S7 Pointers

Simatic Tip Tip No. VC

Pointers and Indirect Addressing in S7 PLCs, Volume 1- Memory Indirect Addressing

Copyright 2000 by SIEMENS page 1 / 9 Revision 4

SIMATIC NET customers have free use of the application tips. These tips are only a general approach to using SIMATIC NET with various applications.

Your specific application may be different. It is your responsibility to use SIMATIC NET properly in your applications.

SIMATIC TIPS Totally Integrated Automation

Application Notes

Group Topic and Author

Automation Pointers and Indirect Addressing in S7 PLCs, Volume 1- Memory

Indirect Addressing

Eddie Prince

Overview – Indirect Addressing in S7 PLCs

This application note provides an overview of indirect addressing methods and structures available in the Statement List (STL) language for S7 PLCs. It describes the types of addressing available, including immediate addressing, direct addressing, and indirect addressing, with a primary focus on memory indirect addressing. The document also includes an archived STEP7 library of functions that use these addressing methods. The functions in the library demonstrate the use of memory indirect addressing to read from and write to arrays of bytes, integers, and real numbers.

Structure of an STL Statement

The STL Statement is the smallest “piece” of a user program. It defines a specific task for the CPU to perform, such as loading a variable into a register, or performing a math operation. The structure of an STL statement is shown below, and the individual elements of the statement are further described.

A) Label – the label is an optional “name” assigned to a statement used for “Jump” or “Loop” operations

B) Operation –the operation is the “task to be performed” such as Load, Transfer, Add.

C) Operand – the operand is the “variable” (or data) to be manipulated by this statement. The operand may be an actual “value”, or it may be a memory address that contains the data, or it may be a pointer to a memory address that contains the data

D) Comment –Optional text field for documenting the program code

The following sections will describe various methods of addressing the Operand.

Label Operation Operand Comment

Loop: L MB 12 // Load accu1

Pointers and Indirect Addressing in S7 PLCs, Volume 1- Memory Indirect

Addressing





Types of Addressing in S7

There are several basic methods of addressing that can be used to “identify” an operand in an S7 programmable controller. These basic types are as follows:

A) Immediate Addressing – Immediate addressing refers to the use of a number value as an operand. A Statement List example would be to load a constant into the accumulator. There is no operand “address” in this operation, the operand is contained in the statement

a. L 14 // Load accumulator with the integer value 14

B) Direct addressing - Direct addressing refers to the use of an actual memory or object address to specify the location of the operand. A statement list example would be loading the value contained in Marker word 46 into the accumulator. The operand address is explicitly called out in the operation

a. L MW46 // Load the accumulator with the contents of MW46

C) Indirect addressing –Indirect addressing refers to the use of a “pointer” to indicate where the operand address can be found. A statement list example would be loading the accumulator with the contents of a memory word, whose address is contained in a pointer. The operand address is not computed until runtime. Braces are used to signify an indirect address to the operand

a. L MW [POINTER_LOCATION] // Load accumulator from a MW whose address is stored as a POINTER in POINTER_LOCATION

Two Types of Indirect Addressing

Indirect addressing in S7 PLCs can then be further subdivided into two types:

A) Memory-Indirect addressing – In memory-indirect addressing, the “pointer” to the operand address is stored in a memory location. The pointers may be stored in „double word‟ locations in Marker (MD), Local (LD), Global Data Block (DBD) or Instance Data Block (DID) memory. Memory indirect addressing is convenient to use when you have multiple pointers that you are using in the program

B) Register Indirect addressing – In register indirect addressing, an address register is used for computing the actual address of the data. The “pointer” to the actual data address is stored in one of the two Address Registers of the PLC, and that gets combined with an “offset” value to compute the variable address. Register indirect addressing is the form best supported by STL since you can directly display the contents of the address register to see where the pointer is aimed. Register indirect addressing also executes faster than Memory Indirect addressing. Register indirect addressing can also be used for programming situations where you don‟t explicitly

know the Memory Area of the actual data until runtime. Register Indirect Addressing is covered more completely in a companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 2 – Register Indirect Addressing”


Addressing





Memory indirect addressing of Marker memory are shown below:

Example Comment

L MW [MD44] Load accum. from marker word whose address is stored in MD 44, If MD44 contains the Pointer P#122.0, then this operation will load the contents of MW122 into the accumulator.

L MW [DBD12] Load accum. from marker word whose address is in DBD 12, If DBD 12 contains the Pointer P#122.0, then this operation will load the contents of MW122 into the accumulator.

Memory indirect addressing of Peripheral Input memory are shown below:

Example Comment

L PIB [MD22] Load accum. from PI byte whose address is in MD 22, If MD22 contains the Pointer P#122.0, then this operation will load the contents of PIB 122 into the accumulator.

L PIW [DBD38] Load accum. from PI word whose address is in DBD 38, If DBD 38 contains the Pointer P#122.0, then this operation will load the contents of PIW 122 into the accumulator.

Register Indirect addressing of Peripheral Input memory is shown below:

Example Comment

LAR1 P#20.0

L MB [AR1, P#0.0]

Preload Address Register 1 (AR1) with a pointer (20.0). Then load the accumulator with the contents of the Marker Byte addressed by the sum of AR1 and the offset P#0.0. In this case the accumulator would be loaded with the contents of MB20

Special Case – Indirect Addressing of Block Objects

Certain Block Objects in the S7 PLC architecture are identified by an “integer” address rather than a Byte.Bit structured address. These objects include the following:

Global Data Blocks DB xxx Instance Data Blocks DI xxx

Timers T xxx Counters C xxx

Functions FC xxx Function Blocks FB xxx


Addressing





These Block Objects may be Indirectly addressed by using an integer form of Memory Indirect addressing. Examples of this form of indirect addressing are shown in the table below

Memory Indirect Addressing of Block Objects

Example Comment

OPN DB [MW22] This will open a data block whose address (data block number) is stored as an integer in MW22. If MW22 contains the integer value 126, then Data Block 126 will be opened.

