I IA CE
SIPLUS RIC IEC on S7
Functional description
Version V1.5
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 2 of 235 ©SIEMENS AG 2013
Safety instructions
Warning notices
These Operating Instructions contain information that you should observe in order to ensure your own
personal safety, as well to avoid material damage. The notices referring to your personal safety are high-
lighted in the manual by a warning triangle. Notices referring only to equipment damage have no safety
alert symbol. Warnings are shown in descending order according to the degree of danger as follows.
DANGER
indicates that death or serious injury will result if proper precautions are not taken.
WARNING
indicates that death or serious injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury may result if proper precautions are not taken.
NOTICE
means that material damage can occur if the appropriate precautions are not taken.
Note:
highlights important information about the product, handling the product, or part of the
documentation that is of particular importance.
Qualified personnel
Commissioning and operation of equipment described in this manual (module, device) may only be car-
ried out by qualified personnel. Qualified personnel in the meaning of the technical safety instructions in
this manual are persons authorized to commission, isolate, earth and marking devices, systems and
power circuits in accordance with the standards of security technology.
Please observe also the required basic knowledge mentioned in the preamble.
Trademarks
SIMATIC, SIMATIC HMI, SIMATIC NET, SIROTEC, SINUMERIK and USS are registered trademarks of
Siemens AG. Any other names used in this document may be brand names, the use of which by third
parties for their own purposes may infringe the rights of the legal owners.
and SIPLUS®
2006
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 3 of 235 ©SIEMENS AG 2013
Correct usage of Siemens products
Please observe the following:
WARNING
Siemens products may only be used for the applications indicated in the catalog and in
the relevant technical description. If third-party products and components are used,
these must be recommended or approved by Siemens. To ensure trouble-free and
safe operation of the products, they must be appropriately transported, stored, assem-
bled, installed, commissioned, operated and maintained. The permitted environmental
and ambient conditions must be adhered to. Notices in the relevant documentation
must be observed.
CAUTION
Changes to cabinet wiring!
Changes to cabinet wiring may only be performed in zero-voltage state! An additional
or modified wiring realized outside of the manufacturing enterprise requires an addi-
tional functional and insulation test.
Electrostatic Sensitive Devices ESD
Definition of ESD Almost all SIMATIC / FUM modules are equipped with highly integrated components or
elements in MOS technology. For technological reasons, these electronic components are very sensitive
to overvoltage and, consequently, to electrostatic discharge:
The short designation for such electrostatic sensitive components/modules is: "ESD", which is the com-
monly used international abbreviation of ”ESD” (Electrostatic Sensitive Device).
NOTICE
Electrostatic Sensitive Devices ESD
The presence of this symbol on cabinet, rack or packaging labels indicates the use of
electrostatically sensitive devices and thus the touch sensitivity of these components.
These modules can be destroyed by voltage and energy far below the limits of human perception. Volt-
ages of this kind occur as soon as a device or an assembly is touched by a person who is not electrostat-
ically discharged.
Copyright © Siemens AG 2013 All rights reserved
The forwarding and reproduction of this document, and the
reuse and distribution of its content is not permitted, unless
explicit permission has been granted. Damages will be
sought in all cases of infringement. All rights reserved, in
particular in the event of patents being granted or a utility
model being registered.
Siemens AG
I IA CE
P.O. Box 23 55
90713 Fürth
Germany
Disclaimer:
We have checked the content of this printed document in
accordance with the hardware and software described.
Nevertheless, the risk of deviations cannot be excluded
completely, which is why we do not accept liability for
complete conformity. The details provided in this printed
document are checked on a regular basis, however, and
any corrections necessary are included in subsequent edi-
tions. We would be happy to receive your suggestions for
improvement.
Technical data are subject to change.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 4 of 235 ©SIEMENS AG 2013
Preamble
Purpose of the functional description
This functional description describes all the steps required to use the software application SIPLUS RIC
IEC on S7. It assists in the rapid and effective familiarization of personnel in the functionality of the appli-
cation.
Contents of the functional description
This functional description contains the following topics
- Principles of communication with the telecontrol protocols conforming to IEC60870-5-101and
IEC60870-5-104
- Configuration of communication
- Description of the communication blocks and application blocks
- Parameterization of the blocks
- Appendices
Basic knowledge required
Comprehension of this manual requires basic knowledge in the field of telecontrol and the IEC60870-5
protocols as well as general knowledge of automation technology with SIMATIC S7. Users should also
have sufficient knowledge of computers, or of tools similar to PCs (e.g. programming devices), and of the
Windows operating system.
As the S7 is configured using the STEP 7 basic software, you should also have sufficient experience in
handling the basic software.
Target group
This manual is aimed at people with the required qualifications to commission, operate and maintain the
products described:
- Installation engineers
- Programmers
- Commissioning engineers
- Servicing and maintenance personnel
Validity of the functional description
This functional description contains the description of the software application valid at the time of publica-
tion of the manual. We reserve the right to describe changes in the functionality of the software applica-
tion in a special product information document.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 5 of 235 ©SIEMENS AG 2013
Contents:
1. General ................................................................................................................................................. 8
1.1. IEC60870-5-101 and IEC60870-5-104 .......................................................................................... 8
1.2. IEC60870-5-103 Master ................................................................................................................ 9
1.3. IEC on WinAC ............................................................................................................................... 9
1.3.1. Transmission of the Telecontrol protocol IEC60870-5-101 .................................................... 9
1.3.2. Transmission of the Telecontrol protocol IEC60870-5-104 .................................................... 9
2. Ordering information SIPLUS RIC IEC on S7 ................................................................................... 9
2.1. Preferential bundles..................................................................................................................... 9
2.2. Add On for SIMATIC PCS 7 ....................................................................................................... 10
3. Communication - IEC60870-5-101 ................................................................................................... 12
3.1. Overview ..................................................................................................................................... 12
3.2. Settings in the SIMATIC Manager ............................................................................................. 14
3.2.1. Hardware configurations for CPx41 ...................................................................................... 14
3.2.2. Hardware configuration for ET200S CP 1SI ASCII .............................................................. 15
3.2.3. Hardware configuration for WinAC ....................................................................................... 16
3.2.3.1. WinLC RTX on SIMATIC Microbox PC (Nanobox PC) ................................................. 16
3.2.3.2. WinLC RTX on SIMATIC S7 modular Embedded Controller EC31 .............................. 17
3.2.3.3. Setup of Windows COM-Interface ................................................................................. 18
3.2.4. Connection configuration CP340, CP341, ET200S CP 1SI ASCII ....................................... 19
3.2.5. Project planning CP441 connection ..................................................................................... 19
3.3. Configuration of 'S7_IEC_Config' ............................................................................................ 20
3.3.1. IEC60870-5-101 Master Parameters .................................................................................... 21
3.3.1.1. Master Parameters for S7-300, S7-400 and ET200S ................................................... 21
3.3.1.2. Master Parameters for WinAC ...................................................................................... 23
3.3.2. IEC60870-5-101 Slave Parameters ...................................................................................... 25
3.3.2.1. Slave Parameters for S7-300, S7-400 and ET200S ..................................................... 25
3.3.2.2. Slave Parameters for WinAC......................................................................................... 27
3.3.3. Parameter description ........................................................................................................... 29
3.3.4. Use of the Windows COM-Interface under WinAC............................................................... 34
3.3.4.1. DB90 Parameter ............................................................................................................ 34
3.3.4.2. Use of several Interfaces ............................................................................................... 36
3.3.5. Link-Address parameter-DB for line operation ..................................................................... 37
4. Communication with - IEC60870-5-104 ........................................................................................... 40
4.1. Overview ..................................................................................................................................... 40
4.2. Settings in the SIMATIC Manager ............................................................................................. 43
4.2.1. Hardware configuration CPx43 ............................................................................................. 43
4.2.2. Hardware configuration CPU31x PN, CPU41x PN and ET200S IM151-8 PN ..................... 43
4.2.3. Hardware configuration for WinAC ....................................................................................... 44
4.2.3.1. WinLC RTX on SIMATIC Microbox PC (Nanobox PC) ................................................. 44
4.2.3.2. WinLC RTX on SIMATIC S7 modular Embedded Controller EC31 .............................. 45
4.2.3.3. Setup of Windows LAN-Interface .................................................................................. 46
4.2.4. Connection configuration CP343-1 and CP443-1 ................................................................ 47
4.3. Configuration of 'S7_IEC_Config' (FB100) .............................................................................. 48
4.3.1. IEC60870-5-104 master parameters .................................................................................... 49
4.3.1.1. Communication via CPx43 ............................................................................................ 49
4.3.1.2. Communication via the integrated PN interface of the CPU ......................................... 51
4.3.1.3. WinAC Master Parameter for mEC31 and microbox-PC (nanobox-PC) ....................... 53
4.3.2. IEC60870-5-104 slave parameter......................................................................................... 55
4.3.2.1. Communication via CPx43 ............................................................................................ 55
4.3.2.2. Communication via the integrated PN interface of the CPU ......................................... 57
4.3.2.3. WinAC Slave Parameter for mEC31 and microbox-PC (nanobox-PC) ......................... 59
4.3.3. Parameter description ........................................................................................................... 61
4.3.4. Use of the Windows Ethernet-Interface under WinAC ......................................................... 66
4.3.4.1. DB80 Parameter ............................................................................................................ 66
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 6 of 235 ©SIEMENS AG 2013
4.4. Message buffering ..................................................................................................................... 68
4.4.1. Use of the Message Memory ................................................................................................ 68
4.4.2. T104-Confirmation buffer ...................................................................................................... 69
4.4.3. Projection .............................................................................................................................. 69
4.5. Improvement of the IEC-Master performance ......................................................................... 71
5. Multiple channel / Redundancy ....................................................................................................... 73
5.1. Implementation ........................................................................................................................... 73
5.1.1. Cascade_Mode_0: Multiple Channel on basis of Layer 2 .................................................... 75
5.1.2. Cascade_Mode_1: Multiple Channel on basis of Layer 7 .................................................... 76
5.1.3. Cascade_Mode_2: Multiple Channel on basis of Layer 7 .................................................... 76
5.1.4. Cascade_Mode_3: Extension of the T104-Redundancy group ............................................ 77
6. Application blocks ............................................................................................................................ 78
6.1. Slave blocks SL .......................................................................................................................... 79
6.1.1. Organization block - SL_Org_ASDU_1 (FB121) .................................................................. 80
6.1.2. Blocks for process data capture SLi ..................................................................................... 83
6.1.2.1. Single point and double point information - SLi_SP_DP_s128 (FB130) ....................... 84
6.1.2.2. Step position information - SLi_ST_s8 (FB131) ............................................................ 90
6.1.2.3. Bit pattern messages - SLi_BO_s8 (FB132) ................................................................. 96
6.1.2.4. Measured values - SLi_ME_ABC_s32 (FB133) .......................................................... 103
6.1.2.5. Integrated totals - SLi_IT_s8 (FB134) ......................................................................... 111
6.1.3. Blocks for the process output SLo ...................................................................................... 118
6.1.3.1. Single, double and regulating step commands - SLo_SC_DC_RC_sx (FB135) ........ 119
6.1.3.2. Setpoint commands - SLo_SE_ABC_sx (FB136) ....................................................... 127
6.1.3.3. Bit pattern commands - SLo_BO_sx (FB137) ............................................................. 134
6.1.3.4. Return_Values of the Slo-Blocks ................................................................................. 140
6.1.4. Individual IEC-Addressing .................................................................................................. 141
6.2. Calling Sli-Blocks from time interrupts (Cyclic Interrupts) ................................................. 143
6.3. Master Blocks MA .................................................................................................................... 144
6.3.1. Organization block - MA_Org_ASDU_n (FB122) ............................................................... 145
6.3.2. ASDU-Address Parameter-DB ........................................................................................... 148
6.3.3. Output blocks - MAo_xyz_pDB ........................................................................................... 151
6.3.3.1. Single point information - MAo_SP_IM_pDB (FC140) ................................................ 157
6.3.3.2. Double point information - MAo_DP_IM_pDB (FC141) .............................................. 162
6.3.3.3. Step position information - MAo_ST_IM_pDB (FC142) .............................................. 166
6.3.3.4. Bit pattern messages - MAo_BO_IM_pDB (FC143) ................................................... 170
6.3.3.5. Measured values - MAo_ME_NA_IM_pDB (FC144) ................................................... 175
6.3.3.6. Measured values - MAo_ME_NB_IM_pDB (FC145) ................................................... 179
6.3.3.7. Measured values - MAo_ME_NC_IM_pDB (FC146) .................................................. 183
6.3.3.8. Integrated totals - MAo_IT_IM_pDB (FC147).............................................................. 188
6.3.4. Input blocks - MAi_xyz_pDB ............................................................................................... 193
6.3.4.1. Single, double and regulating step commands - MAi_SC_DC_RC_pDB (FB148) ..... 195
6.3.4.2. Setpoint commands - MAi_SE_ABC_1 (FB149) ......................................................... 200
6.3.4.3. Bit pattern commands - MAi_BO (FB150) ................................................................... 203
7. Using the NON_Retain Memory ..................................................................................................... 205
7.1.1. FC100 Description .............................................................................................................. 206
7.1.1.1. Adaption of the DB-length from automatically generated DBs: ................................... 206
7.1.1.2. Read out of DB-Number and DB_Length of internal Buffer-DB .................................. 206
8. SIPLUS RIC IEC on S7 in SIMATIC H-Systems ............................................................................ 208
8.1. Configurations .......................................................................................................................... 208
8.1.1. IEC60870-5-101 Master ..................................................................................................... 209
8.1.2. IEC60870-5-101 Slave ....................................................................................................... 209
8.1.3. IEC60870-5-104 Master ..................................................................................................... 210
8.1.4. IEC60870-5-104 Slave ....................................................................................................... 210
8.1.5. H-CPUs V6 – Use of the integrated PN-Interface .............................................................. 211
8.2. Licensing in the H-System ...................................................................................................... 212
9. SIPLUS RIC IEC on S7 in S7-1500 – Systems .............................................................................. 213
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 7 of 235 ©SIEMENS AG 2013
9.1.1. Available Libraries .............................................................................................................. 213
9.1.1.1. Specific features / differences ..................................................................................... 213
9.1.1.2. Remanence ................................................................................................................. 214
9.1.1.3. Use of several libraries at the same time .................................................................... 215
10. Software protection and demo mode ........................................................................................ 216
10.1. General activation of SIPLUS RIC IEConS7 ....................................................................... 216
10.2. Activation of SIPLUS RIC IEConS7 in H-systems and other systems ............................ 217
10.3. Activation of SIPLUS RIC IEConWinAC ............................................................................. 218
11. Contacts / Addresses .................................................................................................................. 219
12. Appendix ...................................................................................................................................... 220
12.1. Resource assignment .......................................................................................................... 220
12.2. Re-wiring blocks ................................................................................................................... 224
12.2.1. Data blocks:..................................................................................................................... 224
12.2.2. Independent FBs / FCs: .................................................................................................. 224
12.2.3. FBs / FCs with dependency ............................................................................................ 224
12.2.3.1. Possible problems at re-wiring .................................................................................... 225
12.2.3.2. Solution / Workaround: ................................................................................................ 225
12.3. Interoperability list for T101/T104 ....................................................................................... 225
12.4. New Features and Functions .............................................................................................. 226
12.4.1. Delivery Version V1.1 ...................................................................................................... 226
12.4.2. Delivery Version V1.2 ...................................................................................................... 229
12.4.3. Delivery Version V1.3 ...................................................................................................... 230
12.4.4. Delivery Version V1.4 ...................................................................................................... 232
12.4.5. Delivery Version V1.5 ...................................................................................................... 233
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 8 of 235 ©SIEMENS AG 2013
1. General
SIPLUS RIC is a range of hardware and software products facilitating the transmission of information in
conformity with the IEC60870-5 standard.
The standardized IEC60870-5 protocols are sub-divided into the following versions
a serial protocol IEC60870-5-101 for telecontrol
a serial protocol IEC60870-5-102 for remote meter reading
a serial protocol IEC60870-5-103 for protection data acquisition
a network protocol IEC60870-5-104 for telecontrol.
1.1. IEC60870-5-101 and IEC60870-5-104
This manual describes the functionality of the SIPLUS RIC IEC on S7 and includes the functions of the
protocols IEC60870-5-101 and IEC60870-5-104.
SIPLUS RIC IEC on S7 uses only standard components of SIMATIC ET200S, S7-300, S7-400 and S7-
400H.
SIPLUS RIC IEC on S7 comprises a S7 code library (S7 program).
The IEC protocols use 3 layers of the ISO/OSI layer model.
Layer 1: Physical layer.
Layer 2: Link layer.
Layer 7: User layer.
Layer 1 is the hardware channel of the SIMATIC S7 and is therefore dependent on the interface used.
This produces different functional blocks for the various configurations of the SIMATIC ET200S, S7-300;
SIMATIC S7-400 and S7-400H.
Layer 2 is the link layer which creates, monitors and secures the link to the communication partner re-
gardless of the hardware being used. With the network-based T104 protocol the real layer 2 forms part of
the network layer. When T104 layer 2 is referred to below, the 'APCI' transport interface defined in the
standard is meant.
Layer 7 is the user layer which controls the defined user data and represents the link element between
the protocol and the user program / process.
SIPLUS RIC IEC on S7 software packages each include an FB100 (S7_IEC_Config) in which layers 1
and 2 required for the hardware and protocol type, as well as a base layer 7, are summarized and the
necessary parameters are adjustable.
The 'FB100' implements a 'telecontrol channel' on which the application blocks included in delivery as
well, can be coupled for the process monitoring and process control.
If multiple telecontrol channels are required, the FB100 must be called up multiple times (another in-
stance) and the relevant parameters entered. The channels then function completely independently of
one another.
The link redundancy with the IEC60870-5-104 protocol is already integrated into the '–104 Slave' and ‘-
104 Master’ product versions. Redundancy groups each with 2 TCP links are supported which have to be
different in the connection parameters:
IP-Address (module), Port number or active link connection on the part of SIPLUS RIC IEC on S7.
Each software package needs to be activated. This is achieved by entering a registration code at the
input of an FB100 input. The registration code is based on the serial number of the MMC (ET200S and
S7-300) resp. MC (S7-400) or serial number of the CPUs (S7-400H) and can be supplied with the order,
in case a MC/MMC is included in the order, or the serial number has been specified. Alternatively, you
can request a registration code later on via email.
Complete software packages (block library) can be ordered as HW/SW Bundle.
On request an example project appropriate for your configuration can be supplied, which is pre-allocated
with basic parameters (only your registration code is required). It can be adapted with low effort.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 9 of 235 ©SIEMENS AG 2013
1.2. IEC60870-5-103 Master
From V1.2 also the protection devices protocol IEC60870-5-103 Master with several devices on one poll-
ing line is supported.
The functionality of the SIPLUS RIC IEC on S7 application for the protocol IEC60870-5-103 Master is de-
scribed in the SIPLUS RIC IEC103 on S7 manual.
1.3. IEC on WinAC
With the version V1.3 WinAC based systems are supported from SIPLUS RIC IEConS7 now. On this
computers the software package WinAC from RTX 2010 must be installed. WinAC contains a Windows
logic controller (WinLC) RTX V4.6. With it the IEConS7 application can be operated like on a hardware
CPU (S7-300/400).
Up to know the mEC31 and micro box PC hardware is tested and released.
The registration code is not based on the serial number of the MMC (ET200S and S7-300) resp. MC (S7-
400) or serial number of the CPUs (S7-400H) as hitherto, but it is descended from the installed license-
key of the RTX. For further information we refer you to chapter 10.3.
1.3.1. Transmission of the Telecontrol protocol IEC60870-5-101
The transmission of the telecontrol protocol IEC60870-5-101 is carried out via the COM interface on the
Micro box PC and mEC31 (in this case an additional EM PC is required). The interface is administrated
from Windows. For using it by WinAC first of all the installation of a corresponding driver is required (see
chapter 3.2.3.3).
When using mEC31 the communication can be carried out also via a CP340.
Note:
Though a transmission of the telecontrol protocol IEC60870-5-101 via further interfaces
(e.g. USB) is possible, but it cannot be ensured for all applications.
1.3.2. Transmission of the Telecontrol protocol IEC60870-5-104
WinLC supports a LAN resp. PN-Interface on the Micro box PC and mEC31, which can be used also for
the transmission of the telecontrol protocol IEC60870.5.104. However only one interface is assignable.
Optionally further network adapters administrated from Windows can be used for the transmission. In this
case first of all the installation of a corresponding driver on the Micro box PC resp. mEC31 is required
(see chapter 4.2.3.3).
Note:
Though a transmission of the telecontrol protocol IEC60870-5-104 via further network
adapters (e.g. USB adapter) is possible, but it cannot be ensured for all applications.
2. Ordering information SIPLUS RIC IEC on S7
2.1. Preferential bundles
The so called preferential bundles can be ordered via MLFB-Numbers.
This preferential bundles contain in each case a combination of SIMATIC S7 hardware and the SIPLUS
RIC IEC on S7 block library adapted to the hardware.
We would also be pleased to offer you project-specific combinations functions and additional services of
SIMATIC products also using SIPLUS extreme.
You’ll find the Ordering numbers on the SIPLUS Internet pages.
Website: http://www.automation.siemens.com/siplus/index_00.htm
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 10 of 235 ©SIEMENS AG 2013
2.2. Add On for SIMATIC PCS 7
The following products can be ordered direct via MLFB as Add On for the assignment in SIMATIC PCS 7
equipments.
MLFB
Description
6AG6 003-0BA11-0AA0
for AS Single Station, Protocol IEC60870-5-101 functional block library for
S7-400,
Interface CP 441
6AG6 003-0BA01-0AA0
for AS Redundancy Station, Protocol IEC60870-5-101
functional block library for S7-300/S7-400H,
Interface CP 340/341
6AG6 003-0BB11-0AA0
for Protocol IEC60870-5-104,
functional block library for S7-400/S7-400H,
Interface CP 443-1"
For further information please refer to Catalog ST PCS 7.1,
Add Ons for the
Process control system SIMATIC PCS 7
In the figures below we introduce some typical configuration examples for operation of the telecontrol pro-
tocols IEC60870-5-101 (serial) resp. IEC60870-5-104 (TCP/IP) with SIMATIC PCS 7.
Example of the configuration for telecontrol systems with SIMATIC PCS 7 AS on a third-party supervisory control system
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 11 of 235 ©SIEMENS AG 2013
Redundancy configuration with AS 412H/AS 414H/AS 417H and telecontrol protocol IEC60870-5-101 (serial)
Redundancy configuration with AS 412H/AS 414H/AS 417H and telecontrol protocol IEC60870-5-104 (TCP/IP)
Note:
The blocks of the SIPLUS RIC IEC on S7 library can be used in combination with automa-
tion systems of the process control system SIMATIC PCS 7 V7. The utilization of the library
SIPLUS RIC IEC on S7 for the telecontrol configurations shown above is independent from
the SIMATIC PCS 7 Telecontrol.
For further information please refer to Catalog ST PCS 7.1,
Add Ons for the
Process control system SIMATIC PCS 7
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 12 of 235 ©SIEMENS AG 2013
3. Communication - IEC60870-5-101
3.1. Overview
IEC60870-5-101 is a telecontrol protocol for bit-serial transmission.
SIPLUS RIC IEC on S7 supports communication via the communication modules CP 1SI, CP340, CP341
resp. CP441 in ASCII- mode and the properties of the interfaces (RS232, RS422/485), baud rates, etc.
This means the CPs of the ET200S- and S7-300 range can be used 'directly'. They are allocated to the
respective IEC communication module via the hardware address.
In the S7-400 system, 'connection configuration' using NETPRO is required in addition to the hardware
configuration. The link ID (local ID) of the point-to-point connection (PtP) created must be assigned to the
respective IEC communication module.
For details of the hardware configuration and connection parameterization, refer to the chapter 'Settings
in the Simatic Manager'.
SIPLUS RIC IEC on WinAC supports the communication via mEC31-RTX (WinAC 2010) resp. Micro box-
PC with RTX.
SIPLUS RIC IEC on S7 resp. SIPLUS RIC IEC on WinAC is available for IEC 101 communication with the
following properties:
- as Master or Slave
- in both traffic types balanced or unbalanced mode
- in leased line operation – VFT control is a CP property
- to one or several connection partner each
(new in V1.2: polling control of multiple stations on one line is available).
The following combinations are available:
Software-Variant
Released Hardware
S7LIB: S7IEC_M101_CP340/341
SIPLUS RIC IEConS7 IEC60870-5-101 Master via
CP340 or CP341
for Standard CPUs S7-300 and S7-400H
CP340-1 RS232
CP340-1 RS485/422
CP341-1 RS232
CP341-1 RS485/422
6ES7340-1AH02-0AE0
6ES7340-1CH02-0AE0
6ES7341-1AH02-0AE0
6ES7341-1CH02-0AE0
S7LIB: S7IEC_M101_CP441
SIPLUS RIC IEConS7 IEC60870-5-101 Master via
CP441
for Standard CPUs S7-400
CP441-1
CP441-2
IF963-RS232
IF963-RS485/422
6ES7441-1AA04-0AE0
6ES7441-2AA04-0AE0
6ES7963-1AA00-0AA0
6ES7963-3AA00-0AA0
S7LIB: S7IEC_S101_CP340/341
SIPLUS RIC IEConS7 IEC60870-5-101 Slave via
CP340 or CP341
for Standard CPUs S7-300 and S7-400H
CP340-1 RS232
CP340-1 RS485/422
CP341-1 RS232
CP341-1 RS485/422
6ES7340-1AH02-0AE0
6ES7340-1CH02-0AE0
6ES7341-1AH02-0AE0
6ES7341-1CH02-0AE0
S7LIB: S7IEC_S101_CP441
SIPLUS RIC IEConS7 IEC60870-5-101 Slave via
CP441
for Standard CPUs S7-400
CP441-1
CP441-2
IF963-RS232
IF963-RS485/422
6ES7441-1AA04-0AE0
6ES7441-2AA04-0AE0
6ES7963-1AA00-0AA0
6ES7963-3AA00-0AA0
S7LIB: S7IEC_M101_CP1SI
SIPLUS RIC IEConS7 IEC60870-5-101 Master via
CP1SI
for ET200S CPUs
Interface modules 1SI
ASCII (8Byte)
6ES7138-4DF01-0AB0
S7LIB: S7IEC_S101_CP1SI
SIPLUS RIC IEConS7 IEC60870-5-101 Slave via
CP1SI
for ET200S CPUs
Interface modules 1SI
ASCII (8Byte)
6ES7138-4DF01-0AB0
S7LIB:S7IEC_M101_WinAC
SIPLUS RIC WinAC IEC60870-5-101 Master for
mEC31, nanobox-PC and microbox-PC
IEC-Comm. via CP340, resp. COM-Interfaces
EC31-RTX (WinAC 2010)
Microbox-PC with RTX
Nanobox-PC with RTX
6ES7677-1DD10-0BB0
6ES7675-1DF30-0DB0
6SE7xxx
S7LIB:S7IEC_S101_WinAC
SIPLUS RIC WinAC IEC60870-5-101 Slave for
mEC31, nanobox-PC and microbox-PC
IEC-Comm. via CP340, resp. COM-Interfaces
EC31-RTX (WinAC 2010)
Microbox-PC with RTX
Nanobox-PC with RTX
6ES7677-1DD10-0BB0
6ES7675-1DF30-0DB0
6ES7xxx
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 13 of 235 ©SIEMENS AG 2013
Software-Variant
Released Hardware
S7LIB:S7_IEC_1500_101_MS_CM_PtP_V1_5
SIPLUS RIC IEConS7 IEC60870-5-101 Master/Slave
via CM1540 or CM1541
for Standard CPUs S7-1500
CM1540 RS232
CM1540 RS485/422
CM1541 RS232
CM1541 RS485/422
6ES7540-1AD00-0AA0
6ES7540-1AB00-0AA0
6ES7541-1AD02-0AB0
6ES7541-1AB00-0AB0
In each case the library contains a central communication block FB100 'S7_IEC_Config', corresponding
subordinate auxiliary blocks, as well as the associated 'application blocks' for the process connection.
The FB100 has to be programmed with your parameters (see next chapter)and takes care of the entire
IEC communication with the connection partner.
A pointer in DWord format establishes the connection / interface to the 'application blocks'. You use only
the blocks with the required functionality which can be used on the other hand multiple, too.
Limits are only set here by the memory and resource consumption (cycle time). For more details, see
chapter ‘Application blocks’, separated by master (e.g. sending commands, receiving messages and
measurement values) and slave functionality (e.g. sending messages and measurement values, receiving
commands).
The blocks for CP340 and CP341 are usable in standard S7-300 systems as well as in S7-400H systems.
For more details using the blocks in a H-system, refer to chapter 8.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 14 of 235 ©SIEMENS AG 2013
3.2. Settings in the SIMATIC Manager
The necessary settings in the hardware configuration and in the connection configuration are described
here.
3.2.1. Hardware configurations for CPx41
For the CP441-2 modules the settings are made for each interface used. Important settings in the hard-
ware configuration are:
The 'ASCII-protocol' setting is required for the
protocol
The ASCII protocol requires the following pa-
rameters:
- After the character delay time elapses;
The character delay time depends on
the baud rate. The default setting can be
used.
- Transmission speed
Baud rate 300 – 115200 bit/s
(depending on the used CP)
- Character frame
8 data bits specified in standard
1 stop bit specified in standard
Parity even specified in the norm
Transmission parameters:
- XON/XOFF is not permissible!
- No data flow control makes sense in the
default
- Alternatively RTS/CTS data flow control
or operation of the V24 signals in ac-
cordance with the 'Online help'
These settings are only available in
combination with the RS232 interface
(module with CP441, module version
with CP341)
The RS422/485 interface version has other set-
ting options in a separate card 'interface'.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 15 of 235 ©SIEMENS AG 2013
Receiving data:
Receive buffer on CP
- Prevent overwriting
- Buffered receive message frames: 2
Receive mailbox on CPU
- Do not use a CPU receive mailbox.
3.2.2. Hardware configuration for ET200S CP 1SI ASCII
Subsequent the ET200S CP 1SI ASCII (8 Byte) module is projected.
The ASCII-protocol needs the following parame-
ters:
- After the character dwell time has been
expired.
The character dwell time depends from
the baud rate. The default adjustments
can be used.
- Transfer rate
Baud rate 300 – 115200 Bit/s
- Character frame
8 Data bits fixed in the standard
1 Stop bit fixed in the standard
Even Parity fixed in the standard
Transfer parameters:
- XON/XOFF is not permitted!
- no data flow control useful in default
- Alternatively RTS/CTS-Transmitter con-
trol resp. automatic operating of the
V24-Signales according ‚Online-Help’
permitted
This adjustments are only possible re-
lated to the RS232 interfaces.
Receiving data:
Receive buffer on the CP
- Dynamic message buffer
- Prevent overwriting message buffer
- Clear receive buffer during Start-up
Example parameterization for RS232
Example parameterization for RS485
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 16 of 235 ©SIEMENS AG 2013
3.2.3. Hardware configuration for WinAC
The SIMATIC Microbox PC (Nanobox PC as well) and the embedded controller have to be inserted as
PC-Station.
3.2.3.1. WinLC RTX on SIMATIC Microbox PC (Nanobox PC)
Subsequent the hardware configuration in the SIMATIC Manager Step 7 V5.5 (mandatory required) is
shown:
Hardware catalog:
The V4.6 corresponds to
WinAC RTX2010
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 17 of 235 ©SIEMENS AG 2013
3.2.3.2. WinLC RTX on SIMATIC S7 modular Embedded Controller EC31
Subsequent the hardware configuration in the SIMATIC Manager Step 7 V5.5 (mandatory required) is
shown:
Hardware catalog:
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 18 of 235 ©SIEMENS AG 2013
3.2.3.3. Setup of Windows COM-Interface
The transmission of the telecontrol protocol IEC60870-5-101 is carried out via the COM interface on the
Nanobox PC, Microbox PC and mEC31 (in this case an additional EM PC is required). The interface is
administrated from Windows. For using it by WinAC first of all the installation of a corresponding driver is
required.
You receive the driver for the COM interface on a CD. It is in the ‚WinAC_COM_Driver’ directory together
with an ‚Install.bat’ file. The parameterizing of the communication characteristics is carried out in a pa-
rameter block (default DB90) see chapter 3.3.4
When executing the Install.bat file the driver-dll (WinLC_SER_COM.dll) will be installed in the Windows
Sytsem32 directory of the Microbox PC (Nanobox PC) resp. mEC31and is now ready for use.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 19 of 235 ©SIEMENS AG 2013
3.2.4. Connection configuration CP340, CP341, ET200S CP 1SI ASCII
CP340 and CP341 modules as well as ET200S CP 1SI ASCII are operated exclusively via the hardware
address and therefore do not require any connection configuration.
3.2.5. Project planning CP441 connection
Only the CP441 modules require a connection projection
Use the Simatic Manager / NETPRO to gener-
ate a point-to-point connection
(PtP = Point to Point)
to an unspecified partner.
If multiple 'connection paths' (CPs, or interfaces)
are available, select the required path.
Note down the 'Local ID'.
You will need this later on for programming the
parameters.
Save, translate and load the configuration.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 20 of 235 ©SIEMENS AG 2013
3.3. Configuration of 'S7_IEC_Config'
The FB100 can be called up directly from the OB1 as well as included in CFC.
Note:
The FB100 block ('S7_IEC_Config') is designed exclusively for the OB1 priority level.
The application blocks need also to be operated in priority level OB1.
The block library contains a DB100 as a pre-defined instance DB for FB100 with a symbolic name
'S7_IEC'. When calling up the FB100 manually you can use this DB directly (Call FB100, DB100). If you
prefer or require other DB numbers, or you are working with CFC (automatic DB assignment), you can
delete DB100.
In addition, you need to refer to the enclosed variable table 'VAT_S7_IEC'. If you want to use this, by as-
signing the 'new instance DB a symbolic name and change the DB numbers in the variable table
(DB100.x -> Dbnew.x).
In the figure below the exemplary illustration of some S7_IEC config. blocks in the CFC plan is shown,
and that followed a detailed list of the input and output variables with their brief comments, and a detailed
description.
Note to the CFC plan view
The CFC views included in the manual are used exclusively for explanation purposes. CFC
is not required for using the blocks.
The standard programming options in SIMATIC are sufficient.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 21 of 235 ©SIEMENS AG 2013
3.3.1. IEC60870-5-101 Master Parameters
3.3.1.1. Master Parameters for S7-300, S7-400 and ET200S
FB100
Type
Default
Block-Comment / Brief description
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
For differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_Local_ID *1)
IN
WORD
W#16#1000
see NetPro Connection Property 'ID' of your PtP-
Connection
L1_Laddr_HW *2)
IN
INT
0
see Address of CP-Module in your HW-Configuration
L1_Data_Wait_Time *3)
IN
TIME
T#10ms
Time to wait for partner to set CTS on after setting
RTS (Def: T#10ms)
L1_Time_RTS_OFF *3)
IN
TIME
T#10ms
Time to elapse after transmission before RTS turns off
(Def: T#10ms)
L2_Length_Link_Address
IN
INT
1
Length of Link-Address (0,1,2 Octets); Default: 1
L2_Link_Address
IN
DINT
L#1
Link-Address: 1-254, 1-65534; Default: 1
L2_TimeOut_SendConfirm
IN
TIME
T#2S
Timeout for answers; Default: 2 sec (T#2s)
L2_Time_Pollcycle
IN
TIME
T#500ms
only unbal. mode master: time between two polls, if no
ACD is in answer(T#500ms)
L2_TimeOut_RcvInfo
IN
TIME
T#30S
unbal. Slave -> Cycle Error, bal mode -> Linktest, 0 ->
not active, Default 30s
L2_Repeats_on_Timeout
IN
INT
2
No of Repeats on Timeout; Default: 2
L2_Balanced_mode
IN
BOOL
FALSE
0 -> unbalanced mode (slave) 1-> balanced mode;
Default: 0
L2_Dir_Bit
IN
BOOL
TRUE
balanced mode: 1=Set DIR-Bit in Send-Telegrams;
Default: 1
L2_E5_as_ACK_NACK
IN
BOOL
TRUE
1 -> E5 will be accepted as ACK (FC0) and NACK
(FC9); Default: 1
L2_UnbalMaster_noCL2Poll
IN
BOOL
FALSE
only unbalanced master: Polling only with Class1-
Request, no Class2-Requests
L7_Length_ASDU_Address
IN
INT
1
Length of ASDU-Address (1 or 2 Octets); Default: 1
L7_Length_Info_Addresses
IN
INT
2
Length of Info object-Addresses (1, 2 or 3 Octets);
Default: 2
L7_With_Originator
IN
BOOL
FALSE
0 -> without Originator; 1 -> with Originator; Default: 0
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Next_Info
IN
BOOL
FALSE
Only allowed for additional calls in a Cycle ->reduced
operation -> next info
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
Serial_from_CPU
IN
BOOL
FALSE
For Registration use serial number from CPU instead
of memory card
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 22 of 235 ©SIEMENS AG 2013
FB100
Type
Default
Block-Comment / Brief description.
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if Connection is not established
FB_RetVal
OUT
INT
0
positive Values -> ok; negative Values (16#8xxx) ->
Error
More_Info_available *4)
OUT
BOOL
FALSE
Set, if more info are available for processing in the
actual OB1-cycle.
More_info_is_spo *4)
OUT
BOOL
FALSE
More info is spontaneous
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one or more Info were deleted from
the buffers
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is Invalid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter only present in product version for S7-400
*2) Parameter only present in product version for S7-300 and ET200S
*3) Parameter only present in product version for ET200S
*4) Parameter only present up to variant V1.4
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 23 of 235 ©SIEMENS AG 2013
3.3.1.2. Master Parameters for WinAC
FB100 VAR_INPUT
Type
Default
Block-Comment / Brief description.
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_COM_or_Laddr
IN
INT
1
COM-Port (ext. ser. drv) or address of CP-Module in
your HW-Configuration
L2_Length_Link_Address
IN
INT
1
Length of Link-Address (0,1,2 Octets); Default: 1
L2_Link_Address
IN
DINT
L#1
Link-Address: 1-254, 1-65534; Default: 1
L2_TimeOut_SendConfirm
IN
TIME
T#2S
Timeout for answers; Default: 2 sec (T#2s)
L2_Time_Pollcycle
IN
TIME
T#500ms
only unbal. mode master: time between two polls, if no
ACD is in answer(T#500ms)
L2_TimeOut_RcvInfo
IN
TIME
T#30S
unbal. Slave -> Cycle Error, bal mode -> Link test, 0 ->
not active, Default 30s
L2_Repeats_on_Timeout
IN
INT
2
No of Repeats on Timeout; Default: 2
L2_Balanced_mode
IN
BOOL
FALSE
0 -> unbalanced mode (slave) 1-> balanced mode;
Default: 0
L2_Dir_Bit
IN
BOOL
TRUE
balanced mode: 1=Set DIR-Bit in Send-Telegrams;
Default: 0
L2_E5_as_ACK_NACK
IN
BOOL
TRUE
1 -> E5 will be accepted as ACK (FC0) and NACK
(FC9); Default: 1
L2_UnbalMaster_noCL2Poll
IN
BOOL
FALSE
only unbalanced master: Polling only with Class1-
Request, no Class2-Requests
L7_Length_ASDU_Address
IN
INT
1
Length of ASDU-Address (1 or 2 Octets); Default: 1
L7_Length_Info_Addresses
IN
INT
2
Length of Info object-Addresses (1, 2 or 3 Octets);
Default: 2
L7_With_Originator
IN
BOOL
FALSE
0 -> without Originator; 1 -> with Originator; Default: 0
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Next_Info
IN
BOOL
FALSE
Only allowed for additional calls in a Cycle ->reduced
operation -> next info
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
Para_DB_No
IN
INT
90
DB-Number which contains the settings for ext. serial
driver (Default: 90)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 24 of 235 ©SIEMENS AG 2013
FB100 VAR_OUTPUT
Type
Default
Block-Comment / Brief description.
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if Connection is not established
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
Sino
OUT
WORD
W#16#0
additional information in case of errors
More_Info_available *1)
OUT
BOOL
FALSE
Set, if more infos are available for processing in the
actual OB1-cycle.
More_info_is_spo *1)
OUT
BOOL
FALSE
More info is spontaneous
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one or more Info were deleted from
the buffers
FB100 VAR_IN_OUT
Type
Default
Block-Comment / Brief description.
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is InValid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter only present up to variant V1.4
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 25 of 235 ©SIEMENS AG 2013
3.3.2. IEC60870-5-101 Slave Parameters
3.3.2.1. Slave Parameters for S7-300, S7-400 and ET200S
FB100
Type
Default
Block-Comment / Brief description.
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_Local_ID *1)
IN
WORD
W#16#1000
see NetPro Connection Property 'ID' of your PtP-
Connection
L1_Laddr_HW *2)
IN
INT
0
see Address of CP-Module in your HW-Configuration
L1_Data_Wait_Time *3)
IN
TIME
T#10ms
Time to wait for partner to set CTS on after setting
RTS (Def: T#10ms)
L1_Time_RTS_OFF *3)
IN
TIME
T#10ms
Time to elapse after transmission before RTS turns off
(Def: T#10ms)
L2_Length_Link_Address
IN
INT
1
Length of Link-Address (0,1,2 Octets); Default: 1
L2_Link_Address
IN
DINT
L#1
Link-Address: 1-254, 1-65534; Default: 1
L2_TimeOut_SendConfirm
IN
TIME
T#2S
Timeout for answers; Default: 2 sec (T#2s)
L2_TimeOut_RcvInfo
IN
TIME
T#30S
unbal. Slave -> Cycle Error, bal mode -> Link test, 0 ->
not active, Default 30s
L2_Repeats_on_Timeout
IN
INT
2
No of Repeats on Timeout; Default: 2
L2_Balanced_mode
IN
BOOL
FALSE
0 -> unbalanced mode (slave) 1-> balanced mode;
Default: 0
L2_Dir_Bit
IN
BOOL
FALSE
balanced mode: 1=Set DIR-Bit in Send-Telegrams;
Default: 0
L2_E5_as_ACK_NACK
IN
BOOL
TRUE
1 -> E5 will be accepted as ACK (FC0) and NACK
(FC9); Default: 1
L2_UnbalSlave_CL2_NACK
IN
BOOL
FALSE
only unbal. slave: 1-> Answer to Class2-Request al-
ways with NACK not with Data
L7_Length_ASDU_Address
IN
INT
1
Length of ASDU-Address (1 or 2 Octets); Default: 1
L7_Length_Info_Addresses
IN
INT
2
Length of Info object-Addresses (1, 2 or 3 Octets);
Default: 2
L7_With_Originator
IN
BOOL
FALSE
0 -> without Originator; 1 -> with Originator; Default: 0
L7_Block_Len
IN
INT
120
max. length of T101/104-ASDU (1..255, see manual);
Default 120
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
No_of_Send_Buffers
IN
INT
2
Default 2; Number of Send buffers (with send priority 1
to this para)
Send_Buffer_Dim
IN
DINT
L#4096
Dimension [size in byte] of the send buffers; De-
fault 4096
Cascade_P_Application
IN
DWORD
0
Connect to P_Application from an other
S7_IEC_Config for realizing mult. channel
Cascade_Mode
IN
BYTE
B#16#0
0 (Def): L2 copy, 1: L7 copy, 2: L7 copy, 3: red chan-
nel
Serial_from_CPU
IN
BOOL
FALSE
for Registration use serial number from CPU instead
of memory card
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 26 of 235 ©SIEMENS AG 2013
FB100
Type
Default
Block-Comment / Brief description.
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if Connection is not established
FB_RetVal
OUT
INT
0
positive Values -> ok; negative Values (16#8xxx) ->
Error
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one or more Info were deleted from
one of the buffers
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is Invalid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter only present in product version for S7-400
*2) Parameter only present in product version for S7-300
*3) Parameter only present in product version for ET200S
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 27 of 235 ©SIEMENS AG 2013
3.3.2.2. Slave Parameters for WinAC
FB100 VAR_INPUT
Type
Default
Block-Comment / Brief description
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_COM_or_Laddr
IN
INT
1
COM-Port (ext. ser. drv) or address of CP-Module in
your HW-Configuration
L2_Length_Link_Address
IN
INT
1
Length of Link-Address (0,1,2 Octets); Default: 1
L2_Link_Address
IN
DINT
L#1
Link-Address: 1-254, 1-65534; Default: 1
L2_TimeOut_SendConfirm
IN
TIME
T#2S
Timeout for answers; Default: 2 sec (T#2s)
L2_TimeOut_RcvInfo
IN
TIME
T#30S
unbal. Slave -> Cycle Error, bal mode -> Link test, 0 ->
not active, Default 30s
L2_Repeats_on_Timeout
IN
INT
2
No of Repeats on Timeout; Default: 2
L2_Balanced_mode
IN
BOOL
FALSE
0 -> unbalanced mode (slave) 1-> balanced mode;
Default: 0
L2_Dir_Bit
IN
BOOL
FALSE
balanced mode: 1=Set DIR-Bit in Send-Telegrams;
Default: 0
L2_E5_as_ACK_NACK
IN
BOOL
TRUE
1 -> E5 will be accepted as ACK (FC0) and NACK
(FC9); Default: 1
L2_UnbalSlave_CL2_NACK
IN
BOOL
FALSE
only unbal. slave: 1-> Answer to Class2-Request al-
ways with NACK not with Data
L7_Length_ASDU_Address
IN
INT
1
Length of ASDU-Address (1 or 2 Octets); Default: 1
L7_Length_Info_Addresses
IN
INT
2
Length of Info object-Addresses (1, 2 or 3 Octets);
Default: 2
L7_With_Originator
IN
BOOL
FALSE
0 -> without Originator; 1 -> with Originator; Default: 0
L7_Block_Len
IN
INT
120
max. length of T101/104-ASDU (1..255, see manual);
Default 120
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
No_of_Send_Buffers
IN
INT
2
Default 2;Number of Send buffers (with send priority 1
to this para)
Send_Buffer_Dim
IN
DINT
L#4096
Dimension [size in byte] of the send buffers; De-
fault 4096
Cascade_P_Application
IN
DWORD
0
Connect to P_Application from an other
S7_IEC_Config for realizing mult. channel
Cascade_Mode
IN
BYTE
B#16#0
0 (Def): L2 copy, 1: L7 copy, 2: L7 copy, 3: red chan-
nel
Para_DB_No
IN
INT
90
DB-Number which contains the settings for ext. serial
driver (Default: 90)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 28 of 235 ©SIEMENS AG 2013
FB100 Var_OUT
Type
Default
Block-Comment / Brief description.
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if Connection is not established
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
Z_Info
OUT
WORD
W#16#0
additional information in case of errors
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one or more Info were deleted from
one of the buffers
FB100 Var_IN_OUT
Type
Default
Block-Comment / Brief description.
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is InValid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 29 of 235 ©SIEMENS AG 2013
3.3.3. Parameter description
Registration_Code
The MMC (S7-300, ET200S) or MC (S7-400) is used as a dongle.
Depending on its serial number, you will receive from Siemens a registration / activa-
tion code which you need to specify here.
No entries or the incorrect entries will permit the unrestricted operation in demo mode
for 15 min. After this period, the telecontrol communication will be stopped.
For more details, refer to 'FB_RetVal' and the software protection chapter
Alternatively also the number of the data block containing a list of registration codes
can be entered here.
The permissible range for entering a DB
1 up to 2000 (decimal); e.g. DB1000 -> DW#16#3E8
For further details please refer to ‚FB_RetVal’ and chapter 9.
Line_ID
Is only relevant if you call up the communication block multiple times (as another in-
stance with a separate DB) to realize an additional IEC link.
The calls then need to be identified using different Line_IDs.
The Line_ID is used for the derivation of the internal Connection_ID (Con_ID) which
has to be unique for each TCP_Connection of the CPU when using PN-Interfaces.
Therefore Line-IDs from FB100, using the same interface have to be selected that
way, that from this unique Con_IDs can be generated.
The values are generated as follows:
CON_ID = LINE_ID for C1 (if only one channel exists)
CON_ID = LINE_ID + x for C2
CON_ID = LINE_ID + 2x for C3
CON_ID = LINE_ID + 3x for C3
x = 16 for WinAC-Variants
x = 64 for S7-Variants with 4 channels
x = 128 for S7 Variants with 2 channels
For diagnostics purposes additional a Comp_ID is used. It has the same value like
the Con_ID and concerns the Layer 1, 2 and 7 which are (internal) called in the
FB100
L1_COM_or_Laddr
Number of the COM Interface (in the hardware configuration) which is used for the
transmission of the IEC 60870-5-101 protocol. In case of using a CP340 for transmis-
sion the corresponding address has to be entered (still not released)
<=255 Interpretation as Windows COM port. The external interface driver is used.
The parameterizing of the communication characteristics is carried out in a parameter
data block (default DB90) see chapter 3.3.4
L1_Local_ID
Is the ID from the connection configuration (NETPRO) e.g. w#16#1000.
The value can be taken from NETPRO / properties TCP connection / module parame-
ters.
L1_Laddr_HW
Is the address of the CP allocated / shown in the hardware configuration.
L1_Data_Wait_Time
RTS-lead time.
Waiting time until data are sent after RTS has been set if the partner has not set
CTS = ON before.
Only for ET200S (1SI) with adjusted data flow control „Automatically use of the V.24-
signal“. At other CPs the parameter is located in the hardware configuration.
L1_Time_RTS_OFF
RTS-Follow-up time
Time which has to expire after transmission before RTS is switched OFF.
Only for ET200S (1SI) with adjusted data flow control „Automatically use of the V.24-
signal“. At other CPs the parameter is located in the hardware configuration.
L2_Length_Link_Address
Is the number of the address octet in the link layer
Permissible range in balanced mode 0, 1 and 2
Permissible range in unbalanced mode 1 and
L2_Link_Address
Link_address is the address value of the link layer
Permissible range with length of link address 0 is fixed at 0
Permissible range with length of link address 1 is 1 to 254
Permissible range with length of link address 2 is 1 to 65534
If there is more than one station connected to one channel (line operation) you have
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 30 of 235 ©SIEMENS AG 2013
to use a link address parameter data block.
Detailed description see chapter 3.3.5
L2_TimeOut_SendConfirm
Maximum time for responses in balanced mode and unbalanced mode master, incl.
the message transfer time itself, in other words, depending on the baud rate.
After the time elapses, the last message is repeated.
If the repetitions are still unsuccessful (para L2_Repeats_on_Timeout), the link is
marked as faulted (L2_Error_Link) and re-established
L2_Time_Pollcycle
Only with unbalanced mode master:
Time [ms] between 2 call messages if there is no high priority data.
L2_TimeOut_RcvInfo
Every correctly received message re-triggers the monitoring timer.
When the time set here elapses, the response is as follows, depending on the traffic
type:
Unbalanced mode slave: -> link error-> (L2_Error_Link)
balanced mode -> send link test FC2 (whose response must be received, which is
monitored)
L2_Repeats_on_Timeout
Refer to L2_TimeOut_SendConfirm
L2_Balanced_mode
Setting of the required traffic type:
FALSE: -> unbalanced mode
TRUE: -> balanced mode
L2_Dir_Bit
Only relevant in balanced mode. There the DIR bit is used to differentiate between
the two partners. Normally the dir bit is set for masters (main station), and not set for
slaves (sub-station).
L2_E5_as_ACK_NACK
If activated, individual characters E5 are accepted depending on the situation as the
follows:
- positive acknowledgement (ACK FC0)
- no user data available (NACK FC9)
Short messages are always used for sending, regardless of this setting, which
means that no individual characters are used.
L2_UnbalSlave_CL2_NACK
Only relevant to unbalanced mode slave:
If TRUE, all data being set is handled as class 1 data, and class 2 interrogations are
rejected with NACK 'No user data available' (but with the ACD bit set).
With FALSE, data to be sent (in addition to class 1) are also transferred to class 2
queries.
L2_UnbalMaster_noCL2Poll
Only relevant with unbalanced mode master:
If TRUE, instead of the normal cyclical class 2 interrogations, only class 1 interroga-
tions are implemented. This increases the data through-put with relevant partners.
