Resolving SFC20 PADR Parameter in S5 to S7 FB208 Conversion

Overview

Migrating an S5-115U, S5-135U, or S5-155U program (CPU 944B or 945) to the S7-300/400 platform using the STEP 7 S5 converter leaves several operands unresolved on FB 208. The converter emits a generated CALL of SFC 20 (BLKMOV) and returns the diagnostic message "CALL SFC 20 has been generated, please complete the parameter list" at the offending line. The unresolved operands are the SRCBLK and DSTBLK pointer constants. The root cause is the PADR formal parameter of FB 208, which the S5 source keeps inside a flag word (FW) or data word (DW) that the converter cannot statically resolve.

This article documents the engineering procedure required to (a) determine the absolute value that the S5 program loads into PADR, (b) translate the S5 transfer sequence (L PADR, OW W#16#0001, TNB 1) into the S7 ANY pointer format expected by SFC 20, and (c) validate the converted block on a real S7-300 CPU with the correct background DB.

The reference target is an S5 944B CPU on a 135U/155U rack, converted with the STEP 7 S5 converter shipped with STEP 7 V5.4 / V5.5 / V5.6 and loaded on a S7-300 (CPU 315-2 DP / 317-2 DP) or S7-400 (CPU 414-3 / 416-3) target. Documentation references for the converter and SFC 20 are available on the Siemens Support portal and in the STEP 7 SFC/SFB reference manual.

S5 FB 208 Parameter Interface

FB 208 is a user-defined or library-resident function block in the S5 program. The block header declares the formal parameters in S5 STEP 5 mnemonics (BI = byte in/out, W = word, BO = boolean). The instance DB (background DB) holds the static instance data, and the block uses the parameters to drive the serial hardware on a 944B CPU or on a CP 524 / CP 525 / CP 526 front-end module.

The S5 caller fills these parameters at the FB call site. In OB 1 the call appears as a box (graphical) or as a SPA / SPB jump to FB 208. A typical call looks like:

:SPA FB208
 NAME : FB208
 UBDB : DB150
 PADR : FW 30        // or DW 20, or a literal KH constant
 COFF : KF +0
 WDHA : KF +1
 MAFB : KF +0
 CHAN : KF +1
 EROR : M 200.0
 RFLM : M 200.1

Open the actual call in the S5 program. Note the operand that is bound to PADR. Three cases are typical:

1. Literal constant: PADR is wired with KF / KH (e.g. KF +128 or KH 0080). The value to enter into the SRCBLK of SFC 20 is then the data-byte offset directly.
2. Flag word: PADR is wired with FW n (n = 0..254, even). The runtime value is loaded from flag word n in the S5 cycle. You must inspect the OB 1 / OB 21 / OB 22 initialization routine to determine which FW cell is preset and with which KH / KF value.
3. Data word: PADR is wired with DW n of the background DB. The DW is set inside FB 208 itself, typically in the first network. Search the FB body for any "L KH #### ; T DW n" sequence that writes the value before the BLKMOV is called.

Converter Failure Mode on PADR

The STEP 7 S5 converter translates each formal parameter of FB 208 into a local TEMP variable in the converted STL source. For static types it can map FW n to MW n and DW n to DBW (DBB + 2*n). For the BLKMOV call it generates a placeholder ANY pointer on the SRCBLK and DSTBLK inputs and emits the diagnostic "CALL SFC 20 has been generated, please complete the parameter list" at the offending line. The converter cannot infer a pointer ANY because the operand is a parameter (formal) and not a static instance variable, and the S5 instruction sequence L PADR ; OW W#16#0001 ; TNB 1 in the S5 body has no direct equivalent in the S7 SFC 20 input model.

The converter is not a programming assistant. It is a one-pass translator that emits the highest-fidelity STL it can derive from the S5 source. When it cannot resolve an operand, it leaves a placeholder and a comment. The engineer is responsible for filling the placeholder before downloading the program to the target CPU.

SFC 20 BLKMOV in S7

SFC 20 (BLKMOV) is part of the S7-300/400 system functions (IEC 1131-3 standard function "MOVE_BLK"). It copies a contiguous byte range from a source memory area to a destination memory area. The function is available in every S7-300 / S7-400 CPU firmware and is documented in the STEP 7 System and Standard Functions reference manual.

