Indirect Addressing S5 S7

http://support.automation.siemens.
com/US/view/99/24519683
STEP 7 -- Creating S7 programs -- Indirect Addressing Entry ID:24519683 Date:2011-08-09 STEP 7 -- Creating S7 programs -- Indirect Addressing Why are the bit and byte addresses changed when indirectly addressing a program converted from S5 to S7? How can you open data blocks indirectly and do an indexed call, start and evaluation of timers? Information on the topic of "Indirect addressing" What is the difference between STEP 7 and STEP 5 with regard to the operations for indirect addressing? How do access the I/O address area indirectly and what should you watch out for when copying with the SFC20? How can you access an element indirectly in STL in a two-dimensional array (e.g. a value in line 2 and column 5)? In the case of a function, how is the address of the ANY pointer for the elementary IN, OUT and IN-OUT parameters loaded into the address register AR1? How can you calculate an offset for an ANY pointer or change the pointer? How can you use "CHAR"-type variables for FC1 (DP_SEND)? How do you parameterize blocks, which have "ANY"-type or "Pointer" type parameters? Why are indirect calls using AR2 replaced by static local variables after saving the block? In which operations does STEP 7 overwrite ACCU or register contents? Why are the bit and byte addresses changed when indirectly addressing a program converted from S5 to S7? Description: When calculating the address in STEP 5, bits 12 to 15 are used for the interim results. But these bits are not needed for indirect addressing in STEP 5. Unlike DO instructions (e.g. "B MW") in STEP 5, in STEP 7 addressing is via double-words, because of the extended address area. With the instruction in STEP 7, an area (E, A, M), an access range (bit, byte, word and double-word) and an address are specified. The address contains the byte number. The structure of the address register must be observed when an address is preset via the Accu: RRR: area identifier B...B: byte address XXX: bit address
Fig. 01 If the program is now converted to STEP 7, then when bits 12 to 15 are used by STEP 7 the system changes the addresses. Fig. 01 shows an example of a bit pattern "W#16#221". After conversion, the address "33.2" is calculated.
Page 1 of 35
2/24/2012 3:06:40 PM
http://support.automation.siemens.com/US/view/99/24519683
Fig. 02 Fig. 02 shows the same program, but with the bit pattern"W#16#1221". The leading "1" is not evaluated by STEP 5. After conversion, however, the address "35.2" is calculated by STEP 7. The reason for this is that the leading "1" at the bit point is placed by the system in the byte address with value 2.
Fig. 03 Remedy: If you can't ensure that bits 12 to 15 are not used, then change the two move commands as follows. SLW 5 to SLW 12. SRW 5 to SRW 12. After conversion, however, the correct address "33.2" is calculated in STEP 7.
Fig. 04 Keywords: S5/S7 converter Fig. 01
Page 2 of 35
2/24/2012 3:06:40 PM
Fig. 02
Fig. 03
Page 3 of 35
2/24/2012 3:06:40 PM
Fig. 04
How can you open data blocks indirectly and do an indexed call, start and evaluation of timers? Instructions You have the following options for opening a data block indirectly: By programming with a formal parameter of the "BLOCK_DB" parameter type (Example 1). By way of a local data word (temporary block variables) (Example 2). Through indirect memory addressing (Example 3). Fig. 01 shows three examples of indirect opening of a data block in STL.
Page 4 of 35
2/24/2012 3:06:40 PM
Fig. 01 Example 1 In this case, input parameter "Data2" is given a formal parameter of the "BLOCK_DB" type. The content of "Data2" corresponds to the number of the data block to be opened. Example 2 Input parameter "InWord" of the "WORD" type is given to the temporary variable "Data1". The number in the temporary variable "Data1" of the "WORD" type is the number of the global data block. The global data block is then opened with AUF DB[Data1]. Example 3 With indirect memory addressing, here, for example, DB number 10 is saved in marker word MW20. The instruction AUF DB[MW20] opens the global data block whose number is contained in marker word MW20. AUF DB[MW20] thus corresponds to AUF DB10. Further methods for opening data blocks with indirect memory addressing are possible with AUF DB [DBW <No.>] and AUF DB[DIW <No.>]. If no FBs are used, both DB registers may be used freely, i.e. all variants can also be opened with AUF DI .... Note For more information see the STEP 7 Online Help under keyword "Legal data types in the transfer of parameters". Indexed call, start and evaluation of TIMER You can make an indexed call of a timer by way of a tag of the WORD data type. This tag can be A global tag [MW] A local tag in a DB [DBW]
Page 5 of 35
2/24/2012 3:06:40 PM
A temporary tag in a block Access is as follows (example): SI SI SI T[MW2] T[DBW2] T[#time_x] //The timer number is in marker word 2, hex coded. //The timer number is in data block word 2, hex coded. The DB must be opened explicitly beforehand. //The "#time_x" tag is a temporary tag of the WORD data type.
