THE STEP7 PROGRAMMING LANGUAGE

STEP 7 is the standard software package used for configuring and programming SIMATIC programmable logic controllers. It is part of the SIMATIC industry software. Basic algorithm for an automation process:

Programs in a CPU In a CPU, two different programs are always executing:

The operating system The user program.

Operating System Every CPU has an operating system that organizes all the functions and sequences of the CPU that are not associated with a specific control task. The tasks of the operating system include the following:

Handling a warm restart and hot restart Updating the process image table of the inputs and outputting the process image table of the outputs Calling the user program Detecting interrupts and calling the interrupt OBs Detecting and dealing with errors Managing the memory areas Communicating with programming devices and other communications partners

If you change operating system parameters (the operating system default settings), you can influence the activities of the CPU in certain areas. User Program You yourself must create the user program and download it to the CPU. This contains all the functions required to process your specific automation task. The tasks of the user program include the following:

Specifying the conditions for a warm restart and hot restart on the CPU (for example, initializing signals with a particular value) Processing process data (for example, logically combining binary signals, reading in and evaluating analog signals, specifying binary signals for output, outputting analog values) 1

Specifying the reaction to interrupts Handling disturbances in the normal running of the program

STEP7 programs can be written in three types of languages; LAD (Ladder Logic Diagrams), STL (Statement List) and FBD (Function Block Diagram). LAD is like circuit diagrams to show power flow in terms of contacts and blocks. STL is an assembly like language which is the fastest of all in compiling and FBD is a language consisting of logic blocks like AND, OR and XOR gates. Objects and Object Hierarchy In the same way that the Windows Explorer shows the directory structure of folders and files, the object hierarchy for projects and libraries in STEP 7 is shown in the SIMATIC Manager. The following figure shows an example of an object hierarchy.

Objects have the following functions:

Carriers of object properties, Folders, Carriers of functions (for example, to start a particular application).

Block Types There are several different types of blocks you can use within an S7 user program: Block Brief Description of Function Organization blocks (OB) System function blocks (SFB) and system functions(SFC) Function blocks (FB) Functions (FC) Instance data blocks (instance DB) Data blocks (DB) OBs determine the structure of the user program. SFBs and SFCs are integrated in the S7 CPU and allow you access to some important system functions. FBs are blocks with a "memory" which you can program yourself. FCs contain program routines for frequently used functions. Instance DBs are associated with the block when an FB/SFB is called. They are created automatically during compilation.

DBs are data areas for storing user data. In addition to the data that are assigned to a function block, shared data can also be defined and used by any blocks. OBs, FBs, SFBs, FCs, and SFCs contain sections of the program and are therefore also known as logic blocks. The permitted number of blocks per block type and the permitted length of the blocks is CPU-specific.

Elementary Data Types Each elementary data type has a defined length. The following table lists the elementary data types. Range and Number Notation (lowest to Type and Size Format Options highest value)_ Description in Bits BOOL(Bit) BYTE (Byte) WORD (Word) 8 16 1 Boolean text Hexadecimal Binary number Hexadecimal number BCD TRUE/FALSE B16#0 to B16#FF 0 to 2#1111_1111_1111_1111 W#16#0 to W#16#FFFF C#0 to C#999

Decimal number unsigned B#(0.0) to B#(255.255) DWORD (Double word) 32 Binary number 2#0 to 2#1111_1111_1111_1111 1111_1111_1111_1111 Hexadecimal number DW#16#0000_0000 to DW#16#FFFF_FFFF Decimal number unsigned B#(0,0,0,0) to B#(255,255,255,255) -32768 to 32767 L#-2147483648 to L#2147483647 Upper limit: 3.402823e+38 Lower limit: 1.175 495e-38 S5T#0H_0M_0S_10MS to S5T#2H_46M_30S_0MS and S5T#0H_0M_0S_0MS

INT (Integer)

16

Decimal number signed Decimal number signed IEEE Floating-point number S7 time in steps of 10 ms (default)

DINT 32 (Integer, 32 bits) REAL (Floating-point number) 32

S5TIME 16 (SIMATIC time) TIME (IEC time) DATE (IEC date) 32 16

IEC time in steps of 1 ms, -T#24D_20H_31M_23S_648MS to integer signed T#24D_20H_31M_23S_647MS IEC date in steps of 1 day D#1990-1-1 to D#2168-12-31 Time in steps of 1 ms ASCII characters TOD#0:0:0.0 to TOD#23:59:59.999 'A','B' etc.