R T [MW14} This operation resets the timer who‟s number is stored in MW14. If MW14 contains 24, then Timer #24 will be reset

Pointers

Pointers are special “data types” that are structured to contain an S7 memory address. Pointers may be stored as “data” in either memory locations or in S7 CPU registers. There are three “classes” of pointers contained in the S7 architecture. These include:

A) Area Pointers – a 32 bit structure that specifies a specific address

B) DB Pointers – a 48 bit structure that combines an area pointer and a 16 bit DB number

C) ANY Pointers – an 80-bit structure with additional specifications for the variable address.

This application note will describe “area pointers” in detail. Further information on DB pointers and ANY pointers can also be found in the companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 2 – Register Indirect Addressing”.

Area Pointers

In general, an area pointer needs to contain the three basic components as shown below to specify a location in S7 memory

A) Address Area – the address area part of the address describes which memory area is being addressed. In general the S7 address areas include Peripheral I/O (PI and PQ), Input and Output image (I and Q), Marker memory (M), Global data (DBx), Instance data (DIx), temporary local data (L), and temporary local data of the “calling block‟ (V). The address area may also contain a “null” specification meaning the pointer containing only a “byte.bit” value

B) Byte Address – the byte address is a number specifying the byte offset into the memory area. The byte address of an address area starts at byte 0

Address Area Byte Address Bit Address


Addressing





C) Bit Address – this contains the bit number of the addressed byte above. The bit address is a number from 0 to 7.

The 32 bit Area Pointers are constructed as shown in the figure below. It consists of 4 bytes of information. The byte contents are described below.

Where:

XXX = the bit address (values range from „000‟ to „111‟

YYYYYYYYYYYYYYYY = Byte address (values range from hex „0000‟ to „FFFF‟

Area Type = memory area as specified in the table below

“Area Type”

Bit Value

Area Type

00000000 “Area internal pointer”, meaning a pointer that does not include the Address area type in the pointer value

10000000 Peripheral I/O (PI or PQ)

10000001 Inputs (I)

10000010 Outputs (Q)

10000011 Marker memory (M)

10000100 Global Data (DBX)

10000101 Instance Data (DIX)

10000110 Temporary Local Data (L)

10000111 Temporary Local Data of the predecessor (calling) block (V)

A Pointer data type is identified in S7 programming languages by the format “P#address”, where “address” is the memory address to turn into a pointer, for instance:

Byte 1 Byte 2 Byte 3 Byte 4

P# 12.0 creates a pointer value of 00000000 00000000 00000000 01100000


P# M12.3 creates a pointer value of 10000011 00000000 00000000 01100011

Pointers can also be created using the symbolic name of a memory location. For instance, if the symbol table includes a symbol named “Valve_12” that is assigned to M12.3, then using the

Byte N Byte N+1 Byte N+2 Byte N+3

Area Type 00000YYY YYYYYYYY YYYYYXXX


Addressing





pointer “P# Valve_12” creates the same pointer value as “P# M12.3”. A pointer data type can then be used as “immediate operands” in STL statements as shown in the table below.

Preparing Pointers for use as Indirect Addresses

“Area Internal” Pointer Operation Description

L P# 123.0 This operation instructs the CPU to load the accumulator with an “area internal pointer” for “123.0” After execution of this statement, the accumulator will contain the following 32 bit value:

00000000 00000000 00000011 11011000

L P# 123.0

T MD4

This two-step operation loads an “area internal pointer” into the accumulator, and then transfers the pointer value into MD4, which can now be used for an indirect addressing operation. MD4 now contains

00000000 00000000 00000011 11011000

L P# 123.0

T MD4

.

L MB [MD4]

This three-step operation loads a pointer of value 123.0 into the accumulator and stores the pointer into the double word location MD4. The third instruction will then use the “pointer” found in MD4 to point to location M123.0 and will load the contents of MB123 into the into the accumulator

“Area Crossing” Pointer Operation Description

L P#M123.0 This operation instructs the CPU to load the accumulator with an “area crossing pointer” for “M123.0” After execution of this statement, the accumulator will contain the following 32 bit value:

10000011 00000000 00000011 11011000

L P#M123.0

T MD4

This two-step operation loads a pointer to M123.0 into the accumulator, and then transfers the pointer value into MD4, which can now be used for an indirect addressing operation. MD4 now contains

10000011 00000000 00000011 11011000

L P#M123.0

T MD4

.

L B [MD4]

This three-step operation loads a pointer to M123.0 into the accumulator and stores the pointer into the double word location MD4. The third instruction will then use the “pointer” found in MD4 to point to location M123.0 and will load the contents of MB123 into the into the accumulator

Working With Memory Indirect Addressing - Instructions

Memory Indirect Addressing can be used in the following Statement List instructions:


Addressing





Operation STL Mnemonics Sample

Binary Logic Operations A, AN, O, ON, X, XN A M [MD12]

O T [QW12]*

Binary Memory Functions

=, S, R, FP, FN = Q [MD66]

R C [MW88]*

Accumulator Functions L, T T QW [DID44]

L T [MW12]*

Block Functions

(Integer memory indirect specification of the objects))

OPN (opening aDB)

S, R, CU, CD (counter actions)

SP, SE, SD, SS, SF (start timers)

CALL, UC, CC (calling code blocks)

