LAD (S7-1200, S7-1500)

LAD

This chapter contains the following information:

• Bit logic operations (S7-1200, S7-1500)
• Timer operations (S7-1200, S7-1500)
• Counter operations (S7-1200, S7-1500)
• Comparator operations (S7-1200, S7-1500)
• Math functions (S7-1200, S7-1500)
• Move operations (S7-1200, S7-1500)
• Conversion operations (S7-1200, S7-1500)
• Program control operations (S7-1200, S7-1500)
• Word logic operations (S7-1200, S7-1500)
• Shift and rotate (S7-1200, S7-1500)
• Additional instructions (S7-1500)

-1-
 Bit logic operations (S7-1200, S7-1500)

Bit logic operations

This chapter contains the following information:

• ---| |---: Normally open contact (S7-1200, S7-1500)
• ---| / |---: Normally closed contact (S7-1200, S7-1500)
• --|NOT|--: Invert RLO (S7-1200, S7-1500)
• ---( )---: Assignment (S7-1200, S7-1500)
• --( / )--: Negate assignment (S7-1200, S7-1500)
• ---( R )---: Reset output (S7-1200, S7-1500)
• ---( S )---: Set output (S7-1200, S7-1500)
• SET_BF: Set bit field (S7-1200, S7-1500)
• RESET_BF: Reset bit field (S7-1200, S7-1500)
• SR: Set/reset flip-flop (S7-1200, S7-1500)
• RS: Reset/set flip-flop (S7-1200, S7-1500)
• --|P|--: Scan operand for positive signal edge (S7-1200, S7-1500)
• --|N|--: Scan operand for negative signal edge (S7-1200, S7-1500)
• --(P)--: Set operand on positive signal edge (S7-1200, S7-1500)
• --(N)--: Set operand on negative signal edge (S7-1200, S7-1500)
• P_TRIG: Scan RLO for positive signal edge (S7-1200, S7-1500)
• N_TRIG: Scan RLO for negative signal edge (S7-1200, S7-1500)
• R_TRIG: Set tag on positive signal edge (S7-1200, S7-1500)
• F_TRIG: Set tag on negative signal edge (S7-1200, S7-1500)

-2-
 ---| |---: Normally open contact (S7-1200, S7-1500)

---| |---: Normally open contact

Description
The activation of the normally open contact depends on the signal state of the associated operand.
When the operand has signal state "1", the normally open contact closes and the signal state at the
output is set to the signal state of the input.
When the operand has signal state "0", the normally open contact is not activated and the signal state
at the output of the instruction is reset to "0".
Two or more normally open contacts are linked bit-by-bit by AND when connected in series. With a
series connection, power flows when all contacts are closed.
The normally open contacts are linked by OR when connected in parallel. With a parallel connection,
power flows when one of the contacts is closed.

Parameter
The following table shows the parameters of the instruction:

Parame‐ Declara‐ Data Memory area Description

ter tion type
S7-1200 S7-1500
Operand whose
<Oper‐
Input BOOL I, Q, M, D, L I, Q, M, D, L, T, C signal state is
and>
queried.

Example
The following example shows how the instruction works:

The "TagOut" operand is set when one of the following conditions is fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The operand "TagIn_3" has the signal state "1".

-3-
 ---| / |---: Normally closed contact (S7-1200, S7-1500)

---| / |---: Normally closed contact

Description
The activation of the normally closed contact depends on the signal state of the associated operand.
When the operand has signal state "1", the normally closed contact opens and the signal state at the
output of the instruction is reset to "0".
When the operand has signal state "0", the normally closed contact is not enabled and the signal state
of the input is transferred to the output.
Two or more normally closed contacts are linked bit-by-bit by AND when connected in series. With a
series connection, power flows when all contacts are closed.
The normally closed contacts are linked by OR when connected in parallel. With a parallel connection,
power flows when one of the contacts is closed.

Parameter
The following table shows the parameters of the instruction:

Parameter Declara‐ Data type Memory area Description

tion
S7-1200 S7-1500
Operand
whose signal
<Operand> Input BOOL I, Q, M, D, L I, Q, M, D, L, T, C
state is quer‐
ied.

Example
The following example shows how the instruction works:

The "TagOut" operand is set when one of the following conditions is fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The operand "TagIn_3" has the signal state "0".

-4-
 --|NOT|--: Invert RLO (S7-1200, S7-1500)

--|NOT|--: Invert RLO

Description
You use the "Invert RLO" instruction to invert the signal state of the result of logic operation (RLO). If
the signal state is "1" at the input of the instruction, the output of the instruction has signal state "0". If
the signal state is "0" at the input of the instruction, the output has the signal state "1".

Example
The following example shows how the instruction works:

Operand "TagOut" is reset when one of the following conditions is fulfilled:

• The operand "TagIn_1" has the signal state "1".
• The signal state of the operands "TagIn_2" and "TagIn_3" is "1".

-5-
 ---( )---: Assignment (S7-1200, S7-1500)

---( )---: Assignment

Description
You can use the "Assignment" instruction to set the bit of a specified operand. If the result of logic
operation (RLO) at the input of the coil has signal state "1", the specified operand is set to signal state
"1". If the signal state is "0" at the input of the coil, the bit of the specified operand is reset to "0".
The instruction does not influence the RLO. The RLO at the input of the coil is sent directly to the out‐
put.

Parameter
The following table shows the parameters of the "Assignment" instruction:

Parameter Declaration Data type Memory area Description

Operand to which
<Operand> Output BOOL I, Q, M, D, L the RLO is as‐
signed.

Example
The following example shows how the instruction works:

The "TagOut_1" operand is set when one of the following conditions is fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The signal state of the operand "TagIn_3" is "0".

The "TagOut_2" operand is set when one of the following conditions is fulfilled:
• Operands "TagIn_1", "TagIn_2", and "TagIn_4" have signal state "1".
• The signal state of the "TagIn_3" operand is "0" and the signal state of the "TagIn_4" operand is
"1".

-6-
 --( / )--: Negate assignment (S7-1200, S7-1500)

--( / )--: Negate assignment

Description
The "Negate assignment" instruction inverts the result of logic operation (RLO) and assigns it to the
specified operand. When the RLO at the input of the coil is "1", the operand is reset. When the RLO at
the input of the coil is "0", the operand is set to signal state "1".

Parameter
The following table shows the parameters of the "Negate assignment" instruction:

Parameter Declaration Data type Memory area Description

Operand to which
<Operand> Output BOOL I, Q, M, D, L the RLO is as‐
signed.

Example
The following example shows how the instruction works:

Operand "TagOut_1" is reset when one of the following conditions is fulfilled:

• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The signal state of the operand "TagIn_3" is "0".

-7-
 ---( R )---: Reset output (S7-1200, S7-1500)

---( R )---: Reset output

Description
You can use the "Reset output" instruction to reset the signal state of a specified operand to "0".
The instruction is only executed if the result of logic operation (RLO) at the input of the coil is "1". If
power flows to the coil (RLO = "1"), the specified operand is reset to "0". If the RLO at the input of the
coil is "0" (no signal flow to the coil), the signal state of the specified operand remains unchanged.

Parameter
The following table shows the parameters of the "Reset output" instruction:

Parameter Declaration Data type Memory area

S7-1200 S7-1500 Description
Operand that
I, Q, M, D, L,
<Operand> Output BOOL I, Q, M, D, L is reset when
T, C
RLO = "1".

Example
The following example shows how the instruction works:

Operand "TagOut" is reset when one of the following conditions is fulfilled:

• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The signal state of the operand "TagIn_3" is "0".

-8-
 ---( S )---: Set output (S7-1200, S7-1500)

---( S )---: Set output

Description
You can use the "Set output" instruction to set the signal state of a specified operand to "1".
The instruction is only executed if the result of logic operation (RLO) at the input of the coil is "1". If
power flows to the coil (RLO = "1"), the specified operand is set to "1". If the RLO at the input of the
coil is "0" (no signal flow to the coil), the signal state of the specified operand remains unchanged.

Parameter
The following table shows the parameters of the "Set output" instruction:

Parameter Declaration Data type Memory area Description

Operand which is
<Operand> Output BOOL I, Q, M, D, L set with RLO =
"1".

Example
The following example shows how the instruction works:

The "TagOut" operand is set when one of the following conditions is fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The signal state of the operand "TagIn_3" is "0".

-9-
 Timer operations (S7-1200, S7-1500)

Timer operations

This chapter contains the following information:

• IEC Timers (S7-1200, S7-1500)
• SIMATIC Timers (S7-1500)

- 10 -
 IEC Timers (S7-1200, S7-1500)

IEC Timers

This chapter contains the following information:

• TP: Generate pulse (S7-1200, S7-1500)
• TON: Generate on-delay (S7-1200, S7-1500)
• TOF: Generate off-delay (S7-1200, S7-1500)
• TONR: Time accumulator (S7-1200, S7-1500)
• ---( TP )---: Start pulse timer (S7-1200, S7-1500)
• ---( TON )---: Start on-delay timer (S7-1200, S7-1500)
• ---( TOF )---: Start off-delay timer (S7-1200, S7-1500)
• ---( TONR )---: Time accumulator (S7-1200, S7-1500)
• ---( RT )---: Reset timer (S7-1200, S7-1500)
• ---( PT )---: Load time duration (S7-1200, S7-1500)

- 11 -
 TP: Generate pulse (S7-1200, S7-1500)

TP: Generate pulse

Description
You can use the "Generate pulse" instruction to set the output Q for a programmed duration. The in‐
struction is started when the result of logic operation (RLO) at input IN changes from "0" to "1" (posi‐
tive signal edge). The programmed time PT begins when the instruction starts. Output Q is set for the
duration PT, regardless of the subsequent course of the input signal. Even if a new positive signal
edge is detected, the signal state at the output Q is not affected as long as the PT time duration is
running.
You can scan the current time value at the ET output. The time value starts at T#0s and ends when
the value of duration PT is reached. When the duration PT is reached and the signal state at input IN
is "0", the ET output is reset.
Each call of the "Generate pulse" instruction must be assigned to an IEC timer in which the instruction
data is stored.

Note
If the timer is not called in the program because it is skipped, for example, the ET output returns a
constant value as soon as the timer has expired.

For S7-1200 CPU

An IEC timer is a structure of the data type IEC_TIMER or TP_TIME that you can declare as follows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")
• Declaration as a local tag of the type TP_TIME, TP_LTIME or IEC_TIMER in the "Static" section of
a block (for example, #MyIEC_TIMER)

For S7-1500 CPU

An IEC timer is a structure of the data type IEC_TIMER, IEC_LTIMER, TP_TIME or TP_LTIME that
you can declare as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TP_TIME, TP_LTIME, IEC_TIMER or IEC_LTIMER in the
"Static" section of a block (for example, #MyIEC_TIMER)
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the IEC timer is stored in its own data block (single instance) or as a local tag (multi-in‐
stance) in the block interface. If you create a separate data block, you will find it in the project tree in
the "Program resources" folder under "Program blocks > System blocks". For additional information
on this topic, refer to "See also".
The instruction data is updated both when the instruction is called and also each time the outputs Q or
ET are accessed.
The execution of the "Generate pulse" instruction requires a preceding logic operation. It can be
placed within or at the end of the network.

Parameters
The following table shows the parameters of the "Generate pulse" instruction:

- 12 -
 TP: Generate pulse (S7-1200, S7-1500)

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500 S7-1200 S7-1500
I, Q, M, D, I, Q, M, D, L,
IN Input BOOL BOOL Start input
L P
Duration of
the pulse
I, Q, M, D, I, Q, M, D, L, The value of
TIME,
PT Input TIME L or con‐ P or con‐ the PT pa‐
LTIME
stant stant rameter
must be pos‐
itive.
I, Q, M, D, I, Q, M, D, L,
Q Output BOOL BOOL Pulse output
L P
TIME, I, Q, M, D, I, Q, M, D, L, Current time
ET Output TIME
LTIME L P value
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Generate pulse" instruction:

- 13 -
 TON: Generate on-delay (S7-1200, S7-1500)

TON: Generate on-delay

Description
You can use the "Generate on-delay" instruction to delay setting of the Q output by the programmed
duration PT. The instruction is started when the result of logic operation (RLO) at input IN changes
from "0" to "1" (positive signal edge). The programmed time PT begins when the instruction starts.
When the duration PT expires, the output Q has the signal state "1". Output Q remains set as long as
the start input is still "1". When the signal state at the start input changes from "1" to "0", the Q output
is reset. The timer function is started again when a new positive signal edge is detected at the start
input.
The current time value can be queried at the ET output. The time value starts at T#0s and ends when
the value of duration PT is reached. The ET output is reset as soon as the signal state at the IN input
changes to "0".
Each call of the "Generate on-delay" instruction must be assigned to an IEC timer in which the instruc‐
tion data is stored.

Note
If the timer is not called in the program because it is skipped, for example, the ET output returns a
constant value as soon as the timer has expired.

For S7-1200 CPU

An IEC timer is a structure of the data type IEC_TIMER or TON_TIME that you can declare as follows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")

• Declaration as a local tag of the type TON_TIME or IEC_TIMER in the "Static" section of a block
(for example, #MyIEC_TIMER)

For S7-1500 CPU

An IEC timer is a structure of the data type IEC_TIMER, IEC_LTIMER, TON_TIME or TON_LTIME
that you can declare as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TON_TIME, TON_LTIME, IEC_TIMER or IEC_LTIMER in the
"Static" section of a block (for example, #MyIEC_TIMER)
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the IEC timer is stored in its own data block (single instance) or as a local tag (multi-in‐
stance) in the block interface. If you create a separate data block, you will find it in the project tree in
the "Program resources" folder under "Program blocks > System blocks". For additional information
on this topic, refer to "See also".
The instruction data is updated both when the instruction is called and also each time the outputs Q or
ET are accessed.
The execution of the "Generate on-delay" instruction requires a preceding logic operation. It can be
placed within or at the end of the network.

Parameters
The following table shows the parameters of the "Generate on-delay" instruction:

- 14 -
 TON: Generate on-delay (S7-1200, S7-1500)

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500 S7-1200 S7-1500
I, Q, M, D, I, Q, M, D, L,
IN Input BOOL BOOL Start input
L P
Duration of
the on-delay
I, Q, M, D, I, Q, M, D, L, The value of
TIME,
PT Input TIME L or con‐ P or con‐ the PT pa‐
LTIME
stant stant rameter
must be pos‐
itive.
Output that
I, Q, M, D, I, Q, M, D, L, is set when
Q Output BOOL BOOL
L P the time PT
expires.
TIME, I, Q, M, D, I, Q, M, D, L, Current time
ET Output TIME
LTIME L P value
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Generate on-delay" instruction:

- 15 -
 TOF: Generate off-delay (S7-1200, S7-1500)

TOF: Generate off-delay

Description
You can use the "Generate off-delay" instruction to delay resetting of the Q output by the programmed
duration PT. The Q output is set when the result of logic operation (RLO) at input IN changes from "0"
to "1" (positive signal edge). When the signal state at input IN changes back to "0", the programmed
time PT starts. Output Q remains set as long as the duration PT is running. When duration PT ex‐
pires, the Q output is reset. If the signal state at input IN changes to "1" before the PT time duration
expires, the timer is reset. The signal state at the output Q continues to be "1".
The current time value can be queried at the ET output. The time value starts at T#0s and ends when
the value of duration PT is reached. When the time duration PT expires, the ET output remains set to
the current value until the IN input changes back to "1". If input IN switches to "1" before the duration
PT has expired, the ET output is reset to the value T#0s.
Each call of the "Generate off-delay" instruction must be assigned to an IEC timer in which the instruc‐
tion data is stored.

Note
If the timer is not called in the program because it is skipped, for example, the ET output returns a
constant value as soon as the timer has expired.

For S7-1200 CPU

An IEC timer is a structure of the data type IEC_TIMER or TOF_TIME that you can declare as follows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")

• Declaration as a local tag of the type TOF_TIME or IEC_TIMER in the "Static" section of a block
(for example, #MyIEC_TIMER)

For S7-1500 CPU

An IEC timer is a structure of the data type IEC_TIMER, IEC_LTIMER, TOF_TIME or TOF_LTIME that
you can declare as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TOF_TIME, TOF_LTIME, IEC_TIMER or IEC_LTIMER in the
"Static" section of a block (for example, #MyIEC_TIMER)
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the IEC timer is stored in its own data block (single instance) or as a local tag (multi-in‐
stance) in the block interface. If you create a separate data block, you will find it in the project tree in
the "Program resources" folder under "Program blocks > System blocks". For additional information
on this topic, refer to "See also".
The instruction data is updated both when the instruction is called and also each time the outputs Q or
ET are accessed.
The execution of the "Generate off-delay" instruction requires a preceding logic operation. It can be
placed within or at the end of the network.

Parameters
The following table shows the parameters of the "Generate off-delay" instruction:

- 16 -
 TOF: Generate off-delay (S7-1200, S7-1500)

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500 S7-1200 S7-1500
I, Q, M, D, I, Q, M, D, L,
IN Input BOOL BOOL Start input
L P
Duration of
the off delay
I, Q, M, D, I, Q, M, D, L, The value of
TIME,
PT Input TIME L or con‐ P or con‐ the PT pa‐
LTIME
stant stant rameter
must be pos‐
itive.
Output that
is reset
I, Q, M, D, I, Q, M, D, L,
Q Output BOOL BOOL when the
L P
timer PT ex‐
pires.
TIME, I, Q, M, D, I, Q, M, D, L, Current time
ET Output TIME
LTIME L P value
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Generate off-delay" instruction:

- 17 -
 TONR: Time accumulator (S7-1200, S7-1500)

TONR: Time accumulator

Description
The "Time accumulator" instruction is used to accumulate time values within a period set by the PT
parameter. When the signal state at input IN changes from "0" to "1" (positive signal edge), the in‐
struction executes and the duration PT starts. While the duration PT is running, the time values are
accumulated that are recorded when the IN input has signal state "1". The accumulated time is written
to output ET and can be queried there. When the duration PT expires, the output Q has the signal
state "1". The Q parameter remains set to "1", even when the signal state at the IN parameter
changes from "1" to "0" (negative signal edge).
The R input resets the outputs ET and Q regardless of the signal state at the start input.
Each call of the "Time accumulator" instruction must be assigned to an IEC timer in which the instruc‐
tion data is stored.

For S7-1200 CPU

An IEC timer is a structure of the data type IEC_TIMER or TONR_TIME that you can declare as fol‐
lows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")
• Declaration as a local tag of the type TONR_TIME or IEC_TIMER in the "Static" section of a block
(for example, #MyIEC_TIMER)

For S7-1500 CPU

An IEC timer is a structure of the data type IEC_TIMER, IEC_LTIMER, TONR_TIME or TONR_LTIME
that you can declare as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TONR_TIME, TONR_LTIME, IEC_TIMER or IEC_LTIMER in
the "Static" section of a block (for example, #MyIEC_TIMER)
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the IEC timer is stored in its own data block (single instance) or as a local tag (multi-in‐
stance) in the block interface. If you create a separate data block, you will find it in the project tree in
the "Program resources" folder under "Program blocks > System blocks". For additional information
on this topic, refer to "See also".
The instruction data is updated both when the instruction is called and also each time the outputs Q or
ET are accessed.
The execution of the Time accumulator" instruction requires a preceding logic operation. It can be
placed within or at the end of the network.

Parameters
The following table shows the parameters of the "Time accumulator" instruction:

- 18 -
 TONR: Time accumulator (S7-1200, S7-1500)

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500 S7-1200 S7-1500
I, Q, M, D, I, Q, M, D, L,
IN Input BOOL BOOL Start input
L P
I, Q, M, D, I, Q, M, D, L,
R Input BOOL BOOL L or con‐ P or con‐ Reset input
stant stant
Maximum
duration of
time record‐
I, Q, M, D, I, Q, M, D, L, ing
TIME,
PT Input TIME L or con‐ P or con‐ The value of
LTIME
stant stant the PT pa‐
rameter
must be pos‐
itive.
Output that
I, Q, M, D, I, Q, M, D, L, is set when
Q Output BOOL BOOL
L P the time PT
expires.
TIME, I, Q, M, D, I, Q, M, D, L, Accumulated
ET Output TIME
LTIME L P time
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Time accumulator" instruction:

- 19 -
 ---( TP )---: Start pulse timer (S7-1200, S7-1500)

---( TP )---: Start pulse timer

Description
Use the "Start pulse timer" instruction to start an IEC timer with a specified duration as pulse. The IEC
timer is started when the result of logic operation (RLO) changes from "0" to "1" (positive signal edge).
The IEC timer runs for the specified duration regardless of any subsequent changes in the RLO. The
run of the IEC timer is also not affected by the detection of a new positive signal edge. As long as the
IEC timer is running, the querying of the timer status for "1" returns the signal state "1". When the IEC
timer has expired, the timer status returns the signal state "0".

Note
You can start and query the IEC timer at various execution levels, as each querying of the outputs
Q or ET updates the IEC_TIMER structure.

