Description Use one of the products below to establish an OPEN MODBUS / TCP communication to third-party devices with the S7-400 H station or with an S7-300/400 station with CPs.
OPEN MODBUS / TCP Redundant V1 (order number: 2XV9450-1MB01)
OPEN MODBUS / TCP Redundant V2 (order number: 2XV9450-1MB11)
The table below show the differences between OPEN MODBUS / TCP Redundant V1 and OPEN MODBUS / TCP Redundant V2.
Properties
OPEN MODBUS /
TCP Redundant V1
OPEN MODBUS /
TCP Redundant V2
Supported function codes
3, 4 and 16
1, 2, 3, 4, 5, 6, 15 and 16
Connections used
1
parameterizable
Usable CPs
all Industrial Ethernet CPs that do not support Multiport
Industrial Ethernet CPs that support the commands CMD 6 and CMD 7 of FC10 "AG_CNTRL".
Additional Information More information about which Industrial Ethernet CPs support the commands CMD 6 and CMD 7 of FC10 "AG_CNTRL" is available in Entry ID 33414377.
Table 01
Note It is recommended to use OPEN MODBUS / TCP Redundant V2.
Additional Information Detailed information about establishing OPEN MODBUS / TCP communication between SIMATIC S7 and third-party devices is available in Entry ID 22660304.
What is the difference between "normal routing" and data record routing?
Description
Routing is the transfer of data beyond network boundaries. In this case you can send data from a sender to a receiver over various networks. For this you need special device technology that provides this functionality.
Data Record Routing is an extension of "normal routing" and is used for drives, for example and by SIMATIC PDM when the programming device is not connected directly to the PROFIBUS DP subnet to which the target device is also connected, but to the PROFINET interface of the CPU, for example.
The data sent with data record routing includes the parameter assignment of the field devices participating (slaves) and also device-specific information (setpoint values and limit values, for example). In data record routing, the structure of the target address depends on the data content, that is on the slave for which the data is destined.
With the PG you can use data record routing to read and edit a parameter record already on the field device or send it to the field device if the PG is already assigned as target slave to another subnet.
The field devices themselves do not have to support data record routing, because these devices do not forward the information content.
The following S7-300 CPUs and components of distributed IO devices support data record routing:
CPU
Version
CPU 313C-2 DP
V3.3
CPU 314C-2 DP
V3.3
CPU 314C-2 PN/DP
V3.3
CPU 315-2 DP
V3.0
CPU 315F-2 DP
V3.0
CPU 315-2 PN/DP
V3.1
CPU 315F-2 PN/DP
V3.1
CPU 317-2 DP
V3.3
CPU 317F-2 DP
V3.3
CPU 317-2 PN/DP
V3.1
CPU 317F-2 PN/DP
V3.1
CPU 319-3 PN/DP
V2.7
CPU 319F-3 PN/DP
V2.7
IM154-8 PN/DP CPU
V3.2
IM154-8F PN/DP CPU
V3.2
IM154-8FX PN/DP CPU
V3.2
IM151-8 PN/DP CPU
V2.7
IM151-8F PN/DP CPU
V2.7
Table 01
S7-400 CPUs firmware version V5.1 onwards support data record routing. For this the CPUs must also be configured in a higher firmware version.
CPU
Version
CPU 412-1
V5.1
CPU 412-2 DP
V5.1
CPU 412-2 PN
V6.0
CPU 414-2 DP
V5.1
CPU 414-3 DP
V5.1
CPU 414-3 PN/DP
V5.1
CPU 414F-3 PN/DP
V6.0
CPU 416-2 DP
V5.1
CPU 416-3 DP
V5.1
CPU 416F-3 DP
V5.1
CPU 416-3 PN/DP
V5.1
CPU 416F-3 PN/DP
V5.1
CPU 417-4
V5.1
CPU 412-5H PN/DP
V6.0
CPU 414-5H PN/DP
V6.0
CPU 416-5H PN/DP
V6.0
CPU 417-5H PN/DP
V6.0
Table 02
The following communications processors (CPs) support data record routing:
CP
Order number
Version
CP443-5 Extended
6GK7443-5DX02
V3.0
CP443-5 Extended
6GK7443-5DX03
V4.0
CP443-5 Extended
6GK7443-5DX04
V6.0
Table 03
The following gateways support data record routing:
CPU
Order number
IE/PB Link
6GK1411-5AA00
IE/PB Link
6GK1411-5AB00
IWLAN/PB Link
6GK1417-5AB00
IWLAN/PB Link
6GK1417-5AB01
Table 04
Additional Information Refer to the manuals of the CPUs to see whether or not the data record routing function is supported. The manuals of the above-mentioned CPUs, gateways and CPs are available in the following Entry IDs:
Manual
Entry ID
SIMATIC S7-300 CPU 31xC and CPU 31x:
Technical data
More information about data record routing is available in Entry IDs 19257092 and 7808062.
Note
Data record routing by means of the backplane bus is not supported for an I slave. The data for these modules cannot be routed over the backplane bus.
Additional Keywords Process device communication, Field device communication
Which SIMATIC S7-300/S7-400 modules support the NTP time-of-day message and how do you activate this kind of time synchronization?
Introduction The NTP (network time protocol) is a general mode for synchronizing system clocks in local and global networks. The NTP mode differs fundamentally from most other protocols. NTP synchronizes not just all sorts of clocks with each other but also establishes a hierarchy of NTP time servers and NTP clients. A hierarchy level is called a "stratum", whereby "stratum 1" is the highest level. Time servers of this level synchronize themselves to a reference time source; these can be radio clocks, GPS receivers or modem time services. Stratum One Time Servers make their time available to multiple NTP clients in the network, which are designated as "stratum 2".
In the NTP mode, the CP transmits time-of-day queries (in client mode) to the NTP server in the subnet (LAN) at regular intervals. Taking the responses from the servers as a basis, the most reliable and most precise time-of-day is ascertained, and the time-of-day of the station is synchronized. The advantage of this mode is that it enables the time-of-day to be synchronized over and beyond subnet limits. The precision depends on the quality of the NTP server used.
SIMATIC S7-300 components with the time synchronization function using the NTP.
SIMATIC S7-300
Order number
Firmware
CPU314C-2 PN/DP
6ES7314-6EH04-0AB0
V3.3
CPU315-2 PN/DP
6ES7315-2EH13-0AB0
V2.5
CPU315-2 PN/DP
6ES7315-2EH14-0AB0
V3.1
CPU315F-2 PN/DP
6ES7315-2FH13-0AB0
V2.5
CPU315F-2 PN/DP
6ES7315-2FJ14-0AB0
V3.1
CPU317-2 PN/DP
6ES7317-2EK13-0AB0
V2.5
CPU317-2 PN/DP
6ES7317-2EK14-0AB0
V3.1
CPU317F-2 PN/DP
6ES7317-2FK13-0AB0
V2.5
CPU317F-2 PN/DP
6ES7317-2FK14-0AB0
V3.1
CPU319-3 PN/DP
6ES7318-3EL00-0AB0
V2.4
CPU319-3 PN/DP
6ES7318-3EL01-0AB0
V3.2
CPU319F-3 PN/DP
6ES7318-3FL00-0AB0
V2.5
CPU319F-3 PN/DP
6ES7318-3FL01-0AB0
V3.2
CP343-1
6GK7343-1EX20-0XE01)
V1.1
CP343-1
6GK7343-1EX21-0XE0
V1.0
CP343-1
6GK7343-1EX30-0XE0
V2.0
CP 343-1 IT
6GK7343-1GX11-0XE01)
V2.0
CP343-1 IT
6GK7343-1GX20-0XE0
V1.0
CP343-1 Adv
6GK7343-1GX21-0XE0
V1.0
CP343-1 Adv
6GK7343-1GX30-0XE0
V1.0
CP343-1 Adv
6GK7343-1GX31-0XE0
V3.0
CP343-1 Lean
6GK7343-1CX00-0XE01)
V1.0
CP343-1 Lean
6GK7343-1CX10-0XE0
V1.0
Table 01
1) Only the time-of-day of the internal CP diagnostics buffer is synchronized by means of the NTP.
ET 200 CPUs with the time synchronization function by means of the NTP.
ET 200 CPU
Order number
Firmware
IM151-8 PN/DP CPU
6ES7151-8AB00-0AB0
V2.7
IM151-8 PN/DP CPU
6ES7151-8AB01-0AB0
V3.2
IM151-8F PN/DP CPU
6ES7151-8FB00-0AB0
V2.7
IM151-8F PN/DP CPU
6ES7151-8FB01-0AB0
V3.2
IM154-8 PN/DP CPU
6ES7154-8AB00-0AB0
V2.5
IM154-8 PN/DP CPU
6ES7154-8AB01-0AB0
V3.2
IM154-8F PN/DP CPU
6ES7154-8FB01-0AB0
V3.2
IM154-8FX PN/DP CPU
6ES7154-8FX01-0AB0
V3.2
Table 02
SIMATIC S7-400 components with the time synchronization function using the NTP.
SIMATIC S7-400
Order number
Firmware
CPU412-2 PN
6ES7412-2EK06-0AB0
V6.0
CPU412-5H PN/DP
6ES7412-5HK06-0AB0
V6.0
CPU414-3 PN/DP
6ES7414-3EM05-0AB0
V5.0
CPU414-3 PN/DP
6ES7414-3EM06-0AB0
V6.0
CPU414F-3 PN/DP
6ES7414-3FM06-0AB0
V6.0
CPU414-5H PN/DP
6ES7414-5HM06-0AB0
V6.0
CPU416-3 PN/DP
6ES7416-3ER05-0AB0
V5.0
CPU416-3 PN/DP
6ES7416-3ES06-0AB0
V6.0
CPU 416F-3 PN/DP
6ES7 416-3FR05-0AB0
V5.0
CPU 416F-3 PN/DP
6ES7416-3ES06-0AB0
V6.0
CPU 416-5H PN/DP
6ES7416-5HS06-0AB0
V6.0
CPU 417-5H PN/DP
6ES7417-5HT06-0AB0
V6.0
CP443-1
6GK7443-1EX11-0XE0
V2.0
CP443-1
6GK7443-1EX20-0XE0
V1.0
CP443-1
6GK7443-1EX30-0XE0
V3.0
CP443-1 Adv
6GK7443-1EX40-0XE0
V1.0
CP443-1 Adv
6GK7443-1EX41-0XE0
V1.0
CP443-1 Adv
6GK7443-1GX20-0XE0
V2.0
CP443-1 Adv
6GK7443-1GX30-0XE0
V3.0
CP443-1 IT
6GK7443-1GX11-0XE0
V2.0
Table 03
Activating the NTP for time synchronization
You set the time synchronization for the CPUs via the NTP in the hardware configuration of STEP 7.
