PLC concepts 4

4.1 Execution of the user program

The CPU supports the following types of code blocks that allow you to create an efficient
structure for your user program:
● Organization blocks (OBs) define the structure of the program. Some OBs have
predefined behavior and start events, but you can also create OBs with custom start
events. Valid OB number ranges are shown in Event execution priorities and queuing
(Page 75).
● Functions (FCs) and function blocks (FBs) contain the program code that corresponds to
specific tasks or combinations of parameters. Each FC or FB provides a set of input and
output parameters for sharing data with the calling block. An FB also uses an associated
data block (called an instance DB) to maintain state of values between execution that can
be used by other blocks in the program. Valid FC and FB numbers range from 1 to
65535.
● Data blocks (DBs) store data that can be used by the program blocks. Valid DB numbers
range from 1 to 65535.
Execution of the user program begins with one or more optional start-up organization blocks
(OBs) which are executed once upon entering RUN mode, followed by one or more program
cycle OBs which are executed cyclically. An OB can also be associated with an interrupt
event, which can be either a standard event or an error event, and executes whenever the
corresponding standard or error event occurs.
A function (FC) or a function block (FB) is a block of program code that can be called from
an OB or from another FC or FB, down to the following nesting depths:
● 16 from the program cycle or startup OB
● 4 from time delay interrupt, cyclic interrupt, time of day interrupt, hardware interrupt, time
error interrupt, or diagnostic error interrupt OB
FCs are not associated with any particular data block (DB), while FBs are tied directly to a
DB and use the DB for passing parameters and storing interim values and results.
The size of the user program, data, and configuration is limited by the available load memory
and work memory in the CPU. There is no specific limit to the number of each individual OB,
FC, FB and DB block. However, the total number of blocks is limited to 1024.
Each cycle includes writing the outputs, reading the inputs, executing the user program
instructions, and performing background processing. The cycle is referred to as a scan cycle
or scan.
The modules (SM, SB, BB, CB, CM or CP) are detected and logged in only upon power-up.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 67
PLC concepts
4.1 Execution of the user program

● Inserting or removing a module in the central rack under power (hot) is not supported.
Never insert or remove a module from the central rack when the CPU has power..

WARNING

Insertion or removal of a module (SM, SB, BB, CD, CM or CP) from the central rack
when the CPU has power could cause unpredictable behavior, resulting in damage to
equipment and/or injury to personnel.
Always ensure that power is removed from the CPU and central rack before inserting or
removing a module from the central rack.

● You can insert or remove a SIMATIC memory card while the CPU is under power.
However, inserting or removing a memory card when the CPU is in RUN mode causes
the CPU to go to STOP mode.

CAUTION

Insertion or removal of a memory card when the CPU is in RUN mode causes the CPU
to go to STOP, which might result in in damage to the equipment or the process being
controlled.
Whenever you insert or remove a memory card, the CPU immediately goes to STOP
mode. Before inserting or removing a memory card, always ensure that the CPU is not
actively controlling a machine or process. Always install an emergency stop circuit for
your application or process.

● If you insert or remove a module in a distributed I/O rack (PROFINET or PROFIBUS)

when the CPU is in RUN mode, the CPU generates an entry in the diagnostics buffer and
stays in RUN mode.
Under the default configuration, all local digital and analog I/O points are updated
synchronously with the scan cycle using an internal memory area called the process image.
The process image contains a snapshot of the physical inputs and outputs (the physical I/O
points on the CPU, signal board, and signal modules).
The CPU performs the following tasks:
● The CPU writes the outputs from the process image output area to the physical outputs.
● The CPU reads the physical inputs just prior to the execution of the user program and
stores the input values in the process image input area. This ensures that these values
remain consistent throughout the execution of the user instructions.
● The CPU executes the logic of the user instructions and updates the output values in the
process image output area instead of writing to the actual physical outputs.
This process provides consistent logic through the execution of the user instructions for a
given cycle and prevents the flickering of physical output points that might change state
multiple times in the process image output area.

S7-1200 Programmable controller

68 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

You can specify whether digital and analog I/O points are to be automatically updated and
stored in the process image. If you insert a module in the device view, its data is located in
the process image of the CPU (default). The CPU handles the data exchange between the
module and the process image area automatically during the update of the process image.
To remove digital or analog points from the process-image automatic update, select the
appropriate device in Device configuration, view the Properties tab, expand if necessary to
locate the desired I/O points, and then select "IO addresses/HW identifier". Then change the
entry for "Process image:" from "Cyclic PI" to "---". To add the points back to the process-
image automatic update, change this selection back to "Cyclic PI".
You can immediately read physical input values and immediately write physical output
values when an instruction executes. An immediate read accesses the current state of the
physical input and does not update the process image input area, regardless of whether the
point is configured to be stored in the process image. An immediate write to the physical
output updates both the process image output area (if the point is configured to be stored in
the process image) and the physical output point. Append the suffix ":P" to the I/O address if
you want the program to immediately access I/O data directly from the physical point instead
of using the process image.
The CPU supports distributed I/O for both PROFINET and PROFIBUS networks (Page 423).

4.1.1 Operating modes of the CPU

The CPU has three modes of operation: STOP mode, STARTUP mode, and RUN mode.
Status LEDs on the front of the CPU indicate the current mode of operation.
● In STOP mode, the CPU is not executing the program. You can download a project.
● In STARTUP mode, the startup OBs (if present) are executed once. Interrupt events are
not processed during the startup mode.
● In RUN mode, the program cycle OBs are executed repeatedly. Interrupt events can
occur and be processed at any point within the RUN mode. Some parts of a project can
be downloaded in RUN mode (Page 690).
The CPU supports a warm restart for entering the RUN mode. Warm restart does not include
a memory reset. All non-retentive system and user data are initialized at warm restart.
Retentive user data is retained.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 69
PLC concepts
4.1 Execution of the user program

A memory reset clears all work memory, clears retentive and non-retentive memory areas,
and copies load memory to work memory. A memory reset does not clear the diagnostics
buffer or the permanently saved values of the IP address.

Note
When you download one or more DBs from STEP 7 V11 to an S7-1200 V2 CPU, the
retentive and non-retentive values of those DBs are set to their start values. The next
transition to RUN performs a warm restart, setting all non-retentive data to their start values
and setting all retentive data to their retained values.
When you download project elements (such as device configuration, code blocks or DBs)
from STEP 7 V10.5 to any S7-1200 CPU or from STEP 7 V11 to an S7-1200 V1 CPU (or a
V2 CPU that has been configured as a V1 CPU), the next transition to RUN mode resets all
of the DBs in the project to their start values.

You can configure the "startup after POWER ON" setting of the CPU. This configuration item
appears under the "Device configuration" for the CPU under "Startup". When power is
applied, the CPU performs a sequence of power-up diagnostic checks and system
initialization. During system initialization the CPU deletes all non-retentive bit memory and
resets all non-retentive DB contents to the initial values from load memory. The CPU retains
retentive bit memory and retentive DB contents and then enters the appropriate operating
mode. Certain detected errors prevent the CPU from entering the RUN mode. The CPU
supports the following configuration choices:
● No restart (stay in STOP mode)
● Warm restart - RUN
● Warm restart - mode prior to POWER OFF

CAUTION

The CPU can enter STOP mode due to repairable faults, such as failure of a
replaceable signal module, or temporary faults, such as power line disturbance or erratic
power up event.
If the CPU has been configured to "Warm restart mode prior to POWER OFF", it will not
return to RUN mode when the fault is repaired or removed until it receives a new
command from STEP 7 to go to RUN. Without a new command, the STOP mode is
retained as the mode prior to POWER OFF.
CPUs that are intended to operate independently of a STEP 7 connection should
typically be configured to "Warm restart - RUN" so that the CPU can be returned to RUN
mode by a power cycle following the removal of fault conditions.

S7-1200 Programmable controller

70 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

You can change the current operating mode using the "STOP" or "RUN" commands from the
online tools of the programming software. You can also include a STP instruction in your
program to change the CPU to STOP mode. This allows you to stop the execution of your
program based on the program logic.

● In STOP mode, the CPU handles any communication requests (as appropriate) and
performs self-diagnostics. The CPU does not execute the user program, and the
automatic updates of the process image do not occur.
You can download your project only when the CPU is in STOP mode.
● In STARTUP and RUN modes, the CPU performs the tasks shown in the following figure.

( ུ

$ % & ' ) ཰ ཱ ི ཱི

STARTUP RUN
A Clears the I (image) memory area ① Writes Q memory to the physical outputs
B Initializes the outputs with either the ② Copies the state of the physical inputs to I
last value or the substitute value memory
C Executes the startup OBs ③ Executes the program cycle OBs
D Copies the state of the physical inputs ④ Performs self-test diagnostics
to I memory
E Stores any interrupt events into the ⑤ Processes interrupts and communications
queue to be processed after entering during any part of the scan cycle
RUN mode
F Enables the writing of Q memory to the
physical outputs

STARTUP processing
Whenever the operating mode changes from STOP to RUN, the CPU clears the process
image inputs, initializes the process image outputs and processes the startup OBs. Any read
accesses to the process-image inputs by instructions in the startup OBs read zero rather
than the current physical input value. Therefore, to read the current state of a physical input
during the startup mode, you must perform an immediate read. The startup OBs and any
associated FCs and FBs are executed next. If more than one startup OB exists, each is
executed in order according to the OB number, with the lowest OB number executing first.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 71
PLC concepts
4.1 Execution of the user program

Each startup OB includes startup information that helps you determine the validity of
retentive data and the time-of-day clock. You can program instructions inside the startup
OBs to examine these startup values and to take appropriate action. The following startup
locations are supported by the Startup OBs:

Table 4- 1 Startup locations supported by the startup OB

Input Data Type Description

LostRetentive Bool This bit is true if the retentive data storage areas have been lost
LostRTC Bool This bit is true if the time-of-day clock (Real time Clock) has been lost

The CPU also performs the following tasks during the startup processing.
● Interrupts are queued but not processed during the startup phase
● No cycle time monitoring is performed during the startup phase
● Configuration changes to HSC (high-speed counter), PWM (pulse-width modulation), and
PtP (point-to-point communication) modules can be made in startup
● Actual operation of HSC, PWM and point-to-point communication modules only occurs in
RUN
After the execution of the startup OBs finishes, the CPU goes to RUN mode and processes
the control tasks in a continuous scan cycle.

See also
Stop scan cycle instruction (Page 235)
CPU operator panel for the online CPU (Page 679)

4.1.2 Processing the scan cycle in RUN mode

For each scan cycle, the CPU writes the outputs, reads the inputs, executes the user
program, updates communication modules, and responds to user interrupt events and
communication requests. Communication requests are handled periodically throughout the
scan.
These actions (except for user interrupt events) are serviced regularly and in sequential
order. User interrupt events which are enabled are serviced according to priority in the order
in which they occur.

S7-1200 Programmable controller

72 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

The system guarantees that the scan cycle will be completed in a time period called the
maximum cycle time; otherwise a time error event is generated.
● Each scan cycle begins by retrieving the current values of the digital and analog outputs
from the process image and then writing them to the physical outputs of the CPU, SB,
and SM modules configured for automatic I/O update (default configuration). When a
physical output is accessed by an instruction, both the output process image and the
physical output itself are updated.
● The scan cycle continues by reading the current values of the digital and analog inputs
from the CPU, SB, and SMs configured for automatic I/O update (default configuration),
and then writing these values to the process image. When a physical input is accessed
by an instruction, the value of the physical input is accessed by the instruction, but the
input process image is not updated.
● After reading the inputs, the user program is executed from the first instruction through
the end instruction. This includes all the program cycle OBs plus all their associated FCs
and FBs. The program cycle OBs are executed in order according to the OB number with
the lowest OB number executing first.
Communications processing occurs periodically throughout the scan, possibly interrupting
user program execution.
Self-diagnostic checks include periodic checks of the system and the I/O module status
checks.
Interrupts can occur during any part of the scan cycle, and are event-driven. When an event
occurs, the CPU interrupts the scan cycle and calls the OB that was configured to process
that event. After the OB finishes processing the event, the CPU resumes execution of the
user program at the point of interruption.

4.1.3 Organization blocks (OBs)

OBs control the execution of the user program. Each OB must have a unique OB number.
The default OB numbers are reserved below 200. Other OBs must be numbered 200 or
greater.
Specific events in the CPU trigger the execution of an organization block. OBs cannot call
each other or be called from an FC or FB. Only a start event, such as a diagnostic interrupt
or a time interval, can start the execution of an OB. The CPU handles OBs according to their
respective priority classes, with higher priority OBs executed before lower priority OBs. The
lowest priority class is 1 (for the main program cycle), and the highest priority class is 26 (for
the time-error interrupts).

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 73
PLC concepts
4.1 Execution of the user program

OBs control the following operations:

● Program cycle OBs execute cyclically while the CPU is in RUN mode. The main block of
the program is a program cycle OB. This is where you place the instructions that control
your program and where you call additional user blocks. Multiple program cycle OBs are
allowed and are executed in numerical order. OB 1 is the default. Other program cycle
OBs must be identified as OB 200 or greater.
● Startup OBs execute one time when the operating mode of the CPU changes from STOP
to RUN, including powering up in the RUN mode and in commanded STOP-to-RUN
transitions. After completion, the main "Program cycle" OB will begin executing. Multiple
startup OBs are allowed. OB 100 is the default. Others must be OB 200 or greater.
● Cyclic interrupt OBs execute at a specified interval. A cyclic interrupt OB will interrupt
cyclic program execution at user defined intervals, such as every 2 seconds. You can
configure up to a total of 4 for both the time-delay and cyclic events at any given time,
with one OB allowed for each configured time-delay and cyclic event. The OB must be
OB 200 or greater.
● Hardware interrupt OBs execute when the relevant hardware event occurs, including
rising and falling edges on built-in digital inputs and HSC events. A hardware interrupt OB
will interrupt normal cyclic program execution in reaction to a signal from a hardware
event. You define the events in the properties of the hardware configuration. One OB is
allowed for each configured hardware event. The OB must be OB 200 or greater.
● A time error interrupt OB executes when either the maximum cycle time is exceeded or a
time error event occurs. The OB for processing the time error interrupt is OB 80. If
triggered, it executes, interrupting normal cyclic program execution or any other event
OB. The events that trigger the time error interrupt and the reaction of the CPU to those
events are described below:
– Exceeding the maximum cycle time: You configure the maximum cycle time in the
properties of the CPU. If OB 80 does not exist, the reaction of the CPU for exceeding
the maximum time is to change to STOP.
– Time errors: If OB 80 does not exist, the reaction of the CPU is to stay in RUN. Time
errors occur if the time of day event is missed or repeated, the queue overflows, or an
event OB (time delay event, time of day event, or cyclic interrupt) starts before the
CPU finishes the execution of the first.
The occurrence of either of these events generates a diagnostic buffer entry describing
the event. The diagnostic buffer entry is generated regardless of the existence of OB 80.
● Diagnostic error interrupt OBs execute when a diagnostic error is detected and reported.
A diagnostic OB interrupts the normal cyclic program execution if a diagnostics-capable
module recognizes an error (if the diagnostic error interrupt has been enabled for the
module). OB 82 is the only OB number supported for the diagnostic error event. You can
include an STP instruction (put CPU in STOP mode) inside your OB 82 if you desire your
CPU to enter STOP mode upon receiving this type of error. If there is no diagnostic OB in
the program, the CPU ignores the error (stays in RUN).

