Part 3: Programming PLCs

3.1 Introduction into the PLC-simulator PLCSIM

Simulation of a S7-CPU with S7-PLCSIM
Siemens offers in the frame of STEP 7 software a S7-PLCSIM option package for the
simulation of the operation of an S7-CPU system. Using this option package, you can run
and test your programs on a simulated automation system that exists on your PC or
programming device (Soft-PLC). As the PLC simulation is completely integrated in the
STEP 7 software, no connection to S7-hardware, neither to CPU, nor to signal modules is
needed for the testing of PLC programs. With the simulated S7 target system PLCSIM allows
to test programs both for S7-300 as for S7-400 CPUs and thus to eliminate errors.
General properties of the PLCSIM
PLCSIM has a simple user interface to monitor and change various parameters that are used
in the simulated program, such as the switching on/off of inputs, the selection of numerical
values in different formats, etc. While the program is processed by the simulated CPU
various applications of the STEP 7 software, such as observing and manipulating of variables
using the variable table.
PLCSIM offers a graphical user interface to view and edit the variables of PLC programs. It
allows to execute the program in a single cycle mode or automatically continuously cycle-by
cycle in the simulated target system, or to change the operation mode of the simulated CPU.
Online access and test functions of STEP 7 programming tools can exactly be carried out as
with a real CPU. Thus, the complete test of the program can take place already in the
Program Development Office. S7-PLCSIM supports the following PLC programming
languages and software tools:
LD, FUP, IL
S7-GRAPH
S7-HiGraph
S7-SCL
CFC
WINCC
Figure 1 shows the window of PLCSIM after starting from the SIMATIC Manager

Fig. 1: the window of PLCSIM after starting

Applications of PLCSIM

The application areas of PLCSIM can be found mainly at the test of step 7-programs for
Simatic S7-300 and S7-400, as long as they cannot be tested directly on the destination
systems. This can have several reasons:
- It concerns small program modules that yet cannot be tested in the complete process
on the machine.
- An application is so critical, that damages for persons and machine are to be feared if
programming errors occur. Such errors to be already dispelled in advance by a
simulation..
- Another widely used application area of PLCSIM is the use for training and exercise
purposes, on the one hand due to cost reasons or if there is no hardware PLC
available
Memory areas of PLCSIM
Data in an automation system can be accessed through the addressing of specific memory
areas that perform specific functions. With PLCSIM during a simulation of a S7-CPU the
following memory areas can be accessed: inputs / outputs, memory areas, data blocks,
timers, counters, local data, etc. In table 1 below, you will find a compilation and short
description of the main memory areas available of the simulated CPU:
Memory areas

Description

T: Timer

2048 Timer: T 0 to T 2047

In this memory area the time rare realized.
2048 Counter: C 0 to C 2047
131.072 Bits (16 KB) in the area of bit-memory
131.072 Bits (16 KB)
corresponding to the complete addressable I/O area.
Enables direct access to peripheral In- and Output-modules.
Maximum: 131.072 Bits (16 KB)
Pre-installed: 8192 Bits ( = 1024 Bytes)
With this memory-area access to PII and PIO is possible. The values will
be actualized at begin of each cycle.
Maximum: 64 KB
2048 Function blocks (FB) and Functions (FC)
4095 Data blocks (DB): You also have access to data stored in data
blocks.
OB1 (free Cycle)
Many further organization blocks

C: Counter
M: Memory
PI, PO:
Periphery-areas of
Inputs and Outputs
I, O:
Process image of Inand Outputs
L: Local data
Code- and
Data blocks
Organization-blocks
(OB)

Table 1: Memory areas for PLCSIM

Functionalities in PLCSIM
PLCSIM is equipped with the following functions and properties that partly even go beyond
the functionalities of a real PLC:
-

An icon in the Simatic Manager

turns the simulation on or off. With a click
on the simulation button PLCSIM is called and a simulated CPU is opened. When
PLCSIM is activated, then each new connection is made automatically to the
simulated CPU.
The simulated automation system processes programs, both were written for the
CPUs of the S7-300 series as also of the S7-400 series.
Via sub-window you can access to storage areas of the inputs and outputs, the
bit-memory areas, timers and counters, as well as to accumulators and registers
of the simulated CPU. Memory accesses are possible also via symbolic
addressing.

The operating modes "STOP", "RUN" and "RUN-P" can be selected in same way
as with each real CPU. In addition, the simulation has the command "Halt" which
allows to interrupt the program execution at any time, without affecting the current
state of the program.
Of particular interest is, to automatically work with the timers. You can manually
set or reset a single time or reset all times together.
Generally, all commonly available STEP 7-tools can be used to observe the
activities of the simulated automation system, und thus to control and test the
programs.
Though the simulated system exists only in the software, but the STEP 7
programs works, except a few minor differences, as if the simulated CPU would
be a real S7 target system.

First Steps with PLCSIM

If you have no experience with PLCSIM, so the following procedure offers a way to get
started:
First, create a simple STEP 7 program, for example with the name "TESTSIM". To do this,
invoke the Simatic Manager. Select under the menu 'File' the item Wizard 'New project'.
Click on "Next" and select a CPU, for example the CPU314. Again with click on "Continue"
you can select the cyclically running organization block OB1. After pressing "next" insert into
the top line your project name TESTSIM. Now you can finish your new project. Your project
window "Simatic Manager TESTSIM" appears with only one single program block OB1, as
shown in Figure 3.

