2.Register Indirect Addressing

Simatic Tip Tip No. VC

Pointers and Indirect Addressing in S7 PLCs, Volume 2- Register Indirect Addressing

Copyright 2000 by SIEMENS page 1 / 9 Revision 11

SIMATIC NET customers have free use of the application tips. These tips are only a general approach to using SIMATIC NET with various applications.

Your specific application may be different. It is your responsibility to use SIMATIC NET properly in your applications.

SIMATIC TIPS Totally Integrated Automation

Application Notes

Group Topic and Author

Automation Pointers and Indirect Addressing in S7 PLCs, Volume 2- Register

Indirect Addressing

Eddie Prince

Overview – Indirect Addressing in S7 PLCs

This application note is the second of three notes that provide an overview of indirect addressing methods and structures available in the Statement List (STL) language for S7 PLCs. It describes the types of addressing available, including immediate, direct, and indirect addressing, and detailed descriptions of address pointers and their uses. The documents also include archived STEP7 librarys containing functions (FC) that demonstrate these addressing methods. The functions in the library demonstrate the use of indirect addressing methods to read from and write to arrays of bytes, integers, real numbers, and arrays of structures.

Volume 1 describes Memory Indirect Addressing

Volume 2 describes Register Indirect Addressing

Volume 3 describes the use of DB Pointers and ANY Pointers

Structure of an STL Statement

The STL Statement is the smallest “piece” of a user program. It defines a specific task for the CPU to perform, such as loading a variable into a register, or performing a math operation. The structure of an STL statement is shown below, and the individual elements of the statement are further described.

A) Label –An optional “name” assigned to a statement used for “Jump” or “Loop” operations

B) Operation –The “task to be performed” such as Load, Transfer, Add.

C) Operand –The “variable” (or data) to be manipulated by this statement. The operand may be a “value”, or a memory address containing the data, or a pointer to a memory address that contains the data.

D) Comment –Optional text field for documenting the program code

Label Operation Operand Comment

Loop: L MB 12 // Load accu1

Pointers and Indirect Addressing in S7 PLCs, Volume 2- Register Indirect

Addressing





Types of Addressing in S7

There are several basic methods of addressing that can be used to “identify” an operand in an S7 programmable controller. These basic types are as follows:

A) Immediate Addressing – Immediate addressing refers to the use of a number value as an operand. A Statement List example would be to load a constant into the accumulator. There is no operand “address” in this operation, the operand is contained in the statement

a. L 14 // Load accumulator with the integer value 14

B) Direct addressing - Direct addressing refers to the use of an actual memory or object address to specify the location of the operand. A statement list example would be loading the value contained in Marker word 46 into the accumulator. The operand address is explicitly called out in the operation

a. L MW46 // Load the accumulator with the contents of MW46

C) Indirect addressing –Indirect addressing refers to the use of a “pointer” to indicate where the operand address can be found. A statement list example would be loading the accumulator with the contents of a memory word, whose address is contained in a pointer. The operand address is not computed until runtime. Braces are used to signify an indirect address to the operand

a. L MW [POINTER_LOCATION] // Load accumulator from a MW whose address is stored as a POINTER in POINTER_LOCATION

Two Types of Indirect Addressing

Indirect addressing in S7 PLCs can then be further subdivided into two types:

A) Memory-Indirect addressing – In memory-indirect addressing, the “pointer” to the operand address is stored in a memory location. The pointers may be stored in „double word‟ locations in Marker (MD), Local (LD), Global Data Block (DBD) or Instance Data Block (DID) memory. Memory indirect addressing is convenient to use when you have multiple pointers that you are using in the program. . Memory Indirect Addressing is covered more completely in a companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 1 – Memory Indirect Addressing”.

B) Register Indirect addressing – In register indirect addressing, an address register is used for computing the actual address of the data. The “pointer” to the actual data address is stored in one of the two Address Registers of the PLC, and that gets combined with an “offset” value to compute the variable address. Register indirect addressing is the form best supported by STL since you can directly display the contents of the address register to see where the pointer is aimed. Register indirect addressing also executes faster than Memory Indirect addressing. Register indirect addressing can also be used for programming situations where you don‟t explicitly

know the Memory Area of the actual data until runtime. This is useful when constructing general purpose Functions and Function Blocks where a location will be passed into or out of the function block. In register Indirect addressing the address


Addressing





register can contain either an “area internal” or an “area crossing” pointer. The

difference between these two pointers is that an “area internal” pointer only contains

a Byte.Bit value (for instance P#22.3) whereas an “area crossing” pointer also includes the memory area identifier (for instance P#M22.3 contains the type identifier for Marker memory)

Pointers

Pointers are special “data types” that are structured to contain an S7 memory address. Pointers may be stored as “data” in either memory locations or in S7 CPU registers. There are three “classes” of pointers contained in the S7 architecture. These include:

A) Area Pointers – a 32 bit structure that specifies a specific address

B) DB Pointers – a 48 bit structure that combines an area pointer and a 16 bit DB number

C) ANY Pointers – an 80-bit structure with additional specifications for the variable address.