S7-1200 Programmable controller

74 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

4.1.4 Event execution priorities and queuing

The CPU processing is controlled by events. An event triggers an interrupt OB to be
executed. You can specify the interrupt OB for an event during the creation of the block,
during the device configuration, or with an ATTACH or DETACH instruction. Some events
happen on a regular basis like the program cycle or cyclic events. Other events happen only
a single time, like the startup event and time delay events. Some events happen when there
is a change triggered by the hardware, such as an edge event on an input point or a high
speed counter event. There are also events like the diagnostic error and time error event
which only happen when there is an error. The event priorities and queues are used to
determine the processing order for the event interrupt OBs.
The program cycle event happens once during each program cycle (or scan). During the
program cycle, the CPU writes the outputs, reads the inputs and executes program cycle
OBs. The program cycle event is required and is always enabled. You may have no program
cycle OBs, or you may have multiple OBs selected for the program cycle event. After the
program cycle event is triggered, the lowest numbered program cycle OB (usually OB 1) is
executed. The other program cycle OBs are executed sequentially (in numerical order) within
the program cycle.
The cyclic interrupt events allow you to configure the execution of an interrupt OB at a
configured scan time. The initial scan time is configured when the OB is created and
selected to be a cyclic interrupt OB. A cyclic event will interrupt the program cycle and
execute the cyclic interrupt OB (the cyclic event is at a higher priority class than the program
cycle event).
Only one cyclic interrupt OB can be attached to a cyclic event.
Each cyclic event can be assigned a phase shift so that the execution of cyclic interrupts with
the same scan time can be offset from one another by the phase shift amount. The default
phase shift is 0. To change the initial phase shift, or to change the initial scan time for a
cyclic event, right click on the cyclic interrupt OB in the project tree, click "Properties", then
click "Cyclic interrupt", and enter the new initial values. You can also query and change the
scan time and the phase shift from your program using the Query cyclic interrupt
(QRY_CINT) and Set cyclic interrupt (SET_CINT) instructions. Scan time and phase shift
values set by the SET_CINT instruction do not persist through a power cycle or a transition
to STOP mode; scan time and phase shift values will return to the initial values following a
power cycle or a transition to STOP. The CPU supports a total of four cyclic and time-delay
interrupt events.
The startup event happens one time on a STOP to RUN transition and causes the startup
OBs to be executed. Multiple OBs can be selected for the startup event. The startup OBs are
executed in numerical order.
The time delay interrupt events allow you to configure the execution of an interrupt OB after
a specified delay time has expired. The delay time is specified with the SRT_DINT
instruction. The time delay events will interrupt the program cycle to execute the time delay
interrupt OB. Only one time delay interrupt OB can be attached to a time delay event. The
CPU supports four time delay events.
The hardware interrupt events are triggered by a change in the hardware, such as a rising or
falling edge on an input point, or a HSC (High Speed Counter) event. There can be one
interrupt OB selected for each hardware interrupt event. The hardware events are enabled in
Device configuration. The OBs are specified for the event in the Device configuration or with
an ATTACH instruction in the user program. The CPU supports several hardware interrupt
events. The exact events are based on the CPU model and the number of input points.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 75
PLC concepts
4.1 Execution of the user program

The time and diagnostic error interrupt events are triggered when the CPU detects an error.
These events are at a higher priority class that the other interrupt events and can interrupt
the execution of the time delay, cyclic and hardware interrupt events. One interrupt OB can
be specified for each of the time error and diagnostic error interrupt events.

Understanding event execution priorities and queuing

The number of pending (queued) events from a single source is limited, using a different
queue for each event type. Upon reaching the limit of pending events for a given event type,
the next event is lost. Refer to the following section on "Understanding time error events" for
more information regarding queue overflows.
Each CPU event has an associated priority. You cannot change the priority of an OB. In
general, events are serviced in order of priority (highest priority first). Events of the same
priority are serviced on a "first-come, first-served" basis.

Table 4- 2 OB events

Event OB number Quantity allowed Start event OB priority

Program cycle OB 1, OB 200 to 1 program cycle event  Startup OB ends 1
OB 65535 Multiple OBs allowed  Last program cycle OB ends
Startup OB 100, OB 200 to 1 startup event 1, 2 STOP-to-RUN transition 1
OB 65535 Multiple OBs allowed
Time OB 200 to OB 65535 Up to 4 time events3 Time-delay OB event is scheduled 3
1 OB per event Cyclic OB event is scheduled 7
Process OB 200 to OB 65535 Up to 50 process events4 Edges: 5
1 OB per event  Rising edge events: 16 max.
 Falling edge events: 16 max.
For HSC: 6
 CV=PV: 6 max.
 Direction changed: 6 max.
 External reset: 6 max.

S7-1200 Programmable controller

76 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

Event OB number Quantity allowed Start event OB priority

Diagnostic error OB 82 1 event (only if OB 82 was Module transmits an error 9
loaded)
Time error OB 80 1 event (only if OB 80 was  Maximum cycle time was 26
loaded)5 exceeded
 A second time interrupt (cyclic or
time-delay) started before the
CPU had finished execution of
the first interrupt

1 The startup event and the program cycle event will never occur at the same time because the startup event will run to
completion before the program cycle event will be started (controlled by the operating system).
2 Only the diagnostic error event (OB 82) interrupts the startup event. All other events are queued to be processed after
the startup event has finished.
3 The CPU provides a total of 4 time events that are shared by the time-delay OBs and the cyclic OBs. The number of
time-delay and cyclic OBs in your user program cannot exceed 4.
4 You can have more than 50 process events if you use the DETACH and ATTACH instructions.
5 You can configure the CPU to stay in RUN if the maximum scan cycle time was exceeded or you can use the
RE_TRIGR instruction to reset the cycle time. However, the CPU goes to STOP mode the second time that the
maximum scan cycle time was exceeded in one scan cycle.

After the execution of an OB with a priority of 2 to 25 has started, processing of that OB

cannot be interrupted by the occurrence of another event, except for by OB 80 (time-error
event, which has a priority of 26). All other events are queued for later processing, allowing
the current OB to finish.

Interrupt latency
The interrupt event latency (the time from notification of the CPU that an event has occurred
until the CPU begins execution of the first instruction in the OB that services the event) is
approximately 175 µsec, provided that a program cycle OB is the only event service routine
active at the time of the interrupt event.

Understanding time error events

The occurrence of any of several different time error conditions results in a time error event.
The following time errors are supported:
● Maximum cycle time exceeded
● Requested OB cannot be started
● Queue overflow occurred
The maximum cycle time exceeded condition results if the program cycle does not complete
within the specified maximum scan cycle time. See the section on "Monitoring the cycle time
in the S7-1200 System Manual" (Page 80) for more information regarding the maximum
cycle time condition, how to configure the maximum scan cycle time, and how to reset the
cycle timer.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 77
PLC concepts
4.1 Execution of the user program

The requested OB cannot be started condition results if an OB is requested by a cyclic

interrupt, a time-delay interrupt, or a time-of-day interrupt, but the requested OB is already
being executed.
The queue overflow occurred condition results if the interrupts are occurring faster than they
can be processed. The number of pending (queued) events is limited using a different queue
for each event type. If an event occurs when the corresponding queue is full, a time error
event is generated.
All time error events trigger the execution of OB 80 if it exists. If an OB 80 is not included in
the user program, then the device configuration of the CPU determines the CPU reaction to
the time error:
● The default configuration for time errors, such as starting a second cyclic interrupt before
the CPU has finished the execution of the first, is for the CPU to stay in RUN.
● The default configuration for exceeding the maximum time is for the CPU to change to
STOP.
You can use the RE_TRIGR instruction to reset the maximum cycle time. However, if two
"maximum cycle time exceeded" conditions occur within the same program cycle without
resetting the cycle timer, then the CPU transitions to STOP, regardless of whether OB 80
exists. See the section on "Monitoring the cycle time in the S7-1200 System Manual"
(Page 80).
OB 80 includes startup information that helps you determine which event and OB generated
the time error. You can program instructions inside OB 80 to examine these startup values
and to take appropriate action.

Table 4- 3 Startup information for OB 80

Input Data type Description

fault_id BYTE 16#01 - maximum cycle time exceeded
16#02 - requested OB cannot be started
16#07 and 16#09 - queue overflow occurred
csg_OBnr OB_ANY Number of the OB which was being executed when the error
occurred
csg_prio UINT Priority of the OB causing the error

No time error interrupt OB 80 is present when you create a new project. If desired, you add a
time error interrupt OB 80 to your project by double-clicking "Add new block" under "Program
blocks" in the tree, then choose "Organization block", and then "Time error interrupt".

Understanding diagnostic error events

Analog (local), PROFINET, and PROFIBUS devices are capable of detecting and reporting
diagnostic errors. The occurrence or removal of any of several different diagnostic error
conditions results in a diagnostic error event. The following diagnostic errors are supported:
● No user power
● High limit exceeded
● Low limit exceeded

S7-1200 Programmable controller

78 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

● Wire break
● Short circuit
Diagnostic error events trigger the execution of OB 82 if it exists. If OB 82 does not exist,
then the CPU ignores the error. No diagnostic error interrupt OB 82 is present when you
create a new project. If desired, you add a diagnostic error interrupt OB 82 to your project by
double-clicking "Add new block" under "Program blocks" in the tree, then choose
"Organization block", and then "Diagnostic error interrupt".

Note
Diagnostic errors for multi-channel local analog devices (I/O, RTD, and Thermocouple)
The OB 82 diagnostic error interrupt can report only one channel's diagnostic error at a time.
If two channels of a multi-channel device have an error, then the second error only triggers
OB 82 under the following conditions: the first channel error clears, the execution of OB 82
triggered by the first error is complete, and the second error still exists.

OB 82 includes startup information that helps you determine whether the event is due to the
occurrence or removal of an error, and the device and channel which reported the error. You
can program instructions inside OB 82 to examine these startup values and to take
appropriate action.

Table 4- 4 Startup information for OB 82

Input Data type Description

IOstate WORD IO state of the device:
 Bit 0 = 1 if the configuration is correct, and = 0 if the configuration is
no longer correct.
 Bit 4 = 1 if an error is present (such as a wire break). (Bit 4 = 0 if
there is no error.)
 Bit 5 = 1 if the configuration is not correct, and = 0 if the configuration
is correct again.
 Bit 6 = 1 if an I/O access error has occurred. Refer to laddr for the
hardware identifier of the I/O with the access error. (Bit 6 = 0 if there
is no error.)
laddr HW_ANY Hardware identifier of the device or functional unit that reported the
error1
channel UINT Channel number
multierror BOOL TRUE if more than one error is present
1 The laddr input contains the hardware identifier of the device or functional unit which returned the error. The hardware
identifier is assigned automatically when components are inserted in the device or network view and appears in the
Constants tab of PLC tags. A name is also assigned automatically for the hardware identifier. These entries in the
Constants tab of the PLC tags cannot be changed.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 79
PLC concepts
4.1 Execution of the user program

4.1.5 Monitoring the cycle time

The cycle time is the time that the CPU operating system requires to execute the cyclic
phase of the RUN mode. The CPU provides two methods of monitoring the cycle time:
● Maximum scan cycle time
● Fixed minimum scan cycle time
Scan cycle monitoring begins after the startup event is complete. Configuration for this
feature appears under the "Device Configuration" for the CPU under "Cycle time".
The CPU always monitors the scan cycle and reacts if the maximum scan cycle time is
exceeded. If the configured maximum scan cycle time is exceeded, an error is generated
and is handled one of two ways:
● If the user program does not include an OB 80, then the CPU generates an error and
goes to STOP. (You can change the configuration of the CPU to ignore this time error
and stay in RUN. The default configuration is for the CPU to go to STOP.)
● If the user program includes an OB 80, then the CPU executes OB 80
The RE_TRIGR instruction (Re-trigger cycle time monitoring) allows you to reset the timer
that measures the cycle time. However, this instruction only functions if executed in a
program cycle OB; the RE_TRIGR instruction is ignored if executed in OB 80. If the
maximum scan cycle time is exceeded twice within the same program cycle with no
RE_TRIGR instruction execution between the two, then the CPU transitions to STOP
immediately. The use of repeated executions of the RE_TRIGR instruction can create an
endless loop or a very long scan.
Typically, the scan cycle executes as fast as it can be executed and the next scan cycle
begins as soon as the current one completes. Depending upon the user program and
communication tasks, the time period for a scan cycle can vary from scan to scan. To
eliminate this variation, the CPU supports an optional fixed minimum scan cycle time (also
called fixed scan cycle). When this optional feature is enabled and a fixed minimum scan
cycle time is provided in ms, the CPU will maintain the minimum cycle time within ±1 ms for
the completion of each CPU scan.
In the event that the CPU completes the normal scan cycle in less time than the specified
minimum cycle time, the CPU spends the additional time of the scan cycle performing
runtime diagnostics and/or processing communication requests. In this way the CPU always
takes a fixed amount of time to complete a scan cycle.
In the event that the CPU does not complete the scan cycle in the specified minimum cycle
time, the CPU completes the scan normally (including communication processing) and does
not create any system reaction as a result of exceeding the minimum scan time. The
following table defines the ranges and defaults for the cycle time monitoring functions.

S7-1200 Programmable controller

80 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

Table 4- 5 Range for the cycle time

Cycle time Range (ms) Default

Maximum scan cycle time1 1 to 6000 150 ms
Fixed minimum scan cycle time2 1 to maximum scan cycle time Disabled
1 The maximum scan cycle time is always enabled. Configure a cycle time between 1 ms to 6000 ms. The default is 150
ms.
2 The fixed minimum scan cycle time is optional, and is disabled by default. If required, configure a cycle time between 1
ms and the maximum scan cycle time.

Configuring the cycle time and communication load

You use the CPU properties in the Device configuration to configure the following
parameters:
● Cycle time: You can enter a maximum scan cycle time. You can also enter a fixed
minimum scan cycle time.

● Communications load: You can configure a percentage of the time to be dedicated for
communication tasks.

For more information about the scan cycle, see "Monitoring the cycle time". (Page 80)

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 81
PLC concepts
4.1 Execution of the user program

4.1.6 CPU memory

Memory management
The CPU provides the following memory areas to store the user program, data, and
configuration:
● Load memory is non-volatile storage for the user program, data and configuration. When
a project is downloaded to the CPU, it is first stored in the Load memory area. This area
is located either in a memory card (if present) or in the CPU. This non-volatile memory
area is maintained through a power loss. The memory card supports a larger storage
space than that built-in to the CPU.
● Work memory is volatile storage for some elements of the user project while executing
the user program. The CPU copies some elements of the project from load memory into
work memory. This volatile area is lost when power is removed, and is restored by the
CPU when power is restored.
● Retentive memory is non-volatile storage for a limited quantity of work memory values.
The retentive memory area is used to store the values of selected user memory locations
during power loss. When a power down or power loss occurs, the CPU restores these
retentive values upon power up.
To display the memory usage for the current project, right-click the CPU (or one of its blocks)
and select "Resources" from the context. To display the memory usage for the current CPU,
double-click "Online and diagnostics", expand "Diagnostics", and select "Memory".

