1.Memory Indirect Addressing

Simatic Tip Tip No. VC

Pointers and Indirect Addressing in S7 PLCs, Volume 1- Memory Indirect Addressing

Copyright 2000 by SIEMENS page 1 / 9 Revision 4

SIMATIC NET customers have free use of the application tips. These tips are only a general approach to using SIMATIC NET with various applications.

Your specific application may be different. It is your responsibility to use SIMATIC NET properly in your applications.

SIMATIC TIPS Totally Integrated Automation

Application Notes

Group Topic and Author

Automation Pointers and Indirect Addressing in S7 PLCs, Volume 1- Memory

Indirect Addressing

Eddie Prince

Overview – Indirect Addressing in S7 PLCs

This application note provides an overview of indirect addressing methods and structures available in the Statement List (STL) language for S7 PLCs. It describes the types of addressing available, including immediate addressing, direct addressing, and indirect addressing, with a primary focus on memory indirect addressing. The document also includes an archived STEP7 library of functions that use these addressing methods. The functions in the library demonstrate the use of memory indirect addressing to read from and write to arrays of bytes, integers, and real numbers.

Structure of an STL Statement

The STL Statement is the smallest “piece” of a user program. It defines a specific task for the CPU to perform, such as loading a variable into a register, or performing a math operation. The structure of an STL statement is shown below, and the individual elements of the statement are further described.

A) Label – the label is an optional “name” assigned to a statement used for “Jump” or “Loop” operations

B) Operation –the operation is the “task to be performed” such as Load, Transfer, Add.

C) Operand – the operand is the “variable” (or data) to be manipulated by this statement. The operand may be an actual “value”, or it may be a memory address that contains the data, or it may be a pointer to a memory address that contains the data

D) Comment –Optional text field for documenting the program code

The following sections will describe various methods of addressing the Operand.

Label Operation Operand Comment

Loop: L MB 12 // Load accu1

Pointers and Indirect Addressing in S7 PLCs, Volume 1- Memory Indirect

Addressing





Types of Addressing in S7

There are several basic methods of addressing that can be used to “identify” an operand in an S7 programmable controller. These basic types are as follows:

A) Immediate Addressing – Immediate addressing refers to the use of a number value as an operand. A Statement List example would be to load a constant into the accumulator. There is no operand “address” in this operation, the operand is contained in the statement

a. L 14 // Load accumulator with the integer value 14

B) Direct addressing - Direct addressing refers to the use of an actual memory or object address to specify the location of the operand. A statement list example would be loading the value contained in Marker word 46 into the accumulator. The operand address is explicitly called out in the operation

a. L MW46 // Load the accumulator with the contents of MW46

C) Indirect addressing –Indirect addressing refers to the use of a “pointer” to indicate where the operand address can be found. A statement list example would be loading the accumulator with the contents of a memory word, whose address is contained in a pointer. The operand address is not computed until runtime. Braces are used to signify an indirect address to the operand

a. L MW [POINTER_LOCATION] // Load accumulator from a MW whose address is stored as a POINTER in POINTER_LOCATION

Two Types of Indirect Addressing

Indirect addressing in S7 PLCs can then be further subdivided into two types:

A) Memory-Indirect addressing – In memory-indirect addressing, the “pointer” to the operand address is stored in a memory location. The pointers may be stored in „double word‟ locations in Marker (MD), Local (LD), Global Data Block (DBD) or Instance Data Block (DID) memory. Memory indirect addressing is convenient to use when you have multiple pointers that you are using in the program

B) Register Indirect addressing – In register indirect addressing, an address register is used for computing the actual address of the data. The “pointer” to the actual data address is stored in one of the two Address Registers of the PLC, and that gets combined with an “offset” value to compute the variable address. Register indirect addressing is the form best supported by STL since you can directly display the contents of the address register to see where the pointer is aimed. Register indirect addressing also executes faster than Memory Indirect addressing. Register indirect addressing can also be used for programming situations where you don‟t explicitly

know the Memory Area of the actual data until runtime. Register Indirect Addressing is covered more completely in a companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 2 – Register Indirect Addressing”


Addressing





Memory indirect addressing of Marker memory are shown below:

Example Comment

L MW [MD44] Load accum. from marker word whose address is stored in MD 44, If MD44 contains the Pointer P#122.0, then this operation will load the contents of MW122 into the accumulator.

L MW [DBD12] Load accum. from marker word whose address is in DBD 12, If DBD 12 contains the Pointer P#122.0, then this operation will load the contents of MW122 into the accumulator.

Memory indirect addressing of Peripheral Input memory are shown below:

Example Comment

L PIB [MD22] Load accum. from PI byte whose address is in MD 22, If MD22 contains the Pointer P#122.0, then this operation will load the contents of PIB 122 into the accumulator.

