30-0XB0...
Page 767: Other Modules
555BOrder numbers C.4 Other modules Table C- 5 Communication board (CB) Communication board (CB) Order Number RS485 CB 1241 RS485 RS485 6ES7 241-1CH30-1XB0 Table C- 6 Communication Processor (CP) Communication processor (CP) Order Number CP 1242-7 GPRS 6GK7 242-7KX30-0XE0 Table C- 7 TeleService TS Adapter Order Number...
Page 768: Memory Cards
555BOrder numbers C.5 Memory cards Memory cards Table C- 11 Memory cards SIMATIC memory cards Order Number SIMATIC MC 2 MB 6ES7 954-8LB01-0AA0 SIMATIC MC 12 MB 6ES7 954-8LE01-0AA0 SIMATIC MC 24 MB 6ES7 954-8LF01-0AA0 Basic HMI devices Table C- 12 HMI devices HMI Basic Panels Order Number...
Page 769: Programming Software
555BOrder numbers C.8 Programming software Item Order Number 6 terminal, 4/pk 6ES7 292-1BF30-0XA0 7 terminal, 4/pk 6ES7 292-1BG30-0XA0 11 terminal, 4/pk 6ES7 292-1BL30-0XA0 Strain relief Strain Relief, CPU1200, Ethernet (4/pk) 6ES7 290-3AA30-0XA0 Programming software Table C- 14 Programming software SIMATIC software Order Number Programming software STEP 7 Basic V11...
Page 770 555BOrder numbers C.9 Documentation S7-1200 Programmable controller System Manual, 11/2011, A5E02486680-05...
Page 771: Index
Index status indicators, 634 step response times (CPU), 669, 677, 686 step response times (SB), 732 step response times (SM), 707 Analog signal (SM) ABS (absolute value), 190 SM 1232 AQ 4 x 14bit, 702 Analog signal board (SB) grounding, 58 SB 1231 AI 1 x 12 bit, 728 inductive loads, 59 SB 1231 AI 1 x 16 bit RTD, 738...
Page 772 Index CM 1243-2 AS-i Module Features, 452 organization blocks (OBs), 19, 61, 66, 68, 665, 673, ASIN (arc sine or inverse sine), 192 Assigning enum types, user-defined Web pages, 501 password protection, 154 ATEX approval, 658 single instance or multi-instance DB, 140 ATH (ASCII to hexadecimal), 251 size of the user program, 19, 61, 665, 673, 682 ATTACH, 273...
Page 773 Index block calls, 61 Communication board (CB) calling code blocks within the user program, 138 add modules, 112 capturing the status of a code block, 34 CB 1241 RS485, 753 copy protection, 156 comparison chart, 20 counters (quantity and memory requirements), 19, configuration of parameters, 115 665, 673, 682 device configuration, 109...
Page 774 Index Comparing code blocks, 641 Web server, 488 Comparison chart Contact information, 3 CPU models, 18 Control DB for user-defined Web pages HMI devices, 25 global commands, 526 modules, 20 parameter to WWW instruction, 508 Computer requirements, 27 request commands and states, 526 CONCAT (concatenate), 254 CONV (convert), 201 Configuration...
Page 775 Index cycle time monitoring, 73 run time meter, 237 device configuration, 109 RUN/STOP buttons, 34 displaying the MAC and IP addresses, 130 Security levels, 153 download, 157 signal board (SB), 22 download to device, 130 startup parameters, 102 empty transfer card, 107 startup processing, 65 enable outputs in STOP mode, 647 step response times, 669, 677, 686...
Page 776 Index valid DB numbers, 61 downloading in RUN mode, 650, 654 data block control, 310 DEC (decrement), 189 Data blocks for user-defined Web pages DECO (decode), 227 importing fragments, 504 Defining enum types, user-defined Web pages, 501 Data handling block (DHB), 141 DELETE (delete substring), 256 Data log Designing a PLC system, 135, 136...
Page 777 TDISCON, 408 Downloading TRCV, 408 displaying the MAC and IP addresses, 130 TRCV_C, 401 project, 157 TSEND, 408 Siemens security certificate to PC, 478, 490 TSEND_C, 401 user program, 157 TURCV, 416 user-defined Web page DBs, 509 TUSEND, 416 DPNRM_DG, 271...
