Step 7 Connecting, Downloading and Uploading

These are general guidelines for connecting, downloading and uploading from an S7-300 or S7-400 PLC. The following procedures were created using Siemens SIMATIC STEP 7 version 5.4 software.

To start, open the SIMATIC Manager.

Now follow the links below.

Step 7 Lite, Step 7 and Step 7 Professional Differences

The Case of the Missing SIMATIC Step 7 Documentation

“We had documentation at one time.”

Sound familiar?  Have you suddenly found changes that have been made in the PLC but not in the offline program?  Nobody knows what happened.

Unfortunately this is an all too common phenomena with the Siemens SIMATIC Step 7 software.  The problems stem from the flexibility of the software both for downloading and editing the online program.  If the person is not familiar with the software it’s very easy to get confused if the changes are being made on the computer or in the controller.

How to solve this problem?  Let’s first of all review some basic terminology.  After that is a step by step best practice when editing programs.  Finally, we’ll highlight the pitfalls and the indicators that tell you whether you are offline or online.  This procedure applies to SIMATIC Step 7 version 5.4.

Terminology

Offline program – The program that is stored on the hard disk of the computer.  This will contain the documentation.  It’s very important to keep a pristine copy of the offline program as the associated documentation is not stored in the PLC.

Online program – This is the program resident in the PLC. 

Download – The act of taking the offline program on the computer and downloading it into the PLC.

Upload – Taking the program in the PLC and bringing it up to the computer.  Doing this without having the associated offline program open will cause a loss of documentation.

Save – Stores the open block onto the hard drive.  It’s important to realize that an edited block can be downloaded to the PLC without saving it offline.  Note that this only saves the opened block and not any others that are concurrently open.

These may seem like simple terms but it’s important to understand how they’re used in the Siemens environment.

Here are some other terms that may come up.

PG/PC – This is Siemens way of referring to a PC or laptop running the SIMATIC software.

Nodes – Refers to any programmable device (in our case a PLC) in the network which will have its own unique address.

Best Practice

The best practice is to make sure you are working from an offline file.  There really isn’t any reason to be working on the program inside the PLC.  Of course, this assumes that you have a good working copy to begin with.  The “golden” copy of the program should live somewhere on a network server or have a dedicated place on one computer or laptop.  I’ve even heard of some companies using USB memory sticks to store the latest and greatest which is great but an original copy should still live on a computer that is backed up.

1. Open the offline file from the File pull down menu and select Open or use the  Open Project icon  on the toolbar.  In the dialog box select the project under the User Project tab. Click OK.  You may have to select Browse to find it in the directory structure.  Note if the Manager was closed with a project open then it will open back up to that project automatically.
2. Expand the project tree down to the program files and select the Blocks folder.  Good practice dictates that all blocks should be opened from here.
3. Once changes have been made:
1. Save the block to the hard disk by clicking the Save icon (or menu item File | Save)
2. Download the block by clicking the Download icon (or menu item PLC | Download).  If the block all ready exists in the PLC then it will confirm that you want to overwrite it¹.  Click Yes.
3. Note that downloading from here only sends that one block to the PLC.  It does not download the entire program.
4. To monitor the block make sure to open it using steps 1 through 3 and then press the Monitor icon (or menu item Debug | Monitor).  The window’s title bar will highlight a lovely shade of blue to indicate a connection to the CPU.  It’s important to note here that you are still working with the program on the computer and not the PLC.  If the procedure in step 3 has not been followed then discrepancies can occur between what you are monitoring in the PLC and what is displayed in the SIMATIC software.

That’s it.  Following these simple steps will save a lot of headaches.

The Pitfalls and Warning Signs

So where do some people get lost?  Here are some common mistakes and their warning signs.  If you get any of these dialog boxes then you should really back out and start over because you’re on the road to losing your documentation.
 

The result of opening the block looks like this

This is an example void of documentation.  Notice the local parameters all say TEMP.  There are no comments or titles.  There are no symbols so it’s all in direct addressing.  The properly documented copy looks like this...

Pitfall #1 – Using Accessible Nodes to Open Blocks

The  Display Accessible Nodes  selection under the PLC menu is a handy way to see what is connected to the network but it should never be used to open blocks.  Opening blocks from here uploads it straight from the PLC and produces the warnings dialog boxes shown above.