Keywords: Indirect addressing, DB call Information on the topic of "Indirect addressing" Instructions Information on the topic of "Indirect addressing" is available in the following manuals and chapters / sections and in the Online Help. Document Version Chapter / section 27.3.4 Parameter Types Format of the parameter type ANY Format of the parameter type POINTER Entry ID 45531107
Manual on "Programming 05/2010 with STEP 7" STEP 7 Online Help V5.5
What is the difference between STEP 7 and STEP 5 with regard to the operations for indirect addressing? Instructions: For indirect addressing in STEP 7 a difference is made between 1. Memory indirect addressing with a number: for addressing timers, counters and blocks. 2. Register indirect addressing with an area pointer: for addressing memory areas: I/O, inputs, outputs, markers, global data (DBX), instance data (DIX) and local data. Memory indirect addressing with a number: Examples: STEP 7 L2 T MW 33 L T [MW33] Load number Save in bit memory word 33 Load current time value of Timer 2 L KF+2 T FW 33 DO FW33 L T0 ....... ....... ....... Equivalent in STEP 5 Load number Save in flag word 33 Process flag word 33 Load current time value of Timer 2 .......
Page 6 of 35
2/24/2012 3:06:40 PM
OPN DB[MW33]
Open DB2
B MW33 C DB0
DO marker word 33 Open DB2 ....... ....... Process flag word 33 Call FC2 if RLO=1: works only if FC2 has no parameters
....... CC FC[MW33]
....... Call FC2 if RLO=1: works only if FC2 has no parameters
DO FW33 JC FC0
The address operand, in which the number is stored (here MW33), can be in the following areas: marker, global data (DBX), instance data (DIX) and local data. In function blocks (FBs) it is only possible to use the area instance data (DIX) for the address operand in CODE_VERSION1 (nonmulti-instance-compatible FB). Register indirect addressing with area pointer Example for an internal area pointer STEP 7 L P#4.5 Load pointer for byte 4, L KF +4 bit 5 L KF +5 SLW 8 OW Equivalent in STEP 5 Load byte number Load bit number Move bit number in high byte Bit in high byte, byte in low byte
Example for cross-area pointer: STEP 7 L P#M 2.3 Pointer calculations A decisive property of the area pointer is that pointer calculations can be made with the normal fixedpoint operations. So for any pointer the following holds: Addition of 1: increase pointer to next bit. Addition of 8: increase pointer to next byte, leave bit number unchanged. Examples: STEP 7 L P#M 2.3 L P#4.5 Load pointer for M2.3 Load pointer for byte 4, ....... ....... Equivalent in STEP 5 Load pointer for M2.3 Equivalent in STEP 5
Page 7 of 35
2/24/2012 3:06:40 PM
bit 5 +D Result: pointer for M7.0, i.e. all 3 instructions are equivalent to: L P#M7.0 ....... L P#DBX 2.3 L 16 -D ....... Load pointer for global data bit 2.3 Load 16 Decreases pointer by 16 bits, i.e. all 3 instructions are equivalent to: L P#DBX0.3
....... .......
.......
In calculations with area pointers, you can only use one pointer with area identifier (not equal to zero). Otherwise the points of the area identifier are "added" or "subtracted" and this results in an invalid identifier. Memory indirect addressing with area pointer Examples: STEP 7 L P#2.0 T MD44 A I [MD44] Load pointer for byte 2, L KF+2 bit 0 Save in bit memory double-word 44 Query of input 2.0 for signal status 1 L KF +0 SLW 8 OW T FW44 DO FW44 A I 0.0 Equivalent in STEP 5 Load byte number Load bit number Move bit number in high byte Bit in high byte, byte in low byte Save in flag word 44 Process flag word 44 Query of input 2.0 for signal status 1 ......... L 123 T MW [MD44] .......... Load 123 Save 123 in bit memory word 2 ....... L KF +123 DO FW44 T FW 0 Load 123 Process flag word 44 Save 123 in flag word 2 .......