Page 778 Index FILL_BLK, 199 Generating user-defined Web page DBs, 508 FIND (find substring), 259 GET, 460 First scan indicator, 79 configuring the connection, 119 Floating-point math, 192 Get LED status, 282 FLOOR, 205 GET_DIAG, 285 Flow control, 550 GetError, 223 configuration, 550 GetErrorID, 224 FM approval, 658 Global data block, 80, 141...
Page 779 LAD or FBD Identification standard Web page, 480 instructions, 31 Idle line, 553, 554 AND, 226 Importing Siemens security certificate, 490 AS-i Distributed I/O, 458 IN_RANGE (within a range), 184 ASIN (arc sine or inverse sine), 192 INC (increment), 189...
Page 780 Index clock, 235 GetError, 223 columns and headers, 32, 599 GetErrorID, 224 common parameters, 427 GO TO (SCL), 216 compare, 183 HSC (high-speed counter), 315, 317 CONCAT (concatenate), 254 HTA (Hex to ASCII), 252 CONTINUE (SCL), 214 IF-THEN (SCL), 210 CONV (convert), 201 IN_RANGE (within a range), 184 COS (cosine), 192...
Page 781 Index PROFINET Distributed I/O, 441 TAN (tangent), 192 program control (SCL), 209 TCON, 408 PUT, 460 TDISCON, 408 QRY_CINT (query cyclic interrupt), 278 time, 233 RALRM, 263 timer, 170 RCV_CFG (receive configuration), 537 timer operations, 174 RCV_PtP (receive Point-to-Point), 544 TOF (off-delay timer), 170 RCV_RST (receiver reset), 546 TON (on-delay timer), 170...
Page 782 Index ISO-on-TCP Local time connection configuration, 118 RD_LOC_T (read local time), 235 connection IDs, 396 Local/Partner connection, 394 parameters, 120 Logging in/out standard Web pages, 477 Lost password, 107 JavaScript restrictions, standard Web pages, 489 JMP, 217 JMP_LIST, 217 MAC address, 127, 130 JMPN, 217 Manual fragment DB control, 526 Manuals, 4...
Page 783 Index empty transfer card for a lost password, 107 SB 1231 AI 1 x 16 bit RTD, 738 inserting into CPU, 100 SB 1231 AI 1 x 16 bit Thermocouple signal lost password, 107 board, 734 operation, 99 SB 1232 AQ 1x12 bit, 731 order number, 758 signal board (SB), 22 overview, 99...
Page 784 Index airflow, 39 clearance, 39 Off-delay (TOF), 170 communication board (CB), 46 operation, 174 communication module (CM), 48 OK instruction, 185 cooling, 39 On-delay delay (TON), 170 CPU, 44 operation, 174 dimensions, 42 On-delay retentive (TONR), 170 expansion cable, 51 operation, 174 grounding, 58 Online...
Page 785 Index memory cards, 768 PM 1207 power supply, 767 overview, 324 programming software, 769 PID_3STEP, 331 Signal boards (SB), 765 PID_3Step algorithm, 325, 331 Signal modules (SM), 766 PID_Compact, 328 simulators, 768 PID_Compact algorithm, 325, 328 STEP 7, 769 visualization software, 769 add modules, 112 WinCC, 769 assigning an IP address to an online CPU, 125...
Page 786 Index errors, 535 configuring the IP address, 114 instructions, 561 connection IDs, 396 PtP example program, 563 CPU-to-CPU communication, 433 Port number, 399 device naming and addressing, 133 Port numbers diagnostics, 441 restricted, 429 Distributed I/O instructions, 441 PORT_CFG (port configuration), 534 DPRD_DAT, 269 Portal view, 28 DPWR_DAT, 269...
Page 787 Index linear and structured programs, 136 inserting instructions, 29 memory card, 99 instance data block (DB), 140 organization block (OB), 138 LAD (ladder), 144 password protection, 154 linear program, 136 priority class, 66 operating modes of the CPU, 63 resetting the start values of a DB, 644 organization block (OB), 138 restoring the status of a code block, 34 PID overview, 324...