L7_Length_ASDU_Address
is the number of the octet of the application service data unit
Station address
Permissible range is 1 and 2
L7_Length_Info_Addresses
is the number of the octet of the information object address
Permissible range in 1, 2 and 3
L7_With_Originator
FALSE means transmission cause without originator
TRUE means transmission cause with originator
L7_Block_Len
The max. length of the T101/104-ASDU will be adjusted.
The possible ASDU-length is depending on the protocol type, at approx. 253 signs.
However an adjusted value which is to high will be limited automatically.
Default value = 120
Setting options 1…255
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 31 of 235 ©SIEMENS AG 2013
Buffer_Handling
Defines the modality of buffering the messages (information). Generally the pro-
cessing described below is carried out only in case of link error
B#16#00 Clear all buffer and keep them empty
B#16#01 buffer first,
in case a buffer is filled up
-> clear all buffer and keep them empty
B#16#02 buffer and in case of overflow clear the oldest info.
B#16#03 buffer and in case of overflow stuffing backward
(meets the behavior in V1.0)
In normal operation (no ,Link_Error’) the information are buffered. In case of impend-
ing buffer overflow ‚backlog’ occurs in the collection blocks (excepting
organizational messages and command acknowledgements)
For the Master blocks we recommend the adjustment B#16#00 with it commands
and setpoint values are not stored.)
For further details about message buffering please refer to chapter 4.4.
Next_Info
Only relevant at Master-Applications.
The parameter Next_Info informs the config. block that a repeated request occurs
within one (OB) cycle. This serves only for handing over the next blocked infor-
mation. In this case a reduced cycle through the ,Master chain’ occurs.
For further details of increasing the flow rate at Master-Applications please refer to
chapter 4.5.
Do_Restart
Not all parameter are effective in case of online changes (without CPU Stop/Start).
The control input enables the save transfer from online changed parameters without
CPU Stop/Start.
With rising edge the IEC-application is new initialized with the values programmed at
the block inputs and started.
First_internal_DB_No
The IEC application generates during start-up different data blocks (diag DB, mes-
sage memory. etc.) The parameter defines the first DB number for creating this (de-
fault: 50).
No_of_Send_Buffers
Number of send buffers to be created (1…16). The default adjustment is 2. The pa-
rameter is available in all IEConS7-Slave Variants. In Master variants default values
are used.
Send_Buffers_Dim
Size of the send buffers to be created. The default value is 4096. The parameter is
available in all IEConS7-Slave Variants. In Master variants default values are used.
Cascade_P_Application
Possibility of coupling another (or more) FB100 to an existing FB100 (cascading /
casc.). Main_FB is the first FB100 which is used for the connection of further FB100
(Casc_FB)
Cascade_Mode
Selection of the desired redundancy mode:
Mode 0: Multiple channel on the basis of layer 2
Mode 1: Multiple channel on layer 7 with partner fault per channel
Mode 2: Multiple channel on layer 7 with partner fault at Main_FB
Mode 3: Extension of the redundancy group (T104) resp. switch over to / from
T101-channels
Para_DB_No
When using the COM interface on the mEC31 or microbox PC (nanobox PC) for
WinAC an external interface driver is required. The communication performance of
this external driver is provided in a parameter data block. It’s DB No. (default DB90)
has to be assigned to the FB100 input ‚Para-DB_No’.
Serial_from_CPU
Selection whether the serial number of the Memory card or the serial number of the
CPU is used for the licensing.
FALSE: Use serial number of the Memory card
TRUE: Use serial number of the CPU
P_Application
Pointer (DWORD) for the interconnection of the application blocks.
The interconnection can be carried out directly in the CFC plan.
With manual programming you assign the output, e.g. to a free memory (MD) or to a
temporary variable which you then specify on the relevant input variables of the ap-
plication blocks.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 32 of 235 ©SIEMENS AG 2013
L2_Error_Link
Signals the communication status to the connection partner, resp. error, as follows:
FALSE: communication established
TRUE: communication error
Errors are formed as follows depending on the traffic type:
With Point to point connections:
True: if the connection partner can’t be contacted anymore.
As unbalanced mode slave:
TRUE: No message reception within the programmable time
period L2_TimeOut_RcvInfo
As unbalanced mode master or in balanced mode:
Please refer to the parameter description
L2_TimeOut_SendConfirm
With line operation (unbalanced mode Master):
SET if no station does answer
RESET if at least one station does answer.
Station specific Link-Error will be written to the link address parameter data block.
FB_RetVal
The signaling of the functional block is as follows:
W#16#0000 No error
W#16#0001 – 0900 block in demo mode.
Remaining runtime in seconds in BCD
- > can be read directly in hex illustration
W#16#7FFF Initialization cycle
Error:
W#16#8101 Error when generating data blocks.
Cause could be working memory too less
W#16#8201 Problem with registration code and demo time
expired
-> Enter correct registration code on the parameter input
Registration_Code.
Further error codes at WinAC applications:
W#16#8301 Error from P_RCV_WinAC
W#16#8302 Error from P_SEND_WinAC
W#16#8305 Error from Com_INIT_WinAC
W#16#84xA General initialization fault L1
W#16#84xB Error Instance-DB allocation (not existing or 0)
Z_Info
Additional information for error code W#16#84xx from FB_RetVal
FB_RetVal error code
Additional info (Z_Info)
W#16#8301
Status of the FB P_RCV_WinAC or P_RCV
*)
W#16#8302
Status of the FB P_SEND_WINAC or P_SEND
*)
W#16#8305
Status of the FB Com_INIT_WINAC
*)
W#16#830A
1 = Para DB = 0 or not existing
2 = Para DB wrong version
3 = Para DB Para for Com not found
4 = Checksum fault Instance DBs
W#16#830B
1 = Instance DB No_P_RCV
2 = Instance DB No_P_SEND
3 = Instance DB No_V24_STAT
4 = Instance DB No_V24_SET
5 = Instance DB COM_INIT
6 = Instance DB P_RESET
*) See also WinAC IP driver documentation (WinAcIpDoku) or S7 manual
More_Info_available
(up to variant V1.4)
Only relevant at Master-Applications
The parameter More_Info_available signalizes that further information (from a
blocked message) are directly available which could be handed over in one of the
following cycle (refer also to the parameter Next_Info).
For further details of increasing the flow rate at Master-Applications please refer to
chapter 4.5.
.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 33 of 235 ©SIEMENS AG 2013
More_info_is_spo
(up to variant V1.4)
Only relevant at Master-Applications
More_Info_is_spo is an additional information permitting repetition cycles in de-
pendency on the cause of transmission (refer also to the parameter Next_Info)
For further details of increasing the flow rate at Master-Applications please refer to
chapter 4.5.
Buffer_Info_lost
Loss of information:
Indicates that minimum one message from the message memories has been lost
(deleted).
With detected Link_Error applies:
The output is set as soon as an information has been cleared.
The output is reset with disappearing Link_Error.
Note:
If the parameter Buffer_Handling = B#16#03,: the Buffer_Info_lost is never set
because in this case no information are cleared from the message buffers.
Time_DS
IN/OUT variable: Summer time bit of the current time.
Displays the current time status, if the variable is being read exclusively. It can be
affected when the assigned variable is forced.
The bit is transferred in IEC messages with a time stamp direct into SU
Time_IV
IN/OUT variable: Invalidity bit of the current time.
Displays the current time status, if the variable is being read exclusively. It can be
affected when the assigned variable is forced.
The bit is transferred in IEC messages with a time stamp direct into IV
Time_SY
IN/OUT variable: Synchronization status of the current time.
Displays the current time status, if the variable is being read exclusively. It can be
affected when the assigned variable is forced.
The bit is not used in IEC messages
Time_Diff
Time difference in comparison to CPU base time.
The value specified here [ms] is added to the current time in the CPU and the result
is used as a time stamp for IEC messages. This means that time corrections such as
local time calculations with CPU time on the basis of GMT can be implemented.
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 34 of 235 ©SIEMENS AG 2013
3.3.4. Use of the Windows COM-Interface under WinAC
The selection of the Windows administrated interfaces for the use by WinAC occurs with the FB100 pa-
rameter ‚L1_Com_or_Laddr’. It is interpreted as follows: <=255: Interpretation as (Windows-) COM-Port.
In this case the external interface driver is used. The parameterizing of the communication characteristics
is carried out in a parameter data block (default DB90). It’s DB-No. has to be assigned to the FB100 input
‚Para-DB_No’.
Additionally the external interface driver needs a number of instance DBs for its functional blocks. The al-
location of the numbers is carried out in the parameter DB as well. The parameter DB is supplied with
pre-settings which allow the direct use in conjunction with the delivered FC-, FB- and DBs without further
adjustments.
The header part of the parameter DB serves for the general management (DB_Management, Info man-
agement) and global adjustments which are pre-adjusted and may not be changed.
Now one (default) or more parameter blocks are succeeding with the following design / contents:
Com-Port:
Corresponds with the FB100 input ‚L1_Com_or_Laddr’ and indicates for which interface the
succeeding parameters have to be used. The value 0 (default) means the use for all interfaces.
IDB_No:
The numbers listed here refer to the instance data blocks of the CC Cologne driver blocks. They
correspond with the DBs provided with the runtime software. Adjustments are only required if
the DB numbers are changed.
COM_PARAMS:
Original parameter format of the provided driver for adjustment of the serial interface aligned to
the setting options of a CP340. Pre-settings are: 9600 Baud, data format 8E1 (8 data bits, even
parity 1 stop bit) without handshake.
Note: In contrast to the CP340 the minimum character delay time has to be at least 20 ms.
3.3.4.1. DB90 Parameter
Addr.
Name
Type
Initial value
Actual val-
ue
Comment
0.0
DB_Manag.Pos_of_DB
BYTE
B#16#0
B#16#0
Reserved for future - do not change
1.0
DB_Manag.No_of_all_DBs
BYTE
B#16#0
B#16#0
Reserved for future - do not change
2.0
DB_Manag.DB_No_Act
WORD
W#16#0
W#16#0
Reserved for future - do not change
4.0
DB_Manag.DB_No_Prev
WORD
W#16#0
W#16#0
Reserved for future - do not change
6.0
DB_Manag.DB_No_Next
WORD
W#16#0
W#16#0
Reserved for future - do not change
8.0
DB_Manag.Reserved
WORD
W#16#0
W#16#0
10.0
Info_Manag.P_Byte_First_Info
INT
26
26
(Byte-) Position of first Para-Block
do not change
12.0
Info_Manag.No_of_Infos
INT
0
0
0; unspecified (DB is filled up to the
end);otherwise size n of Array 1...n
14.0
Info_Manag.Len_Info
BYTE
B#16#46
B#16#46
Difference in byte between two Para
Blocks do not change
15.0
Info_Manag.Len_Sort_Key
BYTE
B#16#0
B#16#0
0: without sorting; >0: Data sets are
sorted ascending with x bytes
16.0
Info_Manag.Re_internal_usage
DWORD
DW#16#0
DW#16#0
20.0
DB_Ident
WORD
W#16#232C
W#16#232C
Do not change
22.0
DB_Ver
WORD
W#16#100
W#16#100
Do not change
24.0
Checksum_IDBs
INT
820
820
Do not change
26.0
Para [1]. Com Port
INT
0
0
0: unspec.(para for any COM), 1-8
(future 1-255) para only for this COM
28.0
Para [1].IDB_No. P_RCV
INT
91
91
Instance DB for FB P_RCV_WinAC
30.0
Para [1].IDB_No. P_SEND
INT
92
92
Instance DB for FB
P_SEND_WinAC
32.0
Para [1].IDB_No.V24_STAT
INT
93
93
Instance DB for FB
V24_STAT_WinAC
34.0
Para [1].IDB_No.V24_SET
INT
94
94
Instance DB for FB
V24_SET_WinAC
36.0
Para [1].IDB_No.COM_INIT
INT
95
95
Instance DB for FB
COM_INIT_WinAC
38.0
Para [1].IDB_No.P_RESET
INT
96
96
Instance DB for FB
P_RESET_WinAC
40.0
Para [1].IDB_No.res14
INT
0
0
42.0
Para [1].IDB_No. res16
INT
0
0
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 35 of 235 ©SIEMENS AG 2013
Addr.
Name
Type
Initial value
Actual val-
ue
Comment
44.0
Para [1].Res18
INT
0
0
46.0
Para [1].COM_PARAMS.
DB_Identifier
WORD
W#16#232C
W#16#232C
Identifier for this DB - Do not change
48.0
Para [1].
COM_PARAMS.COM_PROTOCOL
End_Code_ofRcv_Mes_Frame
BTE
B#16#0
B#16#0
0-2=Expiry of Char Delay Time, Re-
ceipt of End Char(s), Receipt of
fix.No chars
50.0
Para [1].
COM_PARAMS.COM_PROTOCOL
Character_Delay_Time
DNT
L#20
L#20
20-65530 ms - Caution: Will be used
in all cases -
54.0
Para [1].
COM_PARAMS.COM_PROTOCOL
End_ID_1
BYTE
B#16#2
B#16#2
7Bit: 00-7F (Hex)/8Bit: 00-FF (Hex) -
Relevant, if
End_Code_ofRcv_Mes_Fra = 1 -
55.0
Para [1].
COM_PARAMS.COM_PROTOCOL
Enable End_ID_2
BYTE
B#16#0
B#16#0
0-1= deactivate, activate - Relevant,
if End_Code_ofRcv_Mes_Fra = 1 -
56.0
Para [1].
COM_PARAMS.COM_PROTOCOL
End_ID_2
BYTE
B#16#0
B#16#0
7Bit: 00-7F (Hex) / 8Bit: 00-FF (Hex)
- Relevant, if Enable_End_ID_2 = 1 -
58.0
Para [1].
COM_PARAMS.COM_PROTOCOL
Message_Frame_Length
DINT
L#240
L#240
0-1024 Bytes - Relevant, if
End_Code_ofRcv_Mes_Fra = 2 -
62.0
Para [1].
COM_PARAMS.COM_BAUDRATE_
CHARFRAME.Baud_Rate
DINT
L#2
L#2
0-6= 2400, 4800, 9600, 19200,
38400, 57600, 115200
66.0
Para [1].
COM_PARAMS.COM_BAUDRATE_
CHARFRAME.CharSize
BYTE
B#16#8
B#16#8
7-8 Bits
67.0
Para [1].
COM_PARAMS.COM_BAUDRATE_
CHARFRAME.StopBits
BYTE
B#16#1
B#16#1
1-2
68.0
Para [1].
COM_PARAMS.COM_BAUDRATE_
CHARFRAME.EnableParity
BYTE
B#16#1
B#16#1
0-1= deactivated, activated
69.0
Para [1].
COM_PARAMS.COM_BAUDRATE_
CHARFRAME.Parity
BYTE
B#16#2
B#16#2
0-3= none, odd, even, any
70.0
Para [1].
COM_PARAMS.COM_BAUDRATE_
CHARFRAME.Break_Monitoring
BYTE
B#16#0
B#16#0
0-1= deactivated, activated
72.0
Para [1].
COM_PARAMS.COM_FLOW
CONTROL.Data_Flow_Control
BYTE
B#16#0
B#16#0
0-3= without, XON/XOFF, RTX/CTS,
Automat. Use of V24-Signals
73.0
Para [1].
COM_PARAMS.COM_FLOW
CONTROL..XonChar
BYTE
B#16#11
B#16#11
7Bit: 00-7F, 8Bit: 00-FF
74.0
Para [1].
COM_PARAMS.COM_FLOW
CONTROL..XoffChar
BYTE
B#16#13
B#16#13
7Bit: 00-7F, 8Bit: 00-FF
76.0
Para [1].
COM_PARAMS.COM_FLOW
CONTROL.Wait_Time_1
DINT
L#2000
L#2000
Wait for XON after XOFF (Wait Time
for CTS=ON) 20-65530 ms (10
Steps
80.0
Para [1].
COM_PARAMS.COM_FLOW
CONTROL.Wait_Time_2
DINT
L#70
L#70
Time to RTS OFF (only if Da-
ta_Flow_Control = Auto) 0-65530
ms (10 Steps)
84.0
Para [1].
COM_PARAMS.COM_FLOW
CONTROL.Wait_Time_3
DINT
L#10
L#10
Data Output Waiting Ti (only if Da-
ta_Flow_Control = Auto) 0-65530
ms (10 Steps)
88.0
Para [1].
COM_PARAMS.COM_RECEIVE
BUFFER_Delete_Buffer
BYTE
B#16#1
B#16#1
Delete Receive Buffer on Startup 0-
1: yes, no
90.0
Para [1].
COM_PARAMS.COM_RECEIVE
BUFFER_Buffer_Size
DINT
L#2
L#2
Buffered Receive Message Frames
1-250
94.0
Para [1].
COM_PARAMS.COM_RECEIVE
BUFFER_Prevent_Overwriting
BYTE
B#16#1
B#16#1
0-1= no, yes
0, only if Buffer_Size = 1
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 36 of 235 ©SIEMENS AG 2013
3.3.4.2. Use of several Interfaces
If several interfaces are used, by calling multiple instances of the (FB100) software the following infor-
mation has to be observed:
If no other interface characteristics are required the existing parameter block can be used 1 to 1
If other communication adjustments are required, either an additional parameter block has to be
established in the existing parameter DB (extension of the array ‚Para’) or the complete DB has
to be copied and its new number has to be handed over to the FB100.
In both cases the number of the allocated instance DB may remain unchanged, because the in-
terface drivers can operate with one and the same instance.
If using only one DB with then several parameter blocks these have to be arranged in a way that the pa-
rameter block can certainly be found. If any parameter block with unspecified Com-Port (COM=0) is regis-
tered it should be at the end.
Note:
Changes in the parameter DB values always have to be carried out in the actual values
in the data view.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 37 of 235 ©SIEMENS AG 2013
3.3.5. Link-Address parameter-DB for line operation
From version V1.2 also line operation with several stations at a polling line is supported.
The link addresses of the stations at the line have to be different.
If there is more than one station connected to one channel (line operation) the parameterizing of the link
addresses is carried out via a link address parameter data block. The number of this data block has to be
stated at the input parameter of the ‚L2_Link_Address’ from the S7_IEC_Config-Block.
If the address setting has to be carried out via a link address parameter DB, an offset of 100000000 (eight
zeros) has to be entered there.
If the addresses are taken from the DB111 for example, in the ‚L2_Link_Address’ the value L#100000111
has to be entered.
In the parameter DB the link addresses have to be entered in the sequence of the stations to be polled.
Single stations can be marked as reserve by setting the ‚Link_Reserved’ entry in the parameter DB to
‚TRUE’.
In case of processing information with different ASDU addresses from one device (defined via the link
address) the use of an ASDU address parameter DB is provided. For this you find a detailed description
in chapter 6.3.2.
System related, the maximum number of the link and ASDU addresses is only limited by the DB length.
Up to 8 link and ASDU addresses have been tested.
A broad summary of the physically and program technically coherences is shown in the graphic below.
The assignment from the ASDU addresses to the link addresses is necessary:
- in control direction for searching the path,
- in monitoring direction for trouble shooting of single sub stations (RTU)
Polling structure for several stations (links) and several ASDU-Addresses per station.
RTU
Modem
(if necessary)
IEC60870-5-101 Master
IEC60870-5-101 Slave
Link-Address = 1
ASDU-Address = 1
IEC60870-5-101 Slave
Link-Address = 2
ASDU-Address = 3
ASDU-Address = 6
IEC60870-5-101 Slave
Link-Address = n
ASDU-Address = m
RTU
RTU
ASDU
1
3
6
.
.
m
Link
1
2
.
.
n
DB112
DB111
S7_IEC_Config
.
.
n
MA_ORG_ASDU
.
.
n
P_Application
serial
comm.
via
several
media
ASDU x will be reached
via link y
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 38 of 235 ©SIEMENS AG 2013
Structure and values of the Parameter-Data block:
The Parameter-DB has the following basic structure:
Group /
Parameter
Addr.
rel
Addr.
Abs
Type
Initial val-
ue
Comment
DB_Manag
0
0
STRUCT
DB_Manag.
Pos_of_DB
+0.0
0.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
No_of_all_DBs
+1.0
1.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Act
+2.0
2.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Prev
+4.0
4.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Next
+6.0
6.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
Reserved
+8.0
8.0
WORD
W#16#0
reserved for future - do not change !
+10.0
10.0
END_STRUCT
END_STRUCT (10 BYTE)
Info_Manag
STRUCT
Info_Manag.
P_Byte_First_Info
+0.0
10.0
INT
34
(Byte-) Position of first Para-Block - do
not change !
Info_Manag.
No_of_Infos
+2.0
12.0
INT
0
0:unspecified (DB is filled up to the end);
otherwise size n of ARRAY [1..n]
Info_Manag.
Len_Info
+4.0
14.0
BYTE
B#16#4
Difference in [byte] between two Para-
Blocks - do not change !
Info_Manag.
Len_Sort_Key
+5.0
15.0
BYTE
B#16#0
0: without sorting; > 0: Data sets are sort-
ed ascending with x Bytes
DB_Manag.
Re_internal_usage
+6.0
16.0
DWORD
DW#16#0
+10.0
20.0
END_STRUCT
END_STRUCT (10 BYTE)
Global
STRUCT
Global.
Link_Para_Type
0.0
20.0
BYTE
B#16#0
reserved for future - do not change
Global.
Class_1_Requests
1.0
21.0
BYTE
B#16#3
Parameter: Max No of Class 1 requests
for a Station before going to the next
Global.
Act_Parablock
2.0
22.0
INT
0
actual processed Para block at runtime -
> 'read only'
4.0
24.0
END_STRUCT
END_STRUCT (4 BYTE)
Link_Para
ARRAY [0..n]
STRUCT
n = number -1 of the Parameter entries
Link_Para
Link_Error
+0.0
24.0
BOOL
TRUE
actual state of this link connection at
runtime -> 'read only'
Link_Para
Link_Reserved
+0.1
24.1
BOOL
FALSE
Parameter: Set if you actually don't want
to use this link connection
Link_Para
Res_1
+1.0
25.0
BYTE
B#16#0
Link_Para
Link_Address
+2.0
26.0
DINT
L#0
Parameter: Link address
Link_Para
Res_2
+6.0
30.0
INT
0
Link_Para
PRM_State
+8.0
32.0
BYTE
B#16#0
Internal
Link_Para
L2_Send_FCB
+9.0
33.0
BOOL
FALSE
Internal
Link_Para
L2_PRM0_ACD
+9.1
33.1
BOOL
FALSE
Internal
Link_Para
Res_3
+10.0
34.0
DINT
L#0
Link_Para
Res_4
+14.0
38.0
INT
0
16.0
40.0
END_STRUCT
END_STRUCT (16 BYTE)
This values are pre-adjusted in the sample DB and have not be changed.
A sample DB is existing in the particular block libraries.
DB111 = ‚P_LinkAdr_n’.
!!! These Parameters have to be adjusted !!!
Note:
Changes have to be performed always in the ‚Data view’, and not in the ‚Declaration view'
(except dimensioning of the array).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 39 of 235 ©SIEMENS AG 2013
DB_Management
Parameter blocks which include an enumeration are created so, that more than one
data block can be used if required. The following information is required for man-
agement.
Currently the DB management is not used – for this reason all parameters can be left
at their default settings (0)
Pos_of_DB
Number (1 – n) of the current data block for the parameter block
0: not used
No_of_all_DBs
Total number (n) of data blocks for the parameter block
0: not used
DB_No_Act
DB number of the current data block
0: not used
DB_No_Prev
DB number of the previous data block, if one exists.
Otherwise: 0
DB_No_Next
DB number of the subsequent data block, if there is another one.
Otherwise: 0
Info_Management
Parameter blocks containing an enumeration have one information block 'Info man-
agement'. It contains following information
The values of the information management parameters are already preset and there-
fore do not need to be modified.
P_Byte_First_Info
Byte position of the first data record in this DB, may not be changed
No_of_Infos
Number of data records contained in this DB
0: unspecified -> the data block end marks the last data record
Len_Info
Length of the data records:
In this case 4: may not be changed
Len_Sort_Key
0: no sorting (default setting)
Other sort lengths are not supported when using as parameter DB for Individual IEC
addressing.
Global Parameter
Class_1_Requests
Max. number of class 1 requests until switching forward to the next station.
Act_Parablock
This value gives information about the actual processed parameter block.
-> access only reading.
Link_Para
The dimensioning of the array happens in the declaration layer of the data block. It
has to be carried out according to the number of stations which have to be request-
ed.
n+1 stations are requested.
Link_Reserved
Deactivates the request for this station.
FALSE: The station will be requested
TRUE: The station will be not requested (reserve)
Link_Address
Link_address is the value of the link layer address
The permissible range for link address length 0 is 0
The permissible range for link address length 1 is 1 up to 254
The permissible range for link address length 2 is 1 up to 65534
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 40 of 235 ©SIEMENS AG 2013
4. Communication with - IEC60870-5-104
4.1. Overview
Main feature of IEC60870-5-104 is its network capability. SIPLUS RIC IEC on S7 supports the network
link via:
CPs (communication processors) CPx43
Profinet interfaces of the CPUs 31xPN,41xPN
Profinet-interface of the ET200S IM151-8PN/DP CPU
The different hardware results in an important difference in the 'connection configuration'. Whereas TCP
connections are implemented via the interfaces integrated into the CPU exclusively via programming (in
this case, parameter inputs on FB100, multiple connections are each differentiated by _C1, _C2). Config-
uration in NETPRO is required for connections via CP.
Parameters such as connection partners, etc. are set here. For more information we refer you to the rele-
vant chapter. Separate IP addresses, and where applicable, subnet masks, gateway details, etc. general-
ly need to be carried out in the hardware configuration.
The master / slave distinction with regard to telecontrol connection with the T104 protocol means:
on the network level:
whether TCP connections are established actively (master) or are passively maintained on in-
coming connections (slave).
Multiple simultaneous connections are permissible. This 'connection redundancy' is designated
as redundancy group and supported from V1.1 by the Slave and Master versions.
2 TCP connections can be held. In case of passive TCP link connection via one interface they
must have different port numbers (default 2404 and 2405).
Alternatively there is the option
- to project active TCP link connection (from V1.1 possible in all variants)
- to communicate via 2 CPs with different IP addresses – the port number in this case may
remain the same.
On the link level, more specifically APCI (transport interface):
It is used for data security and control of the data flow.
Masters initiate data traffic using 'START_DT'. Slaves accept user data after receiving
'START_DT' and send their own user data via the connection which received 'START_DT' last.
SIPLUS RIC on WinAC supports the network connection via the PN-Interface from
mEC31-RTX (WinAC 2010),
nanobox-PC with RTX and
microbox-PC with RTX.
further LAN interfaces administrated from Windows via an additional driver WinAC_IP_V217 which has to
be installed on mEC31 resp. microbox-PC (nanobox-PC).
The selection is carried out via the FB100 parameter ‚L1_IF_Slot_or_Para_ID_Cx’ which is existing for
each connection.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 41 of 235 ©SIEMENS AG 2013
The following combinations are available:
Software-Variant
Hardware
S7LIB: S7IEC_M104_CP343
SIPLUS RIC IEConS7 IEC60870-5-104 Master via
CP343-1
for Standard CPUs S7-300
CP343-1
6GK7343-1EX30-0XE0
S7LIB: S7IEC_M104_CP443
SIPLUS RIC IEConS7 IEC60870-5-104 Master via
CP443-1
for Standard CPUs S7-400 and S7-400H
CP443-1
CP443-1 Advanced
6GK7443-1EX30-0XE0
6GK7443-1GX30-0XE0
S7LIB: S7IEC_M104_31xPN
SIPLUS RIC IEConS7 IEC60870-5-104 Master via
CPU PN interface
for Standard CPUs S7-300 with PN interface
CPU315-2 PN/DP
CPU317-2 PN/DP
CPU319-3 PN/DP
6ES7315-2EH14-0AB0
6ES7317-2EK14-0AB0
6ES7318-3EL01-0AB0
S7LIB: S7IEC_M104_41xPN
SIPLUS RIC IEConS7 IEC60870-5-104 Master via
CPU PN interface
for Standard CPUs S7-400 with PN interface
CPU 414-3 PN/DP
CPU 416-3 PN/DP
6ES7414-3EM06-0AB0
6ES7416-3ES06-0AB0
S7LIB: S7IEC_S104_CP343
SIPLUS RIC IEConS7 IEC60870-5-104 Slave via
CP343-1
for Standard CPUs S7-300
CP343-1
6GK7343-1EX30-0XE0
S7LIB: S7IEC_S104_CP443
SIPLUS RIC IEConS7 IEC60870-5-104 Slave via
CP443-1
for Standard CPUs S7-400 and S7-400H
CP443-1
CP443-1 Advanced
6GK7443-1EX30-0XE0
6GK7443-1GX30-0XE0
S7LIB: S7IEC_S104_31xPN
SIPLUS RIC IEConS7 IEC60870-5-104 Slave via
CPU PN interface
for Standard CPUs S7-300 with PN interface
CPU315-2 PN/DP
CPU317-2 PN/DP
CPU319-3 PN/DP
6ES7315-2EH14-0AB0
6ES7317-2EK14-0AB0
6ES7318-3EL01-0AB0
S7LIB: S7IEC_S104_41xPN
SIPLUS RIC IEConS7 IEC60870-5-104 Slave via
CPU PN interface
for Standard CPUs S7-400 with PN interface
CPU 414-3 PN/DP
CPU 416-3 PN/DP
6ES7414-3EM06-0AB0
6ES7416-3ES06-0AB0
S7LIB: S7IEC_M104_151PN
SIPLUS RIC IEConS7 IEC60870-5-104 Master via
CPU PN interface
for ET200S IM151-8 PN/DP CPUs
IM151-8 PN/DP CPU
6ES7151-8AB01-0AB0
S7LIB: S7IEC_S104_151PN
SIPLUS RIC IEConS7 IEC60870-5-104 Slave via
CPU PN interface
for ET200S IM151-8 PN/DP CPUs
IM151-8 PN/DP CPU
6ES7151-8AB01-0AB0
S7LIB:S7IEC_M104_WinAC
SIPLUS RIC WinAC IEC60870-5-104 Master for
mEC31, nanobox-PC and microbox-PC
IEC-Communication via PN-Interface
EC31-RTX (WinAC 2010)
Microbox-PC with RTX
Nanobox-PC with RTX
6ES7677-1DD10-0BB0
6ES7675-1DF30-0DB0
6SE7xxx
S7LIB:S7IEC_S104_WinAC
SIPLUS RIC WinAC IEC60870-5-104 Slave for
mEC31, nanobox-PC und microbox-PC
IEC-Communication via PN-Interface
EC31-RTX (WinAC 2010)
Microbox-PC with RTX
Nanobox-PC with RTX
6ES7677-1DD10-0BB0
6ES7675-1DF30-0DB0
6ES7xxx
S7LIB:S7_IEC_1500_104_MS_CPU_PN_V1_5
SIPLUS RIC IEConS7 IEC60870-5-104 Master/Slave
via CPU PN interface
for Standard CPUs S7-1500 with PN interface
CPU1511-1 PN
CPU1513-1 PN
CPU1516-3 PN/DP
6ES7511-1AK00-0AB0
6ES7513-1AL00-0AB0
6ES7516-3AN00-0AB0
In each case the library contains a central communication block FB100 'S7_IEC_Config', corresponding
subordinate auxiliary blocks, as well as the associated 'application blocks' for the process connection.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 42 of 235 ©SIEMENS AG 2013
The FB100 has to be programmed with your parameters (see next chapter)and takes care of the entire
IEC communication with the connection partner.
A pointer in DWord format makes the connection / interface to the 'application blocks'. You use only the
blocks with the required functionality which can be used then repeated, too.
Limits are only set here by the memory and resource consumption (cycle time). For more details, see
chapter ‘Application blocks’, separated by master (e.g. sending commands, receiving messages and
measurement values) and slave functionality (e.g. sending messages and measurement values, receiving
commands).
The blocks for CP340 and CP341 are usable in standard S7-300 systems as well as in S7-400H systems.
For more details using the blocks in a H-system, refer to chapter 8.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 43 of 235 ©SIEMENS AG 2013
4.2. Settings in the SIMATIC Manager
The necessary settings in the hardware configuration and in the connection configuration are described
here.
4.2.1. Hardware configuration CPx43
Using the example of a CP443-1
For T104 connections it is normally not necessary to
carry out any other settings (other than the default set-
tings) with the exception of the following properties
dialog. If necessary, optional according to the notes in
the online help.
The following settings must be carried out:
According to the allocation by your system administra-
tor:
- Own IP address
- + subnet mask
- Router parameter
- Allocation to a subnet
4.2.2. Hardware configuration CPU31x PN, CPU41x PN and ET200S IM151-8 PN
As a minimum, the settings in the shown properties
dialog for the integrated PN-IO interface has to be car-
ried out:
According to the allocation by your system administra-
tor:
- Own IP address
- + subnet mask
- Router parameter
- Allocation to a subnet
Other settings can be carried out (only if required) in
the 'PN-IO / Options' properties dialog. Refer also to
the relevant part of the online help.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 44 of 235 ©SIEMENS AG 2013
4.2.3. Hardware configuration for WinAC
4.2.3.1. WinLC RTX on SIMATIC Microbox PC (Nanobox PC)
Subsequent the hardware configuration in the SIMATIC Manager Step 7 V5.5 (mandatory required) is
shown:
Hardware catalog:
The V4.6 corresponds to
WinAC RTX2010
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 45 of 235 ©SIEMENS AG 2013
4.2.3.2. WinLC RTX on SIMATIC S7 modular Embedded Controller EC31
Subsequent the hardware configuration in the SIMATIC Manager Step 7 V5.5 (mandatory required) is
shown:
Hardware catalog:
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 46 of 235 ©SIEMENS AG 2013
4.2.3.3. Setup of Windows LAN-Interface
WinLC supports a LAN resp. PN-Interface on the Microbox PC, Nanobox PC and mEC31, which can be
used also for the transmission of the telecontrol protocol IEC60870.5.104. However only one interface is
assignable.
Optionally further LAN-Interfaces administrated from Windows can be used for the transmission. In this
case first of all the installation of a corresponding driver on the Microbox PC (Nanobox PC) resp. mEC31
is required.
You’ll receive the driver for the LAN interface on a CD. It is in the ‚WinAC_TCP_Driver’ directory together
with an ‚Install.bat’ file. The corresponding connection parameters are provided by default in the DB80
(see chapter 4.3.4).
When executing the Install.bat file the driver-dll (WinLC_IP_TCOM.dll) will be installed in the Windows
Sytsem32 directory of the Microbox PC (Nanobox PC) resp. mEC31 and is now ready for use.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 47 of 235 ©SIEMENS AG 2013
4.2.4. Connection configuration CP343-1 and CP443-1
Using the example of a CP343-1 PN
Start NETPRO from the Si-
matic Manager (CPU / con-
nections).
Select the CPU.
Insert a new connection
(Menu/Insert/New connec-
tion)
The 'new connection'; is a
TCP connection to an un-
specified partner
From the properties dialog that will appear, you can transfer / note the module parameters 'ID' and
'LADDR' required later on.
Settings for passive link connection
(standard slave configurations:
- No active connection
establishment
- Local port -> typical for IEC: 2404
- Partner IP / port:
None -> any partner
default -> only this partner is permissi-
ble
Settings for active link connection
(standard master configuration)
- Active connection establishment
- Partner IP and port number must
be entered
- Local port number: irrelevant with
an active connection established, but
must be explicit assigned -> any num-
ber.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 48 of 235 ©SIEMENS AG 2013
4.3. Configuration of 'S7_IEC_Config' (FB100)
The FB100 can be called up directly from the OB1 or also integrated in the CFC.
Notice!
The FB100 block ('S7_IEC_Config') is designed exclusively for the OB1 priority level.
The application blocks need also to be operated in priority level OB1!
The block library contains one DB100 as a pre-defined instance DB for FB100 with the symbolic name
'S7_IEC'. When calling up the FB100 manually you can use this DB directly (Call FB100, DB100). If you
prefer or require other DB numbers, or you are working with CFC (automatic DB assignment), you can
delete DB100.
In addition, you need to update the accompanying variable table 'VAT_S7_IEC' if you want to use this. In
this case you have to assign a symbolic name to the 'new instance DB and change the DB numbers in
the variable table (DB100.x Dbnew.x).
In the figure below the exemplarily illustration of some S7_IEC config. blocks in the CFC plan is shown,
and that followed a detailed list of the input and output variables with their brief comments, and a detailed
description.
Note to the CFC plan view:
The CFC views included in the manual are used only for illustration purposes. CFC is not
required for using the blocks. The standard programming options in SIMATIC are sufficient.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 49 of 235 ©SIEMENS AG 2013
4.3.1. IEC60870-5-104 master parameters
- Active (Standard) and passive TCP-Link connection possible
- 2 simultaneously active TCP-connections with active test frame possible.
(the parameters are marked with _C1 resp. _C2).
- Software variants for TCP-communication via integrated PN-interface of the CPU or CP.
The CP-Variant permits the realization from separated networks via 2 CPs.
- StartDT – Message after successful link connection (Connect)
- Data traffic via the channel which has at first established a connection. This channel transmits a
StartDT_Act-Message and is leading the process from this time
The receipt from StartDT_Con is indicated at the output Cx_isActive.
Note:
If the 2 TCP-connections are working simultaneously on the same channel with the passive
link connection adjustment, the used port numbers have to be different (default 2404 and
2405).
4.3.1.1. Communication via CPx43
FB100
Type
Default
Block-Comment / Brief description.
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_Local_ID_C1
IN
INT
0
see NetPro Connection Property 'ID' of your TCP-
Connection
L1_Laddr_C1
IN
WORD
W#16#0
see NetPro Connection Property 'LADDR' of your
TCP-Connection
L1_Local_ID_C2
IN
INT
0
see NetPro Connection Property 'ID' of your TCP-
Connection
L1_Laddr_C2
IN
WORD
W#16#0
see NetPro Connection Property 'LADDR' of your
TCP-Connection
L2_T104_T0
IN
TIME
T#30S
1-255 sec/Def:30/Time-out of connection establish-
ment
L2_T104_T1
IN
TIME
T#15S
1-255 sec/Def:15/Time-out of send or test APDUs
L2_T104_T2
IN
TIME
T#10S
1-255 sec/Def:10/Time-out for acknowledges in case
of no data messages t2<t1
L2_T104_T3
IN
TIME
T#20S
1s-48h/Def:20s/Time-out for sending test frames in
case of a long idle state
L2_T104_k
IN
INT
12
>1/Def:12/Maximum difference receive sequence
number to send state variable
L2_T014_w
IN
INT
8
>1/Def:8/Latest acknowledge after receiving w I-
format APDUs
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 50 of 235 ©SIEMENS AG 2013
FB100
Type
Default
Block comment / brief description
L2_Error_DelayTime
IN
TIME
T#10S
Def: 10 sec: after this time L2_Error_Link will be set, if
no con. is active
L2_Ack_Buf_Dim
IN
INT
0
0(def): without; <>0 (we suggest 1600): dimension
[byte] of ack-buffer;
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Next_Info
IN
BOOL
FALSE
Only allowed for additional calls in a Cycle ->reduced
operation -> next info
Send_StartDT
IN
BOOL
FALSE
a rising edge sends a StartDT (only as master and if
tcp-conn)
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
Serial_from_CPU *1)
IN
BOOL
FALSE
for Registration use serial number from CPU instead
of memory card
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if no Connection is active longer than
L2_Error_DelayTime.
Con_Err_C1
OUT
BOOL
FALSE
Set, if tcp connection 1 is not established
Con_Err_C2
OUT
BOOL
FALSE
Set, if tcp connection 2 is not established
C1_isActive
OUT
BOOL
FALSE
Set, if tcp connection 1 is controlling the process data
(StartDT)
C2_isActive
OUT
BOOL
FALSE
Set, if tcp connection 2 is controlling the process data
(StartDT)
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
More_Info_available *2)
OUT
BOOL
FALSE
Set, if more infos are available for processing in the
actual OB1-cycle.
More_info_is_spo *2)
OUT
BOOL
FALSE
More info is spontaneous
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one ore more Info were deleted
from the buffers
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is Invalid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter is available only in S7-400 product variant.
*2) Parameter only present up to variant V1.4
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 51 of 235 ©SIEMENS AG 2013
4.3.1.2. Communication via the integrated PN interface of the CPU
FB100
Type
Default
Block comment / brief description
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see
manual); Default: 1;
L1_Active_Connect_C1
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active)try
to establish the con...
L1_Acceppt_All_IP_Adr_C1
IN
BOOL
TRUE
0:Only one defined IP-Addr. ... 1 (Default): Each IP-
Address will be accepted
L1_IP_Address_HH_C1
IN
INT
0
xxx-Part of IP-Address xxx.0.0.0 ; only needed if
'accept all' = false
L1_IP_Address_HL_C1
IN
INT
0
xxx-Part of IP-Address 0.xxx.0.0 ; only needed if
'accept all' = false
L1_IP_Address_LH_C1
IN
INT
0
xxx-Part of IP-Address 0.0.xxx.0 ; only needed if
'accept all' = false
L1_IP_Address_LL_C1
IN
INT
0
xxx-Part of IP-Address 0.0.0.xxx ; only needed if
'accept all' = false
L1_TCP_Port_Number_C1
IN
INT
2404
Connections will be accepted or established with
this port (Def:2404)
L1_Active_Connect_C2
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active)try
to establish the con...
… _C2
IN
Parameter for 2nd TCP-Connection (like _C1)
L1_TCP_Port_Number_C2
IN
INT
2405
Connections will be accepted or established with
this port (Def:2405)
L1_C2_over_CPU_Rack_1
*1)
IN
Bool
FALSE
only for H-System; If set C2 will communicate via
CPU in Rack 1
L2_T104_T0
IN
Time
T#30S
1-255 sec/Def:30/Time-out of connection establish-
ment
L2_T104_T1
IN
Time
T#15S
1-255 sec/Def:15/Time-out of send or test APDUs
L2_T104_T2
IN
Time
T#10S
1-255 sec/Def:10/Time-out for acknowledges in
case of no data messages t2<t1
L2_T104_T3
IN
Time
T#20S
1s-48h/Def:20s/Time-out for sending test frames in
case of a long idle state
L2_T104_k
IN
INT
12
>1/Def:12/Maximum difference receive sequence
number to send state variable
L2_T014_w
IN
INT
8
>1/Def:8/Latest acknowledge after receiving w I-
format APDUs
L2_Error_DelayTime
IN
TIME
T#10S
Def: 10 sec: after this time L2_Error_Link will be set,
if no con. is active
L2_Ack_Buf_Dim
IN
INT
0
0(def): without; <>0 (we suggest 1600): dimension
[byte] of ack-buffer;
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will delet-
ed; 3:no act.
Next_Info
IN
BOOL
FALSE
Only allowed for additional calls in a Cycle -
>reduced operation -> next info
Send_StartDT
IN
BOOL
FALSE
a rising edge will send a StartDT message(only as
master and if tcp-conn)
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 52 of 235 ©SIEMENS AG 2013
FB100
Type
Default
Block comment / brief description
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
*1) Parameter is available only in the S7-400 product variant.
FB100
Type
Default
Block comment / brief description
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if no Connection is active longer than
L2_Error_DelayTime.
Con_Err_C1
OUT
BOOL
FALSE
Set, if tcp connection 1 is not established
Con_Err_C2
OUT
BOOL
FALSE
Set, if tcp connection 2 is not established
C1_isActive
OUT
BOOL
FALSE
Set, if tcp connection 1 is controlling the process data
(StartDT)
C2_isActive
OUT
BOOL
FALSE
Set, if tcp connection 2 is controlling the process data
(StartDT)
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
More_Info_available *1)
OUT
BOOL
FALSE
Set, if more info are available for processing in the
actual OB1-cycle.
More_info_is_spo *1)
OUT
BOOL
FALSE
More info is spontaneous
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one ore more Info were deleted
from on of the buffers
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is Invalid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter only present up to variant V1.4
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 53 of 235 ©SIEMENS AG 2013
4.3.1.3. WinAC Master Parameter for mEC31 and microbox-PC (nanobox-PC)
NOTICE!
Changes in the Windows Firewall settings required!
The standard settings in the Windows firewall are blocking all incoming TCP connec-
tions. Therefore the L1_TCP_Port_Number_C1 (Default 2404) and
L1_TCP_Port_Number_C2 (Default 2405) must be unlocked.
The unlocking is carried out under: <System control / Windows Security center / Windows Firewall / Ex-
ceptions / Add Port>.
Enter here the name (e.g. IEC) and the port number (2404 resp. 2405) and complete the entry with OK.
The port will be recorded in the firewall under “Exceptions“ and can be used now.
FB100 VAR_INPUT
Type
Default
Block comment / brief description
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_Active_Connect_C1
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active) try to
establish the con...
L1_Acceppt_All_IP_Adr_C1
IN
BOOL
TRUE
0:Only one defined IP-Addr. ... 1 (Default): Each IP-
Address will be accepted
L1_IF_Slot_or_Para_ID_C1
IN
BYTE
B#16#1
IF_Slot (1-4) of PLC Ethernet Contr. or Para_ID for ext
IP Drv (>=80); Def: 1
L1_IP_Address_HH_C1
IN
INT
0
xxx-Part of IP-Address xxx.0.0.0 ; only needed if
'accept all' = false
L1_IP_Address_HL_C1
IN
INT
0
xxx-Part of IP-Address 0.xxx.0.0 ; only needed if
'accept all' = false
L1_IP_Address_LH_C1
IN
INT
0
xxx-Part of IP-Address 0.0.xxx.0 ; only needed if
'accept all' = false
L1_IP_Address_LL_C1
IN
INT
0
xxx-Part of IP-Address 0.0.0.xxx ; only needed if
'accept all' = false
L1_TCP_Port_Number_C1
IN
INT
2404
Connections will be accepted or established with this
port (Def:2404)
L1_Active_Connect_C2
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active) try to
establish the con...
… _C2
IN
Parameter for 2nd TCP-Connection (like _C1)
L1_TCP_Port_Number_C2
IN
INT
2405
Connections will be accepted or established with this
port (Def:2405)
L2_T104_T0
IN
Time
T#30S
1-255 sec/Def:30/Time-out of connection establish-
ment
L2_T104_T1
IN
Time
T#15S
1-255 sec/Def:15/Time-out of send or test APDUs
L2_T104_T2
IN
Time
T#10S
1-255 sec/Def:10/Time-out for acknowledges in case
of no data messages t2<t1
L2_T104_T3
IN
Time
T#20S
1s-48h/Def:20s/Time-out for sending test frames in
case of a long idle state
L2_T104_k
IN
INT
12
>1/Def:12/Maximum difference receive sequence
number to send state variable
L2_T014_w
IN
INT
8
>1/Def:8/Latest acknowledge after receiving w I-
format APDUs
L2_Error_DelayTime
IN
TIME
T#10S
Def: 10 sec: after this time L2_Error_Link will be set, if
no con. is active
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 54 of 235 ©SIEMENS AG 2013
FB100 VAR_INPUT
Type
Default
Block comment / brief description
L2_Ack_Buf_Dim
IN
INT
0
0(def): without; <>0 (we suggest 1600): dimension
[byte] of ack-buffer;
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will be delet-
ed; 3:no act.
Next_Info
IN
BOOL
FALSE
Only allowed for additional calls in a Cycle ->reduced
operation -> next info
Send_StartDT
IN
BOOL
FALSE
a rising edge will send a StartDT telegram (only as
master and if tcp-conn)
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
Para_DB_No
IN
INT
80
DB-Number which contains the settings for ext. TCP
driver (Default: 80)
FB100 VAR OUTPUT
Type
Default
Block comment / brief description
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if no Connection is active longer than
L2_Error_DelayTime.
Con_Err_C1
OUT
BOOL
FALSE
Set, if tcp connection 1 is not established
Con_Err_C2
OUT
BOOL
FALSE
Set, if tcp connection 2 is not established
C1_isActive
OUT
BOOL
FALSE
Set, if tcp connection 1 is controlling the process data
(StartDT)
C2_isActive
OUT
BOOL
FALSE
Set, if tcp connection 2 is controlling the process data
(StartDT)
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
Z_Info
OUT
WORD
W#16#0
additional information in case of error
More_Info_available *1)
OUT
BOOL
FALSE
Set, if more infos are available for processing in the
actual OB1-cycle.
More_info_is_spo *1)
OUT
BOOL
FALSE
More info is spontaneous
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one ore more Info were deleted
from the buffers
FB100 VAR_IN_OUT
Type
Default
Block comment / brief description
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is InValid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter only present up to variant V1.4
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 55 of 235 ©SIEMENS AG 2013
4.3.2. IEC60870-5-104 slave parameter
- Active and passive (Standard) TCP-link connection possible
- 2 simultaneously active TCP connections with active test frame possible
(the parameters are marked with _C1 resp. _C2).
- Software variants for TCP-communication via integrated PN-interface of the CPU or CP.
The CP-Variant permits the realization from separated networks via 2 CPs
- Data traffic is carried out with the communication device which has sent at last StartDT.
- The receipt of StartDT is indicated at the output Cx_isActive.
Note
If the 2 TCP-connections are working simultaneously on the same channel with the passive
link connection adjustment, the used port numbers have to be different (default 2404 and
2405).
4.3.2.1. Communication via CPx43
FB100
Type
Default
Block-Comment / Brief description.
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_Local_ID_C1
IN
INT
0
see NetPro Connection Property 'ID' of your TCP-
Connection
L1_Laddr_C1
IN
WORD
W#16#0
see NetPro Connection Property 'LADDR' of your
TCP-Connection
L1_Local_ID_C2
IN
INT
0
see NetPro Connection Property 'ID' of your TCP-
Connection
L1_Laddr_C2
IN
WORD
W#16#0
see NetPro Connection Property 'LADDR' of your
TCP-Connection
L2_T104_T0
IN
Time
T#30S
1-255 sec/Def:30/Time-out of connection establish-
ment
L2_T104_T1
IN
Time
T#15S
1-255 sec/Def:15/Time-out of send or test APDUs
L2_T104_T2
IN
Time
T#10S
1-255 sec/Def:10/Time-out for acknowledges in case
of no data messages t2<t1
L2_T104_T3
IN
Time
T#20S
1s-48h/Def:20s/Time-out for sending test frames in
case of a long idle state
L2_T104_k
IN
INT
12
>1/Def:12/Maximum difference receive sequence
number to send state variable
L2_T014_w
IN
INT
8
>1/Def:8/Latest acknowledge after receiving w I-
format APDUs
L2_Error_DelayTime
IN
TIME
T#10S
Def: 10 sec: after this time L2_Error_Link will be set, if
no con. is active
L2_Ack_Buf_Dim
IN
INT
0
0(def): without; <>0 (we suggest 1600): dimension
[byte] of ack-buffer;
L7_Block_Len
IN
INT
120
max. length of T101/104-ASDU (1..255, see manual);
Default 120
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50;
No_of_Send_Buffers
IN
INT
2
Default 2;Number of Send buffers (with send priority 1
to this para)
Send_Buffer_Dim
IN
DINT
L#4096
Dimension [size in byte] of the send buffers; De-
fault 4096
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 56 of 235 ©SIEMENS AG 2013
FB100
Type
Default
Block-Comment / Brief description.
Cascade_P_Application
IN
DWORD
0
Connect to P_Application from an other
S7_IEC_Config for realizing mult. channel
Cascade_Mode
IN
BYTE
B#16#0
0 (Def): L2 copy, 1: L7 copy, 2: L7 copy, 3: red chan-
nel
Serial_from_CPU *1)
IN
BOOL
FALSE
for Registration use serial number from CPU instead
of memory card
FB100
Type
Default
Block-Comment / Brief description.
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if no Connection is active longer than
L2_Error_DelayTime.
Con_Err_C1
OUT
BOOL
FALSE
Set, if tcp connection 1 is not established
Con_Err_C2
OUT
BOOL
FALSE
Set, if tcp connection 2 is not established
C1_isActive
OUT
BOOL
FALSE
Set, if tcp connection 1 is controlling the process data
(StartDT)
C2_isActive
OUT
BOOL
FALSE
Set, if tcp connection 2 is controlling the process data
(StartDT)
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one ore more Info were deleted
from the buffers
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is Invalid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter is available only in S7-400 product variant.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 57 of 235 ©SIEMENS AG 2013
4.3.2.2. Communication via the integrated PN interface of the CPU
FB100
Type
Default
Block-Comment / Brief description
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_Active_Connect_C1
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active)try to
establish the con...