Page 8 of 35
2/24/2012 3:06:40 PM
The same statement applies for the location of the address operand (here MD44) in the possible memory areas as for indirect addressing with one number (see above). The difference however is that here you need a double-word. In the case of memory indirect addressing the area identifier in the pointer must be 0. You can only use internal area pointers. For indirect access to a byte, word or double-word the bit address in the pointer must be 0. Register indirect addressing with area pointer Examples: STEP 7 Equivalent in STEP 5
Example a
L P#2.0 LAR1 Load pointer for byte 2, bit 0 Load pointer in address register 1 .......
//Register indirect internal area addressing A I [AR1, P#0.0] Query of input 2.0 for signal status 1
Example b
LAR1 P#E 2.0 Load pointer for input 2.0 ....... .......
//Register indirect external area addressing U [AR1, P#0.0] Query of input 2.0 for signal status 1
Example c
LAR1 P#DBX 2.0 L MW [AR1, P#0.0] ....... Load pointer for global data bit 2.0 Load marker word 2 .......
Example d1
LAR1 P#Q 2.0 = [AR1, P#2.2] Load pointer for output 2.0 in AR1 Assign current RLO to output 4.2
Example d2
Page 9 of 35
2/24/2012 3:06:40 PM
+AR1 P#2.0 T W [AR1, P#0.0] L P#4.5 +AR1 S [AR1, P#1.0]
Increase pointer in register by 2 bytes Write low word from Accu1 to output 4.0 Load pointer for byte 4, bit 5 Increase pointer in register by Accu1 Set output 9.5 if RLO=1
.......
For register indirect addressing the pointer can carry an area identifier: If the identifier is missing (Example a), then you must specify this in the register indirect instruction. If the identifier is in the pointer (Example b), it can be dropped for the register indirect instruction. Note that in this case you must specify the access range Byte, Word, Double-word (Example d2) for the load and transfer instructions. If the identifier is in the pointer and specified for the instruction (Example c), the area specified in the instruction is valid and the identifier in the pointer is then ignored. In the case of the register indirect instruction you can specify an offset (Example d). This is added to the pointer of the register when the access is executed. The register content itself remains unchanged. Use of the area identifier Local data area in the pointer is not possible in older CPUs. The offset designated in the bracket [AR1, <Offset>] can be in the area from P#0.0 to P#8191.7. The instruction "+AR1" takes into account only the low word of the offset designated in Accu1 or as designated as operand and interprets the 16 bits as number with sign: P#0.0 ..... P#4095.7 is a positive offset for "+AR1" and P#4096.0 ..... P#8191.7 is a negative offset for "+AR1". Example: L P#0.1 +AR1 ......... L P#4095.7 +AR1 ....... L P#4096.0 Smallest positive offset for "+AR1" Increases content of AR1 by P#0.1 ......... Greatest positive offset for "+AR1" Increases content of AR1 by P#4095.7 ....... Greatest negative offset for "+AR1": corresponds to "P#-
Page 10 of 35
2/24/2012 3:06:40 PM
4096.0" +AR1 ....... L P#M 8191.0 +AR1 ....... L P#8191.7 +AR1 ....... L P#E 8192.0 +AR1 Decreases content of AR1 by P#4096.0 ! ....... Corresponds to "P#-1.0" ("+AR1" ignores identifier "M") Decreases content of AR1 by P#1.0 ! ....... Smallest negative offset for "+AR1": corresponds to "P#0.1" Decreases content of AR1 by P#0.1 ! ....... Corresponds to P#0.0" ("+AR1" ignores identifier "E") Content of AR1 remains unchanged !