OPN DB [mw12]*

CU C [DBW56]*

SE T [MW12]*

UC FC [MW12]*

* Integer Memory Pointers for Block Objects

Working With Memory Indirect Addressing - Indexing

Area pointers may be used to perform indexed reading and writing from a table or array of data items. This can easily be accomplished by creating an area pointer that contains the starting address of the table of data, and then adding a “pointer increment” to the table pointer that is equal to the desired “index” into the table of data. The example below shows a routine for accessing an element in the table of bytes starting at location MB20

// This assumes an integer symbol named “index” exists that //contains the index (from 0 to 179) into the table

L index // load a variable “index” into the table

SLD 3 // Shift left 3 bits to create an “index pointer”

L P#20.0 // load the pointer to the start of table

+D // Add “index pointer” to “start of table pointer”

T MD100 // Store the indexed pointer in MD100

L MB [MD100] // read the table element into the accumulator

Location Table

element

MB20 Element 0

MB21 Element 1

MB22 Element 2

MB24 Element 3

… …

MB200 Element 180

Sample STEP7 Function Library

The object inserted below is an archived library of STEP7 functions that demonstrate the use of memory indirect addressing for performing some commonly used data handling operations regarding arrays. You may copy this archived object into a folder on your hard drive and then retrieve the archive using STEP7 program manager. Once the Archive is retrieved, it will add a new library, called “Array_Functions” to your STEP7 package. The functions in this library are


Addressing





then available for your use in developing PLC programs. You may also open this library in the Program manager and transfer the STEP7 program called “Simple Arrays” into an S7 PLC for testing.

The “Simple Arrays” program includes a set of six Functions (FC10 through FC15) for reading and writing to arrays of BYTE, INTEGER, or FLOATING POINT data. The program also includes a main OB1, three data blocks containing test arrays, and three VAT tables for exercising these functions.

The library of six array-handling functions will be available for your use in the instruction catalog as shown in the figure below.

Related Information

Further detailed information regarding the S7 statement List programming language may be found in a textbook by Hans Berger called “Automating with STEP7 in STL and SCL” ISBN Number 3-89578-140-1


Addressing





Hardware and Software Considerations

General Notes

The SIMATIC Application Tips are provided to give users of Siemens‟ Simatic products some indication as to how, from the view of programming technique, certain tasks can be solved. These instructions do not purport to cover all details or variations in equipment, nor do they provide for every possible contingency. Use of the Simatic Application Tips is free.

Siemens reserves the right to make changes in specifications shown herein or make improvements at any time without notice or obligation. It does not relieve the user of responsibility to use sound practices in application, installation, operation, and maintenance of the equipment purchased. Should a conflict arise between the general information contained in this publication, the contents of drawings or supplementary material, or both, the latter shall take precedence.

Siemens is not liable, for whatever legal reason, for damages or personal injury resulting from the use of the application tips.

All rights reserved. Any form of duplication or distribution, including excerpts, is only permitted with express authorization by SIEMENS.


Pointers and Indirect Addressing in S7 PLCs, Volume 2- Register Indirect Addressing





Application Notes


Automation Pointers and Indirect Addressing in S7 PLCs, Volume 2- Register

Indirect Addressing

Eddie Prince


This application note is the second of three notes that provide an overview of indirect addressing methods and structures available in the Statement List (STL) language for S7 PLCs. It describes the types of addressing available, including immediate, direct, and indirect addressing, and detailed descriptions of address pointers and their uses. The documents also include archived STEP7 librarys containing functions (FC) that demonstrate these addressing methods. The functions in the library demonstrate the use of indirect addressing methods to read from and write to arrays of bytes, integers, real numbers, and arrays of structures.

Volume 1 describes Memory Indirect Addressing

Volume 2 describes Register Indirect Addressing

Volume 3 describes the use of DB Pointers and ANY Pointers

Structure of an STL Statement

The STL Statement is the smallest “piece” of a user program. It defines a specific task for the CPU to perform, such as loading a variable into a register, or performing a math operation. The structure of an STL statement is shown below, and the individual elements of the statement are further described.

A) Label –An optional “name” assigned to a statement used for “Jump” or “Loop” operations

B) Operation –The “task to be performed” such as Load, Transfer, Add.

C) Operand –The “variable” (or data) to be manipulated by this statement. The operand may be a “value”, or a memory address containing the data, or a pointer to a memory address that contains the data.

D) Comment –Optional text field for documenting the program code

Label Operation Operand Comment

Loop: L MB 12 // Load accu1

Pointers and Indirect Addressing in S7 PLCs, Volume 2- Register Indirect

Addressing





Types of Addressing in S7

There are several basic methods of addressing that can be used to “identify” an operand in an S7 programmable controller. These basic types are as follows:

A) Immediate Addressing – Immediate addressing refers to the use of a number value as an operand. A Statement List example would be to load a constant into the accumulator. There is no operand “address” in this operation, the operand is contained in the statement

a. L 14 // Load accumulator with the integer value 14

B) Direct addressing - Direct addressing refers to the use of an actual memory or object address to specify the location of the operand. A statement list example would be loading the value contained in Marker word 46 into the accumulator. The operand address is explicitly called out in the operation

a. L MW46 // Load the accumulator with the contents of MW46

C) Indirect addressing –Indirect addressing refers to the use of a “pointer” to indicate where the operand address can be found. A statement list example would be loading the accumulator with the contents of a memory word, whose address is contained in a pointer. The operand address is not computed until runtime. Braces are used to signify an indirect address to the operand

a. L MW [POINTER_LOCATION] // Load accumulator from a MW whose address is stored as a POINTER in POINTER_LOCATION

Two Types of Indirect Addressing

Indirect addressing in S7 PLCs can then be further subdivided into two types:

A) Memory-Indirect addressing – In memory-indirect addressing, the “pointer” to the operand address is stored in a memory location. The pointers may be stored in „double word‟ locations in Marker (MD), Local (LD), Global Data Block (DBD) or Instance Data Block (DID) memory. Memory indirect addressing is convenient to use when you have multiple pointers that you are using in the program. . Memory Indirect Addressing is covered more completely in a companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 1 – Memory Indirect Addressing”.