S7-1200 Programmable controller

82 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

Retentive memory
Data loss after power failure can be avoided by marking certain data as retentive. The
following data can be configured to be retentive:
● Bit memory(M): You can define the precise width of the memory for bit memory in the
PLC tag table or in the assignment list. Retentive bit memory always starts at MB0 and
runs consecutively up through a specified number of bytes. Specify this value from the
PLC tag table or in the assignment list by clicking the "Retain" toolbar icon. Enter the
number of M bytes to retain starting at MB0.
● Tags of a function block (FB): If an FB was created with "Optimzed" selected, then the
interface editor for this FB includes a "Retain" column. In this column, you can select
either "Retentive", "Non-retentive", or "Set in IDB" individually for each tag. An instance
DB that was created when this FB is placed in the program editor shows this retain
column as well. You can only change the retentive state of a tag from within the instance
DB interface editor if you selected "Set in IDB" (Set in instance data block) in the Retain
selection for the tag in the optimized FB.
If an FB was created with "Standard - compatible with S7-300/400" selected, then the
interface editor for this FB does not include a "Retain" column. An instance DB created
when this FB is inserted in the program editor shows a "Retain" column which is available
for edit. In this case, selecting the "Retain" option for any tag results in all tags being
selected. Similarly, deselecting the option for any tag results in all tags being deselected.
For an FB that was configured to be "Standard - compatible with S7-300/400", you can
change the retentive state from within the instance DB editor, but all tags are set to the
same retentive state together.
After you create the FB, you cannot change the option for "Standard - compatible with
S7-300/400". You can only select this option when you create the FB. To determine
whether an existing FB was configured for "Optimized" or "Standard - compatible with S7-
300/400", right-click the FB in the Project tree, select "Properties", and then select
"Attributes". The check box "Optimized block access" when selected shows you whether
a block is optimized. Otherwise, it is standard and compatible with S7-300/400 CPUs.
● Tags of a global data block: The behavior of a global DB with regard to retentive state
assignment is similar to that of an FB. Depending on the block access setting you can
define the retentive state either for individual tags or for all tags of a global data block.
– If you select "Optimized" when you create the DB, you can set the retentive state for
each individual tag.
– If you select "Standard - compatible with S7-300/400" when you create the DB, the
retentive-state setting applies to all tags of the DB; either all tags are retentive or no
tag is retentive.
A total of 10240 bytes of data can be retentive. To see how much is available, from the PLC
tag table or the assignment list, click on the "Retain" toolbar icon. Although this is where the
retentive range is specified for M memory, the second row indicates the total remaining
memory available for M and DB combined. Note that for this value to be accurate, you must
compile all data blocks with retentive tags.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 83
PLC concepts
4.1 Execution of the user program

4.1.6.1 System and clock memory

You use the CPU properties to enable bytes for "system memory" and "clock memory". Your
program logic can reference the individual bits of these functions by their tag names.
● You can assign one byte in M memory for system memory. The byte of system memory
provides the following four bits that can be referenced by your user program by the
following tag names:
– First cycle: (Tag name "FirstScan") bit is set to1 for the duration of the first scan after
the startup OB finishes. (After the execution of the first scan, the "first scan" bit is set
to 0.)
– Diagnostics status changed (Tag name: "DiagStatusUpdate") is set to 1 for one scan
after the CPU logs a diagnostic event. Because the CPU does not set the "diagnostic
graph changed" bit until the end of the first execution of the program cycle OBs, your
user program cannot detect if there has been a diagnostic change either during the
execution of the startup OBs or the first execution of the program cycle OBs.
– Always 1 (high): (Tag name "AlwaysTRUE") bit is always set to 1.
– Always 0 (low): (Tag name "AlwaysFALSE") bit is always set to 0.
● You can assign one byte in M memory for clock memory. Each bit of the byte configured
as clock memory generates a square wave pulse. The byte of clock memory provides 8
different frequencies, from 0.5 Hz (slow) to 10 Hz (fast). You can use these bits as control
bits, especially when combined with edge instructions, to trigger actions in the user
program on a cyclic basis.
The CPU initializes these bytes on the transition from STOP mode to STARTUP mode. The
bits of the clock memory change synchronously to the CPU clock throughout the STARTUP
and RUN modes.

CAUTION

Overwriting the system memory or clock memory bits can corrupt the data in these
functions and cause your user program to operate incorrectly, which can cause damage to
equipment and injury to personnel.
Because both the clock memory and system memory are unreserved in M memory,
instructions or communications can write to these locations and corrupt the data.
Avoid writing data to these locations to ensure the proper operation of these functions, and
always implement an emergency stop circuit for your process or machine.

S7-1200 Programmable controller

84 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.1 Execution of the user program

System memory configures a byte with bits that turn on (value = 1) for a specific event.

Table 4- 6 System memory

7 6 5 4 3 2 1 0
Reserved Always off Always on Diagnostic status First scan indicator
Value 0 Value 0 Value 1 indicator
 1: First scan after
 1: Change startup
 0: No change  0: Not first scan

Clock memory configures a byte that cycles the individual bits on and off at fixed intervals.
Each clock bit generates a square wave pulse on the corresponding M memory bit. These
bits can be used as control bits, especially when combined with edge instructions, to trigger
actions in the user code on a cyclic basis.

Table 4- 7 Clock memory

Bit number 7 6 5 4 3 2 1 0
Tag name
Period (s) 2.0 1.6 1.0 0.8 0.5 0.4 0.2 0.1
Frequency (Hz) 0.5 0.625 1 1.25 2 2.5 5 10

Because clock memory runs asynchronously to the CPU cycle, the status of the clock memory can change several times
during a long cycle.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 85
PLC concepts
4.1 Execution of the user program

4.1.7 Diagnostics buffer

The CPU supports a diagnostics buffer which contains an entry for each diagnostic event.
Each entry includes a date and time the event occurred, an event category, and an event
description. The entries are displayed in chronological order with the most recent event at
the top. Up to 50 most recent events are available in this log. When the log is full, a new
event replaces the oldest event in the log. When power is lost, the events are saved.
The following types of events are recorded in the diagnostics buffer:
● Each system diagnostic event; for example, CPU errors and module errors
● Each state change of the CPU (each power up, each transition to STOP, each transition
to RUN)
To access the diagnostics buffer (Page 680), you must be online. From the "Online &
diagnostics" view, locate the diagnostics buffer under "Diagnostics > Diagnostics buffer".

4.1.8 Time of day clock

The CPU supports a time-of-day clock. A super-capacitor supplies the energy required to
keep the clock running during times when the CPU is powered down. The super-capacitor
charges while the CPU has power. After the CPU has been powered up at least 24 hours,
then the super-capacitor has sufficient charge to keep the clock running for typically 20 days.
STEP 7 sets the time-of-day clock to system time, which has a default value out of the box or
following a factory rest. To utilize the time-of-day clock, you must set it. Timestamps such as
those for diagnostic buffer entries, data log files, and data log entries are based on the
system time. You set the time of day from the "Set time of day" function (Page 678) in the
"Online & diagnostics" view of the online CPU. STEP 7 then calculates the system time from
the time you set plus or minus the Windows operating system offset from UTC (Coordinated
Universal Time). Setting the time of day to the current local time produces a system time of
UTC if your Windows operating system settings for time zone and daylight savings time
correspond to your locale.
STEP 7 includes instructions (Page 249) to read and write the system time (RD_SYS_T and
WR_SYS_T), to read the local time (RD_LOC_T), and to set the time zone
(SET_TIMEZONE). The RD_LOC_T instruction calculates local time using the time zone and
daylight saving time offsets that you set in the "Time of day" configuration in the general
properties of the CPU (Page 123). These settings enable you to set your time zone for local
time, optionally enable daylight saving time, and specify the start and end dates and times
for daylight saving time. You can also use the SET_TIMEZONE instructions to configure
these settings.

S7-1200 Programmable controller

86 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.2 Data storage, memory areas, I/O and addressing

4.1.9 Configuring the outputs on a RUN-to-STOP transition

You can configure the behavior of the digital and analog outputs when the CPU is in STOP
mode. For any output of a CPU, SB or SM, you can set the outputs to either freeze the value
or use a substitute value:
● Substituting a specified output value (default): You enter a substitute value for each
output (channel) of that CPU, SB, or SM device.
The default substitute value for digital output channels is OFF, and the default substitute
value for analog output channels is 0.
● Freezing the outputs to remain in last state: The outputs retain their current value at the
time of the transition from RUN to STOP. After power up, the outputs are set to the
default substitute value.
You configure the behavior of the outputs in Device Configuration. Select the individual
devices and use the "Properties" tab to configure the outputs for each device.
When the CPU changes from RUN to STOP, the CPU retains the process image and writes
the appropriate values for both the digital and analog outputs, based upon the configuration.

4.2 Data storage, memory areas, I/O and addressing

4.2.1 Accessing the data of the S7-1200

STEP 7 facilitates symbolic programming. You create symbolic names or "tags" for the
addresses of the data, whether as PLC tags relating to memory addresses and I/O points or
as local variables used within a code block. To use these tags in your user program, simply
enter the tag name for the instruction parameter.
For a better understanding of how the CPU structures and addresses the memory areas, the
following paragraphs explain the "absolute" addressing that is referenced by the PLC tags.
The CPU provides several options for storing data during the execution of the user program:
● Global memory: The CPU provides a variety of specialized memory areas, including
inputs (I), outputs (Q) and bit memory (M). This memory is accessible by all code blocks
without restriction
● PLC tag table: You can enter symbolic names in the STEP 7 PLC tag table for specific
memory locations. These tags are global to the STEP 7 program and allow programming
with names that are meaningful for your application.
● Data block (DB): You can include DBs in your user program to store data for the code
blocks. The data stored persists when the execution of the associated code block comes
to an end. A "global" DB stores data that can be used by all code blocks, while an
instance DB stores data for a specific FB and is structured by the parameters for the FB.
● Temp memory: Whenever a code block is called, the operating system of the CPU
allocates the temporary, or local, memory (L) to be used during the execution of the
block. When the execution of the code block finishes, the CPU reallocates the local
memory for the execution of other code blocks.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 87
PLC concepts
4.2 Data storage, memory areas, I/O and addressing

Each different memory location has a unique address. Your user program uses these
addresses to access the information in the memory location. References to the input (I) or
output (Q) memory areas, such as I0.3 or Q1.7, access the process image. To immediately
access the physical input or output, append the reference with ":P" (such as I0.3:P, Q1.7:P,
or "Stop:P").

Table 4- 8 Memory areas

Memory area Description Force Retentive

I Copied from physical inputs at the beginning of the scan No No
Process image input cycle
I_:P 1 Immediate read of the physical input points on the CPU, Yes No
(Physical input) SB, and SM
Q Copied to physical outputs at the beginning of the scan No No
Process image output cycle
Q_:P 1 Immediate write to the physical output points on the Yes No
(Physical output) CPU, SB, and SM
M Control and data memory No Yes
Bit memory (optional)
L Temporary data for a block local to that block No No
Temp memory
DB Data memory and also parameter memory for FBs No Yes
Data block (optional)
1 To immediately access (read or write) the physical inputs and physical outputs, append a ":P" to the address or tag
(such as I0.3:P, Q1.7:P, or "Stop:P").

Each different memory location has a unique address. Your user program uses these
addresses to access the information in the memory location. The absolute address consists
of the following elements:
● Memory area identifier (such as I, Q, or M)
● Size of the data to be accessed ("B' for Byte, "W" for Word, or "D" for DWord)
● Starting address of the data (such as byte 3 or word 3)
When accessing a bit in the address for a Boolean value, you do not enter a mnemonic for
the size. You enter only the memory area, the byte location, and the bit location for the data
(such as I0.0, Q0.1, or M3.4).

S7-1200 Programmable controller

88 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.2 Data storage, memory areas, I/O and addressing

 0
࿆ ࿇ ࿈࿉



 ࿊


       
࿋
A Memory area identifier E Bytes of the memory area
B Byte address: byte 3 F Bits of the selected byte
C Separator ("byte.bit")
D Bit location of the byte (bit 4 of 8)

In the example, the memory area and byte address (M = bit memory area, and 3 = Byte 3)
are followed by a period (".") to separate the bit address (bit 4).

Accessing the data in the memory areas of the CPU

STEP 7 facilitates symbolic programming. Typically, tags are created either in PLC tags, a
data block, or in the interface at the top of an OB, FC, or FB. These tags include a name,
data type, offset, and comment. Additionally, in a data block, a start value can be specified.
You can use these tags when programming by entering the tag name at the instruction
parameter. Optionally you can enter the absolute operand (memory area, size and offset) at
the instruction parameter. The examples in the following sections show how to enter
absolute operands. The % character is inserted automatically in front of the absolute
operand by the program editor. You can toggle the view in the program editor to one of
these: symbolic, symbolic and absolute, or absolute.
I (process image input): The CPU samples the peripheral (physical) input points just prior to
the cyclic OB execution of each scan cycle and writes these values to the input process
image. You can access the input process image as bits, bytes, words, or double words. Both
read and write access is permitted, but typically, process image inputs are only read.

Table 4- 9 Absolute addressing for I memory

Bit I[byte address].[bit address] I0.1

Byte, Word, or Double Word I[size][starting byte address] IB4, IW5, or ID12

By appending a ":P" to the address, you can immediately read the digital and analog inputs
of the CPU, SB or SM. The difference between an access using I_:P instead of I is that the
data comes directly from the points being accessed rather than from the input process
image. This I_:P access is referred to as an "immediate read" access because the data is
retrieved immediately from the source instead of from a copy that was made the last time the
input process image was updated.
Because the physical input points receive their values directly from the field devices
connected to these points, writing to these points is prohibited. That is, I_:P accesses are
read-only, as opposed to I accesses which can be read or write.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 89
PLC concepts
4.2 Data storage, memory areas, I/O and addressing

I_:P accesses are also restricted to the size of inputs supported by a single CPU, SB, or SM,
rounded up to the nearest byte. For example, if the inputs of a 2 DI / 2 DQ SB are configured
to start at I4.0, then the input points can be accessed as I4.0:P and I4.1:P or as IB4:P.
Accesses to I4.2:P through I4.7:P are not rejected, but make no sense since these points are
not used. Accesses to IW4:P and ID4:P are prohibited since they exceed the byte offset
associated with the SB.
Accesses using I_:P do not affect the corresponding value stored in the input process image.

Table 4- 10 Absolute addressing for I memory (immediate)

Bit I[byte address].[bit address]:P I0.1:P

Byte, Word, or Double word I[size][starting byte address]:P IB4:P, IW5:P, or ID12:P

Q (process image output): The CPU copies the values stored in the output process image to
the physical output points. You can access the output process image in bits, bytes, words, or
double words. Both read and write access is permitted for process image outputs.

Table 4- 11 Absolute addressing for Q memory

Bit Q[byte address].[bit address] Q1.1

Byte, Word, or Double word Q[size][starting byte address] QB5, QW10, QD40

By appending a ":P" to the address, you can immediately write to the physical digital and
analog outputs of the CPU, SB or SM. The difference between an access using Q_:P instead
of Q is that the data goes directly to the points being accessed in addition to the output
process image (writes to both places). This Q_:P access is sometimes referred to as an
"immediate write" access because the data is sent immediately to the target point; the target
point does not have to wait for the next update from the output process image.
Because the physical output points directly control field devices that are connected to these
points, reading from these points is prohibited. That is, Q_:P accesses are write-only, as
opposed to Q accesses which can be read or write.
Q_:P accesses are also restricted to the size of outputs supported by a single CPU, SB, or
SM, rounded up to the nearest byte. For example, if the outputs of a 2 DI / 2 DQ SB are
configured to start at Q4.0, then the output points can be accessed as Q4.0:P and Q4.1:P or
as QB4:P. Accesses to Q4.2:P through Q4.7:P are not rejected, but make no sense since
these points are not used. Accesses to QW4:P and QD4:P are prohibited since they exceed
the byte offset associated with the SB.
Accesses using Q_:P affect both the physical output as well as the corresponding value
stored in the output process image.

Table 4- 12 Absolute addressing for Q memory (immediate)

Bit Q[byte address].[bit address]:P Q1.1:P

Byte, Word, or Double word Q[size][starting byte address]:P QB5:P, QW10:P or QD40:P

M (bit memory area): Use the bit memory area (M memory) for both control relays and data
to store the intermediate status of an operation or other control information. You can access
the bit memory area in bits, bytes, words, or double words. Both read and write access is
permitted for M memory.

S7-1200 Programmable controller

90 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.2 Data storage, memory areas, I/O and addressing

Table 4- 13 Absolute addressing for M memory

Bit M[byte address].[bit address] M26.7

Byte, Word, or Double Word M[size][starting byte address] MB20, MW30, MD50

Temp (temporary memory): The CPU allocates the temp memory on an as-needed basis.
The CPU allocates the temp memory for the code block at the time when the code block is
started (for an OB) or is called (for an FC or FB). The allocation of temp memory for a code
block might reuse the same temp memory locations previously used by a different OB, FC or
FB. The CPU does not initialize the temp memory at the time of allocation and therefore the
temp memory might contain any value.
Temp memory is similar to M memory with one major exception: M memory has a "global"
scope, and temp memory has a "local" scope:
● M memory: Any OB, FC, or FB can access the data in M memory, meaning that the data
is available globally for all of the elements of the user program.
● Temp memory: Access to the data in temp memory is restricted to the OB, FC, or FB that
created or declared the temp memory location. Temp memory locations remain local and
are not shared by different code blocks, even when the code block calls another code
block. For example: When an OB calls an FC, the FC cannot access the temp memory of
the OB that called it.
The CPU provides temp (local) memory for each of the three OB priority groups:
● 16 Kbytes for startup and program cycle, including associated FBs and FCs
● 4 Kbytes for standard interrupt events including FBs and FCs
● 4 Kbytes for error interrupt events including FBs and FCs
You access temp memory by symbolic addressing only.
DB (data block): Use the DB memory for storing various types of data, including intermediate
status of an operation or other control information parameters for FBs, and data structures
required for many instructions such as timers and counters. You can access data block
memory in bits, bytes, words, or double words. Both read and write access is permitted for
read/write data blocks. Only read access is permitted for read-only data blocks.

