Indirect Addressing S5 S7

http://support.automation.siemens.com/US/view/99/24519683

STEP 7 -- Creating S7 programs -- Indirect Addressing Entry ID:24519683 Date:2011-08-09 STEP 7 -- Creating S7 programs -- Indirect Addressing Why are the bit and byte addresses changed when indirectly addressing a program converted from S5 to S7? How can you open data blocks indirectly and do an indexed call, start and evaluation of timers? Information on the topic of "Indirect addressing" What is the difference between STEP 7 and STEP 5 with regard to the operations for indirect addressing? How do access the I/O address area indirectly and what should you watch out for when copying with the SFC20? How can you access an element indirectly in STL in a two-dimensional array (e.g. a value in line 2 and column 5)? In the case of a function, how is the address of the ANY pointer for the elementary IN, OUT and IN-OUT parameters loaded into the address register AR1? How can you calculate an offset for an ANY pointer or change the pointer? How can you use "CHAR"-type variables for FC1 (DP_SEND)? How do you parameterize blocks, which have "ANY"-type or "Pointer" type parameters? Why are indirect calls using AR2 replaced by static local variables after saving the block? In which operations does STEP 7 overwrite ACCU or register contents? Why are the bit and byte addresses changed when indirectly addressing a program converted from S5 to S7? Description: When calculating the address in STEP 5, bits 12 to 15 are used for the interim results. But these bits are not needed for indirect addressing in STEP 5. Unlike DO instructions (e.g. "B MW") in STEP 5, in STEP 7 addressing is via double-words, because of the extended address area. With the instruction in STEP 7, an area (E, A, M), an access range (bit, byte, word and double-word) and an address are specified. The address contains the byte number. The structure of the address register must be observed when an address is preset via the Accu:




RRR: area identifier B...B: byte address XXX: bit address

Fig. 01 If the program is now converted to STEP 7, then when bits 12 to 15 are used by STEP 7 the system changes the addresses. Fig. 01 shows an example of a bit pattern "W#16#221". After conversion, the address "33.2" is calculated.

Page 1 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

Fig. 02 Fig. 02 shows the same program, but with the bit pattern"W#16#1221". The leading "1" is not evaluated by STEP 5. After conversion, however, the address "35.2" is calculated by STEP 7. The reason for this is that the leading "1" at the bit point is placed by the system in the byte address with value 2.

Fig. 03 Remedy: If you can't ensure that bits 12 to 15 are not used, then change the two move commands as follows.



SLW 5 to SLW 12. SRW 5 to SRW 12.

After conversion, however, the correct address "33.2" is calculated in STEP 7.

Fig. 04 Keywords: S5/S7 converter Fig. 01

Page 2 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

Fig. 02

Fig. 03

Page 3 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

Fig. 04

How can you open data blocks indirectly and do an indexed call, start and evaluation of timers? Instructions You have the following options for opening a data block indirectly:




By programming with a formal parameter of the "BLOCK_DB" parameter type (Example 1). By way of a local data word (temporary block variables) (Example 2). Through indirect memory addressing (Example 3).

Fig. 01 shows three examples of indirect opening of a data block in STL.

Page 4 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

Fig. 01 Example 1 In this case, input parameter "Data2" is given a formal parameter of the "BLOCK_DB" type. The content of "Data2" corresponds to the number of the data block to be opened. Example 2 Input parameter "InWord" of the "WORD" type is given to the temporary variable "Data1". The number in the temporary variable "Data1" of the "WORD" type is the number of the global data block. The global data block is then opened with AUF DB[Data1]. Example 3 With indirect memory addressing, here, for example, DB number 10 is saved in marker word MW20. The instruction AUF DB[MW20] opens the global data block whose number is contained in marker word MW20. AUF DB[MW20] thus corresponds to AUF DB10. Further methods for opening data blocks with indirect memory addressing are possible with AUF DB [DBW ] and AUF DB[DIW ]. If no FBs are used, both DB registers may be used freely, i.e. all variants can also be opened with AUF DI .... Note For more information see the STEP 7 Online Help under keyword "Legal data types in the transfer of parameters". Indexed call, start and evaluation of TIMER You can make an indexed call of a timer by way of a tag of the WORD data type. This tag can be



A global tag [MW] A local tag in a DB [DBW]

Page 5 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683




A temporary tag in a block

Access is as follows (example): SI SI

T[MW2] T[DBW2]

SI

T[#time_x]

//The timer number is in marker word 2, hex coded. //The timer number is in data block word 2, hex coded. The DB must be opened explicitly beforehand. //The "#time_x" tag is a temporary tag of the WORD data type.