L PIW [DBD38] Load accum. from PI word whose address is in DBD 38, If DBD 38 contains the Pointer P#122.0, then this operation will load the contents of PIW 122 into the accumulator.

Register Indirect addressing of Peripheral Input memory is shown below:

Example Comment

LAR1 P#20.0

L MB [AR1, P#0.0]

Preload Address Register 1 (AR1) with a pointer (20.0). Then load the accumulator with the contents of the Marker Byte addressed by the sum of AR1 and the offset P#0.0. In this case the accumulator would be loaded with the contents of MB20

Special Case – Indirect Addressing of Block Objects

Certain Block Objects in the S7 PLC architecture are identified by an “integer” address rather than a Byte.Bit structured address. These objects include the following:

Global Data Blocks DB xxx Instance Data Blocks DI xxx

Timers T xxx Counters C xxx

Functions FC xxx Function Blocks FB xxx


Addressing





These Block Objects may be Indirectly addressed by using an integer form of Memory Indirect addressing. Examples of this form of indirect addressing are shown in the table below

Memory Indirect Addressing of Block Objects

Example Comment

OPN DB [MW22] This will open a data block whose address (data block number) is stored as an integer in MW22. If MW22 contains the integer value 126, then Data Block 126 will be opened.

R T [MW14} This operation resets the timer who‟s number is stored in MW14. If MW14 contains 24, then Timer #24 will be reset

Pointers

Pointers are special “data types” that are structured to contain an S7 memory address. Pointers may be stored as “data” in either memory locations or in S7 CPU registers. There are three “classes” of pointers contained in the S7 architecture. These include:

A) Area Pointers – a 32 bit structure that specifies a specific address

B) DB Pointers – a 48 bit structure that combines an area pointer and a 16 bit DB number

C) ANY Pointers – an 80-bit structure with additional specifications for the variable address.

This application note will describe “area pointers” in detail. Further information on DB pointers and ANY pointers can also be found in the companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 2 – Register Indirect Addressing”.

Area Pointers

In general, an area pointer needs to contain the three basic components as shown below to specify a location in S7 memory

A) Address Area – the address area part of the address describes which memory area is being addressed. In general the S7 address areas include Peripheral I/O (PI and PQ), Input and Output image (I and Q), Marker memory (M), Global data (DBx), Instance data (DIx), temporary local data (L), and temporary local data of the “calling block‟ (V). The address area may also contain a “null” specification meaning the pointer containing only a “byte.bit” value

B) Byte Address – the byte address is a number specifying the byte offset into the memory area. The byte address of an address area starts at byte 0

Address Area Byte Address Bit Address


Addressing





C) Bit Address – this contains the bit number of the addressed byte above. The bit address is a number from 0 to 7.

The 32 bit Area Pointers are constructed as shown in the figure below. It consists of 4 bytes of information. The byte contents are described below.

Where:

XXX = the bit address (values range from „000‟ to „111‟

YYYYYYYYYYYYYYYY = Byte address (values range from hex „0000‟ to „FFFF‟

Area Type = memory area as specified in the table below

“Area Type”

Bit Value

Area Type

00000000 “Area internal pointer”, meaning a pointer that does not include the Address area type in the pointer value

10000000 Peripheral I/O (PI or PQ)

10000001 Inputs (I)

10000010 Outputs (Q)

10000011 Marker memory (M)

10000100 Global Data (DBX)

10000101 Instance Data (DIX)

10000110 Temporary Local Data (L)

10000111 Temporary Local Data of the predecessor (calling) block (V)

A Pointer data type is identified in S7 programming languages by the format “P#address”, where “address” is the memory address to turn into a pointer, for instance:

Byte 1 Byte 2 Byte 3 Byte 4

P# 12.0 creates a pointer value of 00000000 00000000 00000000 01100000

P# 12.3 creates a pointer value of 00000000 00000000 00000000 01100011

P# M12.3 creates a pointer value of 10000011 00000000 00000000 01100011

Pointers can also be created using the symbolic name of a memory location. For instance, if the symbol table includes a symbol named “Valve_12” that is assigned to M12.3, then using the

Byte N Byte N+1 Byte N+2 Byte N+3

Area Type 00000YYY YYYYYYYY YYYYYXXX


Addressing





pointer “P# Valve_12” creates the same pointer value as “P# M12.3”. A pointer data type can then be used as “immediate operands” in STL statements as shown in the table below.

Preparing Pointers for use as Indirect Addresses

“Area Internal” Pointer Operation Description

L P# 123.0 This operation instructs the CPU to load the accumulator with an “area internal pointer” for “123.0” After execution of this statement, the accumulator will contain the following 32 bit value:

00000000 00000000 00000011 11011000

L P# 123.0

T MD4

This two-step operation loads an “area internal pointer” into the accumulator, and then transfers the pointer value into MD4, which can now be used for an indirect addressing operation. MD4 now contains

00000000 00000000 00000011 11011000

L P# 123.0

T MD4

.