Fig. 3: Project window for the test project

Enter the Program
After double-click on program OB1 the Editor window to edit a program appears. Choose in
menu "representation" the "LD" in order to program segment 1 in ladder diagram
representation. Then, using the well known LD-symbols enter the simple program shown in
Figure 4 to set or reset a bit-memory. It is recommended to save the program after entering,
either with the menu sequence file > save or a click on the symbol for Save.
Call PLCSIM
If you would like to test your program without having access to a hardware PLC, you must
first call the Simulator PLCSIM. Click to the simulator icon
( simulation on/off) on the
right hand side of the function bar.
S7-PLCSIM will open its "CPU" window, as shown in Figure 1 above and the application
starts with the default MPI address 2. Now, instead of a hardware-PLC, the SIMATIC
3

Manager has access to the computer internal PLCSIM. All programs of your STEP 7 project
are loaded into the simulated automation system.
What still is missing for testing a program is a possibility, to manipulate the program flow with
the help of simulated input signals at the addresses I0.0 - I0.2 and at the same time to
observe the impact of the program on the signal states of memory bit M1.0 and the output
Q0.0.

Fig. 4: The program TESTSIM, 1st version

PLCSIM Simulation Window

The simulation window of PLCSIM (see Figure 1) includes the central workspace (to edit
your program), the title bar (top of the screen), the status bar (at the bottom of the picture),
some elements to operate the sub-windows, the menus (simulation, edit, view..., help) as
well as the toolbars with the symbol groups "Standard", "Insert", "CPU mode" etc.
Sub-window "CPU"
If you work the first time with PLCSIM, after calling the Simulator, first the sub-window "CPU"
appears in the central workspace, according Figure 5. This window appears every time when
you open a simulation. In the "CPU" sub-window, status and operation modes of the
simulated CPU are displayed. You can change the operation modes the same way, like it is
carried out with the key switch on a real CPU.

Fig. 5: the sub-window "CPU"

4

The operation modes of the CPU

As with a real PLC system PLCSIM allows a choice of different operation modes for the CPU.
The control switches (control box) for selecting the operation modes (RUN-P, RUN and
STOP) and the switch button for a general reset (MRES) are located in the "CPU" window,
along with the LED displays for RUN, STOP etc. corresponding to a "real" CPU, see fig. 5.
The simulator reacts to changes of the operation mode just like a real PLC. To change the
operating mode, click to the appropriate control button. The LEDs in the left part of the
window react accordingly to the mode selector.
Further Sub-Windows of PLCSIM
Now you can open different other sub-windows in the workspace, in order to manipulate and
observe all relevant data areas of your simulated automation project.
Opening Sub-Windows
In order to monitor and manipulate relevant variables of the simulated project, sub-windows
can be called for inputs, outputs, memory areas, timers, counters etc. Open these windows
either under the menu item "Insert" or by clicking on one of the corresponding icons in the
toolbar, shown in Fig. 6. As shown, seven sub-windows enable you to monitor and change
variables of the current program in the simulator. In table 3, you will find a compilation of
these sub-windows with their explanations and possibilities of application.

C
Insert Vertical Bits
Insert General Variable
Insert Counter
Insert Timer
Insert Memory
Insert Output
Insert Input

Fig. 6: Symbols for opening Sub-Windows

Menue Insert

explanations of application

Insert Input
Insert Output
Insert Memory
Insert Timer
Insert Counter
Insert
general variable
Insert
vertical Bits

Data of the process image of inputs (I). Default address: Byte 0 (IB0).
Data of the process image of outputs (Q). Default address: Byte 0 (QB0).
Data of the memory area (M). Default address: Byte 0 (MB0).
Timers to be used by the program. Default timer is T0.
Counters to be used by the program. Default counter is C0.
Any operand area of the simulated CPU, including datablocks (DBs).
Any operand area of the simulated CPU, except timer and counter.
In the sub-window "Vertical Bits" only Bytes will be indicated (from inputs, outputs,
memory or data blocks). The bits of a Byte are arranged vertically. Addressing is
also possible with symbolic addressing.

Table 3: Sub-Windows to open via the menu Insert

Insert sub-window Inputs

In order to test the program click to the icon Insert Input (fig. 5). The address IB 0 will
automatically appear in the address field. The contents of IB 0 is automatically indicated as a
bit pattern. IB0 byte contains the inputs used in our program I0.0 to I0.2. You can also display
the inputs in the window "Vertical Bits", but have to add the address IB 0 yourself.
Insert sub-window Outputs
Click to the icon Insert Output (fig. 5). Now the address QB 0 will appear in the address
field. The contents of QB 0 is again displayed as a bit pattern. In QB 0 you will find the output
Q0.0 used in our program. You can also display the outputs in the window "Vertical Bits", but
have to add the address QB 0 yourself.
Insert sub-window Memory
In a similar way you can insert the sub-window Memory. In this window, you have access to
the variables stored in the memory area (M) of the CPU. This area is used for storing
intermediate results and auxiliary variables, which are determined and required by the
program. You can monitor and also change the status of the memory flags in this window.
The address MB 0 automatically appears in the address field and the contents of MB 0 is
indicated as a bit pattern. However as you want to monitor the status of memory M1.0 you
must change the byte address to MB 1. Now the result should be a simulator window as
shown in Figure 7.

Fig. 7: Simulator with the sub-windows for in-/outputs and a memory byte
Download of the program
Now, all preparations are made to transfer the program of OB1 into the program load
memory of the simulated CPU. To transfer the folder "Program Blocks" (in this case it
contains only the block OB1) into the simulated PLC click on the load symbol
You can find the load icon in the Editor window, see Figure 4. Now you can
program loaded into the simulated CPU.

