S7-300 Custom Up/Down Counter with Variable Step in STEP 7

1. Overview

Siemens S7-300/400 CPUs expose the IEC 61131-3 CTUD (Count Up/Down) functionality through System Function Block SFB 2 (CTUD) in the System Function Blocks library. SFB 2 increments by +1 on a rising edge at CU and decrements by -1 on a rising edge at CD, which is sufficient for the classic IEC counter use case. It does not, however, allow the engineer to configure the step width: the count always changes by exactly 1 per qualified edge.

When a machine requires a user-defined increment (for example "add 5 to the count on every up-pulse") or when the count variable must survive a scan cycle so that it can be read by an HMI or transferred to another block, the engineer must build a custom Function Block (FB) backed by an Instance Data Block (DB). The FB holds the count value in a STAT variable, qualifies the up/down command inputs with edge flags, applies the step, and clamps the result against configurable high and low limits.

This reference describes a production-ready FB_CountUpDown for STEP 7 V5.x targeting S7-300 CPUs (also valid for S7-400 and ET 200S IM 151-7/151-8 with CPU interface). The implementation covers:

• STL, SCL and LAD/FBD source code variants.
• Edge detection with debounce semantics.
• Limit clamping and DINT/INT rollover protection.
• Status outputs for HMI, alarms, and axis interlocks.
• Commissioning checks via VAT and the S7 PLCSIM simulator.

2. Why SFB 2 Is Not Sufficient for a Variable-Step Counter

SFB 2 declares a fixed PV (preset) and reports a 1-bit difference. The relevant I/O footprint is documented in chapter 26.6 of SIMATIC S7-300/400 Standard Functions (Reference Manual):

Three limitations make SFB 2 inadequate for variable-step applications:

1. Fixed step width. SFB 2 always adds or subtracts 1. There is no input that lets the caller pass a step of 2, 5, 0.5, or any other value.
2. INT range. The internal CV is a 16-bit INT, so the count is bounded by -32768..32767. Modern machines with 32-bit position values exceed this range.
3. No user-defined low limit. The lower bound is hard-coded to 0; an application that needs to count within, for example, 200..800 cannot use SFB 2 without external arithmetic that has to mirror the internal state.

The recommended path is a custom FB. The FB carries the count in its STAT section (so the value persists between cycles and can be observed through the instance DB), accepts the step and limits as inputs, and exposes clean STAT/OUT values to the HMI.

3. Prerequisites

Before building the counter, verify that the following hardware and software is in place:

• STEP 7 V5.5 SP2 (or later V5.x) installed on the engineering station. The SCL optional package is required for the SCL variant.
• PLC: S7-300 CPU 31x with firmware V2.x or higher. For DINT counters, all 31x CPUs (CPU 312 to CPU 319) support DINT; CPU 312 IFM (6ES7312-5AC00) only supports INT counters and must use the INT variant.
• Project structure: a S7 program with a S7-300 station, an OB1 (or OB35 for cyclic tasks) and at least one FB. The FB must be created in the S7 Program / Blocks folder.
• Online interface: MPI, PROFIBUS, or PROFINET to the target CPU for commissioning. The S7 PLCSIM simulator (part of STEP 7) can be used for dry-run tests.
• I/O wiring: two digital inputs wired to the operator's up/down push-buttons (or to discrete sensors). The wiring follows the S7-300 Wiring and Installation Manual.

4. Block Interface Design

Open the S7 Program, right-click Blocks and select Insert New Object → Function Block. Name the FB FB_CountUpDown and assign a number in the user range (e.g. FB100). Define the interface as follows:

Mark sCount, sUpEdge, sDnEdge, and sInit with the attribute S7_retentive = TRUE on the FB properties so the count survives a CPU STOP/RUN transition and a power loss (provided the CPU has a retentivity configuration that covers the instance DB).

5. STL Implementation (STEP 7 V5.5)

The following STL source runs in OB1 or any cyclic OB. The two edge memories produce exactly one increment per qualified input edge regardless of how long the input is held.

FUNCTION_BLOCK FB100
TITLE  ='Up/Down Counter with Variable Step'
VERSION : '1.0'

//-------------------------------------------------
// Section: STAT initialisation on first scan
//-------------------------------------------------
      A     #sInit
      JCN   INIT
      L     L#0
      T     #sCount
      SET
      =     #sInit
INIT: NOP 0

//-------------------------------------------------
// Section: input validation
//-------------------------------------------------
      L     #iStep
      L     0                   // L 0
      >I                       // step <= 0 ?
      =     #oError.%X0         // E0: step must be > 0

      L     #iHigh
      L     #iLow
      <=D                       // iHigh <= iLow ?
      =     #oError.%X1         // E1: invalid limits

      L     #oError.%W0
      L     0
      <>I
      JC    SKIP                // abort counting on error