B) Register Indirect addressing – In register indirect addressing, an address register is used for computing the actual address of the data. The “pointer” to the actual data address is stored in one of the two Address Registers of the PLC, and that gets combined with an “offset” value to compute the variable address. Register indirect addressing is the form best supported by STL since you can directly display the contents of the address register to see where the pointer is aimed. Register indirect addressing also executes faster than Memory Indirect addressing. Register indirect addressing can also be used for programming situations where you don‟t explicitly

know the Memory Area of the actual data until runtime. This is useful when constructing general purpose Functions and Function Blocks where a location will be passed into or out of the function block. In register Indirect addressing the address


Addressing





register can contain either an “area internal” or an “area crossing” pointer. The

difference between these two pointers is that an “area internal” pointer only contains

a Byte.Bit value (for instance P#22.3) whereas an “area crossing” pointer also includes the memory area identifier (for instance P#M22.3 contains the type identifier for Marker memory)

Pointers

Pointers are special “data types” that are structured to contain an S7 memory address. Pointers may be stored as “data” in either memory locations or in S7 CPU registers. There are three “classes” of pointers contained in the S7 architecture. These include:

A) Area Pointers – a 32 bit structure that specifies a specific address



This application note will describe “area pointers” in detail. Further information on DB pointers and ANY pointers can also be found in the companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 3 – DB Pointers and ANY Pointers”.

Area Pointers

As shown below, an area pointer needs to contain three basic components to specify a location in S7 memory

A) Address Area – the address area part of the pointer describes which memory area is being addressed. In general the S7 address areas include Peripheral I/O (PI and PQ), Input and Output image (I and Q), Marker memory (M), Global data (DBx), Instance data (DIx), temporary local data (L), and temporary local data of the “calling block‟ (V). The address area may also contain a “null” specification meaning the pointer contains only a “byte.bit” value



The 32 bit Area Pointers are constructed as shown in the figure below. It consists of 4 bytes of information. The byte contents are described below.


Byte N Byte N+1 Byte N+2 Byte N+3


Addressing





Where:

XXX = the bit address (values range from „000‟ to „111‟

YYYYYYYYYYYYYYYY = Byte address (values range from hex „0000‟ to „FFFF‟

Area Type = memory area as specified in the table below

“Area Type”Bit Value Area Type

00000000 “Area internal pointer”, meaning a pointer that does not include the

Address area type in the pointer value. Area internal pointers are

the only pointers allowed for use in memory indirect

addressing.

10000000 Peripheral I/O (PI or PQ)

10000001 Inputs (I)

10000010 Outputs (Q)

10000011 Marker memory (M)

10000100 Global Data (DBX)

10000101 Instance Data (DIX)

10000110 Temporary Local Data (L)

10000111 Temporary Local Data of the predecessor (calling) block (V)

A Pointer data type is identified in S7 programming languages by the format “P#address”, where “address” is the memory address to turn into a pointer, for instance:

Byte 1 Byte 2 Byte 3 Byte 4



P# M12.3 creates a pointer value of 10000011 00000000 00000000 01100011

Pointers can also be created using the symbolic name of a memory location. For instance, if the symbol table includes a symbol named “Valve_12” that is assigned to M12.3, then using the pointer “P# Valve_12” creates the same pointer value as “P# M12.3”. Once created and stored, a pointer data type can then be used as an “operand” in STL statements for defining the indirect addressing.

Register indirect addressing permits the use of both the “internal” and “area crossing” area pointer types. When using the “internal” type of pointer, the statement containing the indirect operation must include an explicit identification of the desired memory area. When using the

Area Type 00000YYY YYYYYYYY YYYYYXXX


Addressing





“area crossing” pointer type, the statement need only identify the “data length” (byte, word, or double word) since the pointer itself contains the area definition.

The “operand format” for instructions using register indirect addressing is shown below for both “area internal” and “area crossing” pointer types. Several examples of each type of register indirect addressing are then demonstrated in the tables below.

Operand Format for “Area Internal” register indirect

LENGTH [address_register, offset]

Operand Format for “Area crossing” register indirect

AREA LENGTH [address_register, offset]

Register Indirect addressing of using “area internal” pointers:

Example Comment

LAR1 P#20.0

L MB [AR1, P#0.0]

Preload Address Register 1 (AR1) with an “area internal” pointer (20.0). Then load the accumulator with the contents of the Marker Byte addressed by the sum of AR1 and the offset P#0.0. In this case the accumulator would be loaded with the contents of MB20

LAR2 P#18.0

L MB [AR2, P#2.0]

Preload Address Register 2 (AR1) with an “area internal” pointer (18.0). Then load the accumulator with the contents of the Byte addressed by the sum of AR2 and the offset P#2.0. In this case the accumulator would also be loaded with the contents of MB20 since the actual indirect address includes an “offset” of 2 byte positions

LAR1 P#18.3

S Q [AR2, P#0.2]

In this example, the “SET” operation computes a target address of Q18.5 by combining the contents of AR1 (18.3) with an offset of 2 bits (0.2) This demonstrates the use of indirect addressing to specify “bit” locations

The examples of “area Internal” addressing shown in the table above are repeated in the next table; however, the “area internal” pointers are replaced with “area crossing” pointers to demonstrate the format differences.