run the

Program Execution
With a click on the control box "RUN" or "RUN-P" in the CPU you can start the simulated
CPU in the RUN mode. With another click on bit 1 of IB0 you simulate the switching on of
input I0. 1 (the signal of I0.2 is negated and therefore must be switched off). A small hook ()
in the box of I0.1 indicates that I0.1 is in the binary state "1". Now watch the effects on the
memory bit M1.0 and output Q0.0: both show the hook symbol indicating that they were
switched on. With another click on the box of input I0.1 you will reset this input variable back
to the state of "0". M1.0 and A0.0 however remain in the state "1", since M1.0 has been set
6

permanently as a bit memory. Only by clicking on I0.0 you bring the reset variable to "1", and
hence M1.0 and Q0.0 will be reset again.
Monitoring of the program in the Editor
You can monitor and test the simulation of your program in well known manner. Proceed as
follows:
- Open the editor window of OB1 with your ladder program.
- click to the spectacle icon.
If the simulated CPU is in the RUN mode, then you can watch the binary signal states by
changing colours: green for signal state "1" or dashed blue for signal state "0". Watch how
the signal changes at the inputs affect the other program variables.
With an appropriate arrangement of editor and simulator window, you can at the same time
switch the inputs in the simulator and watch the effects in the editor window. This status test
works the same way as you are used to when working with a real PLC.
The simulation processing the program can be stopped by a click on "STOP" in the CPU
window control box. At the bottom of the window, the red highlighted box confirms the STOP
mode.
Exit simulation
To exit the simulation proceed as following:
In the simulator window, click in the editor or SIMATIC Manager the simulator icon
(simulation on/off).

3.2 Representation of Data

Abstract:

The chapter provides an introduction to, and overview of the data types used
to represent the variables in STEP 7 programs. The chapter first introduces
into elementary data types and corresponding constant representations. A
further section is concerned with complex data types and one more chapter
explains how to represent numbers digitally in different number formats.

3.2.1 Elementary Data Types

General
Data types determine the characteristics and features of variables, especially their length (in
number of bits), their structure and permissible ranges. The data types are directly linked to
specific groups of STEP 7 operations permissible to them. Any declaration of variables and
constants is connected with an assignment to a corresponding data type. The declaration of
variables makes use of specific key-words, defining exactly data length and format of the
data types. On principle any variable is combined with an address or name and a data type
that will occupy a storage location of suitable size (of bit positions) in the storage device of
the CPU. All data types, corresponding to the standard DIN EN 61131-3, are globally valid
and thus can be used in any program block.
The Standard DIN EN 61131-3
The goal of the international standard DIN EN 61131-3 (adoption 1992) is to harmonize the
programming of PLCs. Hence the standard defines common elements like data types,
variables, and program organization units POUs- as well as five different programming
languages. The long-term objective of the international organization PLCopen, that
enhances this standard, is the portability of PLC software between the products of different
7

PLC manufacturers. This would guarantee exchange and re-use of functions and function
blocks between the systems of different manufacturers. Though this goal is not yet achieved,
meantime most of the manufacturers are in compliance with this standard.
Data Types according to DIN EN 61131-3
All data (variables, constants etc.) of a users program must be identified and declared by
certain data types. According to the programming standard DIN EN 61131-3 there are
different types of data as:
o
o
o

Elementary Data Types (up to 32 bits)

Complex (compound) Data Types - as combinations of other types like Elementary
Data Types (e.g. ARRAY, STRUCT) and
User-Defined Data Types (UDT), which will be given a name and suitable structure by
the user with the declaration procedure.

By allocating a variable to an appropriate data type its size, structure and binary keying is
determined. The advantages of a consequent declaration of data are:
o
o
o
o

Programs will become more clear and better to be understood

All variables can be submit to compatibility checks
Data of the same type can be administrated commonly
User-Defined Data Types (UDT) enables the user in an efficient way to set up data
blocks with identical data structures.

Elementary Data Types

Variables and constants of elementary data types have a maximum length of a double word
(DWORD), corresponding to 4 bytes or 32 bits. Elementary data types can occupy
o
o
o
o

one bit (type BOOL),

one byte (type BYTE, 8 bits),
one word (type WORD, 2 bytes = 16 bits) or
one double word (type DWORD, 2 words = 4 bytes = 32 bits).

The elementary data types can be processed therefore either with binary logic operations for
the type BOOL, or with load- and transfer functions for the types BYTE, WORD and
DWORD.
Choice of Elementary Data Types
Each elementary data type has a defined length, a range with lower and upper limits and a
binary structure. The user may select between the following elementary types:
o
o
o
o
o
o
o
o
o
o
o
o
(*)

BOOL (binary variable),

BYTE (8 bits),
WORD (2 bytes = 16 bits),
DWORD (double word 4 bytes = 32 bits),
INT (integer whole numbers, 16 bits) (*)
DINT (double integer, 32 bits),
REAL (floating point number) (*)
S5TIME (SIMATIC time) - see also: 4.4 Timer Functions
TIME (IEC time in steps of 1 ms),
DATE (IEC date in steps of 1 day),
TIME_OF_DAY (time in steps of 1 ms) and
CHAR (character).

see also: 7.1 Digital Representation of numbers

8

In table 1 the elementary data types available at STEP 7 are listed together with their ranges.

3.2.2 Complex Data Types

Complex data types define data groups that are larger than 32 bits or data groups consisting
of other (e.g. elementary) data types. STEP 7 provides the following complex data types:

DATE_AND_TIME
STRING
ARRAY
STRUCT
UDT (User-Defined Data Types (*))
FBs and SFBs

(*)

User-Defined Data Types UDT.

UDTs can be used for structuring of large uniform sets of data, normally applied with data
blocks. They can be generated with the programming tool Data Block Editor of the STEP 7
editor. Within UDTs symbolic names, data types, initial values and comments for a multitude
of different variables are determined. The data type UDT was provided by the standard IEC
61131-3 as a self-defined (derived) data type.