For S7-1200 CPU

The instruction "Start pulse timer" stores its data in a structure of the data type IEC_TIMER or
TP_TIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")
• Declaration as a local tag of the type TP_LTIME or IEC_TIMER in the "Static" section of a block (for
example, #MyIEC_TIMER)

For S7-1500 CPU

The instruction "Start pulse timer" stores its data in a structure of the data type IEC_TIMER, IEC_LTI‐
MER, TP_TIME or TP_LTIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TP_TIME, TP_LTIME, IEC_TIMER or IEC_LTIMER in the
"Static" section of a block (for example, #MyIEC_TIMER)
The instruction data is updated both when the instruction is called and also each time the assigned
timer is accessed.
The current timer status is stored in the Q structure component of the IEC timer. You can use a nor‐
mally open contact to query timer status for "1" or a normally closed contact for "0". The query on Q or
ET (for example, "MyTimer".Q or "MyTimer".ET) updates the IEC_TIMER structure.
The execution of the "Start pulse timer" instruction assumes a preceding logic operation. It can be
placed only at the end of the network.

Parameter
The following table shows the parameters of the "Start pulse timer" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
Duration with
<Time dura‐ I, Q, M, D, L or
Input TIME TIME, LTIME which the IEC
tion> constant
timer runs.

- 20 -
 ---( TP )---: Start pulse timer (S7-1200, S7-1500)

IEC_TIMER,
IEC_TIMER, IEC_LTIMER, IEC timer that
<IEC timer> InOut D, L
TP_TIME TP_TIME, is started.
TP_LTIME
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "Start pulse timer" instruction is executed when the signal state of the operand "Tag_Input"
changes from "0" to "1". The timer "DB1".MyIEC_TIMER is started for the time stored in the operand
"TagTime".

As long as the timer "DB1". MyIEC_TIMER is running, the timer status ("DB1".MyIEC_TIMER.Q) has
signal state "1" and the operand "Tag_Output" is set. When the IEC timer has expired, the signal state
of the time status changes back to "0" and the "Tag_Output" operand is reset.

- 21 -
 ---( TON )---: Start on-delay timer (S7-1200, S7-1500)

---( TON )---: Start on-delay timer

Description
Use the "Start on-delay timer" instruction to start an IEC timer with a specified duration as on-delay.
The IEC timer is started when the result of logic operation (RLO) changes from "0" to "1" (positive sig‐
nal edge). The IEC timer runs for the specified time. The output returns the signal state "1" if the RLO
at the input of the instruction has the signal state "1". If the RLO changes to "0" before the time ex‐
pires, the IEC timer is reset. In this case, querying the timer status for "1" returns signal state "0". The
IEC timer restarts when the next positive signal edge is detected at the input of the instruction.

Note
You can start and query the IEC timer at various execution levels, as each querying of the outputs
Q or ET updates the IEC_TIMER structure.

For S7-1200 CPU

The instruction "Start on-delay timer" stores its data in a structure of the data type IEC_TIMER or
TON_TIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")
• Declaration as a local tag of the type TON_TIME or IEC_TIMER in the "Static" section of a block
(for example, #MyIEC_TIMER)

For S7-1500 CPU

The "Start on-delay timer" instruction stores its data in a structure of the data type IEC_TIMER,
IEC_LTIMER, TON_TIME or TON_LTIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TON_TIME, TON_LTIME, IEC_TIMER or IEC_LTIMER in the
"Static" section of a block (for example, #MyIEC_TIMER)
The instruction data is updated both when the instruction is called and also each time the assigned
timer is accessed.
The current timer status is stored in the ET structure component of the IEC timer. You can use a nor‐
mally open contact to query timer status for "1" or a normally closed contact for "0". The query on Q or
ET (for example, "MyTimer".Q or "MyTimer".ET) updates the IEC_TIMER structure.
The execution of the "Start on-delay timer" instruction assumes a preceding logic operation. It can be
placed only at the end of the network.

Parameter
The following table shows the parameters of the "Start on-delay timer" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
Duration with
<Time dura‐ I, Q, M, D, L or
Input TIME TIME, LTIME which the IEC
tion> constant
timer runs.

- 22 -
 ---( TON )---: Start on-delay timer (S7-1200, S7-1500)

IEC_TIMER,
IEC_TIMER, IEC_LTIMER, IEC timer that
<IEC timer> InOut D, L
TON_TIME TON_TIME, is started.
TON_LTIME
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "Start on-delay timer" instruction is executed when the signal state of the operand "Tag_Input"
changes from "0" to "1". The "MyIEC_TIMER timer is started for the time stored in the "TagTime" op‐
erand.

If the timer "MyIEC_TIMER" has expired and the operand "Tag_Input" has the signal state "1", query‐
ing the timer status ("MyIEC_TIMER).Q) returns signal state "1" and the "Tag_Output" operand is set.
When the signal state of the operand "Tag_Input" changes to "0", the querying of the timer status re‐
turns the signal state "0" and the operand "Tag_Output" is reset.

- 23 -
 ---( TOF )---: Start off-delay timer (S7-1200, S7-1500)

---( TOF )---: Start off-delay timer

Description
Use the "Start off-delay timer" instruction to start an IEC timer with a specified duration as on-delay.
The query of the timer status for "1" returns the signal state "0" if the result of logic operation (RLO) at
the input of the instruction has the signal state "1". When the RLO changes from "1" to "0" (negative
signal edge), the IEC timer starts with the specified time. The timer status remains at signal state "1"
as long as the IEC timer is running. When the timer has run out and the RLO at the input of the in‐
struction has the signal state "0", the timer status is set to the signal state "0". If the RLO changes to
"1" before the time expires, the IEC timer is reset and the timer status remains at signal state "1".

Note
You can start and query the IEC timer at various execution levels, as each querying of the outputs
Q or ET updates the IEC_TIMER structure.

For S7-1200 CPU

The instruction "Start off-delay timer" stores its data in a structure of the data type IEC_TIMER or
TOF_TIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")
• Declaration as a local tag of the type TOF_TIME or IEC_TIMER in the "Static" section of a block
(for example, #MyIEC_TIMER)

For S7-1500 CPU

The "Start off-delay timer" instruction stores its data in a structure of the data type IEC_TIMER,
IEC_LTIMER, TOF_TIME or TOF_LTIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TOF_TIME, TOF_LTIME, IEC_TIMER or IEC_LTIMER in the
"Static" section of a block (for example, #MyIEC_TIMER)
The instruction data is updated both when the instruction is called and also each time the assigned
timer is accessed.
The current timer status is stored in the ET structure component of the IEC timer. You can use a nor‐
mally open contact to query timer status for "1" or a normally closed contact for "0". The query on Q or
ET (for example, "MyTimer".Q or "MyTimer".ET) updates the IEC_TIMER structure.
The execution of the "Start off-delay timer" instruction assumes a preceding logic operation. It can be
placed only at the end of the network.

Parameters
The following table shows the parameters of the "Start off-delay timer" instruction:

- 24 -
 ---( TOF )---: Start off-delay timer (S7-1200, S7-1500)

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
Duration with
<Time dura‐ I, Q, M, D, L or
Input TIME TIME, LTIME which the IEC
tion> constant
timer runs.
IEC_TIMER,
IEC_TIMER, IEC_LTIMER, IEC timer that
<IEC timer> InOut D, L
TOF_TIME TOF_TIME, is started.
TOF_LTIME
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "Start off-delay timer" instruction is executed when the signal state of the operand "Tag_Input"
changes from "1" to "0". The timer #MyIEC_TIMER is started for the time stored in the operand "Tag‐
Time".

As long as timer #MyIEC_TIMER is running, the query of the time status (#MyIEC_TIMER.Q) returns
the signal state "1" and operand "Tag_Output" is set. If the timer has expired and the operand
"Tag_Input" has the signal state "0", the query of the timer status returns the signal state "0". If the
signal state of the operand "Tag_Input" changes to "1" before timer #MyIEC_TIMER expires, the timer
is reset. When the signal state of the operand "Tag_Input" is "1", the query of the timer status returns
the signal state "1".

- 25 -
 ---( TONR )---: Time accumulator (S7-1200, S7-1500)

---( TONR )---: Time accumulator

Description
You can use the "Time accumulator" instruction to record how long the signal is at the input of instruc‐
tion "1". The instruction is started when the result of logic operation (RLO) changes from "0" to "1"
(positive signal edge). The time is recorded as long at the RLO is "1". If the RLO changes to "0", the
instruction is halted. If the RLO changes back to "1", the time recording is continued. The query of the
timer status for "1" returns the signal state "1" if the recorded time exceeds the value of the specified
duration and the RLO at the input of coil is "1".
The timer status and the currently expired timer can be reset to "0" using the "Reset timer" instruction.

Note
You can start and query the IEC timer at various execution levels, as each querying of the outputs
Q or ET updates the IEC_TIMER structure.

For S7-1200 CPU

The "Time accumulator" instruction stores its data in a structure of the data type IEC_TIMER or
TONR_TIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER (for example, "MyIEC_TIMER")
• Declaration as a local tag of the type TONR_TIME or IEC_TIMER in the "Static" section of a block
(for example, #MyIEC_TIMER)

For S7-1500 CPU

The "Time accumulator" instruction stores its data in a structure of the data type IEC_TIMER,
IEC_LTIMER, TONR_TIME or TONR_LTIME. You can declare the structure as follows:
• Declaration of a data block of system data type IEC_TIMER or IEC_LTIMER (for example,
"MyIEC_TIMER")
• Declaration as a local tag of the type TONR_TIME, TONR_LTIME, IEC_TIMER or IEC_LTIMER in
the "Static" section of a block (for example, #MyIEC_TIMER)
The instruction data is updated both when the instruction is called and also each time the assigned
timer is accessed.
The current timer status is stored in the ET structure component of the IEC timer. You can use a nor‐
mally open contact to query timer status for "1" or a normally closed contact for "0". The query on Q or
ET (for example, "MyTimer".Q or "MyTimer".ET) updates the IEC_TIMER structure.
The execution of the Time accumulator" instruction requires a preceding logic operation. It can be
placed only at the end of the network.

Parameter
The following table shows the parameters of the "Time accumulator" instruction:

- 26 -
 ---( TONR )---: Time accumulator (S7-1200, S7-1500)

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
Duration with
<Time dura‐ I, Q, M, D, L or
Input TIME TIME, LTIME which the IEC
tion> constant
timer runs.
IEC_TIMER,
IEC_TIMER, IEC_LTIMER, IEC timer that
<IEC timer> InOut D, L
TONR_TIME TONR_TIME, is started.
TONR_LTIME
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "Time accumulator" instruction executes on a positive signal edge in the RLO. The time is recor‐
ded as long as the operand "Tag_Input" has the signal state "1".

If the recorded time exceeds the value of the operand "TagTime", then the query of the timer status
("MyIEC_TIMER".Q) will return the signal state "1" and the operand "Tag_Output" will be set.

- 27 -
 ---( RT )---: Reset timer (S7-1200, S7-1500)

---( RT )---: Reset timer

Description
You can use the "Reset timer" instruction to reset an IEC timer to "0". The instruction is only executed
if the result of logic operation (RLO) at the input of the coil is "1". If current is flowing to the coil (RLO
is "1"), the structure components of the timer in the specified data block are reset to "0". If the RLO at
the input of the instruction is "0", the timer remains unchanged.
The instruction does not influence the RLO. The RLO at the input of the coil is sent directly to the out‐
put of the coil.
You assign the "Reset timer" instruction an IEC timer that has been declared in the program.
The instruction data is updated only when the instruction is called and not each time the assigned IEC
timer is accessed. Querying the data is only identical from the call of the instruction to the next call of
the instruction.

Parameters
The following table shows the parameters of the "Reset timer" instruction":

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
IEC_TIMER,
IEC_LTIMER,
TP_TIME,
IEC_TIMER,
TP_LTIME,
TP_TIME,
TON_TIME, IEC timer that
<IEC timer> Output TON_TIME, D, L
TON_LTIME, is reset.
TOF_TIME,
TOF_TIME,
TONR_TIME
TOF_LTIME,
TONR_TIME,
TONR_LTIME
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "Generate on-delay" instruction executes when the signal state of the "Tag_Input_1" operand
changes from "0" to "1". The timer stored in the "TON_DB" instance data block starts running for the
time duration specified by operand "Tag_PT".

- 28 -
 ---( RT )---: Reset timer (S7-1200, S7-1500)

If operands "Tag_Input_2" and "Tag_Input_3" have the signal state "1", the "Reset timer" instruction is
executed and the timer stored in the "TON_DB" data block.

- 29 -
 ---( PT )---: Load time duration (S7-1200, S7-1500)

---( PT )---: Load time duration

Description
You can use the "Load time duration" instruction to set the time for an IEC timer. The instruction is
executed in every cycle when the result of logic operation (RLO) at the input of the instruction has the
signal state "1". The instruction writes the specified time to the structure of the specified IEC timer.

Note
If the specified IEC timer is running while the instruction executes, the instruction overwrites the
current time of the specified IEC timer. This can change the timer status of the IEC timer.

You assign an IEC timer declared in the program to the "Load time duration" instruction.
The instruction data is updated only when the instruction is called and each time the assigned IEC
timer is accessed. The query on Q or ET (for example, "MyTimer".Q or "MyTimer".ET) updates the
IEC_TIMER structure.

Parameter
The following table shows the parameters of the "Load time duration" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
Duration with
<Time dura‐ I, Q, M, D, L or
Input TIME TIME, LTIME which the IEC
tion> constant
timer runs.
IEC_TIMER,
IEC_LTIMER,
TP_TIME,
IEC_TIMER,
TP_LTIME,
TP_TIME, IEC timer, the
TON_TIME,
<IEC timer> Output TON_TIME, D, L duration of
TON_LTIME,
TOF_TIME, which is set.
TOF_TIME,
TONR_TIME
TOF_LTIME,
TONR_TIME,
TONR_LTIME
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 30 -
 ---( PT )---: Load time duration (S7-1200, S7-1500)

The "Generate on-delay" instruction executes when the signal state of the "Tag_Input_1" operand
changes from "0" to "1". The IEC timer stored in the instance data block "TON_DB" is started with the
time duration that is specified by the operand "Tag_PT".

The "Load time duration" instruction is executed when the operand "Tag_Input_2" has the signal state
"1". The instruction writes the time duration "Tag_PT_2" in the instance data block "TON_DB" and at
the same time overwrites the value of the operand "Tag_PT" within the data block. The signal state of
the timer status may therefore change at the next query or when "MyTimer".Q or "MyTimer".ET are
accessed.

- 31 -
 SIMATIC Timers (S7-1500)

SIMATIC Timers

This chapter contains the following information:

• S_PULSE: Assign pulse timer parameters and start (S7-1500)
• S_PEXT: Assign extended pulse timer parameters and start (S7-1500)
• S_ODT: Assign on-delay timer parameters and start (S7-1500)
• S_ODTS: Assign retentive on-delay timer parameters and start (S7-1500)
• S_OFFDT: Assign off-delay timer parameters and start (S7-1500)
• ---( SP ): Start pulse timer (S7-1500)
• ---( SE ): Start extended pulse timer (S7-1500)
• ---( SD ): Start on-delay timer (S7-1500)
• ---( SS ): Start retentive on-delay timer (S7-1500)
• ---( SF ): Start off-delay timer (S7-1500)

- 32 -
 S_PULSE: Assign pulse timer parameters and start (S7-1500)

S_PULSE: Assign pulse timer parameters and start

Description
The "Assign pulse timer parameters and start" instruction starts a programmed timer when a change
from "0" to "1" (positive signal edge) is detected in the result of logic operation (RLO) at input S. The
timer expires with the programmed duration (TV) as soon as the signal state at input S is "1". If the
signal state at input S changes to "0" before the programmed duration expires, the timer is stopped. In
this case, the signal state at output Q is "0".
The duration is made up internally of a time value and a time base and is programmed at parameter
TV. When the instruction is started, the programmed time value is counted down towards zero. The
time base indicates the time period with which the time value is changed. The current time value is
output BI-coded at output BI and BCD-coded at output BCD.
If the timer is running and the signal state at input R changes to "1" then the current time value and
the time base are also set to zero. If the timer is not running, the signal state "1" at the R input has no
effect.
The "Assign pulse timer parameters and start" instruction requires a preceding logic operation for
edge evaluation and can be placed within or at the end of the network.
The instruction data is updated at every access. It can therefore happen that the query of the data at
the start of the cycle returns different values than at the end of the cycle.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameters
The following table shows the parameters of the instruction "Assign pulse timer parameters and start":

Parameter Declaration Data type Memory area Description

Time of the in‐
struction
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
S Input BOOL I, Q, M, D, L Start input
I, Q, M, D, L or
TV Input S5TIME, WORD Preset time value
constant
I, Q, M, T, C, D, L,
R Input BOOL Reset input
P or constant
Current time value
BI Output WORD I, Q, M, D, L, P
(BI-coded)

- 33 -
 S_PULSE: Assign pulse timer parameters and start (S7-1500)

Current time value

BCD Output WORD I, Q, M, D, L, P
(BCD format)
Q Output BOOL I, Q, M, D, L Status of the timer
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the instruction "Assign pulse timer parameters
and start":

Example
The following example shows how the instruction works:

- 34 -
 S_PULSE: Assign pulse timer parameters and start (S7-1500)

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number" as long as the operand "Ta‐
gIn_1" has the signal state "1". If the signal state of the operand "TagIn_1" changes from "1" to "0"
before the timer expires, the timer "Timer_1" is stopped. The operand "TagOut" is reset to "0" in this
case.
The operand "TagOut" has the signal state "1" as long as the timer is running and the operand "Ta‐
gIn_1" has the signal state "1". When the timer expires or is reset, the operand "TagOut" is reset to
"0".

- 35 -
 S_PEXT: Assign extended pulse timer parameters and start (S7-1500)

S_PEXT: Assign extended pulse timer parameters and start

Description
The "Assign extended pulse timer parameters and start" instruction starts a programmed timer when a
change from "0" to "1" (positive signal edge) is detected in the result of logic operation (RLO) at input
S. The timer expires with the programmed duration (TV), even if the signal state at input S changes to
"0". As long as the timer is running, the output Q has the signal state "1". When the timer expires, the
output Q is reset to "0". If the signal state at input S changes from "0" to "1" while the timer is running,
the timer is restarted with the duration programmed at input TV.
The duration is made up internally of a time value and a time base and is programmed at parameter
TV. When the instruction is started, the programmed time value is counted down towards zero. The
time base indicates the time period with which the time value is changed. The current time value is
output BI-coded at output BI and BCD-coded at output BCD.
If the timer is running and the signal state at input R changes to "1" then the current time value and
the time base are also set to zero. If the timer is not running, the signal state "1" at the R input has no
effect.
The "Assign extended pulse timer parameters and start" instruction requires a preceding logic opera‐
tion for edge evaluation and can be placed within or at the end of the network.
The instruction data is updated at every access. It can therefore happen that the query of the data at
the start of the cycle returns different values than at the end of the cycle.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameter
The following table shows the parameters of the instruction "Assign extended pulse timer parameters
and start":

Parameter Declaration Data type Memory area Description

Time of the in‐
struction
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
S Input BOOL I, Q, M, D, L Start input
I, Q, M, D, L or
TV Input S5TIME, WORD Preset time value
constant
I, Q, M, T, C, D, L,
R Input BOOL Reset input
P or constant
Current time value
BI Output WORD I, Q, M, D, L, P
(BI-coded)

- 36 -
 S_PEXT: Assign extended pulse timer parameters and start (S7-1500)

Current time value

BCD Output WORD I, Q, M, D, L, P
(BCD format)
Q Output BOOL I, Q, M, D, L Status of the timer
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Assign extended pulse timer parameters
and start" instruction:

Example
The following example shows how the instruction works:

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number" without being affected by a neg‐

- 37 -
 S_PEXT: Assign extended pulse timer parameters and start (S7-1500)

ative edge at input S. If the signal state of the operand "TagIn_1" changes from "0" to "1" before the
timer expires, the timer is restarted.
The operand "TagOut" has the signal state "1" as long as the timer is running. When the timer expires
or is reset, the operand "TagOut" is reset to "0".

- 38 -
 S_ODT: Assign on-delay timer parameters and start (S7-1500)

S_ODT: Assign on-delay timer parameters and start

Description
The "Assign on-delay timer parameters and start" instruction starts a programmed timer when a
change from "0" to "1" (positive signal edge) is detected in the result of logic operation (RLO) at input
S. The timer expires with the programmed duration (TV) as soon as the signal state at input S is "1". If
the timer expires correctly and input S still has signal state "1" then output Q returns signal state "1". If
the signal state at input S changes from "1" to "0" while the timer is running, the timer is stopped. In
this case, output Q is reset to signal state "0".
The duration is made up internally of a time value and a time base and is programmed at parameter
TV. When the instruction is started, the programmed time value is counted down towards zero. The
time base indicates the time period with which the time value is changed. The current time value is
output BI-coded at output BI and BCD-coded at output BCD.
If the time is running and the signal state at input R changes from "0" to "1" then the current time val‐
ue and the time base are also set to zero. In this case, the signal state at output Q is "0". The timer is
reset if the signal state is "1" at the R input even if the timer is not running and the RLO at input S is
"1".
Specify the timer of the instruction in the placeholder above the box. The timer must be declared with
the data type TIMER.
The "Assign on-delay timer parameters and start" instruction requires a preceding logic operation for
edge evaluation and can be placed within or at the end of the network.
The instruction data is updated at every access. It can therefore happen that the query of the data at
the start of the cycle returns different values than at the end of the cycle.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameter
The following table shows the parameters of the "Assign on-delay timer parameters and start" instruc‐
tion:

Parameter Declaration Data type Memory area Description

Time of the in‐
struction
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
S Input BOOL I, Q, M, D, L Start input
I, Q, M, D, L or
TV Input S5TIME, WORD Preset time value
constant

- 39 -
 S_ODT: Assign on-delay timer parameters and start (S7-1500)

I, Q, M, T, C, D, L,
R Input BOOL Reset input
P or constant
Current time value
BI Output WORD I, Q, M, D, L, P
(BI-coded)
Current time value
BCD Output WORD I, Q, M, D, L, P
(BCD format)
Q Output BOOL I, Q, M, D, L Status of the timer
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Assign on-delay timer parameters and
start" instruction:

Example
The following example shows how the instruction works:

- 40 -
 S_ODT: Assign on-delay timer parameters and start (S7-1500)

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number". If the timer expires and the op‐
erand has the signal state "1", the operand "TagOut" is set to "1". If the signal state of the operand
"TagIn_1" changes from "1" to "0" before the timer expires, the timer is stopped. The operand "Tag‐
Out" has the signal state "0" in this case.