Keywords: Indirect addressing, DB call Information on the topic of "Indirect addressing" Instructions Information on the topic of "Indirect addressing" is available in the following manuals and chapters / sections and in the Online Help. Document

Version Chapter / section

Entry ID

Manual on "Programming 05/2010 with STEP 7"

27.3.4 Parameter Types

STEP 7 Online Help

Format of the parameter type ANY Format of the parameter type POINTER

V5.5

45531107

What is the difference between STEP 7 and STEP 5 with regard to the operations for indirect addressing? Instructions: For indirect addressing in STEP 7 a difference is made between 1. Memory indirect addressing with a number: for addressing timers, counters and blocks. 2. Register indirect addressing with an area pointer: for addressing memory areas: I/O, inputs, outputs, markers, global data (DBX), instance data (DIX) and local data. Memory indirect addressing with a number: Examples: STEP 7

Equivalent in STEP 5

L2

Load number

L KF+2

Load number

T MW 33

Save in bit memory word 33

T FW 33

Save in flag word 33

L T [MW33]

Load current time value of Timer 2

DO FW33

Process flag word 33

L T0

Load current time value of Timer 2

.......

Page 6 of 35

.......

.......

.......

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

OPN DB[MW33]

Open DB2

....... CC FC[MW33]

B MW33

DO marker word 33

C DB0

Open DB2

.......

.......

.......

Call FC2 if RLO=1:

DO FW33

Process flag word 33

works only if FC2 has no parameters

JC FC0

Call FC2 if RLO=1: works only if FC2 has no parameters

The address operand, in which the number is stored (here MW33), can be in the following areas: marker, global data (DBX), instance data (DIX) and local data. In function blocks (FBs) it is only possible to use the area instance data (DIX) for the address operand in CODE_VERSION1 (nonmulti-instance-compatible FB). Register indirect addressing with area pointer Example for an internal area pointer STEP 7 L P#4.5

Equivalent in STEP 5

Load pointer for byte 4, L KF +4 bit 5

Load byte number

L KF +5

Load bit number

SLW 8

Move bit number in high byte

OW

Bit in high byte, byte in low byte

Example for cross-area pointer: STEP 7 L P#M 2.3

Load pointer for M2.3

Equivalent in STEP 5 ∅

Pointer calculations A decisive property of the area pointer is that pointer calculations can be made with the normal fixedpoint operations. So for any pointer the following holds:



Addition of 1: increase pointer to next bit. Addition of 8: increase pointer to next byte, leave bit number unchanged.

Examples: STEP 7 L P#M 2.3

Load pointer for M2.3

L P#4.5

Load pointer for byte 4,

Page 7 of 35

Equivalent in STEP 5 ∅ .......

.......

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

bit 5 +D

Result: pointer for M7.0, i.e. all 3 instructions are equivalent to: L P#M7.0 .......

∅

.......

.......

L P#DBX 2.3

Load pointer for global data bit 2.3

∅

L 16

Load 16

-D

Decreases pointer by 16 bits, i.e. all 3 instructions are equivalent to: L P#DBX0.3

.......

....... ∅

In calculations with area pointers, you can only use one pointer with area identifier (not equal to zero). Otherwise the points of the area identifier are "added" or "subtracted" and this results in an invalid identifier. Memory indirect addressing with area pointer Examples: STEP 7

Equivalent in STEP 5

L P#2.0

Load pointer for byte 2, L KF+2 bit 0

Load byte number

T MD44

Save in bit memory double-word 44

L KF +0

Load bit number

A I [MD44]

Query of input 2.0 for signal status 1

SLW 8

Move bit number in high byte

OW

Bit in high byte, byte in low byte

T FW44

Save in flag word 44

DO FW44

Process flag word 44

A I 0.0

Query of input 2.0 for signal status 1

.........

..........

.......

.......

L 123

Load 123

L KF +123

Load 123

T MW [MD44]

Save 123 in bit memory word 2

DO FW44

Process flag word 44

T FW 0

Save 123 in flag word 2

Page 8 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

The same statement applies for the location of the address operand (here MD44) in the possible memory areas as for indirect addressing with one number (see above). The difference however is that here you need a double-word. In the case of memory indirect addressing the area identifier in the pointer must be 0. You can only use internal area pointers. For indirect access to a byte, word or double-word the bit address in the pointer must be 0. Register indirect addressing with area pointer Examples: STEP 7

Equivalent in STEP 5

Example a L P#2.0

Load pointer for byte 2, bit 0

LAR1

Load pointer in address register 1

∅ .......