Table 4- 14 Absolute addressing for DB memory

Bit DB[data block number].DBX[byte DB1.DBX2.3

address].[bit address]
Byte, Word, or Double DB[data block number].DB [size][starting DB1.DBB4, DB10.DBW2,
Word byte address] DB20.DBD8

Note
When you specify an absolute address, STEP 7 precedes this address with a "%" character
to indicate that it is an absolute address. While programming, you can enter an absolute
address either with or without the "%" character (for example %I0.0 or I.0). If omitted,
STEP 7 supplies the "%" character.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 91
PLC concepts
4.3 Processing of analog values

Configuring the I/O in the CPU and I/O modules

When you add a CPU and I/O modules to your

configuration screen, I and Q addresses are
automatically assigned. You can change the
default addressing by selecting the address field in
the configuration screen and typing new numbers.
 Digital inputs and outputs are assigned in
groups of 8 points (1 byte), whether the module
uses all the points or not.
 Analog inputs and outputs are assigned in
groups of 2 points (4 bytes).

The figure shows an example of a CPU 1214C with two SMs and one SB. In this example,
you could change the address of the DI8 module to 2 instead of 8. The tool will assist you by
changing address ranges that are the wrong size or conflict with other addresses.

4.3 Processing of analog values

Analog signal modules provide input signals or expect output values that represent either a
voltage range or a current range. These ranges are ±10V, ±5V, ±2.5V, or 0 - 20mA. The
values returned by the modules are integer values where 0 to 27648 represents the rated
range for current, and -27648 to 27648 for voltage. Anything outside the range represents
either an overflow or underflow. See the tables for analog input representation (Page 770)
and analog output representation (Page 771) for details.
In your control program, you probably need to use these values in engineering units, for
example to represent a volume, temperature, weight or other quantitative value. To do this
for an analog input, you must first normalize the analog value to a real (floating point) value
from 0.0 to 1.0. Then you must scale it to the minimum and maximum values of the
engineering units that it represents. For values that are in engineering units that you need to
convert to an analog output value, you first normalize the value in engineering units to a
value between 0.0 and 1.0, and then scale it between 0 and 27648 or -27648 to 27648,
depending on the range of the analog module. STEP 7 provides the NORM_X and SCALE_X
instructions (Page 219) for this purpose. You can also use the CALCULATE instruction
(Page 198) to scale the analog values (Page 33).

S7-1200 Programmable controller

92 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.4 Data types

4.4 Data types

Data types are used to specify both the size of a data element as well as how the data are to
be interpreted. Each instruction parameter supports at least one data type, and some
parameters support multiple data types. Hold the cursor over the parameter field of an
instruction to see which data types are supported for a given parameter.
A formal parameter is the identifier on an instruction that marks the location of data to be
used by that instruction (example: the IN1 input of an ADD instruction). An actual parameter
is the memory location (preceded by a "%" character) or constant containing the data to be
used by the instruction (example %MD400 "Number_of_Widgets"). The data type of the
actual parameter specified by you must match one of the supported data types of the formal
parameter specified by the instruction.
When specifying an actual parameter, you must specify either a tag (symbol) or an absolute
(direct) memory address. Tags associate a symbolic name (tag name) with a data type,
memory area, memory offset, and comment, and can be created either in the PLC tags
editor or in the Interface editor for a block (OB, FC, FB and DB). If you enter an absolute
address that has no associated tag, you must use an appropriate size that matches a
supported data type, and a default tag will be created upon entry.
All data types except String are available in the PLC tags editor and the block Interface
editors. String is available only in the block Interface editors. You can also enter a constant
value for many of the input parameters.
● Bit and Bit sequences (Page 94): Bool (Boolean or bit value), Byte (8-bit byte value),
Word (16-bit value), DWord (32-bit double-word value)
● Integer (Page 95)
– USInt (unsigned 8-bit integer), SInt (signed 8-bit integer),
– UInt (unsigned 16-bit integer), Int (signed 16-bit integer)
– UDInt (unsigned 32-bit integer), DInt (signed 32-bit integer)
● Floating-point Real (Page 95): Real (32-bit Real or floating-point value), LReal (64-bit
Real or floating-point value)
● Time and Date (Page 96): Time (32-bit IEC time value), Date (16-bit date value), TOD
(32-bit time-off-day value), DT (64-bit date-and-time value)
● Character and String (Page 97): Char (8-bit single character), String (variable-length
string of up to 254 characters)
● Array (Page 99)
● Data structure (Page 100): Struct
● PLC Data type (Page 100)
● Pointers (Page 101): Pointer, Any, Variant
Although not available as data types, the following BCD numeric format is supported by the
conversion instructions.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 93
PLC concepts
4.4 Data types

Table 4- 15 Size and range of the BCD format

Format Size (bits) Numeric Range Constant Entry Examples

BCD16 16 -999 to 999 123, -123
BCD32 32 -9999999 to 9999999 1234567, -1234567

4.4.1 Bool, Byte, Word, and DWord data types

Table 4- 16 Bit and bit sequence data types

Data Bit Number Number Constant Address

type size type range examples examples
Bool 1 Boolean FALSE or TRUE TRUE, 1, I1.0
Binary 0 or 1 0, 2#0 Q0.1
M50.7
Octal 8#0 or 8#1 8#1 DB1.DBX2.3
Hexadecimal 16#0 or 16#1 16#1 Tag_name
Byte 8 Binary 2#0 to 2#11111111 2#00001111 IB2
Unsigned integer 0 to 255 15 MB10
DB1.DBB4
Octal 8#0 to 8#377 8#17 Tag_name
Hexadecimal B#16#0 to B#16#FF B#16#F, 16#F
Word 16 Binary 2#0 to 2#1111111111111111 2#1111000011110000 MW10
Unsigned integer 0 to 65535 61680 DB1.DBW2
Tag_name
Octal 8#0 to 8#177777 8#170360
Hexadecimal W#16#0 to W#16#FFFF, W#16#F0F0, 16#F0F0
16#0 to 16#FFFF
DWord 32 Binary 2#0 to 2#111100001111111100 MD10
2#111111111111111111111111 001111 DB1.DBD8
11111111 Tag_name
Unsigned integer 0 to 4294967295 15793935
Octal 8#0 to 8#37777777777 8#74177417
Hexadecimal DW#16#0000_0000 to DW#16#F0FF0F,
DW#16#FFFF_FFFF, 16#F0FF0F
16#0000_0000 to
16#FFFF_FFFF

S7-1200 Programmable controller

94 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.4 Data types

4.4.2 Integer data types

Table 4- 17 Integer data types (U = unsigned, S = short, D= double)

Data type Bit size Number Range Constant examples Address

examples
USInt 8 0 to 255 78, 2#01001110 MB0, DB1.DBB4,
SInt 8 -128 to 127 +50, 16#50 Tag_name
UInt 16 0 to 65,535 65295, 0 MW2, DB1.DBW2,
Int 16 -32,768 to 32,767 30000, +30000 Tag_name

UDInt 32 0 to 4,294,967,295 4042322160 MD6, DB1.DBD8,

DInt 32 -2,147,483,648 to -2131754992 Tag_name
2,147,483,647

4.4.3 Floating-point real data types

Real (or floating-point) numbers are represented as 32-bit single-precision numbers (Real),
or 64-bit double-precision numbers (LReal) as described in the ANSI/IEEE 754-1985
standard. Single-precision floating-point numbers are accurate up to 6 significant digits and
double-precision floating point numbers are accurate up to 15 significant digits. You can
specify a maximum of 6 significant digits (Real) or 15 (LReal) when entering a floating-point
constant to maintain precision.

Table 4- 18 Floating-point real data types (L=Long)

Data type Bit size Number range Constant Examples Address examples
Real 32 -3.402823e+38 to -1.175 495e-38, 123.456, -3.4, 1.0e-5 MD100, DB1.DBD8,
±0, Tag_name
+1.175 495e-38 to +3.402823e+38
LReal 64 -1.7976931348623158e+308 to 12345.123456789e40, DB_name.var_name
-2.2250738585072014e-308, 1.2E+40 Rules:
±0,
+2.2250738585072014e-308 to  No direct addressing
+1.7976931348623158e+308 support
 Can be assigned in an
OB, FB, or FC block
interface table

Calculations that involve a long series of values including very large and very small numbers
can produce inaccurate results. This can occur if the numbers differ by 10 to the power of x,
where x > 6 (Real), or 15 (LReal). For example (Real): 100 000 000 + 1 = 100 000 000.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 95
PLC concepts
4.4 Data types

4.4.4 Time and Date data types

Table 4- 19 Time and date data types

Data type Size Range Constant Entry Examples

Time 32 bits T#-24d_20h_31m_23s_648ms to T#5m_30s
T#24d_20h_31m_23s_647ms T#1d_2h_15m_30s_45ms
Stored as: -2,147,483,648 ms to +2,147,483,647 TIME#10d20h30m20s630ms
ms 500h10000ms
10d20h30m20s630ms
Date 16 bits D#1990-1-1 to D#2168-12-31 D#2009-12-31
DATE#2009-12-31
2009-12-31
Time_of_Day 32 bits TOD#0:0:0.0 to TOD#23:59:59.999 TOD#10:20:30.400
TIME_OF_DAY#10:20:30.400
23:10:1
DTL 12 bytes Min.: DTL#1970-01-01-00:00:00.0 DTL#2008-12-16-20:30:20.250
(Date and Time Max.: DTL#2554-12-31-23:59:59.999 999 999
Long)

Time
TIME data is stored as a signed double integer interpreted as milliseconds. The editor format
can use information for day (d), hours (h), minutes (m), seconds (s) and milliseconds (ms).
It is not necessary to specify all units of time. For example T#5h10s and 500h are valid.
The combined value of all specified unit values cannot exceed the upper or lower limits in
milliseconds for the Time data type (-2,147,483,648 ms to +2,147,483,647 ms).

Date
DATE data is stored as an unsigned integer value which is interpreted as the number of days
added to the base date 01/01/1990, to obtain the specified date. The editor format must
specify a year, month and day.

TOD
TOD (TIME_OF_DAY) data is stored as an unsigned double integer which is interpreted as
the number of milliseconds since midnight for the specified time of day (Midnight = 0 ms).
The hour (24hr/day), minute, and second must be specified. The fractional second
specification is optional.

S7-1200 Programmable controller

96 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.4 Data types

DTL
DTL (Date and Time Long) data type uses a12 byte structure that saves information on date
and time. You can define DTL data in either the Temp memory of a block or in a DB. A value
for all components must be entered in the "Start value" column of the DB editor.

Table 4- 20 Size and range for DTL

Length Format Value range Example of value input

(bytes)
12 Clock and calendar Min.: DTL#1970-01-01-00:00:00.0 DTL#2008-12-16-20:30:20.250
Year-Month-Day:Hour:Minute: Max.: DTL#2554-12-31-23:59:59.999
Second.Nanoseconds 999 999

Each component of the DTL contains a different data type and range of values. The data
type of a specified value must match the data type of the corresponding components.

Table 4- 21 Elements of the DTL structure

Byte Component Data type Value range

0 Year UINT 1970 to 2554
1
2 Month USINT 1 to 12
3 Day USINT 1 to 31
4 Weekday 1 USINT 1(Sunday) to 7(Saturday) 1
5 Hour USINT 0 to 23
6 Minute USINT 0 to 59
7 Second USINT 0 to 59
8 Nanoseconds UDINT 0 to 999 999 999
9
10
11
1 The weekday is not considered in the value entry.

4.4.5 Character and String data types

Table 4- 22 Character and String data types

Data type Size Range Constant Entry Examples

Char 8 bits ASCII character codes: 16#00 to 16#FF 'A', 't', '@'
String n+ 2 bytes n = (0 to 254 character bytes) 'ABC'

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 97
PLC concepts
4.4 Data types

Char
Char data occupies one byte in memory and stores a single character coded in ASCII
format. The editor syntax uses a single quote character before and after the ASCII character.
Visible characters and control characters can be used. A table of valid control characters is
shown in the description of the String data type.

String
The CPU supports the String data type for storing a sequence of single-byte characters. The
String data type contains a total character count (number of characters in the string) and the
current character count. The String type provides up to 256 bytes for storing the maximum
total character count (1 byte), the current character count (1 byte), and up to 254 characters,
with each character stored in 1 byte.
You can use literal strings (constants) for instruction parameters of type IN using single
quotes. For example, ‘ABC’ is a three-character string that could be used as input for
parameter IN of the S_CONV instruction. You can also create string variables by selecting
data type "String" in the block interface editors for OB, FC, FB, and DB. You cannot create a
string in the PLC tags editor.
You can specify the maximum string size in bytes by entering square brackets after the
keyword "String" (once the data type "String" is selected from a data type drop-list). For
example, "MyString String[10]" would specify a 10-byte maximum size for MyString. If you do
not include the square brackets with a maximum size, then 254 is assumed.
The following example defines a String with maximum character count of 10 and current
character count of 3. This means the String currently contains 3 one-byte characters, but
could be expanded to contain up to 10 one-byte characters.

Table 4- 23 Example of a String data type

Total Character Current Character Character 1 Character 2 Character 3 ... Character 10

Count Count
10 3 'C' (16#43) 'A' (16#41) 'T' (16#54) ... -
Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 ... Byte 11

ASCII control characters can be used in Char and String data. The following table shows
examples of control character syntax.

Table 4- 24 Valid ASCII control characters

Control characters ASCII Hex value Control function Examples

$L or $l 0A Line feed '$LText', '$0AText'
$N or $n 0A and 0D Line break '$NText', '$0A$0DText'
The new line shows two characters in the
string.
$P or $p 0C Form feed '$PText', '$0CText'
$R or $r 0D Carriage return (CR) '$RText','$0DText'
$T or $t 09 Tab '$TText', '$09Text'

S7-1200 Programmable controller

98 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.4 Data types

Control characters ASCII Hex value Control function Examples

$$ 24 Dollar sign '100$$', '100$24'
$' 27 Single quote '$'Text$'','$27Text$27'

4.4.6 Array data type

Arrays
You can create an array that contains multiple elements of the same data type. Arrays can
be created in the block interface editors for OB, FC, FB, and DB. You cannot create an array
in the PLC tags editor.
To create an array from the block interface editor, name the array and choose data type
"Array [lo .. hi] of type", then edit "lo", "hi", and "type" as follows:
● lo - the starting (lowest) index for your array
● hi - the ending (highest) index for your array
● type - one of the data types, such as BOOL, SINT, UDINT

Table 4- 25 ARRAY data type rules

Data Type Array syntax

ARRAY Name [index1_min..index1_max, index2_min..index2_max] of <data type>
 All array elements must be the same data type.
 The index can be negative, but the lower limit must be less than or equal to the upper limit.
 Arrays can have one to six dimensions.
 Multi-dimensional index min..max declarations are separated by comma characters.
 Nested arrays, or arrays of arrays, are not allowed.
 The memory size of an array = (size of one element * total number of elements in array)

Array index Valid index data types Array index rules

Constant or USInt, SInt, UInt, Int, UDInt,  Value limits: -32768 to +32767
variable DInt
 Valid: Mixed constants and variables
 Valid: Constant expressions
 Not valid: Variable expressions

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 99
PLC concepts
4.4 Data types

Example: array ARRAY[1..20] of REAL One dimension, 20 elements

declarations ARRAY[-5..5] of INT One dimension, 11 elements
ARRAY[1..2, 3..4] of CHAR Two dimensions, 4 elements
Example: array ARRAY1[0] ARRAY1 element 0
addresses ARRAY2[1,2] ARRAY2 element [1,2]
ARRAY3[i,j] If i =3 and j=4, then ARRAY3 element
[3, 4] is addressed

4.4.7 Data structure data type

You can use the data type "Struct" to define a structure of data consisting of other data
types. The struct data type can be used to handle a group of related process data as a single
data unit. A Struct data type is named and the internal data structure declared in the data
block editor or a block interface editor.
Arrays and structures can also be assembled into a larger structure. A structure can be
nested up to eight levels deep. For example, you can create a structure of structures that
contain arrays.
A Struct variable begins at an even-byte address and uses the memory to the next word
boundary.

