Converting S5 DO Instruction to S7: Indirect Addressing Migration

Overview: What the S5 DO Instruction Does

The Step 5 DO instruction performs indirect data block opening. The operand following DO supplies the DB number at runtime rather than at compile time. After DO executes, every subsequent data-word (L DW / T DW) or data-doubleword (L DD / T DD) access targets the DB whose number was just resolved.

Classic S5 source pattern from the original program:

L  FW 252       // load DB number from flag word 252
DO  FW 252       // open DB whose number is in FW252
L  DD 0          // load data doubleword 0 from the resolved DB
T  DD 2          // transfer to DD 2 of the same DB

DO  FW 250       // switch DB to number held in FW250
L  DD 0
L  DD 6

DO  FW 248       // switch DB to number held in FW248
L  DD 0
L  DD 6

Runtime semantics: if FW252 = 16, DO FW 252 opens DB 16 and the following L DD 0 loads doubleword 0 of DB 16. DO also permits the operand FY (flag byte), FW (flag word), or FD (flag doubleword), or directly the accumulator-1 via DO with no operand in some S5 firmware variants.

Memory Model: S5 Words vs S7 Bytes (Critical Difference)

The single largest source of data corruption during S5-to-S7 conversion is the change in data-block addressing granularity.

The S5 word address DW n therefore maps to S7 byte address DBW (2*n). Doubling the offset is mandatory; otherwise the new code reads and writes overlapping data.

Similarly for doublewords:

• DD 0 (S5) = DBD 0 (S7)
• DD 1 (S5) = DBD 4 (S7)
• DD n (S5) = DBD 4*n (S7)

S7 Indirect Addressing Architecture

S7-300/400 STL supports three pointer-based indirect forms. The decision tree is governed by the destination operand area.

The pointer format for area-internal memory-indirect addressing (e.g., DBD[MD10]) is a 32-bit word:

For area-crossing register-indirect addressing (PIB [AR1, P#0.0]), bits 24..26 hold the area identifier and bit 31 remains 0.

Converting DO FW to STL Pointer Logic

There is no DO equivalent in S7. The conversion is structural: replace the indirect DB-open with a pointer, and convert every L DD n / T DD n that follows into a memory-indirect or register-indirect load/transfer.

Conversion pattern:

// Step 5
L  FW 252            // DB number, e.g., 16
DO FW 252            // open DB 16
L  DD 0              // load DBD 0 of opened DB
T  DD 2              // transfer to DBD 2

// Step 7 STL equivalent (area-internal)
L    #DB_no          // INT source, value 16 in this example
ITD                  // widen INT to DINT (avoid sign issues)
SLD   5              // shift left 5 — converts DBD index to byte-pointer
T    #ptr_dbd        // temp DWORD pointer
OPN   DB [#DB_no]    // open the DB explicitly
L     DBD [#ptr_dbd] // load DBD 0
T     DBD [#ptr_dbd] // transfer to DBD 2 ... or another offset

Key observations:

1. OPN DB [#DB_no] opens the data block whose number is in #DB_no. This replaces DO FW 252. The operand must be an INT or WORD; using a DWORD can trigger an area length error if the upper bits are non-zero on older CPUs.
2. The SLD 5 shift is required because DBD [#ptr_dbd] expects a byte pointer (byte offset in bits 3..18), but the natural index is a DBD index. Multiplying by 32 (= shifting left by 5) produces the correct pointer format with bit address 0.
3. Always widen with ITD before shifting — shifting an INT left by 5 can promote sign bits into the byte-offset field and corrupt the pointer.

The SLD Shift Constants Explained

The shift constant depends on the operand width of the data being addressed. The rule is: the shift equals the binary log of the bytes-per-unit, plus 3 (the 3 is the bit-address field reserved at the LSB of every S7 pointer).

