[?]: Messy code: accessing outside of DB

SIMATIC S7-200/300/400, Step7, PCS7, CFC, SFC, PDM, PLCSIM,
SCL, Graph, SPS-VISU S5/S7, IBHsoftec, LOGO ...
Forum rules
nguyenthe_k
Posts: 11
Joined: Sun May 11, 2008 11:14 am
Location: Vietnam

[?]: Messy code: accessing outside of DB

Post by nguyenthe_k »

Anyone help me to understand this pieces of code. The comment I wrote is just on the right. The 1st was to read the information on Profibus and get access to DB611 but then... the address of DB611 is only 320 byte (by seeing in Step 7)

Code: Select all

FUNCTION "FC_SEW_SERVO_POS_ABSOLUT" : VOID
TITLE =SERVO ABSOLUTE POSITIONING (L2-DP) WITH 6-PD PROZESSDATA
{ S7_language := '7(1) Deutsch (Deutschland)  09.02.2007  11:05:27' }
AUTHOR :
FAMILY : 
NAME : SEW_SERV
VERSION : 0.0


VAR_INPUT
  CONTROLLER_INHIBIT : BOOL ;	//REGLERSPERRE
  POS_ABSOLUTE : BOOL ;	//POSITIONIERUNG ABSOLUT
  REFERENCE : BOOL ;	//REFERENZFAHRT AUSLÖSEN
  TOUCH_POS : BOOL ;	//TIPPEN POSITIV
  TOUCH_NEG : BOOL ;	//TIPPEN NEGATIV
  RELEASE : BOOL ;	//FREIGABE
  RESET : BOOL ;	//QUITTIERUNG STOERUNG
  START_DATA : INT ;	//DATENBEREICH ANFANG (182 FEST)
  SPEED_MAX : INT ;	//MAXIMALE DREHZAHL
  PERIPHERY : INT ;	//PERIPHERIE ANFANGSADRESSE
END_VAR
VAR_TEMP
  PERIPHERY_START : WORD ;	//PERIPHERIE ANFANGSADRESSE
  RETURN_VALUE_R : INT ;	//RETUERN_VALUE READ
  RETURN_VALUE_W : INT ;	//RETUERN_VALUE WRITE
  DATA_DESTINATION : ANY ;	//DATENBEREICH ANFANG <- SEW
  DATA_SOURCE : ANY ;	//DATENBEREICH ANFANG -> SEW
  TEMP : DINT ;	
  TEMP_ORDER : BYTE ;	
END_VAR
BEGIN
NETWORK
TITLE =CALL DRIVE-DB

      OPN   DB ["BLOCK_NO_VAL:_DRIVE_1_N"]; // CALL DRIVE DB         			  	OPN DB611

      L     #PERIPHERY;                                         #PERIPHERY = 1208
      T     #PERIPHERY_START; 
NETWORK
TITLE =WRITE ADRESSREGISTER 

      L     #START_DATA; // STARTADRESS - DB						#START_DATA = 182
      SLD   3; 																		
      LAR2  ; 										AR2 = 182*8  = 1456
NETWORK		
TITLE =READ PROZESSDATA FROM FC

      LAR1  P##DATA_DESTINATION; 
      L     B#16#10; 
      T     LB [AR1,P#0.0]; 
      L     B#16#2; 
      T     LB [AR1,P#1.0]; 
      L     12; 
      T     LW [AR1,P#2.0]; 
      L     "BLOCK_NO_VAL:_DRIVE_1_N"; 
      T     LW [AR1,P#4.0]; 
      L     #START_DATA; 
      L     44; 
      +I    ; 
      SLD   3; 
      L     DW#16#84000000; 
      OD    ; 
      T     LD [AR1,P#6.0]; 

      CALL "SFC_DPRD_DAT" (
           LADDR                    := #PERIPHERY_START,
           RET_VAL                  := #RETURN_VALUE_R,
           RECORD                   := #DATA_DESTINATION);
      A     #RESET; 
      R     DBX   70.5; 
      L     #RETURN_VALUE_R; //FAULT PERIPHERY
      L     0; 
      <>I   ; 
      S     DBX   70.5; 
NETWORK
TITLE =REFERENCE / SYNCHRONIZE							Interesting part:
	
      L     DBW [AR2,P#44.0]; //STATUSWORD 2		L DBW[1456+44 = 1560] ? How it accesses to DB611.DBW1560
      T     DBW [AR2,P#2.0]; //STATUSWORD 2 ->  BIT                                 			Look at the DB611, the maximu address is 320. 

