Hello everyone, I am Lao Wang. I have been working in the automation industry for nearly twenty years, handling countless Siemens PLCs from the old S7-300 and S7-400 to the current S7-1200 and S7-1500. Today, let’s have a good talk about the instruction set of Siemens PLCs, which is the core language for us engineers to “communicate” with the PLC. Don’t worry about the technical terms; I will break it down and explain it thoroughly, ensuring that you can start debugging after listening.
1. What are PLC instructions? Why are they so important?
Imagine a PLC as an indefatigable “workshop supervisor” that only understands specific “work instructions.” These instructions are the commands you write in the program, telling it: “When this button is pressed (input), immediately power that motor (output).” The instruction set is a collection of all available commands, equivalent to the PLC’s “manual.” Without instructions, the PLC is just an expensive metal box.
2. Overview of the Siemens PLC Instruction Family (Common Core Instructions)
Siemens categorizes its instructions clearly; let’s go through them by function:
1. Bit Logic Instructions – The Basics of Switch Control
• A (And) – Normally Open Contact: This is the most commonly used instruction! Imagine a switch that only allows current to flow when its corresponding bit (e.g., I0.0 input point) is “1” (powered). In the program, it is written as A I0.0.
• AN (And Not) – Normally Closed Contact: The opposite of A. It allows current to flow only when its corresponding bit is “0” (not powered). This is equivalent to a switch that is normally closed and opens when activated. For example, the emergency stop button often uses a normally closed point, AN I0.1 (emergency stop input) indicates that the circuit is only closed when the emergency stop is not pressed.
• O (Or) – Parallel Normally Open: Implements “or” logic. If either condition on the left or right is “on” (status is 1), this parallel branch is active. For example, O I0.2 and O I0.3 in parallel means either I0.2 or I0.3 can be pressed.
• ON (Or Not) – Parallel Normally Closed: This branch is active when either condition on the left or right is “off” (status is 0). It is used less frequently.
• = (Assign) – Output Coil: This is the endpoint of “work.” When the logical operation result is “on” (1), it sets the corresponding bit (e.g., Q0.0 output point) to “1” (powered). In the program, it is written as = Q0.0. It controls motors, lights, and valves.
• S (Set) / R (Reset) – Set/Reset: This is a switch with a “memory” function. Once S M0.0 is executed (even if the condition quickly becomes false), M0.0 will be locked in the “1” state until the R M0.0 instruction unlocks it back to “0.” It is very suitable for maintaining start/stop states and fault locking.
2. Timer Instructions (TON, TOF, TP) – Allowing PLC to “Watch the Clock”
• TON (On-Delay Timer) – Delay on: The most commonly used timer. When its start condition (IN) changes from 0 to 1 (on), it starts timing. The current value (TV, commonly T0 or a variable in DB) accumulates from 0 upwards, and when it reaches the set time (PT value, e.g., T#2S for 2 seconds), the timer bit (Q) changes from 0 to 1. If the time is not reached, Q remains 0. Typical applications: the motor starts X seconds after pressing the start button; the device shuts down after a delay for lubrication.
• TOF (Off-Delay Timer) – Delay off: Timing starts when the start condition (IN) changes from 1 to 0 (off). During the timing process, the timer bit (Q) remains 1 until the time is up (reaching PT value), at which point it changes to 0. Typical applications: the fan continues to run for X seconds after the motor stops; the safety indicator light remains on for X seconds after the light goes out.
• TP (Pulse Timer) – Pulse Timer: When the start condition (IN) changes from 0 to 1 (rising edge), the timer bit (Q) immediately becomes 1, outputting a pulse while starting the timer. Regardless of whether the start condition remains 1, when the timing reaches the PT value, Q automatically resets to 0. Typical applications: generating fixed-width pulse signals; momentary operation of devices (pressing a button causes the device to operate for a fixed time before stopping automatically).
• Key Points:
TON starts timing when the condition is on, and the action occurs when the time is up (Q=1); TOF starts timing when the condition is off, and the reset occurs when the time is up (Q=0); TP immediately acts when the condition is on (Q=1), and automatically resets when the time is up (Q=0).