TIME_OF_DAY 32 (Time) CHAR (Character) 8

8 bits

8 bits

8 bits

8 bits

MB0 MW0

MB1 MD0

MB2 MW2

MB3

Program elements
Some of the LAD programming elements and their usage are given below. Normally Open Contact <address> ---| |--Format: Parameter <address>

Data Type Memory Area BOOL I, Q, M, L, D, T, C

Description Checked bit

Description of instruction: ---| |--- (Normally Open Contact) is closed when the bit value stored at the specified <address> is equal to "1". When the contact is closed, ladder rail power flows across the contact and the result of logic operation (RLO) = "1". Otherwise, if the signal state at the specified <address> is "0", the contact is open. When the contact is open, power does not flow across the contact and the result of logic operation (RLO) = "0". When used in series, ---| |--- is linked to the RLO bit by AND logic. When used in parallel, it is linked to the RLO by OR logic.

Normally Closed Contact <address> ---| / |--Format: Parameter <address>

Data Type BOOL

Memory Area I, Q, M, L, D, T, C

Description Checked bit

Description of instruction: ---| / |--- (Normally Closed Contact) is closed when the bit value stored at the specified <address> is equal to "0". When the contact is closed, ladder rail power flows across the contact and the result of logic operation (RLO) = "1". Otherwise, if the signal state at the specified <address> is "1", the contact is opened. When the contact is opened, power does not flow across the contact and the result of logic operation (RLO) = "0". When used in series, ---| / |--- is linked to the RLO bit by AND logic. When used in parallel, it is linked to the RLO by OR logic. 4

Output Coil <address> ---( )---

Format: Parameter <address>

Data Type BOOL

Memory Area I, Q, M, L, D

Description Assigned bit

Description of instruction: ---( ) ---(Output Coil) works like a coil in a relay logic diagram. If there is power flow to the coil (RLO = 1), the bit at location <address> is set to "1". If there is no power flow to the coil (RLO = 0), the bit at location <address> is set to "0". An output coil can only be placed at the right end of a ladder rung. Multiple output elements (max. 16) are possible (see example). A negated output can be created by using the ---|NOT|--- (invert power flow) element. MCR (Master Control Relay) dependency: MCR dependency is activated only if an output coil is placed inside an active MCR zone. Within an activated MCR zone, if the MCR is on and there is power flow to an output coil; the addressed bit is set to the current status of power flow. If the MCR is off, a logic "0" is written to the specified address regardless of power flow status.

Positive RLO Edge Detection <address> ---( P )--Format: Parameter <address>

Data Type BOOL

Memory Area I, Q, M, L, D

Description Edge memory bit, storing the previous signal state of RLO

Description of instruction: ---( P )--- (Positive RLO Edge Detection) detects a signal change in the address from "0" to "1" and displays it as RLO = "1" after the instruction. The current signal state in the RLO is compared with the signal state of the address, the edge memory bit. If the signal state of the address is "0" and the RLO was "1" before the instruction, the RLO will be "1" (pulse) after this instruction, and "0" in all other cases. The RLO prior to the instruction is stored in the address.

Set Reset Flip Flop

<address> SR S R

Format: Parameter <address> S R Q

Data Type BOOL BOOL BOOL BOOL

Memory Area I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D

Description Set or reset bit Enable set instruction Enable reset instruction Signal state of <address>

Description of instruction: SR (Set-Reset Flip Flop) is set if the signal state is "1" at the S input, and "0" at the R input. Otherwise, if the signal state is "0" at the S input and "1" at the R input, the flip flop is reset. If the RLO is "1" at both inputs, the order is of primary importance. The SR flip flop executes first the set instruction then the reset instruction at the specified <address>, so that this address remains reset for the remainder of program scanning. The S (Set) and R (Reset) instructions are executed only when the RLO is "1". RLO "0" has no effect on these instructions and the address specified in the instruction remains unchanged. MCR (Master Control Relay) dependency: MCR dependency is activated only if a SR flip flop is placed inside an active MCR zone. Within an activated MCR zone, if the MCR is on ; the addressed bit is set to "1" or reset to "0" as described above. If the MCR is off, the current state of the specified address remains unchanged regardless of input states.