4.4.8 PLC data type

The PLC data type editor lets you define data structures that you can use multiple times in
your program. You create a PLC data type by opening the "PLC data types" branch of the
project tree and double-clicking the "Add new data type" item. On the newly created PLC
data type item, use two single-clicks to rename the default name and double-click to open
the PLC data type editor.
You create a custom PLC data type structure using the same editing methods that are used
in the data block editor. Add new rows for any data types that are necessary to create the
data structure that you want.
If a new PLC data type is created, then the new PLC type name will appear in the data type
selector drop drop-lists in the DB editor and code block interface editor.
Potential uses of PLC data types:
● PLC data types can be used directly as a data type in a code block interface or in data
blocks.
● PLC data types can be used as a template for the creation of multiple global data blocks
that use the same data structure.
For example, a PLC data type could be a recipe for mixing colors. You can then assign this
PLC data type to multiple data blocks. Each data block can then have the variables adjusted
to create a specific color.

S7-1200 Programmable controller

100 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.4 Data types

4.4.9 Pointer data types

The pointer data types (Pointer, Any, and Variant) can be used in the block interface tables
for FB and FC code blocks. You can select a pointer data type from the block interface data
type drop-lists.
The Variant data type is also used for instruction parameters.

4.4.9.1 "Pointer" pointer data type

The data type Pointer points to a particular variable. It occupies 6 bytes (48 bits) in memory
and can include the following information:
● DB number or 0 if the data is not stored in a DB
● Storage area in the CPU
● Variable address
3RLQWHUIRUPDW

%LW %LW
   
%\WH '%QXPEHU RU %\WH

%\WH 0HPRU\DUHD      E E E %\WH

%\WH E E E E E E E E E E E E E [ [ [ %\WH

E E\WHDGGUHVV [ ELWDGGUHVV

Depending on the instruction, you can declare the following three types of pointers:
● Area-internal pointer: contains data on the address of a variable
● Area-crossing pointer: contains data on the memory area and the address of a variable
● DB-pointer: contains a data block number and the address of a variable

Table 4- 26 Pointer types:

Type Format Example entry

Area-internal pointer P#Byte.Bit P#20.0
Area-crossing pointer P#Memory_area_Byte.Bit P#M20.0
DB-pointer P#Data_block.Data_element P#DB10.DBX20.0

You can enter a parameter of type Pointer without the prefix (P #). Your entry will be
automatically converted to the pointer format.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 101
PLC concepts
4.4 Data types

Table 4- 27 Memory area encoding in the Pointer data:

Hexadecimal code Data type Description

b#16#81 I Input memory area
b#16#82 Q Output memory area
b#16#83 M Marker memory area
b#16#84 DBX Data block
b#16#85 DIX Instance data block
b#16#86 L Local data
b#16#87 V Previous local data

4.4.9.2 "Any" pointer data type

The pointer data type ANY ("Any") points to the beginning of a data area and specifies its
length. The ANY pointer uses 10 bytes in memory and can include the following information:
● Data type: Data type of the data elements
● Repeat factor: Number of data elements
● DB Number: Data block in which data elements are stored
● Storage area: Memory area of the CPU, in which the data elements are stored
● Start address: "Byte.Bit" starting address of the data
The following image shows the structure of the ANY pointer:

%LW %LW
   

%\WH %\WH
KIRU6 'DWDW\SH
%\WH %\WH
5HSHDWIDFWRU
%\WH '%1XPEHU RU %\WH

%\WH 0HPRU\DUHD      E E E %\WH

%\WH E E E E E E E E E E E E E [ [ [ %\WH

E %\WHDGUHVV [ %LWDGUHVV

A pointer can not detect ANY structures. It can only be assigned to local variables.

Table 4- 28 Format and examples of the ANY pointer:

Format Entry example Description

P#Data_block.Memory_area P#DB 11.DBX 20.0 INT 10 10 words in global DB 11
Data_address Type Number starting from DBB 20.0
P#Memory_area Data_address P#M 20.0 BYTE 10 10 bytes starting from MB 20.0
Type Number P#I 1.0 BOOL 1 Input I1.0

S7-1200 Programmable controller

102 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.4 Data types

Table 4- 29 Data type encoding in the ANY pointer

Hexadecimal code Data type Description

b#16#00 Null Null pointer
b#16#01 Bool Bits
b#16#02 Byte Bytes, 8 Bits
b#16#03 Char 8-bit character
b#16#04 Word 16-bit-word
b#16#05 Int 16-bit-integer
b#16#37 SInt 8-bit-integer
b#16#35 UInt 16-bit unsigned integer
b#16#34 USInt 8-bit unsigned integer
b#16#06 DWord 32-bit double word
b#16#07 DInt 32-bit double integer
b#16#36 UDInt 32-bit-unsigned double integer
b#16#08 Real 32-Bit floating point
b#16#0B Time Time
b#16#13 String Character string

Table 4- 30 Memory area encoding in the ANY pointer:

Hexadecimal code Memory area Description

b#16#81 I Input memory area
b#16#82 Q Output memory area
b#16#83 M Marker memory area
b#16#84 DBX Data block
b#16#85 DIX Instance data block
b#16#86 L Local data
b#16#87 V Previous local data

4.4.9.3 "Variant" pointer data type

The data type Variant is can point to variables of different data types or parameters. The
Variant pointer can point to structures and individual structural components. The Variant
pointer does not occupy any space in memory.

Table 4- 31 Properties of the Variant pointer

Length Representation Format Example entry

(Byte)
0 Symbolic Operand MyTag
DB_name.Struct_name.element_name MyDB.Struct1.pressure1
Absolute Operand %MW10
DB_number.Operand Type Length P#DB10.DBX10.0 INT 12

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 103
PLC concepts
4.4 Data types

4.4.10 Accessing a "slice" of a tagged data type

PLC tags and data block tags can be accessed at the bit, byte, or word level depending on
their size. The syntax for accessing such a data slice is as follows:
● "<PLC tag name>".xn (bit access)
● "<PLC tag name>".bn (byte access)
● "<PLC tag name>".wn (word access)
● "<Data block name>".<tag name>.xn (bit access)
● "<Data block name>".<tag name>.bn (byte access)
● "<Data block name>".<tag name>.wn (word access)
A double word-sized tag can be accessed by bits 0 - 31, bytes 0 - 3, or word 0 - 1. A word-
sized tag can be accessed by bits 0 - 15, bytes 0 - 2, or word 0. A byte-sized tag can be
accessed by bits 0 - 8, or byte 0. Bit, byte, and word slices can be used anywhere that bits,
bytes, or words are expected operands.

Note
Valid data types that can be accessed by slice are Byte, Char, Conn_Any, Date, DInt,
DWord, Event_Any, Event_Att, Hw_Any, Hw_Device, HW_Interface, Hw_Io, Hw_Pwm,
Hw_SubModule, Int, OB_Any, OB_Att, OB_Cyclic, OB_Delay, OB_WHINT, OB_PCYCLE,
OB_STARTUP, OB_TIMEERROR, OB_Tod, Port, Rtm, SInt, Time, Time_Of_Day, UDInt,
UInt, USInt, and Word. PLC Tags of type Real can be accessed by slice, but data block tags
of type Real cannot.

S7-1200 Programmable controller

104 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.4 Data types

Examples
In the PLC tag table, "DW" is a declared tag of type DWORD. The examples show bit, byte,
and word slice access:

LAD FBD SCL

Bit access IF "DW".x11 THEN
...
END_IF;

Byte access IF "DW".b2 = "DW".b3

THEN
...
END_IF;

Word access out:= "DW".w0 AND

"DW".w1;

See also
SCL (Page 156)

4.4.11 Accessing a tag with an AT overlay

The AT tag overlay allows you to access an already-declared tag of a standard access block
with an overlaid declaration of a different data type. You can, for example, address the
individual bits of a tag of a Byte, Word, or DWord data type with an Array of Bool.

Declaration
To overlay a parameter, declare an additional parameter directly after the parameter that is
to be overlaid and select the data type "AT". The editor creates the overlay, and you can
then choose the data type, struct, or array that you wish to use for the overlay.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 105
PLC concepts
4.4 Data types

Example
This example shows the input parameters of a standard-access FB. The byte tag B1 is
overlaid with an array of Booleans:

Table 4- 32 Overlay of a byte with a Boolean array

7 6 5 4 3 2 1 0
AT[0] AT[1] AT[2] AT[3] AT[4] AT[5] AT[6] AT[7]

Another example is a DWord tag overlaid with a Struct:

The overlay types can be addressed directly in the program logic:

LAD FBD SCL

IF #AT[1] THEN
...
END_IF;

IF (#DW1_Struct.S1 =
W#16#000C) THEN
...
END_IF;

out1 := #DW1_Struct.S2;

Rules
● Overlaying of tags is only possible in FB and FC blocks with standard access.
● You can overlay parameters for all block types and all declaration sections.

S7-1200 Programmable controller

106 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.5 Using a memory card

● An overlaid parameter can be used like any other block parameter.

● You cannot overlay parameters of type VARIANT.
● The size of the overlaying parameter must be less than or equal to the size of the overlaid
parameter.
● The overlaying variable must be declared immediately after the variable that it overlays
and identified with the keyword "AT".

See also
SCL (Page 156)

4.5 Using a memory card

NOTICE

The CPU supports only the pre-formatted SIMATIC memory card (Page 826).
Before you copy any program to the formatted memory card, delete any previously saved
program from the memory card.

Use the memory card either as a transfer card or as a program card. Any program that you
copy to the memory card contains all of the code blocks and data blocks, any technology
objects, and the device configuration. A copied program does not contain force values.
● Use a transfer card (Page 110) to copy a program to the internal load memory of the CPU
without using STEP 7. After you insert the transfer card, the CPU first erases the user
program and any force values from the internal load memory, and then copies the
program from the transfer card to the internal load memory. When the transfer process is
complete, you must remove the transfer card.
You can use an empty transfer card to access a password-protected CPU when the
password has been lost or forgotten (Page 118). Inserting the empty transfer card deletes
the password-protected program in the internal load memory of the CPU. You can then
download a new program to the CPU.
● Use a program card (Page 112) as external load memory for the CPU. Inserting a
program card in the CPU erases all of the CPU internal load memory (the user program
and any force values). The CPU then executes the program in external load memory (the
program card). Downloading to a CPU that has a program card updates only the external
load memory (the program card).
Because the internal load memory of the CPU was erased when you inserted the
program card, the program card must remain in the CPU. If you remove the program
card, the CPU goes to STOP mode. (The error LED flashes to indicate that program card
has been removed.)

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 107
PLC concepts
4.5 Using a memory card

The copied program on a memory card includes the code blocks, the data blocks, the
technology objects, and the device configuration. The memory card does not contain any
force values. The force values are not part of the program, but are stored in the load
memory, whether the internal load memory of the CPU, or the external load memory (a
program card). If a program card is inserted in the CPU, STEP 7 then applies the force
values only to the external load memory on the program card.
You also use a memory card when downloading firmware updates (Page 115).

4.5.1 Inserting a memory card in the CPU

CAUTION

Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap when
you handle the memory card. Store the memory card in a conductive container.

Check that the memory card is not write-protected. Slide the protection
switch away from the "Lock" position.

CAUTION

If you insert a memory card (whether configured as a program or transfer card) into a
running CPU, the CPU goes immediately to STOP mode, which might result in damage to
the equipment or to the process being controlled. Before inserting or removing a memory
card, always ensure that the CPU is not actively controlling a machine or process. Always
install an emergency stop circuit for your application or process.

Note
If you insert a memory card with the CPU in STOP mode, the diagnostic buffer displays a
message that the memory card evaluation has been initiated. The CPU will evaluate the
memory card the next time you either change the CPU to RUN mode, reset the CPU
memory with an MRES, or power-cycle the CPU.

S7-1200 Programmable controller

108 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.5 Using a memory card

To insert a memory card, open the top

CPU door and insert the memory card in
the slot. A push-push type connector
allows for easy insertion and removal.
The memory card is keyed for proper
installation.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 109
PLC concepts
4.5 Using a memory card

4.5.2 Configuring the startup parameter of the CPU before copying the project to the
memory card
When you copy a program to a transfer card or a program card, the program includes the
startup parameter for the CPU. Before copying the program to the memory card, always
ensure that you have configured the operating mode for the CPU following a power-cycle.
Select whether the CPU starts in STOP mode, RUN mode, or in the previous mode (prior to
the power cycle).

4.5.3 Transfer card

CAUTION

Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap
whenever you handle the memory card. Store the memory card in a conductive container.

Creating a transfer card

Always remember to configure the startup parameter of the CPU (Page 110) before copying
a program to the transfer card. To create a transfer card, follow these steps:
1. Insert a blank SIMATIC memory card into an SD card reader/writer attached to your
computer.
If you are reusing a SIMATIC memory card that contains a user program or a firmware
update, you must delete the program files before reusing the card. Use Windows Explorer
to display the contents of the memory card and delete the "S7_JOB.S7S" file and also
delete any existing "Data Logs" folders and directory folder (such as "SIMATIC.S7S" or
"FWUPDATE.S7S").
2. In the Project tree (Project view), expand the "SIMATIC Card Reader" folder and select
your card reader.
3. Display the "Memory card" dialog by right-clicking the drive letter corresponding to the
memory card in the card reader and selecting "Properties" from the context menu.

S7-1200 Programmable controller

110 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.5 Using a memory card

4. In the "Memory card" dialog, select "Transfer" from the "Card type" drop-down menu.
At this point, STEP 7 creates the empty transfer card. If you are creating an empty
transfer card, such as to recover from a lost CPU password (Page 118), remove the
transfer card from the card reader.

5. Add the program by selecting the CPU device (such as PLC_1 [CPU 1214 DC/DC/DC]) in
the Project tree and dragging the CPU device to the memory card. (Another method is to
copy the CPU device and paste it to the memory card.) Copying the CPU device to the
memory card opens the "Load preview" dialog.
6. In the "Load preview" dialog, click the "Load" button to copy the CPU device to the
memory card.
7. When the dialog displays a message that the CPU device (program) has been loaded
without errors, click the "Finish" button.

Using a transfer card

WARNING
Verify that the CPU is not actively running a process before inserting the memory card.
Inserting a memory card will cause the CPU to go to STOP mode, which could affect the
operation of an online process or machine. Unexpected operation of a process or machine
could result in death or injury to personnel and/or property damage.
Before inserting a memory card, always ensure that the CPU is offline and in a safe state.

To transfer the program to a CPU, follow these steps:

1. Insert the transfer card into the CPU (Page 108). If the CPU is in RUN, the CPU will go to
STOP mode. The maintenance (MAINT) LED flashes to indicate that the memory card
needs to be evaluated.
2. Power-cycle the CPU to evaluate the memory card. Alternative methods for rebooting the
CPU are to perform either a STOP-to-RUN transition or a memory reset (MRES) from
STEP 7.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 111
PLC concepts
4.5 Using a memory card

3. After the rebooting and evaluating the memory card, the CPU copies the program to the
internal load memory of the CPU.
The RUN/STOP LED alternately flashes green and yellow to indicate that the program is
being copied. When the RUN/STOP LED turns on (solid yellow) and the MAINT LED
flashes, the copy process has finished. You can then remove the memory card.
4. Reboot the CPU (either by restoring power or by the alternative methods for rebooting) to
evaluate the new program that was transferred to internal load memory.
The CPU then goes to the start-up mode (RUN or STOP) that you configured for the project.

Note
You must remove the transfer card before setting the CPU to RUN mode.

4.5.4 Program card

CAUTION

Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap when
you handle the memory card. Store the memory card in a conductive container.

Check that the memory card is not write-protected. Slide the protection
switch away from the "Lock" position.
Before you copy any program elements to the program card, delete any
previously saved programs from the memory card.

S7-1200 Programmable controller

112 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.5 Using a memory card

Creating a program card

When used as a program card, the memory card is the external load memory of the CPU. If
you remove the program card, the internal load memory of the CPU is empty.

