S7-1200 Easy Book: Complete Programming Reference Guide

S7-1200 Easy Book Scope and Document Access

The SIMATIC S7-1200 Easy Book (Siemens Industry Online Support entry ID 39710145) is the official introductory reference for engineers commissioning an S7-1200 compact PLC for the first time. It walks through the entire onboarding path: STEP 7 Basic (TIA Portal) project creation, hardware catalog selection, device and network configuration, LAD and FBD programming, the full data-type table, program organization blocks, online test and diagnosis, PROFINET and point-to-point communication, HMI basic panel visualization, USS drive handshaking with the SINAMICS G110 and MICROMASTER 4, and the LabVIEW data-exchange model.

The Easy Book is distributed as a free PDF and as an HTML help page from the Siemens Industry Online Support portal. The canonical download entry is support.industry.siemens.com - SIMATIC S7-1200 Easy Book (ID 39710145). Because the document has been reissued several times (most recently the 04/2012 edition, with online updates tied to TIA Portal V11/V12), always check the Edition field on the title page and cross-reference it against the firmware version of the CPU you are programming.

S7-1200 Hardware Components and CPU Selection

The Easy Book opens with the physical building blocks of an S7-1200 station. The chassis-less modular PLC is assembled from a CPU, optional signal boards (SB) plugged onto the CPU front, signal modules (SM) snapped to the right of the CPU, and communication modules (CM/CP) clipped to the left of the CPU. Power is fed either through the integrated 24 V DC terminal on the CPU or through a separate PM1207 power module.

The Easy Book explicitly maps each catalog article to its slot and address area. The S7-1200 address space is fixed and starts at I0.0 for digital inputs and Q0.0 for digital outputs on the CPU. Adding an SM1223 to the right of the CPU extends the digital area to I8.0 / Q8.0 and beyond; analog channels begin at IW64 / QW64 by default and are remappable from the device configuration.

STEP 7 Basic Project Handling

STEP 7 Basic is the engineering tool bundled with TIA Portal and is the only programming environment that targets the S7-1200 in the current Siemens portfolio (STEP 7 V5.5 and older do not support S7-1200). The Easy Book dedicates its opening chapter to the portal view, project tree, and the four working panes: Project Navigation, Device Configuration, Programming Editor, and Online & Diagnostics.

1. Launch TIA Portal and select Create new project. The project name becomes the basis of the offline/online comparison path stored under \Documents\Automation\Projects\<ProjectName>.ap<version>.
2. Insert a new device through Add new device > SIMATIC PLC > S7-1200 > CPU. Pick the exact order number (MLFB) and firmware version of the physical CPU - mismatched firmware is the single most common cause of a download failure.
3. Add a programming block: Program blocks > Add new block > OB1 (Main). The Easy Book uses OB1 as the default cyclic organization block and recommends leaving its priority at 1.
4. Add an HMI device: Add new device > SIMATIC HMI > KTP400 / KTP700 / KTP900 / KTP1200 Basic. HMI basic panels use WinCC Basic, which is included in STEP 7 Basic at no extra cost.
5. Add a PC station for WinCC Runtime or for a LabVIEW TCP target if needed.
6. Save and compile the project. The compiler produces a consistent system data snapshot used by all online operations.

The Easy Book emphasizes one discipline repeatedly: the device configuration is the single source of truth for I/O addresses, slot rules, and PROFINET device names. A ladder network that references an address that is not configured in the device will compile but will fail to bind during download, surfacing as Download to device - error 33:0x0119 inconsistent system data in the diagnostics buffer.

Device Configuration and Network Planning

The Device View is the graphical representation of the station rail. Drag a CPU from the catalog to slot 0, an SB into the SB slot inside the CPU front cover, SMs to slots 1-8 to the right, and CMs/CPs to slots 101-103 to the left. PROFINET IO devices attach to the CPU PROFINET port (or to the CP 1243-1) and occupy sub-slots in the device view rather than physical slots.

Network planning follows the standard PROFINET topology. The CPU acts as the IO Controller and assigns IP addresses and device names to the IO Devices at startup. The Easy Book recommends reserving a sub-net from a private range (e.g. 192.168.0.0/24) and disabling DHCP on every PROFINET node. Topology editor entries - port-to-port cabling - are optional but mandatory for the LLDP-based neighbor detection used by some PROFIenergy and diagnostics functions.

LAD and FBD Programming Fundamentals

The Easy Book introduces the two editors used for S7-1200: Ladder Logic (LAD) and Function Block Diagram (FBD). Structured Text (SCL) and Graph are available in TIA Portal V13+ as paid add-ons, while the Easy Book era covers the free LAD/FBD subset. Both editors operate on the same compiled code; switching editors in the project tree is non-destructive.