Compare Integer
CMP xx I IN1 IN2

Format: Parameter box input box output

Data Type BOOL BOOL

Memory Area I, Q, M, L, D I, Q, M, L, D

IN1 IN2

INT INT

I, Q, M, L, D or constant I, Q, M, L, D or constant

Description Result of the previous logic operation Result of the comparison, is only processed further if the RLO at the box input =1 First value to compare Second value to compare

Description of instruction: CMP xx I (Compare Integer) can be used like a normal contact. It can be located at any position where a normal contact could be placed. IN1 and IN2 are compared according to the type of comparison you choose. xx = Comparison type: > greater than < less than == equal to <> not equal to >= greater than or equal to <= less than or equal to If the comparison is true, the RLO of the function is "1". It is linked to the RLO of the whole rung by AND if the box is used in series, or by OR if the box is used in parallel.

Up-down counter
S_CUD CU CD S PV R Q CV CV_BCD ZV ZR S ZW R ZAEHLER Q DUAL DEZ

Format Parameter Parameter International SIMATIC C no. Z no.

CU CD S PV

ZV ZR S ZW

PV counter R CV CV_BCD

ZW R DUAL DEZ

Data Type Memory Area Description ________________________________________________ COUNTER C Counter identification number; range depends on CPU BOOL I, Q, M, L, D Count up input BOOL I, Q, M, L, D Count down input BOOL I, Q, M, L, D Set input for presetting counter WORD I, Q, M, L, D Enter counter value or constant as C#<value> in the range from 0 to 999 WORD I, Q, M, L, D Value for presetting BOOL WORD WORD I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D 7 Reset input Current counter value, hexadecimal number Current counter value, BCD coded

BOOL

I, Q, M, L, D

Status of the counter

Description of instruction: S_CUD (Up-Down Counter) is preset with the value at input PV if there is a positive edge at input S. If there is a 1 at input R, the counter is reset and the count is set to zero. The counter is incremented by one if the signal state at input CU changes from "0" to "1" and the value of the counter is less than "999". The counter is decremented by one if there is a positive edge at input CD and the value of the counter is greater than "0". If there is a positive edge at both count inputs, both instructions are executed and the count value remains unchanged. If the counter is set and if RLO = 1 at the inputs CU/CD, the counter will count accordingly in the next scan cycle, even if there was no change from a positive to a negative edge or viceversa. The signal state at output Q is "1" if the count is greater than zero and "0" if the count is equal to zero.

Add integer
ADD_I EN IN1 IN2 ENO OUT

Format: Parameter EN ENO IN1 IN2 OUT

Data Type BOOL BOOL INT INT INT

Memory Area I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D or constant I, Q, M, L, D or constant I, Q, M, L, D

Description Enable input Enable output First value for addition Second value for addition Result of addition

Description of instruction: ADD_I (Add Integer) is activated by a logic "1" at the Enable (EN) Input. IN1 and IN2 are added and the result can be scanned at OUT. If the result is outside the permissible range for an integer (16-bit), the OV bit and OS bit will be "1" and ENO is logic "0", so that other functions after this math box which are connected by the ENO (cascade arrangement) are not executed.

Move
MOVE EN IN ENO OUT

Format: Parameter EN ENO IN

OUT

Data Type Memory Area BOOL I, Q, M, L, D BOOL I, Q, M, L, D All elementary data I, Q, M, L, D or constant types with a length of 8, 16, or 32 bits All elementary data I, Q, M, L, D Destination address types with a length of 8, 16, or 32 bits

Description Enable input Enable output Source value

Description of instruction: MOVE (Assign a Value) is activated by the Enable EN Input. The value specified at the IN input is copied to the address specified at the OUT output. ENO has the same logic state as EN. MOVE can copy only BYTE, WORD, or DWORD data objects. User-defined data types like arrays or structures have to be copied with the system function BLKMOVE.