Pitfall #2 – Viewing Online from SIMATIC manager

Once a project is open and a connection to a PLC is established then selecting the Online button (menu View | Online) brings up a similar project tree showing the contents inside the PLC.  The window title bar is highlighted in blue to indicate its online status.  Working from this window presents less of a danger for losing documentation but it is confusing and could lead to problems.  For instance if a block is renamed offline and then the old one is opened online then it will have no associated documentation.

The proper way to view a block online is to open the block and select the Establish Connection to Configured CPU icon .  Just make sure what you are viewing has been downloaded to the PLC.

Pitfall #3 – Opening the Online Partner

If an offline block is open then selecting the  Open Offline/Online Partner icon (menu item File | Open Online) will switch it to the online version of the block for editing.  Essentially this puts you in the same place as pitfall #2.

Conclusion

Programming with SIMATIC Step 7 is different enough from other types of PLCs to throw off the casual user.  Always working from the offline copy will make it less likely to screw up.  Opening up a block from the accessible nodes window is always a no-no.  Likewise, opening a block from a window that has a highlighted blue title bar will also cause potential problems.  Be sure and read all dialog boxes especially the ones we’ve shown in the article.  Avoid the pitfalls and keep that documentation.  Mystery solved.

Footnote:

(1) Siemens dialog boxes have an option that says, “Do not display this message again.”  This is handy for some annoying pop ups but it is really not a good idea to turn off important ones like warnings for overwriting blocks.  These warnings are especially crucial if you are working on real machinery.  If more then one person is using the software then you can reset these messages to display again by going to the SIMATIC Manager and select the menu Options | Customize.  Click the General tab and press the Activate button.  If it’s grayed out then all messages are set to display.

S7 Library Functions

I couldn't find a complete listing of all the function blocks in the standard Siemens S7 Libraries so I made one myself. It helps me get a better overview of what is available. The complete listing is also available as an Excel spreadsheet so you can sort or adjust to your needs.

System Function Blocks

System Function Calls

S5-S7 Converting Blocks

IEC Function Blocks

PID Control Blocks

Communication Blocks

TI-S7 Converting Blocks

Miscellaneous Blocks

Siemens Technical Terms

Otherwise known as Siemens speak. Here's a list of Siemens specific abbreviations and their meanings.

Step 7 Elementary Data Types

S5TIME NOTES

• Underscores in time and date are optional
• It is not required to specify all time units (for example: T#5h10s is valid)
• Maximum time value = 9,990 seconds or 2H_46M_30S

S5TIME Format

Symbol Table Allowed Addresses and Data Types

Siemens S7 Indirect Addressing

by Automation Training

The following is provided by Automation Training from their excellent Siemens Step 7 training manual. This is a really nice explanation of a difficult but important subject. Check out their website for hands-on and online training classes.

Introduction

The most common form of addressing used in the Siemens S7 PLCs is direct and symbolic. When a direct addressed is referenced by an instruction there is no question as to the location in memory. The following are examples of direct addressing:

By using the methods of indirect addressing the address used by an instruction can be varied to point to any number of locations. In this case, a memory location stores a “pointer” to another memory location. While this may increase the difficulty of troubleshooting, its advantage is to greatly reduce the number of networks and instructions needed to control a process. It is also a method that must be understood to use some of the library and system function calls provided by Siemens.

The POINTER and ANY Data Types

A POINTER data type is used to format a number to be accepted as an address rather then a value. A pointer is always preceded by a P# symbol. The pointer address may be in three different formats.

The ANY data type is used to pass a parameter of an unknown or undefined data type. Some functions in the library use the ANY data type to work on whole sections of memory. To do this, the last pointer method is used to describe an area. For example the address P#DB25.DBX 0.0 Byte 14 points to the first byte of DB25 with a length of 14 bytes.

NOTE: A DINT can be converted to a POINTER by simply shifting the double word left by 3 bits.

Data Block Instructions

When working with indirect addressing it is sometimes needed to first of all open a DB and then begin working on the
address without directly referring to any one DB. This is done using the OPN instruction. The OPN instruction can open either a shared data block (DB) or an instance data block (DI).