Since the operation "+AR1" only takes the low word of Accu1 into account, pointers with area identifier can also be used. It doesn't matter if the identifier is in the high word, unlike pointer calculation with integer operations. Please note that independent of the options for increasing and decreasing the address register in a register indirect instruction, the register content must always be in the area from P<possible identifier> 0.0 to P<possible identifier> 65535.7. General remarks Analogous to Address Register 1, there is a second register AR2 in the CPUs with the same utilization options. There are restrictions on using the address registers. If you do not observe these, the user program might react unexpectedly. For more detailed information please refer to the Help functions of STEP 7, keyword "AR1". Help in deciding which indirect addressing options to choose: When using the address registers you should give preference to register indirect addressing with internal area pointers. The memory area addressed with the instruction is visible here in the instruction. This makes the program clearer, less susceptible to faults and easier to maintain. Here you do not have to pay attention to the service life of the address operand. Utilization of the address register is always possible regardless of the DB opened or the local data. The advantages of using memory indirect addressing with pointer in the marker area are: You do not have to worry about the restrictions for using registers. Also here you don't have to worry about the service life of the address operand, because the marker area is available without restrictions at every point in the program. You can use multiple pointers in parallel. However, here you do not have the convenient options of "+ARi" and specification of an offset. Note on working with pointers or ANY pointers:
Page 11 of 35
2/24/2012 3:06:40 PM
Both contain the area pointer in the lowest value 32 bits as presented above. When using indirect addressing, programming errors might not surface as quickly as when using direct addressing. Furthermore, data can be lost not only inadvertently in the desired memory area, but also unintentionally in other memory areas. Therefore, proceed carefully and test your program thoroughly! Note: More information and examples are available in the STEP 7 Online Help under Format of the ANY parameter type. Format of the POINTER parameter type. Using the POINTER parameter type. Using the ANY parameter type. How do access the I/O address area indirectly and what should you watch out for when copying with the SFC20? Instructions: A memory range, which is defined with the ANY pointer, for an I/O input module which does not lie within the process image, cannot be copied with SFC20 (BLKMOV). The input data, which lies outside the process image, must be copied to a global data block in consecutive order first of all. You can then copy the data from the global data block (source field) to the target field (outputs, flags, data blocks) with the SFC20. ANY pointer "P#PE300.0 BYTE 16 cannot be specified. Fig. 01 shows an example of how data is copied from the I/O input word PEW300 to the DB5 data block.
Fig. 01 Note: Please note that it takes a great deal of cycle time to use the SFC20 (BLKMOV) in the example above. Furthermore, this also involves the use of additional memory (second data block) on the automation system. In this case it would be better if only the load and transfer functions were applied, e.g. L PEW 300 T DB5.DBW0 Sample program for indirect addressing of the I/O address area: The following download "PAE.zip" contains a sample program for indirect addressing of the PQ area. You have only write access to the output modules and only read access to the input modules. The "PEA.zip" attachment contains the two STL sources: Quelle_PEA.AWL: sample program with German comments. Source_PEA.AWL: sample program with English comments.
Page 12 of 35
2/24/2012 3:06:40 PM
PEA.zip ( 1 KB ) Keywords: Symbolic programming, Indirect addressing, Cross-area pointer Fig. 01
How can you access an element indirectly in STL in a two-dimensional array (e.g. a value in line 2 and column 5)? Instructions: A two-dimensional array contains a matrix consisting of rows and columns. If you want to access one element of the array, you must first calculate the address of the element. For this you add the line and column offsets. After converting the result into the pointer format you can indirectly access the element in the array using the address register. In this way it is possible to access the array elements variably. The "2D_Array" download attached contains a STEP 7 program that is based on a two-dimensional array of the type 25x25 REAL values. By specifying the line and column FC10 calculates the address and returns it to you as OUT parameter in the pointer format.
Fig. 01
Page 13 of 35
2/24/2012 3:06:40 PM
The calculation is based on the following premises: The two-dimensional array consists of 25x25 REAL numbers. The array begins with a data block as from the address zero. Definition of the array: ARRAY [1..25,1..25] OF REAL Column 1 Line 1 Line 2 Line 3 ... Line 25 1,1 2,1 3,1 ... 25,1 Column 2 1,2 2,2 3,2 ... 25,2 Column 3 1,3 2,3 3,3 ... 25,3 Column 4 1,4 2,4 3,4 ... 25,4 ... ... ... ... ... ... Column 25 1,25 2,25 3,25 ... 25,25
Note: If the premises described above are not given, then accessing non-existent memory areas might cause the CPU to go into STOP mode. The attached download "2D_Array" contains a STEP 7 project with the blocks described above (FC10, DB10 and OB1). The blocks with the German comments are in the "Deutsch" station and the blocks with the English comments are in the "English" station.