AND word
WAND_W EN IN1 IN2 ENO OUT

Format: Parameter EN ENO IN1 IN2 OUT

Data Type BOOL BOOL WORD WORD WORD

Memory Area I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D

Description Enable input Enable output First value for logic operation Second value for logic operation Result word of logic operation

Description of instruction: WAND_W (AND Words) is activated by signal state "1" at the enable (EN) input and ANDs the two word values present at IN1 and IN2 bit by bit. The values are interpreted as pure bit patterns. The result can be scanned at the output OUT. ENO has the same logic state as EN. 9

XOR word Format: Parameter EN ENO IN1 IN2 OUT

Data Type BOOL BOOL WORD WORD WORD

Memory Area I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D I, Q, M, L, D

Description Enable input Enable output First value for logic operation Second value for logic operation Result word of logic operation

Description of instruction: WXOR_W (Exclusive OR Word) is activated by signal state "1" at the enable (EN) input and XORs the two word values present at IN1 and IN2 bit by bit. The values are interpreted as pure bit patterns. The result can be scanned at the output OUT. ENO has the same logic state as EN.

10

Sample program 1
M1 M2
HH1 H1 L1 LL1

pump

M3 M4 Tank 1 M5 Motors Tank 2

H2

Scenario HH1, H1, L1, LL1 and H2 are level sensors. The pump starts when LL1 is activated till HH1 is activated. M1 and M2 is a group that is working in shift with another group consisting of M4 and M5. the shift change isdone by a switch. M3 will be substituted for any motor that is out of order. Motors are taking the water out of tank1 and collect water in tank2. they will start with the activation of H1 and work till L1 is active. Motor will also stop when H2 is activated. Each motor has thermic contacts that will be opened in the case of an overload or overheating. LAD (Ladder Logic Programming Language) Diagrams Network 1 Main power LL1 HH1 pump

pump

If the main power is switched, the LL1 sensor is active and HH1 is OFF, then the pump operates. The pump contact is in OR gate with LL1 in order to continue the operation as the water level is higher than LL1. At that time LL1 will be inactive but pump contact keeps the process going on. Network 2 H1 level control S Network 3 L1 level control R

Networks 2 and 3 determines the motor start and stop times respectively. When there is enough water to activate H1, the level control is set and this starts the process in network 4. when there is not enough water, level control output is reset and network 4 is cut. 11

Network 4 Main power levelcontrol H2 Shiftswitch Thermic1 M1

Thermic2

M2

Thermic1 Thermic3 Thermic2 Shiftswitch Thermic4 M4

M3

Thermic5

M5

Thermic4 Thermic3 Thermic5

M3

The main power (logic 1), level control (logic 1) and tank2 level (logic 0) bits operate the motors. The shift switch determines group to operate. In case of thermic breakdown of motor 1, 2, 4 or 5, motor 3 is started if it is not thermically out of order. STL (Statement List) Network 1 A I 3.6 A( O LL1 O pump ) AN HH1 = pump Network 2 A H1 S levelcontrol Network 3 A L1 R levelcontrol

12

Network 4 A I 3.6 A levelcontrol AN H2 = L 20.0 A L 20.0 A shiftswitch = L 20.1 A L 20.1 AN thermic1 = M1 A L 20.1 AN thermic2 = M2 A L 20.1 A( O thermic1 O thermic2 )

AN = A AN = A AN = A AN = A A( O O ) AN =

thermic3 M3 L 20.0 shiftswitch L 20.1 L 20.1 thermic4 M4 L 20.1 thermic5 M5 L 20.1 thermic4 thermic5 thermic3 M3