L1_Acceppt_All_IP_Adr_C1
IN
BOOL
TRUE
0:Only one defined IP-Addr. ... 1 (Default): Each IP-
Address will be accepted
L1_IP_Address_HH_C1
IN
INT
0
xxx-Part of IP-Address xxx.0.0.0 ; only needed if
'accept all' = false
L1_IP_Address_HL_C1
IN
INT
0
xxx-Part of IP-Address 0.xxx.0.0 ; only needed if
'accept all' = false
L1_IP_Address_LH_C1
IN
INT
0
xxx-Part of IP-Address 0.0.xxx.0 ; only needed if
'accept all' = false
L1_IP_Address_LL_C1
IN
INT
0
xxx-Part of IP-Address 0.0.0.xxx ; only needed if
'accept all' = false
L1_TCP_Port_Number_C1
IN
INT
2404
Connections will be accepted or established with this
port (Def:2404)
L1_Active_Connect_C2
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active)try to
establish the con...
… _C2
IN
Parameter for 2nd TCP-connection (like _C1)
L1_TCP_Port_Number_C2
IN
INT
2405
Connections will be accepted or established with this
port (Def:2405)
L1_C2_over_CPU_Rack_1
*1)
IN
Bool
FALSE
only for H-System; If set C2 will communicate via CPU
in Rack 1
L2_T104_T0
IN
Time
T#30S
1-255 sec/Def:30/Time-out of connection establish-
ment
L2_T104_T1
IN
Time
T#15S
1-255 sec/Def:15/Time-out of send or test APDUs
L2_T104_T2
IN
Time
T#10S
1-255 sec/Def:10/Time-out for acknowledges in case
of no data messages t2<t1
L2_T104_T3
IN
Time
T#20S
1s-48h/Def:20s/Time-out for sending test frames in
case of a long idle state
L2_T104_k
IN
INT
12
>1/Def:12/Maximum difference receive sequence
number to send state variable
L2_T014_w
IN
INT
8
>1/Def:8/Latest acknowledge after receiving w I-
format APDUs
L2_Error_DelayTime
IN
TIME
T#10S
Def: 10 sec: after this time L2_Error_Link will be set, if
no con. is active
L2_Ack_Buf_Dim
IN
INT
0
0(def): without; <>0 (we suggest 1600): dimension
[byte] of ack-buffer;
L7_Block_Len
IN
INT
120
max. length of T101/104-ASDU (1..255, see manual);
Default 120
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50.
No_of_Send_Buffers
IN
INT
2
Default 2;Number of Send buffers (with send priority 1
to this para)
Send_Buffer_Dim
IN
DINT
L#4096
Dimension [size in byte] of the send buffers; De-
fault 4096
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 58 of 235 ©SIEMENS AG 2013
FB100
Type
Default
Block-Comment / Brief description
Cascade_P_Application
IN
DWORD
0
Connect to P_Application from an other
S7_IEC_Config for realizing mult. channel
Cascade_Mode
IN
BYTE
B#16#0
0 (Def): L2 copy, 1: L7 copy, 2: L7 copy, 3: red chan-
nel
FB100
Type
Default
Block-Comment / Brief description
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if no Connection is active longer than
L2_Error_DelayTime.
Con_Err_C1
OUT
BOOL
FALSE
Set, if tcp connection 1 is not established
Con_Err_C2
OUT
BOOL
FALSE
Set, if tcp connection 2 is not established
C1_isActive
OUT
BOOL
FALSE
Set, if tcp connection 1 is controlling the process data
(StartDT)
C2_isActive
OUT
BOOL
FALSE
Set, if tcp connection 2 is controlling the process data
(StartDT)
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one ore more Info were deleted
from the buffers
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is Invalid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
*1) Parameter is available only in S7-400 product variant.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 59 of 235 ©SIEMENS AG 2013
4.3.2.3. WinAC Slave Parameter for mEC31 and microbox-PC (nanobox-PC)
NOTICE!
Changes in the Windows Firewall settings required!
The standard settings in the Windows firewall are blocking all incoming TCP connec-
tions. Therefore the L1_TCP_Port_Number_C1 (Default 2404) and
L1_TCP_Port_Number_C2 (Default 2405) must be unlocked.
The unlocking is carried out under: <System control / Windows Security center / Windows Firewall / Ex-
ceptions / Add Port>.
Enter here the name (e.g. IEC) and the port number (2404 resp. 2405) and complete the entry with OK.
The port will be recorded in the firewall under “Exceptions“ and can be used now.
FB100 VAR_INPUT
Type
Default
Block-Comment / Brief description
Registration_Code
IN
DWORD
DW#16#0
!!! IMPORTANT !!! See product information
Line_ID
IN
INT
1
for differentiation of more than one line;1-x (see man-
ual); Default: 1;
L1_Active_Connect_C1
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active)try to
establish the con...
L1_Acceppt_All_IP_Adr_C1
IN
BOOL
TRUE
0:Only one defined IP-Addr. ... 1 (Default): Each IP-
Address will be accepted
L1_IF_Slot_or_Para_ID_C1
IN
BYTE
B#16#1
IF_Slot (1-4) of PLC Ethernet Contr. or Para_ID for ext
IP Drv (>=80); Def: 1
L1_IP_Address_HH_C1
IN
INT
0
xxx-Part of IP-Address xxx.0.0.0 ; only needed if
'accept all' = false
L1_IP_Address_HL_C1
IN
INT
0
xxx-Part of IP-Address 0.xxx.0.0 ; only needed if
'accept all' = false
L1_IP_Address_LH_C1
IN
INT
0
xxx-Part of IP-Address 0.0.xxx.0 ; only needed if
'accept all' = false
L1_IP_Address_LL_C1
IN
INT
0
xxx-Part of IP-Address 0.0.0.xxx ; only needed if
'accept all' = false
L1_TCP_Port_Number_C1
IN
INT
2404
Connections will be accepted or established with this
port (Def:2404)
L1_Active_Connect_C2
IN
BOOL
FALSE
0 (default): we are passive (listen); 1: we (active)try to
establish the con...
… _C2
IN
Parameter for 2te TCP-Connection (like _C1)
L1_TCP_Port_Number_C2
IN
INT
2405
Connections will be accepted or established with this
port (Def:2405)
L2_T104_T0
IN
Time
T#30S
1-255 sec/Def:30/Time-out of connection establish-
ment
L2_T104_T1
IN
Time
T#15S
1-255 sec/Def:15/Time-out of send or test APDUs
L2_T104_T2
IN
Time
T#10S
1-255 sec/Def:10/Time-out for acknowledges in case
of no data messages t2<t1
L2_T104_T3
IN
Time
T#20S
1s-48h/Def:20s/Time-out for sending test frames in
case of a long idle state
L2_T104_k
IN
INT
12
>1/Def:12/Maximum difference receive sequence
number to send state variable
L2_T014_w
IN
INT
8
>1/Def:8/Latest acknowledge after receiving w I-format
APDUs
L2_Error_DelayTime
IN
TIME
T#10S
Def: 10 sec: after this time L2_Error_Link will be set, if
no con. is active
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 60 of 235 ©SIEMENS AG 2013
FB100 VAR_INPUT
Type
Default
Block-Comment / Brief description
L2_Ack_Buf_Dim
IN
INT
0
0(def): without; <>0 (we suggest 1600): dimension
[byte] of ack-buffer;
L7_Block_Len
IN
INT
120
max. length of T101/104-ASDU (1..255, see manual);
Default 120
Buffer_Handling
IN
BYTE
B#16#0
0(def): compl, 1:compl. if ov 2:oldest Info will deleted;
3:no act.
Do_Restart
IN
BOOL
FALSE
a rising edge restarts the IEC-Application
First_internal_DB_No
IN
INT
50
First DB-Number for DBs created by the Runtime
Software; Default: 50.
No_of_Send_Buffers
IN
INT
2
Default 2;Number of Send buffers (with send priority 1
to this para)
Send_Buffer_Dim
IN
DINT
L#4096
Dimension [size in byte] of the send buffers; De-
fault 4096
Cascade_P_Application
IN
DWORD
0
Connect to P_Application from an other
S7_IEC_Config for realizing mult. channel
Cascade_Mode
IN
BYTE
B#16#0
0 (Def): L2 copy, 1: L7 copy, 2: L7 copy, 3: red chan-
nel
Para_DB_No
IN
INT
80
DB-Number which contains the settings for ext. TCP
driver (Default: 80)
FB100 VAR_OUTPUT
Type
Default
Block-Comment / Brief description
P_Application
OUT
DWORD
DW#16#0
Pointer to Application Functions (SL_x, MA_x)
L2_Error_Link
OUT
BOOL
FALSE
Set, if no Connection is active longer than
L2_Error_DelayTime.
Con_Err_C1
OUT
BOOL
FALSE
Set, if tcp connection 1 is not established
Con_Err_C2
OUT
BOOL
FALSE
Set, if tcp connection 2 is not established
C1_isActive
OUT
BOOL
FALSE
Set, if tcp connection 1 is controlling the process data
(StartDT)
C2_isActive
OUT
BOOL
FALSE
Set, if tcp connection 2 is controlling the process data
(StartDT)
FB_RetVal
OUT
WORD
W#16#0
positive Values -> ok; negative Values (16#8xxx) ->
Error
Z_Info
OUT
WORD
W#16#0
additional information in case of error
Buffer_Info_lost
OUT
BOOL
FALSE
in case of Link_Err one ore more Info were deleted
from the buffers
FB100 VAR_IN_OUT
Type
Default
Block-Comment / Brief description
Time_DS
IN/OUT
BOOL
FALSE
Time-Qualifier DaylightSaving (Summertime)
Time_IV
IN/OUT
BOOL
TRUE
Time-Qualifier Time is InValid
Time_SY
IN/OUT
BOOL
FALSE
Time-Qualifier Time is synchronized (actually only in-
ternal used)
Time_Diff
IN/OUT
Time
T#0MS
Time difference between CPU-Time and desired IEC-
Time-Stamps
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 61 of 235 ©SIEMENS AG 2013
4.3.3. Parameter description
Registration_Code
The MMC (S7-300) or MC (S7-400) is used as a dongle. Depending on its serial
number, you will receive from Siemens a registration / activation code which you need
to enter here.
No entry or a mismatched entry of the information will permit unrestricted operation in
demo mode for 15 min. After this period, the telecontrol communication is stopped.
For more details, we refer you to 'FB_RetVal' and the software protection chapter
Alternatively also the number of the data block containing a list of registration codes
can be entered here.
The permissible range for entering a DB
1 up to 2000 (decimal); e.g. DB1000 -> DW#16#3E8
For further details please refer to ‚FB_RetVal’ and chapter 9.
Line_ID
Is only relevant if you call up the communication block multiple times (as another in-
stance with a separate DB) to realize an additional IEC link.
The calls then need to be identified using different Line_IDs.
The Line_ID is used for the derivation of the internal Connection_ID (Con_ID) which
has to be unique for each TCP_Connection of the CPU when using PN-Interfaces.
Therefore Line-IDs from FB100, using the same interface have to be selected that
way, that from this unique Con_IDs can be generated.
The values are generated as follows:
CON_ID = LINE_ID for C1 (if only one channel exists)
CON_ID = LINE_ID + x for C2
CON_ID = LINE_ID + 2x for C3
CON_ID = LINE_ID + 3x for C3
x = 16 for WinAC-Variants
x = 64 for S7-Variants with 4 channels
x = 128 for S7 Variants with 2 channels
For diagnostics purposes additional a Comp_ID is used. It has the same value like
the Con_ID and concerns the Layer 1, 2 and 7 which are (internal) called in the
FB100
L1 parameter with communication via CP:
L1_Local_ID (_C1, _C2)
This is the ID from the connection configuration (NETPRO) e.g. 1.
The value can be taken from NETPRO / properties TCP connection / module parame-
ters.
T104 connections which are not used should be specific switched off with the value 0.
L1_Laddr_C1 (_C1, _C2)
This is the hardware address of the CP module used for establishment of the TCP
connection. It can be taken from the hardware configuration or from NETPRO / prop-
erties TCP connection / module parameters.
L1 parameter with communication via PN interface of the CPU:
L1_Active_Connect (_C1 _C2)
Determines whether the TCP link connection is established active or passive.
In case of active link connection the connection partner has to be specified with the
parameters ‚L1_IP_Address_xy (_C1 _C2)’ und ‚L1_TCP_Port_Number (_C1 _C2)’
L1_Acceppt_All_IP_Adr (_C1
_C2)
When establishing passive connections (as a slave), this parameter can be used to
determine whether connections are permitted by any partner or only by a specified
partner (IP address below).
Can be parameterized for each connection.
L1_IP_Address_xy (_C1 _C2)
Passive connection establishment (IEC slave): In the case of selective connection
partners (parameter 'L1_Acceppt_All_IP_Adr' = FALSE), this will set its IP address.
Active connection establishment (IEC master): IP address of the partner for TCP con-
nection establishment.
L1_TCP_Port_Number (_C1
_C2)
Passive connection establishment (IEC slave): A connection can only be established
using the port no. set here. The port number 2404 intended for IEC-T104 is preset for
connection 1 (_C1). Any other connection (_C2) can only be enabled using a different
port number (default 2405).
Active connection establishment (IEC master): Number of the port used for the connec-
tion establishment to the partner is.
T104 connections which are not used should be specific switched off with the value 0.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 62 of 235 ©SIEMENS AG 2013
L1_C2_over_CPU_Rack_1
Only for S7-400-H systems
Activating of the parameter causes the use of the PN-interface of the CPU located in
rack 1
L1 Parameter with communication via WinAC
L1_IF_Slot_or_Para_ID_(C1_C2)
FB100 parameter for the selection of the interface on mEC31 resp. microbox PC
(nanobox PC) used for transmission.
1-4 interpretation as slot containing the ‚installed’ LAN interface. Default =1.
IF1 = B#16#01
IF2 = B#16#02
IF3 = B#16#03
IF4 = B#16#04
>=B#16#80 = Interpretation as LAN-interface/Network adapter supported from Win-
dows logic controller (WinLC). In this case the setup of an external interface driver
(provided) is required.
The value is at the same time a parameter ID (>=80)
The parameterizing of the communication characteristics of the interface driver is car-
ried out in a parameter data block (default DB80) see chapter 4.3.4. These DB-No. has
to be assigned to a FB100 input ‘Para-DB_No’.
L2_T104_T0
Standard parameter T0: Time monitoring of the connection establishment
Normally this parameter does not need to be changed
L2_T104_T1
Standard parameter T1: Time monitoring for sent APDU or test APDU
Normally this parameter does not need to be changed
L2_T104_T2
Standard parameter T2: Time monitoring for acknowledgements, if no data messages
have been transferred
Normally this parameter does not need to be changed
L2_T104_T3
Standard parameter T3: Time monitoring for sent test messages in the case of long
idle states
Normally this parameter does not need to be changed
L2_T104_k
Standard parameter k: Maximum difference in the number of receive sequences and
the number of send sequences
Normally this parameter does not need to be changed
L2_T014_w
Standard parameter w: Latest acknowledgement after receipt of w APDU in the I-
format
Normally this parameter does not need to be changed
L2_Error_DelayTime
Delay time for L2_Error_Link
After this time L2_Error_Link is set if no IEC connection is active (no StartDT).
L2_Ack_Buf_Dim
The parameter defines the size of the T104 receive buffer
0 without receive buffer (like V1.0)
>0 size of the receive buffer in Byte
recommended adjustment: 1600
For further details about rating the receive buffer please refer to chapter 4.4.2.
L7_Block_Len
The max. length of the T101/104-ASDU will be adjusted.
The possible ASDU-length is depending on the protocol type, at approx. 253 signs.
However an adjusted value which is to high will be limited automatically.
Default value = 120
Setting options 1…255
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 63 of 235 ©SIEMENS AG 2013
Buffer_Handling
Defines the modality of buffering the messages (information). Generally the processing
described below is carried out only in case of link error
B#16#00 Clear all buffer and keep them empty
B#16#01 buffer first,
in case a buffer is filled up
-> clear all buffer and keep them empty
B#16#02 buffer and in case of overflow clear the oldest info.
B#16#03 buffer and in case of overflow stuffing backward
(meets the behavior in V1.0)
In normal operation (no ,Link_Error’) the information are buffered. In case of impending
buffer overflow ‚backlog’ occurs in the collection blocks (excepting organizational mes-
sages and command acknowledgements)
For the Master blocks we recommend the adjustment B#16#00 with it commands and
setpoint values are not stored.)
For further details about message buffering please refer to chapter 4.4
Next_Info
Only relevant at Master-Applications.
The parameter Next_Info informs the config. block that a repeated request occurs
within one (OB) cycle. This serves only for handing over the next blocked information.
In this case a reduced cycle through the ,Master chain’ occurs.
For further details of increasing the flow rate at Master-Applications please refer to
chapter 4.5.
Send_StartDT
With rising edge a StartDT-message is send.
Assumption:
The application is working as Master and the TCP-connection is assembled.
The input permits the manual transmission of a StartDT-message. For start of the
communication after a L2_Link_Error the wiring is not necessary because the StartDT-
message is sent automatically in this case.
Do_Restart
Not all parameter are effective in case of online changes (without CPU Stop/Start). The
control input enables the save transfer from online changed parameters without CPU
Stop/Start.
With rising edge the IEC-application is new initialized with the values parameterized at
the block inputs and started.
First_internal_DB_No
The IEC application generates during start-up different data blocks (diag DB, message
memory. etc.) The parameter defines the first DB number for creating this (default: 50).
No_of_Send_Buffers
Number of send buffers to be created (1…16). The default adjustment is 2. The pa-
rameter is available in all IEConS7-Slave Variants. In Master variants default values
are used.
Send_Buffers_Dim
Size of the send buffers to be created. The default value is 4096. The parameter is
available in all IEConS7-Slave Variants. In Master variants default values are used.
Cascade_P_Application
Possibility of coupling another (or more) FB100 to an existing FB100 (cascading /
casc.). Main_FB is the first FB100 which is used for the connection of further FB100
(Casc_FB)
Cascade_Mode
Selection of the desired redundancy mode:
Mode 0: Multiple channel on layer 2 basis
Mode 1: Multiple channel on layer 7 with partner fault per channel
Mode 2: Multiple channel on layer 7 with partner fault at Main_FB
Mode 3: Extension of the redundancy group (T104) resp. switch over to / from
T101-channels
Para_DB_No
When using further LAN interfaces on the mEC31 or microbox PC (nanobox PC) for
WinAC an external interface driver is required. The communication performance of this
external driver is provided in a parameter data block. It’s DB No. (default DB80) has to
be assigned to the FB100 input ‚Para-DB_No’.
Serial_from_CPU
Selection whether the serial number of the Memory card or the serial number of the
CPU is used for the licensing.
FALSE: Use serial number of the Memory card
TRUE: Use serial number of the CPU
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 64 of 235 ©SIEMENS AG 2013
P_Application
Pointer (DWORD) for the interconnection of the application blocks.
The interconnection can be carried out directly in the CFC plan.
With manual programming you assign the output, e.g. to a free memory (MD) or to a
temporary variable which you then specify on the relevant input variables of the appli-
cation blocks.
L2_Error_Link
Signals the communication status to the connection partner, resp. error, as follows:
FALSE: communication established
TRUE: communication error
Errors are formed as follows depending on the traffic type:
Set if no active IEC-connection was established to the connection partner within
,L2_Error_DelayTime’ (no StartDT).
Con_Err_C1
Connection fault TCP-connection 1
Set if the TCP connection 1 is not established.
Con_Err_C2
Connection fault TCP-connection 2
Set if the TCP connection 2 is not established.
C1_isActive
TCP-connection 1 is active
Set if the process data are exchanged via TCP-connection 1 (StartDT).
C2_isActive
TCP-connection 2 is active
Set if the process data are exchanged via TCP-connection 2 (StartDT).
FB_RetVal
The signaling of the functional block is as follows:
W#16#0000 No error
W#16#0001 – 0900 block in demo mode.
Remaining runtime in seconds in BCD
-> can be read directly in hex illustration
W#16#7FFF Initialization cycle
Error:
W#16#8101 Error when generating data blocks.
Cause could be working memory too less
W#16#8201 Problem with registration code and demo time
expired
-> Enter correct registration code on the parameter input
Registration_Code.
Further error codes at WinAC applications
W#16#84x2 Error from TINT_WINAC
W#16#84x3 Error from TSEND_WINAC
W#16#84x4 Error from TRCV_WINAC
W#16#84x5 Error from TCON_WINAC
W#16#84x6 Error from TDISCON_WINAC
W#16#84xA Gen. initialization fault L1
W#16#84xB Error instance-DB allocation (not existing or 0)
x = channel number (1,2)
Z_Info
Additional information for error code W#16#84xx from FB_RetVal
FB_RetVal error code
Additional info (Z_Info)
W#16#84x2
Status of the FB TINT_WINAC
*)
W#16#84x3
Status of the FB TSEND_WINAC or TSEND
*)
W#16#84x4
Status of the FB TRCV_WINAC or TRCV
*)
W#16#84x5
Status of the FB TCON_WINAC or TCON
*)
W#16#84x6
Status of the FB TDISCON_WINAC or TDISCON
*)
W#16#84xA
1 = Para DB = 0 or not existing
2 = Para DB wrong version
3 = Para DB ID not found
4 = Checksum fault instance DBs
W#16#84xB
1 = Instance DB TINIT_WINAC
2 = Instance DB TSEND_WINAC
3 = Instance DB TRCV_WINAC
4 = Instance DB TCON_WINAC
5 = Instance DB TDISCON_WINAC
*) See also WinAC IP driver documentation (WinAcIpDoku)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 65 of 235 ©SIEMENS AG 2013
More_Info_available
(up to variant V1.4)
Only relevant at Master-Applications
The parameter More_Info_available signalizes that further information (from a
blocked message) are directly available which could be handed over in one of the fol-
lowing cycle (refer also to the parameter Next_Info).
For further details of increasing the flow rate at Master-Applications please refer to
chapter 4.5.
.
More_info_is_spo
(up to variant V1.4)
Only relevant at Master-Applications
More_Info_is_spo is an additional information permitting repetition cycles in depend-
ency on the cause of transmission (refer also to the parameter Next_Info)
For further details of increasing the flow rate at Master-Applications please refer to
chapter 4.5.
Buffer_Info_lost
Loss of information:
Indicates that minimum one message from the message memories has been lost (de-
leted).
With detected Link_Error applies:
The output is set as soon as an information has been cleared.
The output is reset with disappearing Link_Error.
Note
If the parameter Buffer_Handling = B#16#03,: the Buffer_Info_lost is never set be-
cause in this case no information are cleared from the message buffers.
Time_DS
IN/OUT variable: Summer time bit of the current time.
Displays the current time status, if the variable is being read exclusively. It can be af-
fected when the assigned variable is forced.
The bit is transferred in IEC messages with a time stamp direct into SU
Time_IV
IN/OUT variable: Invalidity bit of the current time.
Displays the current time status, if the variable is being read exclusively. It can be af-
fected when the assigned variable is forced.
The bit is transferred in IEC messages with a time stamp direct into IV
Time_SY
IN/OUT variable: Synchronization status of the current time.
Displays the current time status, if the variable is being read exclusively. It can be af-
fected when the assigned variable is forced.
The bit is not used in IEC messages
Time_Diff
Time difference in comparison to CPU base time.
The value specified here [ms] is added to the current time in the CPU and the result is
used as a time stamp for IEC messages. This means that time corrections such as lo-
cal time calculations with CPU time on the basis of GMT can be implemented.
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 66 of 235 ©SIEMENS AG 2013
4.3.4. Use of the Windows Ethernet-Interface under WinAC
For using further LAN interfaces for WinAC on mEC31 or Microbox PC (Nanobox PC) an external inter-
face driver is used. The communication characteristics of this driver are provided in a parameter data
block (default DB80).
4.3.4.1. DB80 Parameter
Ad-
dress
Name
Type
Initial value
Actual
value
Comment
0.0
DB_Manag.Pos_of_DB
BYTE
B#16#0
B#16#0
Reserved for future - do not change
1.0
DB_Manag.No_of_all_DBs
BYTE
B#16#0
B#16#0
Reserved for future - do not change
2.0
DB_Manag.DB_No_Act
WORD
W#16#0
W#16#0
Reserved for future - do not change
4.0
DB_Manag.DB_No_Prev
WORD
W#16#0
W#16#0
Reserved for future - do not change
6.0
DB_Manag.DB_No_Next
WORD
W#16#0
W#16#0
Reserved for future - do not change
8.0
DB_Manag.Reserved
WORD
W#16#0
W#16#0
10.0
Info_Manag.P_Byte_First_Info
INT
26
26
(Byte-) Position of first Para-Block do
not change
12.0
Info_Manag.No_of_Infos
INT
0
0
0; unspecified (DB is filled up to the
end);otherwise size n of Array 1...n
14.0
Info_Manag.Len_Info
BYTE
B#16#26
B#16#26
Difference in byte between two Para
Blocks do not change
15.0
Info_Manag.Len_Sort_Key
BYTE
B#16#0
B#16#0
0: without sorting; >0: Data sets are
sorted ascending with x bytes
16.0
Info_Manag.Re_internal_usage
DWORD
DW#16#0
DW#16#0
20.0
DB_Ident
WORD
W#16#AC01
W#16#AC01
Do not change
22.0
DB_Ver
WORD
W#16#100
W#16#100
Do not change
24.0
Checksum_IDBs
INT
1092
1092
Do not change
26.0
Para [1]. Para_ID
Byte
B#16#0
B#16#80
0: unspec. (para for any connection),
80-FF for spec. connection
28.0
Para [1].DLL_ID
INT
0
0
0: Default-DLL
30.0
Para [1].Res_04
INT
0
0
32.0
Para [1].IDB_No.TINIT_WINAC
INT
82
82
Instance DB for FB TINIT_WINAC
34.0
Para [1].IDB_No.TSEND_WINAC
INT
83
83
Instance DB for FB TSEND_WINAC
36.0
Para [1].IDB_No.TRCV_WINAC
INT
84
84
Instance DB for FB TRCV_WINAC
38.0
Para [1].IDB_No.TCON_WINAC
INT
85
85
Instance DB for FB TCON_WINAC
40.0
Para [1].IDB_No.TDISCON_WINAC
INT
86
86
Instance DB for FB TDISCON_WINAC
42.0
Para [1].IDB_No.TUSEND_WINAC
INT
87
87
Instance DB for FB TUSEND_WINAC
44.0
Para [1].IDB_No.TURCV_WINAC
INT
88
88
Instance DB for FB TURCV_WINAC
46.0
Para [1].IDB_No.res_14
INT
0
0
48.0
Para [1].Local_IP_Address.HH
INT
0
192
xxx-Part of local IP-Address xxx.0.0.0
only needed if more netw. Adapt. exist
50.0
Para [1].Local_IP_Address.HL
INT
0
168
xxx-Part of local IP-Address 0.xxx.0.0
only needed if more netw. Adapt. exist
52.0
Para [1].Local_IP_Address.LH
INT
0
1
xxx-Part of local IP-Address 0.0.xxx.0
only needed if more netw. Adapt. exist
54.0
Para [1].Local_IP_Address.LL
INT
0
4
xxx-Part of local IP-Address 0.0.0.xxx.
only needed if more netw. Adapt. Exist
56.0
Para [1].Local_IP_Address.Res_08
INT
0
0
58.0
Para [1].Local_IP_Address.Res_10
INT
0
0
60.0
Para [1].Res_34
DWORD
DW#16#0
DW#16#0
64.0
Para [2].Para_ID
Byte
B#16#0
B#16#81
0: unspec. (para for any connection),
80-FF for spec. connection
66.0
Para [2].DLL_ID
INT
0
1
0: Default-DLL
68.0
Para [2].Res_04
INT
0
0
70.0
Para [2].IDB_No.TINIT_WINAC
INT
82
1082
Instance DB for FB TINIT_WINAC
72.0
Para [2].IDB_No.TSEND_WINAC
INT
83
1083
Instance DB for FB TSEND_WINAC
74.0
Para [2].IDB_No.TRCV_WINAC
INT
84
1084
Instance DB for FB TRCV_WINAC
76.0
Para [2].IDB_No.TCON_WINAC
INT
85
1085
Instance DB for FB TCON_WINAC
78.0
Para [2].IDB_No.TDISCON_WINAC
INT
86
1086
Instance DB for FB TDISCON_WINAC
80.0
Para [2].IDB_No.TUSEND_WINAC
INT
87
1087
Instance DB for FB TUSEND_WINAC
82.0
Para [2].IDB_No.TURCV_WINAC
INT
88
1088
Instance DB for FB TURCV_WINAC
84.0
Para [2].IDB_No.res_14
INT
0
0
86.0
Para [2].Local_IP_Address.HH
INT
0
192
xxx-Part of local IP-Address xxx.0.0.0
only needed if more netw. Adapt. exist
88.0
Para [2].Local_IP_Address.HL
INT
0
168
xxx-Part of local IP-Address 0.xxx.0.0
only needed if more netw. Adapt. exist
90.0
Para [2].Local_IP_Address.LH
INT
0
1
xxx-Part of local IP-Address 0.0.xxx.0
only needed if more netw. Adapt. exist
92.0
Para [2].Local_IP_Address.LL
INT
0
116
xxx-Part of local IP-Address 0.0.0.xxx.
only needed if more netw. Adapt. Exist
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 67 of 235 ©SIEMENS AG 2013
Ad-
dress
Name
Type
Initial value
Actual
value
Comment
94.0
Para [2].Local_IP_Address.Res_08
INT
0
0
96.0
Para [2].Local_IP_Address.Res_10
INT
0
0
98.0
Para [2].Res_34
DWORD
DW#16#0
DW#16#0
Additionally the external interface driver needs a number of instance DBs for its functional blocks. The al-
location of the numbers is carried out in the parameter DB as well. The parameter DB is supplied with
pre-settings which allow the direct use in conjunction with the delivered FC-, FB- and DBs without further
adjustments if only one network adapter exists.
FB100 Parameter L1_IF_Slot_or_Para_ID_Cx = B#16#80
The adjustment of the IP address for the network adapter is carried out under the DB80 address 48 – 54.
If another network adapter has to be used the corresponding address for this adapter has to be adjusted
in the DB80:
FB100 Parameter L1_IF_Slot_or_Para_ID_Cx = B#16#81
The adjustment of the IP address for this network adapter is carried out under the DB80 address 86 – 94.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 68 of 235 ©SIEMENS AG 2013
4.4. Message buffering
4.4.1. Use of the Message Memory
From V1.0 already 4 data blocks are created as message buffer (more exactly: event buffer between pro-
cess blocks and telecontrol protocol) and used as follows:
- TX_Buf_1 (message memory 1): Default length 1000h=4096 Byte
for organizational entries (start-up indication, confirmation messages,…)
- TX_Buf_2 (message memory 2): Default length 1000h=4096 Byte
Entries from process blocks (Sly,…) with Prio High
- TX_Buf_3 (message memory 3): Default length 1000h=4096 Byte
Entries from process blocks (Sly,…) with Prio Low
- TX_Buf_4 (message memory 4): Default length 200h=512 Byte
reserved for low prior applications, currently not used
The Buffer-DBs are created during start-up. The length are singular given in the Instance-DB from
S7_IEC_Config. With it they are available as a kind of ,background parameter’.
Basically also in V1.1 the size of a buffer is limited to one DB (no DB comprehensive buffer). In larger
systems (S7-400, CP317PN) the max. DB size is 64kB, in S7-300 systems normally 16kB (refer to the S7
manual).
As a guiding value for the memory consumption per info approx. 40 Bytes can be assumed. In this case
you can enter per buffer:
with 4096 Byte: approx. 100 Information
with 16 Kbyte: approx. 400 Information
with 64 Kbyte: approx. 1600 Information
An entry in one of the buffers occurs independently from the cause of transmission, also at general inter-
rogations and cyclic transmission procedures. However cyclic entries are only carried out from the SLi-
blocks if the buffer is filled less 50%. Requested entries are carried out only if the buffer is filled less 70%.
The remaining space is used for spontaneous changes (like in V1.0).
In V1.0 the message memories in all Master packages were cleared continuously (to prevent the storage
of commands). In the Slave packages the accumulated information during connection disturbances were
remaining (oldest info – see above). While in Master systems preferred should not be buffered, the re-
quirements in the Slave are arranged customer specific as follows:
a) After disappearing connection disturbances no old info are desired
b) No loss of information should occur during connection disturbances
From Version 1.1 the desired behavior regarding the message buffering can be parameterized via ‚Buff-
er_Handling’ (Parameter input from S7_IEC_Config).
For more details refer to chapter 4.4.3.
From Version V1.3, instead of two defined buffers, up to maximum 16 Prio-buffers can be set, adjustable
at FB100 with the parameter „No_of_Send_Buffers“. With the Parameter “Send_Buffer_Dim” the size of
the single buffers can be adjusted. Thereby the limits mentioned above apply referenced to the size of the
DB.
Every buffer is treated with a defined priority. The first buffer (buffer 0) is disposed with highest priority,
while the 16th (buffer 15) is treated with lowest priority.
The priority, with which an information should be transmitted, is adjusted at the respective collection
blocks (SLi_xyz) via the input parameter “Tx_Prio”, range of value 0..15.
If a priority is adjusted at the collection block that is not available – for example 5 priority buffers are cre-
ated, but the adjusted priority at the collection block is 8 – the next lower order priority is used automati-
cally, in this example 4.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 69 of 235 ©SIEMENS AG 2013
4.4.2. T104-Confirmation buffer
At IEC60870-5-104 transmission not every single message will get a confirmation. In order to transmit
unconfirmed messages again if necessary (connection fault), all messages (I-Formats) have to be tempo-
rary buffered. For this purpose a confirmation buffer can be created from V1.1 with the following behavior:
- An existing receive buffer is used from all T104 connections of a redundancy group (several
TCP connections, process data exchange only via one connection)
- Sent messages (I-Formats) are generally entered in parallel into the receive buffer. The reading
pointer is switched forward according to the received messages.
- In case of a connection switch over (StartDT to another TCP-connection) or interrupt and anew
link connection, first non acknowledged information from the receive buffer are sent.
Via a parameter input ‚L2_Ack_Buf_Dim’ at S7_IEC_Config block the configuration is carried out whether
a corresponding receive buffer should be created and controlled.
With the default value (0) no receive buffer is created / controlled.
- Messages once sent can not be repeated.
- This adjustment should be used for central units (Master functions) so that commands are not
stored during a longer period.
Values <>0 define the desired size of the receive buffer:
- The optimum buffer size can be calculated as follows:
- L=30+((22Bytes + 6 + ‚max_Block_Len’) x parameter ‚L2_T104_k’)
30 = administration part in the DB itself
22 = length of the internal Job-Header
6 = length of one T104-Message-Header
In conjunction with the default values for ‚max_Block_Len’ = 120 and ‚L2_T104_k’ = 12 it results
in a value of 1806 (Bytes).
- Too small values (but not less 30) lead in the worst case to the state that not all unconfirmed in-
formation can be entered, but no fault occurs.
4.4.3. Projection
For projection of the desired buffer characteristics the following new FB100-Parameter have been estab-
lished in Version V1.1:
Input: ‚L2_Ack_Buf_Dim’ (T104-Variants only)
Input: ‚Buffer_Handling’
Output: ,Buffer_Info_lost’ (for diagnostics)
L2_Ack_Buf_Dim
(only T104-Variants)
The parameter defines the size of the T104 receive buffer
0 without receive buffer (like V1.0)
>0 size of the receive buffer in Byte
recommended adjustment: 1600
Buffer_Handling
Defines the modality of buffering the messages (information). Generally the pro-
cessing described below is carried out only in case of link error. In normal opera-
tion (no ,Link_Error’) ‚backlog’ occurs (excepting ORG- and command blocks).
B#16#00 Clear all buffer and keep them empty
B#16#01 buffer first,
in case a buffer is filled up
-> clear all buffer and keep them empty
B#16#02 buffer and in case of overflow clear the oldest info.
B#16#03 buffer and in case of overflow stuffing backward
(meets the behavior in V1.0)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 70 of 235 ©SIEMENS AG 2013
Buffer_Info_lost
Loss of information:
Indicates that minimum one message from the message memories has been lost
(deleted).
With detected Link_Error applies:
The output is set as soon an information has been cleared
The output is reset with disappearing Link_Error
Note
If the parameter Buffer_Handling = B#16#03,: the Buffer_Info_lost is never set
because in this case no information are cleared from the message buffers.
Generally the processing is carried out only in case of Link_Error. In normal operation ,backlog’ occurs
always.
‚Buffer_Info_Lost’ appears with the first cleared info and disappears with disappearing Link_Error.
An existing T104 receive buffer is always cleared in Mode 0 (‚Buffer_Handling’ = 0). In the other modes it
is cleared only with erasing an info (‚Buffer_Info_lost’).
With ‚Buffer_Handling’ = 0 the buffering is deactivated.
Deactivating means continuous clearing of the buffers during a discovered link error. In case of Master all
buffers are cleared, in case of Slave all buffers with exception of the organizational buffer. In this case a
possible existing TK70 message is kept (further entries aren’t to be expected).
Using T104 the receive buffer is controlled analog resp. it is not existing (‚L2_Ack_Buf_Dim’).
The following table gives an overview of the effect from the possible buffer variants (‚Buffer_Handling’).
Buffer_
Handling
Function
Concerns
Buffer_Info_lost appears
00
Clear all buffer / keep it empty
Message memory 2,3,4
Message memory 1 (ORG) only if
Master
T104-receive buffer
As soon as an info was
cleared
01
Buffer first
in case a buffer is filled up
-> clear all buffer and keep
them empty
Message memory 2,3,4
Message memory 1 (ORG) only if
Master
T104-receive buffer
As soon as an info was
cleared
02
Buffer and clear the oldest
info in case of overflow
Each individual buffer
Message memory 1 (ORG) only if
Master
T104- receive buffer
As soon as an info was
cleared
03
Buffer and possibly backlog*
Is NOT set here
* Meaning of backlog in this case:
Fill the buffer and in case the buffer is filled don’t enter new messages.
=> possible new (actual) information can’t be entered into the message buffer and can get lost.
Note:
The message buffering is switched off in case of parameterization with default values.
This corresponds with the behavior in V1.0. If necessary the corresponding parameteriza-
tion has to be consciously activated.
Note:
If necessary the size of the buffer DBs in the FB100’s instance DB can be adapted. For
this adjust the parameters TX_Buf_n_Len according to your requirements.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 71 of 235 ©SIEMENS AG 2013
4.5. Improvement of the IEC-Master performance
In normal case in each OB1 cycle one information is processed. This may lead to problems in case of re-
ceiving blocked information and longer OB1 cycle times.
In order to process more than one info per cycle the ,Master-Chain’, this means the S7_IEC_Config and
all evaluation blocks, could be principally called several times (but always the complete Master-Chain).
In this case all functions would be passed every time. This is not necessary in order to evaluate only a
further information from a blocked message.
Therefore parameter have been established in the S7_IEC_Config (FB100) from the Master applications
which allow a reduced cycle of the ,Master-Chain’.
This can be used as follows:
- ,More_Info_Available’ signals that directly further information (from a blocked message) are
existing which could be handed over in a subsequent cycle.
- ,More_Info_is_spo’ is an additional information, allowing repeated cycles in dependency of the
cause of transmission (= spontaneous, <> spontaneous).
- ,Next_Info’ informs the Config-block that a repeated call is executed within a (OB-) cycle only
for the purpose to hand over the next blocked information.
With programming a suitable loop an improvement of the performance when receiving blocked messages
can be achieved.
Example for the programming:
// Master
SET
R #Next_Info
L 10
Loop: T #L_Count
CALL "S7_IEC_Config" , DB100
Next_Info :=#Next_Info
More_Info_available :=#More_Info_Available
CALL "MA_Org_Asdu_1" , DB122
CALL "MAo_SP_IM_pDB"
… (further evaluation blocks)
// set Rep after the first cycle
SET
U #More_Info_available
S #Next_Info
SPBN WWW
L #L_Count
LOOP Loop
WWW: NOP 0
The loop shown above is causing the processing and output of up to 10 (#L_Count) information from a
received blocked message within one OB1-cycle.
The drop is carried out if #More_Info_available=FALSE or the loop counter is #L_Count=0.
Wiring the FB-100 input Next_Info with the variable #Next_Info is causing thereby the reduced cycle of
the ,Master-Chain’. In this case an explicit enhanced information performance has been reached with only
slight increased cycle time.
The size of the loop counter should be selected in such a way to reach a possible optimum ratio between
performance improvement and max. cycle time extension. Normally 10 should be a practicable value.
Remark for the supervisory time L2_T104_T2 at T104-Communication
In case of Master and an expected high data appearance the time L2_T104_T2 should be possibly small
adjusted (1 sec) (T2 ->send receive).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 72 of 235 ©SIEMENS AG 2013
Note:
From version V1.5 up to 10 information objects are internal provided per cycle and edited
from the Mao blocks. This is carried out independently of the use of the blocks, in Master
or Slave communication in standard or reversed direction.
The possibility to improve the performance described in this chapter for the Master library
is no longer necessary. It is inapplicable including the related parameter.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 73 of 235 ©SIEMENS AG 2013
5. Multiple channel / Redundancy
The IEC60870-5-104 standard specifies for the operation of redundant connections the following rules:
1. Central station and substation must be able to process several logical connections.
2. These logical connections form a redundancy group.
3. Only one logical connection per redundancy group is started and transmits and receives appli-
cation data.
4. The central station decides which of the existing connections is started.
5. All logical connections of a redundancy group have to be monitored with test messages.
6. A redundancy group has to be configured on one process image only (data inventory / event
buffer)
7. If more than one central station simultaneously needs access to the same substation each cen-
tral station has to be assigned to another redundancy group (process image).
However not all control centers support this redundancy rules. Instead of data transmission on only one
connection which was activated with Start_DT, they expect when operating with several connections also
data from all connections. Up to now this could only be realized with starting several instances of the
(FB100) communication and the complete collection (SL-Blocks).
5.1. Implementation
From variant V1.4 IEConS7 now offers the possibility of cascading FB100 Blocks. The basic idea is the
possibility of coupling one (or more) FB100 to an existing FB100.
For this the FB100 are extended by the inputs ‚Cascade_P_Application’ and ‚Cascade_Mode’. The first
FB100 (Main) is leading like until now. As usual all application blocks (SL-Blocks) are coupled to it via
P_Application.
At cascading now one further FB100 (Casc) respectively can be interconnected to P_Application via its
new input ‚Cascade_P_Application’.
In monitoring direction the subordinated (Casc) FB100 transmit identical messages like the respective
superior FB100 by writing either directly into the transfer box of layer 7 to layer 2 (Casc_Mode 0) or into a
send buffer (Casc_Mode 1, 2). In Casc_Mode 3 only one channel transmits the present send data from
the Main-FB100.
In control direction each FB100 checks alternating on self received messages or on received messages
existing from a subordinated block and transfers them to the superior FB100 resp. to P_Application as
Main FB100.
It is only buffered once (at the Main FB100) and only if no more connection is existing. The subordinated
FB100 do not need own buffer blocks in Casc_Modes 0 and 3. Here the parameter ‚No_of_Send_Buffers’
can be adjusted to 0. In Mode 1 the parameter can be reduced to 1.
Note:
In order to have a consistent time management in the FB100 blocks the time bits
(Time_DS, Time_IV, Time_SY) should be interconnected.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 74 of 235 ©SIEMENS AG 2013
In conjunction with the already mentioned parameter ‚Cascade_Mode’ the following functions can be real-
ized:
Cascade_
Mode
Function
Application
0
Multiple channel on the basis of layer 2
Transmission of a message copy (application
data)
Standard for transmitting parallel
In T104 Slave, where applicable also in T101
Slave, for redundant / parallel data supply for con-
trol center (control center compound) if identical
transmission path (e.g. LAN) are existing. The
transmission of a message must be completed on
all channels before transmission of the next mes-
sage.
1
Multiple channel on the basis of layer 7 – with
partner fault per channel
May only be used project specific!
2
Multiple channel on the basis of layer 7 – with
partner fault at Main FB
In T101 Slave, where applicable also in T104
Slave, for redundant / parallel data supply for con-
trol center (control center compound) and different
transmission path / data rates are existing because
of decoupling via a buffer. Theoretical also com-
munication parameter like the length of the IOA
may be different in this mode.
3
Extension of the redundancy group (T104)
resp. switch over to / from T101-channels
Extension of the redundancy group from T104
Master or Slaves and T101 redundancy only if
transmitting application data via one channel / con-
nection.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 75 of 235 ©SIEMENS AG 2013
5.1.1. Cascade_Mode_0: Multiple Channel on basis of Layer 2
Data flow in monitoring direction
Virtual ‚parallel’ transmission for the supply of one control center via several connections.
Messages created in the Main FB100 (only ASDU = application service data unit) are handed
over to all connections which are marked as non disturbed, and sent. A short congestion may
occur if it was not possible to send on one connection. For example confirmation is not possible
because a breakdown of the line arises and the disturbance is not yet recognized.
With different protocols (e.g. 104, 101) the slowest partner specifies the flow-rate.
A total disturbance (Link_Error at Main FB100) and an associated congestion occurs only if
there is no more connection to the control center.
Cascade shape: Line
No buffer-DBs and T104-acknowledgement buffer are required in the FB100 (Casc).
In control direction messages from all channels are accepted. In case of high message appear-
ance a message from the own connection is alternating processed with a message from the
next subordinated block. The more FBs have been cascaded the longer it takes (OB1 cycles)
for the handover of messages from the FB with the lowest hierarchy.
The FB100 (Casc) must have the same L7-Message adjustments like the FB100 (main).
The operation mode is designed for minimum one valid and active connection. In case of a total disturb-
ance the buffer handling adjusted with the parameter ‘Buffer_Handling’ is executed.
Example: Buffer_Handling 2 is adjusted and 4 connections are projected. Last of all only connection 3
was active. In case of breakdown of connection 3 as well, buffering is carried out in the FB100 (Main). If
now a connection which is different from connection 3 operates again all messages from the FB100
(Main) are transmitted via this connection.
It may occur that some messages are obviously missing. These are still in the send buffer of connec-
tion 3, because they have not been yet transmitted or acknowledged from the control center. If connection
3 returns, these missing messages are transmitted as well.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 76 of 235 ©SIEMENS AG 2013
5.1.2. Cascade_Mode_1: Multiple Channel on basis of Layer 7
(with partner disturbance per channel)
This mode may be only used project specific !
Link_Error is created discretely from each channel. In order to buffer data in case of disturbance a special
add-on block is required.
The further behavior is like Mode 2.
5.1.3. Cascade_Mode_2: Multiple Channel on basis of Layer 7
(with partner disturbance at the main FB)
Data flow in monitoring direction
Information which has to be transmitted is additional placed to another channel by writing into
the send buffer DB with the highest priority (like from a SLi-Block).
Thus a decoupled processing of single information, including parameterized properties like
with/without originator, IOA length (at T101 protocol etc.).
Cascade shape: Line
Control direction like Cascade_mode 0
With larger amount of data the send buffer with the highest priority from the respective FB100
(Casc) serves as decoupling buffer. If it is full a congestion into the FB100 (Main) occurs in case
of slow processing. In case of fault the buffer is kept empty resp. data are transferred to another
FB100 (Casc) if existing.
Link_Error at the FB100 (main) is the collective message also from subordinated FB100 (Casc)
Link Errors. In case of fault a congestion is possible!
Sequential extendable …
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 77 of 235 ©SIEMENS AG 2013
5.1.4. Cascade_Mode_3: Extension of the T104-Redundancy group
(resp. switchover to / from T101-Channels)
Data flow in monitoring direction
In this example only T101 channel is transmitting
Behavior like specified in the Standard:
At T104-Protocol:
Step-by-step extension of the T104 redundancy group from FB100 (Main) by respectively 2 fur-
ther connections. According to definition in the standard application data are only sent and
accepted on one connection (which was activated with StartDT).
At T101-Protocol:
Step-by-step extension by respectively one further T101 channel. Also at T101 only one chan-
nel is used for transmission. The switchover / activation is carried out with the receiving of appli-
cation data (e.g. command or general interrogation message).
Reverse, no application data may be received via non active channels. The link layer is active
on all T101 channels.
Mixed operation of T101 and T104 protocol and with different interfaces is possible as well.
Cascade shape: Several FB100 (Casc) at one FB100 (Main)! This means in parallel resp. star-
shaped. Here also at the FB100 (Main) ‚Casc_Mode’ = 3 has to be declared!
No buffer are required at the FB100 (Casc) (however Org and Diag are always created).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 78 of 235 ©SIEMENS AG 2013
6. Application blocks
Basically there are two packets available: Slave and master functions.
Slave (SL) blocks fulfill traditional 'substation functions' such as indication/measured value recording or
command output.
Master (MA) blocks carry out 'control center functions, e.g. the transfer of status conditions to images, ini-
tiation of commands, etc.
Although each protocol version can work in principle together with both master and slave blocks, the
available versions only include the master or slave application packet.
NOTICE!
All application blocks are designed exclusively for the priority class OB1. The com-
munication blocks FB100 ('S7_IEC_Config') also need to be operated in this priority
class!
Note to the CFC plan view
The CFC views included in the manual are used exclusively for explanation purposes. CFC
is not required for using the blocks.
The standard programming options in SIMATIC are sufficient.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 79 of 235 ©SIEMENS AG 2013
6.1. Slave blocks SL
The slave application blocks (SL) are connected via the pointer 'P_Application' to the protocol version
supplied, i.e. the function block 'SL_Org_Asdu_1' and the functional blocks for the outputs in the control
direction (SLo) are coupled directly to the IEC interface connection. The data capture blocks (SLi) are
each 'interconnected' to an organization block.
The organization of an ASDU address in monitoring direction is carried out in the function block
'SL_Org_Asdu_1' which supplies the pointer 'P_to_SLi' for the data capture blocks.
The data capture blocks are connected to the pointer 'P_to_SLi' and write its messages to the relevant
send buffer.
Additional ASDU addresses can be managed in the monitoring direction via the multiple call-up of the
block SL_Org_Asdu_1 and subordinated SLi blocks.
In the control direction the ASDU address(es) are managed directly in the parameter DB.
FB_xy -> e.g.
S7_IEC_S101
L1_xy
L2_xy
L7_T101_104_B
P_to_SLi
All blocks are also multiple applicable
SLo_BO…
(FB137)
SLo_SC_DC…
(FB135)
ASDU-
address
Message buffer
…
…
P_Application
SL_Org_Asdu_1
(FB121)
SLi_IT…
(FB134)
SLi_SP_DP…
(FB130)
FB_xy -> e.g.
S7_IEC_S104
L1_xy
L2_xy
L7_T101_104_B
Slave blocks (SL)
(control centre connection)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 80 of 235 ©SIEMENS AG 2013
6.1.1. Organization block - SL_Org_ASDU_1 (FB121)
CALL "SL_Org_Asdu_1" , DB121
Comp_ID :=
P_Application :=#P_Appl
ASDU_Adr :=
Accept_ClockSync :=TRUE
Sim_GI :=
Set_Time_Correction:=
SF_Originator :=
P_SLi :=#P_SLi
Reset :=
TimeSync :=
GI_Runs :=
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
The block has been created as a functional block (FB), and therefore requires an instance DB (e.g. Call
FB121,DB121) or can be used within a higher level FBs as a 'multi-instance'.
The tasks of SL_ORG_ASDU_1 always relate to the parameterized ASDU address and are:
Provision of an interface to subordinate SLi data capture blocks
Sending of TK70 (start-up message)
Management of TK100 interrogation (general interrogation)
Management of counter interrogation commands TK101
Support of single interrogation TK102
Response of test messages TK104 and TK107
TK105 remote reset
TK103 time synchronizing message
Negative command receipt, in case no command block has processed the message
From Version V1.5 applicable also in time interrupts (see chapter 6.2)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 81 of 235 ©SIEMENS AG 2013
Block parameters with their default assignment and brief comment
FB121
Type
Default
Block-Comment / Brief description.