Each network must terminate with a coil (LAD) or an assignment box (FBD). Unterminated networks fail to compile with the diagnostic Network N must contain a coil or assignment. The four key instruction families are:

• Bit logic: normally-open (NO), normally-closed (NC), output coil, set/reset, SR/RS flip-flops, rising/falling edge detectors P and N.
• Timers: TP (pulse), TON (on-delay), TOF (off-delay), TONR (retentive on-delay). The Easy Book maps each timer to its IEC 61131-3 definition and warns that S7-200-style T32/T96 timer numbers do not exist on the S7-1200.
• Counters: CTU (count up), CTD (count down), CTUD (count up/down). All counter instances live in their own data block and survive a CPU restart only if the instance is set to Retain.
• Comparators and math: ==, <>, >, >=, <, <=; integer and real arithmetic +, -, *, /, MOD; CALCULATE box for inline expressions.

A canonical LAD example from the Easy Book - an automatic start/stop seal-in with overload interlock - looks as follows:

Network 1:    Start seal-in
              |      Start_PB   OL_OK        Motor_Run       |
              |----| |--------|/|----------(S)---------------|
              |                                              |
              |      Stop_PB                              Motor_Run |
              |----| |------------------------------------( )---|

Network 2:    Output to contactor
              |      Motor_Run                                  |
              |----( )----------------------------------------( )Q0.0

The S7-1200 evaluates networks top to bottom in OB1; coil feedback to a contact in the same network is a closed loop in the PLC sense only if the contact is read at the start of the next scan. The Easy Book explicitly recommends the seal-in pattern shown rather than a single-line self-latching contact, because the S7-1200 optimizer in TIA Portal V14+ can otherwise detect a tautology and emit the warning Formal parameter access to a constant in a network.

Variables, Data Types, and Memory Layout

The PLC tag table replaces the S7-200/VB-style symbol table + absolute address split. Every variable used in a program is declared once in the PLC tag table or in a data block, and then addressed symbolically. The Easy Book distinguishes four scopes:

Retain behavior is configured per tag, per FB instance, and per DB. The Easy Book recommends a maximum of 10 KB of retained data for CPU 1211C/1212C and up to 14 KB for 1214C/1215C; exceeding the retain budget causes a download with a diagnostic warning Retain memory overflow and forces non-retain behavior at runtime.

Program Blocks: OB, FB, FC, DB, and UDT

The Easy Book dedicates a chapter to the block architecture of the S7-1200, which mirrors the IEC 61131-3 model:

• OB (Organization Block): cyclically called entry points. OB1 is the main scan, OB35 the cyclic interrupt (default 100 ms, configurable down to 1 ms), OB82 the diagnostic interrupt, OB121 the programming error OB, OB122 the I/O access error OB.
• FB (Function Block): reusable code with its own static memory. Each call uses an instance DB; multi-instance capability was added in firmware V4.0.
• FC (Function): stateless code; variables passed by value through the input interface and returned through the output interface.
• DB (Data Block): typed or untyped storage. The Easy Book uses typed DBs exclusively for non-trivial data because the type information drives the HMI tag list and the OPC UA server exposed by the CPU.
• UDT (User-Defined Data Type): a struct-like template. Use it to define a motor, a recipe row, or a PID block once and instantiate it across multiple DBs.

FB invocation syntax in the Easy Book (FBD editor):

Motor_DB.Motor_Run           // DB scope access

Instance_DB of FB "MotorControl"
EN:    TRUE                  // Enable input
Start: Start_PB              // Local tag binding
Stop:  Stop_PB
OL:    OL_OK                 // Overload feedback
Run:   "Motor1_Run"          // Output tag
Fault: "Motor1_Fault"        // Static output retained in instance

Calling an FB without an instance is the second most common runtime error in the Easy Book and produces the diagnostic Instance DB missing - block cannot be called (SF LED on, BF off, MAINT blinking).

Online Operation, Watch Tables, and Diagnosis

Online operations require the IP route from the engineering PC to the S7-1200 PROFINET port. The Easy Book walks through the Go online wizard, which performs a three-step discovery: accessible nodes over Ethernet, accessible nodes over PROFIBUS, and finally the Online & Diagnostics view for the selected CPU.

The diagnostic buffer is the primary fault-triage surface. Each entry carries a timestamp (relative to the CPU's time-of-day clock), an event ID, and a description. Key events called out in the Easy Book include:

• 16#0301 (769): Diagnostics interrupt from an SM - read the channel-level diagnostic in the online view of the module.
• 16#0131 (305): Programming error in the user program, with the OB and instruction address of the fault.
• 16#0132 (306): I/O access error, typically a removed or unconfigured module.
• 16#454B (17739): Time-of-day clock set successfully after STOP-to-RUN transition.

Forcing an output writes the value directly into the process image and bypasses the user program. The Easy Book warns that the FORCE LED is lit whenever any tag is forced, and that forcing a digital output on an SM that has been removed from the rack leaves the force table in an inconsistent state - clear all forces before a hot-swap of an SM.

PROFINET Communication

The CPU 1214C/1215C/1217C expose a two-port PROFINET switch on the bottom of the chassis (port 1 and port 2 in the device configuration). The Easy Book uses PROFINET for three classes of traffic: HMI, distributed I/O, and PUT/GET or S7 communication with another S7 controller.