//Register indirect internal area addressing A I [AR1, P#0.0]

Query of input 2.0 for signal status 1

Example b LAR1 P#E 2.0

Load pointer for input 2.0

∅

//Register indirect external area addressing

.......

U [AR1, P#0.0]

.......

Query of input 2.0 for signal status 1

∅

Example c LAR1 P#DBX 2.0

Load pointer for global data bit 2.0

L MW [AR1, P#0.0]

Load marker word 2

.......

∅

.......

Example d1 LAR1 P#Q 2.0

Load pointer for output 2.0 in AR1

= [AR1, P#2.2]

Assign current RLO to output 4.2

∅

Example d2

Page 9 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

+AR1 P#2.0

Increase pointer in register by 2 bytes

T W [AR1, P#0.0]

Write low word from Accu1 to output 4.0

L P#4.5

Load pointer for byte 4, bit 5

+AR1

Increase pointer in register by Accu1

S [AR1, P#1.0]

Set output 9.5 if RLO=1

∅ .......

∅

For register indirect addressing the pointer can carry an area identifier:



If the identifier is missing (Example a), then you must specify this in the register indirect instruction. If the identifier is in the pointer (Example b), it can be dropped for the register indirect instruction. Note that in this case you must specify the access range Byte, Word, Double-word (Example d2) for the load and transfer instructions.

If the identifier is in the pointer and specified for the instruction (Example c), the area specified in the instruction is valid and the identifier in the pointer is then ignored. In the case of the register indirect instruction you can specify an offset (Example d). This is added to the pointer of the register when the access is executed. The register content itself remains unchanged. Use of the area identifier Local data area in the pointer is not possible in older CPUs. The offset designated in the bracket [AR1, ] can be in the area from P#0.0 to P#8191.7. The instruction "+AR1" takes into account only the low word of the offset designated in Accu1 or as designated as operand and interprets the 16 bits as number with sign:



P#0.0 ..... P#4095.7 is a positive offset for "+AR1" and P#4096.0 ..... P#8191.7 is a negative offset for "+AR1".

Example: L P#0.1

Smallest positive offset for "+AR1"

+AR1

Increases content of AR1 by P#0.1 .........

.........

L P#4095.7

Greatest positive offset for "+AR1"

+AR1

Increases content of AR1 by P#4095.7

.......

.......

L P#4096.0

Greatest negative offset for "+AR1": corresponds to "P#-

Page 10 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

4096.0" +AR1

Decreases content of AR1 by P#4096.0 !

.......

.......

L P#M 8191.0

Corresponds to "P#-1.0" ("+AR1" ignores identifier "M")

+AR1

Decreases content of AR1 by P#1.0 !

.......

.......

L P#8191.7

Smallest negative offset for "+AR1": corresponds to "P#0.1"

+AR1

Decreases content of AR1 by P#0.1 !

.......

.......

L P#E 8192.0

Corresponds to P#0.0" ("+AR1" ignores identifier "E")

+AR1

Content of AR1 remains unchanged !

Since the operation "+AR1" only takes the low word of Accu1 into account, pointers with area identifier can also be used. It doesn't matter if the identifier is in the high word, unlike pointer calculation with integer operations. Please note that independent of the options for increasing and decreasing the address register in a register indirect instruction, the register content must always be in the area from P 0.0 to P 65535.7. General remarks Analogous to Address Register 1, there is a second register AR2 in the CPUs with the same utilization options. There are restrictions on using the address registers. If you do not observe these, the user program might react unexpectedly. For more detailed information please refer to the Help functions of STEP 7, keyword "AR1". Help in deciding which indirect addressing options to choose:




When using the address registers you should give preference to register indirect addressing with internal area pointers. The memory area addressed with the instruction is visible here in the instruction. This makes the program clearer, less susceptible to faults and easier to maintain. Here you do not have to pay attention to the service life of the address operand. Utilization of the address register is always possible regardless of the DB opened or the local data.

The advantages of using memory indirect addressing with pointer in the marker area are:





You do not have to worry about the restrictions for using registers. Also here you don't have to worry about the service life of the address operand, because the marker area is available without restrictions at every point in the program. You can use multiple pointers in parallel. However, here you do not have the convenient options of "+ARi" and specification of an offset.

Note on working with pointers or ANY pointers:

Page 11 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683




Both contain the area pointer in the lowest value 32 bits as presented above.