Examples:

// Load DBW 5 (= DBB 10..11) using a variable index
L    #DBW_index       // INT, value 5
ITD
SLD   4               // 5 * 16 = 80 = P#10.0
T    #ptr_dbw
L     DBW [#ptr_dbw]  // loads DBW 10

// Load DBB 7 using a variable index
L    #DBB_index       // INT, value 7
ITD
SLD   3               // 7 * 8 = 56 = P#7.0
T    #ptr_dbb
L     DBB [#ptr_dbb]  // loads DBB 7

The same rule applies to address registers:

// Load AR1 with pointer to DBW 5
L    P#10.0           // hard-coded pointer (= DBW 5 byte address)
LAR1
L     DBW [AR1, P#0.0]

STL Conversion Examples: Byte, Word, Dword

Variable DBD access (replaces L DD n / T DD n)

// FC parameter:  in_word  WORD (DBD index, S5-style)
//                in_dbd   POINTER (any-pointer to receive pointer)
//                out_val  DWORD (loaded value)
L     #in_word         // S5-style DBD index
ITD
SLD   5               // convert to byte-pointer
T     #in_dbd         // pointer now valid for DBD[#in_dbd]
OPN   DB [#in_word]   // open DB whose number == in_word (assumed equal)
L     DBD [#in_dbd]   // load variable DBD
T     #out_val

Variable DBW access (replaces L DW n / T DW n)

L     #in_word
ITD
SLD   4
T     #in_dbd
OPN   DB [#db_no]
L     DBW [#in_dbd]
T     #out_word

Variable DBB access (replaces L DR n / L DL n / T DR n / T DL n)

L     #in_byte
ITD
SLD   3
T     #in_dbd
L     DBB [#in_dbd]
T     #out_byte

Read-only pattern using AR1 (register-indirect, area-internal)

L     P#0.0
L     #in_word
ITD
SLD   5
+D                   // accumulator now holds base + offset pointer
LAR1                  // load AR1 with final pointer
OPN   DB [#db_no]
L     DBD [AR1, P#0.0]
T     #out_val

Area-Crossing Indirect Addressing (PIB, PQB, MB)

The original S5 program also uses L PY 0 — loading a peripheral byte from the P area. S7 still supports the P periphery, but the typical pattern is the process image (PIB, PQB). For area-crossing indirect access, the pointer must carry the area identifier in bits 24..26.

Setting up an AR1 pointer for PIB

// Goal: load PIB[#input_offset]
L     #input_offset    // BYTE/INT, e.g., 10
ITD
SLD   3                // convert byte offset to pointer
L     B#16#81          // area ID for input bytes (100 0001 bin)
OD                    // OR area ID into bits 24..26
T     #temp_ptr
LAR1
L     PIB [AR1, P#0.0]
T     #out_byte

Area-ID constants:

Error case from the field report

The S5 program fragment DO FW252 / L PY 0 triggered an Area length error in S7 after this conversion:

T     #conv_akku1
L     STW
T     #conv_stw
L     MB   253
SLW   3
LAR1
L     PIB  [AR1, P#0.0]

Root cause:

1. SLW 3 is a 16-bit shift, not a 32-bit shift. The result occupies only the low word of ACCU 1; the high word is zero. AR1 receives a 32-bit value where bits 16..31 are zero.
2. Bits 24..26 are therefore zero — the area-ID field is missing, so the CPU cannot determine whether AR1 points to PI, PQ, MB, or DB. The CPU falls back to DB and rejects the PIB operand as illegal.
3. MB 253 itself is also problematic: bit-memory byte 253 is in the last valid byte of the default flag area on most S7-300 CPUs (0..255), but on CPUs with only 256 flag bytes the byte index must be multiplied by 8 to become a pointer, which SLW 3 handles only inside the low word.

Corrected code:

T     #conv_akku1
L     STW
T     #conv_stw
L     #input_offset    // proper INT source
ITD
SLD   3                // 32-bit shift — preserves high word
L     B#16#81          // area ID for PIB
OD
LAR1
L     PIB  [AR1, P#0.0]
T     #conv_akku1

Area Length Error: Root Cause and Fix

An Area length error (SF LED lit, diagnostic buffer entry) occurs when STL indirect addressing reads or writes outside the area bound by OPN, or when the area-ID is inconsistent with the operand syntax.