Open the Properties dialog of the Industrial Ethernet CP to enable. In the "Time Synchronization" tab, set a check mark for "Activate NTP time-of-day synchronization".
Enter the IP addresses of the relevant NTP servers in the "NTP Server Addresses" field.
Important
The NTP mode does not support any automatic changeover between summer time and winter time. This is not provided for in the protocol. You must change the local time accordingly. NTP always transmits the coordinated world time (UTC) or Greenwich Mean Time (GMT).
How to calculate summer time is described in Entry ID: 19324378
You cannot set any time zones when using the NTP time-of-day synchronization mode in S7-300 and S7-400 CPUs.
In the case of CP343-1 IT with order number 6GK7343-1GX20-0XE0 and firmware V1.0 you must select the MPI address 2 for the CPU when using the "Set CPU time" function. As from firmware V1.1, setting the CPU time is independent of the MPI address, see Entry ID: 21070809.
Example of a time-of-day relay with S7-400 as time slave In order to be able to use the NTP mode you must enable the "Activate NTP time-of-day synchronization" function in the Properties dialog of the Industrial Ethernet CP -> "Time-of-Day Synchronization" tab. Furthermore, at least one IP address of an NTP server must be specified with the "Add..." button and the "Forward time of day to a station" option must be enabled. The time zone and update interval should be set according to the requirements of the project.
You can use these NTP servers for time-of-day synchronization. In this example the time-of-day synchronization is made by means of the Stratum One Time Server of the University of Erlangen-Nürnberg.
In the Properties dialog of the CPU you must configure the S7-400 CPU as time slave in the "Diagnostics/Clock" tab.
Fig. 02
Example of a time-of-day relay with an S7-300 as time slave In order to be able to use the NTP mode you must enable the "Activate NTP time-of-day synchronization" function in the Properties dialog of the Industrial Ethernet CP > "Time-of-Day Synchronization" tab. Furthermore, at least one IP address of an NTP server must be specified with the "Add..." button and the "Forward time of day to a station" option must be enabled. The time zone and update interval should be set according to the requirements of the project.
Fig. 03
A list of active NTP servers (stratum 1) is available at the following internet site: http://support.ntp.org/bin/view/Servers/WebHome. These NTP servers can be used for time-of-day synchronization. In our example the time-of-day synchronization is made by means of the NTP server (stratum 1) of the University of Erlangen-Nürnberg.
Since the time-of-day of the S7-300 CPU is repeatedly set from the Industrial Ethernet CP, it is necessary to have a connection resource for this service of the S7-300 CPU. Please bear this in mind when configuring the system.
There is only need to configure time-of-day synchronization for the S7-300 CPU if you are using one of the following Industrial Ethernet CPs:
SIMATIC S7-300
Order number
Firmware
CP343-1
6GK7343-1EX30-0XE0
as from V2.2
CP343-1 Adv
6GK7343-1GX30-0XE0
as from V1.0
CP343-1 Adv
6GK7343-1GX31-0XE0
as from V3.0
CP343-1 Lean
6GK7343-1CX10-0XE0
as from V2.2
Table 04
If you are using one of the above-mentioned Industrial Ethernet CPs, then you must make additional settings in the Properties dialog of the CPU. The settings depend on the configuration of the communication bus in the backplane bus of the CPU.
The communication bus is configured as a party line, in other words it is physically "wired through" to the MPI interface on the CPU. This setup is found in CPUs from CPU 312 up to and including CPU 315-2 DP and the C7 devices. In this case, in the Properties dialog of the CPU you select the "Diagnostics/Clock" tab and set "As slave" for the synchronization mode on the MPI.
Fig. 04
The communication bus is not configured as a party line, in other words the MPI interface and the communication bus are separate. This bus setup is found in CPUs from CPU 315-2 PN/DP up to and including CPU 319-3 PN/DP. In this case, in the Properties dialog of the CPU you select the "Diagnostics/Clock" tab and set "As slave" for the synchronization mode in the PLC.
Fig. 05
Diagnostics
Open the NCM S7 diagnostics of the Industrial Ethernet CP to determine the status of the time synchronization.
Start the NCM S7 Diagnostics in the Windows START menu by means of "SIMATIC > STEP 7 > NCM S7 > Diagnostics".
Alternatively you can also open the NCM S7 Diagnostics with the SIMATIC Manager. Right-click the Industrial Ethernet CP and select the menu "PLC > Module status". In the "Module status" dialog you switch to the "General" tab and click on the "Special Diagnostics" button to open the NCM S7 Diagnostics of the Industrial Ethernet CP.
Information about time-of-day synchronization in SIMATIC mode or in NTP mode is available in the "Time-of-Day" tab.
Fig. 06
Note the following points when interpreting the display:
Display of configured NTP servers You can specify up to four NTP servers in the configuration. The relevant NTP servers are addressed by the CP and their reply messages evaluated. The NTP server with the greatest precision is chosen. This ensures that the station with the most precise time is synchronized.
Important here is the Status column. The following displays are possible here:
NTP master The CP accepts the configured NTP server for time-of-day synchronization. The CP assigns this status to just one of the configured NTP servers.
Reachable The configured NTP server is reachable in the network, but is not taken for time-of-day synchronization.
Reachable (unsynchronized) The configured NTP server is reachable in the network, but is not taken for time-of-day synchronization. The CP recognizes from the message that the NTP server is not synchronized.
Not reachable The NTP server is configured but cannot be reached under the specified IP address.
None of the configured NTP servers is displayed as NTP master Sometimes all the NTP servers are displayed as Reachable - but none as NTP master.
This indicates that the time-of-day of the NTP servers has been evaluated as imprecise.
In the CP's firmware there are various checks that are defined in the corresponding RFCs (Internet Standard).
This might also have something to do with the synchronization of the NTP master. There are multiple time stamps in the NTP message. If an NTP server is not synchronized externally, this is noted accordingly in the time stamps in the messages. The consequence is that the time-of-day of these NTP servers is not accepted.
The fact that there is no potential NTP master among the reachable NTP servers is also indicated to the user in addition by a counter in the diagnostics. In this case the "How often the sampling interval was exceeded" counter is increased by 1 after expiry of the sampling interval.
Note
All CPs that are older than the modules listed or which have an older firmware version do not react to the reply message of an NTP server if the server does not have an even-numbered NTP version, V2.x, V4.x, for example. You must then upgrade the module with the latest firmware version. All more recent modules that support time-of-day synchronization by means of NTP also accept reply messages from other NTP server versions.
SICLOCK TM time-of-day transmitter The SICLOCK time-of-day transmitter is a separate unit that can transmit time-of-day messages by means of the Ethernet in SIMATIC or NTP mode.
SICLOCK TM, order number: 2XV9450-1AR23, firmware as from April 2001
The SICLOCK works exclusively as time-of-day master and broadcasts time-of-day messages in Multicast or Broadcast mode by means of ISO Industrial Ethernet. In NTP mode it is also possible to operate by means of a router. The SICLOCK time-of-day can also be synchronized with a central time from a DCF 77 or GPS receiver.
For more parameters please refer to the SICLOCK manual.
Which manufacturer ID, in other words OUI (Organizationally Unique Identifier), does SIEMENS AG use for the MAC addresses of network-compatible devices?
Gateways like IE/PB Link, IWLAN/PB Link and IE/AS-Interface Link
Interface modules of ET 200M, ET 200pro and ET 200S
ET 200eco PN
The first 3 bytes of the MAC address describe the manufacturer ID, also known as the OUI (Organizationally Unique Identifier).
Up to now these modules above have been delivered with a MAC address in which the first three bytes have always been 08-00-06.
The manufacturer ID of the MAC addresses is administered by the IEEE (Institute of Electrical and Electronics Engineers). At the link below you can see which manufacturer ID or OUI the first three bytes of a MAC address describe.
SIEMENS AG uses the following manufacturer IDs or OUIs for the MAC addresses of the above-mentioned network-compatible devices.
08-00-06 (hex)
SIEMENS AG
Siemens IT Solutions and Services, SIS GO QM O
Siemensstraße 2-4
POB 2353 Fürth 90713
GERMANY
00-0E-8C (hex)
Siemens AG A&D ET
Siemensstraße 10
Regensburg 93055
GERMANY
00-1B-1B (hex)
Siemens AG
I IA SC EWK PU1, Östliche Rheinbrückenstraße 50
76181 Karlsruhe, Baden Württemberg
GERMANY
Confusion may arise in the following situations:
A network engineer uses a new module whose factory-set MAC address has the manufacturer ID 00-0E-8C or 00-1B-1B. From older modules he is used to factory-set MAC addresses having the manufacturer ID 08-00-06. Therefore he will look for a MAC address 08-00-06-xx-yy-zz which, however, he will not find.
Spare parts scenario: A module with a factory-set MAC address of 08-00-06-xx-yy-zz is defective and has to be replaced with a new module. It might be that the factory-set MAC address of the new module has the manufacturer ID 00-0E-8C or 00-1B-1B.
What should you watch out for when using the alarm numbering procedure?
Description: In STEP 7 a distinction is made between the bit alarm procedure and the alarm numbering procedure.
Bit alarm procedure
In the bit alarm procedure the alarms are configured in WinCC, ProTool or WinCC flexible for the HMI. Tags are assigned to these signals. While the process is running the tag values are read out from the PLC at regular intervals. The configured messages are displayed on the HMI according to the values read out.
Alarm numbering procedure
In the alarm number procedure events to be reported are assigned message texts when the program is created in STEP 7 and alarm numbers are assigned.
Alarms numbers and associated message texts are stored in the HMI project when generated.
In productive mode, when an event to be reported occurs, only the alarm number and time stamp are transmitted from the CPU to the HMI device.
Then the HMI device displays the alarm number, the time of the event and the associated message text. (The message text is already stored in the HMI device.)