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
DW#16#0
Pointer which must be connected to ‘S7_IEC_Config’
– Module
ASDU_Adr
IN
DINT
L#1
ASDU-Address which will be controlled by this module
Accept_ClockSync
IN
BOOL
FALSE
if true, time of received clock sync. commands will ac-
cepted (Default: False)
Sim_GI
IN
BOOL
FALSE
A rising edge starts a station (general) interrogation
Set_Time_Correction
IN
TIME
T#0MS
the set time of clock sync. commands will be corrected
with this time (Def. 0ms)
SF_Originator
IN
BYTE
B#16#0
Originator which will be overtaken by all SLi-blocks
(Default: b#16#0)
P_Sli
OUT
DWORD
DW#16#0
Pointer, which must be connected to SLi - Application
modules (SLi_x)
Reset
OUT
BOOL
FALSE
Signals a received reset command (TI105) for about 5
sec
TimeSync
OUT
BOOL
FALSE
Signals a received (and accepted) TimeSync-
Telegr.(TI103) for one cycle
GI_Runs
OUT
BOOL
FALSE
Signals a running general interrogation
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions
P_Application
Pointer which has to be connected to the output 'P_Application' on block
'S7_IEC_Config' (FB100). It refers to all data required internally, such as send and
receive buffer, etc.
ASDU_Adr
Value of the address of the application service data unit which is processed by this
block.
Permissible range with ASDU address length of 1 is 1 to 254
Permissible range with ASDU address length 2 is 1 to 65534.
The broadcast addresses 255 (FFh with length 1) or 65535 (FFFFh with length 2)
are always accepted.
Accept_ClockSync
TRUE: Received time setting jobs (TK103) are accepted and confirmed positively.
The time transferred is used as the system time.
FALSE: TK103 messages are not accepted and confirmed negatively
Sim_GI
A rising edge at this input simulates the initiation of a general interrogation (with
originator 0) (from version V1.3). Like at a real interrogation the GI-Confirmation
and the GI-End message will be transmitted as well.
Set_Time_Correction
The time from the clock adjustment task (TK103) will be corrected by this value
(runtime correction)
SF_Originator
Special function from V1.4: The value denoted here is taken over as originator in
messages of the own block and from the SLi-blocks. This occurs as well at interro-
gations, if the originator = 0 in the interrogation message or equal the value param-
eterized here.
P_SLi
Pointer (DWORD) for the interconnection of the SLi blocks.
The interconnection can be carried out directly in the CFC plan.
With manual programming you assign the output to a free marker (MD) or a tempo-
rary variable for example. Then this has to be assigned again to the corresponding
input variables of the SLi blocks.
Reset
Signals a remote reset job received for approx. 5 seconds (TK105)
TimeSync
Signals a received and accepted clock adjustment task (TK103) for one OB1-cycle.
GI_Runs
This output signals a received GI-Request (processed from SL_Org_ASDU). The
output remains set until the general interrogation is terminated (GI-End). (From
V1.3).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 82 of 235 ©SIEMENS AG 2013
Additional Notes for Command Processing
In Version V1.0 commands are only confirmed (and terminated) if the command was processed from an
output block (SLo) thus the combination ASDU, TK and information object address (IOA) was known as
well.
Commands with unknown IOA or unknown command types were rejected.
From V1.1 negative command confirmations are sent ,substitutional’ from SL_ORG_ASDU if no com-
mand block has processed the message within the next OB1-cycle after receipt of a command message
(with COT=6).
The confirmation is carried out with:
- COT 44: unknown TK, if there is no output block programmed for the received TK.
- COT 47: unknown IOA, if there is no output block programmed for the received IOA.
- SL_ORG_ASDU reacts only at messages with ASDU-address, which are suitable to its parame-
terization
- if the SL_ORG_ASDU confirms negative, the original message is mirrored 1:1 (including proba-
bly existing time stamp) only the Cause Of Transmission (COT) will be changed.
From V1.5 the mirroring for all ASDU marked with ‚CON‘ in the standard (confirmed application services)
is carried out centrally if the message cannot be ‚executed‘.
The following causes of transmission are possible and executed in the subsequent order:
<44>:= unknown type identifier:
If there is no evaluation block for the message type ‚CON‘. This applies generally without inter-
connection at P_Application.
<46>:= unknown common address of the ASDU:
broadcast addresses are not mirrored.
<45>:= unknown cause of transmission (COT)
In case of receiving unexpected or not supported cause of transmission. Received messages
with one of the cause of transmission mentioned here (44-47) are not mirrored.
<47>:= unknown address of the information object
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 83 of 235 ©SIEMENS AG 2013
6.1.2. Blocks for process data capture SLi
The symbol name encrypts the most important block properties as follows:
SLi_SP_DP_s128
SLi is the abbreviation for slave blocks input, in other words process cap-
ture blocks
SLi_SP_DP_s128
Information types supported by the block with the brief designation: SP =
Single Point information according to IEC standard
SLi_SP_DP_s128
s is the abbreviation for sequential processing, in other words consecutive
image data capture and IEC addresses each starting with a base position,
resp. start address.
p would be the abbreviation for programmable allocation of data capture
point and IEC address.
SLi_SP_DP_s128
The (maximum) number of processable info points of the block (here 128).
The number of info points can be increased by multiple call-ups (instances).
The available SLi functional blocks can be found in the following overview.
Block
Block no.
Function
SLi_SP_DP_s128
FB130
For processing max. 128 single (SP) or double points (DP)
SLi_ST_s8
FB131
For processing max. 8 step position (ST)
SLi_BO_s8
FB132
For processing max. 8 bit pattern (BO)
SLi_ME_ABC_s32
FB133
For processing max. 32 measured values, standardized
(ME_A), scaled (ME_B) or floating point (ME_C)
SLi_IT_s8
FB134
For processing of max. 8 integrated totals (IT)
Illustration of the necessary interconnection - here in a CFC plan as an example:
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 84 of 235 ©SIEMENS AG 2013
6.1.2.1. Single point and double point information - SLi_SP_DP_s128 (FB130)
The block only works in combination with 'SL_ORG_ASDU'.
In the simplest possible case, it monitors a bit field (starting with First_Source_Pos) for changes and tele-
controls the contained values as single or double point information.
CALL "SLi_SP_DP_s128" , DB130
Comp_ID :=
P_SLi :=#P_SLi
First_Source_Pos :=M100.0
First_IEC_Info_Adr :=L#32500
Src_Struct_Type :=
Val_Type :=
No_of_Infos :=128
Tx_Prio :=10
Time_3_7 :=
Time_Stamp_spo :=
Time_Stamp_cyc :=
Time_Stamp_req :=
Set_NT :=
Inro_QOI :=
Send_Cyclic_Interval_sec:=
Phase_Offset_Cyc_Interv :=
IEC_InfoAdr_FeedBack :=
FB_RetVal :=
Illustration as CFC block with default values
Illustration in the AWL with partial parameter provision
Important features are:
With minor effort of parameterization you can telecontrol up to 128 information (No_of_Infos):
single point information with TK 1,2,30 (depending on 'Val_Type' + 'Time-Para')
double point information with TK 3,4,31 (depending on 'Val_Type' + 'Time-Para')
Default settings can be read in the respective variable comment, on the other hand they require
a minimum of mandatory inputs.
The minimum requirement is the interconnection of P_SLi and FirstSource_Pos.
The information object addresses (IOA) are automatically calculated in ascending / consecutive
order starting with the programmable basic address ('First_IEC_Info_Adr').
Any type of image sources starting with 'First_Source_Pos; can be addressed (E,M,DB,...)
Numerous data capture structures can be selected with 'Src_Struct_Type':
- One-pole or two-pole bit field
- IEC format (+ status bits)
- Optional time stamp and / or additional filler bytes
Cyclical sending is possible in addition to spontaneous operation.
A group interrogation is supported in parallel to the general interrogation (GI).
Selectable transmission priority (high / low).
Time stamping can be activated separately for spontaneous, cyclical and interrogated transmis-
sion
A global error input permits the fast identification of all information with the status not topical
(NT) and simultaneous data capture blocking.
Input for external realization of feedback processing available (IEC_IOA_Feedback)
Individual address setting via address parameter-DBs possible.
From Version V1.5 applicable also in time interrupts (see chapter 6.2)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 85 of 235 ©SIEMENS AG 2013
Block parameters with their default assignment and brief comment
FB130
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_SLi
IN
DWORD
DW#16#0
must be connected with P_to_SLi from SL_Org_ASDU
- Module
First_Source_Pos
IN
POINTER
-
First Position of .... e.g. I0.0 - (without default)
First_IEC_Info_Adr
IN
DINT
L#1
First Information object address / Default = 1
Src_Struct_Type :
IN
BYTE
B#16#0
0: (Default) 1 Bit 1: 2 Bit 2: IEC_Info 1 Byte, .... others
-> + TimeTag...
Val_Type :
IN
BYTE
B#16#1
1: (Default) SP, 3: DP / others are not allowed
No_of_Infos
IN
INT
1
Allowed range: 1-128 / Default = 1
Tx_Prio
IN
INT
1
Priority of transmission: 0 (highest), 15 (lowest) / De-
fault = 1
Time_3_7
IN
BOOL
TRUE
0: -> Time_3 -> TI2 / 1: -> Time_7 -> TI30 / Default = 1
Time_Stamp_spo
IN
BOOL
TRUE
spontaneous Transmission without (0) or with (1)
Timestamp / Default = 1
Time_Stamp_cyc :
IN
BOOL
FALSE
cyclic Transmission without (0) or with (1) Timestamp /
Default = 0
Time_Stamp_req :
IN
BOOL
FALSE
requested Transmission without (0) or with (1)
Timestamp / Default = 0
Set_NT :
IN
BOOL
FALSE
Reset[0], Set[1] all Infos Not Topical
Inro_QOI
IN
BYTE
B#16#14
0: No Reaction; 20 (=14hex,default) General interroga-
tion; 21-36 -> Group 1-16
Send_Cyc_Interval
IN
INT
0
0: without; 1-x [sec] Time interval for cyc transm, works
sync to absolute time
Phase_Offset_Cyc_Interv
IN
INT
0
0: without(def), +/-x [sec]: offset for cyc transm related
to absolute time
IEC_IOA_FeedBack
IN
DINT
L#0
This IEC-Address will be transmitted with COT
11'Retrem' instead of spo
FB_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: counter of
transmitted infos + state
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 86 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions. Assign different num-
bers within a block type as a byte variable.
e.g. B#16#1
P_SLi
P_SLi is a pointer to a common data range from block SL_ORG_ASDU,. Therefore it
has to be interconnected with its output P_SLi via a DWord variable.
The ORG block transfers values such as 'ASDU address', current time stamp, send
buffer, and processes e.g. GI’s, via this pointer or the data range behind it.
First_Source_Pos
Bit pointer to the first information to be collected.
e.g. P#E0.0 or P#DB1.DBX0.0
With non bit-oriented image structures, byte limits have to be observed (p#Ex.0), oth-
erwise there may be 'access errors'.
First_IEC_Info_Adr
Address value of the first collected information object
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address is available in structured form (3 octets), it must be
converted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Further information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4
Src_Struct_Type
0 one-pole bit field
1 two-pole bit field
2 byte field with IEC assignment
can be combined with time stamp capture
For more details, refer to detailed description.
Val_Type
Type identification 1. single point information (preset)
Type identification 3. double point information
(No others permitted)
No_of_Infos
Number of information to be collected
Range of values 1 to 128
Values outside this range result in an output of fault at the FB_RetVal and no further
processing is carried out.
Tx_Prio
Used for prioritization of the information transfer.
from V1.3:
15: lowest priority
0: highest priority.
In case of specifying a priority which is less than the available send buffer, the infor-
mation is entered automatically into the send buffer with the lowest available priority.
Time_3_7
The time stamp format can be set on input 'Time_3_7':
FALSE -> 3-byte length = short or partial time stamp CP24Time2a
TRUE -> 7-byte length = long or full time stamp CP56Time2a
Time_Stamp_...
Time_Stamp_spo
Time_Stamp_cyc
Time_Stamp_req
The transmission of the messages with or without time stamp can be parameterized
separately for:
spontaneous transmission with 'Time_Stamp_spo'
cyclical transmission with 'Time_Stamp_cyc'
interrogated transmission with 'Time_Stamp_req'
FALSE: no time stamp
TRUE: with time stamp
Set_NT
The block input 'Set_NT' applies to all information processed by this block and works
as follows:
Set_NT coming -> spontaneous transmission of all infos with last status (from image)
and status NT (not topical), image updating remains locked, GI or cyclical transmis-
sion may be carried out from 'old image'.
Set_NT going -> Image update and spontaneous transmission of all information with
the current value
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 87 of 235 ©SIEMENS AG 2013
Inro_QOI
Interrogation process: programmable interrogation identification in accordance with
IEC standard:
- 0: No response
- 20 (B#16#14 hex) -> General interrogation
- 21 (B#16#15 hex) to 36: Group interrogation + (always) general interrogation
In case the block has to react only to group interrogations and not to general interro-
gations, the group number and additional the Bit 26 has to be set.
Example.: Group interrogation 3 (B#16#43 hex)
The actual processing (check that there are actually infos of the inquired interrogation
group – corresponding reaction = pos/neg confirmation,…) is managed by the ORG
block.
The interrogated data always come from the 'image'
Send_Cyc_Interval
Time interval for cyclical transmission
value 0: no cyclical transmission
value 1- x sec. time interval in seconds. All information are sent cyclically once within
this time period.
The timer synchronizes itself to the absolute daily time.
Phase_Offset_Cyc_Interv
Offset of the time interval for the cyclic transmission compared with the synchroniza-
tion to the absolute time. Positive as well as negative values are permitted. The unit is
seconds.
IEC_IOA_FeedBack
The IEC address given here is sent, if caused by an information change, not with
transmission cause 3 (spontaneous) but with transmission cause 11 (response on
remote command).
Can be used for externally programmed response message processing.
FB_RetVal
Positive FB_RetVal values:
0000-0FFFh: Transmit counter (0-4095 decimal)
1xxxh (Bit12) Buffer jam
2xxxh (Bit13) Interrogation active
Negative FB_RetVal values:
8101h: Para ‚No_of_Infos’ <1 or>128
8102h P_SLi = 0 or wrong allocated
8104h not supported ‚ValType’
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 88 of 235 ©SIEMENS AG 2013
The structure types (Src_Struct_Type) in detail
The structure of Src_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
DT
Ext_State
Data_Type
Image
spacing
Data_Type
Data_Type is used depending on the information type – in this case, as follows:
00 (0): one-pole bit field -> data capture bit by bit
01 (1): two-pole bit field -> double data capture bit by bit
10 (2): byte field with IEC assignment
11 (3): reserved
1 bit / 1 byte*
2 bit / 1 byte*
1 byte
Ext_State
With bit set the image is expanded by the status byte 'Ext_State'.
As a priority the status byte is used for the optional transfer of time status bits which are
not supported by the S7 date and time format.
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Res
Res
Res
IV
SY
DS
TI
+ 1 byte
TI: The status bits (DS, SY, IV) are only transferred if the TI bit is set.
This means that Ext_State can also be used as a filler byte (no other function),
to establish image structures with even number of bytes.
DS: Daylight Saving Time - summer time:
The bit is transferred directly into SU in IEC messages
SY: synchronized:
The bit is not used in IEC messages
IV: Invalid:
The bit is transferred directly into IV in IEC messages
DT
Date and time in S7 format:
Normally the CPU time is used. If DT is available, the time stamp submitted is assigned
(time status, refer to ext_State).
+ 8 bytes
Add_Dist
Additional image spacing which is taken into account.
+ n bytes
Res
Reserved for future expansions
*) If additional 'functions' have been activated for the bit field (e.g. DT)
Resultant typical image structures:
Structure type 0 (B#16#00): One-bit data acquisition
Bit
7
6
5
4
3
2
1
0
Byte 0
7
6
5
4
3
2
1
0
1
15
14
13
12
11
10
9
8
2
...
17
16
...
16
127
Structure type 1 (B#16#01): Two-bit data acquisition
Bit
7
6
5
4
3
2
1
0
Byte 0
Info 3
Info 2
Info 1
Info 0
1
Info 7
Info 6
Info 5
Info 4
2
...
9
Info 8
...
32
127
Resultant structure: 4 infos per byte
In each case, 2 neighboring bits belong to the
info and are transferred directly in double point
info messages.
In case of single point info messages the con-
version process is as follows
00 -> 0 + status IV (error position 00)
01 -> 0
10 -> 1
11 -> 1 + status IV (error position 11)
Resultant structure: 8 infos per byte
Each bit represents a status 0 (OFF/Going) or
1 (ON/Coming) which you can transfer inde-
pendently of this in a single point or double
point info message.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 89 of 235 ©SIEMENS AG 2013
Structure type 2 (B#16#02): 1 Byte IEC-data acquisition
Bit
7
6
5
4
3
2
1
0
Byte 0
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 0
1
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 1
2
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 2
…
…
127
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 127
Structure type 18 (B#16#12): 1 byte IEC data acquisition
+ 1 filler byte (Add_Dist=1)
Bit
7
6
5
4
3
2
1
0
Byte 0
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 0
1
Filler byte
2
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 1
3
Filler byte
4
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 2
5
Filler byte
...
254
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 127
255
Filler byte
Structure type 14 (B#16#0E): 1 byte IEC data acquisition
+ 1 byte Ext_State
+ 8 byte time
Bit
7
6
5
4
3
2
1
0
Byte 0
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 0
1
Res
Res
Res
Res
IV
SY
DS
TI
2
S7 Date and Time
3
4
5
6
7
8
9
10
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 1
11
Res
Res
Res
Res
IV
SY
DS
TI
12
S7 Date and Time ...
13
14
15
...
1270
IV
NT
SB
BL
-
-
-
DPI
SPI
DPI
Info 127
1271
Res
Res
Res
Res
IV
SY
DS
TI
1272
S7 Date and Time
1273
1274
1275
1276
1277
1278
1279
Resultant structure: 10 bytes per info
Resultant structure: 2 bytes per info
The filler bytes remain ignored with regard to
image data acquisition and are simply
skipped. They may be used as required by
other parts of the program or are simply creat-
ed just for structuring reasons.
Resultant structure: 1 byte per info
In each case, complete bytes are monitored
for changes and are transferred unchanged
into the message.
Please use the status bits SPI and DPI ac-
cording to the required transmission type
(Val_Typ = SP or DP)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 90 of 235 ©SIEMENS AG 2013
6.1.2.2. Step position information - SLi_ST_s8 (FB131)
The block only works in combination with 'SL_ORG_ASDU'.
In the simplest possible case, it monitors a byte field (starting with First_Source_Pos) for changes and
telecontrols the contained values as step position messages.
CALL "SLi_ST_s8" , DB131
Comp_ID :=
P_SLi :=#P_SLi
First_Source_Pos :=DB2.DBX0.0
First_IEC_Info_Adr :=L#2000
Src_Struct_Type :=
Val_Type :=
No_of_Infos :=8
Tx_Prio :=10
Time_3_7 :=
Time_Stamp_spo :=
Time_Stamp_cyc :=
Time_Stamp_req :=
Set_NT :=
Inro_QOI :=
Send_Cyclic_Interval_sec:=
Phase_Offset_Cyc_Interv :=
IEC_InfoAdr_FeedBack :=
FB_RetVal :=
Illustration as CFC block with default values
Illustration in the AWL with partial parameter provision
Important features are:
With minor effort of parameterization you can telecontrol up to 8 info (No_of_Infos):
- Transformer position with TK5.6 or 32 (depending on 'Val_Type' +'Time-Para')
Default settings can be read in the respective variable comment, on the other hand they require
a minimum of mandatory inputs.
The minimum requirement is the interconnection of P_SLi and FirstSource_Pos.
The information object addresses (IOA) are automatically calculated in ascending / consecutive
order starting with the programmable basic address ('First_IEC_Info_Adr').
Any type of image sources starting with 'First_Source_Pos; can be addressed (E,M,DB,...)
Numerous data capture structures can be selected with 'Src_Struct_Type':
- Transformer position 1 byte only
- IEC format (+status bits)
- Optional time stamp and / or additional filler bytes
Cyclical sending is possible in addition to spontaneous operation.
A group interrogation is supported in parallel to the general interrogation (GI).
Selectable transmission priority (high / low)
Time stamping can be activated separately for spontaneous, cyclical and interrogated transmis-
sion
A global error input permits the fast identification of all info with the status not topical (NT) and
simultaneous data capture blocking.
Input for external realization of feedback processing available (IEC_IOA_Feedback).
Individual address setting via address parameter-DBs possible
From Version V1.5 applicable also in time interrupts (see chapter 6.2)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 91 of 235 ©SIEMENS AG 2013
Block parameters with their default assignment and brief comment
FB131
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_SLi
IN
DWORD
DW#16#0
must be connected with P_to_SLi from SL_Org_ASDU
- Block
First_Source_Pos
IN
POINTER
-
First Position of .... e.g. I0.0 - (without default)
First_IEC_Info_Adr
IN
DINT
L#1
First Information object address / Default = 1
Src_Struct_Type :
IN
BYTE
B#16#0
0: (Default) only (1) val-byte, 1: IEC_Info 2 Byte, ....
others -> TimeTag...
Val_Type :
IN
BYTE
B#16#5
5: (Default) ST / others are not supported
No_of_Infos
IN
INT
1
Allowed range: 1-8 / Default = 1
Tx_Prio
IN
INT
1
Priority of transmission: 0 (highest), 15 (lowest) / De-
fault = 1
Time_3_7
IN
BOOL
TRUE
0: -> Time_3 -> TI2 / 1: -> Time_7 -> TI30 / Default = 1
Time_Stamp_spo
IN
BOOL
TRUE
spontaneous Transmission without (0) or with (1)
Timestamp / Default = 1
Time_Stamp_cyc :
IN
BOOL
FALSE
cyclic Transmission without (0) or with (1) Timestamp /
Default = 0
Time_Stamp_req :
IN
BOOL
FALSE
requested Transmission without (0) or with (1)
Timestamp / Default = 0
Set_NT :
IN
BOOL
FALSE
Reset[0], Set[1] all Info Not Topical
Inro_QOI
IN
BYTE
B#16#14
0: No Reaction; 20 (=14hex,default) General interroga-
tion; 21-36 -> Group 1-16
Send_Cyc_Interval
IN
INT
0
0: without; 1-x [sec] Time interval for cyc transm, works
sync to absolute time
Phase_Offset_Cyc_Interv
IN
INT
0
0: without(def), +/-x [sec]: offset for cyc transm related
to absolute time
IEC_IOA_FeedBack
IN
DINT
L#0
This IEC-Address will be transmitted with
COT 11 'Retrem' instead of spo
FB_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: counter of
transmitted infos + state
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 92 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions. Assign different num-
bers within a block type as a byte variable.
e.g. B#16#1
P_SLi
P_SLi is a pointer to a common data range from block SL_ORG_ASDU,. Therefore it
has to be interconnected with its output P_SLi via a DWord variable.
The ORG block transfers values such as 'ASDU address', current time stamp, send
buffer, and processes e.g. GI’s, via this pointer or the data range behind it.
First_Source_Pos
Bit pointer to the first information to be collected.
e.g. P#E0.0 or P#DB1.DBX0.0
With non bit-oriented image structures, byte limits have to be observed (p#Ex.0), oth-
erwise there may be 'access errors'.
First_IEC_Info_Adr
Address value of the first collected information object
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address is available in structured form (3 octets), it must be
converted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Further information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4
Src_Struct_Type
0 -> 1 byte transformer position
1 -> 1 byte transformer position + 1byte status, IEC assignment
can be combined with time stamp capture
-> For more details, refer to detailed description.
Val_Type
Type identification 5. Step position (preset)
(No others permitted)
No_of_Infos
Number of information to be collected
Range of values 1 to 8
Values outside this range result in an output of fault at the FB_RetVal and no further
processing is carried out.
Tx_Prio
Used for prioritization of the information transfer.
from V1.3
15: Lowest priority
0: Highest priority.
In case of specifying a priority which is less than the available send buffer, the infor-
mation is entered automatically into the send buffer with the lowest available priority.
Time_3_7
The time stamp format can be set on input 'Time_3_7':
FALSE -> 3-byte length = short or partial time stamp CP24Time2a
TRUE -> 7-byte length = long or full time stamp CP56Time2a
Time_Stamp_...
Time_Stamp_spo
Time_Stamp_cyc
Time_Stamp_req
The transmission of the messages with or without time stamp can be parameterized
separately for:
spontaneous transmission with 'Time_Stamp_spo'
cyclical transmission with 'Time_Stamp_cyc'
interrogated transmission with 'Time_Stamp_req'
FALSE: no time stamp
TRUE: with time stamp
Set_NT
The block input 'Set_NT' applies to all info processed by this block and works as fol-
lows:
Set_NT coming -> spontaneous transmission of all info with last status (from image)
and status NT (not topical), image updating remains locked, GI or cyclical transmis-
sion may be carried out from 'old image'.
Set_NT going -> Image update and spontaneous transmission of all information with
the current value
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 93 of 235 ©SIEMENS AG 2013
Inro_QOI
Interrogation process: programmable interrogation identification in accordance with
IEC standard:
- 0: No response
- 20 (B#16#14 hex) -> General interrogation
- 21 (B#16#15 hex) to 36: Group interrogation + (always) general interrogation
In case the block has to react only to group interrogations and not to general interro-
gations, the group number and additional the Bit 26 has to be set.
Example.: Group interrogation 3 (B#16#43 hex)
The actual processing (check that there are actually info of the inquired interrogation
group – corresponding reaction = pos/neg confirmation,…) is managed by the ORG
block.
The interrogated data always come from the 'image'
Send_Cyc_Interval
Time interval for cyclical transmission
value 0: no cyclical transmission
value 1- x sec. time interval in seconds. All information are sent cyclically once within
this time period.
The timer synchronizes itself to the absolute daily time.
Phase_Offset_Cyc_Interv
Offset of the time interval for the cyclic transmission compared with the synchroniza-
tion to the absolute time. Positive as well as negative values are permitted. The unit is
seconds.
IEC_IOA_FeedBack
The IEC address given here is sent, if triggered by an information change, not with
transmission cause 3 (spontaneous) but with transmission cause 11 (response on
remote command).
Can be used for externally programmed response message processing.
FB_RetVal
Positive FB_RetVal values:
0000-0FFFh: Transmit counter (0-4095 decimal)
1xxxh (Bit12) Buffer jam
2xxxh (Bit13) Interrogation active
Negative FB_RetVal values:
8101h: Para ‚No_of_Infos’ <1 or>128
8102h P_SLi = 0 or wrong allocated
8104h not supported ‚ValType’
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 94 of 235 ©SIEMENS AG 2013
The structure types (Src_Struct_Type) in detail
The structure of Src_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
DT
Ext_State
Data_Type
Image
spacing
Data_Type
Data_Type is used depending on the information type – in this case, as follows:
00 (0): 1 byte transformer position
01 (1): 1 byte transformer position + 1 byte status, IEC assignment
10 (2): reserved
11 (3): reserved
1 byte
2 bytes
Ext_State
With bit set the image is expanded by the status byte 'Ext_State'.
As a priority the status byte is used for the optional transfer of time status bits which are
not supported by the S7 date and time format.
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Res
Res
Res
IV
SY
DS
TI
+ 1 byte
TI: The status bits (DS, SY, IV) are only transferred if the TI bit is set.
This means that Ext_State can also be used as a filler byte (no other function),
to establish image structures with even number of bytes.
DS: Daylight Saving Time - summer time:
The bit is transferred directly into SU in IEC messages
SY: synchronized:
The bit is not used in IEC messages
IV: Invalid:
The bit is transferred directly into IV in IEC messages
DT
Date and time in S7 format:
Normally the CPU time is used. If DT is available, the time stamp submitted is assigned
(time status, refer to ext_State).
+ 8 bytes
Add_Dist
Additional image spacing which is taken into account.
+ n bytes
Res
Reserved for future expansions
Resultant typical image structures:
Structure type 0 (B#16#00): 1 byte transformer position
Bit
7
6
5
4
3
2
1
0
Byte 0
Transformer position
Info 1
2
Transformer position
Info 2
3
Transformer position
Info 3
…
8
Transformer position
Info 8
Structure type 1 (B#16#01): 1 byte transformer position
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
Transformer position
Info 1
1
IV
NT
SB
BL
-
-
-
OV
2
Transformer position
Info 2
3
IV
NT
SB
BL
-
-
-
OV
…
14
Transformer position
Info 8
15
IV
NT
SB
BL
-
-
-
OV
Resultant structure: 2 bytes per info
Each 1 byte represents a transformer position
in IEC format,
the quality identifier for this transformer posi-
tion is stored in each second byte in IEC for-
mat.
Resultant structure: 1 byte per info
Each 1 byte represents a transformer position
in IEC format which can be transferred as a
step position information message.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 95 of 235 ©SIEMENS AG 2013
Structure type 44 (B#16#2C): 1 byte transformer position
+ 1 byte Ext_State
+ 8 byte time
+ 2 filler byte
Bit
7
6
5
4
3
2
1
0
Byte 0
Transformer position
Info 1
1
Res
Res
Res
Res
IV
SY
DS
TI
2
S7 Date and Time
3
4
5
6
7
8
9
10
Filler byte
11
Filler byte
12
Transformer position
Info 2
13
Res
Res
Res
Res
IV
SY
DS
TI
14
S7 Date and Time
15
16
17
18
19
20
21
22
Filler byte
23
Filler byte
…
84
Transformer position
Info 8
85
Res
Res
Res
Res
IV
SY
DS
TI
86
S7 Date and Time
87
88
89
90
91
92
93
94
Filler byte
95
Filler byte
Resultant structure: 12 bytes per info
Each 1 byte represents a transformer position
in IEC format.
Followed by
1 byte Ext_State and
8 byte S7 Date and Time
The status bits from Ext_State (DS, SY, IV)
are only transferred if the TI bit is set.
Even if these status bits are not necessarily
being used, the use of the byte Ext_State as
an additional filler byte is advisable in this
case.
This means that the entry Date and Time start
at even-order byte numbers in each case.
This is advantageous for the further pro-
cessing of Date and Time.
The filler bytes remain ignored with regard to
image data acquisition and are simply
skipped. They may be used as required by
other parts of the program or are simply cre-
ated just for structuring reasons.
The filler bytes in this example provide a data
structure with 12 byte grid.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 96 of 235 ©SIEMENS AG 2013
6.1.2.3. Bit pattern messages - SLi_BO_s8 (FB132)
The block only functions in combination with 'SL_ORG_ASDU'.
In the simplest possible case it monitors a field of consecutive DWords (starting with First_Source_Pos)
for changes and telecontrols the contained values as a bit pattern message.
CALL "SLi_BO_s8" , DB132
Comp_ID :=
P_SLi :=#P_SLi
First_Source_Pos :=DB2.DBX200.0
First_IEC_Info_Adr :=L#3000
Src_Struct_Type :=
Val_Type :=
No_of_Infos :=8
Tx_Prio :=10
Time_3_7 :=
Time_Stamp_spo :=
Time_Stamp_cyc :=
Time_Stamp_req :=
Set_NT :=
Inro_QOI :=
Send_Cyclic_Interval_sec:=
Phase_Offset_Cyc_Interv :=
IEC_InfoAdr_FeedBack :=
FB_RetVal :=
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
With minor effort of parameterization you can telecontrol up to 8 info (No_of_Infos):
- Bit pattern with TK7,8,33 (depending on 'Val_Type' +'Time-Para')
Default settings can be read in the respective variable comment, on the other hand they require
a minimum of mandatory inputs.
The minimum requirement is the interconnection of P_SLi and FirstSource_Pos.
The information object addresses (IOA) are automatically calculated in ascending / consecutive
order starting with the programmable basic address ('First_IEC_Info_Adr').
Any type of image sources starting with 'First_Source_Pos; can be addressed (E,M,DB,...)
Numerous data capture structures can be selected with 'Src_Struct_Type':
- 4 byte bit pattern
- IEC format (+ status bits)
- Optional time stamp and / or additional filler bytes
Cyclical sending is possible in addition to spontaneous operation.
A group interrogation is supported in parallel to the general interrogation (GI).
Selectable transmission priority (high / low).
Time stamping can be activated separately for spontaneous, cyclical and interrogated transmis-
sion
A global error input permits the fast identification of all info with the status not topical (NT) and
simultaneous data capture blocking.
Input for external realization of feedback processing available (IEC_IOA_Feedback).
Individual address setting via address parameter-DBs possible
From Version V1.5 applicable also in time interrupts (see chapter 6.2)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 97 of 235 ©SIEMENS AG 2013
Block parameters with their default assignment and brief comment
FB132
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_SLi
IN
DWORD
DW#16#0
must be connected with P_to_SLi from SL_Org_ASDU
- Block
First_Source_Pos
IN
POINTER
-
First Position of .... e.g. I0.0 - (without default)
First_IEC_Info_Adr
IN
DINT
L#1
First Information object address / Default = 1
Src_Struct_Type :
IN
BYTE
B#16#0
0: (Default) only bit pattern, 1: IEC_Info 5 Byte, .... oth-
ers -> TimeTag...
Val_Type :
IN
BYTE
B#16#7
7: (Default) BO / others are not supported
No_of_Infos
IN
INT
1
Allowed range: 1-8 / Default = 1
Tx_Prio
IN
INT
1
Priority of transmission: 0 (highest), 15 (lowest) / De-
fault = 1
Time_3_7
IN
BOOL
TRUE
0: -> Time_3 -> TI2 / 1: -> Time_7 -> TI30 / Default = 1
Time_Stamp_spo
IN
BOOL
TRUE
spontaneous Transmission without (0) or with (1)
Timestamp / Default = 1
Time_Stamp_cyc :
IN
BOOL
FALSE
cyclic Transmission without (0) or with (1) Timestamp /
Default = 0
Time_Stamp_req :
IN
BOOL
FALSE
requested Transmission without (0) or with (1)
Timestamp / Default = 0
Set_NT :
IN
BOOL
FALSE
Reset[0], Set[1] all Infos Not Topical
Inro_QOI
IN
BYTE
B#16#14
0: No Reaction; 20 (=14hex,default) General interroga-
tion; 21-36 -> Group 1-16
Send_Cyc_Interval
IN
INT
0
0: without; 1-x [sec] Time interval for cyc transm, works
sync to absolute time
Phase_Offset_Cyc_Interv
IN
INT
0
0: without(def), +/-x [sec]: offset for cyc transm related
to absolute time
IEC_IOA_FeedBack
IN
DINT
L#0
This IEC-Address will be transmitted with COT
11'Retrem' instead of spo
FB_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: counter of
transmitted infos + state
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 98 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions. Assign different
numbers within a block type as a byte variable.
e.g. B#16#1
P_SLi
P_SLi is a pointer to a common data range from block SL_ORG_ASDU,. Therefore
it has to be interconnected with its output P_SLi via a DWord variable.
The ORG block transfers values such as 'ASDU address', current time stamp, send
buffer, and processes e.g. GI’s, via this pointer or the data range behind it.
First_Source_Pos
Bit pointer to the first information to be collected.
e.g. P#E0.0 or P#DB1.DBX0.0
With non bit-oriented image structures, byte limits have to be observed (p#Ex.0),
otherwise there may be 'access errors'.
First_IEC_Info_Adr
Address value of the first collected information object
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address is available in structured form (3 octets), it must be
converted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Further information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4
Src_Struct_Type
0 4 byte bit pattern
1 4 byte bit pattern + 1byte status, IEC assignment
can be combined with time stamp capture
For more details, refer to detailed description.
Val_Type
Type identification 7. bit string of 32 bit (preset)
(No others permitted)
No_of_Infos
Number of information to be collected
Range of values 1 to 8
Values outside this range result in an output of fault at the FB_RetVal and no fur-
ther processing is carried out.
Tx_Prio_L_H
Used for prioritization of the information transfer.
FALSE: low priority
TRUE: high priority.
In case of specifying a priority which is less than the available send buffer, the in-
formation is entered automatically into the send buffer with the lowest available
priority.
Time_3_7
The time stamp format can be set on input 'Time_3_7':
FALSE -> 3-byte length = short or partial time stamp CP24Time2a
TRUE -> 7-byte length = long or full time stamp CP56Time2a
Time_Stamp_...
Time_Stamp_spo
Time_Stamp_cyc
Time_Stamp_req
The transmission of the messages with or without time stamp can be parameter-
ized separately for:
spontaneous transmission with 'Time_Stamp_spo'
cyclical transmission with 'Time_Stamp_cyc'
interrogated transmission with 'Time_Stamp_req'
FALSE: no time stamp
TRUE: with time stamp
Set_NT
The block input 'Set_NT' applies to all infos processed by this block and works as
follows:
Set_NT coming -> spontaneous transmission of all infos with last status (from im-
age) and status NT (not topical), image updating remains locked, GI or cyclical
transmission may be carried out from 'old image'.
Set_NT going -> Image update and spontaneous transmission of all information
with the current value
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 99 of 235 ©SIEMENS AG 2013
Inro_QOI
Interrogation process: programmable interrogation identification in accordance with
IEC standard:
- 0: No response
- 20 (B#16#14 hex) -> General interrogation
- 21 (B#16#15 hex) to 36: Group interrogation + (always) general interrogation
In case the block has to react only to group interrogations and not to general inter-
rogations, the group number and additional the Bit 26 has to be set.
Example.: Group interrogation 3 (B#16#43 hex)
The actual processing (check that there are actually infos of the inquired interroga-
tion group – corresponding reaction = pos/neg confirmation,…) is managed by the
ORG block.
The interrogated data always come from the 'image'
Send_Cyc_Interval
Time interval for cyclical transmission
value 0: no cyclical transmission
value 1- x sec. time interval in seconds. All information are sent cyclically once
within this time period.
The timer synchronizes itself to the absolute daily time.
Phase_Offset_Cyc_Interv
Offset of the time interval for the cyclic transmission compared with the synchroni-
zation to the absolute time. Positive as well as negative values are permitted. The
unit is seconds.
IEC_IOA_FeedBack
The IEC address given here is sent, if triggered by an information change, not with
transmission cause 3 (spontaneous) but with transmission cause 11 (response on
remote command).
Can be used for externally programmed response message processing.
FB_RetVal
Positive FB_RetVal values:
0000-0FFFh: Transmit counter (0-4095 decimal)
1xxxh (Bit12) Buffer jam
2xxxh (Bit13) Interrogation active
Negative FB_RetVal values:
8101h: Para ‚No_of_Infos’ <1 or>128
8102h P_SLi = 0 or wrong allocated
8104h not supported ‚ValType’
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 100 of 235 ©SIEMENS AG 2013
The structure types (Src_Struct_Type) in detail
The structure of Src_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
DT
Ext_State
Data_Type
Image
spacing
Data_Type
Data_Type is used depending on the information type – in this case, as follows:
00 (0): 4 byte bit pattern
01 (1): 4 byte bit pattern + 1 byte status, IEC assignment
10 (2): reserved
11 (3): reserved
4 bytes
5 bytes
Ext_State
With bit set the image is expanded by the status byte 'Ext_State'.
As a priority the status byte is used for the optional transfer of time status bits which are
not supported by the S7 date and time format.
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Res
Res
Res
IV
SY
DS
TI
+ 1 byte
TI: The status bits (DS, SY, IV) are only transferred if the TI bit is set.
This means that Ext_State can also be used as a filler byte (no other function),
to establish image structures with even number of bytes.
DS: Daylight Saving Time - summer time:
The bit is transferred directly into SU in IEC messages
SY: synchronized:
The bit is not used in IEC messages
IV: Invalid:
The bit is transferred directly into IV in IEC messages
DT
Date and time in S7 format:
Normally the CPU time is used. If DT is available, the time stamp submitted is assigned
(time status, refer to ext_State).
+ 8 bytes
Add_Dist
Additional image spacing which is taken into account.
+ n bytes
Res
Reserved for future expansions
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 101 of 235 ©SIEMENS AG 2013
Resultant typical image structures:
Structure type 0 (B#16#00): 4 byte bit patterns
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit bit pattern
Info 1
1
2
3
4
32-bit bit pattern
Info 2
5
6
7
…
28
32-bit bit pattern
Info 8
29
30
31
Structure type 1 (B#16#01): 4 byte bit patterns
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit bit pattern
Info 1
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
32-bit bit pattern
Info 2
6
7
8
9
IV
NT
SB
BL
-
-
-
OV
…
35
32-bit bit pattern
Info 8
36
37
38
39
IV
NT
SB
BL
-
-
-
OV
Resultant structure: 5 bytes per info
The first 4 bytes represent a 32-bit bit pattern,
in each fifth byte the quality identification for
this bit pattern is stored in IEC format.
Resultant structure: 4 bytes per info
Each 4 bytes represent a 32-bit bit pattern
which can be transferred as a bit pattern
message.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 102 of 235 ©SIEMENS AG 2013
Structure type 45 (B#16#2D): 4 byte bit patterns
+ 1 byte status, IEC assignment
+ 1 byte Ext_State
+ 8 byte time
+ 2 filler byte
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit bit pattern
Info 1
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
Res
Res
Res
Res
IV
SY
DS
TI
6
S7 Date and Time
7
8
9
10
11
12
13
14
Filler byte
15
Filler byte
16
32-bit bit pattern
Info 2
17
18
19
20
IV
NT
SB
BL
-
-
-
OV
21
Res
Res
Res
Res
IV
SY
DS
TI
22
S7 Date and Time
23
24
25
26
27
28
29
30
Filler byte
31
Filler byte
…
112
32-bit bit pattern
Info 8
113
114
115
116
IV
NT
SB
BL
-
-
-
OV
117
Res
Res
Res
Res
IV
SY
DS
TI
118
S7 Date and Time
119
120
121
122
123
124
125
126
Filler byte
127
Filler byte
Resultant structure: 16 bytes per info
The first 4 bytes represent a 32-bit bit pattern,
in each fifth byte the quality identification for
this bit pattern is stored in IEC format.
Followed by
1 byte Ext_State
8 byte time and date
2 filler bytes
The status bits from Ext_State (DS, SY, IV)
are only transferred if the TI bit is set.
Even if these status bits are not necessarily
used, the use of the byte Ext_State as an ad-
ditional filler byte is advisable in this case.
This means that the entry Date and Time start
at even-order byte numbers in each case.
This is advantageous for the further pro-
cessing of Date and Time.
The filler bytes remain ignored with regard to
image data acquisition and are simply
skipped. They may be used as required by
other parts of the program or are simply cre-
ated just for structuring reasons.
The filler bytes in this example provide a data
structure with 16 byte grid.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 103 of 235 ©SIEMENS AG 2013
6.1.2.4. Measured values - SLi_ME_ABC_s32 (FB133)
The block only works in combination with 'SL_ORG_ASDU'.
In the simplest possible case it monitors a consecutive integer field (starting with First_Source_Pos) for
changes and telecontrols the contained values as measured value in normalized, scaled or floating point
format.
CALL "SLi_ME_ABC_s32" , DB133
Comp_ID :=
P_SLi :=#P_SLi
First_Source_Pos :=DB2.DBX400.0
First_IEC_Info_Adr :=L#4000
Src_Struct_Type :=
Val_Type :=
No_of_Infos :=32
Tx_Prio :=10
Time_3_7 :=
Time_Stamp_spo :=
Time_Stamp_cyc :=
Time_Stamp_req :=
Set_NT :=
Reset_Threshold :=
Use_Initiation_Method :=
Inro_QOI :=
Send_Cyclic_Interval_sec:=
Phase_Offset_Cyc_Interv :=
No_Cyclic_Infos :=
Threshold_Value :=
Threshold_Sensivity :=
FB_RetVal :=
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
With minor effort of parameterization you can telecontrol up to 32 infos (No_of_Infos):
- as measured value normalized value with TK9,10,34
(depending on 'Val_Type' +'Time-Para'),
- as measured value with scaled value with TK11,12,35
(depending on 'Val_Type' +'Time-Para'),
- as measured value with short floating point number with TK13,14,36
(depending on 'Val_Type' +'Time-Para')
Default settings can be read in the respective variable comment, on the other hand they require
a minimum of mandatory inputs.
The minimum requirement is the interconnection of P_SLi and FirstSource_Pos.
The information object addresses (IOA) are automatically calculated in ascending / consecutive
order starting with the programmable basic address ('First_IEC_Info_Adr').
Any type of image sources starting with 'First_Source_Pos’; can be addressed (E,M,DB,...)
Numerous data capture structures can be selected with 'Src_Struct_Type':
- 2 byte integer
- 4 byte short real
- IEC format (+ status bits)
- Optional time stamp and / or additional filler bytes
Integrated reassuring method according to the additive threshold value method.
Cyclical sending is possible in addition to spontaneous operation.
A group interrogation is supported in parallel to the general interrogation (GI).
A global error input permits the fast identification of all information with the status not topical
(NT) and simultaneous data capture blocking.
Individual address setting via address parameter-DBs possible
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 104 of 235 ©SIEMENS AG 2013
From Version V1.5 applicable also in time interrupts (see chapter 6.2)
Block parameter with their default assignment and brief comment
FB133
Type
Default
Block-Comment / Brief description.
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_SLi
IN
DWORD
DW#16#0
must be connected with P_to_Sli from SL_Org_ASDU
– Module
First_Source_Pos
IN
POINTER
-
First Position of …. e.g. I0.0 – (without default)
First_IEC_Info_Adr
IN
DINT
L#1
First Information object address / Default = 1
Src_Struct_Type :
IN
BYTE
B#16#0
0:(Default) int; 1:IEC int+state; 2:real; 3:IEC re-
al+state; ...TimeTag...
Val_Type :
IN
BYTE
B#16#9
16#9:(Default) ME_NA (9,norm.); 16#B: ME_NB
(11,scaled); 16#D: ME_NC (13,flaot)
No_of_Infos
IN
INT
1
Allowed range: 1-32 / Default = 1
Tx_Prio
IN
INT
1
Priority of transmission: 0 (highest), 15 (lowest) / De-
fault = 1
Time_3_7
IN
BOOL
TRUE
0: -> Time_3 -> TI2 / 1: -> Time_7 -> TI30 / Default =
1
Time_Stamp_spo
IN
BOOL
FALSE
spontaneous Transmission without (0) or with (1)
Timestamp / Default = 0
Time_Stamp_cyc :
IN
BOOL
FALSE
cyclic Transmission without (0) or with (1) Timestamp /
Default = 0
Time_Stamp_req :
IN
BOOL
FALSE
requested Transmission without (0) or with (1)
Timestamp / Default = 0
Set_NT :
IN
BOOL
FALSE
Reset[0], Set[1] all Infos Not Topical
Reset_Threshold
IN
BOOL
FALSE
Resets the actual internal calculated threshold value
to 0.
Use_Initiation_Method
IN
BOOL
FALSE
0 (def):new entry; 1:existing measured values in buffer
will be updated;
Inro_QOI
IN
BYTE
B#16#14
0: No Reaction; 20 (=14hex,default) General interro-
gation; 21-36 -> Group 1-16
Send_Cyc_Interval_sec
IN
INT
0
0: without; 1-x [sec] Time interval for cyc transm,
works sync to absolute time
Phase_Offset_Cyc_Interv
IN
INT
0
0: without(def), +/-x [sec]: offset for cyc transm related
to absolute time
No_Cyclic_Infos
IN
INT
0
0: all (def); 1…n limits the number of meas. values per
cycl. activation
Threshold_Value
IN
REAL
0.00000e+000
0: Dynamic (Default); pos. Value -> Valid Value
Threshold_Sensivity
IN
INT
5
0 (without) – 100 [% Percent] of Threshold_Value
….Default: 5 %
FB_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: counter of
transmitted infos + state
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 105 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions. Assign different num-
bers within a block type as a byte variable.
e.g. B#16#1
P_SLi
P_SLi is a pointer to a common data range from block SL_ORG_ASDU,. Therefore it
has to be interconnected with its output P_SLi via a DWord variable.
The ORG block transfers values such as 'ASDU address', current time stamp, send
buffer, and processes e.g. GI’s, via this pointer or the data range behind it.
First_Source_Pos
Bit pointer to the first information to be collected.
e.g. P#E0.0 or P#DB1.DBX0.0
With non bit-oriented image structures, byte limits have to be observed (p#Ex.0), oth-
erwise there may be 'access errors'.
First_IEC_Info_Adr
Address value of the first collected information object
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address is available in structured form (3 octets), it must be
converted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Further information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4.
Src_Struct_Type
0 2 byte measured value (Integer)
1 2 byte measured value (Integer) + 1 byte status, IEC assignment
2 4 byte measured value (Short Real)
3 4 byte measured value (Short Real) + 1 byte status, IEC assignment
can be combined with time stamp capture
For more details, refer to detailed description.
Val_Type
Type identification 9. Measured value, normalized value (preset)
Type identification 11. Measured value, scaled value
Type identification 13. Measured value, short floating point number
(No others permitted)
No_of_Infos
Number of information to be collected
Range of values 1 to 32
Values outside this range result in an output of fault at the FB_RetVal and no further
processing is carried out.
Tx_Prio
Used for prioritization of the information transfer.
from V1.3
15: lowest priority
0: highest priority.
In case of specifying a priority which is less than the available send buffer, the infor-
mation is entered automatically into the send buffer with the lowest available priority.
Time_3_7
The time stamp format can be set on input 'Time_3_7':
FALSE 3-byte length = short or partial time stamp CP24Time2a
TRUE 7-byte length = long or full time stamp CP56Time2a
Time_Stamp_...
Time_Stamp_spo
Time_Stamp_cyc
Time_Stamp_req
The transmission of the messages with or without time stamp can be parameterized
separately for:
spontaneous transmission with 'Time_Stamp_spo'
cyclical transmission with 'Time_Stamp_cyc'
interrogated transmission with 'Time_Stamp_req'
FALSE: no time stamp
TRUE: with time stamp
Set_NT
The block input 'Set_NT' applies to all infos processed by this block and works as fol-
lows:
Set_NT coming spontaneous transmission of all infos with last status (from image)
and status NT (not topical), image updating remains locked, GI or cyclical transmis-
sion may be carried out from 'old image'.
Set_NT going Image update and spontaneous transmission of all information with
the current value
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 106 of 235 ©SIEMENS AG 2013
Reset_Threshold
With rising edge the actual calculated threshold value is reset.
In normal operation a new threshold value is taken over only if the last threshold
has been reached. This may take a long time in case of adverse circumstances.
With external wiring of ‚Reset_Threshold’ the dynamical calculation of the threshold
value (see ,Threshold_Value’) is started new.
Use_Initiation_Method
From V1.3: The activation of the function ‚Initiation method’ is carried out via the
additional parameter input ‚Use_Initiation_Method’.
-0 (Default): Without initiation method. Measured values are entered new into the
send buffer.
-1: With initiation method. Before entering the measured value into the send buffer
it is checked whether the value (with this IOA) is already existing in the send buffer.
In this case the existing entry is overwritten resp. refreshed
Inro_QOI
Interrogation process: programmable interrogation identification in accordance with
IEC standard:
- 0: No response
- 20 (B#16#14 hex) -> General interrogation
- 21 (B#16#15 hex) to 36: Group interrogation + (always) general interrogation
In case the block has to react only to group interrogations and not to general inter-
rogations, the group number and additional the Bit 26 has to be set.
Example.: Group interrogation 3 (B#16#43 hex)
The actual processing (check that there are actually infos of the inquired interroga-
tion group – corresponding reaction = pos/neg confirmation,…) is managed by the
ORG block.
The interrogated data are transmitted from V1.1 with actual value.
Send_Cyc_Interval
Time interval for cyclical transmission
value 0: no cyclical transmission
value 1- x sec. time interval in seconds. All information are sent cyclically once
within this time period.
The timer synchronizes itself to the absolute daily time.
Phase_Offset_Cyc_Interv
Offset of the time interval for the cyclic transmission compared with the synchroni-
zation to the absolute time. Positive as well as negative values are permitted. The
unit is seconds.
No_Cyclic_Infos
With the parameter ‚No_Cyclic_Infos’ (1…n) the number of sent measured values
per cyclic initiation is limited.
0 (Default) = send all measured values
Threshold_Value
Threshold value for spontaneous transmission of the measured value.
0: dynamic calculation of the threshold value taking into account the parameterized
percentage value in 'Threshold_Sensitivity'.
The dynamically calculated threshold value is the
max. occurring measured value multiplied by parameterized percentage value.
>0 (e.g. 20000.0): Calculation of the threshold value without taking into account
'Threshold_Sensitivity'
This value is taken directly as a threshold to be reached arithmetically.