When monitoring in STL the shared DB number is displayed in the DB1 column and the instance DB number is displayed in the DB2 column.

Furthermore, there are instructions to confirm that the correct DB number is opened and that it is large enough for the next operation.

Memory Indirect Addressing

The first method of indirect addressing is called memory indirect addressing because it allows for a memory location (M, DB or L) to determine or point to another.

The memory area identifiers T, C, DB, DI, FB and FC use a word (16-bit) pointer location in integer format. Two examples are as follows:

The memory area identifiers I, Q, M, L, DB use a double word (32-bit) location using the POINTER data type.

When monitoring memory indirect addressing the INDIRECT column displays the current address the instruction is using.

Note that math can be done on the POINTER data type using the double math instructions (e.g. P#2.0 + P#5.0 = P#7.0).

Since the bit position only goes to eight the result of P#8.7 + P#1.1 = P#10.0 and not P#9.8. These methods can be used to offset the address or increase/decrease the pointer in a loop.

The Address Registers

Besides the regular accumulators, there are two 32-bit address registers (AR1, AR2) for storing pointers used in register indirect addressing methods. A series of different load and transfer type instructions can be used to work with AR1. A similar set is available for AR2.

Addition can be directly accomplished on AR1 and AR2 with the following:

Area-Internal Register Indirect Addressing

The area-internal register indirect addressing method uses one of the address registers plus a pointer to determine the address the instruction is to reference. The format is:

address identifier [address register, pointer]

The address identifier can be I, Q, M, L, DI or DB in bit, byte, word or double word form. The address register must be previously loaded with a double word pointer without reference to the address identifier. The exact address is determined by adding the address register with the pointer. The example below shows the area-internal method using bit locations.

Area-Crossing Register Indirect Addressing

Area-crossing register indirect addressing is similar to the area-internal method except the pointer loaded into the address register references a memory area (e.g. P#M10.0 or P#DBX0.0). This means the address identifier used before the opening bracket is not needed if referencing a bit otherwise it will be a B for byte, W for word or D for double. The example below shows the area-crossing method using bit locations.

This next example shows area-crossing methods using a word and double word format.

Exercise #1

1. Comment the lines of STL below to describe what this network does:

2. Enter the code, monitor it and verify your answers.

Exercise #2 (Advanced)

1. Create a DB with an array of 10 real numbers. Populate the array with random values.
2. Create a function that will return the max number in the array and its position. Use the indirect addressing method of your choice.

Siemens S7 Status Word

In Siemens PLCs the Status Word is an internal CPU register used to keep track of the state of the instructions as they are being processed.  In order to use STL more effectively it is important to understand the Status Word and its functions.

Each bit in the Status Word has a specific function to keep track of bit logic (RLO, STA), math (OV, OS), comparison operations (CC0, CC1) and whether the logic should continue, be nested or start new (/FC, OR, BR).  Only the first 9 of the 16 bits are used.

Bit Positions

Each instruction may do the following to each bit in the status word.

The status word can be seen by displaying the STATUS column while monitoring in STL view.  The RLO (bit 1) and the STA (bit 2) are also displayed in the RLO and STA column.

The Most Important Status Word Bits

/FC – First Check (bit 0)

If the /FC bit is a 0 then the instruction is considered to be the first instruction being processed.  If the /FC is a 1 then the instruction being scanned will use the logic from the previous instruction. Certain instructions like =, S and R will set the /FC bit to 0 thus starting new logic after it.  Other instructions like A or O will set the /FC bit to 1 signalling to combine the logic with the next instruction.

RLO – Result of Logic Operation (bit 1)

The RLO bit stores the running logic state of the currently processing instructions.  Certain bit logic and comparison instruction will turn the RLO to a 1 when the condition is TRUE and write a 0 when the condition is FALSE.  Other instructions read the RLO (=, S, R) to determine how they are to execute.

STA – Status (bit 2)

The STA bit reflects the state of the current Boolean address.

Help with RLO, STA and /FC

If you are used to ladder logic and struggling to understand the purpose of the RLO and STA it may help to visualize a rung like below.  The STA is used to keep track of the state of the addresses.  The RLO is used to keep track of the state of the rung.