When configuring, a distinction is made here between the following three types of alarm:
Block-related alarms
Symbol-related alarms
User-defined diagnostics alarms
The 3 alarm types of the alarm numbering procedure are described in this entry and references are made to other entries that demonstrate how to configure these alarms. The entry is designed to be a guide for the alarm numbering procedure.
Block-related alarms:
You can configure block-related alarms in STEP 7 for BOOL parameters of the input (I), output (Q), marker (M), data (D) and local data (L) areas. They are triggered by the STEP 7 program synchronously to the program runtime using the system alarm blocks. The block-related alarm is sent to the HMI as soon as the STEP 7 program calls a system alarm block You can also have associated values from the PLC displayed on the HMI along with the block-related alarms.
A sample configuration and a description of how to configured ALARM_D and ALARM_S messages are available
More descriptions of how to configure block-related alarms are available in the STEP 7 Help under:
"Creating block-related alarms (CPU-wide)"
"Creating block-related alarms (project-wide)"
"Editing block-related alarms (CPU-wide)"
"Editing block-related alarms (project-wide)"
The following table describes the system alarm blocks that you can use to display block-related alarms in your program. These system alarm blocks are available in the "Standard Library" in the "System Function Blocks" directory.
Name
SFB/
SFC
S7 CPU
Acknowl-
edgable
Number of
alarm-
triggering
signals per
block
Number of possible
associated values
Win
CC
WinCC flexible/
ProTool
ALARM_SQ
SFC 17
S7-300/400
yes
1
12 ( max. length of all associated values together: 12 bytes)
yes
yes2)
ALARM_S
SFC 18
S7-300/400
no
1
12 ( max. length of all associated values together: 12 bytes)
yes
yes2)
ALARM_SC
SFC 19
S7-300/400
-
-
-
yes
yes2)
ALARM_DQ
SFC 107
S7-300/4001)
yes
1
12 ( max. length of all associated values together: 12 bytes)
yes
yes2)
ALARM_D
SFC 108
S7-300/4001)
no
1
12 ( max. length of all associated values together: 12 bytes)
yes
yes2)
NOTIFY_8P
SFB 31
only S7-400
no
8
10
yes
no
ALARM
SFB 33
only S7-400
yes
1
10
yes
no
ALARM_8
SFB 34
only S7-400
yes
8
None
yes
no
ALARM_8P
SFB 35
only S7-400
yes
8
10
yes
no
NOTIFY
SFB 36
only S7-400
no
1
10
yes
no
Table 1
1) The system functions SFC 107 and SFC 108 are supported by S7-300 CPUs from firmware V2.5.0.
2) Whether alarm display is possible depends on the HMI type. 3) Alarm_SC (SFC19) is not an alarm-triggering system function (SFC), but is only for querying the alarm status.
The system alarm blocks in Table 1 can be implemented in the following types of network:
Industrial Ethernet
MPI
PROFIBUS
Symbol-related alarms:
You can configure symbol-related alarms in STEP 7 for BOOL parameters of the input (I), output (Q) and marker (M) areas. Associated values can also be configured for symbol-related alarms. The alarms and associated values can be displayed with WinCC.
You can use the symbol-related alarms on S7-400 CPUs. They are triggered asynchronously to the program runtime. Here you can set a monitoring time (SCAN grid).
Descriptions of how to configure symbol-related alarms in STEP 7 are available in the STEP 7 Help under:
"Creating symbol-related alarms (CPU-wide)"
"Creating symbol-related alarms (project-wide)"
"Editing symbol-related alarms (CPU-wide)"
"Assigning and editing symbol-related alarms (project-wide)"
User-defined diagnostics alarms:
Via SFC 52 (WR_USMSG) you can enter user-defined alarms and additional information into the CPU's S7 diagnostics buffer. The S7 diagnostics buffer can be displayed on the HMI with WinCC and ProTool. It is not possible to display the S7 diagnostics buffer with SFC 52 in WinCC flexible. You can use other blocks for WinCC flexible. For this please refer to Entry IDs: 22449810 and 22319131.
Descriptions of how to configure user-defined alarms in STEP 7 are available in the STEP 7 Help under:
"Delete user-defined alarms (CPU-wide)"
"Delete user-defined alarms (project-wide)"
"Creating user-defined alarms (CPU-wide)"
"Creating user-defined alarms (project-wide)"
More information on SFC 52 is available in Table 2 below:
Name
SFB/
SFC
S7 CPU
Acknowl-
edgable
Number of
alarm-
triggering
signals per
block
Number of possible
associated values
Win
CC
WinCC flexible/
ProTool
WR_USMSG
SFC 52
S7-300/400
-
-
2 pieces of
additional information
yes
no/yes 1)2)
Table 2
1) Display of the S7 diagnostics buffer is not available in WinCC flexible as in ProTool. Refer here to Entry IDs: 22449810 and 22319131.
2) Whether alarm display is possible depends on the HMI type.
Quantity framework of the S7-300 CPUs for the alarm numbering procedure
With regard to quantity frameworks you must take into account not only the maximum number of alarms possible, but also the number of stations for alarm functions that can be logged on.
With S7-300 you can split the communication connections into PG, OP, S7-Basic communication and stations for alarm functions. The maximum number of communication connections and splitting is determined finally by the number of alarm stations that can be operated.
Table 3 below shows the quantity frameworks of the S7-300 CPUs (with actual firmware, see item 26290163).
CPU
Order no.
Max. number
of stations
that can be logged on
Simultaneously
active
ALARM_S
blocks
Max. number
of associated
values per alarm
CPU 312C
6ES7312-5BD01-0AB0
6
20
1...12 ( max. length of all associated values together: 12 bytes)
CPU 312C
6ES7312-5BE03-0AB0
6
20
CPU 313C
6ES7313-5BE01-0AB0
8
20
CPU 313C
6ES7313-5BF03-0AB0
8
20
CPU 313C-2DP
6ES7313-6CE01-0AB0
8
20
CPU 313C-2DP
6ES7313-6CF03-0AB0
8
20
CPU 313C-2PtP
6ES7313-6BE01-0AB0
8
20
CPU 313C-2PtP
6ES7313-6BF03-0AB0
8
20
CPU 314C-2DP
6ES7314-6CF02-0AB0
12
40
CPU 314C-2DP
6ES7314-6CG03-0AB0
12
40
CPU 314C-2PtP
6ES7314-6BF02-0AB0
12
40
CPU 314C-2PtP
6ES7314-6BG03-0AB0
12
40
CPU 312
6ES7312-1AD10-0AB0
6
20
1...12 ( max. length of all associated values together: 12 bytes)
CPU 312
6ES7312-1AE13-0AB0
6
20
CPU 312
6ES7312-1AE14-0AB0
6
300
CPU 314
6ES7314-1AF11-0AB0
12
40
CPU 314
6ES7314-1AG13-0AB0
12
40
CPU 314
6ES7314-1AG14-0AB0
12
300
CPU315-2DP
6ES7315-2AG10-0AB0
16
40
CPU 315-2DP
6ES7315-2AH14-0AB0
16
300
CPU 315-2 PN/DP
6ES7315-2EG10-0AB0
16
40
CPU 315-2 PN/DP
6ES7315-2EH13-0AB0
16
40
CPU316-2DP
6ES7316-2AG00-0AB0
12
50
CPU317-2DP
6ES7317-2AJ10-0AB0
32
60
CPU 317-2 PN/DP
6ES7317-2EJ10-0AB0
32
60
CPU 317-2 PN/DP
6ES7317-2EK13-0AB0
32
60
CPU318-2DP
6ES7318-2AJ00-0AB0
16
100
CPU319-3 PN/DP
6ES7318-3EL00-0AB0
32
300
CPU315F-2 DP
6ES7315-6FF01-0AB0
16
40
1...12 ( max. length of all associated values together: 12 bytes)
CPU315F-2 DP
6ES7315-6FF04-0AB0
16
300
CPU315F-2 PN/DP
6ES7315-2FH10-0AB0
16
40
CPU315F-2 PN/DP
6ES7315-2FH13-0AB0
16
40
CPU317F-2 DP
6ES7317-2AJ10-0AB0
32
60
CPU 317F-2 PN/DP
6ES7317-2FK13-0AB0
32
60
CPU 317F-2DP
6ES7317-6FF00-0AB0
32
60
CPU 317F-2DP
6ES7317-6FF03-0AB0
32
60
CPU 319F-3 PN/DP
6ES7318-3FL00-0AB0
32
300
Table 3
Example taking CPU319-3 PN/DP from Table 3:
In CPU319-3 PN/DP (with Firmware 2.7.2 or higher) you can have a maximum of 300 alarms consisting of ALARM_D or ALARM_S blocks. However, more alarms can be programmed/configured.
Quantity framework of the S7-400 CPUs for the alarm numbering procedure Tables 4 and 5 show the quantity frameworks of the S7-400 CPUs for the alarm numbering procedure.
CPU
Number of stations that can be logged on
Simultaneously
active ALARM_S/
ALARM_D blocks
Max. number
of associated values
(additional values)
per alarm with ALARM_S/
ALARM_D
ALARM_8 blocks
Max. length of data that can be transferred
via SD_i associated values
(additional values)
per alarm with NOTIFY
NOTIFY_8P,
ALARM and
ALARM_8P per SFB1)
CPU 412-1
8
70
1...12 ( max. length of all associated values together: 12 bytes)
300
432 bytes
CPU 412-2
8
70
1...12 ( max. length of all associated values together: 12 bytes)
300
432 bytes
CPU 414-2
8
100
1...12 ( max. length of all associated values together: 12 bytes)
600
432 bytes
CPU 414-3
8
100
1...12 ( max. length of all associated values together: 12 bytes)
600
432 bytes
CPU 416-2
12
200
1...12 ( max. length of all associated values together: 12 bytes)
1800
432 bytes
CPU 416-3
12
200
1...12 ( max. length of all associated values together: 12 bytes)
1800
432 bytes
CPU 417-4
16
200
1...12 ( max. length of all associated values together: 12 bytes)
10000
432 bytes
Table 4: Block-related alarm functions with S7-400
1)Explanations:
The maximum length of data that can be transferred via the associated values depends on:
Whether Acknowledgment-triggered Alarms is enabled.
How many associated values (SD_i) are transferred.
The maximum length of the data blocks of the CPU used.
The maximum length of the data blocks of the display devices.