Page 788 Index USS, 531 Receive message configuration, 553 PTO (pulse train output) PtP example program, 564 cannot be forced, 649 Receive parameters configuration, 437 configuring pulse channels, 290 Receive runtime return values, 544 CTRL_PWM, 287 Referencing enum types, user-defined Web pages, 501 operation, 289 Refreshing user-defined Web pages, 494 PtP communication, 531...
Page 789 Index add new device, 110 PROFIBUS address, 449 airflow, 39 PROFIBUS port, 449 AS-i, 454 PROFINET, 127 AS-i address, 454 program card, 105 AS-i port, 454 pulse outputs, 289 capturing the status of a code block, 34 resetting the start values of a DB, 644 capturing values of a DB, 644 restoring the status of a code block, 34 clearance, 39...
Page 790 Index CONCAT (concatenate), 254 MAX (maximum), 191 conditions, 147 MC_ChangeDynamic, 365 CONTINUE, 214 MC_CommandTable, 362 control statements, 147, 209, 210, 211, 212, 213, MC_Halt, 352 214, 215, 216 MC_Home, 350 CONV (convert), 201 MC_MoveAbsolute, 354 Conversion instructions, 202 MC_MoveJog, 360 COS (cosine), 192 MC_MoveRelative, 356 counters, 178...
Page 791 SGN_SET (set RS232 signals), 548 Simulators, 759 SHL and SHR (shift left and shift right), 231 SIN (sine), 192 Siemens security certificate, Web pages, 478, 490 Slave polling architecture, 562 Siemens technical support, 3 SM 1231 RTD siemens_automation_language cookie, 523...
Page 792 Index Software flow control, 551 SM 1231 AI 8 x 16 bit TC signal module, 709 Special characters SM 1231 AI 8 x 16 bit TC wiring diagram, 711 User-defined Web pages, 505 SM 1231 AI 8 x RTD x 16 bit signal module, 714 Specifications SM 1231 RTD 4 x 16 bit wiring diagram, 716 analog input representation (voltage), 669, 678,...
Page 793 Index AS-i, 454 startup processing, 65 AS-i port, 454 time synchronization property (PROFINET), 132 assigning an IP address to an online CPU, 125 transfer card, 99 block calls, 61 types of code blocks, 61 calling code blocks within the user program, 138 unplugged modules, 38 capturing the status of a code block, 34 valid FC, FB, and DB numbers, 61...
Page 794 Index monitor, 642 WR_SYS_T (write system time), 235 status, 642 Time delay interrupt), 279 TAN (tangent), 192 Time of day Task cards configuring the online CPU, 638 columns and headers, 32, 599 Time synchronization property, 132 TCON, 408 Time-error interrupt OB, 67 configuration, 118 Timers connection IDs, 396...
Page 795 Index restricted, 429 activating and deactivating from control DB, 526 TSEND, 408 AWP commands for accessing S7-1200 data, 494 connection IDs, 396 configuring, 507 TSEND_C, 435 creating fragments, 503 configuration, 118 creating with HTML editor, 493 connection IDs, 396 deleting program blocks, 508 connection parameters, 120 downloading corresponding DBs, 509 TSEND_C, 435...
Page 796 Index memory card does not contain force values, 99 XOR (exclusive OR), 226 monitor, 642 operation, 645 trigger values, 646 Watchdog, 221 Web pages STEP 7, 4 Web server, 473 constraints, 488 enabling, 474 Quotation mark conventions, 505 standard Web pages, 474 update rate, 474 Web server, user-defined Web pages, 492 Wiring diagrams...

This manual is also suitable for:

Simatic s7-1200

Siemens SIMATIC S7 System Manual

1 Product Overview

2 STEP 7 Programming Software

3 Installation

4 PLC Concepts

5 Device Configuration

6 Programming Concepts

7 Basic Instructions

8 Extended Instructions

9 Technology Instructions

10 Communication

Quick Links

Related Manuals for Siemens SIMATIC S7

Summary of Contents for Siemens SIMATIC S7