The equivalent STL is shown below.

It steps through the logic as follows:

1. At the start the First Check bit (/FC) is zero so an And instruction will logically mirror the Status bit (STA) over to the Result of Logic Operation (RLO).  In this case the address I0.0 is 1 so the STA is one and the result of the logic (RLO) will be 1.  The A instruction writes a 1 to /FC.
   
2. On the second line, the /FC bit is now 1 indicating that this line needs to use the RLO from the previous line.  The address I1.1 is on so the STA = 1.  The RLO from the last line is 1 and this is ‘anded’ with the current STA with a result of 1 in the current RLO.
   
3. The same thing happens on the second line but this time 1 and 0 makes the current RLO = 0.
   
4. The fourth is the Assign instruction which takes the RLO and writes it out to the corresponding address.  In this case the final RLO = 0 so the output will be off.  If M0.0 was 1 then the “And” operation will evaluate to true making the RLO = 1 which will then turn on the output Q1.0.
   

The Other Status Bits

OR (bit 3)

The OR bit is used for combining AND functions before OR functions.

OS – Overflow Stored (bit 4)

In the event of an overflow (OV bit 5) the OS bit will store the value even after the OV bit has been reset.  The following commands reset the OS bit: JOS (Jump if OS=1), block call instructions, block end instructions.

OV – Overflow (bit 5)

The OV bit is set by a math instruction with floating point numbers after a fault has occurred (overflow, illegal operation, comparison unordered). The OV bit is reset when the fault is eliminated.

CC0, CC1 – Condition Code (bits 6 and 7)

The Condition Code bits provide results for comparison and math instructions.

Comparison Instructions

Math Instructions, without Overflow

Integer Math Instructions, with Overflow

Floating Point Math Instructions, with Overflow

Shift and Rotate Instructions

Word Logic Instructions

BR – Binary Result (bit 8)

The Binary Result transfers the result of the operations
onto the next instruction for reference.  When the BR bit is 1 it enables the output
of the block (ENO) to be TRUE and thus allow other blocks after it to be
processed.  The SAVE, JCB and JNB instructions set the BR bit.

Statement List (STL) Cheat Sheets

If you are a Siemens PLC user then you've more then likely have run into Statement List (STL) programming. STL corresponds to the Instruction List language defined in the IEC 61131-3 specification. The programming is done with very simple mnemonics that can be hard to remember if you don't use it very often.

These cheat sheets provide a quick reference guide for all the instructions and formatting. They are two pages long but if you can print on the front and back then they make for a nice one sheet reference.

STL Listed Alphabetically

Best used when trying to interpret an existing program.

Download: PDF (131KB)

STL Listed by Category

Best when doing programming.

Download: PDF (140KB)

Connecting IFIX SCADA to Siemens S7 using TCP/IP

Setting up an S7 connection using TCP/IP

The TCP/IP method of communication to the S7-300 and S7-400 PLC's via TCP/IP communication module uses the S7WIN, S7WINSP, S7NT, or S7NTSP protocol.

Software requirements

• Siemens SIMATIC NET software v6.1 SOFTNET-S7 Industrial Ethernet
• IFIXSCADA v5.x or above
• Windows XP + SP1

Hardware requirements

• Standard network card
• S7-300 with CPU315-2 DP
• Siemens power supply PS30/5A
• Siemens CP343-1 TCP

The hardware modules occupy the following slots in the Siemens PLC:

1. Siemens power supply
2. S7-300 CPU 315-2 DP
3. Ethernet CP343-1 TCP

Example configuration

All wiring should be installed according to Siemens documentation.

Installing the SIMATIC NET software

You must log in as an Administrator to install the SIMATIC NET software. Close all other running applications, including any antivirus software you may be running.