The values in Table 4 are valid
If Acknowledgment-triggered Alarms is disabled.
For transferring an associated value (SD_i).
If the maximum length of the data blocks is 480 bytes for the CPU used and the display devices in each case.
How to calculate the maximum length of the data is explained in the manual "System Software for S7-300/400 System and Standard Functions", section 23.1, in Entry ID 1214574.
CPU
Number of stations that can be logged on
Symbol-related alarms (max. number)
Max. number of associated values (additional values) per alarm
CPU 412-x
8
512
1
CPU 414-x
8
512
10
CPU 416-x
12
1024
10
CPU 417-x
12
1024
10
Table 5: Symbol-related alarm functions with S7-400
Explanations for Table 5:
The possible number of symbol-related alarms also depends on the the monitoring time (SCAN grid) set.
Example taking CPU 416-3 to better explain the maximum values given in Tables 4 and 5:
You can configure a maximum of 1024 symbol-related alarms for CPU 416-3. All these alarms can be present at the same time.
You can program/configure a maximum of 1800 ALARM_8 blocks for CPU 416-3. All these alarms can be present at the same time(1800 * 8 alarms = 14400 alarms).
In CPU 416-3 you can have a maximum of 200 alarms consisting of ALARM_D or ALARM_S blocks. However, more alarms can be programmed/configured.
Note:
Please note that not all these alarms are generally displayed simultaneously on the HMI. How many alarms can be displayed simultaneously on the HMI depends on the quantity structure of your HMI.
The resources used for ALARM_8 blocks are different to those used for ALARM_S/ALARM_D.
Which IO controllers and IO devices support the following functions: IRT, prioritized startup, MRP, PROFIenergy, Shared device, I device and clock-synchronized mode?
Description The Entry ID 49311792 gives you an overview of the PROFINET IO controllers and IO devices of SIMOTION and SINAMICS that support the PROFINET functions above.
Isochronous real-time communication (IRT) Synchronized transmission procedure for cyclic exchange of IRT data between PROFINET devices. There is a bandwidth reserved for the IRT data in the transmitter clock. The reserved bandwidth guarantees that the IRT data can be transmitted at reserved, clock-synchronized intervals even when the network is otherwise heavily loaded (with TCP/IP communication or additional real-time communication, for example).
Prioritized startup Prioritized startup is the PROFINET functionality for accelerating the startup of an IO device in a PROFINET IO system with RT and IRT communication.
The function cuts the time needed by the appropriately configured IO devices to get back into the cyclic user data communication in the cases below:
After return of power supply
After station return
After IO device enabling
Medium redundancy protocol (MRP) Medium redundancy is a function for ensuring that availability of networks and plants. Redundant transmission paths (ring topology) ensure that when one transmission path fails an alternative path is made available.
PROFIenergy Function for saving power in the process, during idle times, for example, through temporary switch-off of the encoder and load supply in the potential group via standard PROFIenergy commands.
More information about PROFIenergy is available in the manuals ready for downloading in the Entry IDs below.
Shared device IO device that makes its data available to multiple IO controllers.
I device Using the I device function you can use an IO controller also as IO device and thus establish a separate lower-level PROFINET IO subnetwork.
An I device can also be used as a shared device.
Clock-synchronized mode for process data Process data, transmission cycle via PROFINET IO and user program are synchronized with each other to achieve the highest deterministics. The input and output data of distributed IOs in the plant is captured and output simultaneously. The equidistant PROFINET IO cycle is the clock for this.
What is the maximum number of parameters that can be assigned to an FC and FB in the S7-300 CPU?
Description The maximum number of parameters for a function (FC) in an S7-300 CPU is limited to 127. These can be IN, OUT or IN_OUT parameters. On the other hand, the number of parameters for a function block (FB) in an S7-300 CPU is not limited to a specific number, but is restricted by the maximum size of the instance data block.
Which types of connection/protocols do the S7-300/400 CPUs and the CPs support by default?
Instructions: You can connect your controller to various subnetworks depending on which S7-300/400 CPU or CP you are using. The following types of connection/protocols can be used for these subnetworks.
Subnet
Connection types/Protocols
MPI
(Multiple Protocol Interface)
S7 communication (S7-300 only as a server)
GD communication (global data communication)
S7 basic communication
PROFIBUS
DP distributed I/O
(via an integrated port, CP342-5 and CP443-5 extended) FMS - Field bus message specification
(via CP343-5 and CP443-5 Basic) FDL - Field bus data link
(only via PROFIBUS CP)
S7 communication (S7-300 only as a server1))
Industrial Ethernet / PROFINET
S7 communication
(via an Ethernet CP or integrated PN interface)
ISO transport(via Ethernet CP) ISO-on-TCP (via Ethernet CP or an integrated PN interface) TCP (via Ethernet CP or an integrated PN interface) UDP (via Ethernet CP or an integrated PN interface)
E-mail (via Ethernet CP) FTP (via Ethernet CP) PROFINET IO (via Ethernet CP or an integrated PN interface) CBA (via Ethernet CP or an integrated PN interface) MODBUS TCP(via Ethernet CPs or integrated PN interface, see Entry ID: 226603042))
PTP (point-to-point)
RK 512
3964(R)
ASCII
various print drivers
Modbus (RTU) (master/slave) 2)
Data highway DF1 2) ...
1) S7 300: Client functionality only via CP342-5 from FW V5.2
2) These types of connection/protocol cannot be configured as standard in STEP 7 and must be installed afterwards.
The manuals on the Ethernet or PROFIBUS CPs tell you which communication services they support.
Furthermore, the following entries contain an overview of the communication services for S7-300/400 Ethernet CPs and S7-300/400 CPUs with integrated PN interface.
The "Technical Data" chapter of the manuals on the S7 300/400 CPUs describe which communication services can be used via the integrated interfaces in the controllers:
Note about S7 communication: The S7-300 supports S7 communication via the FB14/15 "GET/PUT", FB12/13 "BSEND/BRCV" or FB8/9 "USEND/URCV" function blocks. It works via:
the integrated PN interface with the function blocks from the Standard Library -> Communication Blocks.
CPs with the function blocks from the SIMATIC_NET_CP library.
In the S7-400, data exchange takes place via the SFB14/15 "GET/PUT", SFB12/13 "BSEND/BRCV" or SFB8/9 "USEND/URCV" function blocks. They can be found in the Standard Library -> System Function Block
Note about communication via the integrated PN interface of the CPU: Data exchange by means of TCP, ISO-on-TCP and UDP protocols takes place via open IE communication. The connection and data exchange are configured via the following communication blocks:
UDT 65 "TCON_PAR" with the data structure for assigning parameters to the connection
UDT 66 "TCON_ADR" with the data structure of the addressing parameters of the remote partner (UDP)
FB 65 "TCON" for establishing the connection
FB 66 "TCON" for clearing down the connection
FB 63 "TSEND" for transmitting data via TCP and ISO-on-TCP
FB 64 "TRCV" for receiving data via TCP and ISO-on-TCP
FB 67 "TUSEND" for transmitting data via UDP
FB 68 "TURCV" for receiving data via UDP
You can find further information about the programming and use of the individual types of connection in the following manuals.
Manual
Entry ID
System softwarefor S7-300/400
Systemandstandard functions
1214574
S7 basic communication
S7 communication
Open communication via Industrial Ethernet
PROFINET I/O (SFC 14/15 ("DPRD_DAT/DPWR_DAT")
S7-CPs for PROFIBUS
Configuration and commissioning
1158693
SEND/RECEIVE communication via an FDL connection
DP
FMS
S7-CPs for Industrial Ethernet
Configuration and commissioning
8777865
SEND/RECEIVE communication via
ISO-on-TCP, TCP, UDP or ISO transport connection
PROFINET I/O (FC 9/10 "PNIO_SEND/PNIO_RECV")
Information technology in a
SIMATIC S7 with CP 343–1 IT / CP 343–1 IT GX20 and CP 443–1 IT
Description: IO devices that support the "Replace device without interchangeable medium" function can be replaced without the need for an interchangeable medium (Micro Memory Card, for example) with saved device name being slotted.
The replacement IO device no longer receives the device name from the interchangeable medium, but from the IO controller.
For this, the IO controller and the neighboring PROFINET devices of the replaced IO device must also support the "Replace device without interchangeable medium" function.
The IO controller uses the topology configured in STEP 7 to assign the device name and the neighbor relationships of the IO devices.
The IO controllers below support the "Replace device without interchangeable medium" function:
Configuration Notes: With the extended PROFINET diagnostics it is possible to have functions like the diagnostics and parameterization of integrated Ethernet interfaces (e.g. fiber-optic diagnostics and topology configuration). The PROFINET IO-Devices that support extended PROFINET diagnostics are configured in the Hardware Configuration in STEP 7. They are available in the hardware catalog and have additional ports e.g. interface modules as subslots in Slot 0.
Example: ET200S with and without PROFINET diagnostics
Fig. 01
The following IO-Controllers support the extended PROFINET-Diagnostics:
Module
Firmware
MLFB
PC CPs
CP1616
from V2.0
6GK1 161-6AA00
CP1604
from V2.0
6GK1 160-4AA00
SIMATIC NET PC-Software
SOFTNET PROFINET IO
from V7.1
(Edition 2008)
6GK1704-1HW71-3AA0
Embedded and PC-based Automation
WinAC RTX 2008
from V4.4
6ES7 671-0RC06-0YA0
S7-mEC, EC31-RTX
from V4.4
6ES7 677-1DD00-0BB0
S7-400 CPUs
CPU 414-3 PN/DP
-
6ES7 414-3EM05-0AB0
CPU 416-3 PN/DP
-
6ES7 416-3ER05-0AB0
CPU 416F-3 PN/DP
-
6ES7 416-3FR05-0AB0
S7-300 CPUs
CPU 315-2 PN/DP
from V2.5
-
CPU 315F-2PN/DP
from V2.5
-
CPU 317-2 PN/DP
from V2.5
-
CPU 317F-2PN/DP
from V2.5
-
CPU 319-3 PN/DP
from V2.5
6ES7318-3EL00-0AB0
CPU 319F-3 PN/DP
from V2.5
6ES7318-3FL00-0AB0
Industrial Ethernet CPs
CP343-1 Standard
from V2.0
6GK7343-1EX30-0XE0
CP343-1 Advanced
from V1.0
6GK7343-1GX30-0XE0
CP443-1 Standard
from V1.0
6GK7443-1EX20-0XE0
CP443-1 Advanced
from V2.0
6GK7443-1GX20-0XE0
ET 200S
IM151-8 PN/DP CPU
from V2.7
6ES7 151-8AB00-0AB0
IM151-8F PN/DP CPU
from V2.7
6ES7 151-8FB00-0AB0
ET 200pro
IM154-8 CPU
from V2.5
6ES7 154-8AB00-0AB0
The following IO-Devices can use the extended PROFINET-Diagnostics:
The PROFINET IO devices that support the extended PROFINET diagnostics can only be operated on PROFINET IO controllers that likewise support the extended PROFINET diagnostics.