When using indirect addressing, programming errors might not surface as quickly as when using direct addressing. Furthermore, data can be lost not only inadvertently in the desired memory area, but also unintentionally in other memory areas. Therefore, proceed carefully and test your program thoroughly! Note: More information and examples are available in the STEP 7 Online Help under





Format of the ANY parameter type. Format of the POINTER parameter type. Using the POINTER parameter type. Using the ANY parameter type.

How do access the I/O address area indirectly and what should you watch out for when copying with the SFC20? Instructions: A memory range, which is defined with the ANY pointer, for an I/O input module which does not lie within the process image, cannot be copied with SFC20 (BLKMOV). The input data, which lies outside the process image, must be copied to a global data block in consecutive order first of all. You can then copy the data from the global data block (source field) to the target field (outputs, flags, data blocks) with the SFC20. ANY pointer "P#PE300.0 BYTE 16 cannot be specified. Fig. 01 shows an example of how data is copied from the I/O input word PEW300 to the DB5 data block.

Fig. 01 Note: Please note that it takes a great deal of cycle time to use the SFC20 (BLKMOV) in the example above. Furthermore, this also involves the use of additional memory (second data block) on the automation system. In this case it would be better if only the load and transfer functions were applied, e.g. L PEW 300 T DB5.DBW0 Sample program for indirect addressing of the I/O address area: The following download "PAE.zip" contains a sample program for indirect addressing of the PQ area. You have only write access to the output modules and only read access to the input modules. The "PEA.zip" attachment contains the two STL sources:



Quelle_PEA.AWL: sample program with German comments. Source_PEA.AWL: sample program with English comments.

Page 12 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

PEA.zip ( 1 KB ) Keywords: Symbolic programming, Indirect addressing, Cross-area pointer Fig. 01

How can you access an element indirectly in STL in a two-dimensional array (e.g. a value in line 2 and column 5)? Instructions: A two-dimensional array contains a matrix consisting of rows and columns. If you want to access one element of the array, you must first calculate the address of the element. For this you add the line and column offsets. After converting the result into the pointer format you can indirectly access the element in the array using the address register. In this way it is possible to access the array elements variably. The "2D_Array" download attached contains a STEP 7 program that is based on a two-dimensional array of the type 25x25 REAL values. By specifying the line and column FC10 calculates the address and returns it to you as OUT parameter in the pointer format.

Fig. 01

Page 13 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

The calculation is based on the following premises:



The two-dimensional array consists of 25x25 REAL numbers. The array begins with a data block as from the address zero.

Definition of the array: ARRAY [1..25,1..25] OF REAL Column 1

Column 2

Column 3

Column 4

...

Column 25

Line 1

1,1

1,2

1,3

1,4

...

1,25

Line 2

2,1

2,2

2,3

2,4

...

2,25

Line 3

3,1

3,2

3,3

3,4

...

3,25

...

...

...

...

...

...

25,1

25,2

25,3

25,4

...

25,25

... Line 25

Note: If the premises described above are not given, then accessing non-existent memory areas might cause the CPU to go into STOP mode. The attached download "2D_Array" contains a STEP 7 project with the blocks described above (FC10, DB10 and OB1). The blocks with the German comments are in the "Deutsch" station and the blocks with the English comments are in the "English" station.

2D_Array.zip ( 322 KB ) Copy the "2D_Array" file into a separate folder and then start the file with a double-click. The STEP 7 V5.3 project then unpacks automatically with all the associated subdirectories. You can use the SIMATIC Manager to open and process the extracted project. Runnability and test environment: The example can be used on all the CPU types of SIMATIC S7-300, S7-400, C7 and WinAC. The following table lists the components that have been used to create this entry and verify the functions described. Test environment

Version

PC platform

Pentium(R) M Processor 1.73 GHz

PC operating system

Windows XP SP2

STEP 7

STEP 7 V5.3 SP1

Option package

S7-PLCSIM V5.3

Keywords: Indirect addressing Fig. 01

Page 14 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

In the case of a function, how is the address of the ANY pointer for the elementary IN, OUT and INOUT parameters loaded into the address register AR1? Instructions: The statement "LAR1 P##PointerInput", for example, is invalid in a function (FC) (Fig. 01). When you enter a command or attempt to save the block, you get the following error message: 30:9: "Compilation of the Network 1 is not possible, because it still contains invalid statements." However, the same statement is valid in a function block (FB). This error message is only a secondary message that is always displayed if statements are marked red when saving. When you load the ANY pointer into address register AR1 and into address register AR2, you must note the following for function blocks and functions:



In the case of an FB, the transferred ANY pointer is stored in its assigned instance DB. In the case of an FC the transferred ANY pointer is stored in the caller's local data stack.