Direct threshold exceedance is checked in every OB1-cycle.
Therefore the response to direct threshold exceedance is fast.
The threshold value processing is integrative – in an interval of 1 sec the measured
value difference to the last transmitted value is added. If the threshold value is
reached arithmetically the measurement value will be sent spontaneously.
The threshold can either be calculated automatically (default) or set as an absolute
value.
Threshold_Sensitivity
Percentage value for the dynamic calculation of the threshold value.
The dynamically calculated threshold value is the max. occurring measured value
multiplied by parameterized percentage value.
Value range 0 to 100% (preset: 5%)
0: no threshold value processing, each change of the measurement values is
transmitted spontaneously
otherwise: Percentage value for the dynamic calculation of the threshold value.
The spontaneous transmission in the adjustment cyclic transmission can be pre-
vented by entering the value 32767.
Only relevant if no value is entered in 'Threshold_Value'.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 107 of 235 ©SIEMENS AG 2013
FB_RetVal
Positive FB_RetVal values:
0000-0FFFh: Transmit counter (0-4095 decimal)
1xxxh (Bit12) Buffer jam
2xxxh (Bit13) Interrogation active
Negative FB_RetVal values:
8101h: Para ‚No_of_Infos’ <1 or>128
8102h P_SLi = 0 or wrong allocated
8104h not supported ‚ValType’
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
The structure types (Src_Struct_Type) in detail
The structure of Src_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
DT
Ext_State
Data_Type
Image-
spacing
Data_Type
Data_Type is used depending on the information type – in this case, as follows:
00 (0): 2 byte measured value (integer)
01 (1): 2 byte measured value (integer) + 1 byte status, IEC assignment
10 (2): 4 byte measured value (short real)
11 (3): 4 byte measured value (short real) + 1 byte status, IEC assignment
2 byte
3 byte
4 bytes
5 bytes
Ext_State
With bit set the image is expanded by the status byte 'Ext_State'.
As a priority the status byte is used for the optional transfer of time status bits which are
not supported by the S7 date and time format.
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Res
Res
Res
IV
SY
DS
TI
+ 1 byte
TI: The status bits (DS, SY, IV) are only transferred if the TI bit is set.
This means that Ext_State can also be used as a filler byte (no other function),
to establish image structures with even number of bytes.
DS: Daylight Saving Time - summer time:
The bit is transferred directly into SU in IEC messages
SY: synchronized:
The bit is not used in IEC messages
IV: Invalid:
The bit is transferred directly into IV in IEC messages
DT
Date and time in S7 format:
Normally the CPU time is used. If DT is available, the time stamp submitted is assigned
(time status, refer to ext_State).
+ 8 bytes
Add_Dist
Additional image spacing which is taken into account.
+ n bytes
Res
Reserved for future expansions
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 108 of 235 ©SIEMENS AG 2013
Resultant typical image structures:
Structure type 0 (B#16#00): 2 byte measured value (integer)
Bit
7
6
5
4
3
2
1
0
Byte 0
Measured value
S7 integer
Info 1
1
2
Measured value
S7 integer
Info 2
3
…
62
Measured value
S7 integer
Info 32
63
Structure type 1 (B#16#01): 2 byte measured value (integer)
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
Measured value
S7 integer
Info 1
1
2
IV
NT
SB
BL
-
-
-
OV
3
Measured value
S7 integer
Info 2
4
5
IV
NT
SB
BL
-
-
-
OV
…
93
Measured value
S7 integer
Info 32
94
95
IV
NT
SB
BL
-
-
-
OV
Structure type 2 (B#16#02): 4 byte measured value (short real)
Bit
7
6
5
4
3
2
1
0
Byte 0
Measured value
S7 short real
Info 1
1
2
3
5
Measured value
S7 short real
Info 2
6
7
8
…
124
Measured value
S7 short real
Info 32
125
126
127
Resultant structure: 2 bytes per info
Each 2 bytes (1 word) represent a measured
value in S7 integer format which you can ei-
ther transfer as a measured value message in
normalized or scaled format.
Resultant structure: 4 bytes per info
Each 4 bytes (1 DWord) represent a meas-
ured value in S7 short real format which you
can transfer as a measured value message
with short floating point number.
Resultant structure: 3 bytes per info
Each first 2 bytes (1 word) represent one
measured value in S7 integer format, in each
third byte the quality identifier is stored for
this measured value in the IEC format.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 109 of 235 ©SIEMENS AG 2013
Structure type 3 (B#16#03): 4 byte measured value (short real)
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
Measured value
S7 short real
Info 1
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
Measured value
S7 short real
Info 2
6
7
8
9
IV
NT
SB
BL
-
-
-
OV
…
155
Measured value
S7 short real
Info 32
156
157
158
159
IV
NT
SB
BL
-
-
-
OV
Structure type 17 (B#16#11): 2 byte measured value (integer)
+ 1 byte status, IEC assignment
+ 1 filler byte (Add_Dist=1)
Bit
7
6
5
4
3
2
1
0
Byte 0
Measured value
S7 integer
Info 1
1
2
IV
NT
SB
BL
-
-
-
OV
3
Filler byte
5
Measured value
S7 integer
Info 2
6
7
IV
NT
SB
BL
-
-
-
OV
8
Filler byte
…
124
Measured value
S7 integer
Info 32
125
126
IV
NT
SB
BL
-
-
-
OV
127
Filler byte
Resultant structure: 4 bytes per info
The filler bytes remain ignored with regard to
image data acquisition and are simply
skipped. They may be used as required by
other parts of the program or are simply cre-
ated just for structuring reasons.
Resultant structure: 5 bytes per info
Each first 4 bytes (1 DWord) represent a
measured value in S7 short real format, in
each fifth byte the quality identifier for this
measured value is stored in IEC format.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 110 of 235 ©SIEMENS AG 2013
Structure type 47 (B#16#2F): 4 byte measured value (short real)
+ 1 byte status, IEC assignment
+ 1 byte Ext_State
+ 8 byte time
+ 2 filler byte
Bit
7
6
5
4
3
2
1
0
Byte 0
Measured value
S7 short real
Info 1
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
Res
Res
Res
Res
IV
SY
DS
TI
6
S7 Date and Time
7
8
9
10
11
12
13
14
Filler byte
15
Filler byte
16
Measured value
S7 short real
Info 2
17
18
19
20
IV
NT
SB
BL
-
-
-
OV
21
Res
Res
Res
Res
IV
SY
DS
TI
22
S7 Date and Time
23
24
25
26
27
28
29
30
Filler byte
31
Filler byte
…
496
Measured value
S7 short real
Info 32
497
498
499
500
IV
NT
SB
BL
-
-
-
OV
501
Res
Res
Res
Res
IV
SY
DS
TI
502
S7 Date and Time
503
504
505
506
507
508
509
510
Filler byte
511
Filler byte
Resultant structure: 16 bytes per info
Each first 4 bytes (1 DWord) represent a
measured value in S7 short real format, in
each fifth byte the quality identifier for this
measured value is stored in IEC format.
Followed by
1 byte Ext_State and
8 byte S7 Date and Time
The two filler bytes in this example provide a
data structure with 16 byte grid.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 111 of 235 ©SIEMENS AG 2013
6.1.2.5. Integrated totals - SLi_IT_s8 (FB134)
The block only functions in combination with 'SL_ORG_ASDU'.
It accepts or interprets consecutive DWord content (starting with First_Source_Pos) and telecontrols the
contained values as integrated totals.
CALL "SLi_IT_s8" , DB134
Comp_ID :=
P_SLi :=#P_SLi
First_Source_Pos :=DB2.DBX600.0
First_IEC_Info_Adr :=L#7000
Src_Struct_Type :=
Val_Type :=
No_of_Infos :=8
Tx_Prio :=10
Time_3_7 :=
Send_spontaneous :=
Time_Stamp_spo :=
Time_Stamp_req :=
Set_IV :=
Do_Freeze :=
Do_Freeze_and_Delete :=
Inro_QOI :=
Reqco_QCC :=
Frz_Cyclic_Interval_sec:=
Phase_Offset_Cyc_Interv:=
Cycl_Freeze_with_Delete:=
FB_RetVal :=
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
With minor effort of parameterization you can telecontrol up to 8 infos (No_of_Infos):
- as integrated totals with TK15,16,37 (depending on 'Val_Type' +'Time-Para').
Default settings can be read in the respective variable comment, on the other hand they require
a minimum of mandatory inputs.
The minimum requirement is the interconnection of P_SLi and FirstSource_Pos.
The information object addresses (IOA) are automatically calculated in ascending / consecutive
order starting with the programmable basic address ('First_IEC_Info_Adr').
Any type of image sources starting with 'First_Source_Pos; can be addressed (E,M,DB,...)
Numerous data capture structures can be selected with 'Src_Struct_Type':
- 4 byte integrated totals
- IEC format (integrated totals + status byte)
- optional time stamp and / or additional filler bytes
Various restore versions
In addition to spontaneous operation, all interrogation types (TK100, TK101) are supported.
Selectable transmission priority (high / low)
Time stamping can be activated separately for spontaneous, cyclical and interrogated transmis-
sion
A global error input permits the fast identification of all infos with the status Invalid (IV) with the
next restore
Inputs for restore, restore with deletion and counter interrogation are available.
Individual address setting via address parameter-DB’s possible
From Version V1.5 applicable also in time interrupts (see chapter 6.2)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 112 of 235 ©SIEMENS AG 2013
Block parameter with their default assignment and brief comment
FB134
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_SLi
IN
DWORD
DW#16#0
must be connected with P_to_SLi from SL_Org_ASDU
- Block
First_Source_Pos
IN
POINTER
-
First Position of .... e.g. DB1.DBX0.0 - (without default)
First_IEC_Info_Adr
IN
DINT
L#1
First Information object address / Default = 1
Src_Struct_Type :
IN
BYTE
B#16#0
0: (Default) only counter 4 Byte, 1: IEC_Info 5 Byte, ....
others -> TimeTag...
Val_Type :
IN
BYTE
B#16#E
14: (=B#16#E = Default) IT / others are not allowed
No_of_Infos
IN
INT
1
Allowed range: 1-8 / Default = 1
Tx_Prio
IN
INT
1
Priority of transmission: 0 (highest), 15 (lowest) / De-
fault = 1
Time_3_7
IN
BOOL
TRUE
0: -> Time_3 -> TI2 / 1: -> Time_7 -> TI30 / Default = 1
Send_spontaneous
IN
BOOL
TRUE
If true (default), the ITs will be transmitted spontane-
ous after freezing
Time_Stamp_spo
IN
BOOL
TRUE
spontaneous Transmission without (0) or with (1)
Timestamp / Default = 1
Time_Stamp_req :
IN
BOOL
FALSE
requested Transmission without (0) or with (1)
Timestamp / Default = 0
Set_IV :
IN
BOOL
FALSE
Reset[0], Set[1] all Infos to IV with next freeze
Do_Freeze
IN
BOOL
FALSE
Rising edge -> freeze (all values)
Do_Freeze_and_Delete
IN
BOOL
FALSE
Rising edge -> freeze and delete (all values)
Inro_QOI
IN
BYTE
B#16#0
0: No Reaction (default); 20 (14hex):
General interrogation; 21-36 -> Group 1-16
Reqco_QCC
IN
BYTE
B#16#5
0: No Reaction; 1-4: specified Counter Group;
5(default):general request
Frz_Cyclic_Interval_sec
IN
INT
0
0: without; 1-x [sec] Time interval for cyc freeze, works
sync to absolute time
Phase_Offset_Cyc_Interv
IN
INT
0
0: without(def), +/-x [sec]: offset for cyc transm related
to absolute time
Cycl_Freeze_with_Delete
IN
BOOL
FALSE
Default = false
FB_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: counter of
transmitted infos + state
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 113 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions. Assign different
numbers within a block type as a byte variable.
e.g. B#16#1
P_SLi
P_SLi is a pointer to a common data range from block SL_ORG_ASDU,. Therefore
it has to be interconnected with its output P_SLi via a DWord variable.
The ORG block transfers values such as 'ASDU address', current time stamp, send
buffer, and processes e.g. GI’s, via this pointer or the data range behind it.
First_Source_Pos
Bit pointer to the first information to be collected.
e.g. P#E0.0 or P#DB1.DBX0.0
With non bit-oriented image structures, byte limits have to be observed (p#Ex.0),
otherwise there may be 'access errors'.
First_IEC_Info_Adr
Address value of the first collected information object
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address is available in structured form (3 octets), it must be
converted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Further information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4.
Src_Struct_Type
0 4 byte count value
1 4 byte count value + 1 byte status, IEC assignment
2 reserved
3 reserved
can be combined with time stamp capture
For more details, refer to detailed description.
Val_Type
Type identification 14. integrated totals (preset)
(No others permitted)
No_of_Infos
Number of infos to be collected
Value range 1 to 8
Values outside this range result in an output of fault at the FB_RetVal and no fur-
ther processing is carried out.
Tx_Prio
Used for prioritization of the information transfer.
from V1.3:
15: lowest priority
0: highest priority.
In case of specifying a priority which is less than the available send buffer, the in-
formation is entered automatically into the send buffer with the lowest available
priority.
Time_3_7
The time stamp format can be set on input 'Time_3_7':
FALSE 3-byte length = short or partial time stamp CP24Time2a
TRUE 7-byte length = long or full time stamp CP56Time2a
Send spontaneous
Spontaneous transmission of integrated totals:
FALSE -> No spontaneous transmission of the integrated totals after the restore
TRUE -> After restore the integrated totals are transferred spontaneously.
Time_Stamp_...
Time_Stamp_spo
Time_Stamp_req
The transmission of the messages with or without time stamp can be parameter-
ized separately for:
spontaneous transmission with 'Time_Stamp_spo'
interrogated transmission with 'Time_Stamp_req'
FALSE: no time stamp
TRUE: with time stamp
Set_IV
The block input 'Set_IV' applies to all infos processed by this block. Its status is
transferred directly into the status bit IV of the integrated total with the next restore.
Do_Freeze
The block input 'Do_Freeze' applies to all infos processed by this block.
With a rising edge all interrogated totals are restored from the data capture image
into the integrated totals image (frozen) and transferred spontaneously depending
on the parameter 'Send_spontaneous'.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 114 of 235 ©SIEMENS AG 2013
Do_Freeze_and _Delete
Do_Freeze_and _Delete
The block input 'Do_Freeze_and_Delete' applies to all infos processed by this block.
With a rising edge all integrated totals are restored from the data capture image into
the integrated total image (frozen) and the data capture image is then deleted (set to
0).
With the next restore the status bit CA (Counter adjusted) is shown once by the block.
Inro_QOI
Interrogation process: programmable interrogation identification in accordance with
IEC standard:
- 0: No response
- 20 (B#16#14 hex) -> General interrogation
- 21 (B#16#15 hex) to 36: Group interrogation + (always) general interrogation
In case the block has to react only to group interrogations and not to general interro-
gations, the group number and additional the Bit 26 has to be set.
Example.: Group interrogation 3 (B#16#43 hex)
The actual processing (check that there are actually infos of the inquired interrogation
group – corresponding reaction = pos/neg confirmation,…) is managed by the ORG
block.
The interrogated data always come from the 'image'
Reqco_QCC
Programmable identifier in accordance with the IEC standard to assign the captured
integrated totals to a counter group which applies to counter interrogation, restore and
delete commands (by TK101).
- 0: No group/response
- 1 (B#16#01 hex) to 4: counter interrogation group 1-4 + (always) global counter in-
terrogation
- 5 (B#16#05 hex) -> Global counter interrogation
The actual processing (check that there are actually infos of the inquired interrogation
group – corresponding reaction = pos/neg confirmation,…) is managed by the ORG
block.
The interrogated data always come from the 'image'
Frz_Cyclic_Interval_sec
Time interval for cyclical restore of the integrated totals
Value 0: No cyclical restore
Value 1- x sec. time interval in seconds. All information are restored cyclically once
within this time period.
The timer synchronizes itself to the absolute daily time.
Phase_Offset_Cyc_Interv
Offset of the time interval for the cyclic transmission compared with the synchroniza-
tion to the absolute time. Positive as well as negative values are permitted. The unit is
seconds.
Cycl_Freeze_with_delete
0/False: the count memorys are not deleted after restoring
1/True: the count memorys are deleted after restoring
FB_RetVal
Positive FB_RetVal values:
0000-0FFFh: Transmit counter (0-4095 decimal)
1xxxh (Bit12) Buffer jam
2xxxh (Bit13) Interrogation active
Negative FB_RetVal values:
8101h: Para ‚No_of_Infos’ <1 or>128
8102h P_SLi = 0 or wrong allocated
8104h not supported ‚ValType’
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 115 of 235 ©SIEMENS AG 2013
The structure types (Src_Struct_Type) in detail
The structure of Src_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
DT
Ext_State
Data_Type
Image
spacing
Data_Type
Data_Type is used depending on the information type – in this case, as follows:
00 (0): 4 byte integrated total (DWORD)
01 (1): 4 byte integrated total (DWORD) + 1 byte status, IEC assignment
10 (2): reserved
11 (3): reserved
4 byte
5 byte
Ext_State
With bit set the image is expanded by the status byte 'Ext_State'.
As a priority the status byte is used for the optional transfer of time status bits which are
not supported by the S7 date and time format.
+ 1 byte
TI: The status bits (DS, SY, IV) are only transferred if the TI bit is set.
This means that Ext_State can also be used as a filler byte (no other function),
to establish image structures with even number of bytes.
DS: Daylight Saving Time - summer time:
The bit is transferred directly into SU in IEC messages
SY: synchronized:
The bit is not used in IEC messages
IV: Invalid:
The bit is transferred directly into IV in IEC messages
DT
Date and time in S7 format:
Normally the CPU time is used. If DT is available, the time stamp submitted is assigned
(time status, refer to ext_State).
+ 8 byte
Add_Dist
Additional image spacing which is taken into account.
+ n byte
Res
Reserved for future expansions
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 116 of 235 ©SIEMENS AG 2013
Resultant typical image structures:
Structure type 0 (B#16#00): 4 byte integrated total
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit integrated total
Info 1
1
2
3
4
32-bit integrated total
Info 2
5
6
7
…
28
32-bit integrated total
Info 8
29
30
31
Structure type 1 (B#16#01): 4 byte integrated total
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit integrated total
Info 1
1
2
3
4
IV
CA
CY
Sequence number
5
32-bit integrated total
Info 2
6
7
8
9
IV
CA
CY
Sequence number
…
35
32-bit integrated total
Info 8
36
37
38
39
IV
CA
CY
Sequence number
Resultant structure: 5 bytes per info
Each first 4 bytes represent a 32 bit integrat-
ed total,
in each fifth byte the quality identifier for this
integrated total is stored in IEC format.
From V1.1 at collection variants with IEC sta-
tus the CY-Bit (Carry = overflow) is reset with
each restore / clear. It has to be set thus only
once from the user (Set-Command).
Resultant structure: 4 bytes per info
Each 4 bytes represent a 32 bit integrated to-
tal which you can transfer as a integrated total
message.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 117 of 235 ©SIEMENS AG 2013
Structure type 57 (B#16#39): 4 byte integrated total
+ 1 byte status, IEC assignment
+ 1 byte Ext_State
+ 8 byte time
+ 2 filler byte
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit integrated total
Info 1
1
2
3
4
IV
CA
CY
Sequence number
5
Res
Res
Res
Res
IV
SY
DS
TI
6
S7 Date and Time
7
8
9
10
11
12
13
14
Filler byte
15
Filler byte
16
32-bit integrated total
Info 2
17
18
19
20
IV
CA
CY
Sequence number
21
Res
Res
Res
Res
IV
SY
DS
TI
22
S7 Date and Time
23
24
25
26
27
28
29
30
Filler byte
31
Filler byte
…
112
32-bit integrated total
Info 8
113
114
115
116
IV
CA
CY
Sequence number
117
Res
Res
Res
Res
IV
SY
DS
TI
118
S7 Date and Time
119
120
121
122
123
124
125
126
Filler byte
127
Filler byte
Resultant structure: 16 bytes per info
Every first 4 bytes represent a 32 bit integrat-
ed total,
in each fifth byte the quality identifier for this
integrated total is stored in IEC format.
Followed by
1 byte Ext_State
8 byte time and
2 filler bytes
The status bits from Ext_State (DS, SY, IV)
are only transferred if the TI bit is set.
Even if these status bits are not necessarily
being used, the use of the byte Ext_State as
an additional filler byte is advisable in this
case.
This means that the entry Date and Time start
at even-order byte numbers in each case.
This is advantageous for the further pro-
cessing of Date and Time.
The filler bytes remain ignored with regard to
image data acquisition and are simply
skipped. They may be used as required by
other parts of the program or are simply cre-
ated just for structuring reasons.
The filler bytes in this example provide a data
structure with 16 byte grid format.
From V1.1 at collection variants with IEC sta-
tus the CY-Bit (Carry = overflow) is reset with
each restore / clear. It has to be set thus only
once from the user (Set-Command).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 118 of 235 ©SIEMENS AG 2013
6.1.3. Blocks for the process output SLo
The symbol name encrypts the most important block properties as follows:
SLo_SC_DC_RC_sx
SLo is the abbreviation for slave-blocks output, also known as output
blocks
SLo_SC_DC_RC_sx
Information types supported by the block with the brief designation SC =
Single Command according to IEC standard:
SLo_SC_DC_RC_sx
S is the abbreviation for sequential processing, also known as continuous
output in the target area and IEC address starting with a base position,
start address in each case.
P would be the abbreviation for programmable allocation of data acquisi-
tion point and IEC address.
SLo_SC_DC_ RC_sx
x is the (maximum) number of administrable info points of the block.
x is used for the fact that the (maximum) number of administrable info
points is not limited by the block.
Theoretically the block can manage any number of commands.
In practice the number is limited by the available information addresses or
maximum DB size (depending on the CPU used).
The number of info points can be increased by multiple call-ups (instanc-
es).
The available SLo functional blocks can be found in the overview below.
Block
Block no.
Function
SLo_SC_DC_RC_sx
FB135
For processing single (SC), double (DC) or regulating step
commands RC
SLo_SE_ABC_sx
FB136
For processing analogue setpoint commands, normalized
(SE_A), scaled (SE_B) or floating point (SE_C)
SLo_BO_sx
FB137
For processing bit pattern commands (BO)
(digital setpoint commands)
Illustration of the necessary interconnection - here in a CFC plan as an example:
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 119 of 235 ©SIEMENS AG 2013
6.1.3.1. Single, double and regulating step commands - SLo_SC_DC_RC_sx (FB135)
The block receives single, double or regulating step commands from the telecontrol partner and writes
them in the simplest case to a bit field (starting with First_Source_Pos).
CALL "SLo_SC_DC_RC_sx" , DB135
Comp_ID :=
P_Application :=#P_Appl
ASDU_Adr :=L#1
First_InfoAdr :=L#32500
First_Destination_Pos :=M100.0
No_of_Infos :=128
Dst_Struct_Type :=
Send_Termination :=
Lock :=
Break :=
Time_Q0 :=
Time_Q1 :=
Time_Q2 :=
Cmd_Buffer_Dim :=10
Max_Delay_Time :
Timeout_Select_Execute:
CMD_RUN :=
CMD_Buf_DB :=
IOA_Running_Cmd :
FB_RetVal :
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
With a minor amount of parameterization you can process many commands (No_of_Infos):
- Single commands with TK 45, 58
- Double commands with TK 46, 59
- Regulating step commands with TK 47, 60
Default settings can be read in the relevant variable comment, on the other hand they require
only a minimum of mandatory inputs.
The minimum requirement is the interconnection of P_Application and First_Destination_Pos.
The information object addresses (IOA) and output position are automatically calculated in as-
cending / consecutive order starting with the programmable base address ('First_InfoAdr').
Any output targets starting with 'First_Destination_Pos' (A, M, DB,...) can be addressed auto-
matically.
Numerous output structures can be selected with 'Dst_Struct_Type':
- One-pole or two-pole bit field
- Byte formats (info + status bits)
- additional filler bytes
A global blocking input permits the simple locking of all commands.
Different output times for commands with Q0, Q1 or Q2 can be parameterized separately
Output for external evaluation of an active impulse command present. From V1.5 additionally a
Return_Value and feedback output of the information object address (IOA) of the active com-
mand available.
Global and selective command release possible (Input ‚Break’ or Br bit with byte output)
Selective blocking of individual commands possible (LK bit with byte output)
Function (output) independent of received TK
Individual address setting via address parameter-DBs possible
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 120 of 235 ©SIEMENS AG 2013
Command storage and serial output of the buffered commands possible
(number according to ‚Cmd_Buffer_Dim)
Entire support of command select and command execution (select before operate)
Entire support of aging monitoring of commands with time stamp
Block parameters with their default assignment and brief comment
FB135
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
DW#16#0
Pointer which must be connected to 'S7_IEC_Config’ –
Module
ASDU_Adr
IN
DINT
L#0
ASDU-Address which will be expected by this module
(Default: 0)
First_InfoAdr
IN
DINT
L#0
First Information object address / Default = 0
First_Destination_Pos
IN
POINTER
-
First Position of .... e.g. A0.0 or DB900.DBX5.0
No_of_Infos
IN
INT
1
No of (sequential ascending) IOA which will supported
(Default = 1)
Dest_Struct_Type
IN
BYTE
B#16#0
0:(Def.) 1 Bit (SPI);1:2 Bit (DPI);2:1 Byte
(Stat+SPI);3:1 Byte (Stat+DPI)
Send_Termination
IN
BOOL
TRUE
0: without; 1 (default): with Termination of activation
Lock
IN
BOOL
FALSE
If set, new cmd will not executed, they will locked and
neg. con
Break
IN
BOOL
FALSE
With rising edge a running (pulse) command will be
terminated/cancelled.
Time Q0:
IN
TIME
T#1s
Pulse Time for incoming commands with Q0: Default:
T#1S
Time Q1:
IN
TIME
T#1s
Pulse Time for incoming commands with Q1: Default:
T#1S
Time Q2:
IN
TIME
T#10s
Pulse Time for incoming commands with Q2: Default:
T#10S
Cmd_Buffer_Dim
IN
INT
0
0: without (default); >0 max. number of buffered com-
mands
Max_Delay_Time
IN
Time
T#1M
0: without; >0 max. delay time for command with time
tag; Default: t#60s
Timeout_Select_Execute
IN
Time
T#0MS
0: without sel/exe (def); >0 max. time between select
and execute command.
CMD_RUN
OUT
BOOL
FALSE
Signals a running (pulse-) command
CMD_Buf_DB
OUT
INT
0
Shows the data block number of command buffer
(which is created at runtime)
IOA_Running_Cmd
OUT
DInt
IOA of an active command, otherwise 0; pulse cmd: if
active; per.cmd: one cycle
FB_RetVal
OUT
Word
Neg. values: Error-Codes; o: ok
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 121 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions. Assign different num-
bers within a block type as byte variable.
e.g. B#16#1
P_Application
P_Application is a pointer to a common data range of block S7_IEC_Config. There-
fore it has to be interconnected to its output P_Application via a DWord variable.
The Config block receives user data such as 'ASDU address', receiver buffer, etc. via
this pointer or the data range behind it.
ASDU_Adr
Address value of the application service data unit receiving commands of this block.
Permissible range with ASDU address length 1 is 1 to 254
Permissible range with ASDU address length 2 is 1 to 65534.
The broadcast addresses 255 (FFh with length 1) resp. 65535 (FFFFh with length 2)
are always accepted.
First_InfoAdr
Address value of the first information object edited
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address exists in structured form (3 octets), it must be con-
verted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Further information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4.
First_Destination_Pos
Bit pointer to the first target position which is receiving the information.
e.g. P#A0.0 or P#DB1.DBX0.0
With non bit-oriented output structures, the byte limits must be observed (p#Ax.0),
otherwise 'access errors' may occur.
No_of_Infos
Number of infos to be output
Value range 1 to 255.
Dst_Struct_Type
Bit commands can be output regardless of the received TK as 1-bit or 2-bit com-
mands:
0 -> one-pole bit field
1 -> two-pole bit field
2 -> byte field with IEC assignment (one-pole output)
3 -> byte field with IEC assignment (two-pole output)
-> For more details, refer to the description.
Send_Termination
Selection whether the command has to be completed with or without sending a 'Ter-
mination' of activation.
FALSE: no 'Termination of activation'
TRUE: with 'Termination of activation' (default setting)
Lock
Blocking input for all commands processed by this block.
FALSE: New commands are executed
TRUE: New commands are not executed and negatively acknowledged.
Break
With rising edge a current impulse command will be finished or cancelled. It will be
positive terminated to the control center.
Time_Q0
Output time for received commands with qualifier Q0.
Time_Q1
Output time for received commands with qualifier Q1.
Time_Q2
Output time for received commands with qualifier Q2.
Cmd_Buffer_Dim
The parameter defines the maximum number of buffered commands
0 without command buffer (like V1.1)
>0 maximum number of buffered commands
In this case a command buffer DB will be created during the runtime
An entry into the command buffer DB happens only if during arrival from an impulse
command another impulse command already runs.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 122 of 235 ©SIEMENS AG 2013
Max_Delay_Time
0 (t#0ms) deactivates the aging monitoring of commands with time stamp.
>0: Aging monitoring for commands with time stamp active. The command must not
be older than the parameterized period of time (Default t#60s). Otherwise the com-
mand will be neglected. Further (fixed) basic conditions are: The time in the system
and command must be valid. The time in the command may be max. 1 sec in the fu-
ture. The parameter is available from V1.5.
Timeout_Select_Execute
0 (t#0ms = default): Both select and execute commands will be always accepted
Select before execute is activated. Executing commands are only accepted, if they
are received within the parameterized period of time after receive of the select com-
mand.
The parameter is available from V1.5.
CMD_RUN
Command output (impulse command) running
The output is set for the duration of the command output, if an impulse command is
executed via this block.
CMD_BUF_DB
Indicates the number of the command buffer DB
The size of the command buffer DB will be fixed with ‚Cmd_Buffer_Dim‘.
IOA_Running_Cmd
Output of the information address (IOA) of a currently running command. In case of
persistent command output for one cycle only.
The output is available from V1.5
FB_RetVal
Signals the reason why a command could NOT be executed. You will find a detailed
list in chapter 6.1.3.4
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 123 of 235 ©SIEMENS AG 2013
The structure types (Dst_Struct_Type) in detail
The structure of Dst_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
Res
Data_Type
Image
spacing
Data_Type
Data_Type used depending on information type – in this case, as follows:
00 (0): one-pole bit field -> single bit output (SCS)
01 (1): two-pole bit field -> double bit output (DCS)
10 (2): byte field with status bits (Stat + SCS)
11 (3): byte field with status bits (Stat + DCS)
1 bit
2 bit
1 byte
1 byte
Add_Dist
Additional image distance which is considered in case of sequential writing
+ n Byte
Res
Reserved for future expansions
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 124 of 235 ©SIEMENS AG 2013
Resultant typical image structures:
Structure type 0 (B#16#00): One-bit output
Bit
7
6
5
4
3
2
1
0
Byte 0
7
6
5
4
3
2
1
0
1
15
14
13
12
11
10
9
8
2
...
17
16
...
Structure type 1 (B#16#01): Two-bit output
Bit
7
6
5
4
3
2
1
0
Byte 0
DCS 3
E/H | A/T
DCS 2
E/H | A/T
DCS 1
E/H | A/T
DCS 0
E/H | A/T
1
DCS 7
E/H | A/T
DCS 6
E/H | A/T
DCS 5
E/H | A/T
DCS 4
E/H | A/T
2
...
9
DCS 8
E/H | A/T
...
Structure type 2 (B#16#02): One-bit output + status bits
Bit
7
6
5
4
3
2
1
0
Byte 0
SE
New
Cmd
Lk
Br
-
-
-
SCS
Info 0
1
SE
New
Cmd
Lk
Br
-
-
-
SCS
Info 1
2
SE
New
Cmd
Lk
Br
-
-
-
SCS
Info 2
...
...
...
Structure type 3 (B#16#03): Two-bit output + status bits
Bit
7
6
5
4
3
2
1
0
Byte 0
SE
New
Cmd
Lk
Br
-
-
DCS
E/H
DCS
A/T
Info 0
1
SE
New
Cmd
Lk
Br
-
-
DCS
E/H
DCS
A/T
Info 1
2
SE
New
Cmd
Lk
Br
-
-
DCS
E/H
DCS
A/T
Info 2
...
...
...
Resultant structure: 4 commands per byte
Two neighbouring bits belong to one
command (ON/OFF;LOWER/HIGHER)
The cmd. bits (DCS) are set as follows:
No cmd. output active-> 00
Cmd. with switching direction OFF (A)-> 01
Cmd with switching direction ON (E)-> 10
Regulating step cmd. LOWER (T)-> 01
Regulating step cmd. HIGHER (H)-> 10
Resultant structure: 1 byte per command
Each bit represents one command (SCS) in-
cluding associated status bits. The bit as-
signed to the relevant pulse command is set
for the duration of the command output.
Duration commands (Q3) with switching direc-
tion ON set the bit.
Duration commands (Q3) with switching direc-
tion OFF delete the bit.
Resultant structure: 1 byte per command
Each byte represents a command including
the associated status bits.
The command bits (DCS) are set as follows:
No cmd. output active-> 00
Cmd. with switching direction OFF (A)-> 01
Cmd. with switching direction ON (E)-> 10
Regulating step cmd. LOWER (T)-> 01
Regulating step cmd. HIGHER (H)-> 10
Resultant structure: 8 commands per byte
Each bit represents one command. The bit
assigned to the relevant impulse command is
set for the duration of the command output.
Continuous commands (Q3) with switching
direction ON set the bit.
Continuous commands (Q3) with switching
direction OFF delete the bit.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 125 of 235 ©SIEMENS AG 2013
Structure type 50 (B#16#32): One-Bit-Output + Status bits
+ 3 Filler byte (Add_Dist=3)
Bit
7
6
5
4
3
2
1
0
Byte 0
SE
New
Cmd
Lk
Br
-
-
-
SCS
Info 0
1
Filler byte
2
Filler byte
3
Filler byte
4
SE
New
Cmd
Lk
Br
-
-
-
SCS
Info 1
5
Filler byte
6
Filler byte
7
Filler byte
8
SE
New
Cmd
Lk
Br
-
-
-
SCS
Info 2
9
Filler byte
10
Filler byte
11
Filler byte
...
...
...
Byte assignment when using Dst_Struct_Type = 2 or 3 in detail
SE
Select/Execute
Select bit from IEC message
NewCmd
New Command,
is set with each output of a command.
Can be reset by the user.
Lk
Locked
Locking bit: If this bit is set before output of a new command, the command is blocked.
Instead of that it is 'negatively' acknowledged to the control centre.
Br
Break – terminate
A running '(pulse) command' can be terminated/cancelled using this command. It is termi-
nated positively to the control centre.
The bit is reset with the output of a new command.
SCS
One bit output
Set with running pulse command (Q0, Q1, Q2) with switching direction ON.
Duration command (Q3) with switching direction ON sets SCS
Duration command (Q3) with switching direction OFF resets SCS
DCS
Two-bit output
Bit 0 is set with running OFF or lower command.
Bit 1 is set with running ON or higher command.
Resulting Structure: 4 Byte per command
The filler bytes remain regarding command
output unconsidered and will be leaped. They
may be arbitrary used from other parts of the
program or are created only for structuring
purposes.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 126 of 235 ©SIEMENS AG 2013
Additional notes for processing commands
Continuous commands are carried out at every time
(also during a running switching command)
If necessary the IEC originator is mirrored and sent in the response messages as well
Test bits and set P/N bit in the cause of transmission (COT) result in 'non-handling' – the mes-
sage is not processed.
Command cancellation via cancel command is supported:
If a switching command with the InfoAddr of the cancel command is running, this is terminated
and the cancel command positively acknowledged.
In principle a command from SLo-block is only processed (and with it acknowledged) if these
are commands which are directed to the block
-> In V1.0 version, no response to commands with unknown ASDU address, info address,...
From V1.1 negative command confirmations are sent ,substitutional’ from SL_ORG_ASDU if no
command block (SLo_...) has processed (confirmed) the message within the next OB1-cycle af-
ter receiving a command message (with COT=6 or COT8).
The confirmation is carried out with:
- COT 44: unknown TK, if there is no output block programmed for the received TK.
- COT 45: unknown COT, if the received COT is not supported from the responsible SLo-
block(it is the one with the correct IOA)
- COT 47: unknown IOA, if there is no output block programmed for the received IOA.
For further notes please refer to chapter 6.1.1. As well the modified behavior from V1.5 is de-
scribed there.
Select/execute is entered in the status bit SE when using Dst_Struct_Type 2 and 3, but not
evaluated for the command output.
The command is output regardless of S/E
From V1.5 the Select/Execute handling is carried out according to standard. See as well block
parameter “Timeout_Select_Execute”
Command messages with time stamp (TK 58, 59,60) are accepted and output.
Up to Version V1.4 the time stamp is not evaluated.
From Version V1.5 see block parameter “Max_Delay_Time”.
The switching commands are subject to a 1out of n control.
The 1 out of n control is always active if one switching command (impulse command) is execut-
ed and another one has to be processed.
From V1.2 impulse commands can be cached in a command buffer DB in case an impulse command is
already active.
With it fast ‘non supervised’ command sequences are supported.
Received commands pointed to the block (ASDU-Addr, IOA-Addr…), are processed with the following
rules:
The buffered commands are executed serial, i.e. the next command is executed after the pre-
ceding command has been executed.
The commands are processed in the sequence of its arrival.
Continuous commands are executed always immediately (like before, finished in one cycle)
Cancellation commands are executed if the command which has to be stopped is just active.
Otherwise a negative acknowledgement is carried out.
Cancellation commands have no effect to commands in the buffer.
Without cache (‚Cmd_Buffer_Dim’ = 0, or Buffer-DB could not be created) is the behavior like
in V1.1. Further switching commands arriving during an active switching command (impulse
command) are refused (negative confirmed).
With cache switching commands are immediately executed, if no command is active.
With cache switching commands are buffered if
a (switching) command is active / executed
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 127 of 235 ©SIEMENS AG 2013
already minimum one command is in the buffer
With cache switching commands are refused, if the buffer is full.
6.1.3.2. Setpoint commands - SLo_SE_ABC_sx (FB136)
The block receives setpoint commands in normalized, scaled or floating point format from the telecontrol
partner. In the simplest case it writes them as integer or short-real values to a data field (starting with
First_Source_Pos).
CALL "SLo_SE_ABC_sx" , DB136
Comp_ID :=
P_Application :=#P_Appl
ASDU_Adr :=L#1
First_InfoAdr :=L#8000
First_Destination_Pos :=DB3.DBX0.0
No_of_Infos :=32
Dst_Struct_Type :=
Send_Termination :=
Lock :=
Max_Delay_Time :=
Timeout_Select_Execute:=
IOA_Running_Cmd :=
FB_RetVal :=
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
With a minor amount of parameterization, you can process many setpoint commands
(No_of_Infos):
- Setpoint commands with normalized value with TK 48, 61
- Setpoint commands with scaled value with TK 49, 62
- Setpoint commands with short floating point number with TK 50, 63
Default settings can be read in the relevant variable comment, on the other hand they require
only a minimum of mandatory inputs.
The minimum requirement is the interconnection of ‘P_Application’ and ‘First_Destination_Pos’.
The information object addresses (IOA) and output position are automatically calculated in as-
cending / consecutive order starting with the programmable base address ('First_InfoAdr').
Any output targets starting with 'First_Destination_Pos' (A,M,DB,...) can be addressed automat-
ically.
Numerous output structures can be selected with 'Dst_Struct_Type':
- 2 byte integer
- 4 byte short real (info + status bits)
- IEC format (+ status bits)
- additional filler bytes
A global blocking input permits the simple locking of all setpoint commands.
Selective blocking of individual setpoint commands possible (Lk bit in the command byte)
Individual address setting via address parameter-DBs possible
Entire support of command select and command execution (select before operate)
Entire support of aging monitoring of commands with time stamp
Return_Value and feedback output of the information object address (IOA) of the executed
command
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 128 of 235 ©SIEMENS AG 2013
Block parameters with their default assignment and brief comment
FB136
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
DW#16#0
Pointer which must be connected to 'S7_IEC_Config’ –
Module
ASDU_Adr
IN
DINT
L#0
ASDU-Address which will be expected by this module
(Default: 0)
First_InfoAdr
IN
DINT
L#0
First Information object address / Default = 0
First_Destination_Pos
IN
POINTER
-
First Position of .... e.g. A0.0 or DB900.DBX5.0
No_of_Infos
IN
INT
1
No of (sequential ascending) IOA which will supported
(Default = 1)
Dst_Struct_Type
IN
BYTE
B#16#0
0: (Def) Int (2 Byte);1:3 Byte (Int+Stat);2:4 Byte (Re-
al);3:5 Byte (Real+Stat)
Send_Termination
IN
BOOL
TRUE
0: without; 1 (default): with Termination of activation
Lock
IN
BOOL
FALSE
If set, new cmd will be not executed, they will be
locked and neg. con
Max_Delay_Time
IN
Time
T#1M
0: without; >0 max. delay time for command with time
tag; Default: t#60s
Timeout_Select_Execute
IN
Time
T#0MS
0: without sel/exe (def); >0 max. time between select
and execute command.
IOA_Running_Cmd
OUT
DInt
IOA of an active command, otherwise 0; pulse cmd: if
active; per.cmd: one cycle
FB_RetVal
OUT
Word
Neg. values: Error-Codes; o: ok
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 129 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostics functions. Assign different
numbers within a block type as byte variable.
e.g. B#16#1
P_Application
P_Application is a pointer to a common data range of block S7_IEC_Config. There-
fore it has to be interconnected to its output P_Application via a DWord variable.
The Config block receives user data such as 'ASDU address', receiver buffer, etc.
via this pointer or the data range behind it.
ASDU_Adr
Address value of the application service data unit receiving commands of this
block.
Permissible range with ASDU address length 1 is 1 to 254
Permissible range with ASDU address length 2 is 1 to 65534.
The broadcast addresses 255 (FFh with length 1) resp. 65535 (FFFFh with length
2) are always accepted.
First_InfoAdr
Address value of the first information object edited
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address exists in structured form (3 octets), it must be con-
verted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Other information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4.
First_Destination_Pos
Bit pointer to the first target position which is receiving the information.
e.g. P#A0.0 or P#DB1.DBX0.0
With non bit-oriented output structures, the byte limits must be observed (p#Ax.0),
otherwise 'access errors' may occur.
No_of_Infos
Number of infos to be output
Value range 1 to 255.
Dst_Struct_Type
Setpoint commands can be output in the following formats:
0 -> 2 byte setpoint value (integer)
1 -> 2 byte setpoint value (integer) + 1 byte status
2 -> 4 byte setpoint value (short real)
3 -> 4 byte setpoint value (short real) + 1 byte status
-> For more details, refer to the description.
Send_Termination
Selection whether the command has to be completed with or without sending a
'Termination' of activation.
FALSE: no 'Termination of activation'
TRUE: with 'Termination of activation' (default setting)
Lock
Blocking input for all setpoint commands processed by this block.
FALSE: New setpoint commands are executed
TRUE: New setpoint commands are not executed and negatively acknowledged.
Max_Delay_Time
0 (t#0ms) deactivates the aging monitoring of commands with time stamp.
>0: Aging monitoring for commands with time stamp active. The command must
not be older than the parameterized period of time (Default t#60s). Otherwise the
command will be neglected. Further (fixed) basic conditions are: The time in the
system and command must be valid. The time in the command may be max. 1 sec
in the future. The parameter is available from V1.5.
Timeout_Select_Execute
0 (t#0ms = default): Both select and execute commands will be always accepted
>0: Select before execute is activated. Executing commands are only accepted, if
they are received within the parameterized period of time after receipt of the select
command.
The parameter is available from V1.5.
IOA_Running_Cmd
Output of the information address (IOA) of a currently running command
The output is available from V1.5
FB_RetVal
Signals the reason why a command could NOT be executed. You will find a de-
tailed list in chapter 6.1.3.4
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 130 of 235 ©SIEMENS AG 2013
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
The structure types (Dst_Struct_Type) in detail
The structure of Dst_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
Res
Data_Type
Image
spacing
Data_Type
Data_Type used depending on information type – in this case, as follows:
00 (0): 2 byte setpoint value (integer)
01 (1): 2 byte setpoint value (integer) + 1 byte status
10 (2): 4 byte setpoint value (short real)
11 (3): 4 byte setpoint value (short real) + 1 byte status
2 byte
3 byte
4 bytes
5 bytes
Add_Dist
Additional image distance which is considered in case of sequential writing
+ n Byte
Res
Reserved for future expansions
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 131 of 235 ©SIEMENS AG 2013
Resultant typical image structures:
Structure type 0 (B#16#00): 2 byte setpoint value (integer)
Bit
7
6
5
4
3
2
1
0
Byte 0
Setpoint value
S7 integer
Info 1
1
2
Setpoint value
S7 integer
Info 2
3
…
…
Setpoint value
S7 integer
…
Structure type 1 (B#16#01): 2 byte setpoint value (integer)
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
Setpoint value
S7 integer
Info 1
1
2
SE
New
Cmd
Lk
-
-
-
-
-
3
Setpoint value
S7 integer
Info 2
4
5
SE
New
Cmd
Lk
-
-
-
-
-
…
…
Setpoint value
S7 integer
…
SE
New
Cmd
Lk
-
-
-
-
-
Structure type 17 (B#16#11): 2 Byte setpoint value (Integer)
+ 1 Byte Status, IEC-assignment
+ 1 Filler byte (Add_Dist=1)
Bit
7
6
5
4
3
2
1
0
Byte 0
Setpoint value
S7-Integer
Info 1
1
2
SE
New
Cmd
Lk
-
-
-
-
-
3
Filler byte
4
Setpoint value
S7-Integer
Info 2
5
6
SE
New
Cmd
Lk
-
-
-
-
-
7
Filler byte
…
…
Setpoint value
S7-Integer
…
SE
New
Cmd
Lk
-
-
-
-
-
Filler byte
Resultant structure: 3 bytes per info
Each first 2 bytes (1 word) represent one set-
point value in S7 integer format, in each third
byte, status bits for this setpoint value are
stored.
Resultant structure: 2 bytes per command
Each 2 bytes (1 word) represent a setpoint
value in S7 integer format.
Resulting Structure: 4 Byte per information
The filler bytes remain regarding setpoint
value output unconsidered and will be
leaped. They may be arbitrary used from
other parts of the program or are created only
for structuring purposes.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 132 of 235 ©SIEMENS AG 2013
Structure type 2 (B#16#01): 4 byte setpoint value (short real)
Bit
7
6
5
4
3
2
1
0
Byte 0
Setpoint value
S7 short-real
Info 1
1
2
3
5
Setpoint value
S7 short-real
Info 2
6
7
8
…
…
Setpoint value
S7 short-real
…
Structure type 3 (B#16#03): 4 byte setpoint value (short real)
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
Setpoint value
S7 short-real
Info 1
1
2
3
4
SE
New
Cmd
Lk
-
-
-
-
-
5
Setpoint value
S7 short-real
Info 2
6
7
8
9
SE
New
Cmd
Lk
-
-
-
-
-
…
…
Setpoint value
S7 short-real
...
SE
New
Cmd
Lk
-
-
-
-
-
Byte assignment when using Dst_Struct_Type = 1 or 3 in detail
SE
Select/Execute
Select bit from IEC message
NewCmd
New setpoint command,
is set with each output of a setpoint command.
Can be reset by the user.
Lk
Locked
Locking bit: If this bit is set before a new setpoint command is output, the command is
blocked. Instead of that it is 'negatively' acknowledged to the control centre.
Resultant structure: 4 bytes per info
Each 4 bytes (1 DWord) represent a setpoint
value in S7 short-real format.
Resultant structure: 5 bytes per info
Each first 4 bytes (1 DWord) represent a set-
point value in S7 short-real format, in each
fifth byte, status bits for this setpoint value are
stored.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 133 of 235 ©SIEMENS AG 2013
Additional notes on processing setpoint value adjusting commands
The value of a received setpoint command is output permanently to the target area.
Receipt of a new setpoint value overwrites the value in the target area.
The IEC originator is mirrored and sent in the response messages as well if necessary
Test bits and set P/N bit in the cause of transmission (COT) result in 'non-handling' – the mes-
sage is not processed.
Command cancellation via cancel command is always acknowledged negatively because set-
point value adjusting commands are terminated immediately.
In principle the setpoint command from SLo-block is only processed (and therefore acknowl-
edged) if it is a setpoint command which is directed to the block
In V1.0 version, no response to setpoint commands with unknown ASDU address, info ad-
dress,...
From V1.1 negative command confirmations are sent ,substitutional’ from SL_ORG_ASDU if no
setpoint adjusting command block (SLo_...) has processed (confirmed) the message within the
next OB1-cycle after receiving a setpoint adjusting command message (with COT6 or COT8).
The confirmation is carried out with:
- COT 44: unknown TK, if there is no output block programmed for the received TK.
- COT 45: unknown COT, if the received COT is not supported from the responsible SLo-
block (this is the one with the correct IOA)
- COT 47: unknown IOA, if there is no output block programmed for the received IOA.
For further notes please refer to chapter 6.1.1. As well the modified behavior from V1.5 is de-
scribed there.
Select/Execute is entered into the status bit SE when using Dst_Struct_Type 2 and 3, but not
evaluated for the output of the setpoint command.
The command is output regardless of S/E
From V1.5 the Select/Execute handling is carried out according to standard. See as well block
parameter “Timeout_Select_Execute”
Setpoint command messages with time stamp (TK 61, 62, 63) are accepted and output.
Up to Version V1.4 the time stamp is not evaluated.
From Version V1.5 see block parameter “Max_Delay_Time”
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 134 of 235 ©SIEMENS AG 2013
6.1.3.3. Bit pattern commands - SLo_BO_sx (FB137)
The block receives digital setpoint commands as 32-bit bit patterns from the telecontrol partner. In the
simplest case, it writes them as double word values to a data field (starting with First_Source_Pos).
CALL "SLo_BO_sx" , DB137
Comp_ID :=
P_Application :=#P_Appl
ASDU_Adr :=L#1
First_InfoAdr :=L#9000
First_Destination_Pos :=DB3.DBX200.0
No_of_Infos :=16
Dst_Struct_Type :=
Send_Termination :=
Lock :=
Max_Delay_Time :=
IOA_Running_Cmd :=
FB_RetVal :=
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
With a minor amount of parameterization, you can process many digital setpoint commands
(No_of_Infos):
- Digital setpoint commands with 32-bit bit pattern with TK 51,64
Default settings can be read in the relevant variable comment, on the other hand they require
only a minimum of mandatory inputs.
The minimum requirement is the interconnection of P_Application and First_Destination_Pos.
The information object addresses (IOA) and output position are automatically calculated in as-
cending / consecutive order starting with the programmable base address ('First_InfoAdr').
Any output targets starting with 'First_Destination_Pos' (A,M,DB,...) can be automatically ad-
dressed
Numerous output structures can be selected with 'Dst_Struct_Type':
- 4 bytes
- IEC format (+ status bits)
- additional filler bytes
A global blocking input permits the simple locking of all digital setpoint commands.
Selective blocking of individual digital setpoint commands possible (Lk bit in the command byte)
Individual address setting via address parameter-DB’s possible
Entire support of aging monitoring of commands with time stamp
Return_Value and feedback output of the information object address (IOA) of the executed
command
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 135 of 235 ©SIEMENS AG 2013
Block parameters with their default assignment and brief comment
FB137
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
DW#16#0
Pointer which must be connected to 'S7_IEC_Config’ –
Module
ASDU_Adr
IN
DINT
L#0
ASDU-Address which will be expected by this module
(Default: 0)
First_InfoAdr
IN
DINT
L#0
First Information object address / Default = 0
First_Destination_Pos
IN
POINTER
-
First Position of .... e.g. A0.0 or DB900.DBX5.0
No_of_Infos
IN
INT
1
No of (sequential ascending) IOA which will supported
(Default = 1)
Dst_Struct_Type :
IN
BYTE
B#16#0
0: (Def) 4 Byte (BO); 1: 5 Byte (BO Stat)
Send_Termination
IN
BOOL
TRUE
0: without; 1 (default): with Termination of activation
Lock
IN
BOOL
FALSE
If set, new cmd will be not executed, they will be
locked and neg. con
Max_Delay_Time
IN
Time
T#1M
0: without; >0 max. delay time for command with time
tag; Default: t#60s
IOA_Running_Cmd
OUT
DInt
IOA of an active command, otherwise 0; pulse cmd: if
active; per.cmd: one cycle
FB_RetVal
OUT
Word
Neg. values: Error-Codes; o: ok
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 136 of 235 ©SIEMENS AG 2013
Parameter and function details:
Comp_ID
Block identifier for (currently only internal) diagnostics functions. Assign different
numbers within a block type as byte variable.
e.g. B#16#1
P_Application
P_Application is a pointer to a common data range of block S7_IEC_Config. There-
fore it has to be interconnected to its output P_Application via a DWord variable.