Diagnostic buffer entry in STEP 7:

Event ID 0x2522 / 0x2521
Text: "Area length error when reading/writing"
Stack: STL source location of the L/T instruction

The error class on S7-300 is 4 (OB 121 priority-fault) and on S7-400 is 16. Install an OB 121 / OB 122 temporarily to capture the exact instruction and ACCU contents at the fault.

Multi-Level Pointer Chains and Nested DO

S5 programs often use a "pointer-to-pointer" pattern where FW252 contains the DB number and a data word within that DB holds the actual target offset:

// S5
DO  FW 252           // open DB indexed by FW252
L  DW 0              // load from DW 0 of opened DB — this DW contains the real offset
T  FW 250            // store offset into FW250
DO  FW 250           // open DB indexed by FW250

The S7 equivalent requires nested pointer arithmetic:

// S7
L     #DB_no_outer      // from FW252
ITD
T     #outer_db
OPN   DB [#outer_db]
L     DBD 0             // the "pointer-to-pointer" data in DW 0 of outer DB
ITD                    // the stored offset is an S5-style DW index
SLD   4                // convert DW offset to DBW byte pointer
T     #ptr_inner
L     DBD [#ptr_inner]  // load the real value

If the stored offset is itself a DBD-style index (S5 DD), use SLD 5. If it is a byte index (S5 DR/DL), use SLD 3. Document which one is required at the DB level to avoid silent misuse.

SCL Alternative for New Development

New code in STEP 7 should use SCL (Structured Control Language) instead of indirect STL where possible. SCL provides typed, bounds-checked accessors that eliminate the SLD/AR1 pitfalls.

// SCL equivalent of the conversion
FUNCTION_BLOCK FB_DoEmulator
VAR_INPUT
  i_db_no   : INT;
  i_offset  : INT;   // S5-style DBD index
END_VAR
VAR_OUTPUT
  q_value   : DWORD;
END_VAR
VAR_TEMP
  t_db_no   : INT;
  t_ptr     : DWORD;
END_VAR
BEGIN
  t_db_no := i_db_no;
  IF t_db_no > 0 AND t_db_no <= 32767 THEN
    t_ptr := SHL(IN := DWORD#i_offset * 32, N := 0); // build pointer
    // SCL cannot index DBs symbolically without instance/static blocks,
    // so open and read with ATTRIB/DWORD_TO_* primitives:
    q_value := WORD_TO_DWORD(ATTRIB(int := t_db_no,
                                    offset := i_offset * 4,
                                    area := 6));
  END_IF;
END_FUNCTION_BLOCK

Verification and Commissioning

1. Static check (offline) — Open the converted STL in STEP 7 / TIA Portal and confirm no symbol remains marked red. DO, DW, DD, DL, DR must all be replaced.
2. Cross-reference audit — Use Reference Data → Cross-references to list every OPN DB and every DBD / DBW / DBB access. Each S5 DD n must now read DBD 4*n unless indirect.
3. Online watch table — Force the flag words that fed DO and confirm in VAT that OPN DB displays the correct DB number, and that DBD offsets land on the expected byte address.
4. Diagnostic buffer sweep — Run the converted program in OB 100 (restart) and read the diagnostic buffer for Area length error or Addressing error within the first scan. None should appear.
5. Hardware OB fault capture — Load OB 121 / OB 122 temporarily with a STP or a buffer-stamp so a real fault halts the CPU at the exact instruction.
6. Equivalence test — If the original S5 is still operational, capture I/O traces and replicate them on the S7. Compare data block contents byte-by-byte at the end of each cycle; any mismatch is a missing 2× multiplier on a DW/DBW translation.

Frequently Asked Questions