Timer numbers (e.g., T0, T1) and background data blocks (used in S7-1500/1200) must be allocated properly to avoid conflicts.
PT value settings must be in the correct format: T#500ms (500 milliseconds), T#2s (2 seconds), T#1m30s (1 minute 30 seconds).
3. Counter Instructions (CTU, CTD, CTUD) – Allowing PLC to “Count”
• CTU (Count Up) – Increment Counter: Each time a counting pulse input (CU) changes from 0 to 1 (rising edge), the current value of the counter (CV) increases by 1. When CV >= preset value (PV, e.g., 10), the counter bit (Q) is set to 1. A reset input (R) is needed to clear CV to zero and reset Q.
• CTD (Count Down) – Decrement Counter: Each time a counting pulse input (CD) changes from 0 to 1 (rising edge), the current value of the counter (CV) decreases by 1. When CV <= 0, the counter bit (Q) is set to 1. A load input (LD) is needed to load the preset value (PV) into CV (usually LD will also reset Q).
• CTUD (Count Up/Down) – Increment/Decrement Counter: It has both increment (CU) and decrement (CD) input functions. The execution logic is a combination of CTU and CTD. When CV >= PV, QU is set; when CV <= 0, QD is set. The reset input (R) clears CV to zero and resets QU/QD.
• Key Points:
Counting is triggered by rising edges! A signal remaining at 1 will not count continuously.
Pay attention to the effective levels of reset (R) and load (LD) signals (generally, 1 is effective).
CV and PV are integers (INT or DINT).
4. Data Processing Instructions – Movers and Referees
• MOV (Move) – Move Instruction: Don’t underestimate this instruction; it is the “main artery” of data flow. Its function is simple: copy the value of the source operand (SOURCE) to the destination operand (DESTINATION). For example, MOV 100, MW10 (move constant 100 to MW10 storage word) or MOV DB1.DBW0, PQW256 (move the value of the 0th word in DB1 to the analog output channel). The key is to ensure that the source and destination addresses and data types are compatible!
• Arithmetic Operations: ADD (addition), SUB (subtraction), MUL (multiplication), DIV (division). These instructions usually have several operands: two inputs (IN1, IN2) and one output (OUT). For example, ADD MW10, MW12, MD20 means MD20 = MW10 + MW12 (note type conversion). Integers use the I suffix (ADD_I), and floating-point numbers use the R suffix (ADD_R).
• Comparison Instructions: CMP == (equal), CMP > (greater than), CMP < (less than), CMP >= (greater than or equal to), CMP <= (less than or equal to), CMP <> (not equal). They compare two input values (IN1, IN2), and if the comparison condition is met, the output (or status bit) is 1. Commonly used for conditional judgments, e.g., CMP > MW10, 100, if MW10 > 100, the logic following the instruction will be active.
• Conversion Instructions: CONVERT or specific instructions like DI_I (double integer to integer), I_DI (integer to double integer), DI_R (double integer to real), R_DI (real to double integer – will round or truncate). Data type conversion is one of the most common pitfalls in debugging! Always ensure that the operand types are what you expect.
3. Advanced Tips and Pitfalls Guide for Senior Engineers
1. Address! Address! Address! This is the most common pitfall for beginners. The Siemens addressing system is rigorous:
• I (Input): Physical input image area, such as I0.0 (bit 0 of byte 0), IB0 (byte 0), IW0 (word 0 – includes IB0 and IB1), ID0 (double word 0 – includes IB0 to IB3).
• Q (Output): Physical output image area, formatted the same as I.
• M (Merker): Flag memory/intermediate variable area. Globally available, formatted as M0.0, MB0, MW0, MD0. Frequently used, but plan well to avoid conflicts.
