S7-200 to S7-300 Indirect Addressing Conversion Using SFC20

S7-200 to S7-300 Indirect Addressing Conversion Using SFC20 BLKMOV

Siemens S7-200 indirect addressing syntax such as *LD4 (where the destination address is read from local double-word LD4) does not have a 1:1 equivalent in the S7-300 / S7-400 instruction set. The replacement pattern is to construct an ANY pointer in a temporary variable and pass it to SFC20 BLKMOV. This article covers the ANY data structure, the SFC20 interface, the conversion procedure, complete STL and SCL code, verification steps, and the RET_VAL error matrix.

1. Overview of the Conversion Problem

In a STEP 7 Micro/Win S7-200 program the block-move operation typically looks like the following ladder snippet:

• Source area: VW10000 (fixed start address)
• Destination area: *LD4 (indirect, the actual address is supplied by local double-word LD4)
• Length: 4 bytes

The S7-200 CPU evaluates *LD4 at runtime, so the destination is dynamic. The S7-300 / S7-400 instruction set removes pointer dereferencing operators from ladder (FBD/LAD). To preserve the same runtime behavior the S7-300 engineer must:

1. Build a 10-byte ANY pointer in a temporary DB or in the local stack (LW / P#).
2. Call SFC20 BLKMOV and pass that ANY pointer as SRCBLK or DSTBLK.
3. Handle the RET_VAL word to detect parameter errors at runtime.

2. Prerequisites

• STEP 7 V5.5 or STEP 7 Professional (TIA Portal V13+ for S7-300/S7-400 with the S7-300/S7-400 option package). See the STEP 7 V5.5 SP2 download page.
• S7-300 CPU 31x or 32x, or S7-400 CPU 41x, with firmware that supports SFC20 (all standard S7-CPU firmware).
• S7-200 source program (STEP 7 Micro/Win project) for reference. The Micro/Win IDE is not required for the target S7-300 build.
• Working knowledge of STL bit-slicing (L, T, LAR1, +AR1) or SCL AT-view on STRUCT.

3. Anatomy of the STEP 7 ANY Pointer (10 Bytes)

The ANY pointer is the universal "address + length + repetition" descriptor used by SFCs, SFBs, and FC parameter declarations of type ANY. Layout for the S7-300:

For SFC20 BLKMOV the transport size must be BYTE (01) and the length must be expressed as a number of bytes; therefore the byte address is used as-is.

3.1 Common ANY combinations

4. SFC20 BLKMOV Interface

SFC20 copies exactly count bytes starting at the address inside SRCBLK to the address inside DSTBLK. Overlapping source and destination areas are handled correctly: SFC20 uses an internal intermediate buffer to avoid corruption. Maximum length per call is 512 bytes.

5. Step-by-Step Migration Procedure

1. Identify the dynamic operand. In the S7-200 source, locate every usage of *LD / *VW inside a BLKMOV block. Note the format (DB number, area code, byte offset) of each dynamic pointer.
2. Choose a work area. Reserve a 10-byte ANY in a global DB or in the local stack of the FC/FB. The local stack is volatile and is the recommended location when the ANY only lives during one call.
3. Populate the ANY. Either pre-assemble it in the OB1 startup or assemble it on every call. For runtime-built pointers, place the 10 bytes into a temporary ANY tag using STL byte moves.
4. Call SFC20. Pass the constructed ANY to SRCBLK (when the source is static and the destination is dynamic) or to DSTBLK (when the destination is static and the source is dynamic). For both dynamic, pass two ANY tags.
5. Evaluate RET_VAL. Connect the output to a status word and, if desired, raise an OB82 / OB121 fault on a non-zero return.
6. Verify. Use a VAT table or PLCSIM to inspect memory before and after the SFC20 call, confirm length, address, and data integrity.

6. STL Example: Dynamic Destination in a Global DB

Task: copy 10 bytes from P#I 0.0 BYTE 10 (inputs IB0..IB9) to a destination inside DB100 whose start offset is supplied by MW200. Length is fixed at 10 bytes.

// FC "Build_Any_And_Move"
// Input parameter:  i_destByteOffset (INT) - destination byte offset in DB100
// In/Out parameter: io_status (WORD) - RET_VAL mirror

      L     P##src_any_static        // Pointer to constant source ANY
      LAR1
      L     P##dst_any               // Pointer to work ANY in local stack
      LAR2

      // Build DSTBLK ANY for DB100, offset = i_destByteOffset, length 10
      L     B#16#10                  // Syntax ID = area-internal
      T     LB    6                   // dst_any[0]
      L     B#16#01                  // Transport size BYTE
      T     LB    7                   // dst_any[1]
      L     10                       // Count
      T     LW     8                  // dst_any[2..3]
      L     0                        // DB-no field unused for SynID=10h
      T     LW    10                  // dst_any[4..5]
      L     B#16#84                  // Area = DB
      T     LB    12                  // dst_any[6]
      L     i_destByteOffset          // runtime offset
      SLD   3                        // convert byte offset to bit address
      T     LD    13                  // dst_any[7..10]

      CALL  SFC   20
      SRCBLK := P#I 0.0 BYTE 10
      RET_VAL:= MW   1000
      DSTBLK := dst_any

Notes on the STL code:

• P##src_any_static is a pointer literal to a 10-byte constant declared in the FC's TEMP area, or directly to P#I 0.0 BYTE 10.
• The SLD 3 instruction shifts the byte offset left by 3 bits, producing a 24-bit bit-address (bytes 7..9 of the ANY), exactly what SFC20 expects when the transport size is BYTE.
• If the destination lies in an instance DB instead of a global DB, set the Syntax ID to 10h, the Area byte to 85h, and place the instance DB number in bytes 4..5.