Note
If you insert a blank memory card into the CPU and perform a memory card evaluation by
either power cycling the CPU, performing a STOP to RUN transition, or performing a
memory reset (MRES), the program and force values in internal load memory of the CPU are
copied to the memory card. (The memory card is now a program card.) After the copy has
been completed, the program in internal load memory of the CPU is then erased. The CPU
then goes to the configured startup mode (RUN or STOP).

Always remember to configure the startup parameter of the CPU (Page 110) before copying
a project to the program card. To create a program card, follow these steps:
1. Insert a blank SIMATIC memory card into an SD card reader/writer attached to your
computer.
If you are reusing a SIMATIC memory card that contains a user program or a firmware
update, you must delete the program files before reusing the card. Use Windows Explorer
to display the contents of the memory card and delete the "S7_JOB.S7S" file and also
delete any existing "Data Logs" folders and any directory folder (such as "SIMATIC.S7S"
or "FWUPDATE.S7S").
2. In the Project tree (Project view), expand the "SIMATIC Card Reader" folder and select
your card reader.
3. Display the "Memory card" dialog by right-clicking the drive letter corresponding to the
memory card in the card reader and selecting "Properties" from the context menu.
4. In the "Memory card" dialog, select "Program" from the drop-down menu.

5. Add the program by selecting the CPU device (such as PLC_1 [CPU 1214 DC/DC/DC]) in
the Project tree and dragging the CPU device to the memory card. (Another method is to
copy the CPU device and paste it to the memory card.) Copying the CPU device to the
memory card opens the "Load preview" dialog.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 113
PLC concepts
4.5 Using a memory card

6. In the "Load preview" dialog, click the "Load" button to copy the CPU device to the
memory card.
7. When the dialog displays a message that the CPU device (program) has been loaded
without errors, click the "Finish" button.

Using a program card as the load memory for your CPU

WARNING
Verify that the CPU is not actively running a process before inserting the memory card.
Inserting a memory card will cause the CPU to go to STOP mode, which could affect the
operation of an online process or machine. Unexpected operation of a process or machine
could result in death or injury to personnel and/or property damage.
Before inserting a memory card, always ensure that the CPU is offline and in a safe state.

To use a program card with your CPU, follow these steps:

1. Insert the program card into the CPU. If the CPU is in RUN mode, the CPU goes to STOP
mode. The maintenance (MAINT) LED flashes to indicate that the memory card needs to
be evaluated.
2. Power-cycle the CPU to evaluate the memory card. Alternative methods for rebooting the
CPU are to perform either a STOP-to-RUN transition or a memory reset (MRES) from
STEP 7.
3. After the CPU reboots and evaluates the program card, the CPU erases the internal load
memory of the CPU.
The CPU then goes to the start-up mode (RUN or STOP) that you configured for the CPU.
The program card must remain in the CPU. Removing the program card leaves the CPU with
no program in internal load memory.

WARNING

If you remove the program card, the CPU loses its external load memory and generates an
error. The CPU goes to STOP mode and flashes the error LED.
Control devices can fail in an unsafe condition, resulting in unexpected operation of
controlled equipment. Such unexpected operations could result in death or serious injury to
personnel, and/or damage to equipment.

S7-1200 Programmable controller

114 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.5 Using a memory card

4.5.5 Firmware update

CAUTION

Electrostatic discharge can damage the memory card or the receptacle on the CPU.
Make contact with a grounded conductive pad and/or wear a grounded wrist strap
whenever you handle the memory card. Store the memory card in a conductive container.

You use a memory card when downloading firmware updates from customer support
(http://www.siemens.com/automation/). From this Web site, navigate to Automation
Technology > Automation Systems > SIMATIC Industrial Automation Systems > PLC >
Modular controllers SIMATIC S7 > SIMATIC S7-1200. From there continue navigating to the
specific type of module that you need to update. Under "Support", click the link for "Software
Downloads" to proceed.
Alternatively, you can access the S7-1200 downloads Web page
(http://support.automation.siemens.com/WW/view/en/34612486/133100) directly.

Note
You cannot update an S7-1200 CPU V2.2 or earlier to S7-1200 V3.0 by firmware update.

CAUTION
Do not use the Windows formatter utility or any other formatting utility to reformat the
memory card.
If a Siemens memory card is reformatted using the Microsoft Windows formatter utility, then
the memory card will no longer be usable by a S7-1200 CPU.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 115
PLC concepts
4.5 Using a memory card

To download the firmware update to your memory card, follow these steps:
1. Insert a blank SIMATIC MC 24 MB memory card into an SD card reader/writer attached
to your computer.
You can reuse a SIMATIC memory card that contains a user program or another firmware
update, but you must delete some of the files on the memory card.

CAUTION
Do NOT delete the hidden files "__LOG__" and "crdinfo.bin" from the memory card.
The "__LOG__" and "crdinfo.bin" files are required for the memory card. If you delete
these files, you cannot use the memory card with the CPU.

To reuse a memory card, you must delete the "S7_JOB.S7S" file and any existing "Data
Logs" folders or any folder (such as "SIMATIC.S7S" or "FWUPDATE.S7S") before
downloading the firmware update. However, do not delete the files "__LOG__" and
"crdinfo.bin". (These files are typically hidden and are required.) Use Windows Explorer to
display the contents of the memory card and to delete the file and folders.
2. Select the self-extracting file (.exe) for the firmware update that corresponds to your
module, and download it to your computer. Double-click the update file, set the file
destination path to be the root directory of the SIMATIC memory card, and start the
extraction process. After the extraction is complete, the root directory (folder) of the
memory card will contain a "FWUPDATE.S7S" directory and the "S7_JOB.S7S" file.

S7-1200 Programmable controller

116 System Manual, 04/2012, A5E02486680-06
 PLC concepts
4.5 Using a memory card

To install the firmware update, follow these steps:

WARNING
Verify that the CPU is not actively running a process before installing the firmware update.
Installing the firmware update will cause the CPU to go to STOP mode, which could affect
the operation of an online process or machine. Unexpected operation of a process or
machine could result in death or injury to personnel and/or property damage.
Before inserting the memory card, always ensure that the CPU is offline and in a safe state.

1. Insert the memory card into the CPU. If the CPU is in RUN mode, the CPU then goes to
STOP mode. The maintenance (MAINT) LED flashes to indicate that the memory card
needs to be evaluated.
2. Power-cycle the CPU to start the firmware update. Alternative methods for rebooting the
CPU are to perform either a STOP-to-RUN transition or a memory reset (MRES) from
STEP 7.

NOTICE

To complete the firmware upgrade for the module, you must ensure that the external 24
VDC power to the module remains on.

After the CPU reboots, the firmware update starts. The RUN/STOP LED alternately
flashes green and yellow to indicate that the update is being copied. When the
RUN/STOP LED turns on (solid yellow) and the MAINT LED flashes, the copy process
has finished. You must then remove the memory card.
3. After removing the memory card, reboot the CPU again (either by restoring power or by
the alternative methods for rebooting) to load the new firmware.
The user program and hardware configuration are not affected by the firmware update.
When the CPU is powered up, the CPU enters the configured start-up state. (If the startup
mode for your CPU was configured to "Warm restart - mode before POWER OFF", the CPU
will be in STOP mode because the last state of the CPU was STOP.)

Note
Updating multiple modules connected to CPU
If your hardware configuration contains multiple modules that correspond to a single
firmware update file on the memory card, the CPU applies the updates to all applicable
modules (CM, SM, SB) in configuration order, that is, by increasing order of the module
position in Device Configuration in STEP 7.
If you have downloaded multiple firmware updates to the memory card for multiple modules,
the CPU applies the updates in the order in which you downloaded them to the memory
card.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 117
PLC concepts
4.6 Recovery from a lost password

4.6 Recovery from a lost password

If you have lost the password for a password-protected CPU, use an empty transfer card to
delete the password-protected program. The empty transfer card erases the internal load
memory of the CPU. You can then download a new user program from STEP 7 to the CPU.
For information about the creation and use of an empty transfer card, see the section of
transfer cards (Page 110).

WARNING

If you insert a transfer card in a running CPU, the CPU goes to STOP. Control devices can
fail in an unsafe condition, resulting in unexpected operation of controlled equipment. Such
unexpected operations could result in death or serious injury to personnel, and/or damage
to equipment.

You must remove the transfer card before setting the CPU to RUN mode.

S7-1200 Programmable controller

118 System Manual, 04/2012, A5E02486680-06
Programming concepts 6
6.1 Guidelines for designing a PLC system
When designing a PLC system, you can choose from a variety of methods and criteria. The
following general guidelines can apply to many design projects. Of course, you must follow
the directives of your own company's procedures and the accepted practices of your own
training and location.

Table 6- 1 Guidelines for designing a PLC system

Recommended steps Tasks

Partition your process Divide your process or machine into sections that have a level of independence from each other.
or machine These partitions determine the boundaries between controllers and influence the functional
description specifications and the assignment of resources.
Create the functional Write the descriptions of operation for each section of the process or machine, such as the I/O
specifications points, the functional description of the operation, the states that must be achieved before
allowing action for each actuator (such as a solenoid, a motor, or a drive), a description of the
operator interface, and any interfaces with other sections of the process or machine.
Design the safety Identify any equipment that might require hard-wired logic for safety. Remember that control
circuits devices can fail in an unsafe manner, which can produce unexpected startup or change in the
operation of machinery. Where unexpected or incorrect operation of the machinery could result in
physical injury to people or significant property damage, consider the implementation of
electromechanical overrides (which operate independently of the PLC) to prevent unsafe
operations. The following tasks should be included in the design of safety circuits:
 Identify any improper or unexpected operation of actuators that could be hazardous.
 Identify the conditions that would assure the operation is not hazardous, and determine how
to detect these conditions independently of the PLC.
 Identify how the PLC affects the process when power is applied and removed, and also
identify how and when errors are detected. Use this information only for designing the normal
and expected abnormal operation. You should not rely on this "best case" scenario for safety
purposes.
 Design the manual or electromechanical safety overrides that block the hazardous operation
independent of the PLC.
 Provide the appropriate status information from the independent circuits to the PLC so that
the program and any operator interfaces have necessary information.
 Identify any other safety-related requirements for safe operation of the process.
Plan system security Determine what level of protection (Page 164) you require for access to your process. You can
password-protect CPUs and program blocks from unauthorized access.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 145
Programming concepts
6.2 Structuring your user program

Recommended steps Tasks

Specify the operator Based on the requirements of the functional specifications, create the following drawings of the
stations operator stations:
 Overview drawing that shows the location of each operator station in relation to the process
or machine.
 Mechanical layout drawing of the devices for the operator station, such as display, switches,
and lights.
 Electrical drawings with the associated I/O of the PLC and signal modules.
Create the Based on the requirements of the functional specification, create configuration drawings of the
configuration drawings control equipment:
 Overview drawing that shows the location of each PLC in relation to the process or machine.
 Mechanical layout drawing of each PLC and any I/O modules, including any cabinets and
other equipment.
 Electrical drawings for each PLC and any I/O modules, including the device model numbers,
communications addresses, and I/O addresses.
Create a list of Create a list of symbolic names for the absolute addresses. Include not only the physical I/O
symbolic names signals, but also the other elements (such as tag names) to be used in your program.

6.2 Structuring your user program

When you create a user program for the automation tasks, you insert the instructions for the
program into code blocks:
● An organization block (OB) responds to a specific event in the CPU and can interrupt the
execution of the user program. The default for the cyclic execution of the user program
(OB 1) provides the base structure for your user program and is the only code block
required for a user program. If you include other OBs in your program, these OBs
interrupt the execution of OB 1. The other OBs perform specific functions, such as for
startup tasks, for handling interrupts and errors, or for executing specific program code at
specific time intervals.
● A function block (FB) is a subroutine that is executed when called from another code
block (OB, FB, or FC). The calling block passes parameters to the FB and also identifies
a specific data block (DB) that stores the data for the specific call or instance of that FB.
Changing the instance DB allows a generic FB to control the operation of a set of
devices. For example, one FB can control several pumps or valves, with different
instance DBs containing the specific operational parameters for each pump or valve.
● A function (FC) is a subroutine that is executed when called from another code block
(OB, FB, or FC). The FC does not have an associated instance DB. The calling block
passes parameters to the FC. The output values from the FC must be written to a
memory address or to a global DB.

S7-1200 Programmable controller

146 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.2 Structuring your user program

Choosing the type of structure for your user program

Based on the requirements of your application, you can choose either a linear structure or a
modular structure for creating your user program:
● A linear program executes all of the instructions for your automation tasks in sequence,
one after the other. Typically, the linear program puts all of the program instructions into
the OB for the cyclic execution of the program (OB 1).
● A modular program calls specific code blocks that perform specific tasks. To create a
modular structure, you divide the complex automation task into smaller subordinate tasks
that correspond to the technological functions of the process. Each code block provides
the program segment for each subordinate task. You structure your program by calling
one of the code blocks from another block.

Linear structure: Modular structure:

2% 2% )%

)&

By creating generic code blocks that can be reused within the user program, you can simplify
the design and implementation of the user program. Using generic code blocks has a
number of benefits:
● You can create reusable blocks of code for standard tasks, such as for controlling a pump
or a motor. You can also store these generic code blocks in a library that can be used by
different applications or solutions.
● When you structure the user program into modular components that relate to functional
tasks, the design of your program can be easier to understand and to manage. The
modular components not only help to standardize the program design, but can also help
to make updating or modifying the program code quicker and easier.
● Creating modular components simplifies the debugging of your program. By structuring
the complete program as a set of modular program segments, you can test the
functionality of each code block as it is developed.
● Creating modular components that relate to specific technological functions can help to
simplify and reduce the time involved with commissioning the completed application.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 147
Programming concepts
6.3 Using blocks to structure your program

6.3 Using blocks to structure your program

By designing FBs and FCs to perform generic tasks, you create modular code blocks. You
then structure your program by having other code blocks call these reusable modules. The
calling block passes device-specific parameters to the called block.
When a code block calls another code block, the CPU executes the program code in the
called block. After execution of the called block is complete, the CPU resumes the execution
of the calling block. Processing continues with execution of the instruction that follows after
the block call.

࿆ ࿇ A Calling block
2%)%)& 2%)%)&
B Called (or interrupting) block
ི
཰ ① Program execution
② Instruction or event that initiates the execution of
another block
ཱ
③ Program execution
④ Block end (returns to calling block)
ཱི

You can nest the block calls for a more modular structure. In the following example, the
nesting depth is 4: the program cycle OB plus 3 layers of calls to code blocks.

཰ ཱ ① Start of cycle
② Nesting depth
2% )% )&

'%

)% )% )&

'% '%

)& '%

6.3.1 Organization block (OB)

Organization blocks provide structure for your program. They serve as the interface between
the operating system and the user program. OBs are event driven. An event, such as a
diagnostic interrupt or a time interval, will cause the CPU to execute an OB. Some OBs have
predefined start events and behavior.

S7-1200 Programmable controller

148 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.3 Using blocks to structure your program

The program cycle OB contains your main program. You can include more than one program
cycle OB in your user program. During RUN mode, the program cycle OBs execute at the
lowest priority level and can be interrupted by all other types of program processing. The
startup OB does not interrupt the program cycle OB because the CPU executes the startup
OB before going to RUN mode.
After finishing the processing of the program cycle OBs, the CPU immediately executes the
program cycle OBs again. This cyclic processing is the "normal" type of processing used for
programmable logic controllers. For many applications, the entire user program is located in
a single program cycle OB.
You can create other OBs to perform specific functions, such as for handling interrupts and
errors, or for executing specific program code at specific time intervals. These OBs interrupt
the execution of the program cycle OBs.
Use the "Add new block" dialog to create new OBs in your user program.

Interrupt handling is always event-

driven. When such an event occurs,
the CPU interrupts the execution of
the user program and calls the OB
that was configured to handle that
event. After finishing the execution
of the interrupting OB, the CPU
resumes the execution of the user
program at the point of interruption.

The CPU determines the order for handling interrupt events by a priority assigned to each
OB. Each event has a particular servicing priority. The respective priority level within a
priority class determines the order in which the OBs are executed. Several interrupt events
can be combined into priority classes. For more information, refer to the PLC concepts
chapter section on execution of the user program (Page 67).