There is a migration GSDML file for some of the PROFINET IO devices listed above for operating the PROFINET IO device on a PROFINET IO controller that does not support the extended PROFINET diagnostics.
Example: PN/PN coupler
Fig. 02
Note: The following applications provide a detailed description, including sample program, of the diagnostics options available in a PROFINET IO system.
"Diagnostic Methods for PROFINET Network Components (PROFINET IO, SNMP, WBM)" in Entry ID: 21566216
"PROFINET IO – Diagnostics Processing in the User Program"
in Entry ID: 24000238
Description: Before a S7-300 CPU starts processing the user program after switch-on, a startup program is processed. In the startup program, you can define specific presettings for your cyclic program by programming the startup OB accordingly.
All S7-300 CPUs always execute a restart (warm start). (Only the CPU 318-2 can also execute a cold restart, see Entry ID: 34053758)
In operating mode "STARTUP":
The program is processed in the startup OB 100 for restart (warm start).
Time- and alarm-controlled program processing is not possible.
Times are updated.
The runtime meter runs.
The digital outputs on signal modules are blocked, but can be set via direct access.
Restart (warm restart)
In a restart (warm restart), program processing restarts at the beginning of the program with a "basic setting" of the system data and user address areas.
The process image and the non-retentive markers, timers and counters are reset. Retentive markers, timers and counters each retain their last valid value. All data blocks parameterized with the property "Non Retain" are reset to the loaded values. The other data blocks each retain their last valid value.
Program processing starts again at the beginning (startup OB or OB 1).
Order of operations for restart (warm restart):
You can trigger a manual restart (warm restart):
Via the mode selector switch.
Via menu command from the PG or via communication functions (if the mode selector switch is set to RUN or RUN-P).
An automatic restart (warm restart) can be triggered at POWER ON if:
The CPU was not in STOP at POWER OFF.
The mode selector switch is set to RUN or RUN-P.
There is no automatic hot restart parameterized for POWER ON.
The restart (warm restart) of the CPU has not been interrupted by a power failure (independent of the startup parameterized).
Which SIMATIC S7 modules support the "Direct Data Exchange" function (internode communication)?
Configuration Notes: The following table gives you an overview of the SIMATIC S7 modules that support the "Direct Data Exchange" function (internode communication) as I slave or DP master in the receive and send area.
Module
I slave
DP master
S7-300 CPUs
x
x
S7-400 CPUs
x1)
x1)
ET200 CPUs
BM147-1 CPU
x
x
BM147-2 CPU
x
x
IM151-7 CPU
x
x
IM151-7 CPU FO
x
x
IM151-7 F-CPU
x
x
IM154-8 CPU
x
x
PROFIBUS CPs
CP342-5
-
-
CP443-5 EXT
-
x
S7-400 IM modules
IM 467
-
x
IM 467 FO
-
x
WinAC RTX 2005 from SP2
-
x
x1) The "Direct Data Exchange" function is supported in Send mode from V3.0 and from in Receive mode from V1.1.
Note:
When implementing interface modules, support of the "Direct Data Exchange" (internode communication) function depends on the CPU used and not on the interface module itself.
Which entries deal with consistent data in conjunction with distributed I/O?
Description: S7 Basis Communication involves unconfigured communication connections via which data is transferred on the MPI bus or on the PROFIBUS. The communication connections used are dynamic, i.e. they are set up and released again by the application.
S7 Basis Communication is on Layer 7 ("Application Layer") of the ISO-OSI reference model:
Fig. 01: ISO-OSI reference model
S7 Basis Communication services:
Services
Description
I_PUT / I_GET
This unidirectional service permits you to fetch or write the data of an I slave connected to your own PROFIBUS DP master system.
X_PUT / X_GET
This unidirectional service permits you to fetch or write the data of a module connected to the same MPI bus.
X_SEND / X_RCV
This bidirectional service permits you to fetch or write the data of a module connected to the same MPI bus.
Properties of the services: The data volume of the data to be transferred is a maximum of 76 bytes.
Service / Properties
I_PUT / I_GET
X_PUT / X_GET
X_SEND / X_RCV
Max. user data length
84 bytes / 94 bytes
76 bytes
76 bytes
Communication concept
Client / Server
Client / Server
Client / Client
Connection resources1)
0-12 (S7-300)
16-64 (S7-400)
- see CPU specification
0-12 (S7-300)
16-64 (S7-400)
- see CPU specification
0-12 (S7-300)
16-64 (S7-400)
- see CPU specification
Possible address areas
E, A, M, D
E, A, M, D
E, A, M, D
Blocks
SFC 72 "I_GET" / SFC 73 "I_GET"
SFC 67 "X_GET" / SFC 68 "X_PUT"
SFC 65 "X_SEND" / SFC 66 "X_RCV"
1) The connections resources to be reserved for the S7 Basis Communication are set in the STEP 7 Hardware Configuration in the Properties dialog of the configured CPU -> "Communication" tab.
Advantages of S7 Basis Communication with the service
There is no need to configure communication connections.
Data can be transferred dynamically and variably.
Data is sent and received consistently.
The connection resources can be controlled by the S7 program in the CPU.
The Client / Server and Client / Client communication concepts are possible.
Disadvantages of S7 Basis Communication with the service
S7 Basis Communication can be used only in homogeneous SIMATIC structures.
Only small volumes of data can be transferred.
Notes:
You can find general information about communication via SIMATIC S7 in Entry ID 20982954.
There is information available on the SFCs for S7 Basis Communication is available in the manual "System Software for S7-300/400 System and Standard Functions" in Entry ID: 1214574.
What properties, advantages and special features does the global data communication offer?
Description: Global data communication permits cyclic data communication between SIMATIC S7 CPUs via the MPI interface. Data communication is cyclic during updating of the process output and input images.
In addition to cyclic data transfer, it is also possible to have event-controlled data transfer in the S7-400 CPU via prepared function blocks. For this, function blocks are called in the S7 program for sending and receiving the data.
The data to be transferred is defined statically in the program and can be transferred consistently in different global data rings, i.e. defined groups of nodes that exchange global data with each other. The data can only be transferred to modules that have been parameterized in the same STEP 7 project and that use either the same communications bus (K bus) on the backplane bus or the MPI bus.
Global data communication and MPI are located as follows in the ISO-OSI reference model.
Fig. 01: ISO-OSI reference model
Global data communication services:
Services
Description
Cyclic data transfer
Cyclic data transfer covers all the configured global data rings. The data is transferred when the process image is updated.
GD_SND / GD_RCV
The S7-400 sends and receives global data packages through the event-controlled data transfer via the function blocks GD_SND and GD_RCV respectively. The global data ring number and global data package number are specified on the function block.
Properties of the services: The volume of the data to be transferred is low with a maximum of 22 bytes (S7-300 CPU) and 54 bytes (S7-400 CPU).
Service / Properties
S7-300
S7-400
Max. data length
22 bytes
54 bytes
Max. number of GD packages for sending
4 / 8
depending on the S7-300 CPU
8 / 16
depending on the S7-400 CPU
Max. number of GD packages for receiving
4 / 8
depending on the S7-300 CPU
16 /32
depending on the S7-400 CPU
Max. number of GD rings
4 / 8
depending on the S7-300 CPU
8 / 16
depending on the S7-400 CPU
Blocks
-
SFC 60 "GD_SEND" / SFC 61 "GD_REC"
Advantages of global data communication:
Simple configuration of communication.
Consistent data transfer.
Disadvantages of global data communication:
Global data communication can be used only in homogeneous SIMATIC structures.
Data transfer is static.
Only small volumes of data can be transferred.
Global data communication is not acknowledged.
Notes:
Global data communication is not available in the S7-400H.
You can find general information about communication via SIMATIC S7 in Entry ID: 20982954.
Information on the SFCs for S7 global data communication is available in the manual "System Software for S7-300/400 System and Standard Functions" in Entry ID: 1214574.
What is the connection between subnet masks and IP addresses with regard to subnetting and supernetting (Classless Inter Domain Routing CIDR)?
Configuration Notes With CIDR, there is no fixed assignment of an IP address to a network class and possible subnetting in other networks or supernetting of several networks in a class. There is only one network mask that splits the IP address into a network part and a host part.
The CIDR function (Classless Inter Domain Routing) thus includes subnetting and supernetting.
The following Industrial Ethernet CPs support the subnetting and supernetting functions:
6GK7343-1EX21-0XE0 as from FW V1.2
6GK7343-1EX30-0XE0
6GK7343-1GX21-0XE0 as from FW V1.1
6GK7343-1GX30-0XE0
6GK7343-1GX31-0XE0
6GK7343-1CX10-0XE0
6GK7343-1FX00-0XE0
6FL4343-1CX10-0XE0
6GK7443-1EX20-0XE0
6GK7443-1EX30-0XE0
6GK7443-1EX40-0XE0 as from FW V2.4
6GK7443-1EX41-0XE0
6GK7443-1GX20-0XE0
6GK7443-1GX30-0XE0
The following CPUs with integrated PROFINET interface support the subnetting and supernetting functions:
IM151-8(F) PN/DP CPU
IM154-8(F) CPU
CPU314C-2 PN/DP
CPU315(F)-2 PN/DP as from FW V2.3
CPU317(F)-2 PN/DP as from FW V2.3
CPU319(F)-3 PN/DP
CPU412-2 PN
CPU414(F)-3 PN/DP
CPU416(F)-3 PN/DP
CPU412-5H PN/DP
CPU414-5H PN/DP
CPU416-5H PN/DP
CPU417-5H PN/DP
S7-1200 CPUs as from FW V1.0
The following Industrial Ethernet PC modules support the subnetting and supernetting functions:
CP1616 as from V2.0
CP1604 as from V2.0
CP1613 (A2) as from SW V7.1
CP1623
CP1628
CP1612 and IE General
For the remaining Industrial Ethernet PC modules like CP1613 (A2) < SW V7.1, CP1604 V1, CP1616 V1 and CP1512 it is only possible to configure the "Subnetting" function. It is not possible to configure the "Supernetting" function for these modules in STEP 7 / NCM PC. This is prevented in STEP 7 / NCM PC by an error message (see Fig. 05).