2D_Array.zip ( 322 KB ) Copy the "2D_Array" file into a separate folder and then start the file with a double-click. The STEP 7 V5.3 project then unpacks automatically with all the associated subdirectories. You can use the SIMATIC Manager to open and process the extracted project. Runnability and test environment: The example can be used on all the CPU types of SIMATIC S7-300, S7-400, C7 and WinAC. The following table lists the components that have been used to create this entry and verify the functions described. Test environment PC platform PC operating system STEP 7 Option package Keywords: Indirect addressing Fig. 01 Version Pentium(R) M Processor 1.73 GHz Windows XP SP2 STEP 7 V5.3 SP1 S7-PLCSIM V5.3
Page 14 of 35
2/24/2012 3:06:40 PM
In the case of a function, how is the address of the ANY pointer for the elementary IN, OUT and INOUT parameters loaded into the address register AR1? Instructions: The statement "LAR1 P##PointerInput", for example, is invalid in a function (FC) (Fig. 01). When you enter a command or attempt to save the block, you get the following error message: 30:9: "Compilation of the Network 1 is not possible, because it still contains invalid statements." However, the same statement is valid in a function block (FB). This error message is only a secondary message that is always displayed if statements are marked red when saving. When you load the ANY pointer into address register AR1 and into address register AR2, you must note the following for function blocks and functions: In the case of an FB, the transferred ANY pointer is stored in its assigned instance DB. In the case of an FC the transferred ANY pointer is stored in the caller's local data stack.
Page 15 of 35
2/24/2012 3:06:40 PM
No. STEP 7 error message 30:9 when saving 1 ANY pointer sample program
Fig. 01 2 The statement "LAR1 P##PointerInput" is valid for FBs.
Fig. 02 In FCs, the address must first be loaded into Accu1 with the statement "L P#PointerInput" and from there loaded into the AR1 register with the statement LAR1. 3 The difference between an FB and an FC is that with the statement "LAR1 P##VariableName" In an FC you can only access the TEMP variables (local data stack). In FBs you can also access the IN, OUT, IN-OUT and STAT variables. Fig. 03 shows you an example of how to access a TEMP variable in an FC.
Fig. 03 4 Fig. 04 shows an example of how data of the ANY variable (IN variable) can be transferred in an FC. The data is transferred from address register AR1 into temporary variables for further processing. By way of example, the address of the IN variable "Input" (Type: ANY) is first
Page 16 of 35
2/24/2012 3:06:40 PM
loaded into Accu1 and from there into the AR1 register. The base address can be transferred from address register AR1 into the temporary variable "bit_adr" (Type: DWORD).
Fig. 04 Keywords: Symbolic programming Indirect addressing Cross-area pointer
Fig. 01
Fig. 02
Page 17 of 35
2/24/2012 3:06:40 PM
Fig. 03
Fig. 04
Page 18 of 35
2/24/2012 3:06:40 PM
How can you calculate an offset for an ANY pointer or change the pointer? Instructions STEP 7 saves the data of the parameter type ANY POINTER in 10 bytes. All 10 bytes must be occupied for configuring the ANY pointer and also for calculating an offset. Detailed information on configuring the parameter types POINTER and ANY POINTER is available in the STEP 7 Online Help under Format of the ANY parameter type Format of the POINTER parameter type. An offset is added to the memory area in which the information is stored and stored in the doubleword 6 in the area reserved for the ANY pointer. Fig. 01 shows an example of data storage in a defined area.
Page 19 of 35
2/24/2012 3:06:40 PM
Fig. 01 With system function SFC20 the data is copied byte for byte from a DB10 to a DB20. In DB20 a start of area is defined for data storage (e.g. DB20.DBX2.0). Using this start of area and an offset (here 4 bytes) the data is stored in the desired memory area of DB20. The first data from the address DB10.DBX0.0 is therefore copied into the address DB20.DBX6.0.
Page 20 of 35
2/24/2012 3:06:40 PM
No. Procedure 1 FC12 adds the offset (IN variable "Offset" of the INT type) to the start of area address (IN variable "Start of area" of the BOOL type) and the result is then stored in the double-word 6 of the address register AR1. The data area for the data to be stored is then output via the OUT variable "Area_Pointer" of the ANY type.
Fig. 02 2 FC12 is called and parameterized in OB1. The result of the OUT variables "Area_Pointer" from function FC12 is copied into a buffer (TEMP variable "Area", Type: and transferred to parameter "DSTBLK" of the system function SFC20. In this way the data is transferred from DB10 into the desired address area of DB20.
Fig. 03 Download Copy the "STEP7_V55_Offset_P.zip" file into a separate directory and then start the file with a double-click. The STEP 7 V5.5 project is then extracted automatically with all the associated subdirectories. You can then use STEP 7 V5.5 to open and process the extracted project.