- 41 -
 S_ODTS: Assign retentive on-delay timer parameters and start (S7-1500)

S_ODTS: Assign retentive on-delay timer parameters and start

Description
The "Assign retentive on-delay timer parameters and start" instruction starts a programmed timer
when a change from "0" to "1" (positive signal edge) is detected in the result of logic operation (RLO)
at input S. The timer expires with the programmed duration (TV), even if the signal state at input S
changes to "0". If the timer expires, the "Q" output returns signal state "1" regardless of the signal
state at input "S". If the signal state at input S changes from "0" to "1" while the timer is running, the
timer is restarted with the duration programmed at input (TV).
The duration is made up internally of a time value and a time base and is programmed at parameter
TV. When the instruction is started, the programmed time value is counted down towards zero. The
time base indicates the time period with which the time value is changed. The current time value is
output BI-coded at output BI and BCD-coded at output BCD.
Signal state "1" at input R resets the current time value and time base to "0" regardless of the signal
state at start input S. In this case, the signal state at output Q is "0".
The "Assign retentive on-delay timer parameters and start" instruction requires a preceding logic oper‐
ation for edge evaluation and can be placed within or at the end of the network.
The instruction data is updated at every access. It can therefore happen that the query of the data at
the start of the cycle returns different values than at the end of the cycle.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameter
The following table shows the parameters of the "Assign retentive on-delay timer parameters and
start" instruction:

Parameter Declaration Data type Memory area Description

Time of the in‐
struction
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
S Input BOOL I, Q, M, D, L Start input
I, Q, M, D, L or
TV Input S5TIME, WORD Preset time value
constant
I, Q, M, T, C, D, L,
R Input BOOL Reset input
P or constant
Current time value
BI Output WORD I, Q, M, D, L, P
(BI-coded)

- 42 -
 S_ODTS: Assign retentive on-delay timer parameters and start (S7-1500)

Current time value

BCD Output WORD I, Q, M, D, L, P
(BCD format)
Q Output BOOL I, Q, M, D, L Status of the timer
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Assign retentive on-delay timer parame‐
ters and start" instruction:

Example
The following example shows how the instruction works:

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number", even if the signal state of the
operand "TagIn_1" changes to "0". When the timer expires, the operand "TagOut" is set to "1". If the
signal state of the operand "TagIn_1" changes from "0" to "1" while the timer is running, the timer is
restarted.

- 43 -
 S_OFFDT: Assign off-delay timer parameters and start (S7-1500)

S_OFFDT: Assign off-delay timer parameters and start

Description
The "Assign off-delay timer parameters and start" instruction starts a programmed timer when a
change from "1" to "0" (negative signal edge) is detected in the result of logic operation (RLO) at input
S. The timer expires with the programmed duration (TV). As long as the timer is running or input S
returns signal state "1", then output Q has signal state "1". When the timer expires and the signal
state at input S is "0", output Q is reset to the signal state "0". If the signal state at input S changes
from "0" to "1" while the timer is running, the timer is stopped. The timer is only restarted after a falling
signal edge is detected at input S.
The duration is made up internally of a time value and a time base and is programmed at parameter
TV. When the instruction is started, the programmed time value is counted down towards zero. The
time base indicates the time period with which the time value is changed. The current time value is
output BI-coded at output BI and BCD-coded at output BCD.
Signal state "1" at input R resets the current time value and time base to "0". In this case, the signal
state at output Q is "0".
The "Assign off-delay timer parameters and start" instruction requires a preceding logic operation for
edge evaluation and can be placed within or at the end of the network.
The instruction data is updated at every access. It can therefore happen that the query of the data at
the start of the cycle returns different values than at the end of the cycle.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameter
The following table shows the parameters of the "Assign off-delay timer parameters and start" instruc‐
tion:

Parameter Declaration Data type Memory area Description

Time of the in‐
struction
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
S Input BOOL I, Q, M, D, L Start input
I, Q, M, D, L or
TV Input S5TIME, WORD Preset time value
constant
I, Q, M, T, C, D, L,
R Input BOOL Reset input
P or constant
Current time value
BI Output WORD I, Q, M, D, L, P
(BI-coded)

- 44 -
 S_OFFDT: Assign off-delay timer parameters and start (S7-1500)

Current time value

BCD Output WORD I, Q, M, D, L, P
(BCD format)
Q Output BOOL I, Q, M, D, L Status of the timer
For additional information on valid data types, refer to "See also".

Pulse timing diagram

The following figure shows the pulse timing diagram of the "Assign off-delay timer parameters and
start" instruction:

Example
The following example shows how the instruction works:

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "1" to "0".
The timer expires with the time value of the operand "TagIn_Number". The operand "TagOut" is set to
"1" when the timer is running and when the operand "TagIn_1" has the signal state "0". If the signal
state of the operand "TagIn_1" changes from "0" to "1" while the timer is running, the timer is reset.

- 45 -
 ---( SP ): Start pulse timer (S7-1500)

---( SP ): Start pulse timer

Description
The "Start pulse timer" instruction starts a programmed timer when a change from "0" to "1" (positive
signal edge) is detected in the result of logic operation (RLO). The time runs with the specified dura‐
tion as long as the RLO has the signal state "1". As long as the timer is running, the querying of the
timer status for "1" returns the signal state "1". If there is a change from "1" to "0" in the RLO before
the time value has elapsed, the timer stops. In this case, the querying of the timer status for "1" re‐
turns the signal state "0".
The duration is made up internally of a time value and a time base. When the instruction is started,
the programmed time value is counted down towards zero. The time base indicates the time period
with which the time value is changed.
The "Start pulse timer" instruction requires a preceding logic operation for edge evaluation and can
only be placed at the right side of the network.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameters
The following table shows the parameters of the "Start pulse timer" instruction:

Parameter Declaration Data type Memory area Description

Duration with
I, Q, M, D, L or
<Time duration> Input S5TIME, WORD which the timer
constant
expires.
Timer which is
started.
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 46 -
 ---( SP ): Start pulse timer (S7-1500)

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number" as long as the signal state of
the operand "TagIn_1" is "1". If the signal state of the operand "TagIn_1" changes from "1" to "0" be‐
fore the timer expires, the timer is stopped. As long as the timer is running, the operand "TagOut" has
the signal state "1". A signal state change of the operand "TagIn_1" from "0" to "1" resets the timer,
which stops the timer and sets the current time value to "0".

- 47 -
 ---( SE ): Start extended pulse timer (S7-1500)

---( SE ): Start extended pulse timer

Description
The "Start extended pulse timer" instruction starts a programmed timer when a change from "0" to "1"
(positive signal edge) is detected in the result of logic operation (RLO). The timer expires with the
specified duration, even if the RLO changes to the signal state "0". As long as the timer is running, the
querying of the timer status for "1" returns the signal state "1". If the RLO changes from "0" to "1"
while the timer is running, the timer is restarted with the programmed duration. The querying of the
timer status for "1" returns the signal state "0" when the timer expires.
The duration is made up internally of a time value and a time base. When the instruction is started,
the programmed time value is counted down towards zero. The time base indicates the time period
with which the time value is changed.
The "Start extended pulse timer" instruction requires a preceding logic operation for edge evaluation
and can only be placed at the right side of the network.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameter
The following table shows the parameters of the "Start extended pulse timer" instruction:

Parameter Declaration Data type Memory area Description

Duration with
I, Q, M, D, L or
<Time duration> Input S5TIME, WORD which the timer
constant
expires.
Timer which is
started.
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 48 -
 ---( SE ): Start extended pulse timer (S7-1500)

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number" without being affected by a neg‐
ative edge in the RLO. As long as the timer is running, the operand "TagOut" has the signal state "1".
If the signal state of the operand "TagIn_1" changes from "0" to "1" before the timer expires, the timer
is restarted.

- 49 -
 ---( SD ): Start on-delay timer (S7-1500)

---( SD ): Start on-delay timer

Description
The "Start on-delay timer" instruction starts a programmed timer when a change from "0" to "1" (posi‐
tive signal edge) is detected in the result of logic operation (RLO). The timer runs for the specified
duration as long as the RLO is "1". If the timer expires and the RLO still has the signal state "1", the
query of the timer status for "1" returns the signal state "1". If the RLO changes from "1" to "0" while
the timer is running, the timer is stopped. In this case, the querying of the timer status for "1" returns
the signal state "0".
The duration is made up internally of a time value and a time base. When the instruction is started,
the programmed time value is counted down towards zero. The time base indicates the time period
with which the time value is changed.
The "Start on-delay timer" instruction requires a preceding logic operation for edge evaluation and can
only be placed at the right side of the network.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameter
The following table shows the parameters of the "Start on-delay timer" instruction:

Parameter Declaration Data type Memory area Description

Duration with
I, Q, M, D, L or
<Time duration> Input S5TIME, WORD which the timer
constant
expires.
Timer which is
started.
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 50 -
 ---( SD ): Start on-delay timer (S7-1500)

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number". If the timer expires and the
RLO has the signal state "1", the operand "TagOut" is set to "1". If the signal state of the operand
"TagIn_1" changes from "1" to "0" before the timer expires, the timer is stopped. If the signal state of
the operand "TagIn_2" is "1", the timer "Timer_1" is reset, which stops the timer and sets the current
time value to "0".

- 51 -
 ---( SS ): Start retentive on-delay timer (S7-1500)

---( SS ): Start retentive on-delay timer

Description
The "Start retentive on-delay timer" instruction starts a programmed timer when a change from "0" to
"1" (positive signal edge) is detected in the result of logic operation (RLO). The timer expires with the
specified duration, even if the RLO changes to the signal state "0". When the timer expires, the query‐
ing of the timer status for "1" returns the signal state "1". After expiry of the timer, the timer can only
be restarted if it is explicitly reset.
The duration is made up internally of a time value and a time base. When the instruction is started,
the programmed time value is counted down towards zero. The time base indicates the time period
with which the time value is changed.
The "Start retentive on-delay timer" instruction requires a preceding logic operation for edge evalua‐
tion and can only be placed at the right side of the network.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameters
The following table shows the parameters of the "Start retentive on-delay timer" instruction:

Parameter Declaration Data type Memory area Description

Duration with
I, Q, M, D, L or
<Time duration> Input S5TIME, WORD which the timer
constant
expires.
Timer which is
started.
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 52 -
 ---( SS ): Start retentive on-delay timer (S7-1500)

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "0" to "1".
The timer expires with the time value of the operand "TagIn_Number". When the timer expires, the
operand "TagOut" is set to "1". If the signal state of the operand "TagIn_1" changes from "0" to "1"
while the timer is running, the timer is restarted. If the signal state of the operand "TagIn_2" is "1", the
timer "Timer_1" is reset, which stops the timer and sets the current time value to "0".

- 53 -
 ---( SF ): Start off-delay timer (S7-1500)

---( SF ): Start off-delay timer

Description
The "Start off-delay timer" instruction starts a programmed timer when a change from "1" to "0" (nega‐
tive signal edge) is detected in the result of logic operation (RLO). The timer expires with the specified
duration. As long as the timer is running, the querying of the timer status for "1" returns the signal
state "1". If the RLO changes from "0" to "1" while the timer is running, the timer is reset. The timer is
always restarted when the RLO changes from "1" to "0".
The duration is made up internally of a time value and a time base. When the instruction is started,
the programmed time value is counted down towards zero. The time base indicates the time period
with which the time value is changed.
The "Start off-delay timer" instruction requires a preceding logic operation for edge evaluation and can
only be placed at the right side of the network.

Note
In the time cell, the operating system reduces the time value in an interval specified by the time
base by one unit until the value equals "0". The decrementation is performed asynchronously to the
user program. The resulting timer is therefore at maximum up to one time interval shorter than the
desired time base.

You can find an example of how a time cell can be formed under: See also "L: Load timer value".

Parameter
The following table shows the parameters of the "Start off-delay timer" instruction:

Parameter Declaration Data type Memory area Description

Duration with
I, Q, M, D, L or
<Time duration> Input S5TIME, WORD which the timer
constant
expires.
Timer which is
started.
<Timer> InOut/Input TIMER T The number of
timers depends on
the CPU.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 54 -
 ---( SF ): Start off-delay timer (S7-1500)

The timer "Timer_1" is started when the signal state of the operand "TagIn_1" changes from "1" to "0".
The timer expires with the time value of the operand "TagIn_Number". As long as the timer is running,
the operand "TagOut" is set to "1". If the signal state of the operand "TagIn_1" changes from "1" to "0"
while the timer is running, the timer is restarted. If the signal state of the operand "TagIn_2" is "1", the
timer "Timer_1" is reset, which stops the timer and sets the current time value to "0".

- 55 -
 Counter operations (S7-1200, S7-1500)

Counter operations

This chapter contains the following information:

• IEC Counters (S7-1200, S7-1500)
• SIMATIC Counters (S7-1500)

- 56 -
 IEC Counters (S7-1200, S7-1500)

IEC Counters

This chapter contains the following information:

• CTU: Count up (S7-1200, S7-1500)
• CTD: Count down (S7-1200, S7-1500)
• CTUD: Count up and down (S7-1200, S7-1500)

- 57 -
 CTU: Count up (S7-1200, S7-1500)

CTU: Count up

Description
You can use the "Count up" instruction to increment the value at output CV. When the signal state at
the CU input changes from "0" to "1" (positive signal edge), the instruction is executed and the current
counter value at the CV output is incremented by one. When the instruction executes for the first time,
the current counter value at the CV output is set to zero. The counter is incremented each time a posi‐
tive signal edge is detected, until it reaches the high limit for the specified data type at output CV.
When the high limit is reached, the signal state at the CU input no longer has an effect on the instruc‐
tion.
You can scan the counter status at the Q output. The signal state at the Q output is determined by the
PV parameter. If the current counter value is greater than or equal to the value of the PV parameter,
the Q output is set to signal state "1". In all other cases, the Q output has signal state "0".
The value at the CV output is reset to zero when the signal state at input R changes to "1". As long as
the R input has the signal state "1", the signal state at the CU input has no effect on the instruction.

Note
Only use a counter at a single point in the program to avoid the risk of counting errors.

Each call of the "Count up" instruction must be assigned to an IEC counter in which the instruction
data is stored. An IEC counter is a structure with one of the following data types:

For S7-1200 CPU

Data block of system data type IEC_<Counter> Local tag

(Shared DB)
• CTU_SINT / CTU_USINT
• CTU_INT / CTU_UINT
• IEC_SCOUNTER / IEC_USCOUNTER
• CTU_DINT / CTU_UDINT
• IEC_COUNTER / IEC_UCOUNTER
• IEC_SCOUNTER / IEC_USCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER
• IEC_COUNTER / IEC_UCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER

For S7-1500 CPU

Data block of system data type IEC_<Counter> Local tag

(Shared DB)
• CTU_SINT / CTU_USINT
• CTU_INT / CTU_UINT
• IEC_SCOUNTER / IEC_USCOUNTER
• CTU_DINT / CTU_UDINT
• IEC_COUNTER / IEC_UCOUNTER
• CTU_LINT / CTU_ULINT
• IEC_DCOUNTER / IEC_UDCOUNTER
• IEC_SCOUNTER / IEC_USCOUNTER
• IEC_LCOUNTER / IEC_ULCOUNTER
• IEC_COUNTER / IEC_UCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER

- 58 -
 CTU: Count up (S7-1200, S7-1500)

• IEC_LCOUNTER / IEC_ULCOUNTER

You can declare an IEC counter as follows:

• Declaration of a data block of system data type IEC_<Counter> (for example, "MyIEC_COUNTER")
• Declaration as a local tag of the type CTU_<Data type> or IEC_<Counter> in the "Static" section of
a block (for example #MyIEC_COUNTER)
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the IEC counter is stored in its own data block (single instance) or as a local tag (multi-
instance) in the block interface. If you create a separate data block, you will find it in the project tree in
the "Program resources" folder under "Program blocks > System blocks". For additional information
on this topic, refer to "See also".
If you create the IEC counter in a separate data block (single instance), the instance data block is cre‐
ated by default with "optimized block access" and the individual tags defined as retentive. For addi‐
tional information on setting retentivity in a instance data block, refer to "See also".
If you create the IEC counter as local tag (multi-instance) in a function block with "optimized block ac‐
cess", this is defined as retentive in the block interface.
The execution of the "Count up" instruction requires a preceding logic operation. It can be placed with‐
in or at the end of the network.

Parameters
The following table lists the parameters of the "Count up" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
I, Q, M, D, L I, Q, M, D, L or
CU Input BOOL Count input
or constant constant
I, Q, M, D, L, I, Q, M, T, C,
R Input BOOL P or con‐ D, L, P or con‐ Reset input
stant stant
I, Q, M, D, L, Value at which
I, Q, M, D, L, P
PV Input Integers P or con‐ the output Q is
or constant
stant set.
Q Output BOOL I, Q, M, D, L I, Q, M, D, L Counter status
Integers, I, Q, M, D, L, Current counter
CV Output I, Q, M, D, L, P
CHAR, DATE P value
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 59 -
 CTU: Count up (S7-1200, S7-1500)

When the signal state of the "TagIn_1" operand changes from "0" to "1", the "Count up" instruction
executes and the current counter value of the "Tag_CV" operand is incremented by one. With each
additional positive signal edge, the counter value is incremented until the high limit of the data type
(INT = 32767) is reached.
The value of the PV parameter is adopted as the limit for determining the "TagOut" output. The "Tag‐
Out" output has signal state "1" as long as the current counter value is greater than or equal to the
value of the "Tag_PV" operand. In all other cases, the "TagOut" output has signal state "0".

- 60 -
 CTD: Count down (S7-1200, S7-1500)

CTD: Count down

Description
You can use the "Count down" instruction to decrement the value at output CV. When the signal state
at the CD input changes from "0" to "1" (positive signal edge), the instruction is executed and the cur‐
rent counter value at the CV output is decremented by one. When the instruction executes the first
time, the counter value of the CV parameter is set to the value of the PV parameter. Each time a posi‐
tive signal edge is detected, the counter value is decremented until it reaches the low limit of the
specified data type. When the low limit is reached, the signal state at the CD input no longer has an
effect on the instruction.
You can scan the counter status at the Q output. If the current counter value is less than or equal to
zero, the Q output is set to signal state "1". In all other cases, the Q output has signal state "0".
The value at the CV output is set to the value of the PV parameter when the signal state at the LD
input changes to "1". As long as the LD input has the signal state "1", the signal state at the CD input
has no effect on the instruction.

Note
Only use a counter at a single point in the program to avoid the risk of counting errors.

Each call of the "Count down" instruction must be assigned an IEC counter in which the instruction
data is stored. An IEC counter is a structure with one of the following data types:

For S7-1200 CPU

Data block of system data type IEC_<Counter> Local tag

(Shared DB)
• CTD_SINT / CTD_USINT
• CTD_INT / CTD_UINT
• IEC_SCOUNTER / IEC_USCOUNTER
• CTD_DINT / CTD_UDINT
• IEC_COUNTER / IEC_UCOUNTER
• IEC_SCOUNTER / IEC_USCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER
• IEC_COUNTER / IEC_UCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER

For S7-1500 CPU

Data block of system data type IEC_<Counter> Local tag

(Shared DB)
• CTD_SINT / CTD_USINT
• CTD_INT / CTD_UINT
• IEC_SCOUNTER / IEC_USCOUNTER
• CTD_DINT / CTD_UDINT
• IEC_COUNTER / IEC_UCOUNTER
• CTD_LINT / CTD_ULINT
• IEC_DCOUNTER / IEC_UDCOUNTER
• IEC_SCOUNTER / IEC_USCOUNTER
• IEC_LCOUNTER / IEC_ULCOUNTER
• IEC_COUNTER / IEC_UCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER

- 61 -
 CTD: Count down (S7-1200, S7-1500)

• IEC_LCOUNTER / IEC_ULCOUNTER

You can declare an IEC counter as follows:

• Declaration of a data block of system data type IEC_<Counter> (for example, "MyIEC_COUNTER")
• Declaration as a local tag of the type CTD_<Data type> or IEC_<Counter> in the "Static" section of
a block (for example #MyIEC_COUNTER)
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the IEC counter is stored in its own data block (single instance) or as a local tag (multi-
instance) in the block interface. If you create a separate data block, you will find it in the project tree in
the "Program resources" folder under "Program blocks > System blocks". For additional information
on this topic, refer to "See also".
If you create the IEC counter in a separate data block (single instance), the instance data block is cre‐
ated by default with "optimized block access" and the individual tags defined as retentive. For addi‐
tional information on setting retentivity in a instance data block, refer to "See also".
If you create the IEC counter as local tag (multi-instance) in a function block with "optimized block ac‐
cess", this is defined as retentive in the block interface.
The execution of the "Count down" instruction requires a preceding logic operation. It can be placed
within or at the end of the network.

