Advancing TIA Portal Skills UDTs, SCL, Safety & Field

Overview: Bridging Maintenance Work and Advanced PLC Programming

Most maintenance and reliability engineers reach a plateau in Siemens TIA Portal because their daily work consists of small modifications: adding a sensor, swapping a barcode reader, or replacing an I/O card. These tasks are technically achievable without deep programming knowledge, yet the same engineers are blocked when they encounter safety interlocks, fail-safe blocks, password-protected F-blocks, or unfamiliar data structures such as UDTs and arrays.

This reference walks through the concrete skills required to move from "I can download a project" to "I can modify a running S7-1200 or S7-1500 program safely." It is written for an engineer who owns a TIA Portal workstation, has no in-house automation peer, and needs to perform the typical 5-95% modifications that production environments demand every week.

Prerequisites

Step 1: Build a Reproducible TIA Portal Workflow

The single highest-impact change you can make is to formalize the offline / online / backup loop. Every modification should pass through the same path:

1. Open the project from a versioned archive (do not edit the "master" copy directly).
2. Go online with the CPU in STOP if you intend a full download, or remain in RUN with appropriate online change privileges for incremental work.
3. Make the edit in the offline project tree.
4. Compile (Project tree → right-click CPU → "Compile all"). Errors must be zero.
5. Download to device. Select the correct target (the CPU, not a simulated instance).
6. Back up the updated project immediately after successful download.

Step 2: Mastering UDTs and Structs

A User-Defined Type (UDT) is the equivalent of a struct in C. It bundles related tags under one name and gives them semantic meaning. In maintenance work this is critical because most production programs already use UDTs to represent devices (motors, valves, drives, barcode readers). Without understanding UDTs, you cannot safely add a new device — you will create a flat tag namespace that nobody else can read.

Defining a UDT for a sensor

For an inductive product-detection sensor, define:

TYPE "UDT_Sensor"
  VERSION : 1.0
  STRUCT
    iRawInput   : Bool;       // physical input
    bPresent    : Bool;       // debounced state
    bFault      : Bool;       // wire-break / short
    rSignalLevel : Real;       // analog percentage 0-100
    sDeviceTag  : String[16]; // "S101_BEAM_OK"
    dwUptime_s  : DWord;      // since last fault clear
  END_STRUCT;
END_TYPE

Then create an instance DB:

DATA_BLOCK "DB_Sensors"
  STRUCT
    stS101 : "UDT_Sensor";
    stS102 : "UDT_Sensor";
    stS103 : "UDT_Sensor";
  END_STRUCT;
END_DATA_BLOCK

To add a fourth sensor later, you only append stS104 : "UDT_Sensor"; in the struct and re-compile. The HMI tags automatically inherit the new tag if you generated them from the PLC tag table.

Arrays of UDTs

For variable-length equipment (a 12-position rotary table, a 24-bottle filler), use an array:

DATA_BLOCK "DB_Positions"
  STRUCT
    astPos : Array[1..24] of "UDT_Sensor";
  END_STRUCT;
END_DATA_BLOCK

Indexing with a tag lets you loop through all positions in SCL:

FOR #i := 1 TO 24 DO
    IF "DB_Positions".astPos[#i].bPresent THEN
        // handle position
    END_IF;
END_FOR;

Step 3: SCL vs LAD vs FBD — When to Use Each

Why SCL matters for maintenance

Most "the barcode reader changed and we need to update the prefix" tasks involve string parsing. String handling in LAD becomes unreadable very quickly. In SCL:

// Strip the leading 4-character prefix and validate
#sRaw := "DB_Comm".sBarcodeRaw;
IF LEN(#sRaw) >= 8 THEN
    #sPrefix := LEFT(IN := #sRaw, L := 4);
    #sBody   := MID(IN := #sRaw, L := 4, P := 5);
    IF #sPrefix = "NEW-" THEN
        "DB_Comm".bPrefixOK := TRUE;
        "DB_Comm".sBodyClean := #sBody;
    END_IF;
END_IF;

The same logic in LAD would require LEN_STRING, LEFT_STRING, MID_STRING, and EQ_STRING blocks chained together with status bits — possible, but unmaintainable.

Step 4: Multi-Instance Function Blocks

Multi-instancing is the difference between "copy-paste FB10 twelve times with renamed instance DBs" and "declare one FB with an instance inside another FB." The latter scales.