Page 15 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

No. STEP 7 error message 30:9 when saving 1

ANY pointer sample program

Fig. 01 2

The statement "LAR1 P##PointerInput" is valid for FBs.

Fig. 02 In FCs, the address must first be loaded into Accu1 with the statement "L P#PointerInput" and from there loaded into the AR1 register with the statement LAR1. 3

The difference between an FB and an FC is that with the statement "LAR1 P##VariableName"



In an FC you can only access the TEMP variables (local data stack). In FBs you can also access the IN, OUT, IN-OUT and STAT variables.

Fig. 03 shows you an example of how to access a TEMP variable in an FC.

Fig. 03 4

Fig. 04 shows an example of how data of the ANY variable (IN variable) can be transferred in an FC. The data is transferred from address register AR1 into temporary variables for further processing. By way of example, the address of the IN variable "Input" (Type: ANY) is first

Page 16 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

loaded into Accu1 and from there into the AR1 register. The base address can be transferred from address register AR1 into the temporary variable "bit_adr" (Type: DWORD).

Fig. 04 Keywords: Symbolic programming Indirect addressing Cross-area pointer

Fig. 01

Fig. 02

Page 17 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

Fig. 03

Fig. 04

Page 18 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

How can you calculate an offset for an ANY pointer or change the pointer? Instructions STEP 7 saves the data of the parameter type ANY POINTER in 10 bytes. All 10 bytes must be occupied for configuring the ANY pointer and also for calculating an offset. Detailed information on configuring the parameter types POINTER and ANY POINTER is available in the STEP 7 Online Help under



Format of the ANY parameter type Format of the POINTER parameter type.

An offset is added to the memory area in which the information is stored and stored in the doubleword 6 in the area reserved for the ANY pointer. Fig. 01 shows an example of data storage in a defined area.

Page 19 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

Fig. 01 With system function SFC20 the data is copied byte for byte from a DB10 to a DB20. In DB20 a start of area is defined for data storage (e.g. DB20.DBX2.0). Using this start of area and an offset (here 4 bytes) the data is stored in the desired memory area of DB20. The first data from the address DB10.DBX0.0 is therefore copied into the address DB20.DBX6.0.

Page 20 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

No. Procedure 1 FC12 adds the offset (IN variable "Offset" of the INT type) to the start of area address (IN variable "Start of area" of the BOOL type) and the result is then stored in the double-word 6 of the address register AR1. The data area for the data to be stored is then output via the OUT variable "Area_Pointer" of the ANY type.

Fig. 02 2 FC12 is called and parameterized in OB1. The result of the OUT variables "Area_Pointer" from function FC12 is copied into a buffer (TEMP variable "Area", Type: and transferred to parameter "DSTBLK" of the system function SFC20. In this way the data is transferred from DB10 into the desired address area of DB20.

Fig. 03 Download Copy the "STEP7_V55_Offset_P.zip" file into a separate directory and then start the file with a double-click. The STEP 7 V5.5 project is then extracted automatically with all the associated subdirectories. You can then use STEP 7 V5.5 to open and process the extracted project.

Page 21 of 35

2/24/2012 3:06:40 PM

http://support.automation.siemens.com/US/view/99/24519683

STEP7_V55_Offset_P.zip ( 32 KB ) Block for changing the pointer You can change the bit or byte address of a pointer using the enclosed function FC5. When you call this function, the pointer to be changed is transferred to the "Pointer" variable. You can use internal or cross-area pointers in the double-word format. Using the "Bit_Byte" parameter you can choose whether you want to change the bit or byte address of the pointer (0: bit address, 1: byte address). For the "Inc_Value" variable (in the integer format) you must specify the number that is to be added to or subtracted from the address content. Here you can also specify negative number to decrement the address. If you change the bit address, there is transfer to the byte address (also for decrements); for example:



P#M 5.3, Bit_Byte = 0, Inc_Value = 6 => P#M 6.1, or P#M 5.3, Bit_Byte = 0, Inc_Value = -6 => P#M 4.5.

Note The area information of the pointer is not affected by the function. In the case of over-run or under-run of the pointer, the point is not changed and the "RET_VAL" variable on the output side is set to True until the next correct processing of the function. This is the case if the




Bit address is selected and Inc_Value >7, or