The Config block receives user data such as 'ASDU address', receiver buffer, etc. via
this pointer or the data range behind it.
ASDU_Adr
Address value of the application service data unit receiving commands of this block.
Permissible range with ASDU address length 1 is 1 to 254
Permissible range with ASDU address length 2 is 1 to 65534.
The broadcast addresses 255 (FFh with length 1) resp. 65535 (FFFFh with length 2)
are always accepted.
First_InfoAdr
Address value of the first information object edited
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address exists in structured form (3 octets), it must be con-
verted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Other information objects are addressed consecutively / in ascending order.
Individual address allocation via address parameter-DB’s is possible.
Detailed description see chapter 6.1.3.4.
First_Destination_Pos
Bit pointer to the first target position which is receiving the information.
e.g. P#A0.0 or P#DB1.DBX0.0
With non bit-oriented output structures, the byte limits must be observed (p#Ax.0),
otherwise 'access errors' may occur.
No_of_Infos
Number of infos to be output
Value range 1 to 255
Dst_Struct_Type
Digital setpoint commands can be output in the following formats:
0 -> 4 byte bit pattern (digital setpoint value)
1 -> 4 byte bit pattern (digital setpoint value) + 1 byte status
2 -> Res.
3 -> Res.
-> For more details, refer to the description.
Send_Termination
Selection whether the command has to be completed with or without sending a 'Ter-
mination' of activation.
FALSE: no 'Termination of activation'
TRUE: with 'Termination of activation' (default setting)
Lock
Blocking input for all digital setpoint commands processed by this block.
FALSE: New digital setpoint commands are executed
TRUE: New digital setpoint commands are not executed and negatively acknowl-
edged.
Max_Delay_Time
0 (t#0ms) deactivates the aging monitoring of commands with time stamp.
>0: Aging monitoring for commands with time stamp active. The command must
not be older than the parameterized period of time (Default t#60s). Otherwise the
command will be neglected. Further (fixed) basic conditions are: The time in the
system and command must be valid. The time in the command may be max. 1 sec
in the future. The parameter is available from V1.5.
IOA_Running_Cmd
Output of the information address (IOA) of a currently running command
The output is available from V1.5
FB_RetVal
Signals the reason why a command could NOT be executed. You will find a de-
tailed list in chapter 6.1.3.4
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 137 of 235 ©SIEMENS AG 2013
The structure types (Dst_Struct_Type) in detail
The structure of Dst_Struct_Type
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Add_Dist
Res
Data_Type
Image-
spacing
Data_Type
Data_Type used depending on information type – in this case, as follows:
00 (0): 4 byte bit pattern (digital setpoint value)
01 (1): 4 byte bit pattern (digital setpoint value) + 1 byte status
10 (2): Res.
11 (3): Res.
4 byte
5 byte
Add_Dist
Additional image distance which is considered in case of sequential writing
+ n Byte
Res
Reserved for future expansions
Resultant typical image structures:
Structure type 0 (B#16#00): 4 byte bit pattern (digital setpoint
value)
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit bit pattern
Info 1
1
2
3
4
32-bit bit pattern
Info 2
5
6
7
…
…
32-bit bit pattern
…
Resultant structure: 4 bytes per command
Each 4 bytes represent a 32-bit bit pattern
which can be interpreted as 32 bit setpoint
value.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 138 of 235 ©SIEMENS AG 2013
Structure type 1 (B#16#01): 4 byte bit pattern (digital setpoint
value)
+ 1 byte status, IEC assignment
Bit
7
6
5
4
3
2
1
0
Byte 0
32-bit bit pattern
Info 1
1
2
3
4
SE
New
Cmd
Lk
-
-
-
-
-
5
32-bit bit pattern
Info 2
6
7
8
9
SE
New
Cmd
Lk
-
-
-
-
-
…
…
32-bit bit pattern
…
SE
New
Cmd
Lk
-
-
-
-
-
Structure type 49 (B#16#31): 4 byte bit pattern (digital setpoint
value)
+ 1 byte status, IEC-assignment
+ 3 filler byte (Add_Dist=3)
Bit
7
6
5
4
3
2
1
0
Byte 0
32 bit pattern
Info 1
1
2
3
4
SE
New
Cmd
Lk
-
-
-
-
-
5
Filler byte
6
Filler byte
7
Filler byte
8
32 bit pattern
Info 2
9
10
11
12
SE
New
Cmd
Lk
-
-
-
-
-
13
Filler byte
14
Filler byte
15
Filler byte
…
…
32 bit pattern
…
SE
New
Cmd
Lk
-
-
-
-
-
Filler byte
Filler byte
Filler byte
Resultant structure: 5 bytes per command
Every first 4 bytes represent a 32-bit bit pat-
tern (digital setpoint value),
in each fifth byte the quality identifier is stored
for this bit pattern.
Resulting Structure: 8 Byte per information
The filler bytes remain regarding bit pattern
output unconsidered and will be leaped.
They may be arbitrary used from other parts
of the program or are created only for struc-
turing purposes.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 139 of 235 ©SIEMENS AG 2013
Assignment of the status byte when using Dst Struct_Type = 1 or 3 in detail
SE
Select/Execute
Select bit from IEC message
NewCmd
New command - New digital setpoint command,
is set with each output of a digital setpoint command.
Can be reset by the user.
Lk
Locked - blocked
Blocking bit: If this bit is set before a new digital setpoint command is emitted, the setpoint
command is not emitted. Instead of that it is 'negatively' acknowledged to the control cen-
tre.
Additional notes on processing digital setpoint value commands
The value of a received digital setpoint value command is output permanently to the target area.
Receipt of a new digital setpoint value overwrites the value in the target area.
The IEC originator is mirrored and sent in the response messages as well if necessary
Test bits and set P/N bit in the cause of transmission (COT) result in 'non-handling' – the mes-
sage is not processed.
Command cancellation via cancel command is always acknowledged negatively because set-
point value commands are terminated immediately.
In principle, the digital setpoint command from SLo-block is only processed (and therefore
acknowledged) if it is a digital setpoint command which is directed to the block
-> In V1.0 version, no response to digital setpoint commands with unknown ASDU address, info
address,...
From V1.1 negative command confirmations are sent ,substitutional’ from SL_ORG_ASDU if no
setpoint adjusting command block (SLo_...) has processed (confirmed) the message within the
next OB1-cycle after receiving a digital setpoint adjusting command message (with COT6 or
COT8).
The confirmation is carried out with:
- COT 44: unknown TK, if there is no output block programmed for the received TK.
- COT 45: unknown COT, if the received COT is not supported from the responsible SLo-
Block (it is the one with the correct IOA)
- COT 47: unknown IOA, if there is no output block programmed for the received IOA.
For further notes please refer to chapter 6.1.1. As well the modified behavior from V1.5 is de-
scribed there.
Digital setpoint command messages with time stamp (TK 64) are accepted and output.
Up to the Version V1.4 the time stamp is not evaluated
From Version V1.5 see block parameter „Max_Delay_Time“.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 140 of 235 ©SIEMENS AG 2013
6.1.3.4. Return_Values of the Slo-Blocks
FB_RetVal
Reason
Action
FB135
FB136
FB137
SC..
SE..
BO..
16#8103
P_Application faulty
X
X
X
16#8401
Invalid status DCS (11 or 00)
Refuse command
(negative confirmation COT 7)
X
-
-
16#8402
Non supported Qualifier
Refuse command
(negative confirmation COT 7)
X
-
-
16#8410
Global command lock set
Refuse command
(negative confirmation COT 7)
X
X
X
16#8411
Command specific lock set
Refuse command
(negative confirmation COT 7)
X
X
X
16#8412
Command running (1 out of n)
Refuse command
(negative confirmation COT 7)
X
-
-
16#8413
Command buffer full
Refuse command
(negative confirmation COT 7)
X
-
-
16#8420
Select command received dur-
ing select runs
Refuse command
(negative confirmation COT 7)
X
X
-
16#8421
Select command received dur-
ing command runs
Refuse command
(negative confirmation COT 7)
X
-
-
16#8422
Execute command received
without active select
Refuse command
(negative confirmation COT 7)
X
X
-
16#8423
Execute command does not fit
to active select
Refuse command
(negative confirmation COT 7)
X
X
-
16#8431
Break command but no com-
mand active, or wrong IOA
Refuse command
(negative confirmation COT 7)
X
X
X
16#8501
Time stamp in the command in-
valid
Neglect command
X
X
X
16#8502
System time invalid
Neglect command
X
X
X
16#8503
Fault at time difference calcula-
tion (FC SB_DT_DT)
Neglect command
X
X
X
16#8504
Time stamp in the command is
in the future (> 1sec)
Neglect command
X
X
X
16#8505
Aging monitoring: Command to
old
Neglect command
X
X
X
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 141 of 235 ©SIEMENS AG 2013
6.1.4. Individual IEC-Addressing
With the input parameter ,First_IEC_Info_Adr’ of the SLi/SLo-Blocks is defined whether the address allo-
cation is carried out block by block, from an assignable start address or via address parameter data
blocks.
If the addressing has to be carried out via an address parameter DB an offset from 100000000 (eight ze-
ros) has to be entered there.
If the addresses have to be taken from the DB1301 for example, the value L#100001301 has to be en-
tered at ,First_IEC_Info_Adr’.
In the parameter DB the addresses then have to be entered in the sequence of the collected information.
The single information can be deactivated by entering the value 0 for address (Input L#0) in the parame-
ter DB.
The structure of the address parameter DB’s is the same for all collection blocks (SLi_...) and output
blocks (SLo_...) and has the following basically structure:
Group /
Parameter
Addr.
rel
Addr.
Abs
Type
Initial value
Comment
DB_Manag
0
0
STRUCT
DB_Manag.
Pos_of_DB
+0.0
0.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
No_of_all_DBs
+1.0
1.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Act
+2.0
2.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Prev
+4.0
4.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Next
+6.0
6.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
Reserved
+8.0
8.0
WORD
W#16#0
reserved for future - do not change !
+10.0
10.0
END_STRUCT
END_STRUCT (10 BYTE)
Info_Manag
STRUCT
Info_Manag.
P_Byte_First_Info
+0.0
10.0
INT
34
(Byte-) Position of first Para-Block - do
not change !
Info_Manag.
No_of_Infos
+2.0
12.0
INT
0
0:unspecified (DB is filled up to the end);
otherwise size n of ARRAY [1..n]
Info_Manag.
Len_Info
+4.0
14.0
BYTE
B#16#4
Difference in [byte] between two Para-
Blocks - do not change !
Info_Manag.
Len_Sort_Key
+5.0
15.0
BYTE
B#16#0
0: without sorting; > 0: Data sets are sort-
ed ascending with x Bytes
DB_Manag.
Re_internal_usage
+6.0
16.0
DWORD
DW#16#0
+10.0
20.0
END_STRUCT
END_STRUCT (10 BYTE)
Global
STRUCT
Global.
Para_DB_Type
0.0
20.0
WORD
W#16#101
Internal identifier for this Data Block - do
not change
Global.
Int_W22
2.0
22.0
WORD
W#16#0
Reserved for internal use
4.0
24.0
END_STRUCT
END_STRUCT (4 BYTE)
IEC_Adr
ARRAY [1..n]
STRUCT
n = Number Parameter inputs
IEC_Adr
IOA_x
+0.0
24.0
DINT
L#0
IOA Information object address
4.0
28.0
END_STRUCT
END_STRUCT (4 BYTE)
This values are pre-adjusted in the sample DB and need not to be changed.
A sample DB is included in the corresponding block libraries.
DB139 = ‚Para_DB_IOA_Demo’.
!!! These parameters you have to set !!!
Note:
Always make changes in the 'Data view', not in the 'Declaration view' (except dimension-
ing of the array)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 142 of 235 ©SIEMENS AG 2013
DB_Management
Parameter blocks which include an enumeration are created so, that more than
one data block can be used if required. The following information is required for
management.
Currently the DB management is not used – for this reason all parameters can be
left at their default settings (0)
Pos_of_DB
Number (1 – n) of the current data block for the parameter block
0: not used
No_of_all_DBs
Total number (n) of data blocks for the parameter block
0: not used
DB_No_Act
DB number of the current data block
0: not used
DB_No_Prev
DB number of the previous data block, if one exists.
Otherwise: 0
DB_No_Next
DB number of the subsequent data block, if there is another one.
Otherwise: 0
Info_Management
Parameter blocks containing an enumeration have one information block 'Info
management'. It contains the following information
The values of the information management parameters are already preset and
therefore do not need to be modified.
P_Byte_First_Info
Byte position of the first data record in this DB, may not be changed
No_of_Infos
Number of data records contained in this DB
0: unspecified -> the data block end marks the last data record
Len_Info
Length of the data records:
In this case 4: may not be changed
Len_Sort_Key
0: no sorting (default setting)
Other sort lengths are not supported when using as parameter DB for Individual
IEC addressing.
Global Parameter
Para_DB_Type
Internal used: Identifier for this Parameter-DB – don’t change!
IEC-Addresses
IEC_Adr
The rating of the array is carried out in the declaration view of the data block. It has
to be selected min. as large as the parameter No_of_Infos from the related SLi-
/SLo blocks
IOA
Address value of the captured information objects
Permissible range for length of the IOA-address 1 is 1 up to 255
Permissible range for length of the IOA-address 2 is 1 up to 65535.
Permissible range for length of the IOA-address 3 is 1 up to 16777215
Is the information object address available in structured form (3 Octets), it has to
be converted into a decimal number:
IOA dec = Octet1 + 256*Octet2 + 256*256*Octet3
The value 0 (entered as initial value in the DB)
deactivates the corresponding information.
In this case no telecontrol specific processing is carried out
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
For each call of a capture or output block an own address parameter DB is needed.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 143 of 235 ©SIEMENS AG 2013
6.2. Calling Sli-Blocks from time interrupts (Cyclic Interrupts)
From Version V1.5 exclusively Sli-Blocks (FB130-FB134) may be embedded in a time interrupt
(e.g. OB35) additionally to the standard sequence (OB1). This is realized automatically from the blocks
and the inputs are scanned only in the time interrupt.
In case of slow processing (e.g. 500 ms for measured values) a release of the standard cycle and there-
fore a faster communication can be achieved.
Faster time interrupt cycles (e.g. 10 ms) are suitable for gathering indication with high demand of timing.
Caution: This is permitted only for a restricted number otherwise there is a possibility for cyclic time faults.
The standard sequence is extended as well.
Time stamp and SL_Org_ASDU
Normally the actual time is generated in the FB100. This is used as time stamp for the gathered infor-
mation of the subsequent called Sli-blocks.
In order to achieve a higher time stamp accurateness for the Sli-blocks in time interrupts (in particular fast
alarms) it is allowed to call the SL-Org_ASDU block belonging to the Sli-block as well in the time interrupt
(as well without parameter supply). In this case it actualizes the time for all Sli-blocks running afterwards.
Note:
Please note that every FB in both calls (OB1 and time interrupt) are using the same instance DB.
The parameter supply (interconnection of the inputs and outputs, incl. e.g. P_Sli) can be renounced in the
time interrupt. With it you not only save the global pointer connection but also the necessary multiple
matching in the case of parameter changes.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 144 of 235 ©SIEMENS AG 2013
6.3. Master Blocks MA
The Master (MA) application blocks are connected via the pointer 'P_Application’ to the protocol version
supplied, i.e. the functional block 'MA_Org_Asdu_1' and the blocks for the outputs in monitoring direction
(MAo) as well as the inputs in control direction (MAi) are coupled directly to the IEC interface connection.
The following are available:
MA_Org block for organizational tasks per ASDU address, such as send time, GI after link er-
ror.
MAi blocks for the activation and monitoring of commands and setpoint values.
One block for all commands and setpoint values.
MAo blocks for the output of messages, measured values and count values.
One block per information type.
The ending included in the block symbol names 'pDB' (MAi_xyz_pDB, MAo_xyz_pDB) refers to the 'pa-
rameterization' using data blocks. It contains 'global' parameters as well as 'assignment lists' and is de-
scribed in detail in the subsequent chapters.
Notice!
The application blocks are designed exclusively for priority level OB1. The IEC com-
munication blocks need to be operated as well in the OB1!
…
All blocks are also multiple applicable
MAi_SC_DC_RC_
pDB
(FB148)
Message buffer
MAo_SP_IM_pDB
(FC140)
MAo_SP_IT_pDB
(FC147)
P_Application
FB_100 -> e.g.
S7_IEC_M101
L1_xy
L2_xy
L7_T101_104_B
MA_Org_Asdu_n
(FB122)
FB_100 -> e.g.
S7_IEC_M104
L1_xy
L2_xy
L7_T101_104_B
Master blocks (MA)
(sub-station connection)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 145 of 235 ©SIEMENS AG 2013
6.3.1. Organization block - MA_Org_ASDU_n (FB122)
CALL "MA_Org_Asdu_1" , DB122
Comp_ID :=
P_Application :=#P_Appl
ASDU_Adr :=
Para_Time_Sync_Intervall:=1
Info_Adr_Buffer_Overflow:=L#65000
Start_IC :=
Start_CI :=
IC_QOI :=
CI_QCC :=
Illustration as CFC block with default values
Illustration in AWL with partial parameter supply
The block has been created as a function block (FB), and therefore requires an instance DB (e.g. Call
FB122,DB122) or can be used within a higher level FB as a 'multi-instance'.
The task of MA_ORG_ASDU_n is the station monitoring for the parameterized ASDU address concern-
ing:
Detected link error (from link layer L2)
Receipt of start-up message TK70
Receipt of a buffer overrun message (single info TK1 with parameterized address)
From V1.2 the MA_Org_ASDU_n is Multi-ASDU capable and supports the processing of several ASDU
addresses per station / device.
Depending on the events the following actions are executed:
GI request
- After outgoing link error
- After receipt of TK70
- After receipt of incoming buffer overrun message
Clock adjustment request (TK103), if activated
- After receipt of TK70
- In cyclical intervals according to parameterization
The block can also execute interrogation commands 'manually' by activating the relevant input and setting
the associated identifier. With appropriate control cyclical / time-controlled (list) interrogations thus can be
realized.
(General) interrogation TK100
Counter interrogation TK101
Number of connectable sub-stations:
From V1.2 also polling lines with IEC101 connections and several stations per interface are
supported.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 146 of 235 ©SIEMENS AG 2013
Block parameters with their default assignment and brief comment
FB122
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
0
Pointer which must be connected to 'S7_IEC_Config’ –
Module
ASDU_Adr
IN
DINT
L#1
ASDU-Address which will be controlled by this module
Default L#1
Para_Time_Sync_Intervall
IN
INT
0
Send Clock synchronization command cyclic [min] or
never (0 = default)
Info_Adr_Buffer_Overflow
IN
DINT
L#0
Incoming single point information with this address will
generate a GI-Request
Start_IC
IN
Bool
FALSE
a rising edge will start an interrogation command with
parameterized IC_QOI
Start_CI
IN
Bool
FALSE
a rising edge will start an counter interrogation with
parameterized CI_QCC
IC_QOI
IN
BYTE
B#16#14
IEC-Qualifier of manual started IC (Default: B#16#14=
global Station interro.)
CI_QCC
IN
BYTE
B#16#5
IEC-Qualifier of manual started CI (Default:
B#16#05=general request counter )
Parameter and functional details:
Comp_ID
Block identifier for (currently only internal) diagnostic functions. Assign different
numbers within a block type as byte variable.
e.g. B#16#1
P_Application
P_Application is a pointer to a common data range of block S7_IEC_Config. There-
fore it has to be interconnected to its output P_Application via a DWord variable.
The Config block receives user data such as 'ASDU address', receiver buffer, etc.
via this pointer or the data range behind it.
ASDU_Adr
Address value of the application service data unit receiving commands of this
block.
Permissible range with ASDU address length 1 is 1 to 254
Permissible range with ASDU address length 2 is 1 to 65534.
The broadcast address 255 (FFh at length 1) resp. 65535 (FFFFh at length 2) is
valid as well and may be given, if the remote station in a point-to-point connection
transmits the information with several ASDU addresses.
In stations with several defined ASDU addresses or with several stations at one
polling line, the number of an ASDU address parameter DB has to be given here
For more details refer to chapter 6.3.2.
Para_Time_Sync_Intervall
Time interval for sending a time synchronization message (TK103)
Permissible range at 0 to 65535.
Value 0: none
Value 1-x: Interval in min. In this interval time adjusting messages TK103 are sent
to the partner.
Info_Adr_Buffer_Overflow
Spontaneously received single point information with the information object ad-
dress parameterized here and status 'KOM' start a general interrogation.
Permissible range with IOA address length 1 is 1 to 255
Permissible range with IOA address length 2 is 1 to 65535.
Permissible range with IOA address length 3 is 1 to 16777215
If the information object address is available in structured form (3 octets), it must be
converted into a decimal number:
IOA dec = octet1 + 256*octet2 + 256*256*octet3
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 147 of 235 ©SIEMENS AG 2013
Start_IC
With a rising edge an interrogation command (TK100)
is started with interrogation identification according to parameter 'IC_QOI'.
If a defined ASDU address is parameterized at the input ‚ASDU_Adr’ this ASDU
address will be used.
When using an ASDU address parameter DB the broadcast address 255 (FFh at
length 1) resp. 65535 (FFFFh at length 2) is used.
Note:
To avoid entries into the send buffer when the link layer has not been created, the
trigger should be linked to LINK_ERR.
Start_CI
With a rising edge, a counter interrogation command (TK101)
is started with interrogation identification according to parameter 'CI_QCC'.
If a defined ASDU address is parameterized at the input ‚ASDU_Adr’ this ASDU
address will be used.
When using an ASDU address parameter DB the broadcast address 255 (FFh at
length 1) resp. 65535 (FFFFh at length 2) is used.
Note:
To avoid entries into the send buffer when the link layer has not been created, the
trigger should be linked to LINK_ERR.
IC_QOI
Interrogation identification 'QOI' according to the standard, for transmitting a manu-
al started interrogation command.
Permissible values: 0 to 255
Common values:
20 = B#16#14 (global station interrogation, GI)
21 = B#16#15 (group 1 interrogation)
…
36 = B#16#24 (group 16 interrogation)
The interrogation is started with a rising edge at 'Start_IC'.
CI_QCC
Interrogation identification 'QCC' according to standard, with which the counter in-
terrogation command of a manually started counter interrogation is sent.
Permissible values: see description QCC
Common values:
B#16#05 (general counter interrogation, no re-save, no reset)
B#16#45 (general counter interrogation, with re-save, no reset)
B#16#85 (general counter interrogation, with re-save, with reset)
Interrogation is started with a rising edge at 'Start_CI'.
-> For more details, refer to the description QCC.
The counter interrogation identification (QCC) in detail
The structure of QCC according to the standard
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
FRZ
RQT
RQT
Interrogation
(0): no counter interrogation (not used)
(1): counter interrogation group 1
(2): counter interrogation group 2
(3): counter interrogation group 3
(4): counter interrogation group 4
(5): general counter interrogation
(6..31): reserved (compatible range)
(32..63): reserved (private range)
FRZ
Restore:
00 (0): interrogation (no restore or reset)
01 (1): counter restore no reset
10 (2): counter restore with reset
11 (3): counter reset
The action specified using FRZ is only effective for the group specified using RQT.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 148 of 235 ©SIEMENS AG 2013
6.3.2. ASDU-Address Parameter-DB
From V1.2 the FB ,MA_Org_ASDU_1’ is Multi-ASDU capable and supports the processing of several
ASDU addresses per device.
In case of processing information with different ASDU addresses in one device (defined via the link ad-
dress) the use of an ASDU address parameter DB is provided for this.
For realization from a polling line with several stations at one line the use of the ASDU address parameter
DB is mandatory. Furthermore the use of the ASDU address parameter DB can be useful as well if only
one station (point-to-point operating) is connected, in order to achieve a structuring of the information to
be transmitted.
In addition to the parameterization of the ASDU addresses the assignment to the link address is carried
out in this data block too. The number of this data block has to be indicated at the input parameter
‚ASDU_Adr’ of the MA_Org_Asdu block.
If the address setting has to be carried out via an ASDU address parameter DB, an offset of 100000000
(eight zeros!) has to be entered there.
If the addresses are taken from the DB112 for example, the value of L#100000112 has to be entered in
the ‚ASDU_Adr’.
In the parameter DB the ASDU addresses and the assignment to the corresponding station (link address)
have to be indicated. The path for reaching the respective ASDU is defined via this assignment.
System related, the maximum number of the link and ASDU addresses is only limited by the DB length.
Up to 8 link and ASDU addresses have been tested.
Design and values of the parameter data block:
The parameter-DB has the following basic design:
Group /
Parameter
Addr.
rel
Addr.
Abs
Type
Initial val-
ue
Comment
DB_Manag
0
0
STRUCT
DB_Manag.
Pos_of_DB
+0.0
0.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
No_of_all_DBs
+1.0
1.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Act
+2.0
2.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Prev
+4.0
4.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Next
+6.0
6.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
Reserved
+8.0
8.0
WORD
W#16#0
reserved for future - do not change !
+10.0
10.0
END_STRUCT
END_STRUCT (10 BYTE)
Info_Manag
STRUCT
Info_Manag.
P_Byte_First_Info
+0.0
10.0
INT
34
(Byte-) Position of first Para-Block - do
not change !
Info_Manag.
No_of_Infos
+2.0
12.0
INT
0
0:unspecified (DB is filled up to the end);
otherwise size n of ARRAY [1..n]
Info_Manag.
Len_Info
+4.0
14.0
BYTE
B#16#4
Difference in [byte] between two Para-
Blocks - do not change !
Info_Manag.
Len_Sort_Key
+5.0
15.0
BYTE
B#16#0
0: without sorting; > 0: Data sets are sort-
ed ascending with x Bytes
DB_Manag.
Re_internal_usage
+6.0
16.0
DWORD
DW#16#0
+10.0
20.0
END_STRUCT
END_STRUCT (10 BYTE)
Global
STRUCT
Global.
Glob_R1
0.0
20.0
INT
0
Global.
Glob_R2
2.0
22.0
WORD
W#16#0
4.0
24.0
END_STRUCT
END_STRUCT (4 BYTE)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 149 of 235 ©SIEMENS AG 2013
ASDU_Adr_Para
ARRAY [0..n]
STRUCT
n = number-1 of the parameter entries
ASDU_Adr_Para
ASDU_Address
+0.0
24.0
DINT
L#0
Parameter: ASDU address
ASDU_Adr_Para
Link_Para_DB
+4.0
28.0
INT
0
Parameter: associated link db no / 0 ->
direct (no link db available)
ASDU_Adr_Para
Link_Para_Pos
+6.0
30.0
INT
0
Parameter: parablock no in link db
ASDU_Adr_Para
Error
+8.0
32.0
BOOL
FALSE
internal
ASDU_Adr_Para
Res_1
+9.0
33.0
BYTE
B#16#0
internal
ASDU_Adr_Para
Res_2
+10.0
34.0
DINT
L#0
internal
ASDU_Adr_Para
Res_3
+14.0
38.0
INT
0
internal
16.0
40.0
END_STRUCT
END_STRUCT (16 BYTE)
This values are preset in the sample DB and must not be changed.
A sample DB included in the relevant block libraries.
DB112 = ‚P_ASDUAdr_n’.
!!! These parameters you have to set !!!
Note:
Always make changes in the 'Data view', not in the 'Declaration view' (except dimensioning
of the array)
DB_Management
Parameter blocks which include an enumeration are created so that more than one
data block can be used if required. The following information is required for man-
agement.
Currently the DB management is not used – for this reason all parameters can be
left at their default settings (0)
Pos_of_DB
Number (1 – n) of the current data block for the parameter block
0: not used
No_of_all_DBs
Total number (n) of data blocks for the parameter block
0: not used
DB_No_Act
DB number of the current data block
0: not used
DB_No_Prev
DB number of the previous data block, if one exists.
Otherwise: 0
DB_No_Next
DB number of the subsequent data block, if there is another one.
Otherwise: 0
Info_Management
Parameter blocks containing an enumeration have one information block 'Info
management'. It contains the following information
The values of the information management parameters are already preset and
therefore do not need to be modified.
P_Byte_First_Info
Byte position of the first data record in this DB, may not be changed
No_of_Infos
Number of data records contained in this DB
0: unspecified -> the data block end marks the last data record
Len_Info
Length of the data records:
In this case 4: may not be changed
Len_Sort_Key
0: no sorting (default setting)
Other sorting lengths are not supported when using as parameter DB for optional
IEC-addressing.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 150 of 235 ©SIEMENS AG 2013
Global Parameter
Glob_R1
Reserve, not used
Glob_R2
Reserve, not used
ASDU_Adr_Para
The dimensioning of the array is carried out in the declaration view of the data
block. It has to be done according to the number of the requested ASDU address-
es.
There are n+1 ASDU-Addresses requested.
ASDU_Adress
Address value of the Application-Service –Data-Unit, receiving the commands from
the MA_Org_ASDU block.
Permissible range for length of the ASDU-address 1 is 1 up to 254
Permissible range for length of the ASDU-address 2 is 1 up to 65534
The broadcast addresses 255 (FFh at length 1) resp. 65535 (FFFFh at length 2)
are automatically used from the block if necessary (e.g. for the clock synchroniza-
tion with TK103)
Link_Para_DB
Refers to the assigned link address parameter DB
1 - n: Number of the assigned link address parameter DB
0: no link address parameter DB available (default setting)
This setting has to be selected, when only one station with several ASDU
addresses has to be requested.
Link_Para_Pos
Refers to a parameter block in the link address parameter DB and defines the link
address (station/device) the ASDU belongs to.
0 – n Number of the assigned parameter block in the link address parameter DB
Error
Indicates whether the connection to the ASDU address is disturbed:
FALSE: ASDU is not disturbed
TRUE: ASDU is disturbed
NOTICE!
Please note the permissible valuation of the block parameters. They are not mandatory
checked for plausibility. Incorrect inputs can cause unpredictable responses and incor-
rect functions.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 151 of 235 ©SIEMENS AG 2013
6.3.3. Output blocks - MAo_xyz_pDB
For the different information types in the monitoring direction, there are output blocks (FCs) available
which have to be 'interconnected' to the relevant protocol version supplied, via the pointer 'P_Application'.
The blocks then respond to receive messages with the relevant type identification. They take from this
messages values and qualifiers which are written into an image (IM = Image; in data blocks or PAA).
The 'Allocation' of the IEC information objects to the required image position(s), as well as the transfer of
basic settings / parameters is carried out in an assigned parameter data block.
The symbol name encrypts the most important block properties as follows:
MAo_SP_IM_pDB
MAo is the abbreviation for master block output,.
The block issues the information contained in the message
(in this case to the PAA or a DB).
MAo_SP_IM_pDB
Information types supported by the block with the brief designation ac-
cording to IEC standard: SP = Single Point information
MAo_SP_IM_pDB
IM is the abbreviation for image, i.e. the information is written from the
block into an image (PAA or DB)
MAo_SP_IM_pDB
p is the abbreviation for programmable allocation of IEC address and out-
put point.
MAo_SP_IM_pDB
The parameters for the individual information are stored in a DB.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 152 of 235 ©SIEMENS AG 2013
The available MAo functions can be found in the following overview.
Block
Block.
no.
Para DB no.
(Default)
Assignment from …
… into image (DB) or to PAA.
MAo_SP_IM_pDB
FC140
DB140
Single point information (SP; TK1,2,30) …
MAo_DP_IM_pDB
FC141
DB141
Double point information (DP; TK3,4,31) …
MAo_ST_IM_pDB
FC142
DB142
Step position information (ST; TK5,6,32) …
MAo_BO_IM_pDB
FC143
DB143
Bit pattern messages (BO; TK7,8,33) …
MAo_ME_NA_IM_pDB
FC144
DB144
Normalized measured values (ME_NA: TK9,10,34)
MAo_ME_NB_IM_pDB
FC145
DB145
Scaled measured values (ME_NB; TK11,12,35) …
MAo_ME_NC_IM_pDB
FC146
DB146
Measured value with short floating point number
(ME_NC; TK13,14,36)
MAo_IT_IM_pDB
FC147
DB147
Integrated totals (IT; TK15,16,37) …
Illustration of the necessary interconnection - here in a CFC plan as an example:
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 153 of 235 ©SIEMENS AG 2013
The parameter DBs have the following basic structure (using the example of the parameter DB for single
infos):
Group /
Parameter
Addr.
rel
Addr.
abs.
Type
Start val-
ue
Comment
DB_Manag
0
0
STRUCT
DB_Manag.
Pos_of_DB
+0.0
0.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
No_of_all_DBs
+1.0
1.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Act
+2.0
2.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Prev
+4.0
4.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Next
+6.0
6.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
Reserved
+8.0
8.0
WORD
W#16#0
reserved for future - do not change !
+10.0
10.0
END_STRUCT
END_STRUCT (10 BYTE)
Info_Manag
STRUCT
Info_Manag.
P_Byte_First_Info
+0.0
10.0
INT
34
(Byte-) Position of first Para-Block - do not
change !
Info_Manag.
No_of_Infos
+2.0
12.0
INT
0
0:unspecified (DB is filled up to the end);
otherwise size n of ARRAY [1..n]
Info_Manag.
Len_Info
+4.0
14.0
BYTE
B#16#10
Difference in [byte] between two Para-
Blocks - do not change !
Info_Manag.
Len_Sort_Key
+5.0
15.0
BYTE
B#16#0
0: without sorting; > 0: Data sets are sort-
ed ascending with x Bytes
DB_Manag.
Re_internal_usage
+6.0
16.0
DWORD
DW#16#0
+10.0
20.0
END_STRUCT
END_STRUCT (10 BYTE)
Global
STRUCT
Global.
Para_DB_Type
0.0
20.0
WORD
W#16#101
Internal identifier for this Data Block - do
not change
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1 Bit-Image, 2 IEC-Image, 3
IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#1
0: auto (standard); <> 0: fixed distance
[Bit] of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection
errors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated). For SP only
0 and 1 possible
Global.
Internal_10
10.0
30.0
WORD
W#16#0
Internal use: Last found parablock – do
not change !
Global.
Internal_12
12.0
32.0
WORD
W#16#0
Internal use: Last processed info - do not
change !
14.0
34.0
END_STRUCT
END_STRUCT (14 BYTE)
Para_SP
ARRAY [1..n]
STRUCT
n = Number Parameter inputs
Para_[x].
S_Line
+0.0
34.0
INT
1
Source: No of Line (1..x)-actually do not
change from 1
Para_[x].
S_ASDU
+2.0
36.0
INT
0
Source: Address of ASDU (ASDU-
Address)
Para_[x].
S_Info
+4.0
38.0
DINT
L#0
Source: Address of Infoobject (IOA)
Para_[x].
D_DB_No
+8.0
42.0
INT
0
Dest. No. of Data Block, 0 -> PIQ (PAA)
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest.: Bit position
Para_[x].
P_No_of_fol_Infos
+14.0
48.0
INT
0
Parameter: Number of following sequ. Info
elements
16.0
50.0
END_STRUCT
END_STRUCT (16 BYTE)
These values are preset in the default DBs and must not be changed.
The default DBs are included in the relevant block libraries.
!!! These parameters you have to set !!!
Note:
Always make changes in the 'Data view', not in the 'Declaration view' (except dimensioning
of the array)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 154 of 235 ©SIEMENS AG 2013
DB_Management
Parameter blocks which include an enumeration are created so, that more than one
data block can be used if required. The following information is required for man-
agement.
Currently the DB management is not used – for this reason all parameters can be left
at their default settings (0)
Pos_of_DB
Number (1 – n) of the current data block for the parameter block
0: not used
No_of_all_DBs
Total number (n) of data blocks for the parameter block
0: not used
DB_No_Act
DB number of the current data block
0: not used
DB_No_Prev
DB number of the previous data block, if one exists.
Otherwise: 0
DB_No_Next
DB number of the subsequent data block, if there is another one.
Otherwise: 0
Info_Management
Parameter blocks containing an enumeration have one information block 'Info man-
agement'. It contains the following information
The values of the information management parameters are already preset and there-
fore do not need to be modified.
P_Byte_First_Info
Byte position of the first data record in this DB
No_of_Infos
Number of data records contained in this DB
0: unspecified -> the data block end marks the last data record
Len_Info
Length of the data records:
0: not permitted
1-254: data record length
255: no standard length, length specifications in the byte format by sort criterion
Len_Sort_Key
0: no sorting (default setting)
8: the first 8 bytes of the information-specific parameters (see parameter group Pa-
ra_SP, for example) form the sort criterion.
Other sort lengths are not permitted when using as parameter DB for MAo blocks.
If the DB is being used as parameter DB for MAo blocks and a large number of pa-
rameter blocks is required, it is advisable to create the parameter blocks sorted in
ascending order by 'S_Line, S_ASDU and S_Info' in the parameter DB.
A data block created in this way is then effectively searched in combination with
'Len_Sort_Key' = 8 (binary search).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 155 of 235 ©SIEMENS AG 2013
General (global) parame-
ters
These parameters are type-specific. For this reason their functions are only partially
described here.
Supported values are found in the relevant chapters in the block description.
Para_DB_Type
Used internally: Identifier for this parameter DB – do not change!
Image_Type
Output form of the infos (raw values, IEC format,… IEC-Format+ Ext_State+ Time)
Image_Len
Image spacing in bit – relevant with 'blocked' parameterization – results from Im-
age_Type.
0: automatic calculation.
The calculated length is written from MAo-block into the DB
<>0: fixed space of the process image in bit.
From V1.1 ,Image_Len’ is pre-allocated with 0. Adaption is only necessary if a spe-
cific other (larger) image length shall be created.
Subst_on_Error
Use substitute value in case of error:
TRUE: Use substitute value
All affected infos are set to a defined status / value.
- With detected link error to the (IEC) partner, the substitute value is trans-
ferred into the image for all info points with the affected ASDU address.
Outgoing link errors do not affect the value directly.
This normally occurs via a general interrogation. This will be running, with
the resultant actual values.
- If a received information contains the set status bit 'NT' or 'IV', the substi-
tute value is only entered in the image for this information.
After receiving the relevant information with the status bits 'NT' and 'IV' not
set, the actual value is entered into the image again.
FALSE: Do not use substitute value
Last collected status / value will be kept even in the event of an error.
The use of substitute values is primarily useful if the image does not contain any sta-
tus information. The substitute value is specified with the following parameter
'Subst_Value'.
Subst_Value
Substitute value – only relevant if 'Subst_on_Error' is set (TRUE).
Internal_10
Used internally: Last parameter block found – do not change!
Internal_12
Used internally: Last info processed – do not change!
Note on error processing
Regardless of the use of substitute values (Parameter 'Global.Subst_on_Error'), the NT bit
in IEC images (Parameter 'Global.Image_Type') is always affected with an detected error.
The NT bit in the image is set for the relevant affected infos:
in case of link error detected with (IEC) partner
in case of NT bit set (not topical) in the received message
in case of IV bit set (invalid) in the received message
The updating of the infos is carried out in the same way as described when using substitute
values.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 156 of 235 ©SIEMENS AG 2013
Para_SP
Para per info (group)
Create any number of parameter blocks by setting the array value 'n’ accordingly
in the declaration view. In the data view the parameters can then be modified
individually.
refer in particular also to parameter 'P_No_of_fol_Infos'
S_Line
Reserved for future applications.
Must currently be set / remain on 1
S_ASDU
ASDU address of the (IEC / source) information being processed.
Created as an INT value for easier input. If values > 32767 have to be entered,
you either need to convert the data type to WORD (and enter hexadecimal) or
calculate a corresponding negative value.
S_Info
Information object address (IOA) of the (IEC / source) information being pro-
cessed
D_DB_No
Target position: This is the data block number for the image.
The value 0 causes the output to PAA (process image of the outputs) instead of
output to the data block.
D_Address
Target position: The image in the data block or PAA starts at this bit position.
The following are permitted depending on Image_Type:
Image_Type 1: Any values
Image_Type 2: Multiple of 8 (byte limits)
P_No_of_fol_Infos
This parameter simplifies the parameterization work in case of linear structure. It
also shortens program runtimes because in the ideal situation all infos can be
allocated with a few, or possibly just one parameter block.
Values not equal to 0 result in a sequential expansion of the above source and
target parameters, in other words in a range starting with S_Info or D_Address.
Starting with the base Info_address the following info addresses are processed
in accordance with the number given here.
The image position is calculated using 'D_Address' and the information position
multiplied by 'Image_Len'.
Info on data throughput
The IEC communication blocks each provides max. 1 user information per (OB1) cycle. In
the same OB1 cycle this information have to be processed / output by the process blocks.
This prevents on the one hand multiple outputs from one and the same information and
thus the loss of indication changes (if the images are also evaluated in the OB1). On the
other hand, this produces a direct dependency of the maximum data throughput with the
CPU cycle time, which is relevant in particular with high CPU load. In this case it can also
result in backlogs in the partner station.
With programming a suitable loop using the S7_IEC_Config Parameter
‚More_Info_available’ and ‚Next_Info’ an increasing of the data flow-rate per OB1 cycle can
be achieved with only slight increased cycle time. See also chapter 4.5.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 157 of 235 ©SIEMENS AG 2013
6.3.3.1. Single point information - MAo_SP_IM_pDB (FC140)
MAo_SP_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether they
contain single point information and transfers the useful data into images (DB or PAA) according to the
assigned parameter data block.
CALL "MAo_SP_IM_pDB"
Comp_ID :=B#16#2
P_Application:=#P_Appl
DB_No_Para_SP:=140
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes single point information messages with
TK 1, 2 or 30.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value (bit format)
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the NT bit
- in case of link failure to the IEC partner
- in case of NT bit set (not topical) in received message
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 158 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC140
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_SP
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_SP
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block can be found in the main
chapter.
Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1 Bit-Image, 2 IEC-Image, 3
IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#1
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated). For SP only
0 and 1 possible
Image_Type /
Image_Len
In the current version the block supports 3 versions of the message output with the
following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value / Bit output
1 (B#16#1)
X
2 (B#16#2)
IEC- Output
8 (B#16#8)
3 (B#16#3)
IEC-Format+ Ext_State
+Time
80 (B#16#50)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in depend-
ence of ,Image_Type’). Adaption is only necessary if a specific other (larger) image
length shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
In combination with single point information, only the value range 0 - 1 is appropri-
ate for Subst_Value.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 159 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position. De-
pending on Image_Type the following are permitted:
Image_Type 1: Any values (bit position)
Image_Type 2: Multiple of 8 (byte limits have to be kept)
Image_Type 3: Multiple of 8 (byte limits have to be kept)
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): Bit output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
7
6
5
4
3
2
1
0
0 - 7
1
15
14
13
12
11
10
9
8
8 – 15
2
...
17
16
16 ...
...
...
16
127
...127
…
...
In combination with sequential use (Parameter 'P_No_of_fol_Infos’) and 1 bit spacing (Image_Len), con-
nected ranges are produced as shown in the diagram. The output range can be in the PAA as well as in
data block(s) (Parameter 'D_DB_No’).
Image_Type 2 (B#16#02): 1 byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
IV
NT
SB
BL
-
-
-
SPI
0
1
IV
NT
SB
BL
-
-
-
SPI
8
2
IV
NT
SB
BL
-
-
-
SPI
16
…
…
127
IV
NT
SB
BL
-
-
-
SPI
1016
...
…
In IEC output format, the block sets the contained NT bit 'representative’ in the case of incoming link er-
rors. As an option, the status bit SPI is also affected depending on the parameter 'Subst_on_Error’.
Resultant structure:
1 byte per info
In this mode, the output is carried out by
the direct transfer of the entire infor-
mation 'SIQ’ from the IEC message.
The image therefore has the structure
shown opposite.
Resultant structure:
8 information per byte
Only the status of the EM (SPI = 1 Bit)
contained in the IEC message is read
and written to the relevant bit position
(Parameter’D_Address’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 160 of 235 ©SIEMENS AG 2013
Image_Type 3 (B#16#03): 1 Byte IEC-output
+ 1 Byte Ext_State
+ 8 Byte time
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
IV
NT
SB
BL
-
-
-
SPI
0
1
Res
Res
Res
LO
IV
SY
DS
TI
2
S7 Date and Time
3
4
5
6
7
8
9
10
IV
NT
SB
BL
-
-
-
SPI
80
11
Res
Res
Res
LO
IV
SY
DS
TI
12
S7 Date and Time
13
14
15
16
17
18
19
20
IV
NT
SB
BL
-
-
-
SPI
160
…
…
1270
IV
NT
SB
BL
-
-
-
SPI
10160
...
…
In the IEC output format the block sets ,substitutional’ the contained NT-Bit in case of appearing connec-
tion disturbances. As an option also the status bit SPI is affected depending on parameter
‚Subst_on_Error’.
Compared with ,Image_Type’ 2 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Resulting structure:
10 byte per information
In this mode the output is carried out
with direct transfer of the complete
information ,SIQ’ from the IEC mes-
sage.
Subsequently
1 byte Ext_State and
8 byte S7 Date and Time
The image has so the adjoining struc-
ture.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 161 of 235 ©SIEMENS AG 2013
‚Ext_State’ and ,S7 Date and Time’ in detail
Ext_State
The status byte serves prior for handing over the time status bits which are not supported from the S7-Date
and Time format.
Bit 7
Bit 6
Bit 5
Bit 4
Bit 3
Bit 2
Bit 1
Bit 0
Res
Res
Res
LO
IV
SY
DS
TI
TI: The TI-Bit is always set from MAo-Block.
From SLi-Blocks the status bits (DS, SY, IV) are only taken over if the
TI-Bit is set.
DS: Daylight Saving Time
Direct transfer from IEC-Message with full time stamp, otherwise
Transfer from time status, carried in the CPU (FB100-Parameter Time_DS).
SY: Synchronized
Transfer from time status, carried in the CPU (FB100-Parameter Time_DS).
The bit is not used in IEC-Messages and serves only for information.
IV: Invalid
IV is built as follows
Receive message
IV
With full time stamp
Direct transfer from IEC-Message
With part time stamp
Set, if the IV-bit in the IEC-Message or
in the time status carried in the CPU
is set (FB100-Parameter Time_IV).
without time stamp
Transfer from time status, carried in the CPU (FB100-
Parameter Time_IV)
LO: Local time is set if the FB100-Parameter Time_Diff <> 0.
Transfer from time status, carried in the CPU.
The bit is not used in IEC-Messages and serves only for information.
S7 Date
and Time
Date and Time in S7-Format
The time is built as follows
Receive message
S7 Date and Time
With full time stamp
Transfer of the time from IEC-Message.
With part time stamp
The part time from IEC-Message
is completed to full time with the time carried in the CPU
without time stamp
Transfer of the time carried in the CPU
The images are initialized with the actual time of the CPU
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 162 of 235 ©SIEMENS AG 2013
6.3.3.2. Double point information - MAo_DP_IM_pDB (FC141)
MAo_DP_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether they
contain double point information infos and transfers the useful data into images (DB or PAA) according to
the assigned parameter data block.
CALL "MAo_DP_IM_pDB"
Comp_ID :=B#16#3
P_Application:=#P_Appl
DB_No_Para_DP:=141
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes double point information messages with
TK 3, 4 or 31.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value (bit format)
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the NT bit
- in case of link failure to the IEC partner
- in case of NT bit set (not topical) in received message
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 163 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC141
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_DP
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_DP
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block can be found in the main
chapter.
Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1 Bit-Image, 2 IEC-Image, 3
IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#2
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated). For DP only
0, 1, 2 or 3 possible
Image_Type /
Image_Len
In the current version the block supports 2 versions of the message output with the
following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value / Bit output
2 (B#16#2)
X
2 (B#16#2)
IEC- output
8 (B#16#8)
3 (B#16#3)
IEC-Format+
Ext_State+Time
80 (B#16#50)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in depend-
ence of ,Image_Type’). Adaption is only necessary if a specific other (larger) image
length shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
In combination with double point information, only the value range 0 - 3 is appro-
priate for Subst_Value.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 164 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position. De-
pending on Image_Type the following are permitted:
Image_Type 1: Any values (bit position)
Image_Type 2: Multiple of 8 (byte limits) have to be kept)
Image_Type 3: Multiple of 8 (byte limits have to be kept)
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): Bit output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Info 3
Info 2
Info 1
Info 0
0, 2, ...
1
Info 7
Info 6
Info 5
Info 4
8, 10, ...
2
...
9
Info 8
16, 18 ...
...
...
16
63
... 126
…
...
In combination with sequential use (Parameter 'P_No_of_fol_Infos’) and 2 bit spacing (Image_Len), con-
nected ranges are produced as shown in the diagram. The output range can be in the PAA as well as in
data block(s) (Parameter 'D_DB_No’).
Image_Type 2 (B#16#02): 1 byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
IV
NT
SB
BL
-
-
DPI
0
1
IV
NT
SB
BL
-
-
DPI
8
2
IV
NT
SB
BL
-
-
DPI
16
…
DPI
…
127
IV
NT
SB
BL
-
-
DPI
1016
...
…
In IEC output format, the block sets the contained NT bit 'representative’ in the case of incoming link er-
rors. As an option, the status bit DPI is also affected depending on the parameter 'Subst_on_Error’.
Resultant structure:
1 byte per info
In this mode the output is carried out by
the direct transfer of the entire infor-
mation 'DIQ’ from the IEC message.
The image therefore has the structure
shown opposite.
Resultant structure:
4 infos per byte
Only the status of the DM contained in the
IEC message (DPI = 2 bits) is read and
written to the relevant bit position (Param-
eter 'D_Address’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 165 of 235 ©SIEMENS AG 2013
Image_Type 3 (B#16#03): 1 Byte IEC-output
+ 1 Byte Ext_State
+ 8 Byte time
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
IV
NT
SB
BL
-
-
DPI
0
1
Res
Res
Res
LO
IV
SY
DS
TI
2
S7 Date and Time
3
4
5
6
7
8
9
10
IV
NT
SB
BL
-
-
DPI
80
11
Res
Res
Res
LO
IV
SY
DS
TI
12
S7 Date and Time
13
14
15
16
17
18
19
20
IV
NT
SB
BL
-
-
DPI
160
…
…
1270
IV
NT
SB
BL
-
-
DPI
10160
...
…
In the IEC output format the block sets ,substitutional’ the contained NT-Bit in case of appearing connec-
tion disturbances. As an option also the status bit DPI is affected depending on parameter
‚Subst_on_Error’.
Compared with ,Image_Type’ 2 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Detailed information to ‚Ext_State’ and ,S7 Date and Time’ see chapter 6.3.3.1.
Resulting structure:
10 byte per information
In this mode the output is carried out
with direct transfer of the complete
information ,DIQ’ from the IEC mes-
sage.
Subsequently
1 byte Ext_State and
8 byte S7 Date and time
The image has so the adjoining struc-
ture.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 166 of 235 ©SIEMENS AG 2013
6.3.3.3. Step position information - MAo_ST_IM_pDB (FC142)
MAo_ST_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether they
contain step position information and transfers the useful data into images (DB or PAA) according to the
assigned parameter data block..
CALL "MAo_ST_IM_pDB"
Comp_ID :=B#16#4
P_Application:=#P_Appl
DB_No_Para_ST:=142
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes step position information with
TK 5, 6 or 32.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value (bit format)
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the NT bit
- in case of link failure to the IEC partner
- in case of NT bit set (not topical) in received message
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
An EXCEL based help tool for a fast production of parameter-DBs (AWL sources) particu-
larly for larger number of data points and integration of external data sources (Excel lists)
is available on inquiry.
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 167 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC142
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_ST
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_ST
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block can be found in the main
chapter.
Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1: 1 Byte excl.T, 2: 1 Byte incl. T, 3: IEC 2
Bytes; 4: IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#8
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated)
Image_Type /
Image_Len
In the current version the block supports 3 versions of the message output with the
following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value / Byte output
without intermediate posi-
tion display (T)
8 (B#16#8)
X
2 (B#16#2)
Raw value / Byte output
with Intermediate position
display (T)
8 (B#16#8)
3 (B#16#3)
IEC- Output
16 (B#16#10)
4 (B#16#4)
IEC-Format+
Ext_State+Time
88 (B#16#58)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in depend-
ence of ,Image_Type’). Adaption is only necessary if a specific other (larger) image
length shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
Permissible values are 0 to 255.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 168 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position. Re-
gardless of Image_Type, 'D_Address’ has to be a multiple of 8 (byte limits have to
be observed).
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): 1 Byte Byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
-
Info 1
0
1
-
Info 2
8
2
-
Info 3
16
...
-
…
...
16
-
Info 17
128
…
-
...
In combination with sequential use (Parameter 'P_No_of_fol_Infos’) and 8 bit spacing (Image_Len), con-
nected ranges are produced as shown in the diagram. The output range can be in the PAA as well as in
data block(s) (Parameter 'D_DB_No’)
Image_Type 2 (B#16#02): 1 Byte Byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
T
Info 1
0
1
T
Info 2
8
2
T
Info 3
16
...
T
...
...
16
T
Info 17
128
…
T
...
Image_Type 3 (B#16#03): 2 Byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
T
Info 1
0
Byte 1
IV
NT
SB
BL
-
-
-
OV
Byte 2
T
Info 2
16
Byte 3
IV
NT
SB
BL
-
-
-
OV
Byte 4
T
Info 3
32
Byte 5
IV
NT
SB
BL
-
-
-
OV
…
T
…
...
…
IV
NT
SB
BL
-
-
-
OV
Byte16
T
Info 9
128
…
IV
NT
SB
BL
-
-
-
OV
…
T
…
136
…
IV
NT
SB
BL
-
-
-
OV
In IEC output format, the block sets the contained NT bit 'representative’ in the case of incoming link er-
rors. As an option, the value of the information is also affected depending on the parameter
'Subst_on_Error’.
Resultant structure:
2 bytes per info
In this mode the output is carried out by
the direct transfer of the entire infor-
mation 'VTI’ and 'QDS’ from the IEC
message.
The image therefore has the structure
shown opposite.
Resultant structure:
1 byte per information
Only the value (value = 7 Bit) of the level
setting contained in the IEC message is
read and written to the relevant bit posi-
tion (Parameter 'D_Address’).
Resultant structure:
1 byte per info
The value (value = 7 Bit) of the level set-
ting contained in the IEC message is
read and written to the relevant bit posi-
tion (Parameter 'D_Address’).
In addition, with 'T’ .
T=0: Equipment is not in intermediate
state
T=1: Equipment is in intermediate state
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 169 of 235 ©SIEMENS AG 2013
Image_Type 4 (B#16#04): 2 Byte IEC-Output
+ 1 Byte Ext_State
+ 8 Byte Time
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
T
Info 1
0
1
IV
NT
SB
BL
-
-
-
OV
2
Res
Res
Res
LO
IV
SY
DS
TI
3
S7 Date and Time
4
5
6
7
8
9
10
11
T
Info 2
88
12
IV
NT
SB
BL
-
-
-
OV
13
Res
Res
Res
LO
IV
SY
DS
TI
14
S7 Date and Time
15
16
17
18
19
20
21
22
T
Info 3
176
…
IV
NT
SB
BL
-
-
-
OV
…
…
77
T
Info 9
616
…
IV
NT
SB
BL
-
-
-
OV
…
…
In the IEC output format the block sets ,substitutional’ the contained NT-Bit in case of appearing connec-
tion disturbances. As an option also the value of the information is affected depending on parameter
‚Subst_on_Error’.
Compared with ,Image_Type’ 3 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Detailed information to ‚Ext_State’ and ,S7 Date and Time’ see chapter 6.3.3.1.
Resulting structure:
11 byte per information
In this mode the output is carried out
with direct transfer of the complete
information ,VTI’ and ,QDS’ from the
IEC message.
Subsequently
1 byte Ext_State and
8 byte S7 Date and time
The image has so the adjoining struc-
ture.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 170 of 235 ©SIEMENS AG 2013
6.3.3.4. Bit pattern messages - MAo_BO_IM_pDB (FC143)
MAo_BO_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether they
contain bit pattern messages and transfers the useful data into images (DB or PAA) according to the as-
signed parameter data block.
CALL "MAo_BO_IM_pDB"
Comp_ID :=B#16#5
P_Application:=#P_Appl
DB_No_Para_BO:=143
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes bit pattern messages with
TK 7, 8 or 33.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the NT bit
- in case of link failure to the IEC partner
- in case of NT bit set (not topical) in received message
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
An EXCEL based help tool for a fast production of parameter-DBs (AWL sources) particu-
larly for larger number of data points and integration of external data sources (Excel lists)
is available on inquiry.
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 171 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC143
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_SP
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_SP
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block can be found in the main
chapter. Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#4
1-4: 1 - 4 Byte Bit pattern , 5: IEC 5 Bytes;
6: IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#20
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated)
Image_Type /
Image_Len
In the current version the block supports 5 versions of the message output with the
following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value output
1 Byte bit pattern length
8 (B#16#8)
2 (B#16#2)
Raw value output
2 Byte bit pattern length
16 (B#16#10)
3 (B#16#3)
Raw value output
3 Byte bit pattern length
24 (B#16#18)
4 (B#16#4)
Raw value output
4 Byte bit pattern length
32 (B#16#20)
X
5 (B#16#5)
IEC- Output
40 (B#16#28)
6 (B#16#6)
IEC-Format+
Ext_State+Time
112 (B#16#70)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in depend-
ence of ,Image_Type’). Adaption is only necessary if a specific other (larger) image
length shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
Permissible values are 0 to 255 in each case in every byte.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 172 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position.. De-
pending on Image_Type, 'D_Address’ has to be a multiple of 8 (byte limits have to
be observed).
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): 1 byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
8-bit bit pattern (Info 1)
0
1
8-bit bit pattern (Info 2)
8
2
8-bit bit pattern (Info 3)
16
...
...
...
16
8-bit bit pattern (Info 17)
128
…
...
In combination with sequential use (Parameter 'P_No_of_fol_Infos’) and 8 bit spacing (Image_Len), con-
nected ranges are produced as shown in the diagram. The output range can be in the PAA as well as in
data block(s) (Parameter 'D_DB_No’).
Image_Type 2 (B#16#02): 2-byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
16-bit bit pattern (Info 1)
0
1
2
16-bit bit pattern (Info 2)
16
3
4
16-bit bit pattern (Info 3)
32
5
…
…
...
…
32
16-bit bit pattern (Info 17)
256
33
…
…
...
…
Image_Type 3 (B#16#03): 3-byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
24-bit bit pattern (Info 1)
0
1
2
3
24-bit bit pattern (Info 2)
24
4
5
6
24-bit bit pattern (Info 3)
48
7
8
…
…
...
…
...
48
24-bit bit pattern (Info 17)
384
49
...
…
…
...
...
…
...
Resultant structure:
3 bytes per information
Only the first 3 bytes of the bit pattern
(24 bit) contained in the IEC message
are read and written to the relevant bit
position (Parameter 'D_Address’).
Resultant structure:
2 bytes per information
Only the first 2 bytes of the bit pattern
(16 bit) contained in the IEC message
are read and written to the relevant bit
position (Parameter 'D_Address’).
Resultant structure:
1 byte per information
Only the first byte of the bit pattern (8 bit)
contained in the IEC message is read
and written to the relevant bit position
(Parameter 'D_Address’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 173 of 235 ©SIEMENS AG 2013
Image_Type 4 (B#16#04): 4-byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
32-bit bit pattern (Info 1)
0
1
2
3
4
32-bit bit pattern (Info 2)
32
5
6
7
8
32-bit bit pattern (Info 3)
64
9
10
11
…
…
...
…
…
…
64
32-bit bit pattern (Info 17)
512
65
66
67
…
…
...
…
…
…
Image_Type 5 (B#16#05): 5 Byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
32-bit bit pattern (Info 1)
0
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
32-bit bit pattern (Info 2)
40
6
7
8
9
IV
NT
SB
BL
-
-
-
OV
10
32-bit bit pattern (Info 3)
80
11
12
13
14
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
…
…
IV
NT
SB
BL
-
-
-
OV
80
32-bit bit pattern (Info 17)
640
81
82
83
84
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
…
…
IV
NT
SB
BL
-
-
-
OV
In IEC output format, the block sets the contained NT bit 'representative’ in the case of incoming link er-
rors. As an option, the value of the information is also affected depending on parameter 'Subst_on_Error’.
Resultant structure:
5 bytes per information
In this mode, the output is carried out by
the direct transfer of the entire infor-
mation 'BSI’ and 'QDS’ from the IEC
message.
The image therefore has the structure
shown opposite.
Resultant structure:
4 bytes per information
All 4 bytes of the bit pattern (32 bit) con-
tained in the IEC message are read and
written to the relevant bit position (Pa-
rameter 'D_Address’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 174 of 235 ©SIEMENS AG 2013
Image_Type 6 (B#16#06): 5 Byte IEC-Output
+ 1 Byte Ext_State
+ 8 Byte Time
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
32 Bit Bit pattern (Info 1)
0
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
Res
Res
Res
LO
IV
SY
DS
TI
6
S7 Date and Time
7
8
9
10
11
12
13
14
32 Bit Bit pattern (Info 2)
112
15
16
17
18
IV
NT
SB
BL
-
-
-
OV
19
Res
Res
Res
LO
IV
SY
DS
TI
20
S7 Date and Time
21
22
23
24
25
26
27
28
32 Bit Bit pattern (Info …)
224
…
…
…
…
IV
NT
SB
BL
-
-
-
OV
…
Res
Res
Res
LO
IV
SY
DS
TI
…
S7 Date and Time
…
…
…
…
…
…
…
In the IEC output format the block sets ,substitutional’ the contained NT-Bit in case of appearing connec-
tion disturbances. As an option also the value of the information is affected depending on parameter
‚Subst_on_Error’.
Compared with ,Image_Type’ 5 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Detailed information to ‚Ext_State’ and ,S7 Date and Time’ see chapter 6.3.3.1.
Resulting structure:
14 byte per information
In this mode the output is carried out with
direct transfer of the complete infor-
mation ,BSI’ and ,QDS’ from the IEC
message.
Subsequently
1 byte Ext_State and
8 byte S7 Date and time
The image has so the adjoining struc-
ture.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 175 of 235 ©SIEMENS AG 2013
6.3.3.5. Measured values - MAo_ME_NA_IM_pDB (FC144)
MAo_ME_NA_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether
they contain measured values in the normalized format and transfers the useful data into images (DB or
PAA) according to the assigned parameter data block.
CALL "MAo_ME_NA_IM_pDB"
Comp_ID :=B#16#6
P_Application:=#P_Appl
DB_No_Para_ME:=144
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes measured value messages with normalized value with
TK 9,10 or 34.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the NT bit
- in case of link failure to the IEC partner
- in case of NT bit set (not topical) in received message
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
An EXCEL based help tool for a fast production of parameter-DBs (AWL sources) particu-
larly for larger number of data points and integration of external data sources (Excel lists)
is available on inquiry.
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 176 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC144
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_ME
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_ME
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block, can be found in the
main chapter. Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1: Measured value 2 Bytes, 2: IEC, 3
IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#10
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated)
Image_Type /
Image_Len
In the current version, the block supports 2 versions of the measured value output
with the following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value output
2 Byte measurand (Integer)
16 (B#16#10)
X
2 (B#16#2)
IEC- Output
2 Byte measurand (Integer)
+
1 Byte Status
24 (B#16#18)
3 (B#16#3)
IEC-Format+
Ext_State+Time
96 (B#16#60)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in dependence
of ,Image_Type’). Adaption is only necessary if a specific other (larger) image length
shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
Permissible values are -32767 to +32767.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 177 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position. De-
pending on Image_Type, 'D_Address’ must be a multiple of 8 (byte limits have to
be observed).
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): 2-byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measured value (Info 1)
S7 integer
0
1
2
Measured value (Info 2)
S7 integer
16
3
4
Measured value (Info 3)
S7 integer
32
5
…
…
...
…
32
Measured value (Info 17)
S7 integer
256
33
…
…
...
…
In combination with sequential use (Parameter 'P_No_of_fol_Infos’) and 16 bit spacing (Image_Len),
connected ranges are produced as shown in the diagram. The output range can be in the PAA as well as
in data block(s) (Parameter 'D_DB_No’).
Image_Type 2 (B#16#02): 3 Byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measured value (Info 1)
S7 integer
0
1
2
IV
NT
SB
BL
-
-
-
OV
3
Measured value (Info 2)
S7 integer
24
4
5
IV
NT
SB
BL
-
-
-
OV
6
Measured value (Info 3)
S7 integer
48
7
8
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
IV
NT
SB
BL
-
-
-
OV
48
Measured value (Info 17)
S7 integer
384
49
50
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
IV
NT
SB
BL
-
-
-
OV
In IEC output format, the block sets the contained NT bit 'representative’ in the case of incoming link er-
rors. As an option, the value of the information is also affected depending on the parameter
'Subst_on_Error’.
Resultant structure:
3 bytes per information
In this mode, the output is carried out by
the direct transfer of the entire infor-
mation 'NVA’ and 'QDS’ from the IEC
message.
The image therefore has the structure
shown opposite.
The value of the normalized measured
values contained in the IEC message (15
bit + VZ) is stored in the image in S7 in-
teger format.
Resultant structure:
2 bytes per information
Only the value of the normalized meas-
ured values contained in the IEC mes-
sage (15 bit + VZ) are read and written in
S7 integer format to the relevant bit posi-
tion (Parameter 'D_Address’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 178 of 235 ©SIEMENS AG 2013
Image_Type 3 (B#16#03): 3 Byte IEC-Output
+ 1 Byte Ext_State
+ 8 Byte Time
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measurand (Info 1)
S7-Integer
0
1
2
IV
NT
SB
BL
-
-
-
OV
3
Res
Res
Res
LO
IV
SY
DS
TI
4
S7 Date and Time
5
6
7
8
9
10
11
12
Measurand (Info 2)
S7-Integer
144
13
14
IV
NT
SB
BL
-
-
-
OV
15
Res
Res
Res
LO
IV
SY
DS
TI
16
S7 Date and Time
17
18
19
20
21
22
23
24
Measurand (Info 3)
S7-Integer
288
…
…
IV
NT
SB
BL
-
-
-
OV
…
Res
Res
Res
LO
IV
SY
DS
TI
…
S7 Date and Time
…
…
…
…
…
…
…
In the IEC output format the block sets ,substitutional’ the contained NT-Bit in case of appearing connec-
tion disturbances. As an option also the value of the information is affected depending on parameter
‚Subst_on_Error’.
Compared with ,Image_Type’ 2 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Detailed information to ‚Ext_State’ and ,S7 Date and Time’ see chapter 6.3.3.1.
Resulting structure:
12 byte per information
In this mode the output is carried out with
direct transfer of the complete infor-
mation ,NVA’ and ,QDS’ from the IEC
message.
The value of the standardized measur-
and (15 Bit + VZ) from the IEC message
is stored in the image in S7-Integer For-
mat
Subsequently
1 byte Ext_State and
8 byte S7 Date and time
The image has so the adjoining struc-
ture.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 179 of 235 ©SIEMENS AG 2013
6.3.3.6. Measured values - MAo_ME_NB_IM_pDB (FC145)
MAo_ME_NB_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether
they contain measured values in the scaled format and transfers the useful data into images (DB or PAA)
according to the assigned parameter data block.
CALL "MAo_ME_NB_IM_pDB"
Comp_ID :=B#16#7
P_Application:=#P_Appl
DB_No_Para_ME:=145
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes measured value messages with scaled value with
TK 11,12 or 35.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the NT bit
- in case of link failure to the IEC partner
- in case of NT bit set (not topical) in received message
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 180 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC145
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_ME
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_ME
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block, can be found in the
main chapter. Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1: Measured value 2 Bytes, 2: IEC, 3
IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#10
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated)
Image_Type /
Image_Len
In the current version, the block supports 2 versions of the measured value output
with the following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value output
2 Byte Measurand (Integer)
16 (B#16#10)
X
2 (B#16#2)
IEC- Output
2 Byte Measurand (Integer)
+
1 Byte Status
24 (B#16#18)
3 (B#16#3)
IEC-Format+
Ext_State+Time
96 (B#16#60)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in depend-
ence of ,Image_Type’). Adaption is only necessary if a specific other (larger) image
length shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
Permissible values are -32767 to +32767.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 181 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position. De-
pending on Image_Type, 'D_Address’ must be a multiple of 8 (byte limits have to
be observed).
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): 2-byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measured value (Info 1)
S7 integer
0
1
2
Measured value (Info 2)
S7 integer
16
3
4
Measured value (Info 3)
S7 integer
32
5
…
…
...
…
32
Measured value (Info 17)
S7 integer
256
33
…
…
...
…
In combination with sequential use (Parameter 'P_No_of_fol_Infos’) and 16 bit spacing (Image_Len),
connected ranges are produced as shown in the diagram. The output range can be in the PAA as well as
in data block(s) (Parameter 'D_DB_No’).
Image_Type 2 (B#16#02): 3 Byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measured value (Info 1)
S7 integer
0
1
2
IV
NT
SB
BL
-
-
-
OV
3
Measured value (Info 2)
S7 integer
24
4
5
IV
NT
SB
BL
-
-
-
OV
6
Measured value (Info 3)
S7 integer
48
7
8
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
IV
NT
SB
BL
-
-
-
OV
48
Measured value (Info 17)
S7 integer
384
49
50
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
IV
NT
SB
BL
-
-
-
OV
In IEC output format, the block sets the contained NT bit 'representative’ in the case of incoming link er-
rors. As an option, the value of the information is also affected depending on the parameter
'Subst_on_Error’.
Resultant structure:
3 bytes per information
In this mode, the output is carried out by
the direct transfer of the entire infor-
mation 'SVA’ and 'QDS’ from the IEC
message.
The image therefore has the structure
shown opposite.
The value of the scaled measured values
contained in the IEC message (15 bit +
VZ) is stored in the image in S7 integer
format.
Resultant structure:
2 bytes per information
Only the value of the scaled measured
values contained in the IEC message (15
bit + VZ) are read and written to the rele-
vant bit position (Parameter 'D_Address’)
in S7 integer format.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 182 of 235 ©SIEMENS AG 2013
Image_Type 3 (B#16#03): 3 Byte IEC-Output
+ 1 Byte Ext_State
+ 8 Byte Time
Byte 0
Measurand (Info 1)
S7-Integer
0
1
2
IV
NT
SB
BL
-
-
-
OV
3
Res
Res
Res
LO
IV
SY
DS
TI
4
S7 Date and Time
5
6
7
8
9
10
11
12
Measurand (Info 2)
S7-Integer
144
13
14
IV
NT
SB
BL
-
-
-
OV
15
Res
Res
Res
LO
IV
SY
DS
TI
16
S7 Date and Time
17
18
19
20
21
22
23
24
Measurand (Info 3)
S7-Integer
288
…
…
IV
NT
SB
BL
-
-
-
OV
…
Res
Res
Res
LO
IV
SY
DS
TI
…
S7 Date and Time
…
…
…
…
…
…
…
In the IEC output format the block sets ,substitutional’ the contained NT-Bit in case of appearing connec-
tion disturbances. As an option also the value of the information is affected depending on parameter
‚Subst_on_Error’.
Compared with ,Image_Type’ 2 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Detailed information to ‚Ext_State’ and ,S7 Date and Time’ see chapter 6.3.3.1.
Resulting structure:
12 byte per information
In this mode the output is carried out with
direct transfer of the complete infor-
mation ,SVA’ and ,QDS’ from the IEC
message.
The value of the scaled measurand (15
Bit + VZ) from the IEC message is stored
in the image in S7-Integer Format
Subsequently
1 byte Ext_State and
8 byte S7 Date and time
The image structure is shown in the ad-
joining figure.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 183 of 235 ©SIEMENS AG 2013
6.3.3.7. Measured values - MAo_ME_NC_IM_pDB (FC146)
MAo_ME_NC_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether
they contain measured values in short floating point number format and transfers the useful data into im-
ages (DB and PAA) according to the assigned parameter data block.
CALL "MAo_ME_NC_IM_pDB"
Comp_ID :=B#16#8
P_Application:=#P_Appl
DB_No_Para_ME:=146
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes measured value messages with short floating point number with
TK13, 14 or 36.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the NT bit
- in case of link failure to the IEC partner
- in case of NT bit set (not topical) in received message
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 184 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC146
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_SP
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_SP
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block, can be found in the
main chapter. Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1: Measured value 4 Bytes, 2: IEC 5
Bytes, 3 IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#20
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
REAL
0.0e+0
Substitute value (if activated)
Image_Type /
Image_Len
In the current version, the block supports 2 versions of the measured value output
with the following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value output
4 Byte Meas. (Short Real)
32 (B#16#20)
X
2 (B#16#2)
IEC- Output
4 Byte Meas. (Short Real) +
1 Byte Status
40 (B#16#28)
3 (B#16#3)
IEC-Format+
Ext_State+Time
112 (B#16#70)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in depend-
ence of ,Image_Type’). Adaption is only necessary if a specific other (larger) image
length shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
Permissible values are any floating point values in the format x.y.
(e.g.: 0.0, -1234.5678, 9.876543, …)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 185 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position. De-
pending on Image_Type, 'D_Address’ must be a multiple of 8 (byte limits have to
be observed).
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): 4-byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measured value (Info 1)
S7 short real
0
1
2
3
4
Measured value (Info 2)
S7 short real
32
5
6
7
8
Measured value (Info 3)
S7 short real
64
9
10
11
…
…
...
…
…
…
64
Measured value (Info 17)
S7 short real
512
65
66
67
…
…
...
…
…
…
In combination with sequential use (Parameter 'P_No_of_fol_Infos’) and 16 bit spacing (Image_Len),
connected ranges are produced as shown in the diagram. The output range can be in the PAA as well as
in data block(s) (Parameter 'D_DB_No’).
Resultant structure:
4 bytes per info
Only the value of the measured values
contained in the IEC message (4 byte,
short floating point number) are read and
written in S7 short real format to the rele-
vant bit position (Parameter
'D_Address’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 186 of 235 ©SIEMENS AG 2013
Image_Type 2 (B#16#02): 5 Byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measured value (Info 1)
S7 short real
0
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
Measured value (Info 2)
S7 short real
40
6
7
8
9
IV
NT
SB
BL
-
-
-
OV
10
Measured value (Info 3)
S7 short real
80
11
12
13
14
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
…
…
IV
NT
SB
BL
-
-
-
OV
80
Measured value (Info 17)
S7 short real
640
81
82
83
84
IV
NT
SB
BL
-
-
-
OV
…
…
...
…
…
…
…
IV
NT
SB
BL
-
-
-
OV
In IEC output format, the block sets the contained NT bit 'representative’ in the case of incoming link er-
rors. As an option, the value of the information is also affected depending on the parameter
'Subst_on_Error’.
Resultant structure:
5 bytes per information
In this mode, the output is carried out by
the direct transfer of the entire infor-
mation 'IEEE STD 754’ and 'QDS’ from
the IEC message.
The image therefore has the structure
shown opposite.
The value of the measured values con-
tained in the IEC message (4 byte, short
floating point number) is stored in the im-
age in S7 short real format.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 187 of 235 ©SIEMENS AG 2013
Image_Type 3 (B#16#03): 5 Byte IEC-Output
+ 1 Byte Ext_State
+ 8 Byte Time
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
Measurand (Info 1)
S7-Short-Real
0
1
2
3
4
IV
NT
SB
BL
-
-
-
OV
5
Res
Res
Res
LO
IV
SY
DS
TI
6
S7 Date and Time
7
8
9
10
11
12
13
14
Measurand (Info 2)
S7-Short-Real
40
15
16
17
18
IV
NT
SB
BL
-
-
-
OV
19
Res
Res
Res
LO
IV
SY
DS
TI
20
S7 Date and Time
21
22
23
24
25
26
27
28
Measurand (Info 3)
S7-Short-Real
80
…
…
…
…
IV
NT
SB
BL
-
-
-
OV
…
Res
Res
Res
LO
IV
SY
DS
TI
…
S7 Date and Time
…
…
…
…
…
…
…
In the IEC output format the block sets ,substitutional’ the contained NT-Bit in case of appearing connec-
tion disturbances. As an option also the value of the information is affected depending on parameter
‚Subst_on_Error’.
Compared with ,Image_Type’ 2 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Detailed information to ‚Ext_State’ and ,S7 Date and Time’ see chapter 6.3.3.1.
Resulting structure:
14 byte per information
In this mode the output is carried out with
direct transfer of the complete infor-
mation ‚IEEE STD 754’ and ,QDS’ from
the IEC message.
The value of the measurand (4 Byte
shortened floating point) from the IEC
message is stored in the image in S7-
Short-Real Format
Subsequently
1 byte Ext_State and
8 byte S7 Date and time
The image has so the adjoining struc-
ture.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 188 of 235 ©SIEMENS AG 2013
6.3.3.8. Integrated totals - MAo_IT_IM_pDB (FC147)
MAo_IT_IM_pDB is a function (FC) which monitors receive messages from the IEC link whether they con-
tain integrated totals and transfers the useful data into images (DB or PAA) according to the assigned pa-
rameter data block.
CALL "MAo_IT_IM_pDB"
Comp_ID :=B#16#9
P_Application:=#P_Appl
DB_No_Para_IT:=147
FC_RetVal :=#T_RetVal
Illustration as CFC block with default values
Illustration in AWL with parameter provision
Important features are:
The block processes count value messages with
TK 15, 16 or 37.
The FC can be used in CFC plans as well as in KOP/FUP/AWL with minimal interconnection
work. The allocation of parameter DB and pointer to IEC link (P_Application) are sufficient.
The routing of the info points to the required image positions is carried out in a data block and
is…
- exceptionally effective with sequential IEC address ranges for a large number of info
points each with just one parameter entry
- individually possible for each IEC address
Multiple output - image versions can be parameterized (in parameter data block):
- Raw value
- IEC- Format
- IEC- Format and time stamp
- For details see subsequent description
Output direct to PAA or into data block
Integrated error processing with programmable substitute value and influence on the IV bit
- in case of link failure to the IEC partner
- in case of IV bit (invalid) in received message
Simple handling of the parameter data blocks:
- A default DB with the same number as FC is supplied as well in the block library and can
be modified immediately (Simatic Manager).
From V1.5 the block only accepts the causes of transmission (COT) which are permissible in
the list of interoperability. If an information is rejected because of 'unknown' COT, this is sig-
naled at the newly established FC_RetVal exit. FC_RetVal also shows how many information
objects have been processed from the block in the current call.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 189 of 235 ©SIEMENS AG 2013
Block variables of the FC with their default assignment and brief comment
FC147
Type
Block comment / brief description
Comp_ID
IN
BYTE
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
DB_No_Para_IT
IN
INT
Number of Data Block (DB) which contains the param-
eters for this function
FC_RetVal
OUT
WORD
Neg. values: Error-Codes; Pos. values: No of pro-
cessed info
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application’ output of the block
'S7_IEC_Config’ (FB100). It refers to all data required internally such as send and
receive buffer, etc..
DB_No_Para_IT
DB no. of the associated parameter data block.
FC_RetVal
Positive FC_RetVal values:
0: ok
1-n: number of information processed in the current cycle
7001h partner disturbance coming (Error_Link)
Negative FC_RetVal values:
8112h: P_Application - fault
8302h unknown cause of transmission (COT) received
Block-specific values in the parameter data block:
The entire structure, as well as the basic description of the parameter data block, can be found in the
main chapter. Only the type-specific details are considered at this point:
Global.
Image_Type
2.0
22.0
BYTE
B#16#1
1: Counter Value (4 Bytes), 2: IEC,
3: IEC+Ext_State+Time
Global.
Image_Len
3.0
23.0
BYTE
B#16#20
0: auto (standard); <> 0: fixed distance [Bit]
of process images
Global.
Subst_on_Error
4.0
24.0
BOOL
TRUE
Substitute values in case of connection er-
rors ?
Global.
Subst_Value
6.0
26.0
DWORD
DW#16#0
Substitute value (if activated)
Image_Type /
Image_Len
In the current version the block supports 2 versions of the message output with the
following dependencies of Image_Len to Image_Type:
Image_Type
Signification
Image_Len
Default
1 (B#16#1)
Raw value output
4 Byte integrated total
32 (B#16#20)
X
2 (B#16#2)
IEC- Output
40 (B#16#28)
3 (B#16#3)
IEC-Format+
Ext_State+Time
112 (B#16#70)
From V1.1 ,Image_Len’ is pre-allocated with 0 (automatic calculation in depend-
ence of ,Image_Type’). Adaption is only necessary if a specific other (larger) image
length shall be created.
For more details, refer to the pages below.
Subst_on_Error /
Subst_Value
The substitute value (Subst_Value) in case of a link error is only relevant if
'Subst_on_Error’ is set.
Permissible values are 0 to 232-1.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 190 of 235 ©SIEMENS AG 2013
Para_[x].
D_Address
+10.0
44.0
DINT
L#0
Dest. (target): Bit position
D_Address
Target position: The image in the data block or PAA starts at this bit position. De-
pending on Image_Type, 'D_Address’ must be a multiple of 8 (byte limits have to
be observed).
The image versions (Image_Type) in detail
Image_Type 1 (B#16#01): 4-byte output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
32-bit integrated total (Info 1)
0
1
2
3
4
32-bit integrated total (Info 2)
32
5
6
7
8
32-bit integrated total (Info 3)
64
9
10
11
…
…
...
…
…
…
64
32-bit integrated total (Info 17)
512
65
66
67
…
…
...
…
…
…
In combination with the sequential use (Parameter 'P_No_of_fol_Infos’) and 32 bit spacing (Image_Len),
connected ranges are produced as shown in the diagram. The output range can be in the PAA as well as
in data block(s) (Parameter 'D_DB_No’)
Resultant structure:
4 bytes per information
The integrated total contained in the IEC
message (32 bit) is read and written to
the relevant bit position (Parameter
'D_Address’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 191 of 235 ©SIEMENS AG 2013
Image_Type 2 (B#16#02): 5 Byte IEC output:
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
32-bit integrated total (Info 1)
0
1
2
3
4
IV
CA
CY
Sequence number
5
32-bit integrated total (Info 2)
40
6
7
8
9
IV
CA
CY
Sequence number
10
32-bit integrated total (Info 3)
80
11
12
13
14
IV
CA
CY
Sequence number
…
…
...
…
…
…
…
IV
CA
CY
Sequence number
80
32-bit integrated total (Info 17)
640
81
82
83
84
IV
CA
CY
Sequence number
…
…
...
…
…
…
…
IV
CA
CY
Sequence number
Resultant structure:
5 bytes per information
In this mode, the output is carried out by
the direct transfer of the entire infor-
mation 'BCR’ from the IEC message.
The image therefore has the structure
shown adjoining.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 192 of 235 ©SIEMENS AG 2013
Image_Type 3 (B#16#03): 5 Byte IEC-Output
+ 1 Byte Ext_State
+ 8 Byte Time
Bit
7
6
5
4
3
2
1
0
D_Address
Byte 0
32 Bit integrated totals (Info 1)
0
1
2
3
4
IV
CA
CY
Sequence number
5
Res
Res
Res
LO
IV
SY
DS
TI
6
S7 Date and Time
7
8
9
10
11
12
13
14
32 Bit integrated totals (Info 2)
40
15
16
17
18
IV
CA
CY
Sequence number
19
Res
Res
Res
LO
IV
SY
DS
TI
20
S7 Date and Time
21
22
23
24
25
26
27
28
32 Bit integrated totals (Info 3)
80
…
…
…
…
IV
CA
CY
Sequence number
…
Res
Res
Res
LO
IV
SY
DS
TI
…
S7 Date and Time
…
…
…
…
…
…
…
Compared with ,Image_Type’ 2 the image is extended with the status byte ‚Ext_State’ and ,Date and
Time’ in S7 format.
Detailed information to ‚Ext_State’ and ,S7 Date and Time’ see chapter 6.3.3.1.
Resulting structure:
14 byte per information
In this mode the output is carried out with
direct transfer of the complete infor-
mation ,BCR’ from the IEC message.
Subsequently
1 byte Ext_State and
8 byte S7 Date and time
The image has the structure shown ad-
joining.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 193 of 235 ©SIEMENS AG 2013
6.3.4. Input blocks - MAi_xyz_pDB
For the various information types in the control direction, input blocks (FBs) are available which have to
be 'interconnected' via the pointer 'P_Application' with the relevant protocol version supplied. The blocks
monitor the control bits assigned to them and generate the relevant IEC command messages.
The 'routing' from input point to the resultant IEC command message, as well as the transfer of basic set-
tings / parameters, is carried out (if parameterization is possible) in an allocated parameter data block.
The symbol name encrypts the most important block properties as follows:
MAi_SC_DC_RC_pDB
MAi is the abbreviation for master blocks input.
The block evaluates the entered information (from the PAE or DB) and
generates the respective command messages.
MAi_SC_DC_RC_pDB
Information types supported by the block with the brief designation accord-
ing to IEC standard:
SC = Single Command
DC = Double Command
RC = Regulation Command
MAi_SC_DC_RC_pDB
p is the abbreviation for programmable allocation of input point and IEC
command address.
MAi_SC_DC_RC_pDB
The number of administered info points of the block and the parameters for
the individual information are stored in a DB.
An existing number, shows the maximum number of info points of the block
which can be administered.
The available MAi function blocks can be found in the overview below.
Block
Block
No.
Para DB no.
(Default)
Generation of …
MAi_SC_DC_RC_pDB
FB148
DB148
… Single commands (SC; TK45,58)
… Double commands (DC; TK46,59)
… Regulation commands (RC; TK47,60)
MAi_SE_ABC_1
FB149
n. v.
… Analogue setpoint value commands with
normalized values (SE_A; TK48,61)
scaled values (SE_B; TK49,62)
floating point values (SE_C; TK50,63)
MAi_BO
FB150
n. v.
… digital setpoint values, bit pattern (BO;
TK51,64)
The block MAi_SC_DC_RC_pDB is currently the only MAi block which is parameterized via a DB. The
entire description of this parameter DB can be found in the corresponding block specific chapter.
The basic structure of the parameter DB largely corresponds to the DB for the MAo blocks.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 194 of 235 ©SIEMENS AG 2013
Overview of the available MAi blocks – for a better overview in a CFC plan:
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 195 of 235 ©SIEMENS AG 2013
6.3.4.1. Single, double and regulating step commands - MAi_SC_DC_RC_pDB (FB148)
MAi_SC_DC_RC_pDB is a block (FB) which monitors control bits (in a DB) for a rising edge according to
the allocated parameter data block. Depending on this control bits IEC commands are generated.
CALL "MAi_SC_DC_RC_pDB" , DB158
Comp_ID :=
P_Application:=#P_Appl
Para_DB :=148
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
With a rising edge of the control bit, the block generates commands with
TK 45, 46 or 47 (no time mark)
TK 58, 59 or 60 (with time mark)
The FB can be used in CFC plans as well as in KOP/FUP/AWL with a small amount of inter-
connection work. The allocation of parameter DB and pointer to IEC link (P_Application) are suf-
ficient.
The specification and allocation of the control bits to the required IEC commands is carried out
in a data block
The properties of the commands are defined individually for each command in the parameter
data block
Simple handling of the parameter data blocks:
- A default DB with the same number as FB is supplied in the block library and can be
modified directly (Simatic Manager).
-Sequential processing of the commands
The block issues only one command at the same time (1 out of n check across all commands
assigned to the block).
Block variables of the FB with their default assignment and brief comment
FB148
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
B#16#0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
DW#16#0
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
Para_DB
IN
INT
0
Number of Data Block (DB) which contains the param-
eters for this function
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application' output on block
'S7_IEC_Config' (FB100). It refers to all data required internally such as send and
receive buffer, etc..
Para_DB
DB number of the associated parameter data block.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 196 of 235 ©SIEMENS AG 2013
Structure and values of the parameter data block:
The parameter DB has the following structure:
Group /
Parameter
Addr.
rel
Addr.
sect.
Type
Start
value
Comment
DB_Manag
0
0
STRUCT
DB_Manag.
Pos_of_DB
+0.0
0.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
No_of_all_DBs
+1.0
1.0
BYTE
B#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Act
+2.0
2.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Prev
+4.0
4.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
DB_No_Next
+6.0
6.0
WORD
W#16#0
reserved for future - do not change !
DB_Manag.
Reserved
+8.0
8.0
WORD
W#16#0
reserved for future - do not change !
+10.0
10.0
END_STRUCT
END_STRUCT (10 BYTE)
Info_Manag
STRUCT
Info_Manag.
P_Byte_First_Info
+0.0
10.0
INT
20
(Byte-) Position of first Para-Block - do not
change !
Info_Manag.
No_of_Infos
+2.0
12.0
INT
0
0:unspecified (DB is filled up to the end);
otherwise size n of ARRAY [1..n]
Info_Manag.
Len_Info
+4.0
14.0
BYTE
B#16#18
Difference in [byte] between two Para-
Blocks - do not change !
Info_Manag.
Len_Sort_Key
+5.0
15.0
BYTE
B#16#0
0: without sorting; > 0: Data sets are sort-
ed ascending with x Bytes
DB_Manag.
Re_internal_usage
+6.0
16.0
DWORD
DW#16#0
+10.0
20.0
END_STRUCT
END_STRUCT (10 BYTE)
Para_CMD
ARRAY [1..n]
STRUCT
n = Number Parameter inputs
Para_[x].
S_DB_No
+0.0
20.0
Word
W#16#0
Source: No. of DB
Para_[x].
S_Adress
+2.0
22.0
DWORD
DW#16#0
Source: Bit position
Para_[x].
D_Line
+6.0
26.0
BYTE
B#16#1
Dest. : No of Line (1..x)-actually do not
change from 1
Para_[x].
D_ASDU
+8.0
28.0
WORD
W#16#0
Dest. : Address of ASDU (ASDU-Address)
Para_[x].
D_Info
+10.0
30.0
DWORD
DW#16#0
Dest. : Address of Infoobject (IOA)
Para_[x].
Timeout
+14.0
34.0
BYTE
B#16#14
Timeout [sec] beginning with entry into
send buffer...
Para_[x].
TI
+15.0
35.0
BYTE
B#16#2D
Type Identifier 45(2Dhex=SC);
46(2E=DC); 47(2F=RC); 58,59,60 ->with
time stamp
Para_[x].
Value
+16.0
36.0
DWORD
DW#16#1
SCO/DCO/RCO-Byte, including Value-
Bits (SCS/DCS/RCS),Qualifier (QU) and
S/E-Bit
Para_[x].
Termination_Type
+20.0
40.0
BYTE
B#16#1
how a command will terminated (0:with
sending;1:with recv.conf,2:with recv.term
Para_[x].
CMD_Info_Count
+21.0
41.0
BYTE
B#16#0
Only for reading: will incremented with
each started command
Para_[x].
CMD_Info_State
+22.0
42.0
WORD
B#16#0
Only for reading: shows details of the last
command process
24.0
44.0
END_STRUCT
END_STRUCT (24 BYTE)
These values are preset in the default DBs and must not be changed.
The default DBs are included in the relevant block libraries.
!!! These parameters you have to set !!!
Note:
Always make changes in the 'Data view', not in the 'Declaration view' (except dimensioning
of the array)
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 197 of 235 ©SIEMENS AG 2013
DB_Management
Parameter blocks which include an enumeration are created so, that more than
one data block can be used if required. The following information is required for
management.
Currently the DB management is not used – for this reason all parameters can be
left at their default settings (0)
Pos_of_DB
Number (1 – n) of the current data block for the parameter block
0: not used
No_of_all_DBs
Total number (n) of data blocks for the parameter block
0: not used
DB_No_Act
DB number of the current data block
0: not used
DB_No_Prev
DB number of the previous data block, if one exists.
Otherwise: 0
DB_No_Next
DB number of the subsequent data block, if there is another one.
Otherwise: 0
Info_Management
Parameter blocks containing an enumeration have one information block 'Info
management'. It contains the following information
The values of the information management parameters are already preset and
therefore do not need to be modified.
P_Byte_First_Info
Byte position of the first data record in this DB
No_of_Infos
Number of data records contained in this DB
0: unspecified -> the data block end marks the last data record
Len_Info
Length of the data records:
0: not permitted
1-254: data record length
255: no standard length, length specifications in the byte format by sort criterion
Len_Sort_Key
0: no sorting (default setting)
Other sort lengths are not useful here because the parameter is currently only
used by the MAo blocks.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 198 of 235 ©SIEMENS AG 2013
Para_CMD
Para per info (group)
Create any number of parameter blocks by setting the array value 'n’ accordingly
in the declaration view. In the data view the parameters can then be modified
individually.
One parameter block should be created here for each required command.
The allocation of control bit to command is carried out statically, as well as the
complete description of the relevant command with all its properties.
S_DB_No
Number of the source DB containing the control bit required for this command.
It is essential that the control bits are present in a DB as they are reset by the
command block after the command is completed.
Use of markers, PAE, etc. is not permissible.
S_Adress
Source position of the control bit:
Bit position of the control bit in the data block.
A rising edge on the control bit activates the command.
D_Line
Target number of the communication line:
Reserved for future applications.
Must currently be set / remain on 1
D_ASDU
ASDU address used for the command output.
D_Info
Information object address (IOA) of the generated command message.
Timeout
Monitoring time in seconds.
The time runs from the entry in the send buffer.
After the monitoring time elapses, the command is completed in every case.
TI
Type identification of the command message being generated.
Permissible values are:
45 (B#16#2D) for single commands (SC) without time stamp
46 (B#16#2E) for double commands (DC) without time stamp
47 (B#16#2F) for regulating step commands (RC) without time stamp
58 (B#16#3A) for single commands (SC) with time stamp
59 (B#16#3B) for double commands (DC) with time stamp
60 (B#16#3C) for regulating step commands (RC) with time stamp
Value
Command byte:
Depending on 'TI', the required command byte (SCO/DCO/RCO) is given here,
including command bits (SCS/DCS/RCS), command identifier (QU) and S/E bit
Bit
7
6
5
4
3
2
1
0
TI
Byte
S/E
QU
0
SCS
45 / 58
Byte
S/E
QU
DCS
46 / 59
Byte
S/E
QU
RCS
47 / 60
Structure of the command byte depending on 'TI':
The value stored here is transferred directly into the command byte.
Termination_Type
Command termination:
0: with sending
1: with receipt of the confirmation of the activation
2: with receipt of the termination of the activation
CMD_Info_Count
Command counter (for diagnostics):
The command counter is increased by 1 with each command started.
read access only
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 199 of 235 ©SIEMENS AG 2013
CMD_Info_State
Command status (for diagnostics):
This value provides information on the status of the last processed command.
- > read access only
The individual command status entries are added.
With the start of the command (entry in the message buffer), the status is set to 1
and updated after the command is terminated. The passed status conditions
from the command are then available for evaluation.
Overview of possible values (with decimal illustration):
> 127: The command is terminated successfully (according to 'Termina-
tion_Type)
< 0 (bit 215 set = 8xxx hex): Error during command output
Detailed information can be found in the list below.
Bit 20
Command in the message memory
Bit 21
Not used
Bit 22
Not used
Bit 23
Positive confirmation of the activation received
Bit 24
Positive termination of the activation received
Bit 25
Not used
Bit 26
Not used
Bit 27
Accumulative-Bit: BFE positive:
The command has been terminated according ‚Termination_Type‘,
successfully
Bit 28
Transmission fault. Possible reasons are:
- fault in the subordinated Station
- Number of repetitions at Timeout reached (Link layer)
Bit 29
Negative confirmation of the activation received
Bit 210
Negative termination of the activation received
Bit 211
Timeout
Bit 212
Not used
Bit 213
Not used
Bit 214
Not used
Bit 215
Accumulative-Bit: BFE negative:
Command output fault occurred.
Command prioritization
The block executes the present command jobs sequential.
In case of multiple command trigger bits are set at the same time, these are processed in
the sequence as written in the parameter DB.
This permits the prioritization of the commands.
Higher priority commands have to be in front of lower priority commands in the parameter
DB.
Command termination
The respectively next command is only started after a running command is terminated.
The termination of the running command occurs
in the normal situation as specified for 'Termination_Type', or
in the event of an error, at the latest after expiry of the time span according to
'Timeout'
Command processing with link error
After a link error to the (IEC) partner disappears, the send buffer of the IEC master is
cleared. This prevents that commands which have been started during a detected link er-
ror are delayed output.
If applicable the relevant commands have to be started again.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 200 of 235 ©SIEMENS AG 2013
6.3.4.2. Setpoint commands - MAi_SE_ABC_1 (FB149)
MAi_SE_ABC_1 is a block (FB) which generates IEC setpoint commands.
The command is started due to a rising edge on the allocated trigger bit (PAE, DB; M) and/or due to a
change in the setpoint value.
CALL "MAi_SE_ABC_1" , DB149
Comp_ID :=
P_Application :=#P_Appl
Send_now :=
Send_on_val_change:=TRUE
TI :=50
ASDU_Adr :=1
Info_Adr :=L#5000
Value_I :=
Value_R :=DB1.DBD50
QDS :=DB1.DBB54
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
The block generates setpoint commands with
TK 48, 49,or 50 (without time mark)
TK 61, 62 or 63 (with time mark)
The FB can be used in CFC plans as well as in KOP/FUP/AWL with a small amount of inter-
connection work. The parameterization is carried out directly via interconnection of the block in-
puts.
The properties of the setpoint command are defined individually for each command
Simple handling of the block:
Complete parameterization of the setpoint commands is carried out directly at the block inputs.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 201 of 235 ©SIEMENS AG 2013
Block variables of the FB with their default assignment and brief comment
FB149
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
0
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
Send_now
IN
BOOL
0
A rising edge on this input starts sending a set point
command message
Send_on_val_change
IN
BOOL
0
If this input is true, set point cmd will send autom.
through each val-change
TI
IN
INT
0
Supported TIs are 48 (SE_NA),49 (SE_NB),50
(SE_NC) and with time stamp 61,62,63
ASDU_Adr
IN
INT
0
Common Address of ASDU of the set point command
Info_Adr
IN
DINT
0
Information object address (IOA) of the set point com-
mand
Value_I
IN
INT
0
Set point value as integer - not used if 0 (default)
Value_R
IN
REAL
0
Set point value as real - not used if 0 (default)
QDS
IN
BYTE
0
QDS (default 0) - Qualifier of setpoint command
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application' output on block
'S7_IEC_Config' (FB100). It refers to all data required internally such as send and
receive buffer, etc..
Send_now
Control bit/acceptance bit
A rising edge on this input starts the sending of the setpoint command.
Permissible sources are PAE, DB, marker, timer.
Send_on_val_change
Send after change
If this input is 'TRUE', the sending of the setpoint command is triggered automati-
cally after the setpoint value is changed ('Value_I' or 'Value_R').
TI
Type identification of the setpoint command being generated.
Permissible values are:
48 for setpoint commands with normalized value (SE_NA) without time stamp
49 for setpoint commands with scaled value (SE_NB) without time stamp
50 for setpoint commands with short floating point number (SE_NC) without time
stamp
61 for setpoint commands with normalized value (SE_NA) with time stamp
62 for setpoint commands with scaled value (SE_NB) with time stamp
63 for setpoint commands with short. floating point number (SE_NC) with time
stamp
ASDU_Adr
ASDU address used for the command output.
Info_Adr
Information object address (IOA) of the generated command message.
Value_I
Setpoint value (Format: 2 byte, S7 integer):
This value is relevant with 'TI' = 48, 49, 61 or 62. The value entered here is trans-
ferred to the setpoint command message.
With 'TI' = 50 or 63, this input is not relevant and has to be set to 0.
Value_R
Setpoint value (Format: 4 byte, S7 short real):
This value is relevant with 'TI' = 50 or 63. The value entered here is transferred into
the setpoint command message.
With 'TI' = 48, 49, 61 or 62, this input is not relevant and has to be set to 0.
QDS
Identifier for the setpoint command (QOS):
Enter the required identifier here.
Structure of the identifier for the setpoint command:
Bit
7
6
5
4
3
2
1
0
Byte
S/E
QL
QOS
The value stored here is transferred directly into the command message.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 202 of 235 ©SIEMENS AG 2013
Generation of several different setpoint commands
The block manages precisely the setpoint command defined on its inputs per call-up.
If you require more than one setpoint command for your application, the block needs to be
called up multiple times (once for each setpoint command).
Setpoint command termination
The respectively next setpoint command is only started after the running setpoint com-
mand is terminated.
The termination of the running setpoint command occurs
in the normal situation with the receipt of the 'confirmation of activation', or
in the event of an error, at the latest after 5 seconds (fixed timeout set).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 203 of 235 ©SIEMENS AG 2013
6.3.4.3. Bit pattern commands - MAi_BO (FB150)
MAi_BO is a block (FB) which generates IEC bit pattern commands.
The command is started due to a rising edge on the allocated trigger bit (PAE, DB; M) and/or due to a
change in the bit pattern.
CALL "MAi_BO" , DB150
Comp_ID :=
P_Application :=#P_Appl
Send_now :=
Send_on_val_change:=TRUE
TI :=
ASDU_Adr :=1
Info_Adr :=L#4000
Value :=DB1.DBD100
Illustration as CFC block with default values
Illustration in AWL with partial parameter provision
Important features are:
The block generates bit pattern commands with
TK 51 (no time marker) or
TK 64 (with time marker)
The FB can be used in CFC plans as well as in KOP/FUP/AWL with a small amount of inter-
connection work. The parameterization is carried out directly via interconnection of the block in-
puts.
The properties of the bit pattern command are defined individually for each command
Simple handling of the block:
Complete parameterization of the bit pattern command is carried out directly on the block in-
puts.
Project specific special-purpose solutions can be cost-efficient realized.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 204 of 235 ©SIEMENS AG 2013
Block variables of the FB with their default assignment and brief comment
FB150
Type
Default
Block comment / brief description
Comp_ID
IN
BYTE
0
Identifier for Diagnostic-Functions
P_Application
IN
DWORD
0
Pointer which must be connected to 'S7_IEC_Config’ –
Function Block
Send_now
IN
BOOL
0
A rising edge on this input starts sending a set point
command message
Send_on_val_change
IN
BOOL
0
If this input is true, set point cmd will send autom.
through each val-change
TI
IN
INT
0
Supported TIs are 51 (Default) and with time stamp 64
ASDU_Adr
IN
INT
0
Common Address of ASDU of the set point command
Info_Adr
IN
DINT
0
Information object address (IOA) of the set point com-
mand
Value
IN
DWORD
0
BSI = binary state information 32 Bit
Meaning of the block variables:
Comp_ID
Block identifier for (currently only internal) diagnostic functions.
Recommendation: Number each use of this block consecutively starting with 1
(B#16#1).
P_Application
Pointer which has to be connected to the 'P_Application' output on block
'S7_IEC_Config' (FB100). It refers to all data required internally such as send and
receive buffer, etc..
Send_now
Control bit/acceptance bit
A rising edge on this input starts the sending of the setpoint command.
Permissible sources are PAE, DB, marker, timer.
Send_on_val_change
Send after change
If this input is 'TRUE', the sending of the bit pattern command message is triggered
automatically after the bit pattern ('Value') is changed.
TI
Type identification of the bit pattern command message being generated.
Permissible values are:
51 for bit pattern commands (BO) without time stamp
64 for bit pattern commands (BO) with time stamp
ASDU_Adr
ASDU address used for the command output.
Info_Adr
Information object address (IOA) of the generated command message.
Value
Bit pattern (BSI = 32-bit bit pattern):
The value of the bit pattern being transferred is given here (digital setpoint value)
The value entered here is transferred directly into the bit pattern command mes-
sage.
Generation of several different bit pattern commands
The block manages precisely the bit pattern command defined on its inputs per call-up.
If you require more than one bit pattern command for your application, the block needs to
be called up multiple times (once for each bit pattern command).