Symbol List Address Symbol name Type Start value I0.0 Mainpower BOOL FALSE I0.1 LL1 BOOL FALSE I0.2 HH1 BOOL FALSE I0.3 H1 BOOL FALSE I0.4 L1 BOOL FALSE I0.5 H2 BOOL FALSE Q4.0 Pump BOOL FALSE I0.6 Levelcontrol BOOL FALSE I1.1 Thermic1 BOOL FALSE I1.2 Thermic2 BOOL FALSE I1.3 Thermic3 BOOL FALSE I1.4 Thermic4 BOOL FALSE I1.5 Thermic5 BOOL FALSE Q4.1 M1 BOOL FALSE Q4.2 M2 BOOL FALSE Q4.3 M3 BOOL FALSE Q4.4 M4 BOOL FALSE Q4.5 M5 BOOL FALSE I0.7 Shiftswitch BOOL FALSE Since the program is not so complex, these network can be directly inserted to OB1.

13

Sample program 2
Conveyor Ladder exit The automatic ladder starts when a person enters the ladder and continues till he/she exits and ladder will no longer operate after he/she exited in order to save power. There is also a problem that another person enters the ladder before the first one exits. This time the ladder must wait for the second person to exit. This can be done by counting the entrance and exits and comparing them.

enter

Scenario: A sensor will give logic 1 when a person enters and another sensor on top will give logic 1 when the person exits. The entrance and exit numbers are stored in memory words MW20 and MW24 respectively. Each enter or exit increments the content of corresponding memory. If the entrance number is greater than the exit number, the relay controlling the motor will be ON. A reset switch can be used to manually reset the inputs when power is ON. LAD networks Network 1 power resetswitch M3.2 P 0 M3.4 P 0 MOVE EN ENO IN OUT MW20

MOVE EN ENO IN OUT MW24

This network manually resets the entrance and exit numbers. This can be used as eergency stop. Network 2 power resetswitch enter M4.0 P 1 MW20 ADD_I EN ENO IN1 IN2 OUT MW20

When power is ON and resetswitch is OFF, as a logic 1 comes from the entrance dedector, the memory word (16 bit) MW20 is incremented by one. A word is selected instead of a byte because an integer is defined as a 16 bit word but byte is 8 bit. 14

Network 3 power resetswitch exit M4.4 P 1 MW24 ADD_I EN ENO IN1 IN2 OUT MW24

The same procedure in network 2 is applied for exit and MW24. the adding operation isdone when the RLO of the operation power&resetswitch&exit changes from 0 to 1. Network 4 power resetswitch MW20 MW24 CMP>I IN1 IN2 merdiven

The entrance and exit numbers are compared and the motor drving the lift operates as long as the entrance number is greater than the exit number. All of the program can be written in an organization block OB1.

15

SAMPLE PROGRAM 3 Conveyor Belt

piston Sensor1

Belt1
Motor1 Sensor2 Sensor3

Belt2

Motor2

Sensor4

In the automation of he conveyor belt shown above uses 2 motors for belts, 4 sensors for determining the ends of the belts and 1 piston to push the element fromelt1 to belt2. Scenario: In order to save power, motors will work only when there is at least one element (box) on corresponding belts. The existence of box on the belts is determined by comparing the sensor switching times. Sensor activation means an incrementation in appropriate memory address. Sensor1, sensor2, sensor3 and sensor4 use memory addresses MW0, MW2, MW4 and MW6 respectively. Motor1 runs if MW0>MW2, sensor2 is not active (no element to run piston) and piston is not running. Piston runs when sensor2 is active (box stays here) and motor1 is not running. Motor2 runs independently from motor1. It runs when MW4>MW6 and piston is not running. LAD Networks OB1 This network detects the start/stop buttons Network 1 and gives operation command. It is enough to stop commander push start once to set comander. It stays at start logic 1 until stop button is pressed. commander

Network 2 commander FC1 EN ENO

If the commander is active, go to FC1.