In these modules that support the TCP/IP protocol it is possible to set both the IP address and the associated subnet mask in the hardware configuration of STEP 7. The IP address and associated subnet mask are entered in the Properties window of the CP's or CPU's Ethernet interface. After inserting the Industrial Ethernet CP or CPU with integrated PN interface in the hardware configuration, you are offered the following default settings (see Fig. 01) in the Properties window of the CP's or CPU's Ethernet interface.
IP Address: 192.168.0.1
Subnet mask: 255.255.255.0
Fig. 01: Properties window of a CP's Ethernet interface
If you wish to change these default settings for the IP address and subnet mask, you need information about the connection between classes of IP addresses and subnet masks. The following demonstrates the connection between classes of IP addresses and subnet masks.
Connection between class of the IP address and subnet mask In principle there are 5 classes of IP addresses. These are the classes A to E. Each class has its own subnet mask. The connections are given in the table below.
Class
Class bits
IP address range
Subnet mask
Network share
Node share
A
0xxxxxxx
0.x.x.x - 127.x.x.x
255.0.0.0
1 byte
3 bytes
B
10xxxxxx
128.0.x.x - 191.255.x.x
255.255.0.0
2 bytes
2 bytes
C
110xxxxx
192.0.0.x - 223.255.255.x
255.255.255.0
3 bytes
1 byte
D
1110xxxx
224.0.0.0 - 239.255.255.255
---
Multicast addresses
E
1111xxxx
240.0.0.0 - 255.255.255.255
---
Reserved addresses
(for future purposes)
Class A network IP addresses from Class A begin with the bit sequence 0-...; for example, the IP address range lies between 0.x.x.x and 127.x.x.x.
The subnet mask identifies the range that includes the address information for identifying the subnet. In Class A networks the first byte, that is to say the first 8 bits, corresponds to the IP address of the subnet address. Thus Class A networks are defined by the following subnet mask: 255.0.0.0 = 1111 1111 0000 0000 0000 0000 0000 0000. The last three bytes (24 bits) of the IP address identify a node in this subnet.
The total number of Class A networks can be calculated as follows:
28-1-2 = 27-2 = 126 networks (since the IP address always begins with the bit sequence 0-..., 0.0.0.0 and 127.0.0.0 are not permitted)
The number of computers in a Class A network can be calculated as follows:
224-2 = 16 777 214 computers (x.0.0.0 -> network address and x.255.255.255 -> broadcast address are not permitted)
Fig. 02: Class A network
Class B network IP addresses from Class B begin with the bit sequence 1-0-... and the address range lies between 128.0.x.x and 191.255.x.x. In Class B networks the first two bytes, that is to say the first 16 bits correspond to the IP address of the subnet address. Thus Class B networks are defined by the following subnet mask: 255.255.0.0 = 1111 1111 1111 1111 0000 0000 0000 0000. The last two bytes (16 bits) identify a node in this subnet.
The total number of Class B networks can be calculated as follows:
216-2 = 214 = 16384 networks (since the IP address always begins with the bit sequence 1-0...)
The number of computers in a Class B network can be calculated as follows:
216-2 = 65534 computers (x.x.0.0 -> network address and x.x.255.255 -> broadcast address are not permitted)
Fig. 03: Class B network
Class C network IP addresses from Class C begin with the bit sequence 1-1-0... and the address range lies between 192.0.0.x and 223.255.255.x. In Class C networks the first three bytes, that is to say the first 24 bits correspond to the IP address of the subnet address. Thus Class C networks are defined by the following subnet mask: 255.255.255.0 = 1111 1111 1111 1111 1111 1111 0000 0000. The last byte (8 bits) identifies a node in this subnet.
The total number of Class C networks can be calculated as follows:
224-3 = 221 = 2 097 152 networks (since the IP address always begins with the bit sequence 1-1-0...)
The number of computers in a Class C network can be calculated as follows:
28-2 = 254 computers (x.x.x.0 -> network address and x.x.x.255 -> broadcast address are not permitted)
Fig. 04: Class C network
Class D subnetwork The class D subnetwork consists of special addresses that are used for multicast addressing.
Summary The splitting up of IP addresses in network share and node share leads to the following conclusions:
A Class A network is larger than a Class C network, because there is a greater address area available for addressing the computers.
There are much less Class A networks than Class C networks because the address area of the subnets is smaller.
Reserved addresses
The Class A network address 127.x.x.x is reserved for the Loopback function of all computers, which means that
all IP addresses that have the value 127 in the first byte may only be used for internal tests of computers.
The value 255 in the last byte (Byte 4) is reserved asBroadcast Address. Thus, for example, the address 140.80.255.255 is a broadcast address to all nodes in the Class B network 140.80.0.0.
The following ranges are reserved for private networks. All IP addresses from these ranges are not routed in the Internet. 10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Until now, the connection between the class of the IP address and subnet mask has been explained. Furthermore, it is possible to extend the subnet mask with the so-called "subnetting" procedure.
Subnetting Subnetting can be implemented in a Class A network, for example. It is possible to divide the computers of this Class A network into further logical units (subnets). We will observe the Class A network 86.x.x.x as an example. The subnet mask of this Class A network is 255.0.0.0 (1111 1111 0000 0000 0000 0000 0000 0000). The address area can be divided further into logical subnets by extending the subnet mask by 1 bit. The subnet mask is then 255.128.0.0 (1111 1111 1000 0000 0000 0000 0000 0000).
This means the following for addressing:
Only the addresses 86.0.0.1 to 86.127.255.254 can communicate directly with each other, that is without router, because these computers have the same value (in this case "0") in the first bit after the subnet mask.
Only the addresses 86.128.0.1 to 86.255.255.254 can communicate directly with each other, that is without router, because these computers have the same value (in this case "1") in the first bit after the subnet mask.
The address area of the computers in this Class A network has been divided into two subnets.
Conclusion By extending the subnet mask you can divide the address area of the computers into more logical units (subnets). The address area has been divided into two subnets in the example. By adding more bits you can quickly multiply the number of subnets.
Supernetting Supernetting is the grouping together of multiple networks with partially the same network share in one subnet. The underlying technology is the opposite to subnetting and in principle means a procedure for addressing a large number of nodes within one subnet. With supernetting the node share of a network class is increased. Thus the network share of this network class is decreased.
We will observe the Class C network 192.168.178.0 as an example. The subnet mask of this Class C network is 255.255.255.0 (1111 1111 1111 1111 1111 1111 0000 0000). Now 2 bits are added to the node share. The subnet mask is then 255.255.252.0 (1111 1111 1111 1111 1111 1100 0000 0000).
The lowest IP address of the network to be assigned is
192.168.176.1 (1111 1111.1111 1111. 1011 0000. 0000 0001)
The highest IP address of the network to be assigned is
192.168.179.254 (1111 1111.1111 1111. 1011 0011. 1111 1110)
The addresses 192.168.176.1 to 192.168.179.254 can communicate directly with each other, this means without router.
Requirement The use of "Supernetting" requires that the modules in the network support the "Classless Inter Domain Routing" (CIDR) function.
Note If the module configured in STEP 7 does not support the subnetting function or the supernetting function, then use of these functions is prevented by the following error message in STEP 7
Fig. 05: STEP 7 error message
The STEP 7 Online Help indicates that the subnet mask in the incorrect format as follows.
Fig. 06: STEP 7 Online Help
What are the requirements for using the S7 routing function and which modules can you implement?
Description From STEP 7 V5.0 SP3 HF3 onwards you can reach ST stations online over and beyond subnet limits with the PG/PC, in order, for example, to load user programs or a hardware configuration or in order to execute test and diagnostic functions. You can connect a PG/PC at any place within the network and connect online to any stations which are reached through gateways.
Gateway
The gateway from a subnet to one or more other subnets is in a SIMATIC station that has interfaces to the subnets concerned.
Requirements
At least STEP 7 V5.0 SP3 HF3 is installed on the PG/PC for configuration and use of the S7 routing function.
An interface (Industrial Ethernet or PROFIBUS PC CP) is installed in the PG/PC to establish a connection to the gateway. You can use PROFIBUS PC CPs 55xx and 56xx. You can use any NDIS-compatible Ethernet network card (3COM, CP1613, for example) as Industrial Ethernet interface in the PG/PC.
The associated communications modules of the station support the S7 routing function.
The network configuration does not go across project boundaries.
Both the modules and the PG or PC are loaded with the configuration information that contains the latest "knowledge" about the complete network configuration of the project. Technical background All the modules associated with the gateway must receive information about which subnets can be reached over which routes (= routing information).
Note The lists below have been updated with the modules of the hardware catalog of STEP 7 V5.4 SP2. This means that older modules which support the S7 routing function are listed in the tables, but are not necessarily included in the hardware catalog of the latest versions of STEP 7.
SIMATIC S7-CPUs The list below gives an overview of the SIMATIC S7 CPUs that support the S7 Routing function.
SIMATIC S7 FM modules The list below gives an overview of the SIMATIC S7 FM modules that support the S7 Routing function.
FM
Version
Order number
FM 356-4 V5.0
V5.0
6ES7356-4BM00-0AE0
FM 356-4 V5.0
V5.0
6ES7356-4BN00-0AE0
FM 456-2
V5.0
6ES7456-2AA00-0AB0
Table 01
Gateways The list below gives an overview of the gateways that support the S7 Routing function.
Link
Version
Order number
IE/PB Link
as from V1.0
6GK1411-5AA00
IE/PB Link PNIO
as from V1.0
6GK1411-5AB00
IWLAN/PB Link PNIO
as from V1.1
6GK1417-5AB00
IWLAN/PB Link PNIO
as from V1.1
6GK1417-5AB01
Table 02
SIMATIC S7 IM modules The list below gives an overview of the SIMATIC S7 IM modules that support the S7 Routing function.