Parameters
The following table lists the parameters of the "Count down" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
I, Q, M, D, L I, Q, M, D, L or
CD Input BOOL Count input
or constant constant
I, Q, M, D, L, I, Q, M, T, C,
LD Input BOOL P or con‐ D, L, P or con‐ Load input
stant stant
I, Q, M, D, L, Value at which
I, Q, M, D, L, P
PV Input Integers P or con‐ the output Q is
or constant
stant set.
Q Output BOOL I, Q, M, D, L I, Q, M, D, L Counter status
Integers, I, Q, M, D, L, Current counter
CV Output I, Q, M, D, L, P
CHAR, DATE P value
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 62 -
 CTD: Count down (S7-1200, S7-1500)

When the signal state of the "TagIn_1" operand changes from "0" to "1", the "Count down" instruction
executes and the value at the "Tag_CV" output is decremented by one. With each additional positive
signal edge, the counter value is decremented until the low limit of the specified data type (INT =
-32768) is reached.
The "TagOut" output has signal state "1" as long as the current counter value is less than or equal to
zero. In all other cases, the "TagOut" output has signal state "0".

- 63 -
 CTUD: Count up and down (S7-1200, S7-1500)

CTUD: Count up and down

Description
You can use the "Count up and down" instruction to increment and decrement the counter value at
the CV output. If the signal state at the CU input changes from "0" to "1" (positive signal edge), the
current counter value is incremented by one and stored at the CV output. If the signal state at the CD
input changes from "0" to "1" (positive signal edge), the counter value at the CV output is decremen‐
ted by one. If there is a positive signal edge at the CU and CD inputs in one program cycle, the cur‐
rent counter value at the CV output remains unchanged.
The counter value can be incremented until it reaches the high limit of the data type specified at the
CV output. When the high limit is reached, the counter value is no longer incremented on a positive
signal edge. When the low limit of the specified data type is reached, the counter value is not decre‐
mented any further.
When the signal state at the LD input changes to "1", the counter value at the CV output is set to the
value of the PV parameter. As long as the LD input has the signal state "1", the signal state at the CU
and CD inputs has no effect on the instruction.
The counter value is set to zero when the signal state at the R input changes to "1". As long as the R
input has the signal state "1", a change in the signal state of the CU, CD and LD inputs has no effect
on the "Count up and down" instruction.
You can scan the current status of the up counter at the QU output. If the current counter value is
greater than or equal to the value of the PV parameter, the QU output is set to signal state "1". In all
other cases, the QU output has signal state "0".
You can scan the current status of the down counter at the QD output. If the current counter value is
less than or equal to zero, the QD output is set to signal state "1". In all other cases, the QD output
has signal state "0".

Note
Only use a counter at a single point in the program to avoid the risk of counting errors.

Each call of the "Count up and down" instruction must be assigned an IEC counter in which the in‐
struction data is stored. An IEC counter is a structure with one of the following data types:

For S7-1200 CPU

Data block of system data type IEC_<Counter> Local tag

(Shared DB)
• CTUD_SINT / CTUD_USINT
• CTUD_INT / CTUD_UINT
• IEC_SCOUNTER / IEC_USCOUNTER
• CTUD_DINT / CTUD_UDINT
• IEC_COUNTER / IEC_UCOUNTER
• IEC_SCOUNTER / IEC_USCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER
• IEC_COUNTER / IEC_UCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER

For S7-1500 CPU

- 64 -
 CTUD: Count up and down (S7-1200, S7-1500)

Data block of system data type IEC_<Counter> Local tag

(Shared DB)
• CTUD_SINT / CTUD_USINT
• CTUD_INT / CTUD_UINT
• IEC_SCOUNTER / IEC_USCOUNTER • CTUD_DINT / CTUD_UDINT
• IEC_COUNTER / IEC_UCOUNTER • CTUD_LINT / CTUD_ULINT
• IEC_DCOUNTER / IEC_UDCOUNTER • IEC_SCOUNTER / IEC_USCOUNTER
• IEC_LCOUNTER / IEC_ULCOUNTER • IEC_COUNTER / IEC_UCOUNTER
• IEC_DCOUNTER / IEC_UDCOUNTER
• IEC_LCOUNTER / IEC_ULCOUNTER

You can declare an IEC counter as follows:

• Declaration of a data block of system data type IEC_<Counter> (for example, "MyIEC_COUNTER")
• Declaration as a local tag of the type CTUD_<Data type> or IEC_<Counter> in the "Static" section
of a block (for example #MyIEC_COUNTER)
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the IEC counter is stored in its own data block (single instance) or as a local tag (multi-
instance) in the block interface. If you create a separate data block, you will find it in the project tree in
the "Program resources" folder under "Program blocks > System blocks". For additional information
on this topic, refer to "See also".
If you create the IEC counter in a separate data block (single instance), the instance data block is cre‐
ated by default with "optimized block access" and the individual tags defined as retentive. For addi‐
tional information on setting retentivity in a instance data block, refer to "See also".
If you create the IEC counter as local tag (multi-instance) in a function block with "optimized block ac‐
cess", this is defined as retentive in the block interface.
The execution of the "Count up and down" instruction requires a preceding logic operation. It can be
placed within or at the end of the network.

Parameters
The following table lists the parameters of the "Count up and down" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
I, Q, M, D, L I, Q, M, D, L or
CU Input BOOL Count up input
or constant constant
I, Q, M, D, L I, Q, M, D, L or Count down in‐
CD Input BOOL
or constant constant put
I, Q, M, D, L, I, Q, M, T, C,
R Input BOOL P or con‐ D, L, P or con‐ Reset input
stant stant
I, Q, M, D, L, I, Q, M, T, C,
LD Input BOOL P or con‐ D, L, P or con‐ Load input
stant stant
I, Q, M, D, L, Value at which
I, Q, M, D, L, P
PV Input Integers P or con‐ the output QU
or constant
stant is set.

- 65 -
 CTUD: Count up and down (S7-1200, S7-1500)

Status of the
QU Output BOOL I, Q, M, D, L I, Q, M, D, L
up counter
Status of the
QD Output BOOL I, Q, M, D, L I, Q, M, D, L
down counter
Integers, I, Q, M, D, L, Current counter
CV Output I, Q, M, D, L, P
CHAR, DATE P value
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

If the signal state at the "TagIn_1" or "TagIn_2" input changes from "0" to "1" (positive signal edge),
the "Count up and down" instruction is executed. When there is a positive signal edge at the "Ta‐
gIn_1" input, the current counter value is incremented by one and stored at the "Tag_CV" output.
When there is a positive signal edge at the "TagIn_2" input, the counter value is decremented by one
and stored at the "Tag_CV" output. When there is a positive signal edge at the CU input, the counter
value is incremented until it reaches the high limit of 32767. If input CD has a positive signal edge, the
counter value is decremented until it reaches the low limit of INT = -32768.
The "TagOut" output has signal state "1" as long as the current counter value is greater than or equal
to the value at the "Tag_PV" input. In all other cases, the "TagOut" output has signal state "0".
The "TagOut_QD" output has signal state "1" as long as the current counter value is less than or
equal to zero. In all other cases, the "TagOut_QD" output has signal state "0".

- 66 -
 SIMATIC Counters (S7-1500)

SIMATIC Counters

This chapter contains the following information:

• S_CUD: Assign parameters and count up / down (S7-1500)
• S_CU: Assign parameters and count up (S7-1500)
• S_CD: Assign parameters and count down (S7-1500)
• ---( SC ): Set counter value (S7-1500)
• ---( CU ): Count up (S7-1500)
• ---( CD ): Count down (S7-1500)

- 67 -
 S_CUD: Assign parameters and count up / down (S7-1500)

S_CUD: Assign parameters and count up / down

Description
You can use the "Assign parameters and count up / down" instruction to increment or decrement the
value of a counter. If the signal state at the CU input changes from "0" to "1" (positive signal edge),
the current counter value is incremented by one. If the signal state at the CD input changes from "0"
to "1" (positive signal edge), the counter value is decremented by one. The current counter value is
output as a hexadecimal value at output CV and BCD-coded at output CV_BCD. If there is a positive
signal edge at the CU and CD inputs in one program cycle, the counter value remains unchanged.
The counter value can be incremented until the high limit of "999" is reached. When the high limit val‐
ue is reached, the counter value is no longer incremented on a positive signal edge. When the low
limit "0" is reached, the counter value is not decremented any further.
When the signal state at input S changes from "0" to "1", the counter value is set to the value of the
PV parameter. If the counter is set and if RLO is "1" at the inputs CU and CD, the counter counts
accordingly in the next scan cycle, even if no change in the signal edge was detected.
The counter value is set to zero when the signal state at the R input changes to "1". As long as the R
input has the signal state "1", processing of the signal state of the CU, CD and S inputs has no effect
on the counter value.
The signal state at output Q is "1" if the counter value is greater than zero. If the counter value is
equal to zero, output Q has the signal state "0".

Note
Only use a counter at a single point in the program to avoid the risk of counting errors.

The "Assign parameters and count up / down" instruction requires a preceding logic operation for
edge evaluation and can be placed within or at the end of the network.

Parameters
The following table shows the parameters of the "Assign parameters and count up / down" instruction:

Parameter Declaration Data type Memory area Description

Counter of the in‐
struction
<Counter> InOut/Input COUNTER C The number of
counters depends
on the CPU.
CU Input BOOL I, Q, M, D, L Count up input
I, Q, M, D, L, T, C
CD Input BOOL Count down input
or constant
I, Q, M, D, L, T, C Input for preset‐
S Input BOOL
or constant ting counter
Preset counter
I, Q, M, D, L or
PV Input WORD value (C#0 to
constant
C#999)

- 68 -
 S_CUD: Assign parameters and count up / down (S7-1500)

I, Q, M, D, L, T, C
R Input BOOL Reset input
or constant
Current counter
WORD, S5TIME,
BI Output I, Q, M, D, L value (hexadeci‐
DATE
mal)
Current counter
WORD, S5TIME,
CV_BCD Output I, Q, M, D, L value (BCD for‐
DATE
mat)
Status of the
Q Output BOOL I, Q, M, D, L
counter
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

If the signal state at the "TagIn_1"" or "TagIn_2" input changes from "0" to "1" (positive signal edge),
the "Assign parameters and count up / down" instruction is executed. When there is a positive signal
edge at the "TagIn_1" input and the current counter value is less than "999", the counter value is in‐
cremented by one. When there is a positive signal edge at the "TagIn_2" input and the current counter
value is greater than "0", the counter value is decremented by one.
When the signal state at input "TagIn_3" changes from "0" to "1", the counter value is set to the value
of the operand "TagPresetValue". The counter value is reset to "0" when the "TagIn_4" operand has
signal state "1".
The current counter value is saved as a hexadecimal value in the operand "TagValue_1" and BCD-
coded in the operand "TagValue_2".
The "TagOut" output has the signal state "1" as long as the current counter value is not equal to "0".

- 69 -
 S_CU: Assign parameters and count up (S7-1500)

S_CU: Assign parameters and count up

Description
You can use the "Assign parameters and count up" instruction to increment the value of a counter. If
the signal state at the CU input changes from "0" to "1" (positive signal edge), the current counter val‐
ue is incremented by one. The current counter value is output as a hexadecimal value at output CV
and BCD-coded at output CV_BCD. The counter value can be incremented until the limit of "999" is
reached. When the limit is reached, the counter value is no longer incremented on a positive signal
edge.
When the signal state at input S changes from "0" to "1", the counter value is set to the value of the
PV parameter. If the counter is set and if RLO at input CU is "1", the counter will count accordingly in
the next scan cycle, even when no change has been detected in the signal edge.
The counter value is set to zero when the signal state at the R input changes to "1". As long as the R
input has the signal state "1", processing of the signal state of the CU and S inputs has no effect on
the counter value.
The signal state at output Q is "1" if the counter value is greater than zero. If the counter value is
equal to zero, output Q has the signal state "0".

Note
Only use a counter at a single point in the program to avoid the risk of counting errors.

The "Assign parameters and count up" instruction requires a preceding logic operation for edge evalu‐
ation and can be placed within or at the end of the network.

Parameter
The following table shows the parameters of the "Assign parameters and count up" instruction:

Parameter Declaration Data type Memory area Description

Counter of the in‐
struction
<Counter> InOut/Input COUNTER C The number of
counters depends
on the CPU.
CU Input BOOL I, Q, M, D, L Count up input
I, Q, M, D, L, T, C Input for preset‐
S Input BOOL
or constant ting counter
Preset counter
I, Q, M, D, L or
PV Input WORD value (C#0 to
constant
C#999)
I, Q, M, D, L, T, C
R Input BOOL Reset input
or constant
Current counter
WORD, S5TIME,
CV Output I, Q, M, D, L value (hexadeci‐
DATE
mal)

- 70 -
 S_CU: Assign parameters and count up (S7-1500)

Current counter
WORD, S5TIME,
CV_BCD Output I, Q, M, D, L value (BCD for‐
DATE
mat)
Status of the
Q Output BOOL I, Q, M, D, L
counter
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

When the signal state at the "TagIn_1" input changes from "0" to "1" (positive signal edge) and the
current counter value is less than "999", the counter value is incremented by one. When the signal
state at input "TagIn_2" changes from "0" to "1", the counter value is set to the value of the operand
"TagPresetValue". The counter value is reset to "0" when the "TagIn_3" operand has signal state "1".
The current counter value is saved as a hexadecimal value in the operand "TagValue_1" and BCD-
coded in the operand "TagValue_2".
The "TagOut" output has the signal state "1" as long as the current counter value is not equal to "0".

- 71 -
 S_CD: Assign parameters and count down (S7-1500)

S_CD: Assign parameters and count down

Description
You can use the "Assign parameters and count down" instruction to decrement the value of a counter.
If the signal state at the CD input changes from "0" to "1" (positive signal edge), the counter value is
decremented by one. The current counter value is output as a hexadecimal value at output CV and
BCD-coded at output CV_BCD. The counter value is decremented until the low limit of "0" is reached.
When the low limit is reached, the counter value is no longer decremented on a positive signal edge.
When the signal state at input S changes from "0" to "1", the counter value is set to the value of the
PV parameter. If the counter is set and if RLO at input CD is "1", the counter will count accordingly in
the next scan cycle, even when no change has been detected in the signal edge.
The counter value is set to zero when the signal state at the R input changes to "1". As long as the R
input has the signal state "1", processing of the signal state of the CD and S inputs has no effect on
the counter value.
The signal state at output Q is "1" if the counter value is greater than zero. If the counter value is
equal to zero, output Q has the signal state "0".

Note
Only use a counter at a single point in the program to avoid the risk of counting errors.

The "Assign parameters and count down" instruction requires a preceding logic operation for edge
evaluation and can be placed within or at the end of the network.

Parameter
The following table shows the parameters of the "Assign parameters and count down" instruction:

Parameter Declaration Data type Memory area Description

Counter of the in‐
struction
<Counter> InOut/Input COUNTER C The number of
counters depends
on the CPU.
I, Q, M, D, L or
CD Input BOOL Count down input
constant
I, Q, M, D, L, T, C Input for preset‐
S Input BOOL
or constant ting counter
Preset counter
I, Q, M, D, L or
PV Input WORD value (C#0 to
constant
C#999)
I, Q, M, D, L, T, C
R Input BOOL Reset input
or constant
Current counter
WORD, S5TIME,
CV Output I, Q, M, D, L value (hexadeci‐
DATE
mal)

- 72 -
 S_CD: Assign parameters and count down (S7-1500)

Current counter
WORD, S5TIME,
CV_BCD Output I, Q, M, D, L value (BCD for‐
DATE
mat)
Status of the
Q Output BOOL I, Q, M, D, L
counter
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

When the signal state at the "TagIn_1" input changes from "0" to "1" (positive signal edge) and the
current counter value is greater than "0", the counter value is decremented by one. When the signal
state at input "TagIn_2" changes from "0" to "1", the counter value is set to the value of the operand
"TagPresetValue". The counter value is reset to "0" when the "TagIn_3" operand has signal state "1".
The current counter value is saved as a hexadecimal value in the operand "TagValue_1" and BCD-
coded in the operand "TagValue_2".
The "TagOut" output has the signal state "1" as long as the current counter value is not equal to "0".

- 73 -
 ---( SC ): Set counter value (S7-1500)

---( SC ): Set counter value

Description
You can use the "Set counter value" instruction to set the value of a counter. The instruction is execu‐
ted when the result of logic operation (RLO) at the input changes from "0" to "1". When the instruction
is executed, the counter is set to the specified counter value.
The "Set counter value" instruction needs a preceding logic operation for the edge evaluation and can
only be placed on the right edge of the network.

Parameter
The following table lists the parameters of the "Set counter value" instruction:

Parameter Declaration Data type Memory area Description

Value with which
the counter is pre‐
I, Q, M, D, L or set in the BCD for‐
<Count value> Input WORD
constant mat.
(C#0 to C#999)
Counter that is
<Counter> InOut/Input COUNTER C
preset.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

the counter "Counter_1" starts with the value "100" when the signal state of the "TagIn" operand
changes from "0" to "1".

- 74 -
 ---( CU ): Count up (S7-1500)

---( CU ): Count up

Description
With the "Count up" instruction you can increment the value of the specified counter by one if there is
a positive signal edge in the result of logic operation (RLO). The counter value can be incremented
until the limit of "999" is reached. When the limit is reached, the counter value is no longer incremen‐
ted on a positive signal edge.
The "Count up" instruction requires a preceding logic operation for edge evaluation and can only be
placed at the right side of the network.

Parameter
The following table shows the parameters of the "Count up" instruction:

Parameter Declaration Data type Memory area Description

Counter whose
<Counter> InOut/Input COUNTER C value is incremen‐
ted.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

When the signal state of the "TagIn_1" operand changes from "0" to "1" (positive signal edge), the
counter "Counter_1" is preset with the value "100".
The value of the counter "Counter_1" is incremented by one when the signal state of the operand "Ta‐
gIn_2" changes from "0" to "1".
When the operand "TagIn_3" has the signal state "1", the value of the counter "Counter_1" is reset to
"0".

- 75 -
 ---( CD ): Count down (S7-1500)

---( CD ): Count down

Description
With the "Count down" instruction you can increment the value of the specified counter by one if there
is a positive signal edge in the result of logic operation (RLO). The counter value can be decremented
until the limit of "0" is reached. When the limit is reached, the counter value is no longer changed on a
positive signal edge.
The "Count down" instruction requires a preceding logic operation for edge evaluation and can only
be placed at the right side of the network.

Parameter
The following table shows the parameters of the "Count down" instruction:

Parameter Declaration Data type Memory area Description

Counter whose
<Counter> InOut/Input COUNTER C value is decre‐
mented.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

When the signal state of the "TagIn_1" operand changes from "0" to "1" (positive signal edge), the
counter "Counter_1" is preset with the value "100".
The value of the counter "Counter_1" is decremented by one when the signal state of the operand
"TagIn_2" changes from "0" to "1".
When the operand "TagIn_3" has the signal state "1", the value of the counter "Counter_1" is reset to
"0".

- 76 -
 Comparator operations (S7-1200, S7-1500)

Comparator operations

This chapter contains the following information:

• CMP ==: Equal (S7-1200, S7-1500)
• CMP <>: Not equal (S7-1200, S7-1500)
• CMP >=: Greater or equal (S7-1200, S7-1500)
• CMP <=: Less or equal (S7-1200, S7-1500)
• CMP >: Greater than (S7-1200, S7-1500)
• CMP <: Less than (S7-1200, S7-1500)
• IN_RANGE: Value within range (S7-1200, S7-1500)
• OUT_RANGE: Value outside range (S7-1200, S7-1500)
• ----I OK I----: Check validity (S7-1200, S7-1500)
• ----I NOT_OK I----: Check invalidity (S7-1200, S7-1500)
• VARIANT instructions (S7-1500)

- 77 -
 CMP ==: Equal (S7-1200, S7-1500)

CMP ==: Equal

Description
You can use the "Equal" instruction to determine if a first comparison value (<Operand1>) is equal to
a second comparison value (<Operand2>).
If the condition of the comparison is fulfilled, the instruction returns the result of logic operation (RLO)
"1". If the comparison condition is not fulfilled, the instruction returns RLO "0". The RLO of the instruc‐
tion is logically combined with the RLO of the entire rung as follows:
• By AND, when the comparison instruction is connected in series.
• By OR, when the comparison instruction is connected in parallel.

Specify the first comparison value (<Operand1>) at the operand placeholder above the instruction.
Specify the second comparison value (<Operand2>) at the operand placeholder below the instruction.
The individual characters are compared by means of their code (for example, 'a' is greater than 'A')
during the comparison of the strings. The comparison is performed from left to right. The first charac‐
ter to be different decides the result of the comparison.
The following table lists examples of string comparisons:

<Operand1> <Operand2> RLO of the instruction

'AA' 'AA' 1
'Hello World' 'HelloWorld' 0
'AA' 'aa' 0
You can also use the "Equal" instruction to compare individual characters of a string. The number of
the character to be compared is specified in square brackets next to the operand name. "MyString[2]",
for example, compares the second character of the "MyString" string.
If IEC check is enabled, the operands to be compared must be of the same data type. If IEC check is
not enabled, the width (length) of the operands must be the same. When floating-point numbers are
compared, the operands to be compared must have the same data type regardless of the setting for
the IEC Check.