Page 21 of 35
2/24/2012 3:06:40 PM
STEP7_V55_Offset_P.zip ( 32 KB ) Block for changing the pointer You can change the bit or byte address of a pointer using the enclosed function FC5. When you call this function, the pointer to be changed is transferred to the "Pointer" variable. You can use internal or cross-area pointers in the double-word format. Using the "Bit_Byte" parameter you can choose whether you want to change the bit or byte address of the pointer (0: bit address, 1: byte address). For the "Inc_Value" variable (in the integer format) you must specify the number that is to be added to or subtracted from the address content. Here you can also specify negative number to decrement the address. If you change the bit address, there is transfer to the byte address (also for decrements); for example: P#M 5.3, Bit_Byte = 0, Inc_Value = 6 => P#M 6.1, or P#M 5.3, Bit_Byte = 0, Inc_Value = -6 => P#M 4.5. Note The area information of the pointer is not affected by the function. In the case of over-run or under-run of the pointer, the point is not changed and the "RET_VAL" variable on the output side is set to True until the next correct processing of the function. This is the case if the Bit address is selected and Inc_Value >7, or <-7. Bit or byte address is selected and the change results in a "negative" byte address. Bit or byte address is selected and the change results in an impermissibly large byte address. Download Copy the "STEP7_ChangePointer.zip" file into a separate directory and then start the file with a double-click. The STEP 7 V5.5 project is then extracted automatically with all the associated subdirectories. You can then use STEP 7 V5.5 to open and process the extracted project.
STEP7_V55_ChangePointer.zip ( 35 KB ) Creation environment The pictures and downloads in this FAQ were created with STEP 7 V5.5. The table below lists the components that have been used to create this entry and verify the functions described. Test environment PC platform PC operating system STEP 7 S7 PLCSIM Version Intel(R) Core(TM)2 Duo CPU P8700 2.53 GHz MS Windows XP SP3 V5.5 V5.4+SP4
Keywords Indirect addressing, Symbolic addressing, ANY pointer How can you use "CHAR"-type variables for FC1 (DP_SEND)?
Page 22 of 35
2/24/2012 3:06:40 PM
You are using FC5 AG_SEND or FC1 DP_SEND, for example, to transfer data. For formal parameters (e.g. "SEND" for FC1), which must be given the ANY pointer, BYTE is the only data type permissible as VARTYPE. In Help or in the Online Help of STEP 7 the following is specified for the formal parameter "SEND": ANY as VARTYPE only the following are permissible: for FC1 as from block version V3: BYTE for FC1 up to block version V2.x: BYTE, WORD and DWORD. In a program without symbols, the ANY pointer on the formal operand is parameterized as follows: SEND:= P#DB42.DBX0.0 BYTE 20 This way communication works perfectly. In the case of symbolic programming the compiler skips to the VARTYPE actually available or to the data type declared in the data block. If you use a data block that contains variables of the type CHAR (as in Fig. 01 for example), VARTYPE "CHAR" is used instead of VARTYPE "BYTE" and communication does not work any more. In the pointer on the formal operand for FC 1 the data type "CHAR" is not supported as VARTYPE. If you cannot change the data type to "BYTE" and must use the data type "CHAR", we recommend as a remedy that you do not address across the complete symbolic area. Example: As in Fig. 01 you use the variable ARRAY [1..20] OF CHAR and you address across the complete symbolic area as in Fig. 02. Communication does not work. The parameters for the formal parameter "DataBlock".Variable corresponds to the ANY pointer P#DB42.DBX0.0 BYTE 20, the compiler uses the VARTYPE "CHAR".
Fig. 01
Fig. 02 If, however, you do not address across the complete symbolic area, as in Fig. 03 and thus do not completely use up the ARRAY [1..20], the compiler uses the VARTYPE "BYTE" and communication works.