Command termination
The respectively next bit pattern command is only started after the running bit pattern
command is terminated.
The termination of the running bit pattern command occurs
in the normal situation with the receipt of the 'confirmation of activation', or
in the event of an error, at the latest after 5 seconds (fixed timeout set).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 205 of 235 ©SIEMENS AG 2013
7. Using the NON_Retain Memory
With the introduction of the NON_Retain memory the user has the possibility to gain additional data
memory by using the (non buffered) working storage of the CPU. This NON_Retain memory can be used
for buffering of data in SIPLUS RIC IEConS7.
Until now data blocks are processed in the remanence storage of the CPU. This applies for offline-DBs as
well as for DBs generated by system functional block.
Note:
Non remanent DBs are supported from S7-300 CPUs from V2.0.12 as well as from
ET200S CPUs.
In the technical data of the S7-300 and ET200s CPUs the working storage integrated and the size of the
remanent memory is mentioned. The remanent memory is always a subset of the working storage.
Note:
S7-400 CPUs and WinAC differentiate only between working storage code and working
storage data (both are battery buffered / remanent in the S7-400). This means data
blocks are generated resp. can be stored only in the associated memory range.
Up to now send buffer DBs are generated exclusively during run time (online, in the remanent data
memory of the CPU).
In order to use additional non remanent working storage of the S7-300 resp. ET200S CPUs in case of
high demand of buffer please generate first of all data blocks with defined size and type of array „NON-
Retain“ offline in your project.
The procedure is as follows:
Generate a data block (with New Project Insertion / Data Block) in the project
Open the data block and declare the desired length. Example: Array [1..10000] Word. The
amount of DB length is then 20000 Bytes. A structuring or initialization is not necessary.
Open the DB’s object properties (context menu / Object Properties) and activate (in the index
card General – Part 2 ) the checkbox ‚NON-Retain’
For embedding of the so generated „NON-Retain DB“ the FC100 block is required which is working as
S7_IEC_Buffer_Manager. For further details see chapter 7.1.1. Extend your program after the call of the
FB100 with a call of the FC100 and interconnect it with P_Application from FB100.
Note:
For embedding of several buffer DBs for each NON_Retain DB the call of the FC100 is
required!
The inputs of the FC100 are used as follows:
- P_Application: Interconnection with FB100
- DB_Type: The NON_Retain DB has to be assigned to the desired DB type specified here (see
also FC100 block comment).
- DB_No: DB-Number of the offline generated NON-Retain DB
- DB_Len: The length will be assigned automatically. In this case 0 has to be entered here.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 206 of 235 ©SIEMENS AG 2013
7.1.1. FC100 Description
This block is available with version V1.3, from V1.5 as AddOn-Block.
CALL "S7_IEC_Buf_Manager" // FC100
P_Application:=#P_Appl
DB_Type :=0
DB_No :=0
DB_Len :=L#0
act_DB_No :=#Ret_DB_No
act_DB_Len :=#Ret_DB_Len
Illustration as CFC-block with default values
Illustration in AWL with partial parameter supply
The FC100 block can be used for the following tasks:
Use of an offline generated DB (also NON-Retain) as buffer-DB (see chapter )
Adaption of the DB-length from automatically generated DBs
Readout of DB number and DB length from internal buffer DBs
7.1.1.1. Adaption of the DB-length from automatically generated DBs:
Up to version V1.2 the number of send buffers was definitely specified, and the change of size only re-
strained. With V1.3 or higher the user can specify number and size via FB100 parameter. In this case the
indication of size always refers to all send buffers which have to be generated with the exception of the
always generated DBs for diagnostics and organizational messages.
In order to generate several of the automatically created DBs with individual length, the FC100
(S7_IEC_Buf_Manager) now can be used as well. For this purpose extend your program after the call of
the FB100 with a call of the FC100 and interconnect it with P_Application from FB100 and the following
parameters:
DB_Type: according to the desired DB-Type
DB_No: Has to be 0 here
DB_Len: Desired DB length
interconnect act_DB_No and act_DB_Len with arbitrary (Temp-) variables.
Note:
In case of embedding the block or changing parameters during operation the values are
taken over directly and a restart of the IEC application is carried out. During start up the
previous DB is deleted and created new. This may also be with a new DB number.
7.1.1.2. Read out of DB-Number and DB_Length of internal Buffer-DB
With FC100 (S7_IEC_Buf_Manager) the actual DB-numbers and DB-length from an internal buffer DB
can be read. For this purpose extend your program after the call of the FB100 with a call of the FC100
and interconnect it with P_Application from FB100 and the following parameters:
DB_Type: according to the desired DB-Type
DB_No: Has to be 0 in case of ‚read only’
DB_Len: Has to ne 0 in case of ‚read only
interconnect act_DB_No and act_DB_Len with arbitrary (Temp-) variables. This now con-
tains the number and length of the requested DB. The length is only valid if the DB num-
ber is <>0. The response of the DB number as well is only correct if the requested buffer
is created or existing (depending on the parameter ‚No_of_Send_Buffer’).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 207 of 235 ©SIEMENS AG 2013
Block parameter with its block comments
FC100
Type
Block - Comment
P_Application
IN
DWORD
Pointer which must be connected to ‘S7_IEC_Config’
DB_Type
IN
INT
0..15: Transmission buffer Prio 0..15, 100: Diag_Buffer, 101:
Org_Buffer
DB_No
IN
INT
<>0:number of an offline DB to be assigned; 0: DB will be creat-
ed auto.
DB_Len
IN
DINT
<>0:individual (instead of default) length for autom. created DB
at runtime
act_DB_No
OUT
INT
act_DB_Len
OUT
DINT
Parameter and functional details:
P_Application
Pointer which must be connected to the ,P_Application’ output of the
‚S7_IEC_Config’ (FB100) block. It refers to all internal required data like send and
receive buffer etc.
DB_Type
according to the desired DB-Type:
0…15: Send buffer Prio 0…15;
100: Diagnostic buffer
101: Buffer for organizational messages
DB_No
DB number if an offline DB has to be assigned, otherwise 0
DB_Len
0: If an offline DB has to be assigned (the length is automatically calculated)
<>0: Length of the automatically during run time created DB type specified from user
act_DB_No
The number of the requested DB is written here. The response of the DB number as
well is only correct if the requested buffer is created or existing (depending on the
parameter ‚No_of_Send_Buffer’).
act_DB_Len
The number of the requested DB is written here. The length is only valid if the DB
number is <> 0.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 208 of 235 ©SIEMENS AG 2013
8. SIPLUS RIC IEC on S7 in SIMATIC H-Systems
The blocks from SIPLUS RIC IEC on S7 can be inserted directly in SIMATIC H-Systems.
Subsequently we introduce some typical configuration examples for the telecontrol protocols
IEC 870-5-101 (serial) resp. IEC 870-5-104 (TCP/IP).
8.1. Configurations
The figure shows a possible hardware configuration. In this configuration the assembly of the following
IEC communication links would be possible:
- Protocol IEC101 Master or Slave, via CP340 in ET200 M- Rack
- Protocol IEC101 Master or Slave, via CP341 in ET200 M- Rack
- Protocol IEC104 Master or Slave, via the two CP443-1 in the S7-400H Racks
Depending on the protocol variant which has to be carried out, only a part of the hardware is required.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 209 of 235 ©SIEMENS AG 2013
8.1.1. IEC60870-5-101 Master
Configuration:
SIPLUS RIC IEC on S7 is working as Master.
The connection of a RTU (Remote Terminal Unit) is
carried out serial via a CP340 or CP341 in
ET200M-Rack.
Normal operation:
The process leading CPU (Rack) in the H-System
communicates via the CP340/341 with the RTU.
Breakdown in the process leading Rack:
The CPU in the reserve rack takes over the data
traffic via the CP340/341.
The RTU can’t and don’t has to discover the switch
over. It occurs no loss of data.
The projection of the CP340/341 is carried out like
described in chapter 3.2
8.1.2. IEC60870-5-101 Slave
Configuration:
SIPLUS RIC IEC on S7 is working as Slave.
The connection to the control center is carried out
serial via a CP340 or CP341 in ET200M-Rack.
Normal operation:
The control center communicates via the
CP340/341 with the process leading CPU (rack) in
the H-System.
Breakdown in the process leading Rack:
The CPU in the reserve rack takes over the data
traffic via the CP340/341. The control center can’t
discover the switch over. The breakdown of the
rack can be reported via indications to the control
center.
The projection of the CP340/341 is carried out like
described in chapter 3.2
Control Center
SIPLUS RIC
IEC on S7 Slave
CP341 or CP340
ET200M
S7-400H
Rack 0
S7-400H
Rack 1
Interface
(serial)
Remote Terminal Unit
SIPLUS RIC
IEC on S7 Master
Interface
(serial)
S7-400H
Rack 0
CP341 or CP340
S7-400H
Rack 1
ET200M
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 210 of 235 ©SIEMENS AG 2013
8.1.3. IEC60870-5-104 Master
Configuration:
SIPLUS RIC IEC on S7 is working as Master.
The connection of the RTU via a network is carried
out redundant via respectively one CP443-1 in
Rack 0 and Rack 1.
Normal operation:
The process leading CPU (Rack) in the H-System
establishes via the two CPs respectively one
TCP/IP connection to the RTU. It starts the IEC-
Protocol via one of the two connections and moni-
tors the second connection using test frames.
This is called in the norm redundancy group with 2
connections.
Breakdown of the active connection:
SIPLUS RIC IEC on S7 discovers the up to this
time active connection as disturbed and starts the
protocol via the other connection.
If the behavior of the RTU is conforming to stand-
ards the non confirmed messages are repeated
and no loss of data occurs.
The projection of the CP443-1 is carried out like
described in chapter 4.2.
Alternatively the two connections can be estab-
lished also via two separate LANs.
8.1.4. IEC60870-5-104 Slave
Configuration:
The control center has a network connection.
SIPLUS RIC IEC on S7 is working as Slave.
The connection to the network is carried out redun-
dant via respectively one CP443-1 in Rack 0 and
Rack 1
Normal operation:
The control center establishes respectively one
TCP/IP connection to the two CPs and with it to the
process leading CPU.
It starts the IEC-Protocol via one of the two connec-
tions and monitors the second connection using
test frames.
This is called in the norm redundancy group with 2
connections.
Breakdown of the active connection:
The control center discovers the up to this time ac-
tive connection as disturbed and starts the protocol
via the other connection.
SIPLUS RIC IEC on S7 repeats first the non con-
firmed messages, that no loss of data occurs in the
control center.
Subsequently possible buffered messages are
sent.
The projection of the CP443-1 is carried out like
described in chapter 4.2.
Alternatively the two connections can be estab-
lished also via two separate networks.
Remote Terminal Unit
SIPLUS RIC
IEC on S7 Master
Rack 0
CP443-1
Rack 1
CP443-1
Connection 0
(TCP/IP)
Connection 1
(TCP/IP)
Industrial Ethernet
SIPLUS RIC
IEC on S7 Slave
Rack 0
CP443-1
Rack 1
CP443-1
Control Center
Connection 0
(TCP/IP)
Connection 1
(TCP/IP)
Industrial Ethernet
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 211 of 235 ©SIEMENS AG 2013
8.1.5. H-CPUs V6 – Use of the integrated PN-Interface
From V1.4 SIPLUS RIC supports the use of the PN-Interfaces integrated on the V6-H-CPUs for
IEC60870-104 communication.
The applicable variants are:
S7IEC_S104_41xPN
S7IEC_M104_41xPN
In this case the first connection (C1) communicates always via the PN-Interface of the CPU in RACK 0
resp. solo systems.
For the second connection (C2) it is possible to switch over to the PN-Interface of the CPU in RACK 1 by
parameterization (Parameter „L1_C2_over_CPU_Rack_1“).
You can carry out special configurations (e.g. several connections via the CPU in RACK 1 or mixed oper-
ation with CP-Communication) by using the possibilities of the multiple channel / redundancy (ref. to
chapter 5).
Note:
Please read up on the SIMATIC documentation about possible limitations when using
simultaneously the PN-Interfaces for IEC-Communication (free TCP-Communication) and
coupling to local peripherals.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 212 of 235 ©SIEMENS AG 2013
8.2. Licensing in the H-System
Up to 2012 available CPU for H-Systems were equipped with Firmware version V4.
For its licensing the serial number of the memory card can’t be used. Instead of that the serial number of
the SIMATIC H-CPUs must be taken for the generating of the registration codes. Please activate this by
parameter input ‘Serial_from_CPU’.
Each SIMATIC H-System consists of 2 identical sub systems with respectively own SIMATIC H-CPU
(Master/Reserve). For both SIMATIC H-CPU’s an own activating code is necessary.
For the use of SIPLUS RIC IEC on S7 in H-Systems you’ll receive up to 3 registration codes per SIPLUS
RIC IEC on S7 application:
- 1 registration code for the Master-CPU
- 1 registration code for the Reserve-CPU
- 1 registration code for a possible existing spare part -CPU
This registration codes have to be entered in a data block whose number has to be entered at the FB100
input ,Registration_Code’. For that the DB number has to be converted into a hexadecimal syntax.
Example with DB30 as data block containing the registration codes:
The figure shows the DB30 in the declaration view.
Call of the FB100 (S7_IEC_Config):
CALL "S7_IEC_Config" , "S7_IEC"
Registration_Code :=DW#16#1E //Reg.-Codes in DB30 (1E Hex)
Line_ID :=
…
NOTICE!
Exchange of H-CPU!
H-Systems are normally used in equipments where high availability is requested. In or-
der to allow a change of module without PG in case of service (exchange of H-CPU) it
is strongly recommended to get licensing also for a possible existing spare part CPU.
The necessary serial number for that you’ll find in case of the H-CPU also marked on
the front panel (SVP….). It is not mandatory to read out the serial number in the normal
operation (refer also to chapter 10).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 213 of 235 ©SIEMENS AG 2013
9. SIPLUS RIC IEC on S7 in S7-1500 – Systems
9.1.1. Available Libraries
SIPLUS RIC supports the S7-1500 Hardware from version V1.5. The following libraries are available:
T104-Protocol as Master and Slave via the PN-interface of the CPU
S7_IEC_1500_104_MS_CPU_PN_V1_5.1
T101and T103-Protocol via the communication modules CM PtP.
S7_IEC_1500_101_MS_CM_PtP_V1_5
S7_IEC_1500_103_M_CM_PtP_V1_5
Additional functions
S7_IEC_1500_AddOns
For this version the complete contents of the manual is valid with a few subsequent exceptions:
9.1.1.1. Specific features / differences
- The libraries were created with TIA V12 SP1
- Master and Slave are each integrated in a communication-FB. The functionality is switchable by
parameter
T101: Parameter ‘L2_Master_or_Dir_Bit’
T104: Parameter ‘L2_is_Master’
- All (default-) FB/FC/DB-numbers as well as symbolic names like under Step7 with the exception
that the communication-FBs (up to now FB100, S7_IEC_Config) are now individually numbered
and named symbolically as follows:
T101 FB101 S7_IEC_101_MS_CM_PtP
T103 FB103 S7_IEC_103_M_CM_PtP
T104 FB104 S7_IEC_104_MS_CPU_PN
The FBs can be used simultaneously in a project without renaming (see also chapter 9.1.1.3).
A corresponding Instance-DB (see also chapter 9.1.1.2) each with identical name which is extended with
‘_DB’ is included as well. The table of variables deposited in the respective library is also specifically
adapted and refers to the Instance-DB.
- The libraries contain the following elements / groups shown at the T104 example
S7_IEC_104_MS_CPU_PN
Contains all necessary blocks for the communication.
Is required COMPLETELY
S7_IEC_Appl_S101_104
Contains all Slave application blocks (see also chapter 6.1)
Has to be taken in the project only if required. Single blocks which are not needed may
be cleared.
S7_IEC_Appl_M101_104
Contains all Master application blocks (see also chapter 6.3)
Has to be taken in the project only if required. Single blocks which are not needed may
be cleared.
VAT_S7_IEC_104_MS_PN_CPU
Please copy the table of variables into the project folder ‘Observation and Force tables’1
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 214 of 235 ©SIEMENS AG 2013
In the S7-1500 data blocks created during run time are exclusively supported from DB number 60000.
The parameter ‘First_internal_DB_No‘ is not applicable. See also chapter 9.1.1.2
Please use the online presentation to watch which DBs are created from SIPLUS RIC at run time.
9.1.1.2. Remanence
In the S7-1500 remanence must be explicitly activated compared to the classic systems. SIPLUS RIC
needs remanent data management only at a few positions. Basically this is the corresponding Instance-
DB for the communication-FB (FB101-FB104, earlier FB100). Here the bookkeeping of (buffer-) data
blocks is created during run time.
Without remanence new DBs are created with each restart of the CPU. In order to prevent this the attrib-
ute ‘Set data in standard area remanent’ must be activated. Unfortunately this is permitted in the actual
TIA-Version (V12 SP1) for the Instance-DBs of the know-how protected communication DBs. Therefore
each library has enclosed an Instance-DB with activated remanence. Please use this Instance-DB resp.
copies of it until further notice, and no automatically created DB.
The behavior above (non activatable remanence) applies to the command blocks as well. It would be
needed to notice the number of the buffer-DB for temporary storage of commands. If possible the function
‘Cmd_Buffer_Dim <>0’ should not be used until further notice. Otherwise you should check the online
created data blocks in the test phase occasionally and clear them if necessary, or eliminate them by cold
start or complete loading.
The T103-‘Gateway’ resp. nodal blocks with automatically created image are concerned as well. However
in this case the behavior plays a subordinated role, because the mechanism of the automatic update is
only provided for the commissioning phase resp. for test purpose. Create parameter-DBs with remanent
properties and assign this tightly.
SIPLUS RIC in the S7-1500 creates buffer-data blocks exclusively non-remanent. Therefore the complete
data memory is available.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 215 of 235 ©SIEMENS AG 2013
9.1.1.3. Use of several libraries at the same time
The actual TIA Version V12 (SP1) generates a fault if the libraries T103 and T104 resp. T103 and T101
are copied into the same folder.
Therefore proceed as follows (see the figure below):
Generate a second PLC_2 CPU in the project tree additionally to the used project PLC_1 CPU (step ).
Then copy the different libraries into the two CPUs e.g. T104 into the PLC_1 CPU and T103 into the
PLC_2 CPU (step ).
After that generate a new group in the project CPU which has the same name like in the PLC_2 CPU
(step ). Subsequently copy the required blocks in the project tree from the library in the PLC_2 CPU into
this new generated group of the project PLC_1 CPU (step ).
Finally cancel the PLC_2 CPU.
Notes for loading:
- Complete loading is possible via Menue:
<Online/PLC-Load the program into the device and reset>.
1
Create a new group
2
2
4
Project PLC_1 CPU
with both libraries
Copy required blocks
into the new group
3
Copy libraries
4
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 216 of 235 ©SIEMENS AG 2013
10. Software protection and demo mode
10.1. General activation of SIPLUS RIC IEConS7
For the relevant versions, libraries with protected blocks (Know How Protect) are supplied. As a general
principle these can be freely copied and used.
To ensure that only the number of purchased licenses can be used, the memory card MMC (ET200S and
S7-300), MC (S7-400) or the license number (WinAC) is used in normal case as a dongle.
These must be plugged into the CPU to operate the application.
Depending on the serial number of the memory card, you will receive from Siemens an 8-digit registration
code which you need to enter as an input parameter (Registration_Code) when calling up the FB100
('S7_IEC_Config').
Example:
CALL "S7_IEC_Config" , "S7_IEC"
Registration_Code :=DW#16#94A7000B
Line_ID :=
L1_Active_Connect_C1 :=
From V1.1 the registration code can be entered alternatively also in the DB.
The value entered at the input ,Registration_Code’ is interpreted as DB number if it is more than 0 and
less or equal 2000 (decimal!).
In this DB also several registration codes can be entered (using the format DWORD, DW#16#...). The
corresponding DB will be opened and searched for the suitable registration code.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 217 of 235 ©SIEMENS AG 2013
10.2. Activation of SIPLUS RIC IEConS7 in H-systems and other systems
For the use in SIMATIC H-Systems and reasonable exceptions the possibility was created to use the
CPU as a dongle. This is parameterized at the input ,Serial_from_CPU’ of the FB100 (S7_IEC_Config).
For the generation of the registration code, the following information are required
- order number from the supplier, to be found on the label of the delivered data carrier
- the reference number(s) of the application(s) to be activated (6AG6003-xxxxx-xxxx)
- the serial number readout from the memory card
or for the use in SIMATIC H-systems
- the serial number of the two used SIMATIC H-CPUs and
- the serial number of a possible existing spare part CPU.
Each of the available block libraries includes a table of variables 'VAT_S7_IEC'. This table of variables
can be used to readout the serial number of the memory card (//Serial).
The registration code is required for each CPU, per used application (master, slave, via CPU, via CP…)!
When the valid registration code is entered the telecontrol communication is permanently activated. No
entry or an invalid entry will permit unrestricted operation in demo mode for 15 minutes. After this time the
telecontrol communication will be stopped, i.e. the CPU continues working but the communication will fail.
The corresponding fault outputs of the FB100 are set.
For receiving a registration code please call one of the contact persons mentioned under SIPLUS RIC
Support line (see chapter 11).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 218 of 235 ©SIEMENS AG 2013
10.3. Activation of SIPLUS RIC IEConWinAC
For activation SIPLUS RIC on WinAC the license number (16 digits, as of the 5th digit) of the software
package SIMATIC WinAC RTX20xx is used. If you didn’t get a registration code from Siemens, the follow-
ing steps have to be done (recommended method):
For generating a registration code the following information are needed:
- order number from the supplier, to be found on the label of the delivered data carrier
- the reference number(s) of the application(s) to be activated (6AG6003-xxxxx-xxxx)
- the license number readout from WinAC
Each of the available block libraries includes a table of variables 'VAT_S7_IEC'. This table of variables
can be used to readout (a part of) the license number of WinAC.
The registration code is required for each WinAC installation, per used application (master, slave)!
When the valid registration code is entered the telecontrol communication is permanently activated. No
entry or an invalid entry will permit unrestricted operation in demo mode for 15 minutes. After this time the
telecontrol communication will be stopped, i.e. the CPU continues working but the communication will fail.
The corresponding fault outputs of the FB100 are set.
For receiving a registration code please call one of the contact persons mentioned under SIPLUS RIC
Support line (see chapter 11).
Alternative method for activation of SIPLUS RIC IEConWinAC, if you haven’t done any projecting in
SIMATIC-Manager yet:
For generating a registration code the following information are required:
- order number from the supplier, to be found on the label of the delivered data carrier
- the reference number(s) of the application(s) to be activated (6AG6003-xxxxx-xxxx)
- the license number of WinAC
This number you will find
- on the WinAC software package
- in the Automation License Manager, if you have already transferred the License Key of
WinAC onto your system or
- via the „WinLC RTX-Controller“ Help About „Serial Number:“ (the license no. is
named as „Serial Number”).
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 219 of 235 ©SIEMENS AG 2013
11. Contacts / Addresses
In case you have queries concerning the SIPLUS RIC product line or you want advice via phone: we will
help.
SIPLUS RIC – Product manager
Dieter Söhlmann
Phone: +49 (0) 911 750-4790
Fax: +49 (0) 911 750-134790
Email: dieter.soehlmann@siemens.com
Based on the existing blocks, enhanced requirements for IEC communication (e.g. other image layouts or
information content, transmission causes, etc.…) can be implemented with minimal work and cost-
effectively.
Please ask us if your application requires a customized project solution with enhanced functionality. As a
service provider in the field of SIMATIC project planning and programming, we look forward to solve your
problems together with you.
SIPLUS RIC – Support line
Fax: +49 (0) 911 750-9917
Mail: siplus-ric.automation@siemens.com
You find further information on the SIPLUS Internet pages
Website: http://www.automation.siemens.com/siplus/index_00.htm
Site address
Siemens AG
Industry Sector
I IA CE - SIPLUS RIC
Würzburger Str. 121
D-90766 Fürth
Postal address
Siemens AG
Industry Sector
I IA CE - SIPLUS RIC
P.O. Box 2355
D-90713 Fürth
SIPLUS RIC IEC on S7 is based on standard Siemens products. You will find information and support
from our central service & support
IA and DT Service & Support
General support contact
Phone: +49 (0) 180 5050-222
Inquiries: http://www.siemens.de/automation/support-request
Website: http://www.siemens.de/automation/service&support
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 220 of 235 ©SIEMENS AG 2013
12. Appendix
12.1. Resource assignment
Resources required by the application blocks:
Type
Amount or number range
Note
Memory:
Loading memory
64kB
approx. value, min. requirement
Working memory
64kB
approx. value, min. requirement
Data
10kB
approx. value, min. requirement
Blocks:
FBs
1-199
can be re-wired, multi-instance
compatible
FCs
1-199
can be re-wired
DBs
1-199
Other:
Markers
none
Timers
none
Counters
none
All functional blocks (FB) are written so that they can be used in the application as multi-instance func-
tional blocks.
NOTICE!
Released CPU versions!
Only the following CPU versions are released:
ET200S IM151-7 CPU from V2.6
ET200S IM151-8 PN/DP CPU from V2.7
S7-300 from V2.0 with min 64kB working memory
S7-400 from V4.0
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 221 of 235 ©SIEMENS AG 2013
The table below shows in detail which blocks are included in the individual libraries.
Type
No.
Symbolic Name
S7IEC_M101_CP1SI
S7IEC_M101_CP340
S7IEC_M101_CP341
S7IEC_M101_CP441
S7IEC_M101_WinAC
S7IEC_M104_151PN
S7IEC_M104_31xPN
S7IEC_M104_41xPN
S7IEC_M104_CP343
S7IEC_M104_CP443
S7IEC_M104_WinAC
S7IEC_S101_CP1SI
S7IEC_S101_CP340
S7IEC_S101_CP341
S7IEC_S101_CP441
S7IEC_S101_WinAC
S7IEC_S104_151PN
S7IEC_S104_31xPN
S7IEC_S104_CP343
S7IEC_S104_CP443
S7IEC_S104_41xPN
S7IEC_S104_WinAC
S7_IEC_AddOn
DB
80
Para_TCP_WinAC
x
x
DB
82
..88
Instance DB for
Para_TCP_WinAC
x
x
DB
90
Para_SER_WinAC
x
x
DB
92
98
Instance DB for
Para_SER_WinAC
x
x
DB
100
S7_IEC
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
DB
111
P_LinkAdr_n
x
x
x
x
x
DB
112
P_ASDUAdr_n
x
x
x
x
x
x
x
x
x
x
x
DB
139
Para_DB_IOA_Demo
x
x
x
x
X
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
DB
140
Para_DB _MAo_SP
x
x
x
x
x
x
x
x
x
x
x
DB
141
Para_DB _MAo_DP
x
x
x
x
x
x
x
x
x
x
x
DB
142
Para_DB _MAo_ST
x
x
x
x
x
x
x
x
x
x
x
DB
143
Para_DB _MAo_BO
x
x
x
x
x
x
x
x
x
x
x
DB
144
Para_DB _MAo_MEa
x
x
x
x
x
x
x
x
x
x
x
DB
145
Para_DB _MAo_MEb
x
x
x
x
x
x
x
x
x
x
x
DB
146
Para_DB _MAo_MEc
x
x
x
x
x
x
x
x
x
x
x
DB
147
Para_DB _MAo_IT
x
x
x
x
x
x
x
x
x
x
x
DB
148
Para_DB _MAi_CMD
x
x
x
x
x
x
x
x
x
x
x
DB
161
Para_DB_MAoSLi_MD
x
DB
166
Para_DB_SLoMAi_CD
x
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 222 of 235 ©SIEMENS AG 2013
Type
No.
Symbolic Name
S7IEC_M101_CP1SI
S7IEC_M101_CP340
S7IEC_M101_CP341
S7IEC_M101_CP441
S7IEC_M101_WinAC
S7IEC_M104_151PN
S7IEC_M104_31xPN
S7IEC_M104_41xPN
S7IEC_M104_CP343
S7IEC_M104_CP443
S7IEC_M104_WinAC
S7IEC_S101_CP1SI
S7IEC_S101_CP340
S7IEC_S101_CP341
S7IEC_S101_CP441
S7IEC_S101_WinAC
S7IEC_S104_151PN
S7IEC_S104_31xPN
S7IEC_S104_CP343
S7IEC_S104_CP443
S7IEC_S104_41xPN
S7IEC_S104_WinAC
S7_IEC_AddOn
FB
2
S_RCV
x
x
FB
3
S_SEND
x
x
FB
2
P_RCV
x
x
FB
3
P_SEND
x
x
FB
7
P_RCV_RK
x
x
FB
8
P_SND_RK
x
x
FB
63
TSEND
x
x
x
x
x
x
FB
64
TRCV
x
x
x
x
x
x
FB
65
TCON
x
x
x
x
x
x
FB
66
TDISCON
x
x
x
x
x
x
FB
82
TINT_WINAC
x
x
FB
83
TSEND_WINAC
x
x
FB
84
TRCV_WINAC
x
x
FB
85
TCON_WINAC
x
x
FB
86
TDISCON_WINAC
x
x
FB
87
TUSEND_WINAC
x
x
FB
88
TURCV_WINAC
x
x
FB
91
P_RECV_WINAC
x
x
FB
92
P_SEND_WINAC
x
x
FB
93
V24_STAT_WINAC
x
x
FB
94
V24_SET_WINAC
x
x
FB
95
COM_INIT_WINAC
x
x
FB
96
P_RESET_WINAC
x
x
FB
100
S7_IEC_Config
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FB
101
L1_CP341
x
x
FB
102
L1_CP441
x
x
FB
103
L1_CP340
x
x
FB
104
L1_1SI
x
x
FB
105
L1_CP343
x
x
FB
106
L1_CP443
x
x
FB
107
L1_CPU31x_PN
x
x
x
x
FB
108
L1_CPU41x_PN
x
x
FB
109
L1_WinAC_TCP
x
x
FB
110
L2_T101_103_bal_unbal
x
x
x
x
x
x
x
x
x
x
FB
111
L1_WinAC_Ser
x
x
FB
115
L2_T104_APCI
x
x
x
x
x
x
x
x
x
x
x
x
FB
120
L7_T101_103_104_B
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FB
121
SL_Org_Asdu_1
x
x
x
x
x
x
x
x
x
x
x
FB
122
MA_org_Asdu_1
x
x
x
x
x
x
x
x
x
x
x
FB
130
SLi_SP_DP_s128
x
x
x
x
x
x
x
x
x
x
x
FB
131
SLi_ST_s8
x
x
x
x
x
x
x
x
x
x
x
FB
132
SLi_BO_s8
x
x
x
x
x
x
x
x
x
x
x
FB
133
SLi_ME_ABC_s32
x
x
x
x
x
x
x
x
x
x
x
FB
134
SLi_IT_s8
x
x
x
x
x
x
x
x
x
x
x
FB
135
SLo_SC_DC_RC_sx
x
x
x
x
x
x
x
x
x
x
x
FB
136
SLo_SE_ABC_sx
x
x
x
x
x
x
x
x
x
x
x
FB
137
SLo_BO_sx
x
x
x
x
x
x
x
x
x
x
x
FB
148
MAi_SC_DC_RC_pDB
x
x
x
x
x
x
x
x
x
x
x
FB
149
MAi_SE_ABC_1
x
x
x
x
x
x
x
x
x
x
x
FB
150
MAi_BO
x
x
x
x
x
x
x
x
x
x
x
FB
161
MAoSLi_MD_pDB
x
FB
166
SLoMAi_CD_pDB
x
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 223 of 235 ©SIEMENS AG 2013
Type
No.
Symbolic Name
S7IEC_M101_CP1SI
S7IEC_M101_CP340
S7IEC_M101_CP341
S7IEC_M101_CP441
S7IEC_M101_WinAC
S7IEC_M104_151PN
S7IEC_M104_31xPN
S7IEC_M104_41xPN
S7IEC_M104_CP343
S7IEC_M104_CP443
S7IEC_M104_WinAC
S7IEC_S101_CP1SI
S7IEC_S101_CP340
S7IEC_S101_CP341
S7IEC_S101_CP441
S7IEC_S101_WinAC
S7IEC_S104_151PN
S7IEC_S104_31xPN
S7IEC_S104_CP343
S7IEC_S104_CP443
S7IEC_S104_41xPN
S7IEC_S104_WinAC
S7_IEC_AddOn
FC
1
AD_DT_TM
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
5
V24_STAT
x
x
x
x
x
x
FC
6
V24_SET
x
x
x
x
x
x
FC
10
AG_CNTRL
x
x
x
x
FC
34
SB_DT_DT(ab V1.5)
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
50
AG_LSEND
x
x
FC
60
AG_LRECV
x
x
FC
100
Set_Buf_Para
x
x
x
x
x
x
x
x
x
x
x
x
FC
110
S7_IEC_Buf_Create
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
111
S7_IEC_Buf_Control
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
112
S7_IEC_Job_Info
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
113
S7_IEC_Diag
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
114
S7_IEC_TimeConv
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
115
S7_IEC_MA_Find_IEC_Adr
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
116
S7_IEC_Copy
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
FC
121
H_Calc_DST_UTC_Europe
x
FC
140
MAo_SP_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
FC
141
MAo_DP_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
FC
142
MAo_ST_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
FC
143
MAo_BO_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
FC
144
MAo_ME_NA_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
FC
145
MAo_ME_NB_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
FC
146
MAo_ME_NC_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
FC
147
MAo_IT_IM_pDB
x
x
x
x
x
x
x
x
x
x
x
UDT
65
TCON_PAR
x
x
x
x
x
x
VAT
VAT_S7_IEC
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
The (green) marked blocks are standard SIMATIC blocks.
All others are the application-specific blocks.
If there are already blocks in your project with the same name, you can modify the names according to
the requirements of your project using the 'block/re-wiring' function.
The FB100 blocks ('S7_IEC_Config') are designed exclusively for the OB1 sequence level. Within this al-
so the application blocks have to be operated!
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 224 of 235 ©SIEMENS AG 2013
12.2. Re-wiring blocks
Particularly if using SIPLUS RIC blocks in existing projects or in conjunction with other libraries crossover
of block numbers may occur.
Prior foreign blocks (from the view of SIPLUS RIC) should be renamed. The block numbers of SIPLUS
RIC should be kept. This allows a better support by Siemens and an easy change in case of updates.
In case this is not possible the following rules apply:
12.2.1. Data blocks:
There are no fixed assigned data blocks. They are all created as instance DB or are assignable by pa-
rameterizing. Therefore they are free selectable in the numbering band.
Exception:
IEConS7 for WinAC: Here the data blocks are part of the Runtime-Software. If its DB numbers have to be
changed, they have to be changed in the Parameter DB as well.
12.2.2. Independent FBs / FCs:
FB / FC which may not be called from other blocks may be re-named directly. These are in IEConS7:
FB100 / FB170 (S7_IEC_Config)
All SLi, SLo, MAi and MAo-Blocks
Add_On-Blocks like FC121 (H_Calc_DST_UTC_Europe)
12.2.3. FBs / FCs with dependency
All other FB and FC numbers have to be changed if required using the function ‚Re-wiring’. Procedure:
1 Copy the desired block library into a project like independent S7 program
2 Re-name the FB100 to a high block number (see 12.2.3.1)
3 For the re-wiring procedure follow the online help in the Simatic manager
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 225 of 235 ©SIEMENS AG 2013
12.2.3.1. Possible problems at re-wiring
Problems may occur by multilevel multi instance FB and its request sequence. The re-wiring routine
of the Simatic manager needs an ascending interlacing sequence.
Example:
In the T101 variant the IEConS7 has the following format:
FB100 Layer 1
FB101 FB7
FB8
Layer 2
FB110
Layer 7
FB120
In case of rewiring the FB7 for example, the rewiring routine of the Simatic manager is not working cor-
rectly. The location of FB7 in FB101 and FB101 located in the FB100 is no ascending sequence because
FB101 is >FB100.
12.2.3.2. Solution / Workaround:
A solution would be the re-naming of FB100 into FB1000 because FB1000 >FB101 (FB7 located in
FB101 located in FB1000).
Since FB100 is a „Start-FB“ at IEConS7 it can / may be re-named just by changing the block number in
the Simatic-Manager:
1 Convert the FB100 to a high FB-number (e.g.FB1000) with the function re-name (F2)
2 Carry out the rewiring function according to your demands
3 In the end the re-named FB100/1000 may be arbitrary re-named again.
FB100 Layer 1
FB101 FB7
FB8
Layer 2
FB110
Layer 7
FB120
FB1000 Layer 1
FB101 FB7
FB8
Layer 2
FB110
Layer 7
FB120
12.3. Interoperability list for T101/T104
The interoperability list for the protocols IEC6087-5-101 and IEC6087-5-104 is included on the CD as a
separate PDF file (IEConS7 Interoperability.pdf):
Interoperability list for T101/T104
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 226 of 235 ©SIEMENS AG 2013
12.4. New Features and Functions
12.4.1. Delivery Version V1.1
Below you find a listing with the fundamental improvements in the delivery version V1.1
Assignment of the blocks in SIMATIC H-Systems
The direct assignment of the blocks in SIMATIC H-Systems is now
possible because several registration codes can be entered and the
request of the serial number is parameter driven.
see chapter 8
Supporting CP340
CP340 is supported as an additional interface for T101 protocol vari-
ant.
Same product-ID like CP341-variant.
Delivery also with this variant.
T101/104: Message buffering - Using message memory
Parameter driven processing of the message memory in case of Link
Error.
see chapter 4.4.1
T104: Confirmation buffer
From V1.1 sent T104-messages with user data (I-Formats) can be
buffered meeting technical standard and with this can be recalled.
see chapter 4.4.2
T104: Reverse link connection
The TCP link connection can be carried out active as well as passive
also with connections via the CPU.
T104: Multiple channel Master (T104-Master-Redundanz)
Now also in the Master two active TCP connections are possible
(T104 redundancy group). Both are monitored with test frames. The
data control using StartDT is carried out automatically.
see chapter 4.3.1
T104: Standardized switch off from not used channels
PN and CP-Interface
PN-Interface can be switched off by Port=0
CP-Interface can be switched off by ID=0
T104: Enhanced connection supervisory
I-Formats are not any more confirmed if the connection is non active
(S-Format)
Possibility for the communication partner to detect a non active chan-
nel and to restart the link connection.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 227 of 235 ©SIEMENS AG 2013
T104: Handling of faults – time delayed
Also with established TCP connection the fault output L2_Link_Error
will be set after a parameter driven delay time, if no T104 connection
is active.
T104: Further diagnosis bits (active channel,…)
At T104 additional diagnosis bits are available:
connection faults channel specific
signaling of the active channel
SL-Blocks: Individual information object address (IOA)
Individual (non ascending) IEC address allocation is now possible in
all SL blocks via address parameter DB’s.
see chapter
6.1.3.4
SLi-Blocks: Interrogation groups can be called without GI
Pure group interrogations can be set by parameter.
(without reaction on GI).
SLi_ME_ABC: Collection of measurands
Interrogated measurands are now actual values.
Reset of the threshold value possible via a block input.
(Up to now a new threshold value was taken over only with achieve-
ment of the last threshold)
SLi_IT: Collection of integrated totals:
At collection variants with IEC status the CY-Bit (CY = carry) is reset
from V1.1 with each restoring / clearing. If required it has to be set
from the user only one time (Set command).
SLo-Blocks: Structure extension with filler bytes
The command output format ,Dst_Struct_Type’ now allows also filler
bytes (1-7) like at the SLi blocks.
SL(o)-Blocks: Negative confirmation of commands with unknown TK/IOA
Not executed commands due to unknown TK or IOA are negative
confirmed with adapted cause of transmission (COT).
see chapter 6.1.1
SL_Org: Improved adjustment with TK103 and Receive signaling
Improved procedure for time synchronization for synchronization via
time adjustment message (TK103).
with programmable transit time correction
Diagnosis output for transfer of the time from TK103
MAo-Blocks: Automatically image distance
Determination of the image length automatically in dependency on the
image type at default ‚Image_Len’ in the image = 0.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 228 of 235 ©SIEMENS AG 2013
MAo-Blocks: Output format with time stamp
The MAo-Blocks have been extended with an output format with time
stamp.
see chapter 6.3.3
Several registration codes
If the specified registration code is not suitable it will be interpreted as
DB number if it is >0 and <=2000 (decimal!). The DB will be opened
and scanned for suitable registration codes.
Important for the application in SIMATIC H-Systems.
see chapter 8.2
Licensing via serial number the CPU or MC
Optional selection whether the serial number of the CPU or the
memory card has to be taken for licensing.
Important for the application in SIMATIC H-Systems.
see chapter 8.2
Reset-Input for ‘quasi’ Online-Modifications
Block input for program controlled or manual restart of the IEC appli-
cation without CPU Stop / Start.
Important because some parameter are not effective if loaded online.
Optional DB-No. for buffer
The lowest DB number created from program is now programmable.
Set diagnosis bits Link_Error etc. at demo time expiration
In case of fault (demo time expired) the disturbance outputs
L2_Error_Link, Con_Err_Cx are set and the outputs Cx_isActive are
reset.
Performance increasing for Master - Applications
In case of blocked receive messages a repeated (and then reduced)
cycle of the Master block can be programmed.
see chapter 4.5
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 229 of 235 ©SIEMENS AG 2013
12.4.2. Delivery Version V1.2
Subsequent you find a list with the essential improvements in the delivery version V1.2
Application of the blocks in the ET200S CPUs
Now also variants for the application in SIMATIC ET200S CPUs
available.
see chapter 3.1
and chapter 4.1
T101 Master, polling line
The variants for the T101 Master now also support the polling mode
with several stations on one line.
see chapter 6.3.2
Command buffering
From V1.2 fast successively received switching commands (impulse
commands) can be buffered.
With it command sequences are supported.
see chapter 6.1.3.1
T103 Master
The functionality of the SIPLUS RIC IEC on S7 application for the
IEC60870-5-103 Master protocol is described in the SIPLUS RIC
IEC103 on S7 manual.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 230 of 235 ©SIEMENS AG 2013
12.4.3. Delivery Version V1.3
Subsequent you find a list with the essential improvements in the delivery version V1.3
IEC on WinAC
With the version V1.3 WinAC based systems are supported from
SIPLUS RIC IEConS7 now. On this computers the software package
WinAC from RTX 2010 must be installed.
see chapter 3.2.3
and chapter 4.2.3
GI initiation manually
SL_Org_ASDU (FB121) was extended by the boolean input ‚Sim_GI’.
A positive edge at this input simulates the initiation of a general inter-
rogation (with originator 0). Like at a real interrogation the GI-
Confirmation and the GI-End message are transmitted as well.
see chapter 6.1.1
Signaling GI runs
SL_Org_ASDU (FB121) was extended by the boolean output
GI_Runs. It serves for the signaling of a received (and from
SL_Org_ASDU processed) GI-Request.
see chapter 6.1.1
Support of TK102 (Single request)
The single request with message type TK102 specified in the IEC-
Standard is supported now.
see chapter 6.1.1
Processing measured values Initiation method
Particularly at slow communication lines it may be disturbing to
transmit each detected change of a measured value. With the ‚Initia-
tion Method’ the problem can be avoided. The activation of the func-
tion initiation method is carried out via an additional input
‚Use_Initiation_Method’
see chapter 6.1.2.4
Limit of the number of measured values at cyclic transmission
With the new parameter ‚No_Cyclic_Infos’ the number of transmitted
measured values per cyclic initiation is limited.
see chapter 6.1.2.4
Processing measured values instant reaction at threshold changing
A change of the parameter ‚Threshold_Sensivity’ at run time is moni-
tored and treated like a reset of the thresholds with parameter ‚Re-
set_Threshold’
see chapter 6.1.2.4
Extension of the send buffer: Number and Dimension
The FB100 blocks were extended by two parameters:
No_of_Send_Buffers (1..16): Number of send buffer to be created
Send_Buffer_Dim: Dimension in Byte of send buffer to be created
see chapter 3.3.2
see chapter 4.3.2
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 231 of 235 ©SIEMENS AG 2013
Priority assignment of the Send buffer
In all SLi-blocks the previous boolean parameter ‚Tx_Prio_L_H’ was
replaced by the integer input ‚Tx_Prio’. By means of it the user can
give the priority assignment 0 (high) up to 15 (low).
see chapter 6.1.2
Use of the NON_Retain memory
With the introduction of the NON_Retain memory the user has the
possibility to gain additional data memory by using the (non buffered)
working storage of the CPU. This NON_Retain memory can be used
for buffering of data in SIPLUS RIC IEConS7.
see chapter 7
Introduction of the FC100 Block
The FC100 block can be used for the following tasks:
Use of an offline generated DB (also NON-Retain) as buffer-DB;
Adaption of the DB-length from automatically generated DBs;
Readout of DB number and DB length from internal buffer DBs.
see chapter 7.1.1
Multiple Channel / Redundancy FB100
With the IEConS7 variant V1.3 the cascading of FB100 blocks is now
possible. Basic concept is the coupling of another (or more) FB100 to
an existing FB100
see chapter 5
Parameter Line_ID, Comp_ID und Con_ID
The Line_ID at the FB100 blocks now is standardized used for the
derivation of the internal Connection_ID (Con_ID).
Parameter Block_Len
The parameter ‚Block_Len’ previous used only internally is now
available in all Slave versions. Here the max. length of the ASDU is
adjusted.
CPx43-receiving advanced
If the number of (still) expected signs is unknown the receiving at
CP343 and CP443 is adapted from 1 to 6 signs.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 232 of 235 ©SIEMENS AG 2013
12.4.4. Delivery Version V1.4
Subsequent you find a list with the essential improvements in the delivery version V1.4
AddOn-blocks
Application blocks FB161 and FB166 for nodal functions meeting
Master as well as Slave functions
see manual AddOn
nodal blocks
FB161 for transfer of information in monitoring direction (indications,
measured values etc.) from a subordinated station to the remote sta-
tion.
FB166 for transfer of the commands and setpoint values from a con-
trol center to the subordinated station.
SLi-blocks parameter Phase_Offset_Cyc_Interv
For a parameterizable offset of the initiation for cyclic transmission
and the restoring interval of the integrated totals.
see chapter 6.1.2
Supporting the polling mode of the ET200S (1SI)
The RTS lead and follow-up time for ET200S variants with 1SI can be
adjusted at the FB100 with the parameters ‚L1_Data_Wait_Time‘ as
well as ‚L1_Time_RTS_OFF‘.
At other CPs the parameter is located in the hardware configuration.
Special function SF_Originator
The value denoted here is taken over as originator in messages of
the own block and from the SLi-blocks.
see chapter 6.1.1
Support of H-CPUs V6
SIPLUS RIC supports the use of the PN-Interfaces integrated on the
V6-H-CPUs for IEC60870-104 communication on both CPUs.
see chapter 8.1.5
WinAC-Variants
The driver supports now Windows 7 as well
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 233 of 235 ©SIEMENS AG 2013
12.4.5. Delivery Version V1.5
Subsequently you will find a list with the essential improvements in the delivery version V1.5
General
Extensions at the internal interfaces require a complete upgrade of
existing projects during the actualization. Single V1.5 blocks may not
be taken over into older projects.
Excluded from this are all parameter data blocks. These can be con-
tinued to use from all previous projects.
KEMA-Certification and associated functional extensions
From 17.03.-22.03.13 the software version S7IEC_S104_31xPN SP1
including blocks from the MA-libraries (for reversed direction) was in-
troduced at the DNV/KEMA. It is a matter of the serial version V1.4
with improvements considered to be necessary in the front-end (-
>SP1) and corresponding PID V1.0 (Protocol Implementation Docu-
mentation).
During certification a few objections (almost exclusively in negative
tests) were resolved and additional tested as total version SP1.1
(+PID V1.1). This version has passed the certification. However a
marginal note is that the tests of standard direction (pure substation)
and reversed direction were not conducted at the same time. The
simultaneous functionality cannot be arbitrarily used without further
adaption / boundary conditions. This results from the now tight im-
plemented rejection (mirroring) of unknown messages (resp. mes-
sage contents).
V1.5 is based on version V1.4 and additionally extended by the fol-
lowing functions:
Slave and Master blocks can be used without restrictions and simul-
taneously. ASDU marked with ‚CON‘ in the standard (confirmed ap-
plication services) are centrally mirrored and with it generally with the
corresponding cause of transmission if the message cannot be ‚exe-
cuted‘.
The following causes of transmission are possible and executed in
the subsequent order:
<44>:= unknown type identifier:
If there is no evaluation block for the message type ‚CON‘.
This applies generally without interconnection at
P_Application.
<46>:= unknown common address of the ASDU:
broadcast addresses are not mirrored.
<45>:= unknown cause of transmission (COT)
In case of receiving unexpected or not supported cause of
transmission.
Received messages with one of the cause of transmission
mentioned here (44-47) are not mirrored.
<47>:= unknown address of the information object
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 234 of 235 ©SIEMENS AG 2013
Further functions:
The standard command blocks SLo (FB135-FB137) now support the
function ‘Select before Operate’ completely, i.e. including time moni-
toring. The function can be activated by parameter.
see chapter 6.1.3
The standard command blocks SLo (FB135-FB137) now not only ac-
cept commands with time but also the time stamp is monitored on ag-
ing activatable by parameter input.
see chapter 6.1.3
The command blocks SLo (FB135-FB137) have been extended by a
return value. It signals the reason if a command could not be execut-
ed.
see chapter 6.1.3
The Mao-blocks (FC140 - FC147) only accept the causes of trans-
mission (COT) which are permissible in the list of interoperability. If
an information is rejected because of 'unknown' COT, this is signaled
at the newly established FC_RetVal output.
see chapter 6.3.3
Some FBs need the SIMATIC FC34 (SB_DT_DT) from V1.5. It is now
part of all IEC libraries.
Validity of the KEMA Certification
A preliminary result V1.4 SP1.1 has been certified.
SIPLUS RIC V1.5 is not certified. However it can be classified func-
tionally as follows:
- Communication:
The variant ‚S104_31xPN‘ has been certified. Based on this
variant in V1.5 are as well:
S7IEC_S104_31xPN
S7IEC_S104_41xPN
S7IEC_S104_IM151PN
S7IEC_S104_WinAC (LAN interface administrated
from WinLC, with Port 2404 only one connection
possible)
S7_IEC_1500_104_MS_CPU_PN
- All SLi- (FB130-FB134) and SLo blocks (FB135-FB137) are
based on the certified blocks. These blocks are identical in
all SIPLUS RIC libraries.
All Mao- (FC140-FC147) and Mai blocks (FB148-FB150)
are based on the certified blocks. These blocks are identical
in all SIPLUS RIC libraries.
Functional description I IA CE
SIPLUS RIC IEC on S7 V1.5 Page 235 of 235 ©SIEMENS AG 2013
Performance Improvement ‚internal Loop processing‘
At receipt of blocked messages of each cycle one information was
removed until now and provided to the evaluation blocks (Mao).
From version V1.5 up to 10 information objects are internal provided
per cycle and edited from the Mao blocks. This is carried out inde-
pendently of the use of the blocks, in Master or Slave communication
in standard or reversed direction.
The possibility to improve the performance of the Master libraries de-
scribed in chapter 4.5 is no longer necessary. It is inapplicable includ-
ing the related parameter.
see chapter 4.5
Use of time interrupts
The Sli-Blocks (FB130-FB134) may be embedded in a time interrupt
additionally to the standard sequence (OB1). This is realized auto-
matically from the blocks and the inputs are scanned only in the time
interrupt.
In case of slow processing (e.g. 500 ms for measured values) a re-
lease of the standard cycle and therefore a faster communication can
be achieved.
Fast time interrupt cycles (e.g. 10 ms) are suitable for gathering indi-
cations with high demand of timing. Caution: This is permitted only for
a restricted number otherwise there is a possibility for cyclic time
faults. The standard sequence is extended as well.
see chapter 6.2
Support of TIA-Portal
The current libraries for the ET200S, S7-300, S7-400 and WinAC are
also available as TIA projects. It is a matter of example projects, the
library part is directly available in a program group.
Minimum required: TIA V12 SP1
Support of S7-1500
SIPLUS RIC supports the S7-1500 – Hardware:
T104-Protocol as Master and Slave via the PN-interface of
the CPU.
T101 and T103-Protocol via the communication modules
CM PtP.
see chapter 9