IM
Version
Order number
IM 467
as of V2.0
6ES7467-5GJ02-0AB0
IM 467 FO
as of V2.0
6ES7467-5FJ00-0AB0
Table 03
SIMATIC WinAC RTX, WinAC Slot and WinAC MP The list below gives an overview of SIMATIC WinAC RTX, WinAC Slot and WinAC MP that support the S7 Routing function.
Description: The attached document contains a description of the various memory concepts. To give you a better overview, the various memory concepts in the document are described in separate tables. The last chapter of the document includes a list of the various SIMATIC S7-300 controllers and C7 devices and their associated memory concepts.
The document is divided into the following chapters:
Overview of the Memory Areas and Memory Concept
1.1 Memory Areas
1.2 Memory Concept
1.2.1 Load Memory
1.2.2 Main Memory
1.2.3 System Memory
1.3 Determining the Memory Parameters of a CPU
SIMATIC S7-300 CPUs and C7 Devices Without Bay
2.1 Graphic Display of the Memory Concept
2.2 Load Memory
2.3 Main Memory
2.4 Application of the Buffer Battery
SIMATIC S7-300 CPUs and C7 Devices With MC Bay
3.1 Graphic Display of the Memory Concept
3.2 Load Memory
3.3 Main Memory
3.4 Application of the Buffer Battery
SIMATIC S7-300 CPUs and C7 Devices With MMC Bay
4.1 Graphic Display of the Memory Concept
4.2 Load Memory
4.3 Main Memory
4.4 Application of the Buffer Battery
Memory Concepts of SIMATIC S7-300 CPU Types and C7 Device Types in Detail
5.1 Memory Concepts of SIMATIC S7-300 CPU Types
5.2 Memory Concepts of C7 Device Types
Important: The memory concept for the SIMATIC CPU 318-2DP is similar to that for the SIMATIC S7-400 CPUs (see Entry ID:7302549).
Information on SIMATIC S7-300 CPUs with/without memory card (MC) is available in the following entries.
Data of the individual CPUs is available in the manual "SIMATIC PLC S7-300, CPU Specifications CPU 312 IFM to CPU 318-2 DP ", section 1.4 in Entry ID: 8860591
Notes on the various types of memory card and their properties are available in "SIMATIC PLC S7-300, CPU Specifications CPU 312 IFM to CPU 318-2 DP", section 1.1 in Entry ID: 8860591
Information on SIMATIC S7-300 CPUs with micro memory card (MMC) is available in the following entries.
Data of the individual CPUs is available in the manual "CPU 31xC and CPU 31x: Specifications", chapters 6 and 7 in Entry ID: 12996906
Notes on the various types of micro memory card and their properties are available in "S7-300 CPU 31xC and CPU 31x, Specifications", sections 4.1, 6.1 and 7.1 in Entry ID: 12996906
Notes on overall reset of the CPU can be found in the manual "S7-300 CPU 31xC and CPU 31x, Specifications", section 4.2, in Entry ID: 12996906
Information independent of the type of memory card (MC or MMC)
Notes on the topic of "How can you back up your program from the load memory?" are available in Entry ID: 299133
Notes on the topic of "What is the effect of the STEP 7 function "Copy RAM to ROM"?" are available in Entry ID: 15389520
Keywords:
CPU selection, Memory cards
Retentivity behavior of S7-300 CPU 31x and complete devices C7-6xx with MMC
Description: The retentivity behavior of the separate variables is important for developers when creating programs. Developers usually have variables in their programs, whose contents are to be retained even during POWER OFF (retentive) and other variables that then have to be reset to a defined value (non-retentive). In SIMATIC STEP 7 developers can therefore configure retentive address areas for data, markers, S7 timers and S7 counters which they can then use for retentive variables. This entry describes the retentivity behavior of the address areas of SIMATIC S7-300 CPUs and C7 deviceswith Micro Memory Card (MMC). The retentivity behavior of the address areas is described for the POWER OFF/ON change of status, the STOP/RUN operating mode and for overall reset.
The retentivity behavior of the address areas depends on:
The CPU.
The parameterization in the HW Configuration.
The configuration ("Non-Retain" enabled/disabled) of each individual data block (the settings are not effective in all CPUs).
Retentivity with data blocks
STOP/RUN operating mode or POWER OFF/ON
All the blocks in the load memory (MMC) are retained.
With the S7-300 CPUs and the C7 devices that do not support the "Non-Retain" block property, the DBs are always retentive by default.
With CPUs that support the "Non-Retain" block property you can set the retentivity behavior of each DB separately.
There requirement for this is that you make a setting in STEP 7 as from V5.2 +SP1 by:
Enabling/disabling the "Non-Retain" block property of the DB (see Table 01).
Creating a DB with SFC 82 "CREA-DBL". When you create a DB with SFC 82, in the DB's attributes it is defined in Bit 2 whether the DB is to be retentive or not.
If the "Non-Retain" property of the data block is disabled, the data block is retentive.
If the "Non-Retain" property of the data block is enabled, the data block is non-retentive.
Note:
With certain CPUs only part of the main memory can be used for retentive DBs. If the main memory for retentive data blocks is already full, then:
No more DBs are created by SFC 82 "CREA-DBL".
The error code W#16#80B2 (insufficient main memory) is returned via RET_VAL.
Information on how much main memory can be used for retentive data blocks in your CPU is available in the manual "S7-300 CPU 31xC and CPU 31x, Technical Data", Entry ID: 12996906, in chapters 6 and 7.
If no MMC is slotted at POWER ON, the CPU automatically performs an overall reset. This procedure is independent of the CPU's previously set operating mode.
Overall reset (MRES)
All the blocks in the load memory (MMC) are retained.
The data is reset to the current value from the load memory. These are the last current values loaded from the PG into the CPU or written to the load memory by SFC84 or the STEP 7 function "Copy RAM to ROM...".
Note:
If it is necessary to save the current data, it must be saved on the MMC (load memory). You can use the SFC84 or the STEP 7 function "Copy RAM to ROM..." for this. Write access to the load memory should not be too frequent, because an MMC only permits 100,000 write accesses.
How to configure the retentivity behavior of data blocks (only for CPUs that support the "Non-Retain" property)
In S7-300 CPUs and C7 devices all the data blocks are preset to retentive. With CPUs that support the "Non-Retain" property you can change the retentivity behavior of each data block to non-retentive. The following table describes how to set the retentivity behavior of a data block.
No.
Procedure
1
Mark the data block for which you wish to change the "Non-Retain" property. In the menu bar you select "Edit > Object Properties..." or press the key combination [Alt] + [Return]. This opens the data block's "Properties..." window.
Fig. 01
2
In the "Properties..." dialog you select the "General - Part 2" tab.
Fig. 02
3
When you enable the "Non-Retain" option, the data block is not retentive.
Fig. 03
Table 01
Warning:
The selection field for "Non-Retain" can be selected even if your CPU does not support the "Non-Retain" data block property, and has no affect in this case. Information on whether your CPU supports the "Non-Retain" data block property is available in the manual "S7-300 CPU 31xC and CPU 31x, Specifications", Entry ID 12996906, chapters 6 and 7, as well as in the product information A5E00830173-01 in the same manual.
Retentivity with markers, S7 timers and S7 counters
You can configure the retentive address areas of markers, S7 timers and S7 counters in "HW Config" as described in Table 01.
Operating mode STOP/RUN or POWER OFF/ON
The marker, S7 timer and S7 counter address areas retain their values if they have been defined as retentive. Otherwise they lose their values and are initialized with "0".
Overall reset (MRES)
The marker, S7 timer and S7 counter address areas are deleted with an overall reset regardless of whether they have been defined as retentive or non-retentive.
If no MMC is slotted at POWER ON, the CPU automatically performs an overall reset. This procedure is independent of the CPU's previously set operating mode.
How to configure retentive address areas for markers, S7 timers and S7 counters in STEP 7
The following table describes how to proceed to configure retentive address areas in an S7-300 CPU.
No.
Procedure
1
Open the Hardware Configuration of your S7-300 station.
Fig. 04
2
Double-click your CPU icon. Now the "Properties - CPU 31x ..." window opens. Select the "Retentive Memory" tab.
Fig. 05
3
In the "Retentive Memory" tab, in the "Retentivity" field you can configure the retentive address areas for:
Markers
S7 timers
S7 counters
Fig. 06
4
After configuring the desired retentive areas you can quit the CPU Properties dialog via "OK" or make changes in other tabs.
Table 02
Overall reset
The following table gives an overview of the overall reset procedures.
Overall reset with S7-300 CPUs and C7 devices with MMC
The following elements are deleted in the memory:
All markers
All S7 timers
All S7 counters
The following elements are retained:
Contents of the diagnostics buffer
Contents of the MMC (user program, ...)
Time
Status and value of the elapsed time counter
Behavior and functional sequences without MMC:
If no MMC is slotted at POWER ON, the CPU automatically performs an overall reset. This procedure is independent of the CPU's previously set operating mode.
Without MMC the original MPI interface parameters are retained.
Operation of the CPU without MMC is not possible. However, you can still read out the diagnostics buffer.
Functional sequences after overall reset with slotted MMC:
If you have an MMC inserted, following the overall reset the CPU copies the user program and the system parameters saved on the MMC to the main memory. With data blocks the current values are reloaded from the data blocks on the MMC.
If there are no current values in these data blocks on the MMC, then the initial values are loaded from the load memory.
If an MMC is slotted, at startup the CPU checks whether the data on the MMC are valid for it. If this is the case, the program and the interface configuration are loaded and activated.
Important:
If you wish to communicate with the CPU (without MMC or with data invalid for the CPU) from your PG/PC after the overall reset, the only option you have for setting up this communication is via the MPI or MPI/DP or PROFINET (after node assignment) interface.
Table 03
Buffering the time
The following applies for all SIMATIC S7-300 CPUs* and C7 devices with Micro Memory Card (MMC):
At POWER OFF, the time is usually buffered for 6 weeks at an ambient temperature of 40 °C.
After the buffer duration, upon restart, the clock continues with the time at which the POWER OFF was made.
The runtime meter is retentive, but has to be restarted after each restart.
*This does not apply for CPU 312 and CPU 312C. After the buffer duration, upon restart, these continue with the time at which the POWER OFF was made.
QUESTION:
Is the run-time meter reset after an overall reset of the CPU?