Note
Comparison of floating-point numbers
If you want to compare the data types REAL or LREAL, instead of the instruction "CMP ==: Equal",
use the instruction "IN_RANGE: Value within range".

Note
Comparison of the data type PORT
To be able to compare the operands of the PORT data type with the "Equal" instruction, you need
to select the WORD data type from the drop-down list of the instructions box.

Parameters
The following table lists the parameters of the "Equal" instruction:

- 78 -
 CMP ==: Equal (S7-1200, S7-1500)

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
Bit strings, in‐
Bit strings, in‐
tegers, float‐
tegers, float‐
ing-point num‐
ing-point num‐
bers, character I, Q, M, D, L, P First compari‐
<Operand1> Input bers, character
strings, TIME, or constant son value
strings, TIME,
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
Bit strings, in‐
Bit strings, in‐
tegers, float‐
tegers, float‐
ing-point num‐
ing-point num‐
bers, character I, Q, M, D, L, P Second value
<Operand2> Input bers, character
strings, TIME, or constant to compare
strings, TIME,
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "TagOut" output is set when the following conditions are fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The condition of the comparison instruction is fulfilled if "Tag_Value1" = "Tag_Value2".

- 79 -
 CMP <>: Not equal (S7-1200, S7-1500)

CMP <>: Not equal

Description
You can use the "Not equal" instruction to determine if a first comparison value (<Operand1>) is not
equal to a second comparison value (<Operand2>).
If the condition of the comparison is fulfilled, the instruction returns the result of logic operation (RLO)
"1". If the comparison condition is not fulfilled, the instruction returns RLO "0". The RLO of the instruc‐
tion is logically combined with the RLO of the entire rung as follows:
• By AND, when the comparison instruction is connected in series.
• By OR, when the comparison instruction is connected in parallel.

Specify the first comparison value (<Operand1>) at the operand placeholder above the instruction.
Specify the second comparison value (<Operand2>) at the operand placeholder below the instruction.
The individual characters are compared by means of their code (for example, 'a' is greater than 'A')
during the comparison of the strings. The comparison is performed from left to right. The first charac‐
ter to be different decides the result of the comparison.
The following table lists examples of string comparisons:

<Operand1> <Operand2> RLO of the instruction

'AA' 'aa' 1
'Hello World' 'HelloWorld' 1
'AA' 'AA' 0
You can also use the "Not equal" instruction to compare individual characters of a string. The number
of the character to be compared is specified in square brackets next to the operand name. "My‐
String[2]", for example, compares the second character of the "MyString" string.
If IEC check is enabled, the operands to be compared must be of the same data type. If IEC check is
not enabled, the width (length) of the operands must be the same. If the floating-point numbers are
being compared, the operands to be compared must be of the same data type regardless of the IEC
check setting.

Note
Comparison of the data type PORT
To be able to compare the operands of the PORT data type with the "Not equal" instruction, you
need to select the WORD data type from the drop-down list of the instructions box.

Parameters
The following table lists the parameters of the "Not equal" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
Bit strings, in‐ Bit strings, in‐ I, Q, M, D, L, P First compari‐
<Operand1> Input
tegers, float‐ tegers, float‐ or constant son value

- 80 -
 CMP <>: Not equal (S7-1200, S7-1500)

ing-point num‐
ing-point num‐
bers, character
bers, character
strings, TIME,
strings, TIME,
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
Bit strings, in‐
Bit strings, in‐
tegers, float‐
tegers, float‐
ing-point num‐
ing-point num‐
bers, character I, Q, M, D, L, P Second value
<Operand2> Input bers, character
strings, TIME, or constant to compare
strings, TIME,
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "TagOut" output is set when the following conditions are fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The condition of the comparison instruction is fulfilled if "Tag_Value1" <> "Tag_Value2".

- 81 -
 CMP >=: Greater or equal (S7-1200, S7-1500)

CMP >=: Greater or equal

Description
You can use the "Greater or equal" instruction to determine if a first comparison value (<Operand1>)
is greater than or equal to a second comparison value (<Operand2>). Both values to be compared
must be of the same data type.
If the condition of the comparison is fulfilled, the instruction returns the result of logic operation (RLO)
"1". If the comparison condition is not fulfilled, the instruction returns RLO "0". The RLO of the instruc‐
tion is logically combined with the RLO of the entire rung as follows:
• By AND, when the comparison instruction is connected in series.
• By OR, when the comparison instruction is connected in parallel.

Specify the first comparison value (<Operand1>) at the operand placeholder above the instruction.
Specify the second comparison value (<Operand2>) at the operand placeholder below the instruction.
The individual characters are compared by means of their code (for example, 'a' is greater than 'A')
during the comparison of the strings. The comparison is performed from left to right. The first charac‐
ter to be different decides the result of the comparison. If the left part of the longer string is identical to
the shorter string, the longer string is considered greater.
The following table lists examples of string comparisons:

<Operand1> <Operand2> RLO of the instruction

'BB' 'AA' 1
'AAA' 'AA' 1
'Hello World' 'Hello World' 1
'Hello World' 'HelloWorld' 0
'AA' 'aa' 0
'AAA' 'a' 0
You can also use the "Greater or equal" instruction to compare individual characters of a string. The
number of the character to be compared is specified in square brackets next to the operand name.
"MyString[2]", for example, compares the second character of the "MyString" string.
When time values are compared, the RLO of the instruction is "1" if the point of time at <Operand1> is
greater (more recent) than or equal to the point of time at <Operand2>.

Parameters
The following table lists the parameters of the "Greater or equal" instruction:

Parameters Declaration Data type Memory area Description

S7-1200 S7-1500
Integers, float‐ Integers, float‐
ing-point num‐ ing-point num‐ I, Q, M, D, L, P First compari‐
<Operand1> Input
bers, character bers, character or constant son value
strings, TIME, strings, TIME,

- 82 -
 CMP >=: Greater or equal (S7-1200, S7-1500)

LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
Integers, float‐
Integers, float‐
ing-point num‐
ing-point num‐
bers, character
bers, character I, Q, M, D, L, P Second value
<Operand2> Input strings, TIME,
strings, TIME, or constant to compare
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "TagOut" output is set when the following conditions are fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The condition of the comparison instruction is fulfilled if "Tag_Value1" >= "Tag_Value2".

- 83 -
 CMP <=: Less or equal (S7-1200, S7-1500)

CMP <=: Less or equal

Description
You can use the "Less or equal" instruction to determine if a first comparison value (<Operand1>) is
less than or equal to a second comparison value (<Operand2>). Both values to be compared must be
of the same data type.
If the condition of the comparison is fulfilled, the instruction returns the result of logic operation (RLO)
"1". If the comparison condition is not fulfilled, the instruction returns RLO "0". The RLO of the instruc‐
tion is logically combined with the RLO of the entire rung as follows:
• By AND, when the comparison instruction is connected in series.
• By OR, when the comparison instruction is connected in parallel.

Specify the first comparison value (<Operand1>) at the operand placeholder above the instruction.
Specify the second comparison value (<Operand2>) at the operand placeholder below the instruction.
The individual characters are compared by means of their code (for example, 'a' is greater than 'A')
during the comparison of the strings. The comparison is performed from left to right. The first charac‐
ter to be different decides the result of the comparison. If the left part of the longer string is identical to
the shorter string, the shorter string is considered smaller.
The following table lists examples of string comparisons:

<Operand1> <Operand2> RLO of the instruction

'AA' 'aa' 1
'AAA' 'a' 1
'Hello World' 'Hello World' 1
'HelloWorld' 'Hello World' 0
'BB' 'AA' 0
'AAA' 'AA' 0
You can also use the "Less or equal" instruction to compare individual characters of a string. The
number of the character to be compared is specified in square brackets next to the operand name.
"MyString[2]", for example, compares the second character of the "MyString" string.
When time values are compared, the RLO of the instruction is "1" if the point of time at <Operand1> is
less (less recent) than or equal to the point of time at <Operand2>.

Parameters
The following table lists the parameters of the "Less or equal" instruction:

Parameters Declaration Data type Memory area Description

S7-1200 S7-1500
Integers, float‐ Integers, float‐
ing-point num‐ ing-point num‐ I, Q, M, D, L, P First compari‐
<Operand1> Input
bers, character bers, character or constant son value
strings, TIME, strings, TIME,

- 84 -
 CMP <=: Less or equal (S7-1200, S7-1500)

LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
Integers, float‐
Integers, float‐
ing-point num‐
ing-point num‐
bers, character
bers, character I, Q, M, D, L, P Second value
<Operand2> Input strings, TIME,
strings, TIME, or constant to compare
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "TagOut" output is set when the following conditions are fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The condition of the comparison instruction is fulfilled if "Tag_Value1" <= "Tag_Value2".

- 85 -
 CMP >: Greater than (S7-1200, S7-1500)

CMP >: Greater than

Description
You can use the "Greater than" instruction to determine if a first comparison value (<Operand1>) is
greater than a second comparison value (<Operand2>). Both values to be compared must be of the
same data type.
If the condition of the comparison is fulfilled, the instruction returns the result of logic operation (RLO)
"1". If the comparison condition is not fulfilled, the instruction returns RLO "0". The RLO of the instruc‐
tion is logically combined with the RLO of the entire rung as follows:
• By AND, when the comparison instruction is connected in series.

• By OR, when the comparison instruction is connected in parallel.

Specify the first comparison value (<Operand1>) at the operand placeholder above the instruction.
Specify the second comparison value (<Operand2>) at the operand placeholder below the instruction.
The individual characters are compared by means of their code (for example, 'a' is greater than 'A')
during the comparison of the strings. The comparison is performed from left to right. The first charac‐
ter to be different decides the result of the comparison. If the left part of the longer string is identical to
the shorter string, the longer string is considered greater.
The following table lists examples of string comparisons:

<Operand1> <Operand2> RLO of the instruction

'BB' 'AA' 1
'AAA' 'AA' 1
'AA' 'aa' 0
'AAA' 'a' 0
You can also use the "Greater than" instruction to compare individual characters of a string. The num‐
ber of the character to be compared is specified in square brackets next to the operand name. "My‐
String[2]", for example, compares the second character of the "MyString" string.
When time values are compared, the RLO of the instruction is "1" if the point of time at <Operand1> is
greater (more recent) than the point of time at <Operand2>.

Parameters
The following table lists the parameters of the "Greater than" instruction:

Parameters Declaration Data type Memory area Description

S7-1200 S7-1500
Integers, float‐
Integers, float‐
ing-point num‐
ing-point num‐
bers, character
bers, character I, Q, M, D, L, P First compari‐
<Operand1> Input strings, TIME,
strings, TIME, or constant son value
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT

- 86 -
 CMP >: Greater than (S7-1200, S7-1500)

Integers, float‐
Integers, float‐
ing-point num‐
ing-point num‐
bers, character
bers, character I, Q, M, D, L, P Second value
<Operand2> Input strings, TIME,
strings, TIME, or constant to compare
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "TagOut" output is set when the following conditions are fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The condition of the comparison instruction is fulfilled if "Tag_Value1" > "Tag_Value2".

- 87 -
 CMP <: Less than (S7-1200, S7-1500)

CMP <: Less than

Description
You can use the "Less than" instruction to determine if a first comparison value (<Operand1>) is less
than a second comparison value (<Operand2>). Both values to be compared must be of the same
data type.
If the condition of the comparison is fulfilled, the instruction returns the result of logic operation (RLO)
"1". If the comparison condition is not fulfilled, the instruction returns RLO "0". The RLO of the instruc‐
tion is logically combined with the RLO of the entire rung as follows:
• By AND, when the comparison instruction is connected in series.

• By OR, when the comparison instruction is connected in parallel.

Specify the first comparison value (<Operand1>) at the operand placeholder above the instruction.
Specify the second comparison value (<Operand2>) at the operand placeholder below the instruction.
The individual characters are compared by means of their code (for example, 'a' is greater than 'A')
during the comparison of the strings. The comparison is performed from left to right. The first charac‐
ter to be different decides the result of the comparison. If the left part of the longer string is identical to
the shorter string, the shorter string is considered smaller.
The following table lists examples of string comparisons:

<Operand1> <Operand2> RLO of the instruction

'AA' 'aa' 1
'AAA' 'a' 1
'BB' 'AA' 0
'AAA' 'AA' 0
You can also use the "Less than" instruction to compare individual characters of a string. The number
of the character to be compared is specified in square brackets next to the operand name. "My‐
String[2]", for example, compares the second character of the "MyString" string.
When time values are compared, the RLO of the instruction is "1" if the point of time at <Operand1> is
less (less recent) than the point of time at <Operand2>.

Parameters
The following table lists the parameters of the "Less than" instruction:

Parameters Declaration Data type Memory area Description

S7-1200 S7-1500
Integers, float‐
Integers, float‐
ing-point num‐
ing-point num‐
bers, character
bers, character I, Q, M, D, L, P First compari‐
<Operand1> Input strings, TIME,
strings, TIME, or constant son value
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT

- 88 -
 CMP <: Less than (S7-1200, S7-1500)

Integers, float‐
Integers, float‐
ing-point num‐
ing-point num‐
bers, character
bers, character I, Q, M, D, L, P Second value
<Operand2> Input strings, TIME,
strings, TIME, or constant to compare
LTIME, DATE,
DATE, TOD,
TOD, LTOD,
DTL
DTL, DT, LDT
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The "TagOut" output is set when the following conditions are fulfilled:
• The operands "TagIn_1" and "TagIn_2" have signal state "1".
• The condition of the comparison instruction is fulfilled if "Tag_Value1" < "Tag_Value2".

- 89 -
 Math functions (S7-1200, S7-1500)

Math functions

This chapter contains the following information:

• CALCULATE: Calculate (S7-1200, S7-1500)
• ADD: Add (S7-1200, S7-1500)
• SUB: Subtract (S7-1200, S7-1500)
• MUL: Multiply (S7-1200, S7-1500)
• DIV: Divide (S7-1200, S7-1500)
• MOD: Return remainder of division (S7-1200, S7-1500)
• NEG: Create twos complement (S7-1200, S7-1500)
• INC: Increment (S7-1200, S7-1500)
• DEC: Decrement (S7-1200, S7-1500)
• ABS: Form absolute value (S7-1200, S7-1500)
• MIN: Get minimum (S7-1200, S7-1500)
• MAX: Get maximum (S7-1200, S7-1500)
• LIMIT: Set limit value (S7-1200, S7-1500)
• SQR: Form square (S7-1200, S7-1500)
• SQRT: Form square root (S7-1200, S7-1500)
• LN: Form natural logarithm (S7-1200, S7-1500)
• EXP: Form exponential value (S7-1200, S7-1500)
• SIN: Form sine value (S7-1200, S7-1500)
• COS: Form cosine value (S7-1200, S7-1500)
• TAN: Form tangent value (S7-1200, S7-1500)
• ASIN: Form arcsine value (S7-1200, S7-1500)
• ACOS: Form arccosine value (S7-1200, S7-1500)
• ATAN: Form arctangent value (S7-1200, S7-1500)
• FRAC: Return fraction (S7-1200, S7-1500)
• EXPT: Exponentiate (S7-1200, S7-1500)

- 90 -
 CALCULATE: Calculate (S7-1200, S7-1500)

CALCULATE: Calculate

Description
The "Calculate" instruction is used to define and execute an expression for the calculation of mathe‐
matical operations or complex logic operations depending on the selected data type.
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
Depending on the data type selected, you can combine the functions of certain instructions to perform
a complex calculation. The expression to be calculated is specified via a dialog you can open via the
"Calculator" icon at the top of the instruction box. The expression can contain names of input parame‐
ters and the syntax of the instructions. Operand names and operand addresses cannot be specified.
In its initial state, the instruction box contains at least 2 inputs (IN1 and IN2). The number of inputs
can be extended. The inserted inputs are numbered in ascending order in the box.
The values of the inputs are used to execute the specified expression. Not all of the defined inputs
have to be used in the expression. The result of the instruction is transferred to the output OUT.

Note
If one of the mathematical operations fails in the expression, no result is transferred to the output
OUT and the enable output ENO returns the signal state "1".

If you use inputs in the expression that are not available in the box, they are inserted automatically.
This requires that there are no gaps in the numbering of the inputs to be newly defined in the expres‐
sion. For example, you cannot use the IN4 input in the expression unless the IN3 input has been de‐
fined.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".
• The result of the "Calculate" instruction is outside the range permitted for the data type specified at
the OUT output.
• A floating-point number has an invalid value.
• An error occurred during execution of one of the instructions in the expression.

The following table shows the instructions that can be executed together in the expression of the in‐
struction "Calculate", depending on the selected data type:

Data type Instruction Syntax Example

AND: AND logic operation AND
OR: OR logic operation OR
IN1 AND IN2 OR
Bit strings XOR: EXCLUSIVE OR logic operation XOR
IN3
INV: Create ones complement NOT
SWAP: Swap 1) SWAP
ADD: Add +
(IN1 + IN2) * IN3;
SUB: Subtract -
Integers (ABS(IN2)) *
MUL: Multiply *
(ABS(IN1))
DIV: Divide /

- 91 -
 CALCULATE: Calculate (S7-1200, S7-1500)

MOD: Return remainder of division MOD

INV: Create ones complement NOT
NEG: Create twos complement -(in1)
ABS: Form absolute value ABS( )
ADD: Add +
SUB: Subtract -
MUL: Multiply *
DIV: Divide /
EXPT: Exponentiate **
ABS: Form absolute value ABS( )
SQR: Form square SQR( )
SQRT: Form square root SQRT( )
LN: Form natural logarithm LN( )
((SIN(IN2) *
EXP: Form exponential value EXP( ) SIN(IN2) +
FRAC: Return fraction FRAC( ) (SIN(IN3) *
Floating-point SIN(IN3)) / IN3));
SIN: Form sine value SIN( )
numbers (SQR(SIN(IN2))
COS: Form cosine value COS( )
+
TAN: Form tangent value TAN( ) (SQR(COS(IN3))
ASIN: Form arcsine value ASIN( ) / IN2))
ACOS: Form arcosine value ACOS( )
ATAN: Form arctangent value ATAN( )
NEG: Create twos complement -(in1)
TRUNC: Truncate numerical value TRUNC( )
ROUND: Round numerical value ROUND( )
CEIL: Generate next higher integer from
CEIL( )
floating-point number
FLOOR: Generate next lower integer
FLOOR( )
from floating-point number
1) Not possible for data type BYTE.

Parameters
The following table shows the parameters of the "Calculate" instruction:

Parameters Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Bit strings, inte‐
I, Q, M, D, L, P or First available in‐
IN1 Input gers, floating-point
constant put
numbers
Bit strings, inte‐
I, Q, M, D, L, P or Second available
IN2 Input gers, floating-point
constant input
numbers

- 92 -
 CALCULATE: Calculate (S7-1200, S7-1500)

Bit strings, inte‐

I, Q, M, D, L, P or Additionally inser‐
INn Input gers, floating-point
constant ted inputs
numbers
Bit strings, inte‐ Output to which
OUT Output gers, floating-point I, Q, M, D, L, P the end result is to
numbers be transferred.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameters Operand Value

IN1 Tag_Value_1 4
IN2 Tag_Value_2 4
IN3 Tag_Value_3 3
IN4 Tag_Value_4 2
OUT Tag_Result 12
If the "Tag_Input" input has the signal state"1", the "Calculate" instruction is executed. The value of
operand "Tag_Value_1" is added to the value of operand "Tag_Value_2". The sum is multiplied with
the value of operand "Tag_Value_3". The product is divided by the value of operand "Tag_Value_4".
The quotient is transferred as end result to the operand "Tag_Result" at the OUT output of the instruc‐
tion. If the instruction is executed without errors, the enable output ENO and operand "Tag_Output"
are set to "1".

- 93 -
 ADD: Add (S7-1200, S7-1500)

ADD: Add

Description
You can use the "Add" instruction to add the value at input IN1 and the value at input IN2 and query
the sum at output OUT (OUT := IN1+IN2).
In its initial state, the instruction box contains at least 2 inputs (IN1 and IN2). The number of inputs
can be extended. The inserted inputs are numbered in ascending order in the box. When the instruc‐
tion is executed, the values of all available input parameters are added. The sum is stored at the OUT
output.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The enable input EN has the signal state "0".
• The result of the instruction is outside the range permitted for the data type specified at the OUT
output.
• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Add" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Integers, floating- I, Q, M, D, L, P or First number to be
IN1 Input
point numbers constant added
Integers, floating- I, Q, M, D, L, P or Second number to
IN2 Input
point numbers constant be added
Optional input val‐
Integers, floating- I, Q, M, D, L, P or
INn Input ues that are add‐
point numbers constant
ed.
Integers, floating-
OUT Output I, Q, M, D, L, P Sum
point numbers
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also":

Example
The following example shows how the instruction works:

- 94 -
 ADD: Add (S7-1200, S7-1500)

If operand "TagIn" has the signal state "1", the "Add" instruction is executed. The value of operand
"Tag_Value1" is added to the value of operand "Tag_Value2". The result of the addition is stored in
operand "Tag_Result". If the instruction is executed without errors, the ENO enable output has the
signal state "1" and the "TagOut" output is set.