Data
Type

Size
(bits)

Description

Range and Number

Notation

Example

BOOL
BYTE

1
8

Boolean
8 bit binary
number
Hexadecimal
number
One ASCII
Character
16 bit binary
number

TRUE / FALSE
2#0000_0000 to
2#1111_1111
B#16#00 to B#16#FF
16#00 to 16#FF
A, B, etc. Z

FALSE
L 2#1001_0011

CHAR

WORD

16

DWORD

32

INT

16

DINT

32

REAL

32

S5#time

16

TIME

32

DATE

16

TIME_O
F_DAY
(*)

32

16 bit HEX
number
BCD value,
Count value
Two 8 bit
unsigned decimal numbers
32 bit binary
number
32 bit HEX
number
BCD value
Four 8 bit
unsigned decimal numbers
Fixed-point
number
Fixed-point
number
IEEE Floatingpoint number
Time value in
S7 format
IEC time in
steps of 1 ms
IEC date in
steps of 1 day
Time in steps
of 1 ms

2#0000_0000_0000_0000
to
2#1111_1111_1111_1111
W#16#0000 to W#16#FFFF
16#0000 to 16#FFFF
C#000 to C#999

L B#16#3C
Printable characters,
e.g. L C
L 2#1000_1101_0001_0000
L W#16#A23F
L C#355

B(0,0) to B(255,255)

L B#(15,55)

2#0000_0000 .
0000_0000 to
2#1111_1111 .
1111_1111
DW#16#0000_0000 to
DW#16#FFFF_FFFF
+/- 000 0000 to +/- 999 9999
B(0,0,0,0) to
B(255,255,255,255)

L
2#1010_0101_1101_0010_
1001_0111_0001_0000

- 32 768 to + 32 767

L
L
L
L
L
L
L

L#-2 147 483 648 to L#+2

147 483 647
Upper limit:
3.402 823e+38
Lower limit:
1.175 495e-38
S5T#10ms to
S5T#2h46m30s
T#24d20h31m23s647ms
D#1990-01-01 to
D#2168-12-31
TOD#00:00:00.000 to
TIME_OF_DAY#23:59:59.99
9

(*)

L DW#16#AF02_BCD4
L DW#16#0350_9943
L B#(22,14,100,220)
1
L -35
-2316 L 56
L#-5
L#462 778
3.54e+7
234.17
1.28e-12

L S5T#5m30s
L T#2d3h20m0s0ms
L D#1998-5-12
L D#2003-4-16
L TOD#3:15:40.5

Time in steps of 1ms: Hours (0 -23), minutes (0 -59), seconds (0 - 59), and milliseconds (0 - 999)

Table 1: Overview of Elementary Data Types for STEP 7

The Use of Complex Data Types
Complex data types can be used in conjunction with variables in data blocks (see chapter 8
Data Blocks) or with variables, which are block parameters. But these data types can only
be applied to block parameters as complete variables. It is not possible to process individual
sections with normal statements, like L (Load). However with the methods of indirect
addressing (see chapter 7 Indirect Addressing) it is possible to manipulate the variables, if
their internal structure is known. The following table 2 describes the complex data types.

10

Structures and arrays may be defined either in the variable declaration of a program block or
in a data block.
Data Type
Date_and_Time
DT

STRING

ARRAY

STRUCT

UDT

FB, SFB

Description
Defines an area with 64 bits (8 bytes).
This data type is saved in binary coded
decimal format (BCD)
Defines a group of maximum 254
characters (data type CHAR, ASCII).
The standard area reserved for a
character string is 256 bytes long. This
is the space required to save 254
characters and a header of 2 bytes.
You can reduce the memory required for
a string by defining the number of
characters that have to be stored in the
character string.
Defines a multi-dimensional grouping of
the same data type (either elementary
or complex). You access the data stored
in an array using the index . Up to a
maximum of 6 dimensions can be
defined in one array. The index can be
any integer between -32 768 to +32 767.
Defines a grouping of any combination
of data types. Up to 6 nesting levels are
possible. For example you can define an
array of structures or a structure of
structures and arrays.
Simplifies the structuring of large
quantities of data and entering data
types when creating data blocks or
declaring variables in the variable
declaration. In STEP 7 complex and
elementary data types can be combined
to create own user defined data types.
UDTs have their own name and can
therefore be used more than once.
You determine the structure of the
assigned instance data block and allow
the transfer of instance data for several
FB calls in one instance DB.

Examples
DT#2007-01-0100:00:00.000
DT#2008-12-3123:59:59.999
Error_Motor_1
Valve_5_closed

Values: ARRAY [1..4]

OF REAL
ARRAY [1..2, 1..3] OF
INT
(defines an array of
integers in the format
2 x 3).
Measured values:
STRUCT
Temperature: INT;
Pressure
: REAL;
END_STRUCT;

Table 2: Complex data types

3.3 Addressing and Declaration of Variables

A program block in STL (Statement List) or IL (Instruction List) representation is composed of
a sequence of STEP 7 statements. Thus, the statements are the basic elements of an L
program. A statement is made up of

11

- a label (optional), consisting of up tp 4 characters and terminated by a colon :

- the instruction code, describing the operation the CPU has to execute
- an operand-part, which determines via an address the operand or the variable for
execution of the operation
- comments (optional), separated from the preceding statement parts by two slashes //
(see structure of a statement below).
Structure of a STEP 7 statement:
Label
M001:

Instruct. Code

Operand/Variable (addr.)