The S7 ANY pointer has the following structure on the S7-300 (10 bytes) and S7-400 (16 bytes, with 6 trailing zero bytes):

Byte  0      1         2       3     4      5     6      7       8       9
      10      02/03/04  01      n     DBno.  (byte offset 32-bit)            (unused on S7-300)
      |       |         |      |     |      |
      |       |         |      |     |      +-- byte offset (DWORD)
      |       |         |      |     +--------- DB number (WORD)
      |       |         |      +--------------- repetition count (WORD, in units of the transport size)
      |       |         +---------------------- transport size: 01=BYTE, 02=WORD, 03=DWORD
      |       +-------------------------------- syntax ID: 10=P, 11=OUTPUT, 12=M, 13=DB, 14=DI, 15=L STL (varies by S7 doc revision)
      +---------------------------------------- byte count: 10 (length of the ANY)

The symbolic constant format accepted by the STEP 7 program editor is:

P#DB150.DBX20.0 BYTE 12
P#M 100.0 BYTE 8
P#I 0.0 WORD 4
P#Q 8.0 BYTE 1

You build the SRCBLK and DSTBLK constants from the operand bound to PADR and the parameter area layout of the target block. The SFC 20 input model requires a static ANY constant; you cannot pass a runtime-computed pointer through the formal interface without building the ANY in a TEMP variable (which is the standard technique for dynamic BLKMOV calls).

Tracing the PADR Value in the S5 Source

The procedure below is the engineering workflow to determine the value to load into the SRCBLK ANY pointer of the generated SFC 20 call.

1. Open the S5 program in STEP 5 (or the S5 import project in STEP 7).
2. Locate the FB 208 call site. In OB 1 the call appears as a box (graphical) or a "SPA FB208" line. Note the parameter bindings for PADR, COFF, WDHA, MAFB, CHAN.
3. Identify the operand assigned to PADR. The three common cases are a literal, a flag word, or a data word.
4. Cross-reference the operand in the S5 program.

Once the value of PADR is known, compute the source pointer:

SRCBLK := P#DB<UBDB>.DBX<PADR_value>.0 BYTE <length>

where UBDB is the background DB bound to the call (e.g. DB 150), PADR_value is the absolute byte offset inside that DB, and length is the size of the parameter block. For a typical S5 communication parameter block the length is 8, 12, or 24 bytes.

If the PADR operand is a flag word, the most reliable tracing method is the STEP 5 cross-reference list (Ctrl+K). Search the list for all writers of FW n. The cross-reference returns every line in the S5 program that loads or transfers to FW n. Enumerate the writers; the runtime value is the last one executed before the FB 208 call in the cycle. OB 21 / OB 22 (startup routines) often preload the flag word with the default value; OB 1 (cyclic) can override it conditionally.

Mapping the S5 TNB / OW / Load Sequence

The S5 instruction fragment that the converter cannot translate is:

L   #PADR           // load the PADR value (byte offset) into ACCU1
L   W#16#1          // load constant 0x0001
OW                  // ACCU1 = PADR | 0x0001   (set bit 0)
L   W#16#EEFF       // ACCU1 = 0xEEFF (constant for TNB 1)
UN  M 255.7         // test reset / handshake bit
TNB 1               // transfer 1 byte to the parameter area

The OR with W#16#0001 forces the low bit of the PADR value, which is required by the S5 944B serial interface to align the parameter area to an odd address. The TNB 1 is a special instruction that writes the ACCU low byte to a hardware parameter area addressed by AKKU 2 (the previous accumulator content). The constant W#16#EEFF is the "execute" opcode that triggers the S5 944B serial interface to process the parameter block immediately.

In S7 the equivalent is a load into the SFC parameter area of the communication processor. Replace the L / OW / L / TNB sequence with a write into the I/O area of the CP 340 / CP 441, then call the dedicated CP function block (FB 7 P_SEND / FB 8 P_RCV for the CP 340; the CP 441 library function block for the CP 441). The SFC 20 BLKMOV is only the data-movement part; the handshake / execution constant is implemented inside the CP function block.

Step-by-Step Resolution Procedure

1. Open the S7 project that contains the converted FB 208. In the program editor the FB shows the SFC 20 call with SRCBLK and DSTBLK as ??? placeholders.
2. Open the S5 source archive (or the S5 import folder in the STEP 7 project). Navigate to the FB 208 call site in OB 1 and record the operand bound to PADR (FW, DW, or literal).
3. If the operand is a flag word (e.g. FW 30), search the S5 program for all writes to FW 30: grep "T FW 30" *.S5D or use the STEP 5 cross-reference (Ctrl+K). Record every value loaded into FW 30. The runtime value is the last write executed before the FB 208 call in OB 1.
4. If the operand is a data word (e.g. DW 20 in DB 150), open DB 150 in the S5 program and search FB 208 for the network that loads the DW. Record the value (KH #### or KF +#).
5. Convert the value to the S7 ANY pointer: P#DB150.DBX20.0 BYTE 12 (example for PADR = 20, length = 12 bytes).
6. Open the SRCBLK and DSTBLK parameters in the SFC 20 call and enter the ANY pointer constants. Use a local TEMP variable of type ANY if the value is dynamic, or a direct ANY constant if the value is a literal.
7. Compile the FB. The "CALL SFC 20 has been generated" diagnostic clears when both pointer inputs are valid ANY descriptors.
8. Download the FB and the background DB to the target CPU. Watch the RET_VAL output: W#16#0000 = OK; non-zero = parameter error.
9. Trigger the FB call from OB 1 (or from a test VAT) and verify that RET_VAL returns W#16#0000.
10. Document the resolved PADR value, the SRCBLK constant, and the background DB number in the project documentation for future maintenance.