- 95 -
 SUB: Subtract (S7-1200, S7-1500)

SUB: Subtract

Description
You can use the "Subtract" instruction to subtract the value at input IN2 from the value at input IN1
and query the difference at output OUT (OUT := IN1-IN2).
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".
• The result of the instruction is outside the range permitted for the data type specified at the OUT
output.
• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Subtract" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Integers, floating- I, Q, M, D, L, P or
IN1 Input Minuend
point numbers constant
Integers, floating- I, Q, M, D, L, P or
IN2 Input Subtracting
point numbers constant
Integers, floating-
OUT Output I, Q, M, D, L, P Difference
point numbers
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

If operand "TagIn" has the signal state "1", the "Subtract" instruction is executed. The value of oper‐
and "Tag_Value2" is subtracted from the value of operand "Tag_Value1". The result of the subtraction
is stored in operand "Tag_Result". If the instruction is executed without errors, the ENO enable output
has the signal state "1" and the "TagOut" output is set.

- 96 -
 MUL: Multiply (S7-1200, S7-1500)

MUL: Multiply

Description
You can use the "Multiply" instruction to multiply the value at input IN1 with the value at input IN2 and
query the product at output OUT (OUT := IN1*IN2).
The number of inputs can be expanded in the instruction box. The added inputs are numbered in as‐
cending order in the box. When the instruction is executed, the values of all available input parame‐
ters are multiplied. The product is stored at the OUT output.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN input has the signal state "0".

• The result is outside the range permitted for the data type specified at output OUT.

• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Multiply" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Integers, floating- I, Q, M, D, L, P or
IN1 Input Multiplier
point numbers constant
Integers, floating- I, Q, M, D, L, P or Number being
IN2 Input
point numbers constant multiplied
Optional input val‐
Integers, floating- I, Q, M, D, L, P or
INn Input ues that can be
point numbers constant
multiplied.
Integers, floating-
OUT Output I, Q, M, D, L, P Product
point numbers
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 97 -
 MUL: Multiply (S7-1200, S7-1500)

If operand "TagIn" has the signal state "1", the "Multiply" instruction is executed. The value of operand
"Tag_Value1" is multiplied by the value of operand "Tag_Value2". The result of the multiplication is
stored in operand "Tag_Result". If the instruction is executed without errors, the ENO enable output
has the signal state "1" and the "TagOut" output is set.

- 98 -
 DIV: Divide (S7-1200, S7-1500)

DIV: Divide

Description
You can use the "Divide" instruction to divide the value at input IN1 by the value at input IN2 and
query the quotient at output OUT (OUT := IN1/IN2).
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".
• The result of the instruction is outside the range permitted for the data type specified at the OUT
output.
• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Divide" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Integers, floating- I, Q, M, D, L, P or
IN1 Input Dividend
point numbers constant
Integers, floating- I, Q, M, D, L, P or
IN2 Input Divisor
point numbers constant
Integers, floating-
OUT Output I, Q, M, D, L, P Quotient value
point numbers
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

If operand "TagIn" has the signal state "1", the "Divide" instruction is executed. The value of operand
"Tag_Value1" is divided by the value of operand "Tag_Value2". The division result is stored in oper‐
and "Tag_Result". If the instruction is executed without errors, the ENO enable output has the signal
state "1" and the "TagOut" output is set.

- 99 -
 NEG: Create twos complement (S7-1200, S7-1500)

NEG: Create twos complement

Description
You can use the "Create twos complement" instruction to change the sign of the value at the IN input
and query the result at the OUT output. If there is a positive value at input IN, for example, the nega‐
tive equivalent of this value is sent to output OUT.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".

• The result of the instruction is outside the range permitted for the data type specified at the OUT
output.
• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Create twos complement" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
SINT, INT,
SINT, INT,
DINT, LINT, I, Q, M, D, L, P
IN Input DINT, floating- Input value
floating-point or constant
point numbers
numbers
SINT, INT,
SINT, INT, Twos comple‐
DINT, LINT,
OUT Output DINT, floating- I, Q, M, D, L, P ment of the in‐
floating-point
point numbers put value
numbers
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

If operand "TagIn" has the signal state "1", the "Create twos complement" instruction is executed. The
sign of the value at input "TagIn_Value" is changed and the result is provided at "TagOut_Value" out‐

- 100 -
 NEG: Create twos complement (S7-1200, S7-1500)

put. If the instruction is executed without errors, the ENO enable output has the signal state "1" and
the "TagOut" output is set.

- 101 -
 INC: Increment (S7-1200, S7-1500)

INC: Increment

Description
You can use the "Increment" instruction to change the value of the operand at the IN/OUT parameter
to the next higher value and query the result. The "Increment" instruction is only started when the sig‐
nal state at the EN enable input is "1". If no overflow error occurs during the execution, the ENO ena‐
ble output also has the signal state "1".
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".
• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Increment" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Value to be incre‐
IN/OUT InOut Integers I, Q, M, D, L
mented.
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

If operands "TagIn_1" and "TagIn_2" have the signal state "1", the value of operand "Tag_InOut" is
incremented by one and the "TagOut" output is set.

- 102 -
 DEC: Decrement (S7-1200, S7-1500)

DEC: Decrement

Description
You can use the "Decrement" instruction to change the value of the operand at the IN/OUT parameter
to the next lower value and query the result. The "Decrement" instruction is only started when the sig‐
nal state at the EN enable input is "1". If the range of values of the selected data type is not exceeded
during processing, the ENO output also has the signal state "1".
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".
• A floating-point number has an invalid value.

Parameter
The following table shows the parameters of the "Decrement" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Value to be decre‐
IN/OUT InOut Integers I, Q, M, D, L
mented.
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

If operands "TagIn_1" and "TagIn_2" have the signal state "1", the value of operand "Tag_InOut" is
decremented by one and the "TagOut" output is set.

- 103 -
 MIN: Get minimum (S7-1200, S7-1500)

MIN: Get minimum

Description
The "Get minimum" instruction compares the values at the available inputs and writes the lowest val‐
ue to the OUT output. The number of inputs can be expanded at the instruction box by additional in‐
puts. The inputs are numbered in ascending order in the box.
A minimum of two and a maximum of 100 inputs must be specified for the execution of the instruction.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• Enable input EN has the signal state "0".

• The implicit conversion of the data types fails during execution of the instruction.

• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Get minimum" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME, I, Q, M, D, L, P First input val‐
IN1 Input point num‐
LTIME, TOD, or constant ue
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME, I, Q, M, D, L, P Second input
IN2 Input point num‐
LTIME, TOD, or constant value
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
Integers, float‐
Integers, Additionally in‐
ing-point num‐
floating- serted inputs
bers, TIME, I, Q, M, D, L, P
INn Input point num‐ whose values
LTIME, TOD, or constant
bers, TIME, are to be com‐
LTOD, DATE,
TOD, DATE pared
LDT
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME,
OUT Output point num‐ I, Q, M, D, L, P Result
LTIME, TOD,
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
The data types TOD, LTOD, DATE, and LDT can only be used if the IEC test is not enabled.

- 104 -
 MIN: Get minimum (S7-1200, S7-1500)

You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN1 TagIn_Value1 12222
IN2 TagIn_Value2 14444
IN3 TagIn_Value3 13333
OUT TagOut_Value 12222
If the "TagIn_1" and "TagIn_2" operands have signal state "1", the "Get minimum" instruction is exe‐
cuted. The instruction compares the values of the specified operands and copies the lowest value
("TagIn_Value1") to output "TagOut_Value". If the instruction is executed without errors, the "TagOut"
output is set.

- 105 -
 MAX: Get maximum (S7-1200, S7-1500)

MAX: Get maximum

Description
The "Get maximum" instruction compares the values at the available inputs and writes the highest val‐
ue to the OUT output. The number of inputs can be expanded at the instruction box by additional in‐
puts. The inputs are numbered in ascending order in the box.
A minimum of two and a maximum of 100 inputs must be specified for the execution of the instruction.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• Enable input EN has the signal state "0".

• The implicit conversion of the data types fails during execution of the instruction.

• A floating-point number has an invalid value.

Parameters
The following table shows the parameters of the "Get maximum" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME, I, Q, M, D, L, P First input val‐
IN1 Input point num‐
LTIME, TOD, or constant ue
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME, I, Q, M, D, L, P Second input
IN2 Input point num‐
LTIME, TOD, or constant value
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
Integers, float‐
Integers, Additionally in‐
ing-point num‐
floating- serted inputs
bers, TIME, I, Q, M, D, L, P
INn Input point num‐ whose values
LTIME, TOD, or constant
bers, TIME, are to be com‐
LTOD, DATE,
TOD, DATE pared
LDT
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME,
OUT Output point num‐ I, Q, M, D, L, P Result
LTIME, TOD,
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
The data types TOD, LTOD, DATE, and LDT can only be used if the IEC test is not enabled.

- 106 -
 MAX: Get maximum (S7-1200, S7-1500)

You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN1 TagIn_Value1 12222
IN2 TagIn_Value2 14444
IN3 TagIn_Value3 13333
OUT TagOut_Value 14444
If the "TagIn_1" and "TagIn_2" operands have signal state "1", the "Get maximum" instruction is exe‐
cuted. The instruction compares the values of the specified operands and copies the highest value
("TagIn_Value2") to output "TagOut_Value". If the instruction is executed without errors, the "TagOut"
output is set.

- 107 -
 LIMIT: Set limit value (S7-1200, S7-1500)

LIMIT: Set limit value

Description
You can use the "Set limit value" instruction to limit the value at input IN to the values at the inputs MN
and MX. If the value at the IN input meets the condition MN <= IN <= MX, it is copied to the OUT
output. If the condition is not fulfilled and the input value IN is below the low limit MN, the output OUT
is set to the value of the MN input. If the MX high limit is exceeded, the OUT output is set to the value
of the MX input.
If the value at the MN input is greater than at the MX input, the result is undefined and the enable
output ENO is "0".
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• Enable input EN has the signal state "0".
• The specified tags are not of the same data type.
• An operand has an invalid value.
• The value at the MN input is greater than the value of the MX input.

Parameters
The following table shows the parameters of the "Set limit value" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME, I, Q, M, D, L, P
MN Input point num‐ Low limit
LTIME, TOD, or constant
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME, I, Q, M, D, L, P
IN Input point num‐ Input value
LTIME, TOD, or constant
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
Integers, float‐
Integers,
ing-point num‐
floating-
bers, TIME, I, Q, M, D, L, P
MX Input point num‐ High limit
LTIME, TOD, or constant
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
Integers, Integers, float‐
OUT Output floating- ing-point num‐ I, Q, M, D, L, P Result
point num‐ bers, TIME,

- 108 -
 LIMIT: Set limit value (S7-1200, S7-1500)

LTIME, TOD,
bers, TIME,
LTOD, DATE,
TOD, DATE
LDT
The data types TOD, LTOD, DATE, and LDT can only be used if the IEC test is not enabled.
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

MN Tag_MN 12000
IN Tag_Value 8000
MX Tag_MX 16000
OUT Tag_Result 12000
If operands "TagIn_1" and "TagIn_2" have the signal state "1", the "Set limit value" instruction is exe‐
cuted. The value of operand "Tag_Value" is compared with the values of operands "Tag_MN" and
"Tag_MX". Since the value of operand "Tag_Value" is less than the low limit, the value of operand
"Tag_MN" is copied to the "Tag_Result" output. If the instruction is executed without errors, the "Tag‐
Out" output is set.

- 109 -
 SQR: Form square (S7-1200, S7-1500)

SQR: Form square

Description
You can use the "Form square" instruction to square the value at the IN input and query the result at
the OUT output.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".
• The value at the IN input is not a valid floating-point number.

Parameters
The following table shows the parameters of the "Form square" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Floating-point I, Q, M, D, L, P or
IN Input Input value
numbers constant
Floating-point Square of the in‐
OUT Output I, Q, M, D, L, P
numbers put value
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN Tag_Value 5.0
OUT Tag_Result 25.0
If operand "TagIn" has the signal state "1", the "Form square" instruction is executed. The instruction
squares the value of operand "Tag_Value" and sends the result to the "Tag_Result" output. If the in‐
struction is executed without errors, the "TagOut" output is set.

- 110 -
 SQRT: Form square root (S7-1200, S7-1500)

SQRT: Form square root

Description
You can use the "Form square root" instruction to find the square root of the value at the IN input and
query the result at the OUT output. The instruction outputs a positive result if the input value is greater
than zero. If input values are less than zero, the OUT output returns an invalid floating-point number.
If the value at input IN is "0", then the result is also "0".
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".

• The value at the IN input is not a valid floating-point number.

• The value at the IN input is negative.

Parameters
The following table shows the parameters of the "Form square root" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Floating-point I, Q, M, D, L, P or
IN Input Input value
numbers constant
Floating-point Square root of the
OUT Output I, Q, M, D, L, P
numbers input value
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN Tag_Value 25.0

- 111 -
 SQRT: Form square root (S7-1200, S7-1500)

OUT Tag_Result 5.0

If operand "TagIn" has the signal state "1", the "Form square root" instruction is executed. The instruc‐
tion finds the square root of the value of operand "Tag_Value" and stores the result in the "Tag_Re‐
sult" output. If the instruction is executed without errors, the "TagOut" output is set.

- 112 -
 Move operations (S7-1200, S7-1500)

Move operations

This chapter contains the following information:

• MOVE: Move value (S7-1200, S7-1500)
• Deserialize: Deserialize (S7-1500)
• Serialize: Serialize (S7-1500)
• FieldRead: Read field (S7-1200, S7-1500)
• FieldWrite: Write field (S7-1200, S7-1500)
• MOVE_BLK: Move block (S7-1200, S7-1500)
• MOVE_BLK_VARIANT: Move block (S7-1500)
• UMOVE_BLK: Move block uninterruptible (S7-1200, S7-1500)
• FILL_BLK: Fill block (S7-1200, S7-1500)
• UFILL_BLK: Fill block uninterruptible (S7-1200, S7-1500)
• SWAP: Swap (S7-1200, S7-1500)
• ARRAY DB instructions (S7-1500)
• VARIANT instructions (S7-1500)
• Other (S7-1500)

- 113 -
 MOVE: Move value (S7-1200, S7-1500)

MOVE: Move value

Description
You use the "Move value" instruction to transfer the content of the operand at the IN input to the oper‐
and at the OUT1 output. The transfer is always made in the direction of ascending address.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".

• The data type at the IN parameter does not correspond to the specified data type at the OUT1 pa‐
rameter.
The following table lists the possible transfers for the S7-1200 CPU series:

Source (IN) Destination (OUT1)

With IEC check Without IEC check
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
BYTE BYTE, WORD, DWORD
DINT, UDINT, TIME, DATE ,TOD, CHAR
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
WORD WORD, DWORD
DINT, UDINT, TIME, DATE, TOD, CHAR
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
DWORD DWORD
DINT, UDINT, REAL, TIME, DATE, TOD, CHAR
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
SINT SINT
DINT, UDINT, TIME, DATE, TOD
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
USINT USINT, UINT, UDINT
DINT, UDINT, TIME, DATE, TOD
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
INT INT
DINT, UDINT, TIME, DATE, TOD
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
UINT UINT, UDINT
DINT, UDINT, TIME, DATE, TOD
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
DINT DINT
DINT, UDINT, TIME, DATE, TOD
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
UDINT UDINT
DINT, UDINT, TIME, DATE, TOD
REAL REAL DWORD, REAL
LREAL LREAL LREAL
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
TIME TIME
DINT, UDINT, TIME
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
DATE DATE
DINT, UDINT, DATE
BYTE, WORD, DWORD, SINT, USINT, INT, UINT,
TOD TOD
DINT, UDINT, TOD
DTL DTL DTL
BYTE, WORD, DWORD, CHAR, Character of a
CHAR CHAR
string1)

- 114 -
 MOVE: Move value (S7-1200, S7-1500)

Character of a
Character of a string Character of a string CHAR
string1)
ARRAY2) ARRAY ARRAY
STRUCT STRUCT STRUCT
PLC data type
PLC data type (UDT) PLC data type (UDT)
(UDT)
IEC_TIMER IEC_TIMER IEC_TIMER
IEC_SCOUNT‐
IEC_SCOUNTER IEC_SCOUNTER
ER
IEC_US‐
IEC_USCOUNTER IEC_USCOUNTER
COUNTER
IEC_COUN‐
IEC_COUNTER IEC_COUNTER
TER
IEC_UCOUNT‐
IEC_UCOUNTER IEC_UCOUNTER
ER
IEC_DCOUNT‐
IEC_DCOUNTER IEC_DCOUNTER
ER
IEC_UD‐
IEC_UDCOUNTER IEC_UDCOUNTER
COUNTER
The following table lists the possible transfers for the S7-1500 CPU series:

Source (IN) Destination (OUT1)

With IEC check Without IEC check
BYTE, WORD, DWORD, LWORD, SINT, USINT,
BYTE, WORD, DWORD,
BYTE INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LWORD
LTIME, LDT, DATE ,TOD, LTOD, CHAR
BYTE, WORD, DWORD, LWORD, SINT, USINT,
WORD WORD, DWORD, LWORD INT, UINT, DINT, UDINT, LINT, ULINT, S5TIME,
TIME, LTIME, LDT, DATE, TOD, LTOD, CHAR
BYTE, WORD, DWORD, LWORD, SINT, USINT,
DWORD DWORD, LWORD INT, UINT, DINT, UDINT, LINT, ULINT, REAL,
TIME, LTIME, LDT, DATE, TOD, LTOD, CHAR
BYTE, WORD, DWORD, LWORD, SINT, USINT,
LWORD LWORD INT, UINT, DINT, UDINT, LINT, ULINT, LREAL,
TIME, LTIME, LDT, DATE, TOD, LTOD, CHAR
BYTE, WORD, DWORD, LWORD, SINT, USINT,
SINT SINT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LTIME, LDT, DATE, TOD, LTOD
BYTE, WORD, DWORD, LWORD, SINT, USINT,
USINT, UINT, UDINT,
USINT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
ULINT
LTIME, LDT, DATE, TOD, LTOD
BYTE, WORD, DWORD, LWORD, SINT, USINT,
INT INT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LTIME, LDT, DATE, TOD, LTOD
BYTE, WORD, DWORD, LWORD, SINT, USINT,
UINT UINT, UDINT, ULINT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LTIME, LDT, DATE, TOD. LTOD

- 115 -
 MOVE: Move value (S7-1200, S7-1500)

BYTE, WORD, DWORD, LWORD, SINT, USINT,

DINT DINT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LTIME, LDT, DATE, TOD, LTOD
BYTE, WORD, DWORD, LWORD, SINT, USINT,
UDINT UDINT, ULINT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LTIME, LDT, DATE, TOD, LTOD
BYTE, WORD, DWORD, LWORD, SINT, USINT,
LINT LINT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LTIME, LDT, DATE, TOD, LTOD
BYTE, WORD, DWORD, LWORD, SINT, USINT,
ULINT ULINT INT, UINT, DINT, UDINT, LINT, ULINT, TIME,
LTIME, LDT, DATE, TOD, LTOD
REAL REAL DWORD, REAL
LREAL LREAL LWORD, LREAL
S5TIME S5TIME WORD, S5TIME
BYTE, WORD, DWORD, LWORD, SINT, USINT,
TIME TIME
INT, UINT, DINT, UDINT, LINT, ULINT, TIME
BYTE, WORD, DWORD, LWORD, SINT, USINT,
LTIME LTIME
INT, UINT, DINT, UDINT, LINT, ULINT, LTIME
BYTE, WORD, DWORD, LWORD, SINT, USINT,
DATE DATE
INT, UINT, DINT, UDINT, LINT, ULINT, DATE
DT DT DT
BYTE, WORD, DWORD, LWORD, SINT, USINT,
LDT LDT
INT, UINT, DINT, UDINT, LINT, ULINT, LDT
BYTE, WORD, DWORD, LWORD, SINT, USINT,
TOD TOD
INT, UINT, DINT, UDINT, LINT, ULINT, TOD
BYTE, WORD, DWORD, LWORD, SINT, USINT,
LTOD LTOD
INT, UINT, DINT, UDINT, LINT, ULINT, LTOD
DTL DTL DTL
BYTE, WORD, DWORD, LWORD, CHAR, Charac‐
CHAR CHAR
ter of a string1)
BYTE, WORD, DWORD, LWORD, CHAR, WCHAR,
WCHAR WCHAR
Character of a string1)
Character of a
Character of a string CHAR, WCHAR, Character of a string
string1)
ARRAY2) ARRAY ARRAY
STRUCT STRUCT STRUCT
COUNTER COUNTER, WORD, INT WORD, DWORD, INT, UINT, DINT, UDINT
TIMER TIMER, WORD, INT WORD, DWORD, INT, UINT, DINT, UDINT
PLC data type
PLC data type (UDT) PLC data type (UDT)
(UDT)
IEC_TIMER IEC_TIMER IEC_TIMER
IEC_LTIMER IEC_LTIMER IEC_LTIMER
IEC_SCOUNT‐
IEC_SCOUNTER IEC_SCOUNTER
ER

- 116 -
 MOVE: Move value (S7-1200, S7-1500)

IEC_US‐
IEC_USCOUNTER IEC_USCOUNTER
COUNTER
IEC_COUN‐
IEC_COUNTER IEC_COUNTER
TER
IEC_UCOUNT‐
IEC_UCOUNTER IEC_UCOUNTER
ER
IEC_DCOUNT‐
IEC_DCOUNTER IEC_DCOUNTER
ER
IEC_UD‐
IEC_UDCOUNTER IEC_UDCOUNTER
COUNTER
IEC_LCOUNT‐
IEC_LCOUNTER IEC_LCOUNTER
ER
IEC_UL‐
IEC_ULCOUNTER IEC_ULCOUNTER
COUNTER
1) You can also use the "Move value" instruction to transfer individual characters of a string to oper‐
ands of the CHAR or WCHAR data type. The number of the character to be transferred is specified in
square brackets next to the operand name. "MyString[2]", for example, transfers the second character
of the "MyString" string. It is also possible to transfer from operands of the data type CHAR to the
individual characters of a string. You can also replace a specific character of a string with the charac‐
ter of another string.
2)Transferring entire arrays (ARRAY) is possible only when the array components of the operands at
input IN and at output OUT1 are of the same data type.
If the bit length of the data type at input IN exceeds the bit length of the data type at output OUT1, the
higher-order bits of the source value are lost. If the bit length of the data type at input IN is less than
the bit length of the data type at output OUT1, the higher-order bits of the destination value will be
overwritten with zeros.
In its initial state, the instruction box contains 1 output (OUT1). The number of outputs can be exten‐
ded. The added outputs are numbered in ascending order on the box. During the execution of the in‐
struction, the content of the operand at the input IN is transferred to all available outputs. The instruc‐
tion box cannot be extended if structured data types (DTL, STRUCT, ARRAY) or characters of a
string are transferred.
You can also use the "Move block" (MOVE_BLK) and "Move block uninterruptible" (UMOVE_BLK) in‐
structions to move operands of the ARRAY data type. You can move operands of the STRING data
type with the instruction "Move character string" (S_MOVE).