7. SCL Example: AT-View on a STRUCT

SCL hides the byte layout behind the POINTER and ANY data types, but you can still access the inner fields with an AT view. The following FC builds the same destination ANY and calls SFC20.

FUNCTION FC 100 : VOID
VAR_TEMP
  t_retVal     : INT;
  t_srcAny     : ANY;
  t_dstAny     : ANY;
  t_dstView    : AT  VIEW OF t_dstAny : STRUCT
                  synID   : BYTE;
                  trans   : BYTE;
                  count   : WORD;
                  dbno    : WORD;
                  area    : BYTE;
                  addr    : DWORD;
                END_STRUCT;
END_VAR
VAR_INPUT
  i_destByteOffset : INT;    // Destination byte offset inside DB100
END_VAR
BEGIN
  // Static source ANY (built once via literal in OB1 or initializer)
  t_srcAny := P#I 0.0 BYTE 10;

  // Build the destination ANY byte by byte using the AT view
  t_dstView.synID := B#16#10;          // area-internal
  t_dstView.trans := B#16#01;          // BYTE
  t_dstView.count := 10;               // 10 bytes
  t_dstView.dbno  := 0;                // unused for SynID=10h
  t_dstView.area  := B#16#84;          // DB
  t_dstView.addr  := SHL(IN:=WORD_TO_DWORD(INT_TO_WORD(i_destByteOffset)),
                         N:=3);        // byte -> bit shift

  SFC20(SRCBLK := t_srcAny,
        RET_VAL:= t_retVal,
        DSTBLK := t_dstAny);

  IF t_retVal <> 0 THEN
    // Save RET_VAL in MW1000 to surface in VAT/PLCSIM
    "DB_Status".SFC20_RetVal := t_retVal;
  END_IF;
END_FUNCTION

8. RET_VAL Error Matrix for SFC20

9. Verification

1. Static VAT check. Create a VAT with the source bytes (e.g., IB0..IB9) and the destination DB area (DB100.DBB0..DB100.DBB9 or any offset). Trigger the FC and confirm a data-id match.
2. Monitor control bits. Use PLCSIM or a real CPU. Place a breakpoint inside FC100 (in SCL) or a single-step in STL and inspect the temp ANY bytes after the AT-view population.
3. Edge cases.
   • Set i_destByteOffset to 0, -1 (illegal), and the maximum legal value (DB size - 10). The first must succeed, the second must return a non-zero RET_VAL, the third must succeed.
   • Change the DB number at runtime. Replace t_dstView.dbno with another open DB to confirm that the Syntax ID / area combination works for both 84h (global DB) and 85h (instance DB).
4. Performance. SFC20 execution time depends on length and CPU. For a 10-byte copy on an S7-315-2 PN/DP expect < 50 us; on an S7-412 expect < 20 us. Larger copies scale linearly. If a sub-millisecond cycle is required, place the SFC20 call inside OB35 with the appropriate phase offset.

10. Troubleshooting

11. Portability Notes (S7-400 / TIA Portal / S7-1500)

• The same ANY layout applies to S7-400 and to the S7-300 as a derivative. On S7-400 the maximum SFC20 length is still 512 bytes.
• In TIA Portal, SFC20 is exposed as BLKMOV inside the "Basic Instructions" palette and supports the same ANY input format. The legacy AT-view trick still works.
• On S7-1500, the MOVE_BLK_VARIABLE instruction replaces SFC20; it uses the VARIANT data type instead of an ANY. The dynamic pointer concept still applies, but at a different syntactic level. If the code must run on both S7-300 and S7-1500, keep the SFC20 call in a dedicated FC and gate it by CPU type, or use a wrapper FB on S7-1500 that accepts a VARIANT.

12. Field-Commissioning Checklist

• [ ] All dynamic offsets used at runtime have been range-checked against the destination DB size before calling SFC20.
• [ ] RET_VAL is wired to a status word that HMI can read.
• [ ] A non-zero RET_VAL triggers a one-shot alarm so that the error is captured even if it clears before HMI polls.
• [ ] A watchdog timer (e.g., OB80) is enabled if the SFC20 is critical-path.
• [ ] All DBs referenced by ANY pointers are loaded and unlinked (avoid download in RUN when DB length changes; use "Download in RUN" with care).
• [ ] A reference S7-200 program (or printout) is archived in the project vault for audit trail.

13. Frequently Asked Questions