FUNCTION_BLOCK "FB_Motor"
VAR
    iRun : Bool;
    bFault : Bool;
    tRampUp : Time;
END_VAR
BEGIN
    // motor control logic
END_FUNCTION_BLOCK

Use it inside another FB:

FUNCTION_BLOCK "FB_Conveyor"
VAR
    motDrive : "FB_Motor";       // multi-instance
    motTail  : "FB_Motor";       // multi-instance
END_VAR
BEGIN
    motDrive(iRun := #bStartDrive);
    motTail (iRun := #bStartTail);
END_FUNCTION_BLOCK

The advantage: only one instance DB for the entire conveyor. HMI tag generation, online diagnostics, and search all reference motDrive.iRun instead of "DB_Motor1".iRun.

Step 5: Adding an Inductive Sensor — Field Procedure

Scenario: a line needs an additional inductive sensor to detect product presence at station 5.

1. Wire the sensor to a free DI on the local ET 200SP or the CPU's onboard DI. Note the channel number (e.g., I 8.6 for slot 8, channel 6).
2. In the device configuration, confirm the channel is configured as DI (not deenergized). On ET 200SP this is in Properties → DI8 → Channel template.
3. Add a tag in the PLC tag table: iS5_Present : Bool %I8.6.
4. Add the tag to the existing UDT instance in DB_Sensors or to the relevant equipment DB.
5. Use the tag in the program. For a simple presence latch, drop a normally-open contact iS5_Present in series with the existing "station 5 ok" rung.
6. Compile → download to device (RUN mode with online changes is acceptable for adding a new input; you are not removing anything).
7. Verify with a watch table: force the input off, verify the related permissive drops; release the force, verify it re-arms.

Step 6: Updating a Barcode Reader Prefix — Field Procedure

1. Identify the read function block. Typical patterns: FB_BarcodeReader, FB_RD800, or a vendor-supplied FB.
2. Find the prefix comparison. Search for the old prefix as a string constant: Find and replace → "Search in all blocks for string 'OLD-'".
3. Open the SCL source. Change the comparison string from "OLD-" to "NEW-".
4. Compile. If the block is referenced as a multi-instance, the change propagates automatically.
5. Download with online change (full download not required for a string literal change).
6. Verify by scanning a sample code and watching DB_Comm.bPrefixOK go TRUE.

Step 7: Backup Strategy and Version Control

The phrase "I am afraid to download because I might break it" is solved by backups. Three layers:

Online backup procedure

1. Select the CPU in the project tree.
2. Go online.
3. Right-click → "Backup from online device".
4. Save the .s7pbk file with a name including the date and the modification performed: Line3_CPU_backup_2024-11-08_added_S5_sensor.s7pbk.

This file lets you restore the CPU to the exact state before the change. Without it, a failed download on an F-CPU can lock the safety signature and require a master reset.

Step 8: Safety Blocks and Fail-Safes — Solving the "I Cannot Download" Problem

The most common TIA Portal frustration is being unable to download to an F-CPU. The diagnostic buffer contains one of these patterns:

Step 9: Migrating a LOGO! Workstation to S7-1200

The user's plant has early-2000s workstations running on LOGO! (or other odd solutions). These are candidates for migration. The conversion is not trivial but is achievable in one weekend per station.

Recommended hardware for migration

• CPU 1214C DC/DC/DC with firmware V4.5 (article number 6ES7214-1AG40-0XB0)
• SM 1221 DI 16 x 24 V DC (6ES7221-1BH32-0XB0) if DI count exceeds onboard 14
• SM 1222 DO 16 x 24 V DC (6ES7222-1BH32-0XB0)
• CSM 1277 unmanaged switch for HMI connection
• Basic Panel KTP700 Basic (PN, 7")

Step 10: Self-Directed Learning Path

For an engineer with no in-house PLC peer, Siemens Learning Journey provides a structured curriculum. Recommended sequence:

1. TIA Portal S7-1200 Basic (TIA-PRO1) — online or instructor-led, 5 days.
2. TIA Portal S7-1500 Service (TIA-SERV) — 3 days, focused on maintenance and diagnostics.
3. TIA Portal Programming 2 (TIA-PRO2) — SCL, UDTs, multi-instances, complex data structures.
4. SIMATIC Safety in TIA Portal (TIA-SAFETY) — required before touching any F-program.

Between courses, pick one workstation, reverse-engineer its function, and rebuild it offline. Simulate with PLCSIM. Iterate.

Verification Checklist Before Going Online

• [ ] Offline project compiles with zero errors and zero warnings.
• [ ] Online backup of the CPU is saved to a versioned folder.
• [ ] Watch table is created with the affected tags.
• [ ] For F-CPU work: safety engineer has been informed, signature change is approved.
• [ ] After download: CPU diagnostic buffer shows no new errors.
• [ ] Force table is used (not the program) for any temporary logic verification.
• [ ] Project archive .zap18 is saved with a descriptive filename.

Troubleshooting Matrix

FAQ