O
AN

I
M

Comments

4.3
12.7

//OR combination
//memory bit 12.7

3.3.1 Declaration of Variables

A variable can be regarded as one memory cell with a name (=address) of a memory area,
which is used for the storage of user programs data. Operands or variables are components
of the statements and are specified by their address and type of data. The following diagram
of fig. 1 below shows the typical structure of variables and their components.
Variable

Address + Data Type

Address Identifier + Data length + Memory location

Fig. 1: Variables - structure and components
Addressing of variables
The address identifier determines the kind of operand, such as I for Input, Q for Output or
M for Memory. The data length specifies the number of bits or bytes of an operand, such as
B for byte, W for word, D for double word. The data length is associated with the data
type. According to DIN EN 61131-3, standard single bit variables (data type BOOL) should be
specified by the prefix X. But STEP 7 uses no identifier for single bit operands (I 4.7, M
3.1 or Q 9.5) and thus, in this matter, doesnt fully comply with the international standard.
The memory location of the variable finally specifies the (starting) byte address or, in case of
single bit operands, also the bit number within the byte.
Byte Address in Words and Double Words.
The storage location or absolute address of a variable is generally determined by ist leading
byte address. In case of a 1-bit operand also the bit position (bit number 0 ..7) within the byte
has to be specified. The address identifier given to the operand of a load- (e.g. L IW 4) or
transfer-function (e.g. T MD 12) will always point to the lowest byte address number of a
word or double word. The following schematic shows the address-related composition of
words and double words:
D2

Double words
Words
Bytes

D4

D0
W0
B0 W6 B1
W1

W2
B2

W4
B3

B4
W3

B5

B6

B7

W5
12

Fig. 2: Addressing words and double words in units of bytes

Examples:
The following examples show the principles to address variables of data types BOOL, BYTE,
WORD and DWORD.
Variables of type BOOL:
Variables of data type BOOL are addressed via an address identifier (I, Q, M.), a
byte number 0, 1, 2, . (*) and separated by a decimal point a bit number (0 .. 7).
I 3.6
Q 8.2

Input bit no. 6 in byte no. 3

Output bit no. 2 in byte no. 8

Variables of type BYTE:

Variables of data type BYTE are referenced via an address identifier (I, Q, M.),
supplemented by B (data width BYTE) and the byte number 0, 1, 2, .. (*)
IB 4
QB 2

Input byte no. 4

Output byte no. 2
(*)

(input bits I 4.0 to I 4.7)

(output bits Q 2.0 to Q 2.7)

The upper limit of the byte number is specific to the CPU in use.

Variables of type WORD:

Variables of data type WORD consist of two bytes. They are referenced via an
address identifier (I, Q, M.), supplemented by W (data width WORD) and the byte
number of the high-order byte (0, 1, 2, .).
MW 20

Memory word no. 20

(contains memory bytes MB 20

and MB 21) (**)

IW

Input word no. 6

(contains input bytes IB 6

and IB 7) (**)

(**)

Consider: The byte with the lower address number MB20, IB 6 is the highorder byte (higher binary values), whereas the byte with the higher address number
MB21, IB 7 is the low-order byte (lower binary values).
Variables of type DWORD:
Variables of data type DWORD consist of four bytes. They are referenced via an
address identifier (I, Q, M.), supplemented by D (data width DWORD) and the
byte number of the high-order byte (0, 1, 2, .).
MD 40

Memory double word no. 40

(contains 4 memory bytes

MB 40 to MB 43) (***)

QD 12

Output double word no. 12

(contains 4 output bytes

QB 12 to QB 15) (***)

(***)

Consider: The bytes with the lowest address numbers MB40, QB 12 are the
highest-order bytes (highest binary values), whereas the bytes with the highest
address numbers MB 43, QB 15 are the lowest-order bytes (lowest binary
values).
Exercises:
1. The input double word ID 8 is composed of 4 bytes, see schematic below.
13

a)
b)
c)
d)

Determine the four byte numbers.

Mark input I 10.7 by a cross (x)
Mark input I 11.1 by a circle (O)
Mark input word IW 9 using some color

Byte no. ?

2. An Input module for 16 digital inputs includes the address bytes IB 5 and IB 6, see fig. a)
below. Some inputs have been switched to 1 , the rest is switched off .
Byte no. .?

I 5.0

Byte no. .?

Fig. b)
Represent the bit pattern of the input module (Fig. a) in the
contents of the input word IW 5 by entering the corresponding
signals 0 and 1 into Fig. b).

IB 5

I 5.7
I 6.0

IB 6

I 6.7

Fig. a)

Loading Constants to the ACCU 1

Normally constants are used to preset variables to a fixed value. With the Load-operation
(see also chapter 7.1 Move Functions) a constant can be loaded into the Accumulator 1 for
further processing. With their declaration the constants are fixed to a certain data type. All
constants, which can be loaded into the Accumulator 1, are of data type elementary, which
requires not more than 32 bits. In many cases the constant is given a specific prefix, such as
L, W, D or S5T in order to determine the data type. The following table shows a selection of
constant formats used in STEP 7 programming.
STEP 7 Constant Format
L 1314
L
L
L
L

Explanation
Loads a positive 16 Bit INTEGER (INT) constant,
Range: -32 768 to + 32 767
-5
Loads a negative 16 Bit INTEGER (INT) constant
L#+5
(L: Long integer) Loads a 32 Bit INTEGER (DINT) constant
Range: -2 147 483 648 to +2 147 483 647
2.0e+3
Loads a floating-point constant (REAL, 32 Bit)
(exponential expression)
1234.567
Loads a floating-point constant (REAL, 32 Bit)
14

L
L
L
L
L
L
L
L
L

W#16#ABCD
D#16#F1DA_B23A
ABCD
S5T#2h46m30s
C#126
2#1001 1001 1001 1001
2#1011 0111 1101 0011
0001 1010 1101 0010
B#16#7F
B#(85)

L
L
L
L

B#(12, 34)
B#(12, 34, 56, 78)
P#12.3
D#2001-02-09

Loads a 16 Bit Hex-constant

Loads a 32 Bit Hex-constant
Loads 4 characters (ASCII code)
Loads a timer constant (S5TIME, 16 Bit)
Loads a (BCD) counter constant (16 Bit)
Loads a 16 Bit binary constant
Loads a 32 Bit binary constant
Loading one Byte as a 8 Bit Hex-constant
Loading one Byte as a 8-bit unsigned decimal
number
Loads 2 Bytes as 8-bit unsigned decimal numbers
Loads 4 Bytes as 8-bit unsigned decimal numbers
Loads a Pointer (32 Bit)
Loads a Date, year-month-day, 16 Bit

Table 3: Constant formats used for load operations

For more details related to special constant formats like timer constants (S5TIME) or (BCD)
counter constants see the corresponding chapters (4.4 Timer Functions and 4.5 Counter
Functions).