Page 23 of 35
2/24/2012 3:06:40 PM
Fig. 03 If, however, it is necessary to transfer the entire 20 bytes, in this example you must increase the ARRAY variables in DB42. For example, an ARRAY[1..25] OF CHAR. Fig. 01
How do you parameterize blocks, which have "ANY"-type or "Pointer" type parameters? Description The parameter type ANY is 10 bytes long and contains information about the data type (byte 1), the repeat factor or the number of data types to transfer on the parameter (bytes 2 and 3), the DB number (bytes 4 and 5), the memory area (byte 6), the bit and the byte address. You can find further information about the format of the parameter type ANY in the STEP 7 Online Help under Format of the ANY parameter type Format of the POINTER parameter type. The table below contains a few examples of how to parameterize blocks, which have ANY-type and Pointer-type parameters. 1. Parameterization of a system function in the function block 2. Dynamic supply of a data block to the ANY pointer and transfer of the DB number on an SFC84 3. Parameterization of the function FC81 "IBLKMOV" No. Examples 1 Parameterization of a system function in the function block In the following example, we will explain how to parameterize the ANY pointer for the system function SFC50 "RD_LGADR" (Read Module Logical Addresses). The programming, such as for a function block FB1, is done in the following steps: 1. Declaration of an IN variable "test" and a TEMP variable "test2", each one of the ANY
Page 24 of 35
2/24/2012 3:06:40 PM
type (Fig. 01). 2. Transfer of the "PEADDR" parameter of the SFC50 to the variable "test2", for example, (Fig. 02). 3. By evaluating the ANY pointer "test", you transfer the data from the temporary variable "test2".
Fig. 01 The statement L P##test loads the address into Accu1 first and then, with the statement LAR1, into the address register AR1 (possible short form: LAR1 P##test). Each time the address register AR1 is read there is corresponding storage or buffering (e.g. T LW 0) of the data in the temporary variable "test2" (ANY pointer). The statement sequence in Network 1 copies the ANY data transferred to function block FB1 into the temporary variable "test2".
Page 25 of 35
2/24/2012 3:06:40 PM
Fig. 02 2 Dynamic supply of a data block to the ANY pointer and transfer of the DB number on an SFC84 In the sample program outlined below, the ANY pointer's temporary variables (SRCBLK_ANY and DSTBLK_ANY) are supplied with the number of the data block of the IN variables (SRCBLK_DB_NR and DSTBLK_DB_NR) in the function block FB1. These variables are then transferred to the SFC84. Fig. 03 illustrates an example of how to parameterize the ANY pointer (temporary variables) and of transfer on the SFC84.
Page 26 of 35
2/24/2012 3:06:40 PM
Fig. 03 Function block FB1 is then called in the organization block OB1, for example, and the input parameters for the FB1 are parameterized with the corresponding number from the DBs.
Fig. 04 3 Parameterization of the function FC81 "IBLKMOV" The FC81 "IBLKMOV" function transfers data areas indirectly. Below, we take an example of
Page 27 of 35
2/24/2012 3:06:40 PM
how to parameterize a block: 1. The pointers are initialized in OB100. In this example, two words are transferred from DB1 (as from address 50.0) to DB2 (as from address 10.0). 2. The pointer for the read-out address is loaded in the first block. 3. The second block is for initializing the length to be transferred. In the next block, the target address is written in the data block. 4. The next two blocks are not relevant for running the block. Here, only data is written to addresses in order to be able to observe a change of data in the target address.
Fig. 05 5. 6. 7. 8. The "IBLKMOV" function (FC 81) is then called in OB 1. The marker 10.0 is for calling the block once. Marker 10.1 confirms the error-free transfer of the data record. The variables must be entered as pointers at the inputs "S_DATA", "LEN" and "D_DATA". This means that the variable "P#DB1.DBX0.0" is supplied to the "S_DATA" input. The pointer "P#DB1.dbx10.0" is entered at the "LEN" input and the pointer symbol ("P#DB1.DBX20.0") is likewise written in front of the bit address at the "D_DATA" input. Specification of the pointer format (P#) is not necessary in the screen display. 9. The last input variable is for specifying the data type of the data to be transferred. In this example, data of the "Word" data type is to be transferred resulting in parameterization with B#16#04.
Page 28 of 35
2/24/2012 3:06:40 PM
Fig. 06 More information on FC81 is available in the STEP 7 Online Help by marking the FC81 in the SIMATIC Manager and pressing the "F1" key. Note In order to use the above-mentioned function block FB1 as a multi-instance, replace the first two statements (L P#test; and LAR1;) as follows: No. Code 1 TAR2 2 UD DW#16#00FF_FFFF 3 LAR1 P##test 4 +AR1 Comments The address in AR2 (multi-instance) is written in Accu1 Hide unimportant information AR1 is written with the address of "test" The address in Accu1 (of the multi-instance) is added to address of "test" and finally written into the AR1
As a result, the address of the #test variables is in the address register AR1. Note, however, that there is only a limited value range for increasing the address register 1 (-32768 ... +32767). You must still adapt the example described above to your application. More information is available in our entry: How do you create and update multiple instances? Entry ID 18723826 Keywords Indirect addressing, PL (Previous local data) Why are indirect calls using AR2 replaced by static local variables after saving the block?