      SET
      =     #oValid

//-------------------------------------------------
// Section: reset and preset (priority order)
//-------------------------------------------------
      A     #iReset
      JCN   NORST
      L     #iLow
      T     #sCount
NORST:NOP 0

      A     #iLoad
      JCN   NOLOAD
      L     #iPreset
      T     #sCount
NOLOAD:NOP 0

//-------------------------------------------------
// Section: edge detection and counting
//-------------------------------------------------
      A     #iEnable
      JCN   SKIP                // master enable off

      // --- count UP ---
      A     #iUp
      AN    #sUpEdge
      JCN   NOUP
      L     #iHigh
      L     #sCount
      -D
      L     #iStep
      >=D                       // (High - sCount) >= Step ?
      JC    UPOK
      L     #iHigh              // saturate
      JU    UPWRT
UPOK: L     #sCount
      L     #iStep
      +D
UPWRT:T     #sCount
NOUP: NOP 0
      A     #iUp
      =     #sUpEdge

      // --- count DOWN ---
      A     #iDn
      AN    #sDnEdge
      JCN   NODN
      L     #sCount
      L     #iLow
      -D
      L     #iStep
      >=D                       // (sCount - Low) >= Step ?
      JC    DNOK
      L     #iLow               // saturate
      JU    DNWRT
DNOK: L     #sCount
      L     #iStep
      -D
DNWRT:T     #sCount
NODN: NOP 0
      A     #iDn
      =     #sDnEdge

SKIP: NOP 0

//-------------------------------------------------
// Section: outputs
//-------------------------------------------------
      L     #sCount
      T     #oCount

      L     #sCount
      L     #iHigh
      >=D
      =     #oHigh

      L     #sCount
      L     #iLow
      <=D
      =     #oLow

END_FUNCTION_BLOCK

6. SCL Implementation (recommended for readability)

SCL is included with the S7-SCL optional package and is supported by all S7-300 CPUs that are programmed with STEP 7 V5.5. The SCL source is the most maintainable form of the same algorithm:

FUNCTION_BLOCK FB100
TITLE = 'Up/Down Counter with Variable Step'
VERSION : '1.0'

VAR_INPUT
  iUp      : BOOL;
  iDn      : BOOL;
  iHigh    : DINT;
  iLow     : DINT;
  iStep    : DINT;
  iPreset  : DINT;
  iLoad    : BOOL;
  iReset   : BOOL;
  iEnable  : BOOL;
END_VAR

VAR_OUTPUT
  oCount   : DINT;
  oHigh    : BOOL;
  oLow     : BOOL;
  oValid   : BOOL;
  oError   : WORD;
END_VAR

VAR
  sCount   : DINT;
  sUpEdge  : BOOL;
  sDnEdge  : BOOL;
  sInit    : BOOL;
END_VAR

VAR_TEMP
  tDelta   : DINT;
END_VAR

BEGIN

  // --- input validation ----------------------------------------
  oError  := 0;
  IF iStep <= 0 THEN
    oError.%X0 := TRUE;             // E0 step must be > 0
  END_IF;
  IF iHigh <= iLow THEN
    oError.%X1 := TRUE;             // E1 invalid limits
  END_IF;
  oValid := (oError = 0);

  IF NOT oValid THEN
    oCount := sCount;
    oHigh  := FALSE;
    oLow   := FALSE;
    RETURN;
  END_IF;

  // --- reset / preset ------------------------------------------
  IF iReset THEN
    sCount := iLow;
  END_IF;

  IF iLoad THEN
    sCount := iPreset;
  END_IF;

  // --- edge detection + step arithmetic -----------------------
  IF iEnable THEN

    // count UP
    IF iUp AND NOT sUpEdge THEN
      tDelta := iHigh - sCount;
      IF tDelta >= iStep THEN
        sCount := sCount + iStep;
      ELSE
        sCount := iHigh;             // saturate at upper limit
      END_IF;
    END_IF;
    sUpEdge := iUp;

    // count DOWN
    IF iDn AND NOT sDnEdge THEN
      tDelta := sCount - iLow;
      IF tDelta >= iStep THEN
        sCount := sCount - iStep;
      ELSIF sCount > iLow THEN
        sCount := iLow;              // saturate at lower limit
      END_IF;
    END_IF;
    sDnEdge := iDn;

  END_IF;

  // --- outputs -------------------------------------------------
  oCount := sCount;
  oHigh  := (sCount >= iHigh);
  oLow   := (sCount <= iLow);

END_FUNCTION_BLOCK

Compile with Options → Compile (Ctrl+B) or via the menu PLC → Compile and Download Objects. SCL produces more compact ladder-equivalent MC7 code, which can be confirmed by opening the compiled FB and switching the view to STL.