3.3.3 Symbolic Addressing of Variables

In your STEP 7 program normally you work with absolute addresses for the variables like for
inputs (I 4.3), outputs (Q 2.7), memories, timers (T 12) or even program blocks (FC 4, FB
32). But in order to make the program easier to read and understand, it is recommended to
use meaningful names (symbols) for the variables. Symbolic addressing uses names instead
of the absolute addresses.
Global and local data
For symbolic addressing, a distinction is made between local and global symbols. Thus
variables of elementary data type can be declared either globally in the symbol table or
locally in the declaration section of a program block (function, function block). Global data are
valid for all blocks of a STEP 7 project; local data are valid only for the block they were
declared for as block parameters. The same local variable names can be used in different
blocks for totally different purpose. See also: 3.2 Block Functions and Program Structure Block Parameters for FCs and FBs. In contrary, a global symbol is known throughout the
whole program and has always the same meaning in all program blocks.
Symbol Table
Global symbols are defined in the symbol table, which is not part of a special program block,
but valid for all program blocks. There is only one symbol table in a complete STEP 7
program. A global symbol (variable name) must start with an alpha character and may have
up to 24 characters. It can contain spaces, numbers or special characters. When
programming the global symbols must be enclosed in inverted commas, in order to
distinguish them from operation codes or other kinds of variables.
An entry of a symbolic variable in the symbol table consists of 4 elements:
o

The symbol name (up to 24 characters)

o The absolute address to be associated

o
o

The data type

and an optional comment.

15

The data type is an essential part of the definition of a symbol (see elementary data types). It
defines specific properties of the data behind of the symbol, like binary length of the data,
structure and binary encoding. The optional symbol comment can be up to 80 characters
long. See: Example of a symbol table.
No.
1
2
3
4
5
6
7

Symbol
START
AUTO
Quantity_1
Result
Delay
Duration
Mot_1_on

Address
I 2.4
M 10.0
MW 22
MD 30
T
14
MW 40
Q 4.2

Data Type
BOOL
BOOL
INT
REAL
TIMER
S5TIME
BOOL

Comment
Start operation
Automatic operation
Number of produced work pieces
Weight of produced pieces
Timer for start delay
Duration of start delay
Motor 1 running

Table 4: Example of a symbol table

Symbolic Data in Data Blocks
Also the elements of data blocks can be addressed by a special symbolic addressing mode.
In this case the data element and the data block as well must be addressed by symbolic
names. The symbolic name of the data block is defined within the symbol table, whereas the
name and type of data elements must be given when editing the data block (see: 8 Data
Blocks). This mode of complete addressing is only possible with global data blocks, not with
instance data blocks connected to function blocks. The two symbolic address-parts (data
block and data element) are separated by a decimal point: DATA_BLOCK.DATA_ELEMENT.
The following table gives some examples of symbolic addressing of data elements in data
blocks.
Absolute Addressing
AN
DB 16. DBX 8.3
T
DB 4.DBD 20
L
DB 12.DBW 3
=
DB 16.DBX
3.4

Symbolic Addressing
AN Alarms.MOT_Stop
T
Pump_1.Speed
L
Values.Number_1
=
Alarms.Stop_Switch_4

Comments
Checking of a Data bit
Save value in a Data-Double Word
Load INTEGER-Value from DB 12
Assign the RLO to Data bit
Stop_Switch_4 of Data Block
Alarms

Table 5: Symbolic addressing of data elements in data blocks.

Solutions for the examples:

Examle 1:
Byte Nr. ..IB 8

IB 9

IB 10

IB 11

O
O

IW 9
Examle 2:

Byte no. 5
1 0 1

Byte no. 6

0 0 0 1 0 0 1 0

0 0 0 1 1

3.4 Program Blocks in STEP 7

16

Abstract: The chapter gives an introduction to and overview of the STEP 7 program
structure, where other, higher-ranking blocks will call program blocks conditionally
or unconditionally. Furthermore the different types of STEP 7 blocks, like
organization blocks (OB), functions (FC) and function blocks (FB) are explained.
Block parameters, enabling the data transfer between calling block and called
block, and block end operations are topics of this chapter too.
The total software of an automation system is divided into two main sections:
-

the operating system and

the user programs

The operating system is responsible for all functions and tasks of the CPU, which are not
associated with a specific user application. These tasks include:
-

The periodic processing of the process images for the input and output ranges
(PII, PIQ)
The call of cyclical, time and alarm-driven organization blocks (OBs)
Start-up routines when switching on the mains power or actuating the mode
switch on the CPUs front panel from STOP to RUN (OB 100, OB 101)
Error detection and error handling
Communication with the peripheral modules (input/output) and the programming
device via the MPI-interface
Management of the users and system memory areas

3.4.1 Structured programming

Complex automation tasks can be better programmed, if they are divided into smaller tasks,
which also correspond to the different technological sup-processes of the total automation
project. So the user program will be subdivided into many sections in order to make it easier
to read and understand it. In the user program, these tasks or program sections are
represented by corresponding program modules, the so called program blocks. Also the
possibility of multiple reuses of these program modules should not be neglected. This kind of
programming is called "Structured programming". Special program modules like functions
(FC) and function blocks (FB) generally facilitate creating frequently recurring complex
program sequences, which should be related to a technological or functional basis. In the
following sections the importance of the functions and function blocks will be discussed when
creating user programs and also in which way these blocks differ from each other.
Different Block Types
STEP 7 provides different block types intended for different kinds of tasks:
- User blocks:
- System blocks:
- Standard blocks:

These blocks contain user programs and user data as well.