Creating an additional OB within a class of OB

You can create multiple OBs for your user program, even for the program cycle and startup
OB classes. Use the "Add new block" dialog to create an OB. Enter the name for your OB
and enter an OB number 200 or greater.
If you create multiple program cycle OBs for your user program, the CPU executes each
program cycle OB in numerical sequence, starting with the program cycle OB with the lowest
number (such as OB 1). For example: after first program cycle OB (such as OB1) finishes,
the CPU executes the next higher program cycle OB (such as OB 200).

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 149
Programming concepts
6.3 Using blocks to structure your program

Configuring the operation of an OB

You can modify the operational

parameters for an OB. For example, you
can configure the time parameter for a
time-delay OB or for a cyclic OB.

6.3.2 Function (FC)

A function (FC) is a code block that typically performs a specific operation on a set of input
values. The FC stores the results of this operation in memory locations. For example, use
FCs to perform standard and reusable operations (such as for mathematical calculations) or
technological functions (such as for individual controls using bit logic operations). An FC can
also be called several times at different points in a program. This reuse simplifies the
programming of frequently recurring tasks.
An FC does not have an associated instance data block (DB). The FC uses the local data
stack for the temporary data used to calculate the operation. The temporary data is not
saved. To store data permanently, assign the output value to a global memory location, such
as M memory or to a global DB.

6.3.3 Function block (FB)

A function block (FB) is a code block that uses an instance data block for its parameters and
static data. FBs have variable memory that is located in a data block (DB), or "instance" DB.
The instance DB provides a block of memory that is associated with that instance (or call) of
the FB and stores data after the FB finishes. You can associate different instance DBs with
different calls of the FB. The instance DBs allow you to use one generic FB to control
multiple devices. You structure your program by having one code block make a call to an FB
and an instance DB. The CPU then executes the program code in that FB, and stores the
block parameters and the static local data in the instance DB. When the execution of the FB
finishes, the CPU returns to the code block that called the FB. The instance DB retains the
values for that instance of the FB. These values are available to subsequent calls to the
function block either in the same scan cycle or other scan cycles.

Reusable code blocks with associated memory

You typically use an FB to control the operation for tasks or devices that do not finish their
operation within one scan cycle. To store the operating parameters so that they can be
quickly accessed from one scan to the next, each FB in your user program has one or more
instance DBs. When you call an FB, you also specify an instance DB that contains the block
parameters and the static local data for that call or "instance" of the FB. The instance DB
maintains these values after the FB finishes execution.

S7-1200 Programmable controller

150 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.3 Using blocks to structure your program

By designing the FB for generic control tasks, you can reuse the FB for multiple devices by
selecting different instance DBs for different calls of the FB.
An FB stores the Input, Output, and InOut, and Static parameters in an instance DB.

Assigning the start value in the instance DB

The instance DB stores both a default value and a start value for each parameter. The start
value provides the value to be used when the FB is executed. The start value can then be
modified during the execution of your user program.
The FB interface also provides a "Default value" column that allows you to assign a new start
value for the parameter as you are writing the program code. This default value in the FB is
then transferred to the start value in the associated instance DB. If you do not assign a new
start value for a parameter in the FB interface, the default value from instance DB is copied
to start value.

Using a single FB with DBs

The following figure shows an OB that calls one FB three times, using a different data block
for each call. This structure allows one generic FB to control several similar devices, such as
motors, by assigning a different instance data block for each call for the different devices.
Each instance DB stores the data (such as speed, ramp-up time, and total operating time)
for an individual device.

'%

2%
)%
'%
)%'%

)%'%

)%'%
'%

In this example, FB 22 controls three separate devices, with DB 201 storing the operational
data for the first device, DB 202 storing the operational data for the second device, and DB
203 storing the operational data for the third device.

6.3.4 Data block (DB)

You create data blocks (DB) in your user program to store data for the code blocks. All of the
program blocks in the user program can access the data in a global DB, but an instance DB
stores data for a specific function block (FB).

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 151
Programming concepts
6.3 Using blocks to structure your program

The data stored in a DB is not deleted when the execution of the associated code block
comes to an end. There are two types of DBs:
● A global DB stores data for the code blocks in your program. Any OB, FB, or FC can
access the data in a global DB.
● An instance DB stores the data for a specific FB. The structure of the data in an instance
DB reflects the parameters (Input, Output, and InOut) and the static data for the FB. (The
Temp memory for the FB is not stored in the instance DB.)

Note
Although the instance DB reflects the data for a specific FB, any code block can access
the data in an instance DB.

You can configure a DB as being read-only:

1. Right-click the DB in the project navigator and select "Properties" from the context menu.
2. In the "Properties" dialog, select "Attributes".
3. Select the "Data block write-protected in the device" option and click "OK".

S7-1200 Programmable controller

152 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.4 Understanding data consistency

Creating reusable code blocks

Use the "Add new block" dialog

under "Program blocks" in the
Project navigator to create OBs,
FBs, FCs, and global DBs.
When you create a code block, you
select the programming language
for the block. You do not select a
language for a DB because it only
stores data.

6.4 Understanding data consistency

The CPU maintains the data consistency for all of the elementary data types (such as Words
or DWords) and all of the system-defined structures (for example, IEC_TIMERS or DTL).
The reading or writing of the value cannot be interrupted. (For example, the CPU protects
the access to a DWord value until the four bytes of the DWord have been read or written.) To
ensure that the program cycle OBs and the interrupt OBs cannot write to the same memory
location at the same time, the CPU does not execute an interrupt OB until the read or write
operation in the program cycle OB has been completed.
If your user program shares multiple values in memory between a program cycle OB and an
interrupt OB, your user program must also ensure that these values are modified or read
consistently. You can use the DIS_AIRT (disable alarm interrupt) and EN_AIRT (enable
alarm interrupt) instructions in your program cycle OB to protect any access to the shared
values.
● Insert a DIS_AIRT instruction in the code block to ensure that an interrupt OB cannot be
executed during the read or write operation.
● Insert the instructions that read or write the values that could be altered by an interrupt
OB.
● Insert an EN_AIRT instruction at the end of the sequence to cancel the DIS_AIRT and
allow the execution of the interrupt OB.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 153
Programming concepts
6.5 Programming language

A communication request from an HMI device or another CPU can also interrupt execution of
the program cycle OB. The communication requests can also cause issues with data
consistency. The CPU ensures that the elementary data types are always read and written
consistently by the user program instructions. Because the user program is interrupted
periodically by communications, it is not possible to guarantee that multiple values in the
CPU will all be updated at the same time by the HMI. For example, the values displayed on a
given HMI screen could be from different scan cycles of the CPU.
The PtP (Point-to-Point) instructions, PROFINET instructions (such as TSEND_C and
TRCV_C), PROFINET Distributed I/O instructions , and PROFIBUS Distributed I/O
Instructions (Page 274) transfer buffers of data that could be interrupted. Ensure the data
consistency for the buffers of data by avoiding any read or write operation to the buffers in
both the program cycle OB and an interrupt OB. If it is necessary to modify the buffer values
for these instructions in an interrupt OB, use a DIS_AIRT instruction to delay any interruption
(an interrupt OB or a communication interrupt from an HMI or another CPU) until an
EN_AIRT instruction is executed.

Note
The use of the DIS_AIRT instruction delays the processing of interrupt OBs until the
EN_AIRT instruction is executed, affecting the interrupt latency (time from an event to the
time when the interrupt OB is executed) of your user program.

6.5 Programming language

STEP 7 provides the following standard programming languages for S7-1200:
● LAD (ladder logic) is a graphical programming language. The representation is based on
circuit diagrams (Page 155).
● FBD (Function Block Diagram) is a programming language that is based on the graphical
logic symbols used in Boolean algebra (Page 156).
● SCL (structured control language) is a text-based, high-level programming language
(Page 156).
When you create a code block, you select the programming language to be used by that
block.
Your user program can utilize code blocks created in any or all of the programming
languages.

S7-1200 Programmable controller

154 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.5 Programming language

6.5.1 Ladder logic (LAD)

The elements of a circuit diagram, such as normally closed and normally open contacts, and
coils are linked to form networks.

To create the logic for complex operations, you can insert branches to create the logic for
parallel circuits. Parallel branches are opened downwards or are connected directly to the
power rail. You terminate the branches upwards.
LAD provides "box" instructions for a variety of functions, such as math, timer, counter, and
move.
STEP 7 does not limit the number of instructions (rows and columns) in a LAD network.

Note
Every LAD network must terminate with a coil or a box instruction.

Consider the following rules when creating a LAD network:

● You cannot create a branch that could result in a power flow in the reverse direction.
$ % & ' =

( )

+ *

● You cannot create a branch that would cause a short circuit.

$ % & =

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 155
Programming concepts
6.5 Programming language

6.5.2 Function Block Diagram (FBD)

Like LAD, FBD is also a graphical programming language. The representation of the logic is
based on the graphical logic symbols used in Boolean algebra.

To create the logic for complex operations,

insert parallel branches between the boxes.

Mathematical functions and other complex functions can be represented directly in

conjunction with the logic boxes.
STEP 7 does not limit the number of instructions (rows and columns) in an FBD network.

6.5.3 SCL
Structured Control Language (SCL) is a high-level, PASCAL-based programming language
for the SIMATIC S7 CPUs. SCL supports the block structure of STEP 7 (Page 148). You can
also include program blocks written in SCL with program blocks written in LAD and FBD.
SCL instructions use standard programming operators, such as for assignment (:=),
mathematical functions (+ for addition, - for subtraction, * for multiplication, and / for division).
SCL also uses standard PASCAL program control operations, such as IF-THEN-ELSE,
CASE, REPEAT-UNTIL, GOTO and RETURN. You can use any PASCAL reference for
syntactical elements of the SCL programming language. Many of the other instructions for
SCL, such as timers and counters, match the LAD and FBD instructions. For more
information about specific instructions, refer to the specific instructions in the chapters for
Basic instructions (Page 175) and Extended instructions (Page 247).
You can designate any type of block (OB, FB, or FC) to use the SCL programming language
at the time you create the block. STEP 7 provides an SCL program editor that includes the
following elements:
● Interface section for defining the parameters of the code block
● Code section for the program code
● Instruction tree that contains the SCL instructions supported by the CPU
You enter the SCL code for your instruction directly in the code section. For more complex
instructions, simply drag the SCL instructions from the instruction tree and drop them into
your program. You can also use any text editor to create an SCL program and then import
that file into STEP 7.

S7-1200 Programmable controller

156 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.5 Programming language

In the section of the SCL code block you can declare the following types of parameters:
● Input, Output, InOut, and Ret_Val: These parameters define the input tags, output tags,
and return value for the code block. The tag name that you enter here is used locally
during the execution of the code block. You typically would not use the global tag name in
the tag table.
● Static (FBs only; the illustration above is for an FC): Static tags are used for storage of
static intermediate results in the instance data block. Static data is retained until
overwritten, which may be after several cycles. The names of the blocks, which are called
in this code block as multi-instance, are also stored in the static local data.
● Temp: These parameters are the temporary tags that are used during the execution of
the code block.
If you call the SCL code block from another code block, the parameters of the SCL code
block appear as inputs or outputs.

In this example, the tags for "Start" and "On" (from the project tag table) correspond to
"StartStopSwitch" and "RunYesNo" in the declaration table of the SCL program.

Constructing an SCL expression

An SCL expression is a formula for calculating a value. The expression consists of operands
and operators (such as *, /, + or -). The operands can be tags, constants, or expressions.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 157
Programming concepts
6.5 Programming language

The evaluation of the expression occurs in a certain order, which is defined by the following
factors:
● Every operator has a pre-defined priority, with the highest-priority operation performed
first.
● For operators with equal priority, the operators are processed in a left-to-right sequence.
● You use parentheses to designate a series of operators to be evaluated together.
The result of an expression can be used either for assigning a value to a tag used by your
program, as a condition to be used by a control statement, or as parameters for another SCL
instruction or for calling a code block.

Table 6- 2 Operators in SCL

Type Operation Operator Priority

Parentheses (Expression) (,) 1
Math Power ** 2
Sign (unary plus) + 3
Sign (unary minus) - 3
Multiplication * 4
Division / 4
Modulo MOD 4
Addition + 5
Subtraction - 5
Comparison Less than < 6
Less than or equal to <= 6
Greater than > 6
Greater than or equal to >= 6
Equal to = 7
Not equal to <> 7
Bit logic Negation (unary) NOT 3
AND logic operation AND or & 8
Exclusive OR logic operation XOR 9
OR logic operation OR 10
Assignment Assignment := 11

As a high-level programming language, SCL uses standard statements for basic tasks:
● Assignment statement: :=
● Mathematical functions: +, -, *, and /
● Addressing of global variables (tags): "<tag name>" (Tag name or data block name
enclosed in double quotes)
● Addressing of local variables: #<variable name> (Variable name preceded by "#" symbol)

S7-1200 Programmable controller

158 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.5 Programming language

The following examples show different expressions for different uses.

"C" := #A+#B; Assigns the sum of two local variables to a tag

"Data_block_1".Tag := #A; Assignment to a data block tag
IF #A > #B THEN "C" := #A; Condition for the IF-THEN statement
"C" := SQRT (SQR (#A) + SQR (#B)); Parameters for the SQRT instruction
Arithmetic operators can process various numeric data types. The data type of the result is
determined by the data type of the most-significant operands. For example, a multiplication
operation that uses an INT operand and a REAL operand yields a REAL value for the result.

Control statements
A control statement is a specialized type of SCL expression that performs the following
tasks:
● Program branching
● Repeating sections of the SCL program code
● Jumping to other parts of the SCL program
● Conditional execution
The SCL control statements include IF-THEN, CASE-OF, FOR-TO-DO, WHILE-DO,
REPEAT-UNTIL, CONTINUE, GOTO, and RETURN.
A single statement typically occupies one line of code. You can enter multiple statements on
one line, or you can break a statement into several lines of code to make the code easier to
read. Separators (such as tabs, line breaks and extra spaces) are ignored during the syntax
check. An END statement terminates the control statement.
The following examples show a FOR-TO-DO control statement. (Both forms of coding are
syntactically valid.)

FOR x := 0 TO max DO sum := sum + value(x); END_FOR;

FOR x := 0 TO max DO
sum := sum + value(x);
END_FOR;
A control statement can also be provided with a label. A label is set off by a colon at the
beginning of the statement:

Label: <Statement>;
The STEP 7 online help provides a complete SCL programming language reference.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 159
Programming concepts
6.5 Programming language

Conditions
A condition is a comparison expression or a logical expression whose result is of type BOOL
(with the value of either TRUE or FALSE). The following example shows conditions of
various types.

#Temperature > 50 Relational expression

#Counter <= 100
#CHAR1 < 'S'
(#Alpha <> 12) AND NOT #Beta Comparison and logical expression
5 + #Alpha Arithmetic expression
A condition can use arithmetic expressions:
● The condition of the expression is TRUE if the result is any value other than zero.
● The condition of the expression is FALSE if the result equals zero.

Addressing
As with LAD and FBD, SCL allows you to use either tags (symbolic addressing) or absolute
addresses in your user program. SCL also allows you to use a variable as an array index.

Absolute addressing
I0.0
MB100

Symbolic addressing
"PLC_Tag_1" Tag in PLC tag table
"Data_block_1".Tag_1 Tag in a data block
"Data_block_1".MyArray[#i] Array element in a data block array

Indexed addressing with PEEK and POKE instructions

SCL provides PEEK and POKE instructions that allow you to read from or write to data
blocks, I/O, or memory. You provide parameters for specific byte offsets or bit offsets for the
operation.

Note
To use the PEEK and POKE instructions with data blocks, you must use standard (not
optimized) data blocks. Also note that the PEEK and POKE instructions merely transfer data.
They have no knowledge of data types at the addresses.