• DB (Data Block): Data block. This is a treasure trove for structured data storage! Various variable types can be defined (Bool, Byte, Word, DWord, Int, DInt, Real, Array, Struct…). Access method: “DB block number”.variable name like “MyData”.Temperature or offset address DB1.DBX0.0 (bit 0 of byte 0 in DB1). It is strongly recommended to access DB variables using symbolic names!
• T (Timer): Timer storage area, such as T0.
• C (Counter): Counter storage area, such as C0.
• L (Local): Local variables (only effective in the current block, such as FC/FB internal).
• Key Reminder: Different storage area address spaces are independent! M0.0 and I0.0 are completely different places. Never assume!
2. The Ghost of Scan Cycles: PLC programs are executed in a loop, one cycle: read input -> execute program logic -> write output.
• Instruction execution order is crucial! Within the same cycle, instructions written later can overwrite the results of earlier instructions. If the results are incorrect, check the instruction order.
• Timer/counter updates: Their status and current values are updated at specific stages of the scan cycle. Understanding the timing of TON/TOF/TP actions must be combined with the scan cycle. A long timer may miss the precise trigger point.
• Immediate Read/Write: Standard I and Q access the image area. For points that require extremely fast response (such as high-speed counting, pulse output), immediate instructions (such as L PIB/T PQW for S7-300/400, direct access to P area for S7-1200/1500) should be used, which bypass the image area to operate hardware directly, but caution is required!
3. Indirect Addressing – The Art of Pointers: When your address needs to be calculated or changed at runtime, indirect addressing is required (such as handling arrays, recipes). In S7-1500/1200, mainly use P# pointers (e.g., P#M100.0 BYTE 10 points to a 10-byte area starting from M100.0) combined with L DINO/T DINO instructions. In S7-300/400, AR1/AR2 address registers are commonly used. This is an advanced technique; beginners should first master direct addressing.
4. Make Good Use of Status Bits (EN/ENO): Many instructions have EN (Enable) input and ENO (Enable Output) output.
• EN must be 1 for the instruction to execute.
• If the instruction executes successfully without errors, ENO outputs 1; if there is an error (e.g., division by zero, conversion overflow), ENO outputs 0.
• Strongly Recommended: Chain the ENO outputs of multiple instructions! This way, if any preceding instruction fails, the subsequent instructions will not execute, facilitating overall error handling. Developing this habit can greatly enhance the robustness of your program.
4. Heartfelt Words for Beginners
1. Always Keep the Manual Handy: The help documentation in TIA Portal (press F1) is the best teacher! It clearly explains each instruction, parameters, examples, and limitations. When uncertain about an instruction, check the manual immediately!
2. The Simulator is Your Good Partner: TIA Portal has powerful PLC simulation capabilities. Don’t just test programs on real PLCs; first use the simulator to run the logic and verify the effects of instructions. It saves time, effort, and is safer.
3. Debugging Tools: Online monitoring of program status, viewing variable tables, forcing inputs and outputs. This is the most direct way to understand program logic and locate issues. Learn to observe the flow of variable value changes.
4. Start with Small Programs: Don’t try to write large projects right away. Write a small program to control the sequence of several lights, use timers to create a blinking light, or use counters to record button presses. Get familiar with the basic instructions before moving on.
5. Types! Types! Types! Again, emphasize: mismatched operand types are the root cause of compilation errors and even runtime logic errors. Before assignment, operation, or comparison, always confirm that the data types of both sides are consistent or compatible for conversion.
Conclusion:
The PLC instruction set is the “blueprint” and “operation guide” in the hands of automation engineers. Understanding the “temperament” (function, timing, limitations) of each instruction, familiarizing yourself with the “rules of work” (scan cycles, storage areas, data types) of the PLC, combined with rigorous logical thinking and clear symbolic naming, will enable you to make the cold PLC accurately complete various complex control tasks. Remember, experts grow from mastering each instruction and debugging repeatedly. Write more, try more, think more, and consult the manual; you too can become a “veteran” in Siemens PLC programming. If you encounter specific instruction challenges in your projects, feel free to discuss them!
Follow this account to learn more about Siemens PLC programming knowledge!