Register Indirect addressing of using “area crossing” pointers:

Example Comment

LAR1 P#M20.0 Preload Address Register 1 (AR1) with an “area crossing”


Addressing





L B [AR1, P#0.0] pointer (M20.0). Then load the accumulator with the contents of the Marker Byte addressed by the sum of AR1 and the offset P#0.0. In this case the Load instruction‟s operand does not have to include the area specification M, since this is contained within the pointer. In this instance the accumulator would be loaded with the contents of MB20

LAR2 P#M18.0

L B [AR2, P#2.0]

Preload Address Register 2 (AR1) with an “area crossing” pointer (M18.0). Then load the accumulator with the contents of the Byte addressed by the sum of AR2 and the offset P#2.0. In this case the accumulator would also be loaded with the contents of MB20 since the actual indirect address includes an “offset” of 2 byte positions

LAR1 P#Q18.3

S [AR2, P#0.2]

In this example, the “SET” operation computes a target address of Q18.5 by combining the contents of AR1 (Q18.3) with an offset of 2 bits (0.2). This demonstrates the use of indirect addressing to specify “bit” locations

Working with Register Indirect Addressing - Instructions

Register Indirect Addressing can be used in the following Statement List instructions:

Operation STL Mnemonics Sample

Binary Logic Operations A, AN, O, ON, X, XN A M [AR1, P#2.1]

X [AR2, P#3.4]

Binary Memory Functions

=, S, R, FP, FN = Q [AR2, P#0.0]

R [AR3, P#122.3]

Accumulator Functions L, T T QW [AR2, P#12.2]

L B[AR1, P#0.0]

Working With Register Indirect Addressing - Indexing

Area pointers may be used to perform indexed reading and writing from a table or array of data items. This can easily be accomplished by creating an area pointer that contains the starting address of the table of data, and then adding a “pointer increment” to the table pointer that is equal to the desired “index” into the table of data. The example below shows a routine for accessing an element in the table of bytes starting at location MB20


Addressing





// This assumes an integer symbol named “index” exists that //contains the index (from 0 to 179) into the table

L index // load a variable “index” into the accumulator

SLD 3 // Shift left 3 bits to create an “index pointer”

LAR1 // load the index pointer into the Address register

L MB [AR1, P#20.0] // Load Accumulator from (INDEX + 20)

Location Table

element

MB20 Element 0

MB21 Element 1

MB22 Element 2

MB24 Element 3

… …

MB200 Element 180


The object inserted below is an archived library of STEP7 functions that demonstrate the use of register indirect addressing for performing some commonly used data handling operations regarding arrays. You may copy this archived object into a folder on your hard drive and then retrieve the archive using STEP7 program manager. Once the Archive is retrieved, it will add a new library, called “Reg_Indirect_Array_FC” to your STEP7 package. The functions in this library are then available for your use in developing PLC programs. You may also open this library in the Program manager and transfer the STEP7 program called “Arrays_reg_indirect” into an S7 PLC for testing.

The rogram includes a set of six Functions (FC10 through FC15) for reading and writing to arrays of BYTE, INTEGER, or FLOATING POINT data. The program also includes a main OB1, three data blocks containing test arrays, and three VAT tables for exercising these functions.

The library of six array-handling functions will be available for your use in the instruction catalog as shown in the figure below.


Addressing





Related Information



Addressing





General Notes

The SIMATIC Application Tips are provided to give users of Siemens‟ Simatic products some indication as to how, from the view of programming technique, certain tasks can be solved. These instructions do not purport to cover all details or variations in equipment, nor do they provide for every possible contingency. Use of the Simatic Application Tips is free.





Pointers and Indirect Addressing in S7 PLCs, Volume 3- DB Pointers and ANY Pointers


SIMATIC NET customers have free use of the application tips. These tips are only a general approach to using SIMATIC NET with various applications. Your specific application may be different. It is your responsibility to use SIMATIC NET properly in your applications.


Application Notes


Automation Pointers and Indirect Addressing in S7 PLCs, Volum e 3- DB Pointers and ANY Pointers

Eddie Prince


This application note is the third of three notes that provide an overview of indirect addressing methods and structures available in the Statement List (STL) language for S7 PLCs. It describes the use of DB pointers, ANY pointers and address pointers in STL programs. The documents also include archived STEP7 libraries containing functions (FC) that demonstrate these addressing methods. The functions in the library demonstrate the use of indirect addressing methods to read from and write to arrays of bytes, integers, real numbers, and arrays of structures.

Volume 1 describes Memory Indirect Addressing

Volume 2 describes Register Indirect Addressing

Volume 3 describes the use of DB Pointers and ANY Pointers

Using Pointers in Function (FC) and Function Block (FB) Calls

The first two application notes in this series focused mainly on the use of “area pointers” for indirect access to the operand of a statement list instruction. Area pointers are 32 bit structures that can be stored in a standard 32-bit S7 double word. Area pointers can contain the address of a standard S7 memory location. They can be used in STL instructions for the indirect access of any of the standard S7 elementary data type (Bit, Byte, Char, Word, Integer, DWORD, DINT, and Real data types).

The S7 architecture also includes the concept of “complex” data structures such as “Date, String, Array, and Structure”, as well as provision for multiple data blocks within an S7 program. In general, these complex data types require more than a single S7 memory location, and the definition of their “address” requires a pointer that exceeds the size of a single S7 double word. Furthermore, the STL instruction set does not include the ability to manipulate these complex data structures directly. However, code blocks (SFC, SFB, FC, and FBs) can be developed and used to manipulate these complex data objects.

This application note will demonstrate methods of handling these “complex” data structures in a STEP7 program. The primary topics include:





1) The structure of DB Pointers and ANY Pointers

2) Using pointers as formal parameters in Function Block (FB) calls

3) FB Programming techniques for ANY Pointers

4) Special provisions for Pointers as parameters in Function (FC) calls

5) Archived STEP7 programs with sample FBs and FCs demonstrating the topics described in this application note.