This application note will describe “area pointers” in detail. Further information on DB pointers and ANY pointers can also be found in the companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 3 – DB Pointers and ANY Pointers”.

Area Pointers

As shown below, an area pointer needs to contain three basic components to specify a location in S7 memory

A) Address Area – the address area part of the pointer describes which memory area is being addressed. In general the S7 address areas include Peripheral I/O (PI and PQ), Input and Output image (I and Q), Marker memory (M), Global data (DBx), Instance data (DIx), temporary local data (L), and temporary local data of the “calling block‟ (V). The address area may also contain a “null” specification meaning the pointer contains only a “byte.bit” value

B) Byte Address – the byte address is a number specifying the byte offset into the memory area. The byte address of an address area starts at byte 0

C) Bit Address – this contains the bit number of the addressed byte above. The bit address is a number from 0 to 7.

The 32 bit Area Pointers are constructed as shown in the figure below. It consists of 4 bytes of information. The byte contents are described below.

Address Area Byte Address Bit Address

Byte N Byte N+1 Byte N+2 Byte N+3


Addressing





Where:

XXX = the bit address (values range from „000‟ to „111‟

YYYYYYYYYYYYYYYY = Byte address (values range from hex „0000‟ to „FFFF‟

Area Type = memory area as specified in the table below

“Area Type”Bit Value Area Type

00000000 “Area internal pointer”, meaning a pointer that does not include the

Address area type in the pointer value. Area internal pointers are

the only pointers allowed for use in memory indirect

addressing.

10000000 Peripheral I/O (PI or PQ)

10000001 Inputs (I)

10000010 Outputs (Q)

10000011 Marker memory (M)

10000100 Global Data (DBX)

10000101 Instance Data (DIX)

10000110 Temporary Local Data (L)

10000111 Temporary Local Data of the predecessor (calling) block (V)

A Pointer data type is identified in S7 programming languages by the format “P#address”, where “address” is the memory address to turn into a pointer, for instance:

Byte 1 Byte 2 Byte 3 Byte 4

P# 12.0 creates a pointer value of 00000000 00000000 00000000 01100000

P# 12.3 creates a pointer value of 00000000 00000000 00000000 01100011

P# M12.3 creates a pointer value of 10000011 00000000 00000000 01100011

Pointers can also be created using the symbolic name of a memory location. For instance, if the symbol table includes a symbol named “Valve_12” that is assigned to M12.3, then using the pointer “P# Valve_12” creates the same pointer value as “P# M12.3”. Once created and stored, a pointer data type can then be used as an “operand” in STL statements for defining the indirect addressing.

Register indirect addressing permits the use of both the “internal” and “area crossing” area pointer types. When using the “internal” type of pointer, the statement containing the indirect operation must include an explicit identification of the desired memory area. When using the

Area Type 00000YYY YYYYYYYY YYYYYXXX


Addressing





“area crossing” pointer type, the statement need only identify the “data length” (byte, word, or double word) since the pointer itself contains the area definition.

The “operand format” for instructions using register indirect addressing is shown below for both “area internal” and “area crossing” pointer types. Several examples of each type of register indirect addressing are then demonstrated in the tables below.

Operand Format for “Area Internal” register indirect

LENGTH [address_register, offset]

Operand Format for “Area crossing” register indirect

AREA LENGTH [address_register, offset]

Register Indirect addressing of using “area internal” pointers:

Example Comment

LAR1 P#20.0

L MB [AR1, P#0.0]

Preload Address Register 1 (AR1) with an “area internal” pointer (20.0). Then load the accumulator with the contents of the Marker Byte addressed by the sum of AR1 and the offset P#0.0. In this case the accumulator would be loaded with the contents of MB20

LAR2 P#18.0

L MB [AR2, P#2.0]

Preload Address Register 2 (AR1) with an “area internal” pointer (18.0). Then load the accumulator with the contents of the Byte addressed by the sum of AR2 and the offset P#2.0. In this case the accumulator would also be loaded with the contents of MB20 since the actual indirect address includes an “offset” of 2 byte positions

LAR1 P#18.3

S Q [AR2, P#0.2]

In this example, the “SET” operation computes a target address of Q18.5 by combining the contents of AR1 (18.3) with an offset of 2 bits (0.2) This demonstrates the use of indirect addressing to specify “bit” locations

The examples of “area Internal” addressing shown in the table above are repeated in the next table; however, the “area internal” pointers are replaced with “area crossing” pointers to demonstrate the format differences.