1. On the SIMATIC NET flash screen, start the installation by clicking Install SIMATIC NET Software.
2. The PC configuration screen appears. Click Next.
3. Select the English language option, then click Next. Click Next again.
4. Click yes to the licensing agreement screen.
5. Enter your Name and Company on the User Registration screen.
6. If you already have SIMATIC NET software installed, this will be the drive selected by default. Clear the Run automatic authorization option, and then click next. The Setup: Configuration screen appears.
7. Select all application options to be installed. (This is necessary if you do not already have STEP7 installed on your machine. If STEP7 v5.2 or higher is already installed, you do not have to select the NCM PC/S7 v5.2 application.) Click Next.
8. The applications you selected are installed. At the prompt, click OK to restart your system. The system restarts and installs the selected applications. Click Finish to restart your system again.

The SIMATIC NET software is now installed.

Configuring the SIMATIC NET software

This step involves using the Commissioning Wizard to configure the software you installed in the previous step.

Configuring the module

When your system restarts after the software has been installed, your system's hardware configuration is scanned. The Commissioning Wizard appears automatically. (You can also access the Commissioning Wizard at Start/Simatic/SIMATIC NET/Settings/Commissioning Wizard.)

The number of steps required depends on the number of PC Ethernet cards (or modules) detected in your PC. The more modules you operate in the computer, the more steps are required.

1. Click Next.
   
   An Ethernet Network Card with with the IP addresses settings shown above was found. This is the network card that will be configured for communication with the Siemens PLC. This is put on index 5.
   
   Note: The index of the network card can be set with the NCM PC Configuration (hardware configuration). The station index defaults to 5 if you use the Commissioning Wizard.
   
   
2. Select the Use the module for productive operation in configured PC station option, and then click next.
3. Clear the SIMATIC NET OPC Server in configured PC Station option and select the Configure more applications option. Then click next.
4. Register the names for your user application: enter VFD1 in the Name text box. This user application is put on index 1. Click Next.
   
   Note: The name of the application is the VFD name. This comes later in the IFIX Project Editor under Communication | Ports in the Special options text box.
5. Click Next. This screen appears, confirming you have completed configuring the module:
6. The configuration is saved and the PC station is reconfigured. Your existing configuration data is overwritten. Click OK to confirm at the prompt.

This completes the module configuration.

Configuring the project with the PC Station Wizard

The next step to configure the project using the PC Station Wizard.

1. Start the PC Station Wizard.
2. Choose Create a new project and configuration. A new project is created. Click Next.
3. Define a new Project name; this example uses IFIXS7. Specify where the copy of the local PC station settings resides, and then click Next.
4. Select the Edit network and connection configuration option, and then click Finish. NetPro automatically starts, displaying the network configuration.
5. Click the Application box in the PC station, and then choose Insert | New Connection. The Insert New Connection dialog box appears.
6. Choose the Unspecified item in the tree. From the Type menu in the Connection area, choose S7 connection. Then click Apply, and then click OK.
7. In the Properties -S7-Connection dialog box, the local IP Address should be the address of the Ethernet card in the PC. This example uses 192.168.0.190. The partner IP Address should be that of the Ethernet CP343 module in the PLC, in this case 192.168.0.148. The Local ID is the connection identifier of this connection (here it is S7-Connection_1). It will be used later on as the address of the IFIX I/O device. Click Address Details.
   
   Note: The Local ID S7-Connection_1 is used later in the IFIX Project Editor under Communication | I/O Devices in the I/O Device Address text box. This name is case-sensitive and cannot not contain any spaces.
   
   
8. In the Address Details dialog box, enter the card location of the CPU that the SIMATIC S7 communicates with. Here the card location is 2. Click OK.
   
   Note: Some power supplies might occupy 2 slots. If so, the card location of the CPU is one higher at 3.
   
   
9. In the NetPro window the new S7-Connection_1 connection appears. Choose Network | Save and Compile. The Save and Compile dialog box appears.
10. Select the Compile and check everything option, and then click OK.
11. After completing the save and compile operation, a message appears in the NetPro window. This indicates the warnings and errors present in the configuration. If warnings occur here, then this is to be handled as information only. But if errors occur, the project configuration cannot be loaded. To view errors, choose View |Outputs.
12. Highlight by clicking on the PC Station (TESTXP). Afterwards the connection table disappears in the message window. From the NetPro menu choose PLC | Download | Selected Stations to transfer the project configuration to the PC. Alternatively, right-click the PC Station and choose Download | Selected Stations.
13. To confirm the overwrite of configuration data and to proceed with the download, click Yes.
14. To confirm stopping the Target Module (Network interface Card), click OK.
15. The configuration should now be successfully loaded. Exit NetPro and click next, and next again to finish the Commissioning Wizard. If you have errors, see for details.