Pointers

Pointers are special objects that are structured to contain an S7 memory address. Pointers may be stored in memory locations or in S7 CPU registers. There are three “classes” of pointers contained in the S7 architecture. These include:

A) Area Pointers – a 32 bit structure that identifies a specific address



This application note will describe DB Pointers and ANY Pointers in detail. Further information on Area pointers can be found in the companion application note “Pointers and Indirect addressing in S7 PLCs, Volume 1 – Memory Indirect Addressing” or note “Pointers and Indirect addressing in S7 PLCs, Volume 2 – Register Indirect Addressing”

Area Pointers

As shown below, an area pointer needs to contain three basic components to specify a location in S7 memory

A) Address Area – the “address area” field describes which memory area is being addressed. The S7 address areas include Peripheral I/O (PI and PQ), I/O image (I and Q), Marker (M), Global data (DBx), Instance data (DIx), local data (L), and local data of the “calling block’ (V). Pointers with an area type specified are referred to as “Area Crossing” Pointers.

The address area may also contain a “null” specification meaning the pointer contains only a “byte.bit” value. Pointers with a “null” address area (Hex’00’) are referred to as “Area Internal” Pointers. “Area Internal” Pointers are the only types that can be used for “Memory Indirect Addressing”.








DB Pointers

The area pointers described above can be used to identify an element address of an “opened” data block. An opened data block refers to either the current “global” data block (DB), or the current “instance” data block (DI). However, sometimes it is necessary to identify a data block element that may or may not be one of the two currently “opened” data blocks. The DB Pointer can be used for this purpose.

The DB Pointer contains a “completely specified address” of a data block data element. That means it contains both the Data Block number and the data element address within the data block. A DB Pointer is formed by adding a 16-bit integer value (containing the desired data block number) to a 32-bit “area crossing pointer” containing the address of the data element in the data block. The structure of a DB Pointer is diagrammed below:

Formats for representing a DB Pointer in a STEP7 programming statement are shown below. The first example shows the use of explicit addressing; the second shows the use of symbolic addressing. The explicit address is prefaced by the use of P# to identify a pointer, followed by the explicit data block and byte.bit address in the data block. In symbolic addressing, the STEP7 programming software will interpret the “complete” symbolic name (DB symbol name & element symbol name) as a DB pointer when it is applied to a block parameter defined as a “Pointer”

P# Data_Block_#. Data_Element_Address

DB_Symbol. Data _Element_Symbol

Sample DB pointers

Pointer Description

P#DB62.DBX12.0 The address of data byte.bit 12.0 of data block 62

P#DB62.DBX88.3 The address of data byte.bit 88.3 of data block 62

Motors.Oil_Pump_Motor The address of the data byte.bit of the element “Oil_Pump_Motor” contained within the Data Block named “Motors”

32 Bit Area Crossing Pointer 16 Bit DB Number





ANY Pointers

S7 allows for the definition of “complex” data types that contain multiple data elements in a single structure. Examples of these data types include “Arrays”, “Structures”, and “String” variables. The S7 architecture provides a general pointer, called the ANY pointer, to handle these complex elements. The ANY Pointer adds both “element type” and “quantity” information to the “address” information of other pointers. There are three distinct types of ANY Pointers.

1) ANY Pointers for Data Types. This is the most common format of the ANY pointer, and will be the topic of the rest of this application note.

2) ANY Pointers for Timers and Counters. (Further information regarding these pointers can be found in the Berger text referenced at the end of this application note.)

3) ANY Pointers for FB, FC, DB, SDB blocks. (Further information regarding these pointers can be found in the Berger text referenced at the end of this application note.)

The structure of these three ANY pointer types are shown in the tables below:

Byte # ANY Pointer for Data Types

ANY Pointer for Timer/Counter

ANY Pointer for Blocks

Byte1 Syntax ID=W#16#10 Syntax ID =W#16#10 Syntax ID =W#16#10

Byte 2 TYPE Code TYPE Code TYPE Code

Byte 3 Quantity Quantity Quantity

Byte 4

Byte 5 Data Block Number

HEX Value

W#16#0000

HEX Value

W#16#0000 Byte 6

Byte 7

Area Pointer

TYPE Code HEX Value

W#16#0000 Byte 8 HEX Value W#16#00

Byte 9 T/C Number Block Number

Byte 10

The first byte of the ANY pointer is a “Syntax ID value” and is always equal to HEX Value’10’ for ANY pointers. The second byte contains a “TYPE code” that identifies the data element type (or parameter type) being addressed by the ANY pointer. The TYPE definitions for ANY Pointers are shown in the table below. An integer value containing the quantity of “elements’ being addressed by the ANY pointer is contained in bytes 3 and 4.

DATA Type ANY pointers include a six byte “DB Pointer” following the “quantity field. The structures of the other two ANY pointers are as shown above.