      A     DBX   71.0; //#EN_RELEASE_P_S
      AN    DBX   71.1; //#EN_PRESET_SYNCHRON
      JCN   PEND; 

      L     DBW  102; //#EN_PRESET_SYNCHRON_CONSTANT
      DTR   ; 
      L     DBD  104; //#EN_RESOLUTION
      /R    ; 
      RND   ; 
      L     DBD [AR2,P#46.0]; //#EN_AXLEPOSITION
      TAK   ; 
      -D    ; 
      T     DBD [AR2,P#8.0]; //#EN_PRESET_SYNCHRON_VALUE
      A     DBX   71.0; //#EN_RELEASE_P_S
      R     DBX   71.0; //#EN_RELEASE_P_S
      AN    DBX   71.1; //#EN_PRESET_SYNCHRON
      S     DBX   71.1; //#EN_PRESET_SYNCHRON

PEND: NOP   0; 
      L     DBD [AR2,P#46.0]; //#EN_AXLEPOSITION
      L     DBD [AR2,P#8.0]; //#EN_PRESET_SYNCHRON_VALUE
      -D    ; 
      T     DBD [AR2,P#4.0]; //#EN_POSITION_ACTUAL
      DTR   ; //DOUBLE_INTEGER => REAL  
      L     DBD  104; //#EN_RESOLUTION
      *R    ; 
      RND   ; //REAL => DOUBLE_INTEGER  
      T     DBW  108; //#EN_ACTUAL_VALUE
NETWORK
TITLE = PROCESSING CONTROL-WORD  

      AN    #CONTROLLER_INHIBIT; 
      =     DBX [AR2,P#13.0]; // CONTROLLER INHIBIT / RELEASE
      A     #CONTROLLER_INHIBIT; 
      =     DBX [AR2,P#13.1]; // RELEASE     / RAPID STOP
      A     #RELEASE; 
      =     DBX [AR2,P#13.2]; // RELEASE     / HOLD
      CLR   ; 
      =     DBX [AR2,P#13.3]; // HOLDCONTROL ACTIVE / PASSIVE
      =     DBX [AR2,P#13.4]; // INTEGRATOR 2 / INTEGRATOR 1
      =     DBX [AR2,P#13.5]; // RESERVE
      A     #RESET; 
      A(    ; 
      ON    DBX [AR2,P#3.1]; // READY
      O     DBX [AR2,P#3.5]; // FAULT
      )     ; 
      =     DBX [AR2,P#13.6]; // RESET  
      CLR   ; 
      =     DBX [AR2,P#13.7]; // RESERVE   
NETWORK
TITLE = PROCESSING CONTROL-WORD  (JOB-NO.)

      A     #RELEASE; 
      JC    REF; 
      JU    STOP; 

REF:  AN    #REFERENCE; 
      JC    ABS; 
      L     2#1; 
      JU    SOLL; 
ABS:  AN    #POS_ABSOLUTE; 
      JC    TPOS; 
      L     2#100; 
      JU    SOLL; 
TPOS: AN    #TOUCH_POS; 
      JC    TNEG; 
      L     2#10; 
      JU    SOLL; 
TNEG: AN    #TOUCH_NEG; 
      JC    STOP; 
      L     2#11; 
      JU    SOLL; 
STOP: L     2#0; 
SOLL: T     #TEMP_ORDER; 
      L     DBB [AR2,P#12.0]; 
      SRW   3; 
      SLW   3; 
      L     #TEMP_ORDER; 
      OW    ; 
      T     DBB [AR2,P#12.0]; 
NETWORK
TITLE =EVALUATE SET VALUE
//
//
//
      L     #TEMP_ORDER; 
      L     2#100; // POSITIONING  ABSOLUTE
      <>I   ; 
      JC    DREH; 
      L     DBD [AR2,P#14.0]; // POSITION SET VALUE     [mm]  
      DTR   ; 
      L     DBD  104; // RESOLUTION
      /R    ; 
      RND   ; 
      L     DBD [AR2,P#8.0]; //#EN_PRESET_SYNCHRON_VALUE
      +D    ; 
      T     DBD [AR2,P#40.0]; // SET VALUE

DREH: L     DBW [AR2,P#30.0]; // SPEED SET VALUE    [%]
      ITD   ; 
      L     #SPEED_MAX; // NOMINAL SPEED
      *D    ; 
      L     100; 
      /D    ; 
      T     DBW [AR2,P#32.0]; // SET VALUE

NETWORK
TITLE = SPS -> SERVO

      L     DBD [AR2,P#40.0]; //POSITION SET VALUE
      T     DBD [AR2,P#58.0]; 
      L     DBW [AR2,P#32.0]; //SPEED SET VALUE
      T     DBW [AR2,P#62.0]; 
      L     DBW [AR2,P#34.0]; //RAMP  SET VALUE
      T     DBW [AR2,P#64.0]; 
      L     DBW [AR2,P#36.0]; //RES_WORD
      T     DBW [AR2,P#66.0]; 
      L     DBW [AR2,P#12.0]; //CONTROLWORD
      T     DBW [AR2,P#56.0];
Last edited by nguyenthe_k on Wed Oct 01, 2008 5:16 pm, edited 2 times in total.
Top
nguyenthe_k
Posts: 11
Joined: Sun May 11, 2008 11:14 am
Location: Vietnam