16

Network 3 commander Sensor2 Motor1 piston

This network is used to run the piston when commander and sensor2 is activated but motor1 is not running (assure that the box is at the end of belt1). Network 4 commander EN FC2 ENO

Commander must always be controlled before any action. After all the networks above are runned, goto FC2 (function 2). FC1 Network 1 Sensor1 MW0 1 Network 2 Sensor2 MW2 1 ADD_I EN ENO IN1 IN2 OUT MW2 ADD_I EN ENO IN1 IN2 OUT MW0

Network 3 Sensor2 MW0 MW2 CMP>I IN1 IN2 piston Motor1

17

FC2 Network 1 Sensor3 MW4 1 ADD_I EN ENO IN1 IN2 OUT MW4

Network 2 Sensor4 MW6 1 ADD_I EN ENO IN1 IN2 OUT MW6

Network 3 piston MW4 MW6 CMP>I IN1 IN2 Motor2

FC1 controls the motion of belt1. If the input number is higher than the exit number, the motor will run if the box is not at the end. FC2 controls the belt2 in the sae manner but it asures that the piston is not moving when motor2 is running. The hierarchy between OB1, FC1 and FC2 is that the PLC first looks at the organisation block OB1. One by one, executes the network and if there is a call to any FC, jumps there. After executing the networks in FC, returns back to OB1 and continues to run the networks. When PLC reaches the end of OB1, returns to the top of OB1 and loops in this way. STL Codes OB1 Network 1 A( O start I0.0 O commander M10.0 ) AN stop I0.1 = commander M10.0

Network 2 A commander M10.0 JNB _001 CALL FC 1 _001:NOP 0

18

Network 3 A commander A sensor2 AN motor1 = piston FC1 Network 1 A sensor1 I1.1 JNB _001 L MW 0 L 1 +I T MW 0 Network 3 A( L MW 0 L MW 2 >I ) AN sensor2 AN piston = motor2 FC2 Network 1 A sensor3 JNB _001 L MW 4 L 1 +I T MW 4 Network 3 A( L MW 4 L MW 6 >I ) AN piston = motor2

M10.0 I1.2 Q4.1 Q4.3

Network 4 A commander JNB _002 CALL FC 2 _002:NOP 0 Network 2 A sensor2 JNB _001 L MW 2 L 1 +I T MW 2

M10.0

I1.2

I1.2 Q4.3 Q4.2

I1.3

Network 2 A sensor4 JNB _001 L MW 6 L 1 +I T MW 6

I1.4

Q4.3 Q4.2

17

PROXIMITY SWITCHES Inductive Proximity Switches They are used for sensing the coming metallic materials. It consists of an inductor in front, an oscillator, trigger and an output stage. Oscillator amplitude is affected when a metal gets into the magnetic field created by the inductor in front.
inductor oscillator trigger output

Capacitive Proximity Switches Usually used for ametallic materials. It again consists of a capacitor constructing the sensor surface, an oscillator, triggering circuit and an output stage. The capacitance is changed with the interference of the ametal and this affects the oscillator.
electrode oscillator trigger output

Resistive behaving inductive proximity switches They are used in areas in danger of explosion. Operating voltages are low when compared with the other proximity switches. They consist of inductor and oscillator. The triggering circuit and the output stage is collected in an amplificator. They work like a variable resistor ranging from 1k to 8k. Metallic materials getting into the magnetic field change the resistance of the switch.
inductor oscillator Amplifier

Optical proximity switch Consists of a photodiode (transmitter) and a phototransistor (receiver). The light emitted by the photodiode is received after it is reflected from a body and transmitted to the comparator circuit.
oscillator Transmitter

comparator Receiver >

trigger

output

Its advantages are; 20

 long life because of no mechanical connection can operate in dusty, moist and dirty media because of high protecting classes small dimensions when compared to the mechanical switches can work at high temperatures constant and continuous switching can be done can be connected directly to PLC and automation systems. The stability and long-life of DC operating proximity switches depend on the ripple factor of the feeder voltage. The AC voltage must be rectified by a bridge and filtered by a capacitor. Switching frequency is the number of ON-OFF states in one second. Hysteresis is the distance between the first sensing point when arriving and releasing point when departing from the sensor. Nominal sensor distance is proportional with the inductor and electrode dimensons. Serial connection of proximity switches
3-wire DC serial connection +

PS

PS

output Z

0V

2-wire DC / AC serial connection + ~

PS PS
output Z

0V ~

21

Parallel connection of proximity switches

3-wire DC parallel connection +

PS

PS

output Z

0V

22