The general format for “Data Type ANY Pointer” is demonstrated below:





P# <Data_Block. >Address Type Quantity Where the <Data Block> part is optional. ANY Pointer examples include:

P#DB12.DBX30.0 Byte 226

P#M88.0 BOOL 128

TYPE Codes for ANY Pointers

TYPE Code Element type Example

01 BOOL P#M12.0 BOOL 20

02 BYTE P#M12.0 BYTE 20

03 CHAR P#M12.0 CHAR 20

04 WORD P#M12.0 WORD 20

05 INT P#M12.0 INT 20

06 DWORD P#M12.0 DWORD 20

07 DINT P#M12.0 DINT 20

08 REAL P#M12.0 REAL 20

09 DATE P#M12.0 DATE 20

0A TOD P#M12.0 TOD 20

0B TIME P#M12.0 TIME 20

0C S5TIME P#M12.0 S5TIME 20

0E DT

13 STRING

17 BLOCK_FB L# 10 BLOCK FB 1

18 BLOCK_FC L# 10 BLOCK FC 1

19 BLOCK_DB L# 10 BLOCK DB 1

1A BLOCK_SDB L# 10 BLOCK SDB 1

1C COUNTER L# 10 COUNTER 1

1D TIMER L# 10 TIMER 1

00 Null Type P#P0.0 VOID 0





Working With ANY Pointers – Block Input and Output Parameters

A common use of the ANY Pointers in STEP7 programming is to identify “blocks” of data elements to manipulate using some of the “System Function Blocks”, “Function Blocks”, “System Function Calls”, and “Function Calls” that are supplied with STEP7. For instance, the SFCs “BlockMove” (SFC20) and “Fill” (SFC21) use ANY pointers to describe the blocks of data to be moved or filled. Similarly, the network communications function Blocks such as “BSEND” (SFB12) and PUT or GET (SFB14 and SFB15) use ANY pointers to define the blocks of data to be transmitted or retrieved. There are two ways to “apply” an ANY pointer to a Function Block parameter. The user may enter an “absolute” form of the ANY pointer, or the user may apply a symbolic variable to the parameter. When a symbol name is applied to the ANY pointer input of a function or function block, it is converted to an “absolute” ANY pointer whose starting address is the address of the symbol, whose data type is BYTE, and whose length if the byte length of the defined symbol (for instance, a REAL element would have a byte length of 4). The one exception is when the “symbol” applied to the FBs A NY input happens to be the symbol name of a temporary local variable of type ANY. In this special case, the operating system does not use the LOCATION of the local varia ble, but the CONTENT of the variable as the ANY pointer. This is covered in mor e detail later in this application note.

The table below shows several examples of applying absolute and symbolic references to a FB input parameter defined as an ANY pointer. The last table entry demonstrates the special case of using a temporary local variable symbol name.

“Variable” at FB input Symbol definition ANY Pointe r loaded into FB

P#m10.0 BYTE 20 N/A P#M10.0 BYTE 20

“My_Byte” My_Byte = MB44 P#M44.0 BYTE 1

“My_DB12.My_Array” My_Array = 30 byte long array starting at DB12.DBB64

P#DB12.DBX64.0 BYTE 30

“My_Real” My-Real = MD128 P#M128.0 BYTE 4

“My_DB2.My_UDT” My_UDT= a data structure 120 bytes long starting at DB2.DBB0

P#DB2.DBX0.0 BYTE 120

“My_Local_Temp_ANY” “My_Local_Temp_ANY” = a 10 byte long temporary local variable of type ANY starting at L20.0, but which contains a 10 byte long ANY pointer = P#M34.0 Byte 250

P#M34.0 BYTE 250

(The Operating system uses the content of this special variable rather than it’s location, which would have been P#L20.0 BYTE 10)

A Relay Ladder example of applying absolute and symbolic ANY pointers to the BlockMove SFC call are shown in the following figure. In the first rung the BlockMove SFC is being used to move a 48-byte long block of data (MB20 through MB67) from Marker memory into a 48-byte long area starting at byte 4 of DB12. The first rung demonstrates the use of the





absolute form of an ANY pointer to define the data area. The second rung shows the use of a symbolic name to identify the destination area. In the second rung, DB12 has a symbolic name of MY_DB, and it contains a 48-element array of bytes, called My_Array, that starts at byte 4 of the data block. In this instance, the SFC20 performs the same block data move as in the initial example.

A sample STEP7 program archive containing several program examples of the use of ANY pointers is inserted below. The program called “BLKMOVE and FILL” demonstrates the use of both absolute and symbolic ANY pointer addressing for the “FILL” and “BLKMOVE” SFCs. You can download the program and observe the use of these ANY pointers. Unarchive the program, transfer the program into a PLC and use the two VAT tables to view these ANY pointer block operations.

Anypoint.zip





Pointers as Function Block Parameters

The topic above dealt with the use of ANY pointers as inputs and outputs for prewritten Functions and Function Blocks. However, the reader may also wish to generate their own Functions that use ANY Pointers for manipulating blocks of data such as “STRING”, “UDT”, or “STRUCT” or “ARRAY” data types. The following paragraphs describe the programming steps that need to be used to take advantage of ANY pointers as Function and Function Block parameters.

The first step in understanding the use of pointers in FB calls is to understand the elements of a Function Block declaration table. The declaration table is used to specify (or declare) the local variables that will be used in the FB. There are five basic “declaration types ” that can be specified. These are variables of declaration type “in”, “out”, “in_out”, “stat”, and “temp ”. The figure below shows a sample declaration table containing one of each declaration type.

The first three variable declaration types (in, out, and in_out ) are referred to as “Formal Parameters”. Formal parameters are used for passing “values” into or out of the function block. The “in ” and “in_out ” formal parameters can “receive” values for processing from the calling program and the “in_out ” and “out ” parameters can return values to the calling program. The sources and destinations of the values assigned to formal values on each instance of a FB call are referred to as the “actual parameters” This is illustrated in the figure below.

“Declaration Type” is specified here

“Data Type” is specified here





The other two declaration types (stat and temp) are internal variables that can be used inside of the function block. “Stat” variables have “storage”; that means their values are stored in the FB’s instance data block between executions of the FB. The “temp” variables have no storage between FB calls and are useful as “scratchpad” locations. The table below lists key properties of each type of function block local variable.