These blocks contain system programs and also system data.
These blocks are available either on a storage medium (CD)
or are contained in libraries which are delivered as a part of
the STEP 7 packages.

User program
The entity of all code blocks like functions (FC) or function blocks (FB) forms the user
program. Blocks are defined components of the user program by their function, their
structure or their way of use. In order to be executed, they have to be called from

17

organization blocks, or other blocks. Thus, organization blocks form the interface between
the operating system of CPU and the user program.
User Blocks
Depending on the type of application there is a choice of different block types like
-

Organization Blocks (OB)

functions (FC) or
function blocks (FB),

which are processed by the CPU dependent on certain events. Such events could be the
detection of a program- or hardware-error, some interrupts from the process via peripheral
devices or an internal CPU timer (watchdog or time-of-day interrupts etc.).
Variety of blocks
All user programs and the necessary data are stored in blocks. Code-blocks contain the user
programs and corresponding data are stored in data-blocks. In STEP 7 the following kinds of
blocks as listed below are available:

Program blocks
Organization Block
Function Block
System Function Block
Function
Datablock
System datablock

Identifier Function
OB
Interface to Operation System
FB
Block with allocated memory and possibility of
parameter transfer
SFB
predefined FB, integrated in Operation System
FC
Block without allocated memory, but possibility
of parameter transfer
DB
Block for storage of users program data
SDB
Data Block, containing system relevant data,
such as configuration and parameter data of the
hardware modules. The STEP 7 software
generates and manages these blocks.

Table 2: blocks available in STEP 7

Blocks of STEP 7
Code blocks (program)

Organization blocks Functio blocks Functions

OB
FB
FC

Data blocks (data)

Global datablocks
DB

Instance datablocks
DI

Belong together

3.4.2. Organization Blocks (OB)

18

Organization blocks serve at STEP 7 as an interface between the operating system and the
user program. They correspond to the "tasks" of the IEC 61131-3 to the controlled calls of
user programs. The CPUs operating system calls the OBs when specific events occur, for
example in the event of a hardware or time-of-day interrupt. Depending on the purpose
different classes of OBs can be selected by the user. Their use is controlled by different
priorities. So each type of OB is equipped with its own priority and can interrupt OBs with
lower priority. OBs with the same priority will not interrupt each other, but will be called by the
operating system and executed according to their recognized sequence.
STEP 7 knows organization blocks for:
-cyclic program processing (only OB 1)
-time-driven program processing (clock-, delay- and watchdog-alarms)
-event-driven program processing (process alerts, errors HW/SW)
- and for the start-up (start up routine OBs)
Main Program call by OB1
The main program is always in organization block OB1, which is cyclically called by the
operating system. The repetitive cyclic program execution is the normal mode for processing
a user program in the "RUN" mode. Thus, to achieve a cyclical execution for the user
program you write it into the OB1 or other blocks, called directly or indirectly by the OB1.
Figure 2 shows the call hierarchy of a cyclic program execution by the OB1.

Operationsystem

OB 1

FB

FC

FB

FB

FC

Fig. 2: Hierarchical call of blocks

Priorities
As already mentioned, programs which are activated by certain events or via timing elements,
are assigned priority classes. Thus, the sequence of processing is regulated, as well as the
mutual interuptibility, once various events will happen simultaneously. The program with the
lowest priority is the cyclically running main program of the OB1. Any other event can
interrupt this main program at any point and any moment. The CPU then will execute an
"interrupt-service or an error routine, but then returns to the main program.
Table 3 lists the most important S7-organization blocks, each with ist priority. In some priority
classes, except the priority of OB1, you can change the assigned priority when the CPU is
parameterized by the user.
Call circunstances
Cyclic call by operating syst.
TOD (time of day) interrupts
Time-delay interrupts
Watchdog interrupts
Process interrupts
Communication interrupts
Asynchronous errors
Startup routine
Synchronous errors

OB-Nr.
1 (free cycle)
10 to 17
20 to 23
30 to 38
40 to 47
50 and 51
80 to 87
100 and 101
121 and 122

Priority (default), - comments

1
2 - at specific time or regular intervals
3 to 6
- after programmable time
7 to 15 - at programmable intervals
16 to 23 - interupts from I/O-modules
24
26 - errors not involved in program execut.
27
Priority of the OBs, causing the errors
19

Table 3: Organization blocks of STEP 7

Startup routine
Before the CPU begins with the cyclic main program, e.g. after switching on the mains
power, it executes a startup routine. Following execution of the startup routine program
processing always starts at the beginning of the main program (OB1).

3.4.3 Functions
Functions, FC, are used to program frequently recurring or complex automation functions.
They can be parameterized, i. e. can be given block parameters. These parameters can be
input-values, given to the function when calling them. The FC returns a (output-) value, called
function value, given back to the calling block. The function value is optional. In addition to
the function value, function may also have other output parameters. In contrary to Function
Blocks - FB, functions do not store information (no memory), and thus have no assigned data
block. The function must be called by another program block, like an OB, another FC or a
FB.
Block structure
Essentially, code blocks (FC and FB) consist of three parts:
-

The block header, containing the block properties, such as the block name
The declaration section, in which the block-local variables are declared or defined
The program section, which contains the program and the commentary.

3.4.4 Function Blocks

Function Blocks, FB, are parts of the program, which are called using specific block
parameters. Function blocks are similar to functions, but they use a variable associated
memory which is located in a data block (DB). This DB is permanently allocated to the FB, or,
to be more precise to the call of the FB. It is even possible to assign a different DB (with the
same data structure but containing different values) to each FB-call. Such a permanently
assigned Data block is called an instance data block, DI. The combination of function block
call and instance data block is referred to as a call instance, or shortly instance. FBs can
also save their variables in the instance data block of the called FB.