Parameter
The following table lists the parameters of the "Move value" instruction:

Parameters Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Bit strings, in‐ Bit strings, in‐
tegers, float‐ tegers, float‐
I, Q, M, D, L or
IN Input ing-point num‐ ing-point num‐ Source value
constant
bers, DATE, bers, DATE,
TIME, TOD, DT, LDT,

- 117 -
 MOVE: Move value (S7-1200, S7-1500)

S5TIME,
TIME, LTIME,
TOD, LTOD,
DTL, CHAR,
DTL, CHAR,
STRUCT, AR‐
STRUCT, AR‐
RAY, IEC data
RAY, TIMER,
types, PLC da‐
COUNTER,
ta type (UDT)
IEC data
types, PLC da‐
ta type (UDT)
Bit strings, in‐
tegers, float‐
ing-point num‐
Bit strings, in‐
bers, DATE,
tegers, float‐
DT, LDT,
ing-point num‐
S5TIME,
bers, DATE, Operands to
TIME, LTIME,
TIME, TOD, which in the
OUT1 Output TOD, LTOD, I, Q, M, D, L
DTL, CHAR, source value is
DTL, CHAR,
STRUCT, AR‐ transferred.
STRUCT, AR‐
RAY, IEC data
RAY, TIMER,
types, PLC da‐
COUNTER,
ta type (UDT)
IEC data
types, PLC da‐
ta type (UDT)
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameters Operand Value

IN TagIn_Value 0011 1111 1010 1111
OUT1 TagOut_Value 0011 1111 1010 1111
If the operand "TagIn" has the signal state "1", the "Move value" instruction is executed. The instruc‐
tion copies the contents of operand "TagIn_Value" to operand "TagOut_Value" and sets output "Tag‐
Out" to signal state "1".

- 118 -
 MOVE_BLK: Move block (S7-1200, S7-1500)

MOVE_BLK: Move block

Description
You can use the "Move block" instruction to move the content of a memory area (source area) to an‐
other memory area (destination area). The number of elements to be moved to the destination area is
specified at input COUNT. The width of the elements to be moved is defined by the width of the ele‐
ment at the IN input.
The instruction can only be executed if the source area and the destination area are of the same data
type.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".
• More data is copied than is made available at the IN input or OUT output.

When a Array of BOOL is copied, the enable output ENO for an overflow is set to "1" until the byte
limit of the ARRAY structure is exceeded. If the byte limit of the ARRAY structure is exceeded by the
value at the COUNT input, the ENO enable output is reset to "0".

Parameters
The following table lists the parameters of the "Move block" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Binary num‐ Binary num‐
The first ele‐
bers, integers, bers, integers,
ment of the
floating-point floating-point
IN 1) Input
numbers, numbers,
D, L source area
that is being
TIME, DATE, timers, DATE,
copied
CHAR, TOD TOD, LTOD
Number of ele‐
ments to be
copied from
USINT, UINT, USINT, UINT, I, Q, M, D, L, P
COUNT Input the source
UDINT UDINT, ULINT or constant
area to the
destination
area.
The first ele‐
Binary num‐ Binary num‐ ment of the
bers, integers, bers, integers, destination
floating-point floating-point area to which
OUT 1) Output D, L
numbers, numbers, the contents of
TIME, DATE, timers, DATE, the source
CHAR, TOD TOD, LTOD area are being
copied
1) The specified data types can only be used as elements of an ARRAY structure.

- 119 -
 MOVE_BLK: Move block (S7-1200, S7-1500)

For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

The data type of the a_array op‐
erand is Array [0..5] of INT. It
IN a_array[2]
consists of six elements of data
type INT.
COUNT Tag_Count 3
The data type of the b_array op‐
erand is Array [0..6] of INT. It
OUT b_array[1]
consists of seven elements of
data type INT.
If operands "TagIn_1" and "TagIn_2" have the signal state "1", the "Move block" instruction is execu‐
ted. Starting from the third element, the instruction selects three INT elements from the #a_array tag
and copies their contents to the #b_array output tag, beginning with the second element. If the instruc‐
tion is executed without errors, the ENO enable output has the signal state "1" and the "TagOut" out‐
put is set.

- 120 -
 MOVE_BLK_VARIANT: Move block (S7-1500)

MOVE_BLK_VARIANT: Move block

Description
You can use the "Move block" instruction to move the content of a memory area (source area) to an‐
other memory area (destination area). You can copy elements of an array to another array of the
same data type. The size (number of elements) of the source and destination array may be different.
You can copy several elements within an array or individual elements.
If you are using the instruction, the array must not yet be known at the time the block is created, as
the source and the destination are transferred using VARIANT.
The counting at the parameters SRC_INDEX and DEST_INDEX always starts with the low limit "0",
regardless of the later declaration of the array.
If the VARIANT pointer (source or destination) is of the data type BOOL, it must be addressed abso‐
lutely and the length specified must be divisible by 8; otherwise the instruction is not executed.
The ENO enable output has the signal state "0" if one of the following conditions is fulfilled:
• The EN enable input has the signal state "0".

• More data is copied than is made available.

Parameters
The following table lists the parameters of the "Move block" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
VARIANT
Source block from
SRC Input (array or single el‐ L
which to copy
ement)
Number of ele‐
ments which are
copied
Set the value at
I, Q, M, D, L or the parameter
COUNT Input UDINT
constant COUNT to "1", if
no Array is speci‐
fied at the param‐
eter SRC or the
parameter DEST.
• The SRC_IN‐
DEX parameter
is calculated
zero-based. If
I, Q, M, D, L or an Array is
SRC_INDEX Input DINT
constant specified at pa‐
rameter SRC,
the integer at
the SRC_IN‐

- 121 -
 MOVE_BLK_VARIANT: Move block (S7-1500)

DEX parameter
specifies the
first element
within the
source area
from which
copying is to
take place. This
is independent
of the declared
array limits.
• If no Array is
set at the SRC
parameter or
only an individ‐
ual element of
an array is
specified, as‐
sign the
SRC_INDEX
parameter the
value "0".
• The DEST_IN‐
DEX parameter
is calculated
zero-based. If
an Array is
specified at the
DEST parame‐
ter, the integer
at the
DEST_INDEX
parameter
specifies the
first element
I, Q, M, D, L or within the desti‐
DEST_INDEX Input DINT nation area to
constant
which copying
is to take place.
This is inde‐
pendent of the
declared array
limits.
• If no Array is
specified at the
DEST parame‐
ter, assign the
DEST_INDEX
parameter the
value "0".
Destination area
into which the
DEST Output VARIANT L contents of the
source block are
copied.
RET_VAL Output INT I, Q, M, D, L Error information:

- 122 -
 MOVE_BLK_VARIANT: Move block (S7-1500)

If an error occurs
during the execu‐
tion of the instruc‐
tion, an error code
is output at the
RET_VAL param‐
eter.
For additional information on valid data types, refer to "See also".

RET_VAL parameter
The following table lists the meaning of the values of the RET_VAL parameter:

Error code* Explanation

(W#16#...)
0000 No error
80B4 Data types do not correspond
8151 Access to the SRC parameter is not possible.
8152 The operand at the SRC parameter is not typed.
8153 Code generation error at the SRC parameter
8154 The operand at the SRC parameter has the data type BOOL.
8281 The COUNT parameter has an invalid value
The value at the SRC_INDEX parameter is outside the limits of the VAR‐
8382
IANT.
The value at the SRC_INDEX parameter is outside the high limit of the ar‐
8383
ray.
The value at the DEST_INDEX parameter is outside the limits of the
8482
VARIANT.
The value at the DEST_INDEX parameter is outside the high limit of the
8483
array.
8534 The DEST parameter is write protected
8551 Access to the DEST parameter is not possible.
8552 The operand at the DEST parameter is not typed.
8553 Code generation error at the DEST parameter
8554 The operand at the DEST parameter has the data type BOOL.
*The error codes can be displayed as integer or hexadecimal value in the program editor. For infor‐
mation on toggling display formats, refer to "See also".

Example
The following example shows how the instruction works:

- 123 -
 MOVE_BLK_VARIANT: Move block (S7-1500)

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

The local operand #SrcField
uses a UDT that was still un‐
SRC #SrcField known at the time when the
block was programmed. (Array
[0 to 10] of "MOVE_UDT"
COUNT Tag_Count 2
SRC_INDEX Tag_Src_Index 3
DEST_INDEX Tag_Dest_Index 3
The local operand #DestField
uses a UDT that was still un‐
DEST #DestField known at the time when the
block was programmed. (Array
[10 to 20] of "MOVE_UDT"
If the operand "TagIn" has the signal state "1", the "Move block" instruction is executed. 2 elements
are copied from the source area into the destination area beginning with the fourth element of the ar‐
ray of UDT. The copies are inserted in the array of UDT beginning with the fourth element. If the in‐
struction is executed without errors, the ENO enable output has the signal state "1" and the "TagOut"
output is set.

- 124 -
 Program control operations (S7-1200, S7-1500)

Program control operations

This chapter contains the following information:

• ---( JMP ): Jump if RLO = 1 (S7-1200, S7-1500)
• ---( JMPN ): Jump if RLO = 0 (S7-1200, S7-1500)
• LABEL: Jump label (S7-1200, S7-1500)
• JMP_LIST: Define jump list (S7-1200, S7-1500)
• SWITCH: Jump distributor (S7-1200, S7-1500)
• --(RET): Return (S7-1200, S7-1500)
• Runtime control (S7-1200, S7-1500)

- 125 -
 ---( JMP ): Jump if RLO = 1 (S7-1200, S7-1500)

---( JMP ): Jump if RLO = 1

Description
You can use the "Jump if RLO = 1" instruction to interrupt the linear execution of the program and
resume it in another network. The destination network must be identified by a jump label (LABEL).
The name of this jump label is specified in the placeholder above the instruction.
The specified jump label must be in the same block in which the instruction is executed. The name
you specify can only occur once in the block. Only one jumping coil is permitted within a network.
If the result of logic operation (RLO) at the input of the instruction is "1", the jump to the network iden‐
tified by the specified jump label is executed. The jump direction can be towards higher or lower net‐
work numbers.
If the condition at the input of the instruction is not fulfilled (RLO = 0), execution of the program contin‐
ues in the next network.

Example
The following example shows how the instruction works:

If operand "TagIn_1" has the signal state "1", the "Jump if RLO = 1" instruction is executed. The linear
execution of the program is interrupted and continues in Network 3, which is identified by the jump
label CAS1. If the "TagIn_3" input has the signal state "1", the "TagOut_3" output is set.

- 126 -
 ---( JMPN ): Jump if RLO = 0 (S7-1200, S7-1500)

---( JMPN ): Jump if RLO = 0

Description
You can use the instruction "Jump if RLO = 0" to interrupt the linear execution of the program and
resume it in another network, when the result of logic operation at the input of the instruction is "0".
The destination network must be identified by a jump label (LABEL). The name of this jump label is
specified in the placeholder above the instruction.
The specified jump label must be in the same block in which the instruction is executed. The name
you specify can only occur once in the block. Only one jumping coil is permitted within a network.
If the result of logic operation (RLO) at the input of the instruction is "0", the jump to the network iden‐
tified by the specified jump label is executed. The jump direction can be towards higher or lower net‐
work numbers.
If the result of logic operation at the input of the instruction is "1", execution of the program continues
in the next network.

Example
The following example shows how the instruction works:

If operand "TagIn_1" has the signal state "0", the "Jump if RLO = 0" instruction is executed. The linear
execution of the program is interrupted and continues in Network 3, which is identified by the jump
label CAS1. If the "TagIn_3" input has the signal state "1", the "TagOut_3" output is set.

- 127 -
 LABEL: Jump label (S7-1200, S7-1500)

LABEL: Jump label

Description
You can use a jump label to identify a destination network, in which the program execution should
resume when a jump is executed.
The jump label and the instruction in which the jump label is specified must be located in the same
block. The name of a jump label can only be assigned once in a block. You can declare up to 32 jump
labels when you use a CPU S7-1200 and a maximum of 256 jump labels when you use a CPU
S7-1500.
Only one jump label can be placed in a network. Each jump label can jump to several locations.

Example
The following example shows how the instruction works:

If operand "TagIn_1" has the signal state "1", the "Jump if RLO = 1" instruction is executed. The linear
execution of the program is interrupted and continues in Network 3, which is identified by the jump
label CAS1. If the "TagIn_3" input has the signal state "1", the "TagOut_3" output is set.

- 128 -
 JMP_LIST: Define jump list (S7-1200, S7-1500)

JMP_LIST: Define jump list

Description
You can use the "Define jump list" instruction to define several conditional jumps and continue the
program execution in a specific network depending on the value of the K parameter.
You define the jumps with jump labels (LABEL), which you specify at the outputs of the instruction
box. The number of outputs can be expanded in the instruction box. You can declare up to 32 outputs
when you use a CPU S7-1200 and a maximum of 99 outputs when you use a CPU S7-1500.
The numbering of the outputs begins with the value "0" and continues in ascending order with each
new output. Only jump labels can be specified at the outputs of the instruction. Instructions or oper‐
ands cannot be specified.
The value of the K parameter specifies the number of the output and thus the jump label where the
program execution is to be resumed. If the value in the K parameter is greater than the number of
available outputs, the program execution is resumed in the next network of the block.
The "Define jump list" instruction is only executed if the signal state is "1" at the EN enable input.

Parameter
The following table shows the parameters of the "Define jump list" instruction:

Parameters Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
Specifies the
number of the out‐
I, Q, M, D, L or
K Input UINT put and thus the
constant
jump that is to be
made.
DEST0 - - - First jump label
DEST1 - - - Second jump label
Optional jump la‐
DESTn - - -
bels
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 129 -
 JMP_LIST: Define jump list (S7-1200, S7-1500)

The following table shows how the instruction works using specific operand values:

Parameters Operand/Jump label Value

K Tag_Value 1
Jump to the network that is
Dest0 LABEL0 identified with the jump label
"LABEL0".
Jump to the network that is
Dest1 LABEL1 identified with the jump label
"LABEL1".
Jump to the network that is
Dest2 LABEL2 identified with the jump label
"LABEL2".
If operand "Tag_Input" has the signal state "1", the "Define jump list" instruction is executed. The pro‐
gram execution is resumed according to the value of operand "Tag_Value" in the network that is iden‐
tified with the jump label "LABEL1".

- 130 -
 SWITCH: Jump distributor (S7-1200, S7-1500)

SWITCH: Jump distributor

Description
You can use the "Jump distributor" instruction to define multiple program jumps to be executed de‐
pending on the result of one or more comparison instructions.
You specify the value to be compared in the K parameter. This value is compared with the values that
are provided by the various inputs. You can select the comparison method for each individual input.
The availability of the various comparison instructions depends on the data type of the instruction.
The following table shows the comparison instructions that are available depending on the selected
data type:

Data type Instruction Syntax

S7-1200 S7-1500
Equal ==
Bit strings Bit strings
Not equal <>
Equal ==
Integers, floating- Not equal <>
Integers, floating-
point numbers, Greater or equal >=
point numbers,
TIME, LTIME,
TIME, DATE, Less or equal <=
DATE, TOD,
TOD
LTOD, LDT Greater than >
Less than <
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box. If
you select a comparison instruction and the data type of the instruction is not yet defined, the "<???>"
drop-down list only offers the data types that are permitted for the selected comparison instruction.
Execution of the instruction begins with the first comparison and runs until a comparison condition is
met. If a comparison condition is met, the subsequent comparison conditions are not considered. If
none of the specified comparison conditions are met, the jump at the ELSE output is executed. If no
program jump is defined at the ELSE output, execution of the program continues in the next network.
The number of outputs can be expanded in the instruction box. The numbering of the outputs begins
with the value "0" and continues in ascending order with each new output. Specify jump labels (LA‐
BEL) at the outputs of the instruction. Instructions or operands cannot be specified at the outputs of
the instruction.
An input is automatically inserted for each additional output. The jump programmed at an output is
executed if the comparison condition of the corresponding input is fulfilled.

Parameters
The following table shows the parameters of the "Jump distributor" instruction:

- 131 -
 SWITCH: Jump distributor (S7-1200, S7-1500)

Parameter Declara‐ Data type Memory area Description

tion
S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
I, Q, M, D, L or Specifies the value to
K Input UINT UINT
constant be compared.
Bit strings, in‐
Bit strings, in‐
tegers, float‐
tegers, float‐ Input value with
ing-point
<Comparison ing-point I, Q, M, D, L or which the value of
Input numbers,
values> numbers, constant the K parameter is
TIME, LTIME,
TIME, DATE, compared.
DATE, TOD,
TOD
LTOD, LDT
DEST0 - - - - First jump label
DEST1 - - - - Second jump label
Optional jump la‐
DEST(n) - - - -
bels(n = 2 to 99)
Program jump that is
executed when none
ELSE - - - - of the comparison
conditions are fulfil‐
led.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameters Operand/Jump label Value

K Tag_Value 23
== Tag_Value_1 20
> Tag_Value_2 21
< Tag_Value_3 19

- 132 -
 SWITCH: Jump distributor (S7-1200, S7-1500)

Jump to jump label "LABEL0", if

Dest 0 LABEL0 the value of the K parameter
equals 20.
Jump to jump label "LABEL1" if
Dest 1 LABEL1 the value of the K parameter is
greater than 21.
Jump to jump label "LABEL2", if
Dest 2 LABEL2 the value of the K parameter is
less than 19.
Jump to jump label "LABEL3", if
ELSE LABEL 3 the none of the comparison
conditions are fulfilled.
If the operand "Tag_Input" changes to signal state "1", the instruction "Jump distributor" is executed.
The execution of the program is continued in the network that is identified with the jump label "LA‐
BEL1".

- 133 -
 --(RET): Return (S7-1200, S7-1500)

--(RET): Return

Description
You can use the "Return" instruction to stop the execution of a block. The results is three types
through which the block processing can be completed.
• Without call of the "Return" instruction
The block is exited after execution of the last network. The ENO of the function call is set to the
signal state "1".
• Call of the "Return" instruction with preceding logic operation (see example)
If the left connector has the signal state "1", the block will be exited. The ENO of the function call
corresponds to the operand.
• Call of the "Return" instruction without previous logic operation
The block is exited. The ENO of the function call corresponds to the operand.

Note
Only one jumping coil may be used in a network ("Return", "Jump if RLO=1", "Jump if RLO=0").

If the result of logic operation (RLO) at the input of the "Return" instruction is "1", program execution is
terminated in the currently called block and resumed after the call function in the calling block (for ex‐
ample, in the calling OB). The status (ENO) of the call function is determined by the parameter of the
instruction. This can assume the following values:
• RLO
• TRUE/FALSE
• <Operand>

To set the parameter values, double-click the instruction and select the corresponding value in the
drop-down list.
The following table shows the status of the call function if the "Return" instruction is programmed in a
network within the called block:

RLO Parameter value ENO of the call function

RLO 1
TRUE 1
1
FALSE 0
<Operand> <Operand>
RLO
TRUE The program execution continues in the
0
FALSE next network of the called block.
<Operand>
If an OB is completed, another block will be selected and started or executed by the priority class sys‐
tem:

- 134 -
 --(RET): Return (S7-1200, S7-1500)

• If the program cycle OB was completed, it will be restarted.

• If an OB is completed that has interrupted another block (for example, an alarm OB), then the inter‐
rupted block (for example, program cycle OB) will be executed.

Parameters
The following table shows the parameters of the "Return" instruction:

Parameter Declaration Data type Memory area Description

Status of the call‐
ing function with
RLO = 1:
Is set to the signal
RLO - -
status of the RLO.
TRUE - - 1
FALSE - - 0
Signal state of the
<Operand> Input BOOL I, Q, M, D, L
specified operand

Example
The following example shows how the instruction works:

If operand "TagIn" has the signal state "1", the "Return" instruction is executed. Program execution is
terminated in the called block and continues in the calling block. The ENO enable output of the call
function is reset to signal state "0".