Page 29 of 35
2/24/2012 3:06:40 PM
Description: The STEP 7 editor uses area-internal direct addressing for symbol access to instance data, i.e. to all parameters and the static variables of a function block. The DI register contains the number of the instance data block and the address register AR2 contains the address offset of the instance data area in the multi-instance DB. The AR2 register and the DI register serve as basic address registers for addressing all parameters and the static variables in a function block. In the example given below (Fig. 01), the data is stored to addresses 2.0 and 4.0 with the statements "T DIB[AR2,P#2.0]" and "T DID[AR2,P#4.0]" in the local area of the function block or in its instance data block.
Fig. 01 Fig. 02 shows the symbolic addressing of the static variables. After saving in the LAD/STL/FBD editor, the statements "T DIB[AR2,P#2.0]" and "T DID[AR2,P#4.0]" revert to those variables in the instance DB with the symbolic designations - here Wert_2 and Wert_4 (Value_2 and Value_4).
Fig. 02 After saving the absolute programming of the indirect calls is retained only if the data type of the address in the instance DB does not match that of the indirect addressing. Note: The DI register and the address register AR2 are used on the system side for the FB and multiinstance CALL. If you intend to use address register AR2 in multi-instance-compatible function blocks, you must save the address register beforehand. Fig. 03 shows an example of this.
Fig. 03 Fig. 01
Page 30 of 35
2/24/2012 3:06:40 PM
Fig. 02
Fig. 03
In which operations does STEP 7 overwrite ACCU or register contents? Description Register or ACCU contents are changed by STEP 7 in the programming of some operations. This fact has to be taken into consideration, in particular during programming with absolute addresses. Some
Page 31 of 35
2/24/2012 3:06:40 PM
of the operations which change the contents of registers and ACCUs are explained below: Fully qualified DB access as an actual parameter for functions. After the actual call statement, the editor saves an FC's block parameters as cross-range pointers in the block code. Each block parameter requires a double word memory space. Depending on the data type and declaration type, the pointer indicates the actual parameter itself, a copy of the actual parameter in the temporary local data of the calling block, or the temporary local data of the calling block which, in turn, indicates the actual parameter.
Fig. 01 FB and multi-instance calls. In the case of FBs with multi-instance capability, STEP 7 uses the AR2 as the base register or instance data. When an instance is called, P#DBX0.0 is in AR2. All accesses to block parameters or to static local data in the FB use register-indirect, internal area addressing with the operand area DI via this register. Calling a local instance increases the base address with +AR2 P#y.x so that accesses can be performed relative to this address within the called FB, which uses the instance DB of the calling FB.
Page 32 of 35
2/24/2012 3:06:40 PM
Fig. 02 Structure component of a formal parameter as an address within a function or a function block
Fig. 03 Structure component of a formal parameter as an actual parameter for functions and function blocks
Fig. 04 If you are using the programming options mentioned above and wish to use the registers and ACCUs at the same time, you have to save the contents beforehand and restore them after use. Fig. 05 illustrates an example of how to save the contents of the AR2 and DI registers before addressing indirectly with these registers.
Page 33 of 35
2/24/2012 3:06:40 PM
Fig. 05 More information is available in the STEP 7 Online Help under "Notes on changing the contents of registers" "Avoiding errors when calling blocks" Entry ID:24519683 Date:2011-08-09
Siemens AG 2012 - Corporate Information - Privacy Policy - Terms of Use
Page 34 of 35
2/24/2012 3:06:40 PM
Page 35 of 35
2/24/2012 3:06:40 PM

Indirect Addressing S5 S7

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Indirect Addressing S5 S7

Încărcat de

Drepturi de autor:

Formate disponibile

http://support.automation.siemens.

Fig. 04 Keywords: S5/S7 converter Fig. 01

....... Call FC2 if RLO=1: works only if FC2 has no parameters

+AR1 P#2.0 T W [AR1, P#0.0] L P#4.5 +AR1 S [AR1, P#1.0]

PEA.zip ( 1 KB ) Keywords: Symbolic programming, Indirect addressing, Cross-area pointer Fig. 01

Fig. 01 2 The statement "LAR1 P##PointerInput" is valid for FBs.

Fig. 04 Keywords: Symbolic programming Indirect addressing Cross-area pointer

S-ar putea să vă placă și