Block Parameters
Block parameters for FC and FB represent some kind of transfer interface between the
calling block and the called block. All functions and function blocks can be provided with
parameter sets. So it is possible within a block, to replace the instructions operands by
parameters. That means, the block can be executed several times with different data values
(replacing the declared parameters), which will cause to return different results to the calling
block.
Different kinds
The block parameters must be declared in a parameter list of the block header. There are
different kinds of parameters as shown in Table 4:
Keyword
in
out
in_out

Parameter Kind
input parameter
output parameter
in/out parameter

Description
Loads a value to the program of the called block
Returns a value (result) to the calling block
A parameter is loaded and also returned (changed)
20

temp

temporary value

A temporary value as a local variable in the local

data stack, valid only for the specific program block

Table 4: Block parameters

When declared in the parameter list all parameters will be given a name (symbol), a type and
optional- an initial value. All elementary data types like BOOL, INT, REAL, BYTE,
WORD, DWORD etc. are permissible to be a parameter type. The programming device
will present a choice of the elementary data types. Table 5 gives an example for a possible
parameter list.
Declaration
in
in
out
out
in_out
temp
temp

Name
RESET
START
RESULT
NUMBER

Type
BOOL
BOOL
INT
BYTE

Initial value
TRUE
TRUE
0
20

Comment
Manual Reset
Manual Start
Calculated value

Intermediate_1
Intermediate_2

BOOL
BOOL

FALSE
FALSE

RLO 1
RLO 2

Table 5: Example of a Parameter List

3.4.5 Calling a Function or a Function Block, Block End Functions

If a block has to be processed, it must be called first from another block, e.g. from OB1,
another FC or FB. A block call consists of a call-statement, followed by the name and number
of the block to be called. If parameters were given to the block, a parameter list, generated
by the programming device, will follow automatically the call statement. Otherwise there is no
need to display a parameter list. Call statements can be unconditional or conditional,
dependent on the state of the RLO. The following table 6 lists the 3 possible call-operations
of STEP 7:
Statement
CALL

Condition
no

UC

Operand
FC n, FB n
SFC n, SFB n
FC n, FB n

CC

FC n, FB n

RLO = 1

no

Explanation
Unconditional block call of FCs and FBs with or
without parameters, FBs with or without Instance DB.
Unconditional block call of FCs and FBs, without
parameters only, FBs without Instance DB only.
Conditional block call of FCs and FBs, without
parameters only, FBs without Instance DB only.
Block is called only, if the actual RLO is 1.

Table 6: Block-call operations of STEP 7

Example:
The following simple example in Fig. 2 shows a function FC 1 with some parameters. FC 1
may be called from OB 1.
Declaration
in
in
out
out
in_out

Name
INPUT1
INPUT2
RESULT1
RESULT2

Type
BOOL
BOOL
INT
BYTE

Initial value

Comment

21

temp

MEMORY

BOOL

Local symbols
Local symbols are known only in the block (FC, FB) in which they have been defined as
parameters (names). The same local symbols can be used in different blocks for different
purposes. In the program part of a function or FB the parameters (local symbols) must be
marked by the preceding character #, in order to distinguish them from global symbols,
defined in a symbol table (enclosed with inverted commas like STOP). This is valid for all
kinds of program representation, STL, LAD or FBD language.
Segment 1

&

#INPUT1

#MEMORY

#RESULT1

#INPUT2
Segment 2

#RESULT2

&

#MEMORY

Fig.2: Function FC 1 with parameters

Call of FC 1 by OB 1

OB 1:
Segment 1
CALL FC 1
INPUT1 : =
INPUT2 : =
RESULT1: =
RESULT2: =

I0.0
I0.1
Q4.0
Q4.1

//Unconditional call of FC 1 by OB1

//Actual variables must replace the parameters

Block End Operations

There are 3 different block end operations available in STEP 7:
BE
BEC
BEU

Block end (termination of any block - compulsory)

Block end conditional, executed only if the preceding RLO = 1
Block end unconditional

Block-End (BE) - operation

The BE-operation is already familiar: Each block must be terminated using the BEstatement. After executing a BE-instruction, the processing of a STEP 7 program unit (FC,
FB) will be continued in the preceding higher ranking (calling) block with the instruction
following the last block-call statement, as will be shown in the schematic of figure 3 below.
BEC-operation
The BEC-operation (Block End Conditional) is used to terminate a block dependent on the
binary value of the current RLO. Only if the status of the RLO is 1, the block will be
terminated (before continuing to final BE) and the program is continued in the preceding
higher-ranking block. If the RLO status is 0, the program will be continued with the
statement following the BEC-operation. This provides the user with the possibility to
terminate processing the rest of a block, dependent upon the state of a binary value or result
of a logic operation RLO.

22

Example:
:A
M 3.7
:BEC
:A
I 2.4
:S
Q 2.5
:
:
:BE

//If memory bit M 3.7 = 1:

//Terminate the block already here and return to the preceding block.
//Else if M 3.7 = 0: Continue processing the actual block
//until to block end BE.
//continue .

BEU-operation
The BEU-operation (Block End Unconditional) will terminate an actual block similar to the
normal BE-operation. In contrary however to BE, the BEU-statement will not be used at the
end of a block, but only within a block. The BEU-operation should be used only, if the block
must be terminated before completion due to a conditional or unconditional jump-operation
within the block.
OB1
: .
: .
:CALL FC 3
:A
I 1.3
:AN M 8.2
:
:
:
:A M 3.1
:UC FC 6
:O M 7.2
:ON I 2.7
:
:BE

FC3
: .
: .
:A
I 3.6
:BEC
:O I 3.7
:CC FC 6
:
:BE

FC 6
: .
:L MW 3
:T QW 7
:
:BE

Fig. 3: Program Structure using BEC-Statements

23