Open user communication is configured with the TSEND_C and TRCV_C instruction pairs (since firmware V4.0). The Easy Book example for sending a 200-byte recipe to a partner PLC is:

"TSEND_C_DB" (TSEND_C)
REQ:   Send_Trigger        // Rising edge starts the send
CONT:  TRUE                // Keep the connection open
LEN:   200                 // Fixed payload length
CONNECT: "Partner_Conn"    // Connection description from device config

With a CP 1243-1, the Easy Book also documents the Webserver, FTP, and e-mail instructions. Security settings (user management, certificate handling) on the CP 1243-1 are independent of the CPU and are configured under Device configuration > Security.

Point-to-Point and USS Drive Communication

For serial links the Easy Book covers the CM 1241 modules (RS232, RS422, RS485) and the SB 1231 (RS485). The CM 1241 is configured under Device configuration > RS232/RS422/RS485 interface with the protocol set to ASCII, Modbus RTU, or USS.

The USS protocol wraps a 14-byte telegram around a parameter / read-write word. The Easy Book example for starting a SINAMICS G110 and reading the actual speed uses USS_PORT, USS_DRIVE, and the standard telegram word mapping (control word 1, status word 1, main setpoint, main actual value).

// USS_DRIVE instance configuration
DRIVE:        1             // Drive address set on the G110 / MM440
LEN:          4             // 4 words of process data
PZD_LEN:      2             // PZD portion of the telegram

// Drive control
USS_DRIVE_1(REQ  := Start_Req,
            SPEED := Speed_SP,    // Real, normalized to 1.0 = 50/60 Hz
            ENABLE := TRUE,
            FAULT  => "Drive1_Fault",
            RUNNING => "Drive1_Running",
            ACT_SPEED => "Drive1_Actual");

The Easy Book explicitly maps the USS control word bits: bit 0 = ON/OFF1, bit 1 = OFF2 (coast stop), bit 2 = OFF3 (quick stop), bit 3 = enable/inhibit pulse, bit 4 = ramp enable, bit 5 = ramp enable freeze, bit 6 = setpoint enable, bit 10 = control from PLC. Status word mirroring lives in the same PZD. Forcing bits the user did not configure is the dominant cause of a drive starting in OFF2 state.

HMI Basic Panels and WinCC flexible Integration

KTP400 Basic, KTP700 Basic, KTP900 Basic, and KTP1200 Basic panels are configured inside the same TIA Portal project. The Easy Book shows the integration steps:

1. Add the panel from the catalog: Add new device > SIMATIC HMI > Basic Panel.
2. Drag tags from the PLC tag table to the HMI tag table. Connection "HMI_Connection_1" is created automatically.
3. Place an I/O field on a screen, link it to a PLC tag, set the Display format and Limits.
4. Configure the panel IP and the connection properties (HMI is the PROFINET IO Device, the PLC is the IO Controller).
5. Compile and download the HMI runtime; the Easy Book recommends downloading HMI first, PLC second, to avoid temporary "variable not connected" alarms on the panel.

For projects built with WinCC flexible 2008 (the predecessor of WinCC Basic), the Easy Book documents a migration path: export the WinCC flexible project to a TIA Portal-compatible panel using the Migrate project tool. Pre-V11 WinCC flexible projects compile inside TIA Portal V11+ only after a one-way conversion; once migrated, they no longer open in WinCC flexible.

LabVIEW and Third-Party Integration

The Easy Book covers two paths for connecting an S7-1200 to a LabVIEW front end: OPC and TCP using the open S7 communication protocol. The OPC path uses the SIEMENS PC station with a Softnet S7 Lean / Professional license, and the LabVIEW DSC module acts as the OPC client. The TCP path uses a custom LabVIEW block set that talks to the open S7 protocol on TCP port 102 - the Easy Book shows the four byte TPKT/COTP headers and the S7 job/ack frame layout required to read a DB word.

Commissioning Checklist and Verification

The Easy Book closes with a commissioning sequence that an experienced automation engineer can use as a punch list. Run the steps in order, do not skip the Go-Online checksum comparison before powering the load.

1. Verify the device configuration MLFBs and firmware versions match the physical hardware 1:1.
2. Open Online & Diagnostics > Diagnostic buffer and confirm no entries since last STOP-RUN transition.
3. Check the cycle time of OB1 under Online & Diagnostics > Cycle time. A healthy S7-1200 with a typical Easy Book program runs in 2-10 ms; over 50 ms indicates an unintended scan-time eater such as a blocking USS_PORT on a slow baud rate.
4. Open each watch table for the section under test, click Monitor all, and verify the expected bits toggle with the field wiring.
5. Force each output briefly to confirm end-to-end wiring and actuator response, then clear all forces.
6. On PROFINET: confirm the IO Devices have OK status in Online & Diagnostics > PROFINET and that no Maintenance alarm is latched.
7. On drives: read the drive's r0002 parameter (control word) and r0021 (actual speed) over the USS PZD, and confirm they track the PLC's setpoint.
8. Save the final project to the SIMATIC Memory Card and label the card with the project name and the date.

Troubleshooting Matrix