Properties of Local Variables in Function Blocks

Local Variable

Declaration

Allowable types Read/write access

in FB code

Can “hold” an ANY Pointer

Can be “used” as ANY Pointer

Current value

held in

“IN’ Elementary & Complex Data Types, Timer, Counter, Pointer, ANY_pointer, and Block types

Read only Yes No Instance DB

“OUT” Elementary & Complex Data Types

Write Only No No Instance DB

“IN_OUT” Elementary & Complex Data Types, Pointer, and ANY_pointer

Read/Write Yes No Instance DB

“STAT” Elementary & Complex Data Types

Read/Write No No Instance DB

“TEMP” Elementary & Complex Data Types, ANY_pointer

Read/Write Yes Yes L Memory

The first thing to note in the table above is that only the local variable types “in”, in_out”, and “temp” are capable of being defined as data type ANY. If these local variables are declared as

Formal Parameters:

“Formal_IN…” and “Formal_IO…” receive the values of MW34 & MW40

Actual Parameter:

The values of MW34 and MW40 get passed into the FB

Formal Parameters

Actual Parameters





type ANY, then the system allocates 10 bytes for the variable, and values “passed into’ the Function Block for these variables will be ANY_pointers. If the “actual parameter” applied to the FB input is a symbol name, then the “ANY pointer” to the symbol is what gets passed into the FB, not the value of the symbol. The second thing to note is that the “temp” local variable is the only one that can be used as an ANY pointer.

For instance, in the figure below, two ANY Pointers have been defined as “input parameters” for the function block. The instance datablock for the FB (DB95) has two “elements” defined. Each element has a length of 10 bytes and is specified as an “ANY” data type. When the FB is called in the ladder rung shown below, then the data items “First_Any” and “Second_Any” in the function block will each contain a 10 byte “Any Pointer”.

However, while these two local variables can “store ” an ANY pointer data type, they cannot be “used ” as ANY pointers. In order to make use of the ANY pointers that we have just transferred into the Function Block, the ANY pointer “data” must be moved into a “temporary local variable” that gets defined as data type “ANY”. Then, as mentioned earlier in this document, a “temporary local variable” declared as type “ANY” can be used as an ANY Pointer, and the operating system will use the “CONTENTS” rather than the “ADDRESS” of local variable as the ANY pointer.

The concept described above is illustrated by the figure on the next page. This shows the contents of function block FB2. It contains two inputs defined as type ANY, and two local variables defined as type ANY. The STL code in the function block first transfers the two input ANY variable “contents” into the two temp variables where they can the be applied to a “MOVEBLK” function.

Assume the symbol “clockbits” refers to a 44-byte array starting at DB45.DBB12

Then inside FB2:

First_Any =W#16# ’10 02 00 2C 00 00 83 00 00 B0’ (P#M22.0 BYTE 44)

Second_Any = W#16# ’10 02 00 01 2D 84 00 00 B0’ (P#DB45.DBX12.0 Byte 44)





In variables receive ANY pointers from FB call

First_Any =W#16# ’10 02 00 2C 00 00 83 00 00 B0’ (P#M22.0 BYTE 44)

Second_Any = W#16# ’10 02 00 01 2D 84 00 00 B0’ (“Clockbits” = P#DB45.DBX12.0 Byte 44)

Now the Temp variables hold the ANY pointers

TempANY_1 =W#16# ’10 02 00 2C 00 00 83 00 00 B0’ (P#M22.0 BYTE 44)

TempANY_2 = W#16# ’10 02 00 01 2D 84 00 00 B0’ (P#DB45.DBX12.0 Byte 44)

Move ANY pointer data into the Temp Variables

Block Move will use “contents of Temp variables as the ANY Pointers for “source” and “destination”





Differences Between Functions (FC) and Function Blo cks (FB)

When a Function Block is called in a STEP7 program, it has an “Instance Data Block” associated with it that provides data storage for the “in”, in_out”, and “out” formal parameters. Actual values passed into and out of the FB are maintained in the associated data block element locations.

Functions (FC) do not have data blocks associated with them, and therefore, don’t have these data block locations to hold the actual values passed into or out of the FC. Instead of data block locations, the operating system provides access to the actual values by putting an area pointer into the block code for the parameter. The location the area pointer aims at depends upon the “data type” that was assigned to the formal parameter and the type of operand address. It

Data type assigned to the formal parameter

Operand address type

(And examples)

The Area Pointer target

Contents of area pointer target

Elementary data types

Simple addresses

(Mw22, PIB144)

Actual address of the operand

Value of the operand

Elementary data types

Constants or “fully addressed data block elements

(W#16# 7FF3, DB12.DBB34)

A copy of the operand in the Local memory of the calling block

Value of the operand

Complex data types Strings, Structures, Arrays, UDTs defined in a data block

A DB pointer stored in the local memory of the calling block

DB Pointer that points to the actual operand

ANY Absolute ANY Pointer

(P#m12.0 BYTE 44)

An ANY pointer stored in the local memory of the calling block

ANY pointer to the desired data

ANY An variable declared as a temp local variable of type ANY in the calling block

The starting address of that variable in the local memory of the calling block

The ANY pointer variable value

An example of the use of the calling block’s Local Memory is demonstrated in the following figure where three input variables and one output variable need to be provided for in the L stack.






Related Information


Extra 20 bytes hold

values for VAR1-4

FB 10 Local

Memory before

FC22 call

10 Bytes long

FB 10 Local Memory after

FC22 call

30 bytes long

ANY Pointer

Value of DB1.DBD4

Constant 123.0

Result of VAR4





General Notes

The SIMATIC Application Tips are provided to give users of Siemens’ Simatic products some indication as to how, from the view of programming technique, certain tasks can be solved. These instructions do not purport to cover all details or variations in equipment, nor do they provide for every possible contingency. Use of the Simatic Application Tips is free.




Documents

S7 Pointers