Defining an access point for the application

The next step is to define an access point for the application.

1. The Configuration Console should appear after terminating the Commissioning Wizard. If it doesn't, open the Configuration Console by selecting START / SIMATIC / Simatic Net / Settings / Configuration Console.
2. In the Configuration Console dialog box, right-click the Access Point object, and choose New | New access point.
   
   Note: You can choose any name for the Access point, but it cannot contain spaces and be longer than 32 characters.
   
   
3. In the New access point dialog box, enter your access point name (this example uses IFIXS7). Select the hardware component that will be associated with this access point (TCP/IP -> ASUSTeK/Broadcom 440x in the example).
   
   Note: The access point name is used later in IFIXSCADA in the Project Editor under Communication | Boards in the Special Options text box. The access point name is case-sensitive.
   
   After creating the access point the Configuration Console should look like this:
4. Close the Configuration Console.

This completes the Simatic NET software configuration.

Configuring the S7 driver

The IFIX S7 driver needs three names (settings) from the SIMATIC NET software
configuration. The following points are needed:

Using the Express Wizard

You use the Express Wizard to configure your communications.

1. In IFIX Explorer, create a new (empty) test project.
2. In the IFIXSCADA Project Editor, choose Communication | Express Wizard.
3. In the wizard:
   • Create a new I/O Servers e.g. IOServer.
   • Create a new I/O Device e.g. IODev.
   • Select external as the type of the I/O Device (PLC): Select the Siemens | S7-300 or S7-400| TCPIP using NE2000 network CARD for Windows NT for NT/W2K/XP/2003, or the TCPIP using NE2000 network CARD for Windows 95/98 for 95/98/ME option.
4. Define the name of the connection. In this example it is S7-Connection_1.
   
   Note: Do not select the Link I/O Device to an external tag Database option.

This completes this section.

Setting the Access Point

The next step in the process is to set the access point of the application.

1. Open the Boards dialog box by choosing Communication | Boards.
2. In the Special Opt text box, enter the access point of the application. This example uses IFIXS7.

Setting the VFD name

The next step is to set the VFD name.

1. Open the Ports dialog box by choosing Communication | Ports.
2. In the Special Opt text box enter the VFD Name. In this case VFD1.

Checking the name of the S7 connection

The next step is to check the name of the S7 connection.

1. Open the I/O Device dialog box by choosing Communication | I/O Devices.
2. In the Address field enter the name of the connection to the PLC. This example uses S7-Connection_1.

Variable declaration

The next step is to declare the variables.

1. Open the Tags Form by choosing Tags | Variable Tags.
2. Create a variable with the following information:
   • Variable Tag Name: TestInteger
   • I/O Device Name: IODev
   • Type: INT
   • Address: DB190,0

Troubleshooting your S7 connection

Question: I receive the following error message when downloading the PC station in the SIMATIC NCM PC manager:

• "The module "station manager" cannot be contacted. Change the on-line interface."
• "For On-line connections via the PC internal interface a station name must be assigned in the component configurator. This name must be identical to the name of the PC station, as configured in the STEP7 (or Simatic Net) project."
• "Online: No connection could be made. The participant does not announce itself."

Solution

1. Check in SIMATIC NCM PC Manager under the Menu option Options | Set PG/PC Interface, whether the point of entrance S7ONLINE is linked with the PC internal (local) interface.
2. The Station Configuration Editor tells you whether your module is Online. You can start the Station Configuration Editor by double-clicking the icon. This should not be OFFLINE, so to change its mode of operation, click Change Mode. The mode of operation should now change to ONLINE.
3. Check the station name in the Station Configuration Editor. This must match with the name in SIMATIC NCM PC Manager. You can change the station name in the Station Configuration Editor by clicking Station Name.
4. Open the Station Configuration Editor and the SIMATIC NCM PC Manager. Check the order and the number of configured components and the indexes that are used. These should match.