Verification and Testing

Use the following checklist to validate the converted block on the S7-300 / S7-400 CPU.

Use a variable table (VAT) to monitor the PADR value, the SRCBLK ANY descriptor, and the RET_VAL output. Add a breakpoint in the FB to step through the BLKMOV call. On a CP 340 / CP 441, also watch the DONE / ERROR / STATUS outputs of the P_SEND / P_RCV function block to confirm that the CP executed the parameter block.

Common SFC 20 RET_VAL Codes

The full list of SFC 20 error codes is in the STEP 7 SFC/SFB reference manual on the Siemens Support portal.

Field Notes and Caveats

• The S5 944B serial interface uses the W#16#EEFF "execute" opcode to trigger parameter block processing. The S7 equivalent for the CP 340 / CP 441 is the "EN" or "REQ" input of the P_SEND / P_RCV function block. The SFC 20 BLKMOV alone is not sufficient.
• Some S5 communication blocks used FW 200..FW 254 as scratch area. The STEP 7 converter maps these to MW 200..MW 254. Be careful: on S7-300 the flag area starts at MB 0 and ends at MB 1023 (size 1024 bytes on a 315-2 DP), so FW n maps to MW n. On S7-400 the flag area can be 8192 or 16384 bytes depending on CPU type (e.g. 416-3 supports 16384 bytes).
• If the FB 208 background DB is larger than 4096 bytes, verify that the S7-300 CPU supports a DB of that size. The 312 IFM / 313 / 314 CPUs have a DB size limit (typically 8 KB per work memory bank). The 315-2 DP / 316-2 DP / 318-2 DP do not have this constraint for the typical S5 conversion footprint.
• Always re-test the parameter block after a CPU firmware update. The SFC 20 implementation is the same across STEP 7 V5.4, V5.5, and V5.6, but the CP 340 / CP 441 firmware has been revised (e.g. CP 340 firmware V1.5 / V2.0 for the 6ES7 340-1AH02-0AE0 hardware revision). Confirm compatibility with the CP manual on the Siemens Support portal.
• The S5 program may write the PADR DW from a different FB (e.g. FB 200) via a global variable. In that case the cross-reference must span the entire program. Use the S5 cross-reference list (CTRL+K in STEP 5) to enumerate all writers.
• If the FB 208 call site binds PADR to a KH literal, the converter should resolve the literal automatically. If the converter still emits the placeholder, the S5 source may be using an indirect assignment (e.g. L KH 0080 ; T FW 30 ; SPA FB 208 with PADR := FW 30). Trace the FW writer in OB 1.
• When the converted FB 208 is called from a S7-300 FB 1 / FB 11 (OB 1 wrapper), verify that the instance DB of FB 208 is downloaded separately. The converter does not always download the instance DB automatically.
• The S5 944B flag area is 256 bytes (FW 0..FW 254). The S7-300 flag area is 1024 bytes on a 315-2 DP. If the S5 program uses the flag area above FW 254 (which the 944B does not allow but some 945 / 928B CPUs do), the converter will fail with a range error; the engineer must remap the operand to a DB.

Commissioning Checklist

1. Verify the S5 source archive contains FB 208 and the caller OB 1 / OB 21 / OB 22.
2. Run the STEP 7 S5 converter and resolve all "CALL SFC 20 has been generated" diagnostics.
3. Compile the S7 project; verify no SFC 20 placeholder warnings remain.
4. Download the HW Config (with the correct CP 340 / CP 441 module if used) to the target CPU.
5. Download the S7 program blocks and the FB 208 instance DB.
6. Switch the CPU to RUN-P. Watch the SF / BF LEDs.
7. Open a VAT; monitor PADR, the SRCBLK ANY constant, and RET_VAL.
8. Trigger the FB 208 call from OB 1. Verify RET_VAL = W#16#0000.
9. Verify the CP 340 / CP 441 P_SEND / P_RCV DONE output. If the CP is connected to a partner, verify the partner receives the data.
10. Run the system for 1 hour under load; verify no sporadic RET_VAL codes.
11. Document the resolved PADR value, the SRCBLK / DSTBLK constants, and the commissioning date in the project documentation.

Frequently Asked Questions