ANSWER:
In the S7-300 and C7 complete devices a difference is made between
CPUs with a hardware clock (integrated "real-time clock") and CPUs
with a software clock. The last run-time meter value in the CPUs
with a software clock with no back-up is deleted after an overall
reset of the CPU. In the case of the CPUs with a hardware clock
with back-up, the last run-time meter value is retained after an
overall reset of the CPU.
Table 1 lists the CPUs with software clock. All other S7-300
CPUs and C7 complete devices have a hardware clock. The S7-400 CPUs
all have hardware clocks.
CPU
Order no.
Run-time meter value is deleted/retained
CPU 312-IFM
6ES7 312-5AC0x-0AB0
No run-time meter
CPU 313
6ES7 313-1AD0x-0AB0
Deleted
CPU312
6ES7 312-1AD10-0AB0
Deleted
CPU312C
6ES7 312-5BD0x-0AB0
Deleted
C7-621
6ES7 621-1AD0x-0AE3
Deleted
C7-621 ASi
6ES7 621-6BD0x-0AE3
Deleted
Table 1: S7-300 CPUs and C7 complete devices with software
clock
Why does the retentivity behavior of the S7-300 CPUs and C7 devices without MMC (Micro Memory Card) influence the contents of the variables?
Description: The retentivity behavior of the separate variables is important for developers when creating programs. Developers usually have variables in their programs, whose contents are to be retained even during POWER OFF (retentive) and other variables that then have to be reset to a defined value (non-retentive). In SIMATIC STEP 7 developers can therefore configure retentive address areas for data, markers, S7 timers and S7 counters which they can then use for retentive variables. This entry describes the retentivity behavior of the address areas of SIMATIC S7-300 CPUs and C7 deviceswithout Micro Memory Card (MMC). The retentivity behavior of the address areas is described for the POWER OFF/ON change of status, the STOP/RUN operating mode and for overall reset.
This entry does not refer to the retentivity behavior with the CPU S7-318. The retentivity behavior with CPU S7 318-2 is described in Entry ID: 23596519.
The retentivity behavior of address areas with CPUs without MMC depends on:
The CPU.
The use of battery and memory card (MC).
The parameterization in the HW Configuration.
Note: Not all CPUs and C7 devices can be equipped with battery, memory card or micro memory card.
Program blocks and data blocks at POWER OFF/ON
Without buffer battery:
If the program and data blocks in the main memory are not buffered by a battery, then they are lost after POWER OFF/ON. However, the values in the retentive address areas - as configured in the hardware configuration (see Table 02) - are retained. After POWER OFF/ON the runtime-relevant data blocks and program blocks are reloaded from the FLASH memory card (if slotted) or from the internal FLASH load memory (if available) into the main memory, whereby the values for data block elements declared as retentive are taken from the retentive memory.
In the case of non-retentive data blocks the current values are reloaded from the load memory. If there are no current values in these data blocks in the load memory, then the initial values are loaded from the load memory.
Data blocks and program blocks in the internal RAM load memory are lost at POWER OFF/ON.
With buffer battery:
If you use a battery, the program and all the data blocks are buffered in the main memory. They are retained after POWER OFF/ON.
If a buffer battery is implement, all the data blocks are retentive.
With rechargeable battery:
When using a rechargeable battery, only the time is buffered.
However, the values in the retentive address areas - as configured in the hardware configuration (see Table 02) - are retained.
Data, markers, S7 timers and S7 counters at POWER OFF/ON
The following points apply for markers, S7 timers and S7 counters at POWER OFF/ON:
If a retentivity area has been parameterized for markers, S7 timers and S7 counters in the HW Configuration (see Table 02), the values in the address areas concerned are retained.
If a retentivity area has been parameterized for data blocks in the HW Configuration (see Table 02), then the data save at POWER OFF is transferred again to the data block areas concerned.
Program blocks and data blocks in STOP/RUN operating mode
The following points apply for program blocks and data blocks in the STOP/RUN operating mode:
The program blocks and data blocks are retained in the main memory and are not reloaded from the load memory.
There are no changes to the contents of the data blocks. All data blocks are retentive.
Data, markers, timers and counters in STOP/RUN operating mode
All the markers, S7 timers and S7 counters entered in the retentivity area in the HW Configuration (Fig. 03) are retained in the STOP/RUN operating mode. All other markers, S7 timers and S7 counters are reset.
Data, markers, S7 timers and S7 counters at overall reset
All markers, S7 timers and S7 counters are reset at overall reset. In the case of data blocks the current values are reloaded from the load memory (FLASH memory card or internal FLASH). If there are no current values in these data blocks in the load memory, then the initial values are loaded from the load memory.
Information on the elapsed time counter is available in the Entry ID: 2804630.
Important:
If you wish to communicate with the CPU from your PG/PC after the overall reset, the only option you have for setting up this communication is via the MPI or MPI/DP interface.
Comparison of overall reset and "POWER OFF/ON without buffer battery and without memory card" with S7-300 CPUs and with C7 devices without MMC
In the case of "POWER OFF/ON without buffer battery and without memory card" the retentive areas remain unaffected. If the program is reloaded in this case, then it works with the old values from the retentive area. By default these are the first 8 counters, for example. This can lead to dangerous plant statuses if you don't take this into account. The effects of overall reset and "POWER OFF/ON without buffer battery and without memory card" are compared in Table 01.
Recommendation:
After a "POWER OFF/ON without buffer batteryand without memory card"always do an overall reset.
Overall reset
"POWER OFF/ON without buffer battery and without memory card"
Changed
The hardware configuration is deleted.
The program is deleted.
The retentivity areas are deleted.
The hardware configuration is deleted.
The program is deleted.
Unchanged
The diagnostics buffer.
The protection level set.
The parameters of the MPI interface (MPI address, ...)
The retentivity areas are not deleted.
The diagnostics buffer.
The protection level set.
The parameters of the MPI interface (MPI address, ...)
Table 01
How to configure retentive address areas in STEP 7
The following Table 02 describes how to proceed to configure retentive address areas in an S7-300 CPU without MMC.
No.
Procedure
1
Open the Hardware Configuration of your S7-300 station. Double-click on the icon of your CPU --> The "Properties - CPU 31x ..." window opens.
Fig. 01
2
Select the "Retentive Memory" tab.
Fig. 02
3
In the "Retentive Memory" tab, in the "Retentivity" field you can configure the retentive address areas for:
Markers
S7 timers
S7 counters
In the "Areas" field you can also configure the retentive areas in data blocks.
Fig. 03
Warning:
Please make sure that your data blocks defined as retentive are available in the CPU and are not too short.
Likewise the data blocks must not have the "Unlinked" property. Otherwise the data blocks are only loaded into the load memory.
4
After defining the desired retentive areas you can quit the CPU Properties dialog via "OK" or make changes in other tabs.
Table 02
Warning: Please note that in the meantime C7 devices without MMC have been discontinued. An MMC must be used with all the current C7 devices (C7-613, C7-635 and C7-636).
QUESTION:
How are the variables stored in the temporary local data?
ANSWER:
The L-stack addressing always starts with Address ”0”
Exactly the same number of bytes are reserved on the L-stack
for each block as the number of bytes of static or local data
that each block has.
When a block is terminated, then its space is released again.
The pointer always indicates the 1st byte
of the currently open block.
Example:
Run level
L-stack in bytes
Pointer
Call OB1 (with 20 static [fixed] and 10 additional bytes of local data)
30
0
Call FC1 (with 30 bytes of local data)
30 bytes (OB1) +30 bytes (FC1)
60
30
Call FC10 (with 20 bytes of local data)
60 bytes (OB1 + FC1) +20 bytes FC10
80
60
Call FC11 (with 20 bytes of local data)
60 bytes (OB1 + FC1) +20 bytes FC11
80
60
Call FC12 (with 30 bytes of local data)
60 bytes (OB1 + FC1) +30 bytes FC12
90
60
Call FC2 (with 50 bytes of local data)
30 bytes (OB1) +50 bytes (FC2)
80
30
Call FC20 (with 10 bytes of local data)
80 bytes (OB1 + FC2) +10 bytes FC20
90
80
Call FC21 (with 10 bytes of local data)
80 bytes (OB1 + FC2) +10 bytes FC21
90
80
Call FC22 (with 20 bytes of local data)
80 bytes (OB1 + FC2) +20 bytes FC22
100
80
Call FC221 (with 10 bytes of local data)
100 bytes (OB1 + FC2 + FC22) + 10 bytes FC221
110
80
The L-stack is used by the CPU for internal processing. The STL
editor itself also uses bytes of local data, e.g. in transferring
parameters for a block call. Therefore, do not change the contents of the L-stack.
Note: 256 bytes per priority class are provided per program processing
level (run level).
- for S7-300, fixed
- for S7-400, usually can be set under ”CPU Properties”
in the hardware configuration.
QUESTION:
Why aren't any values returned when using the internal run-time
meter of an S7-300 CPU?
ANSWER:
If a run-time meter with an identifier greater than
"B#16#0" is specified when parameterizing the system
functions SFC2, SFC3 and SFC4 for the CPUs 312IFM to 316-2DP, then
an error occurs and the desired function is not available. In this
case, the identifier "8080h" is output at the "RETVAL" output of
the block. Note:
There is only one run-time meter available for these CPUs.
Therefore you should only use the identifier "B#16#0".
The system function SFC2 "SET_RTM" must not be called in
a cyclic block (OB1, OB35), but only in a restart (OB100). You can
also start the block via an external trigger. Otherwise the block
would always reset the run-time meter and counting would never be
done.
Background: A run-time meter counts the time that a connected device is
switched on or the operating time of the CPU as a sum of the
run-time hours.
In the "STOP" mode of the CPU the run-time meter is stopped. Its
value is retained even after an overall reset. After a restart
(warm start) the run-time meter has to be started again by the user
program. Once restarted it automatically counts on if it has been
started previously. Using the system function SFC2 "SET_RTM" you
can set the run-time meter to a start value. You can start or stop
the run-time meter using the system function SFC3 "CTRL_RTM". You
can use the system function SFC4 "READ_RTM" to read out the current
number of operating hours and the state of the run-time meter
("stopped" or "counting").
Note:
The S7 318 CPU and all S7 400 CPUs have 8 run-time meters.
Numbering starts at 0.
Attachment 01: 