S7-1200 Programmable controller

160 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.5 Programming language

PEEK(area:=_in_, Reads the byte referenced by byteOffset of

dbNumber:=_in_, the referenced data block, I/O or memory
byteOffset:=_in_); area.
Example referencing data block:
%MB100 := PEEK(area:=16#84,
dbNumber:=1, byteOffset:=#i);
Example referencing IB3 input:
%MB100 := PEEK(area:=16#81,
dbNumber:=0, byteOffset:=#i); // when
#i = 3
PEEK_WORD(area:=_in_, Reads the word referenced by byteOffset of
dbNumber:=_in_, the referenced data block, I/O or memory
byteOffset:=_in_); area.
Example:
%MW200 := PEEK_WORD(area:=16#84,
dbNumber:=1, byteOffset:=#i);
PEEK_DWORD(area:=_in_, Reads the double word referenced by
dbNumber:=_in_, byteOffset of the referenced data block, I/O or
byteOffset:=_in_); memory area.
Example:
%MD300 := PEEK_DWORD(area:=16#84,
dbNumber:=1, byteOffset:=#i);
PEEK_BOOL(area:=_in_, Reads a Boolean referenced by the bitOffset
dbNumber:=_in_, and byteOffset of the referenced data block,
byteOffset:=_in_, I/O or memory area
bitOffset:=_in_);
Example:
%MB100.0 := PEEK_BOOL(area:=16#84,
dbNumber:=1, byteOffset:=#ii,
bitOffset:=#j);
POKE(area:=_in_, Writes the value (Byte, Word, or DWord) to
dbNumber:=_in_, the referenced byteOffset of the referenced
byteOffset:=_in_, data block, I/O or memory area
value:=_in_);
Example referencing data block:
POKE(area:=16#84, dbNumber:=2,
byteOffset:=3, value:="Tag_1");

Example referencing QB3 output:

POKE(area:=16#82, dbNumber:=0,
byteOffset:=3, value:="Tag_1");

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 161
Programming concepts
6.5 Programming language

POKE_BOOL(area:=_in_, Writes the Boolean value to the referenced

dbNumber:=_in_, bitOffset and byteOffset of the referenced
byteOffset:=_in_, data block, I/O or memory area
bitOffset:=_in_,
Example:
value:=_in_);
POKE_BOOL(area:=16#84, dbNumber:=2,
byteOffset:=3, bitOffset:=5,
value:=0);
POKE_BLK(area_src:=_in_, Writes "count" number of bytes starting at the
dbNumber_src:=_in_, referenced byte Offset of the referenced
byteOffset_src:=_in_, source data block, I/O or memory area to the
area_dest:=_in_, referenced byteOffset of the referenced
dbNumber_dest:=_in_, destination data block, I/O or memory area
byteOffset_dest:=_in_,
Example:
count:=_in_);
POKE_BLK(area_src:=16#84,
dbNumber_src:=#src_db,
byteOffset_src:=#src_byte,
area_dest:=16#84,
dbNumber_dest:=#src_db,
byteOffset_dest:=#src_byte,
count:=10);

For PEEK and POKE instructions, the following values for the "area", "area_src" and
"area_dest" parameters are applicable. For areas other than data blocks, the dbNumber
parameter must be 0.

16#81 I
16#82 Q
16#83 M
16#84 DB

Calling other code blocks from your SCL program

To call another code block in your user program, simply enter the name (or absolute
address) of the FB or FC with the parameters. For an FB, you must provide the instance DB
to be called with the FB.

<DB name> (Parameter list) Call as a single instance

<#Instance name> (Parameter list) Call as multi-instance

"MyDB"(MyInput:=10, MyInOut:="Tag1");

<FC name> (Parameter list) Standard call

<Operand>:=<FC name> (Parameter list) Call in an expression

"MyFC"(MyInput:=10, MyInOut:="Tag1");

S7-1200 Programmable controller

162 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.5 Programming language

You can also drag blocks from the navigation tree to the SCL program editor, and complete
the parameter assignment.

6.5.4 EN and ENO for LAD, FBD and SCL

Determining "power flow" (EN and ENO) for an instruction

Certain instructions (such as the Math and the Move instructions) provide parameters for EN
and ENO. These parameters relate to power flow in LAD or FBD and determine whether the
instruction is executed during that scan. SCL also allows you to set the ENO parameter for a
code block.
● EN (Enable In) is a Boolean input. Power flow (EN = 1) must be present at this input for
the box instruction to be executed. If the EN input of a LAD box is connected directly to
the left power rail, the instruction will always be executed.
● ENO (Enable Out) is a Boolean output. If the box has power flow at the EN input and the
box executes its function without error, then the ENO output passes power flow
(ENO = 1) to the next element. If an error is detected in the execution of the box
instruction, then power flow is terminated (ENO = 0) at the box instruction that generated
the error.

Table 6- 3 Operands for EN and ENO

Program editor Inputs/outputs Operands Data type

LAD EN, ENO Power flow Bool
FBD EN I, I:P, Q, M, DB, Temp, Power Flow Bool
ENO Power Flow Bool
SCL EN1 TRUE, FALSE Bool
ENO2 TRUE, FALSE Bool
1 The use of EN is only available for FBs.
2. The use of ENO with the SCL code block is optional. You must configure the SCL compiler to set ENO when the code
block finishes.

Configuring SCL to set ENO

To configure the SCL compiler for setting ENO, follow these steps:
1. Select the "Settings" command from the "Options" menu.
2. Expand the "PLC programming" properties and select "SCL (Structured Control
Language)".
3. Select the "Set ENO automatically" option.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 163
Programming concepts
6.6 Protection

Effect of Ret_Val or Status parameters on ENO

Some instructions, such as the communication instructions or the string conversion
instructions, provide an output parameter that contains information about the processing of
the instruction. For example, some instructions provide a Ret_Val (return value) parameter,
which is typically an Int data type that contains status information in a range from -32768 to
+32767. Other instructions provide a Status parameter, which is typically a Word data type
that stores status information in a range of hexadecimal values from 16#0000 to 16#FFFF.
The numerical value stored in a Ret_Val or a Status parameter determines the state of ENO
for that instruction.
● Ret_Val: A value from 0 to 32767 typically sets ENO = 1 (or TRUE). A value from -32768
to -1 typically sets ENO = 0 (or FALSE). To evaluate Ret_Val, change the representation
to hexadecimal.
● Status: A value from 16#0000 16#7FFF typically sets ENO = 1 (or TRUE). A value from
16#8000 to 16#FFFF typically sets ENO = 0 (or FALSE).
Instructions that take more than one scan to execute often provide a Busy parameter (Bool)
to signal that the instruction is active but has not completed execution. These instructions
often also provide a Done parameter (Bool) and an Error parameter (Bool). Done signals that
the instruction was completed without error, and Error signals that the instruction was
completed with an error condition.
● When Busy = 1 (or TRUE), ENO = 1 (or TRUE).
● When Done = 1 (or TRUE), ENO = 1 (or TRUE).
● When Error = 1 (or TRUE), ENO = 0 (or FALSE).

See also
OK and Not OK instructions (Page 197)

6.6 Protection

6.6.1 Access protection for the CPU

The CPU provides three levels of security for restricting access to specific functions. When
you configure the security level and password for a CPU, you limit the functions and memory
areas that can be accessed without entering a password.
The password is case-sensitive.

S7-1200 Programmable controller

164 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.6 Protection

To configure the password,

follow these steps:
1. In the "Device configuration",
select the CPU.
2. In the inspector window,
select the "Properties" tab.
3. Select the "Protection"
property to select the
protection level and to enter a
password.

Each level allows certain functions to be accessible without a password. The default
condition for the CPU is to have no restriction and no password-protection. To restrict access
to a CPU, you configure the properties of the CPU and enter the password.
Entering the password over a network does not compromise the password protection for the
CPU. Password protection does not apply to the execution of user program instructions
including communication functions. Entering the correct password provides access to all of
the functions.
PLC-to-PLC communications (using communication instructions in the code blocks) are not
restricted by the security level in the CPU. HMI functionality is also not restricted.

Table 6- 4 Security levels for the CPU

Security level Access restrictions

No protection Allows full access without password-protection.
Write protection Allows HMI access and all forms of PLC-to-PLC communications without password-protection.
Password is required for modifying (writing to) the CPU and for changing the CPU mode
(RUN/STOP).
Read/write protection Allows HMI access and all forms of PLC-to-PLC communications without password-protection.
Password is required for reading the data in the CPU, for modifying (writing to) the CPU, and for
changing the CPU mode (RUN/STOP).

6.6.2 Know-how protection

Know-how protection allows you to prevent one or more code blocks (OB, FB, FC, or DB) in
your program from unauthorized access. You create a password to limit access to the code
block. The password-protection prevents unauthorized reading or modification of the code
block. Without the password, you can read only the following information about the code
block:
● Block title, block comment, and block properties
● Transfer parameters (IN, OUT, IN_OUT, Return)
● Call structure of the program
● Global tags in the cross references (without information on the point of use), but local
tags are hidden

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 165
Programming concepts
6.6 Protection

When you configure a block for "know-how" protection, the code within the block cannot be
accessed except after entering the password.
Use the "Properties" task card of the code block to configure the know-how protection for
that block. After opening the code block, select "Protection" from Properties.

1. In the Properties for the code block, click

the "Protection" button to display the
"Know-how protection" dialog.
2. Click the "Define" button to enter the
password.

After entering and confirming the password,

click "OK".

6.6.3 Copy protection

An additional security feature allows you to bind the program or code blocks for use with a
specific memory card or CPU. This feature is especially useful for protecting your intellectual
property. When you bind a program or block to a specific device, you restrict the program or
code block for use only with a specific memory card or CPU. This feature allows you to
distribute a program or code block electronically (such as over the Internet or through email)
or by sending a memory cartridge.

S7-1200 Programmable controller

166 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.6 Protection

Use the "Properties" task card of the code block to bind the block to a specific CPU or
memory card.
1. After opening the code block, select "Protection".

2. From the drop-down list under "Copy protection" task, select the option to bind the code
block either to a memory card or to a specific CPU.

3. Select the type of copy protection and enter the serial number for the memory card or
CPU.

Note
The serial number is case-sensitive.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 167
Programming concepts
6.7 Downloading the elements of your program

6.7 Downloading the elements of your program

You can download the elements of your project from the programming device to the CPU.
When you download a project, the CPU stores the user program (OBs, FCs, FBs and DBs)
in permanent memory.

You can download your project from the programming device to your CPU from any of the
following locations:
● "Project tree": Right-click the program element, and then click the context-sensitive
"Download" selection.
● "Online" menu: Click the "Download to device" selection.
● Toolbar: Click the "Download to device" icon.

6.8 Uploading from the CPU

6.8.1 Copying elements of the project

You can also copy the program blocks from an online CPU or a memory card attached to
your programming device.

S7-1200 Programmable controller

168 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.8 Uploading from the CPU

Prepare the offline project for the copied program blocks:

1. Add a CPU device that matches the online CPU.
2. Expand the CPU node once so that the "Program
blocks" folder is visible.

To upload the program blocks from the online CPU to the

offline project, follow these steps:
1. Click the "Program blocks" folder in the offline project.
2. Click the "Go online" button.
3. Click the "Upload" button.
4. Confirm your decision from the Upload dialog
(Page 675).
As an alternative to the previous method, follow these
steps:
1. From the project navigator, expand the node for
"Online access" to select the program blocks in the
online CPU:
2. Expand the node for the network, and double click
"Update accessible devices".
3. Expand the node for the CPU.
4. Drag the "Program blocks" folder from the online CPU
and drop the folder into the "Program blocks" folder of
your offline project.
5. In the "Upload preview" dialog, select the box for
"Continue", and then click the "Upload from device"
button.
When the upload is complete, all of the program blocks,
technology blocks, and tags will be displayed in the offline
area.

Note
You can copy the program blocks from the online CPU to an existing program. The
"Program-blocks" folder of the offline project does not have to be empty. However, the
existing program will be deleted and replaced by the user program from the online CPU.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 169
Programming concepts
6.9 Debugging and testing the program

6.8.2 Using the compare function

You can use the "Compare" editor (Page 681) in STEP 7 to find differences between the
online and offline projects. You might find this useful prior to uploading from the CPU.

6.9 Debugging and testing the program

6.9.1 Monitor and modify data in the CPU

As shown in the following table, you can monitor and modify values in the online CPU.

Table 6- 5 Monitoring and modifying data with STEP 7

Editor Monitor Modify Force

Watch table Yes Yes No
Force table Yes No Yes
Program editor Yes Yes No
Tag table Yes No No
DB editor Yes No No

Monitoring with a
watch table

Monitoring with the LAD editor

Refer to the "Online and diagnostics" chapter for more information about monitoring and
modifying data in the CPU (Page 682).

6.9.2 Watch tables and force tables

You use "watch tables" for monitoring and modifying the values of a user program being
executed by the online CPU. You can create and save different watch tables in your project
to support a variety of test environments. This allows you to reproduce tests during
commissioning or for service and maintenance purposes.

S7-1200 Programmable controller

170 System Manual, 04/2012, A5E02486680-06
 Programming concepts
6.9 Debugging and testing the program

With a watch table, you can monitor and interact with the CPU as it executes the user
program. You can display or change values not only for the tags of the code blocks and data
blocks, but also for the memory areas of the CPU, including the inputs and outputs (I and Q),
peripheral inputs (I:P), bit memory (M), and data blocks (DB).
With the watch table, you can enable the physical outputs (Q:P) of a CPU in STOP mode.
For example, you can assign specific values to the outputs when testing the wiring for the
CPU.
STEP 7 also provides a force table for "forcing" a tag to a specific value. For more
information about forcing, see the section on forcing values in the CPU (Page 689) in the
"Online and Diagnostics" chapter.

Note
The force values are stored in the CPU and not in the watch table.
You cannot force an input (or "I" address). However, you can force a peripheral input. To
force a peripheral input, append a ":P" to the address (for example: "On:P").

6.9.3 Cross reference to show usage

The Inspector window displays cross-reference information about how a selected object is
used throughout the complete project, such as the user program, the CPU and any HMI
devices. The "Cross-reference" tab displays the instances where a selected object is being
used and the other objects using it. The Inspector window also includes blocks which are
only available online in the cross-references. To display the cross-references, select the
"Show cross-references" command. (In the Project view, find the cross references in the
"Tools" menu.)

Note
You do not have to close the editor to see the cross-reference information.

You can sort the entries in the cross-reference. The cross-reference list provides an
overview of the use of memory addresses and tags within the user program.
● When creating and changing a program, you retain an overview of the operands, tags
and block calls you have used.
● From the cross-references, you can jump directly to the point of use of operands and
tags.
● During a program test or when troubleshooting, you are notified about which memory
location is being processed by which command in which block, which tag is being used in
which screen, and which block is called by which other block.

S7-1200 Programmable controller

System Manual, 04/2012, A5E02486680-06 171
Programming concepts
6.9 Debugging and testing the program

Table 6- 6 Elements of the cross reference

Column Description
Object Name of the object that uses the lower-level objects or that is being used by the
lower-level objects
Quantity Number of uses
Location Each location of use, for example, network
Property Special properties of referenced objects, for example, the tag names in multi-instance
declarations
as Shows additional information about the object, such as whether an instance DB is
used as template or as a multiple instance
Access Type of access, whether access to the operand is read access (R) and/or write
access (W)
Address Address of the operand
Type Information on the type and language used to create the object
Path Path of object in project tree

6.9.4 Call structure to examine the calling hierarchy

The call structure describes the call hierarchy of the block within your user program. It
provides an overview of the blocks used, calls to other blocks, the relationships between
blocks, the data requirements for each block, and the status of the blocks. You can open the
program editor and edit blocks from the call structure.
Displaying the call structure provides you with a list of the blocks used in the user program.
STEP 7 highlights the first level of the call structure and displays any blocks that are not
called by any other block in the program. The first level of the call structure displays the OBs
and any FCs, FBs, and DBs that are not called by an OB. If a code block calls another block,
the called block is shown as an indentation under the calling block. The call structure only
displays those blocks that are called by a code block.
You can selectively display only the blocks causing conflicts within the call structure. The
following conditions cause conflicts:
● Blocks that execute any calls with older or newer code time stamps
● Blocks that call a block with modified interface
● Blocks that use a tag with modified address and/or data type
● Blocks that are called neither directly nor indirectly by an OB
● Blocks that call a non-existent or missing block
You can group several block calls and data blocks as a group. You use a drop-down list to
see the links to the various call locations.

S7-1200 Programmable controller

172 System Manual, 04/2012, A5E02486680-06