Post by nguyenthe_k »

Forget to mention. The comment I wrote is:
#START_DATA = 182
AR2 = 182*8 = 1456
Interesting part:
L DBW[1456+44 = 1560] ? How it accesses to DB611.DBW1560

Just to emphasize. The code was not fitted well to the screen.
Top
sania
Site Admin
Posts: 1387
Joined: Sat Aug 13, 2005 6:15 am

Post by sania »

nguyenthe_k wrote:1456+44 = 1560
you are sure???
i think 1456+44 = 1500 :roll:
where you see it?
i see : ar2,p#52.0,or (start_data+44)*8
2)l dbw[ar2,p#52.0]=load word with start BIT this word==ar2,p#52.0
sample:1560 bits from start DB =1560/8=195 over l dbw195

P.S. if not plz correct me

----edited--------
i found [ar2,p#44.0]this dbw182+44=226
( 1456+44*8 )/8

P.P.S. you can see in online your block in STL
in place of RLO representation right-click-> show adress_register1,adress_register2

P.P.P.S. you have problem....what kind of ?
you recive message in plc diag buffer? write this message
Top
pwkoller
Posts: 15
Joined: Sun Dec 04, 2005 9:06 am
Location: Europe

Post by pwkoller »

Check out:
...

TITLE =WRITE ADRESSREGISTER

L #START_DATA; // = 182 => Byte 182 in DB
SLD 3; // convert to Pointer => p#182.0
LAR2 ; // AR2 => p#182.0 => byte 182

...

L DBW [AR2,P#44.0]; //L DBW[p#182.0 + p#44.0 => DBW226 in DB
T DBW [AR2,P#2.0]; //STATUSWORD 2 -> BIT => p#182.0 + p#2.0 => DBX 184.0 in DB

....

check Step7 online manuals for POINTERS and use of AR1/AR2

have fun!
pwkoller
Top
nguyenthe_k
Posts: 11
Joined: Sun May 11, 2008 11:14 am
Location: Vietnam

Post by nguyenthe_k »

ha ha... I didn't notice that the address register refering to the bit address.
Top
nguyenthe_k
Posts: 11
Joined: Sun May 11, 2008 11:14 am
Location: Vietnam

Post by nguyenthe_k »

Another question:

Code: Select all

NETWORK      
TITLE =READ PROZESSDATA FROM FC
      LAR1  P##DATA_DESTINATION;
      L     B#16#10;
      T     LB [AR1,P#0.0];
      L     B#16#2;
      T     LB [AR1,P#1.0];
      L     12;
      T     LW [AR1,P#2.0];
      L     "BLOCK_NO_VAL:_DRIVE_1_N";
      T     LW [AR1,P#4.0];
      L     #START_DATA;
      L     44;
      +I    ;
      SLD   3;
      L     DW#16#84000000;
      OD    ;
      T     LD [AR1,P#6.0];

      CALL "SFC_DPRD_DAT" (
           LADDR                    := #PERIPHERY_START,
           RET_VAL                  := #RETURN_VALUE_R,
           RECORD                   := #DATA_DESTINATION);
      A     #RESET;
      R     DBX   70.5;
      L     #RETURN_VALUE_R; //FAULT PERIPHERY
      L     0;
      <>I   ;
      S     DBX   70.5;
At the call to " SFC_DPRD_DA" (SFC 14), the information from inverter is read to #DATA_DESTINATION; then I don't see the code to transfer #DATA_DESTINATION to DB611; Anyone see I'm overlooking somewhere
Top
pwkoller
Posts: 15
Joined: Sun Dec 04, 2005 9:06 am
Location: Europe

Post by pwkoller »

ha,ha .. you dont know the stucture of an any-pointer too ...
check manuals
Top
nguyenthe_k
Posts: 11
Joined: Sun May 11, 2008 11:14 am
Location: Vietnam

Post by nguyenthe_k »

The code

Code: Select all

Format of the Parameter Type ANY
STEP 7 stores the parameter type ANY in 10 bytes. When constructing a parameter of the type ANY, you must ensure that all 10 bytes are occupied because the called block evaluates the whole contents of the parameter. If, for example, you specify a DB number in byte 4, you must also explicitly specify the memory area in byte 6.

STEP 7 manages the data of elementary and complex data types differently from the data for parameter types.

ANY Format for Data Types

For elementary and complex data types STEP 7 stores the following data:

Data types

Repetition factor

DB number

Memory area in which the information is stored

Start address of the data
.........................

Thank you for reminding me. I'has found them in the manual. Next time I'll look up the manual before posting the question here.
Top

Return to “SIMATIC system”