- 135 -
 Word logic operations (S7-1200, S7-1500)

Word logic operations

This chapter contains the following information:

• AND: AND logic operation (S7-1200, S7-1500)
• OR: OR logic operation (S7-1200, S7-1500)
• XOR: EXCLUSIVE OR logic operation (S7-1200, S7-1500)
• INV: Create ones complement (S7-1200, S7-1500)
• DECO: Decode (S7-1200, S7-1500)
• ENCO: Encode (S7-1200, S7-1500)
• SEL: Select (S7-1200, S7-1500)
• MUX: Multiplex (S7-1200, S7-1500)
• DEMUX: Demultiplex (S7-1200, S7-1500)

- 136 -
 AND: AND logic operation (S7-1200, S7-1500)

AND: AND logic operation

Description
You can use the "AND logic operation" instruction to combine the value at the IN1 input and the value
at the IN2 input bit-by-bit by AND logic and query the result at the OUT output.
When the instruction is executed, bit 0 of the value at the IN1 input and bit 0 of the value at the IN2
input are logically ANDed. The result is stored in bit 0 of output OUT. The same logic operation is exe‐
cuted for all other bits of the specified values.
The number of inputs can be expanded in the instruction box. The added inputs are numbered in as‐
cending order in the box. When the instruction is executed, the values of all available input parame‐
ters are combined with AND logic (ANDed). The result is stored in the OUT output.
The result bit has signal state "1" only when both of the bits in the logic operation also have signal
state "1". If one of the two bits of the logic operation has signal state "0", the corresponding result bit
is reset.

Parameters
The following table shows the parameters of the "AND logic operation" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
I, Q, M, D, L, P or First value for log‐
IN1 Input Bit strings
constant ic operation
I, Q, M, D, L, P or Second value for
IN2 Input Bit strings
constant logic operation
Other inputs
I, Q, M, D, L, P or whose values are
INn Input Bit strings
constant logically com‐
bined.
Result of the in‐
OUT Output Bit strings I, Q, M, D, L, P
struction
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 137 -
 AND: AND logic operation (S7-1200, S7-1500)

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN1 Tag_Value1 0101 0101 0101 0101
IN2 Tag_Value2 0000 0000 0000 1111
OUT Tag_Result 0000 0000 0000 0101
If operand "TagIn" has the signal state "1", the "AND logic operation" instruction is executed. The val‐
ue of operand "Tag_Value1" and the value of operand "Tag_Value2" are ANDed. The result is map‐
ped bit-for-bit and output in operand "Tag_Result". The ENO enable output and the "TagOut" output
are set to signal state "1".

- 138 -
 OR: OR logic operation (S7-1200, S7-1500)

OR: OR logic operation

Description
You can use the "OR logic operation" instruction to combine the value at the IN1 input and the value
at the IN2 input bit-by-bit by OR logic and query the result at the OUT output.
When the instruction is executed, bit 0 of the value at the IN1 input and bit 0 of the value at the IN2
input are combined by OR logic operation. The result is stored in bit 0 of output OUT. The same logic
operation is executed for all bits of the specified tags.
The number of inputs can be expanded in the instruction box. The added inputs are numbered in as‐
cending order in the box. When the instruction is executed, the values of all available input parame‐
ters are combined with OR logic (ORed). The result is stored in the OUT output.
The result bit has signal state "1" when at least one of the two bits in the logic operation has the signal
state "1". If both of the bits of the logic operation have signal state "0", the corresponding result bit is
reset.

Parameters
The following table shows the parameters of the "OR logic operation" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
I, Q, M, D, L, P or First value for log‐
IN1 Input Bit strings
constant ic operation
I, Q, M, D, L, P or Second value for
IN2 Input Bit strings
constant logic operation
Other inputs
I, Q, M, D, L, P or whose values are
INn Input Bit strings
constant logically com‐
bined.
Result of the in‐
OUT Output Bit strings I, Q, M, D, L, P
struction
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 139 -
 OR: OR logic operation (S7-1200, S7-1500)

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN1 Tag_Value1 0101 0101 0101 0101
IN2 Tag_Value2 0000 0000 0000 1111
OUT Tag_Result 0101 0101 0101 1111
If operand "TagIn" has the signal state "1", the "OR logic operation" instruction is executed. The value
of operand "Tag_Value1" and the value of operand "Tag_Value2" are ORed. The result is mapped bit-
for-bit and output in operand "Tag_Result". The ENO enable output and the "TagOut" output are set to
signal state "1".

- 140 -
 XOR: EXCLUSIVE OR logic operation (S7-1200, S7-1500)

XOR: EXCLUSIVE OR logic operation

Description
You can use the "EXCLUSIVE OR logic operation" instruction to combine the value at the IN1 input
and the value at the IN2 input bit-by-bit by EXCLUSIVE OR logic and query the result at the OUT out‐
put.
When the instruction is executed, bit 0 of the value at the IN1 input and bit 0 of the value at the IN2
input are combined by EXCLUSIVE OR logic operation. The result is stored in bit 0 of output OUT.
The same logic operation is executed for all other bits of the specified value.
The number of inputs can be expanded in the instruction box. The added inputs are numbered in as‐
cending order in the box. When the instruction is executed, the values of all available input parame‐
ters are combined with EXCLUSIVE OR logic. The result is stored in the OUT output.
The result bit has signal state "1" when one of the two bits in the logic operation has the signal state
"1". If both of the bits of the logic operation have signal state "1" or "0", the corresponding result bit is
reset.

Parameters
The following table shows the parameters of the "EXCLUSIVE OR logic operation" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
I, Q, M, D, L, P or First value for log‐
IN1 Input Bit strings
constant ic operation
I, Q, M, D, L, P or Second value for
IN2 Input Bit strings
constant logic operation
Other inputs
I, Q, M, D, L, P or whose values are
INn Input Bit strings
constant logically com‐
bined.
Result of the in‐
OUT Output Bit strings I, Q, M, D, L, P
struction
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

- 141 -
 XOR: EXCLUSIVE OR logic operation (S7-1200, S7-1500)

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN1 Tag_Value1 0101 0101 0101 0101
IN2 Tag_Value2 0000 0000 0000 1111
OUT Tag_Result 0101 0101 0101 1010
If operand "TagIn" has the signal state "1", the "EXCLUSIVE OR logic operation" instruction is execu‐
ted. The value of operand "Tag_Value1" and the value of operand "Tag_Value2" are combined by EX‐
CLUSIVE OR logic. The result is mapped bit-for-bit and output in operand "Tag_Result". The ENO en‐
able output and the "TagOut" output are set to signal state "1".

- 142 -
 INV: Create ones complement (S7-1200, S7-1500)

INV: Create ones complement

Description
You can use the "Create ones complement" instruction to invert the signal state of the bits at the IN
input. When the instruction is processed, the value at the IN input and a hexadecimal template
(W#16#FFFF for 16-bit numbers or DW#16#FFFF FFFF for 32-bit numbers) are combined by EX‐
CLUSIVE OR logic. This inverts the signal state of the individual bits that are then stored at output
OUT.

Parameters
The following table shows the parameters of the "Create ones complement" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output
Bit strings, inte‐ I, Q, M, D, L, P or
IN Input Input value
gers constant
Ones complement
Bit strings, inte‐
OUT Output I, Q, M, D, L, P of the value at in‐
gers
put IN
You can select the data type for the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN TagIn_Value W#16#000F W#16#7E
OUT TagOut_Value W#16#FFF0 W#16#81
If operand "TagIn" has the signal state "1", the "Create ones complement" instruction is executed. The
instruction inverts the signal state of the individual bits at input TagIn_Value" and writes the result to
output "TagOut_Value". The ENO enable output and the "TagOut" output are set to signal state "1".

- 143 -
 Shift and rotate (S7-1200, S7-1500)

Shift and rotate

This chapter contains the following information:

• SHR: Shift right (S7-1200, S7-1500)
• SHL: Shift left (S7-1200, S7-1500)
• ROR: Rotate right (S7-1200, S7-1500)
• ROL: Rotate left (S7-1200, S7-1500)

- 144 -
 SHR: Shift right (S7-1200, S7-1500)

SHR: Shift right

Description
You can use the "Shift right" instruction to rotate the content of the operand at the input INbit-by-bit to
the right and query the result at the OUT output. You use the N parameter to specify the number of bit
positions by which the specified value is to be shifted.
When the value at the N parameter is "0", the value at the IN input is copied to the operand at the
OUT output.
When the value at the N parameter is greater than the number of available bit positions, the operand
value at the IN input is shifted by the available number of bit positions to the right.
In the case of unsigned values, the freed bit positions in the left area of the operand are filled with
zeroes when shifting occurs. If the specified value has a sign, the free bit positions are filled with the
signal state of the sign bit.
The following figure show how the content of an operand of integer data type is shifted four bit posi‐
tions to the right:

Parameters
The following table shows the parameters of the "Shift right" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Bit strings, in‐ Bit strings, in‐ I, Q, M, D, L or Value to be
IN Input
tegers tegers constant shifted

- 145 -
 SHR: Shift right (S7-1200, S7-1500)

Number of bit
USINT, UINT,
USINT, UINT, I, Q, M, D, L or positions by
N Input UDINT,
UDINT constant which the value
ULINT
is shifted
Bit strings, in‐ Bit strings, in‐ Result of the
OUT Output I, Q, M, D, L
tegers tegers instruction
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN TagIn_Value 0011 1111 1010 1111
N Tag_Number 3
OUT TagOut_Value 0000 0111 1111 0101
If operand "TagIn" has the signal state "1", the "Shift right" instruction is executed. The content of op‐
erand "TagIn_Value" is shifted three bit positions to the right. The result is sent to the "TagOut_Value"
output. If the instruction is executed without errors, the ENO enable output has the signal state "1"
and the "TagOut" output is set.

- 146 -
 SHL: Shift left (S7-1200, S7-1500)

SHL: Shift left

Description
You can use the "Shift left" instruction to rotate the content of the operand at the IN input bit-by-bit to
the left and query the result at the OUT output. You use the N parameter to specify the number of bit
positions by which the specified value is to be shifted.
When the value at the N parameter is "0", the value at the IN input is copied to the operand at the
OUT output.
When the value at the N parameter is greater than the number of available bit positions, the operand
value at the IN input is shifted by the available number of bit positions to the left.
The bit positions in the right part of the operand freed by shifting are filled with zeros.
The following figure shows how the content of an operand of the WORD data type is shifted by six bit
positions to the left:

Parameters
The following table shows the parameters of the "Shift left" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Bit strings, in‐ Bit strings, in‐ I, Q, M, D, L or Value to be
IN Input
tegers tegers constant shifted

- 147 -
 SHL: Shift left (S7-1200, S7-1500)

Number of bit
USINT, UINT,
USINT, UINT, I, Q, M, D, L or positions by
N Input UDINT,
UDINT constant which the value
ULINT
is shifted
Bit strings, in‐ Bit strings, in‐ Result of the
OUT Output I, Q, M, D, L
tegers tegers instruction
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN TagIn_Value 0011 1111 1010 1111
N Tag_Number 4
OUT TagOut_Value 1111 1010 1111 0000
If operand "TagIn" has the signal state "1", the "Shift left" instruction is executed. The content of oper‐
and "TagIn_Value" is shifted four bit positions to the left. The result is sent to the "TagOut_Value" out‐
put. If the instruction is executed without errors, the ENO enable output has the signal state "1" and
the "TagOut" output is set.

- 148 -
 ROR: Rotate right (S7-1200, S7-1500)

ROR: Rotate right

Description
You can use the "Rotate right" instruction to rotate the content of the operand at the IN input bit-by-bit
to the right and query the result at the OUT output. You use the N parameter to specify the number of
bit positions by which the specified value is to be rotated. The bit positions freed by rotating are filled
with the bit positions that are pushed out.
When the value at the N parameter is "0", the value at the IN input is copied to the operand at the
OUT output.
When the value at the N parameter is greater than the number of available bit positions, the operand
value at the IN input is nevertheless rotated by the specified number of bit positions.
The following figure shows how the content of an operand of DWORD data type is rotated three posi‐
tions to the right:

Parameters
The following table shows the parameters of the "Rotate right" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Bit strings, Bit strings, inte‐ I, Q, M, D, L or Value to be ro‐
IN Input
integers gers constant tated

- 149 -
 ROR: Rotate right (S7-1200, S7-1500)

Number of bit
USINT,
USINT, UINT, I, Q, M, D, L or positions by
N Input UINT,
UDINT, ULINT constant which the value
UDINT
is rotated
Bit strings, Bit strings, inte‐ Result of the
OUT Output I, Q, M, D, L
integers gers instruction
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN TagIn_Value 0000 1111 1001 0101
N Tag_Number 5
OUT TagOut_Value 1010 1000 0111 1100
If operand "TagIn" has the signal state "1", the "Rotate right" instruction is executed. The content of
operand "TagIn_Value" is rotated five bit positions to the right. The result is sent to the "TagOut_Val‐
ue" output. If the instruction is executed without errors, the ENO enable output has the signal state "1"
and the "TagOut" output is set.

- 150 -
 ROL: Rotate left (S7-1200, S7-1500)

ROL: Rotate left

Description
You can use the "Rotate left" instruction to rotate the content of the operand at the IN input bit-by-bit
to the left and query the result at the OUT output. You use the N parameter to specify the number of
bit positions by which the specified value is to be rotated. The bit positions freed by rotating are filled
with the bit positions that are pushed out.
When the value at the N parameter is "0", the value at the IN input is copied to the operand at the
OUT output.
When the value at the N parameter is greater than the number of available bit positions, the operand
value at the IN input is nevertheless rotated by the specified number of bit positions.
The following figure shows how the content of an operand of DWORD data type is rotated three posi‐
tions to the left:

Parameters
The following table shows the parameters of the "Rotate left" instruction:

Parameter Declaration Data type Memory area Description

S7-1200 S7-1500
EN Input BOOL BOOL I, Q, M, D, L Enable input
ENO Output BOOL BOOL I, Q, M, D, L Enable output
Bit strings, Bit strings, inte‐ I, Q, M, D, L or Value to be ro‐
IN Input
integers gers constant tated

- 151 -
 ROL: Rotate left (S7-1200, S7-1500)

Number of bit
USINT,
USINT, UINT, I, Q, M, D, L or positions by
N Input UINT,
UDINT, ULINT constant which the value
UDINT
is rotated
Bit strings, Bit strings, inte‐ Result of the
OUT Output I, Q, M, D, L
integers gers instruction
You can select the data type of the instruction from the "<???>" drop-down list of the instruction box.
For additional information on valid data types, refer to "See also".

Example
The following example shows how the instruction works:

The following table shows how the instruction works using specific operand values:

Parameter Operand Value

IN TagIn_Value 1010 1000 1111 0110
N Tag_Number 5
OUT TagOut_Value 0001 1110 1101 0101
If the "TagIn" input has the signal state "1", the "Rotate left" instruction is executed. The content of
operand "TagIn_Value" is rotated five bit positions to the left. The result is sent to the "TagOut_Value"
output. If the instruction is executed without errors, the ENO enable output has the signal state "1"
and the "TagOut" output is set.

- 152 -
 Additional instructions (S7-1500)

Additional instructions

This chapter contains the following information:

• DRUM: Implement sequencer (S7-1500)
• DCAT: Discrete control-timer alarm (S7-1500)
• MCAT: Motor control-timer alarm (S7-1500)
• IMC: Compare input bits with the bits of a mask (S7-1500)
• SMC: Compare scan matrix (S7-1500)
• LEAD_LAG: Lead and lag algorithm (S7-1500)
• SEG: Create bit pattern for seven-segment display (S7-1500)
• BCDCPL: Create tens complement (S7-1500)
• BITSUM: Count number of set bits (S7-1500)

- 153 -
 DRUM: Implement sequencer (S7-1500)

DRUM: Implement sequencer

Description
You can use the "Implement sequencer" instruction to assign the programmed values of the
OUT_VAL parameter of the corresponding step to the programmed output bits (OUT1 to OUT16) and
the output word (OUT_WORD). The specific step must thereby satisfy the conditions of the program‐
med enable mask on the S_MASK parameter while the instruction remains at this step. The instruc‐
tion advances to the next step if the event for the step is true and the programmed time for the current
step elapses or if the value at the JOG parameter changes from "0" to "1". The instruction is reset if
the signal state on the RESET parameter changes to "1". The current step is hereby equated to the
preset step (DSP).
The amount of time spent on a step is determined by the product of the preset timebase (DTBP) and
the preset counter value (S_PRESET) for each step. At the start of a new step, this calculated value is
loaded into the DCC parameter, which contains the time remaining for the current step. If, for example
the value of the DTBP parameter is "2" and the preset value for the first step is "100" (100 ms), the
DCC parameter has the value "200" (200 ms).
A step can be programmed with a timer value, an event or both. Steps that have an event bit and the
timer value "0" advance to the next step as soon as the signal state of the event bit is "1". Steps that
are programmed only with a timer value start the time immediately. Steps that are programmed with
an event bit and a timer value greater than "0" start the time when the signal state of the event bit is
"1". The event bits are initialized with a signal state of "1".
When the sequencer is on the last programmed step (LST_STEP) and the time for this step has ex‐
pired, the signal state on the Q parameter is set to "1"; otherwise it is set to "0". When the parameter
Q is set, the instruction remains on the step until it is reset.
In the configurable mask (S_MASK) you can selected the separate bits in the output word
(OUT_WORD) and set or reset the output bits (OUT1 to OUT16) by means of the output values
(OUT_VAL). If a bit of the configurable mask is in the signal state "1", the value OUT_VAL sets or
resets the corresponding bit. If the signal state of a bit of the configurable mask is "0", the correspond‐
ing bit is left unchanged. All the bits of the configurable mask for all 16 steps are initialized with a sig‐
nal state of "1".
The output bit at the OUT1 parameter corresponds to the least significant bit of the output word
(OUT_WORD). The output bit at the OUT16 parameter corresponds to the most significant bit of the
output word (OUT_WORD).
When you insert the instruction in the program, the "Call options" dialog opens in which you can spec‐
ify whether the block parameters will be stored in a separate data block (single instance) or as a local
tag (multi-instance) in the block interface. If you create a separate data block, you will find it in the
project tree in the "Program resources" folder under "Program blocks > System blocks". For additional
information on this topic, refer to "See also".

Parameters
The following table shows the parameters of the "Implement sequencer" instruction:

Parameter Declaration Data type Memory area Description

EN Input BOOL I, Q, M, D, L Enable input
ENO Output BOOL I, Q, M, D, L Enable output

- 154 -
 DRUM: Implement sequencer (S7-1500)

The signal state

I, Q, M, D, L or
RESET Input BOOL "1" indicates the
constant
reset condition.
When the signal
state changes
I, Q, M, D, L or from "0" to "1", the
JOG Input BOOL
constant instruction advan‐
ces to the next
step.
The signal state
"1" causes the se‐
I, Q, M, D, L or quencer to ad‐
DRUM_EN Input BOOL
constant vance based on
the event and time
criteria.
I, Q, M, D, L or Number of the last
LST_STEP Input BYTE
constant programmed step.
Event bit (i);
EVENT(i), I, Q, M, D, L or
Input BOOL Initial signal state
1 ≤ i ≤ 16 constant
is "1".
OUT(j),
Output BOOL I, Q, M, D, L Output bit (j)
1 ≤ j ≤ 16
The signal state
"1" indicates that
Q Output BOOL I, Q, M, D, L the time for the
last step has
elapsed.
Word address to
which the se‐
OUT_WORD Output WORD I, Q, M, D, L, P
quencer writes the
output values.
ERR_CODE Output WORD I, Q, M, D, L, P Error information
JOG parameter
JOG_HIS Static BOOL I, Q, M, D, L
history bit
The signal state
"1" indicates that
I, Q, M, D, L or
EOD Static BOOL the time for the
constant
last step has
elapsed.
I, Q, M, D, L, P or Preset step of the
DSP Static BYTE
constant sequencer
I, Q, M, D, L, P or Current step of
DSC Static BYTE
constant the sequencer
Current numerical
I, Q, M, D, L, P or
DCC Static DWORD value of the se‐
constant
quencer
I, Q, M, D, L, P or Preset timebase
DTBP Static WORD
constant of the sequencer

- 155 -
 DRUM: Implement sequencer (S7-1500)

I, Q, M, D, L or Previous system
PREV_TIME Static DWORD
constant time
Preset count for
I, Q, M, D, L or each step [1 to 16]
S_PRESET Static ARRAY of WORD
constant where 1 clock
pulse = 1 ms.
Output values for
I, Q, M, D, L or
OUT_VAL Static ARRAY of BOOL each step [1 to 16,
constant
0 to 15].
Configurable
mask for each
I, Q, M, D, L or
S_MASK Static ARRAY of BOOL step [1 to 16,
constant
0 to 15]. Initial sig‐
nal states are "1".
For additional information on valid data types, refer to "See also".

Parameters ERR_CODE
The following table shows the meaning of the values of the ERR_CODE parameter:

ERR_CODE* Explanation
W#16#0000 No error
The value at the LST_STEP parameter is less than 1 or
W#16#000B
greater than 16.
The value at the DSC parameter is less than 1 or greater
W#16#000C
than the value of the LST_STEP parameter.
The value at the DSP parameter is less than 1 or greater
W#16#000D
than the value of the LST_STEP parameter.
*The error codes can be displayed as integer or hexadecimal value in the program editor. For infor‐
mation on toggling display formats, refer to "See also".

- 156 -