Register Indirect addressing of using “area crossing” pointers:

Example Comment

LAR1 P#M20.0 Preload Address Register 1 (AR1) with an “area crossing”


Addressing





L B [AR1, P#0.0] pointer (M20.0). Then load the accumulator with the contents of the Marker Byte addressed by the sum of AR1 and the offset P#0.0. In this case the Load instruction‟s operand does not have to include the area specification M, since this is contained within the pointer. In this instance the accumulator would be loaded with the contents of MB20

LAR2 P#M18.0

L B [AR2, P#2.0]

Preload Address Register 2 (AR1) with an “area crossing” pointer (M18.0). Then load the accumulator with the contents of the Byte addressed by the sum of AR2 and the offset P#2.0. In this case the accumulator would also be loaded with the contents of MB20 since the actual indirect address includes an “offset” of 2 byte positions

LAR1 P#Q18.3

S [AR2, P#0.2]

In this example, the “SET” operation computes a target address of Q18.5 by combining the contents of AR1 (Q18.3) with an offset of 2 bits (0.2). This demonstrates the use of indirect addressing to specify “bit” locations

Working with Register Indirect Addressing - Instructions

Register Indirect Addressing can be used in the following Statement List instructions:

Operation STL Mnemonics Sample

Binary Logic Operations A, AN, O, ON, X, XN A M [AR1, P#2.1]

X [AR2, P#3.4]

Binary Memory Functions

=, S, R, FP, FN = Q [AR2, P#0.0]

R [AR3, P#122.3]

Accumulator Functions L, T T QW [AR2, P#12.2]

L B[AR1, P#0.0]

Working With Register Indirect Addressing - Indexing

Area pointers may be used to perform indexed reading and writing from a table or array of data items. This can easily be accomplished by creating an area pointer that contains the starting address of the table of data, and then adding a “pointer increment” to the table pointer that is equal to the desired “index” into the table of data. The example below shows a routine for accessing an element in the table of bytes starting at location MB20


Addressing





// This assumes an integer symbol named “index” exists that //contains the index (from 0 to 179) into the table

L index // load a variable “index” into the accumulator

SLD 3 // Shift left 3 bits to create an “index pointer”

LAR1 // load the index pointer into the Address register

L MB [AR1, P#20.0] // Load Accumulator from (INDEX + 20)

Location Table

element

MB20 Element 0

MB21 Element 1

MB22 Element 2

MB24 Element 3

… …

MB200 Element 180

Sample STEP7 Function Library

The object inserted below is an archived library of STEP7 functions that demonstrate the use of register indirect addressing for performing some commonly used data handling operations regarding arrays. You may copy this archived object into a folder on your hard drive and then retrieve the archive using STEP7 program manager. Once the Archive is retrieved, it will add a new library, called “Reg_Indirect_Array_FC” to your STEP7 package. The functions in this library are then available for your use in developing PLC programs. You may also open this library in the Program manager and transfer the STEP7 program called “Arrays_reg_indirect” into an S7 PLC for testing.

The rogram includes a set of six Functions (FC10 through FC15) for reading and writing to arrays of BYTE, INTEGER, or FLOATING POINT data. The program also includes a main OB1, three data blocks containing test arrays, and three VAT tables for exercising these functions.

The library of six array-handling functions will be available for your use in the instruction catalog as shown in the figure below.


Addressing





Related Information

Further detailed information regarding the S7 statement List programming language may be found in a textbook by Hans Berger called “Automating with STEP7 in STL and SCL” ISBN Number 3-89578-140-1


Addressing





General Notes

The SIMATIC Application Tips are provided to give users of Siemens‟ Simatic products some indication as to how, from the view of programming technique, certain tasks can be solved. These instructions do not purport to cover all details or variations in equipment, nor do they provide for every possible contingency. Use of the Simatic Application Tips is free.

Siemens reserves the right to make changes in specifications shown herein or make improvements at any time without notice or obligation. It does not relieve the user of responsibility to use sound practices in application, installation, operation, and maintenance of the equipment purchased. Should a conflict arise between the general information contained in this publication, the contents of drawings or supplementary material, or both, the latter shall take precedence.

Siemens is not liable, for whatever legal reason, for damages or personal injury resulting from the use of the application tips.

All rights reserved. Any form of duplication or distribution, including excerpts, is only permitted with express authorization by SIEMENS.

Documents

2.Register Indirect Addressing