L MB [MD4]

This three-step operation loads a pointer of value 123.0 into the accumulator and stores the pointer into the double word location MD4. The third instruction will then use the “pointer” found in MD4 to point to location M123.0 and will load the contents of MB123 into the into the accumulator

“Area Crossing” Pointer Operation Description

L P#M123.0 This operation instructs the CPU to load the accumulator with an “area crossing pointer” for “M123.0” After execution of this statement, the accumulator will contain the following 32 bit value:

10000011 00000000 00000011 11011000

L P#M123.0

T MD4

This two-step operation loads a pointer to M123.0 into the accumulator, and then transfers the pointer value into MD4, which can now be used for an indirect addressing operation. MD4 now contains

10000011 00000000 00000011 11011000

L P#M123.0

T MD4

.

L B [MD4]

This three-step operation loads a pointer to M123.0 into the accumulator and stores the pointer into the double word location MD4. The third instruction will then use the “pointer” found in MD4 to point to location M123.0 and will load the contents of MB123 into the into the accumulator

Working With Memory Indirect Addressing - Instructions

Memory Indirect Addressing can be used in the following Statement List instructions:


Addressing





Operation STL Mnemonics Sample

Binary Logic Operations A, AN, O, ON, X, XN A M [MD12]

O T [QW12]*

Binary Memory Functions

=, S, R, FP, FN = Q [MD66]

R C [MW88]*

Accumulator Functions L, T T QW [DID44]

L T [MW12]*

Block Functions

(Integer memory indirect specification of the objects))

OPN (opening aDB)

S, R, CU, CD (counter actions)

SP, SE, SD, SS, SF (start timers)

CALL, UC, CC (calling code blocks)

OPN DB [mw12]*

CU C [DBW56]*

SE T [MW12]*

UC FC [MW12]*

* Integer Memory Pointers for Block Objects

Working With Memory Indirect Addressing - Indexing

Area pointers may be used to perform indexed reading and writing from a table or array of data items. This can easily be accomplished by creating an area pointer that contains the starting address of the table of data, and then adding a “pointer increment” to the table pointer that is equal to the desired “index” into the table of data. The example below shows a routine for accessing an element in the table of bytes starting at location MB20

// This assumes an integer symbol named “index” exists that //contains the index (from 0 to 179) into the table

L index // load a variable “index” into the table

SLD 3 // Shift left 3 bits to create an “index pointer”

L P#20.0 // load the pointer to the start of table

+D // Add “index pointer” to “start of table pointer”

T MD100 // Store the indexed pointer in MD100

L MB [MD100] // read the table element into the accumulator

Location Table

element

MB20 Element 0

MB21 Element 1

MB22 Element 2

MB24 Element 3

… …

MB200 Element 180

Sample STEP7 Function Library

The object inserted below is an archived library of STEP7 functions that demonstrate the use of memory indirect addressing for performing some commonly used data handling operations regarding arrays. You may copy this archived object into a folder on your hard drive and then retrieve the archive using STEP7 program manager. Once the Archive is retrieved, it will add a new library, called “Array_Functions” to your STEP7 package. The functions in this library are


Addressing





then available for your use in developing PLC programs. You may also open this library in the Program manager and transfer the STEP7 program called “Simple Arrays” into an S7 PLC for testing.

The “Simple Arrays” program includes a set of six Functions (FC10 through FC15) for reading and writing to arrays of BYTE, INTEGER, or FLOATING POINT data. The program also includes a main OB1, three data blocks containing test arrays, and three VAT tables for exercising these functions.

The library of six array-handling functions will be available for your use in the instruction catalog as shown in the figure below.

Related Information

Further detailed information regarding the S7 statement List programming language may be found in a textbook by Hans Berger called “Automating with STEP7 in STL and SCL” ISBN Number 3-89578-140-1


Addressing





Hardware and Software Considerations

General Notes

The SIMATIC Application Tips are provided to give users of Siemens‟ Simatic products some indication as to how, from the view of programming technique, certain tasks can be solved. These instructions do not purport to cover all details or variations in equipment, nor do they provide for every possible contingency. Use of the Simatic Application Tips is free.

Siemens reserves the right to make changes in specifications shown herein or make improvements at any time without notice or obligation. It does not relieve the user of responsibility to use sound practices in application, installation, operation, and maintenance of the equipment purchased. Should a conflict arise between the general information contained in this publication, the contents of drawings or supplementary material, or both, the latter shall take precedence.

Siemens is not liable, for whatever legal reason, for damages or personal injury resulting from the use of the application tips.

All rights reserved. Any form of duplication or distribution, including excerpts, is only permitted with express authorization by SIEMENS.

Documents

1.Memory Indirect Addressing