7. Ladder / FBD Implementation Notes

The same logic is possible in LAD and FBD but requires more network segments. Use the following network plan as a starting point:

8. OB1 Call and Instance DB Generation

Open OB1 in the S7 program and call the FB. STEP 7 will offer to create the instance DB:

      CALL FB100 , DB100
       iUp      := I 0.0
       iDn      := I 0.1
       iHigh    := MW 20
       iLow     := MW 24
       iStep    := MW 28
       iPreset  := MW 32
       iLoad    := I 0.2
       iReset   := I 0.3
       iEnable  := I 0.4
       oCount   := MW 40
       oHigh    := M 50.0
       oLow     := M 50.1
       oValid   := M 50.2
       oError   := MW 52

On OK, STEP 7 inserts the call and creates DB100. Right-click the FB call to inspect the Instance DB; the Data View tab shows the current count, edge flags, and limit values that can be monitored online.

9. Edge Detection, Debounce, and Input Filter Strategy

The edge flag pattern (iUp AND NOT sUpEdge) guarantees one count per transition. If the push-button has mechanical bounce, a 5-10 ms input filter on the digital input module is the right solution. For S7-300 SM 321 digital input modules set the filter with the Properties → Inputs dialog in HW Config (see Working with STEP 7 for the screen flow).

For applications that need software debounce in addition (e.g. a 50 ms reject window), wrap the input in an IEC timer or a TON with a 50 ms preset and use the timer's output as the FB input.

10. Limit Handling, Saturation, and Rollover Protection

Three saturation scenarios are relevant:

1. Standard step fits the range: (iHigh - sCount) >= iStep. The counter increments by the full step.
2. Remaining range is smaller than the step: the count is forced to iHigh. The next edge of iUp is ignored because the comparator is no longer satisfied.
3. DINT overflow: with iHigh = 2147483647 and iStep = 1 the addition can theoretically overflow. The pre-check (iHigh - sCount) >= iStep prevents the addition from being executed when sCount is already at the limit, so the overflow is avoided in practice.

For INT-only CPUs (e.g. 6ES7312-5AC00), substitute DINT with INT and add an INT#-32768/INT#32767 constant check. The CPU 31x manual describes the data type ranges and arithmetic flags in detail.

11. Error Word Mapping

The 16-bit oError word is bit-coded for quick diagnostic reads from the HMI:

Bit E15 is set by the CPU's group error bits if the FB is called with corrupt actual parameters. Treat it as a fatal event and clear the instance DB.

12. HMI Integration (WinCC flexible / TIA Portal)

For a WinCC flexible runtime that connects to the S7-300 over MPI/ PROFIBUS/ Ethernet, expose the following tags from DB100:

Set the acquisition cycle for the Count tag to 250 ms in WinCC flexible; faster rates increase bus load on MPI networks and rarely add value for a human-operated counter. Refer to the STEP 7 V5.5 Programming Manual for the exact DB address offset for your block version.

13. Verification Procedure

1. Compile the FB. The SCL compiler reports line numbers for any syntax error; STL reports *** Error in line NN ***.
2. Download the blocks (FB100, DB100, OB1) to the CPU or to S7 PLCSIM. Use PLC → Download or Ctrl+L.
3. Online monitor OB1 and DB100. In the LAD/FBD/STL editor press Ctrl+F3 (Monitor on/off). The sCount value should remain at 0 (or at iLow if pre-loaded) until the first edge.
4. Force inputs from a VAT table (PLC → Monitor/Modify → VAT). With iHigh=10, iLow=0, iStep=3, set iUp=TRUE. Confirm sCount reaches 3, 6, 9, and 10 (saturation).
5. Down test: set iDn=TRUE and watch the count decrement by 3 down to 0.
6. Edge test: hold iUp=TRUE for 5 s. The count must advance by exactly one step per cycle of OB1, not by five steps. If it advances continuously, the edge flag is missing.
7. Reset/preset test: pulse iReset; sCount must snap to iLow. Pulse iLoad with iPreset=7; sCount must snap to 7.
8. Error test: set iStep=0. oError.%X0 must be TRUE, oValid must be FALSE, and the count must not change.

14. Field Commissioning and Diagnostic Tips

• When the count drifts upward by one every scan, the most common cause is that the caller has wired a level input that is held TRUE, with the edge flag missing. Re-read the code and confirm that sUpEdge is updated at the end of the network.
• When the count never moves, check that OB1 is actually being executed (use the Module Information tool, Diagnostic Buffer). On a CPU in STOP, the FB does not run.
• If the FB is called from OB35 (cyclic interrupt) instead of OB1, the call frequency is independent of OB1 and the count is updated at the OB35 cycle rate. Set the OB35 cycle to 100 ms or longer for a human-driven counter; faster rates saturate the input filter and add no value.
• For multi-instance use, the FB must be declared with multi-instance capability. Open the FB properties and tick Multi-instance capable. This avoids the need for a separate instance DB per call and reduces the load on the CPU's work memory.
• Persist the count across power loss by adding sCount and the edge flags to a retentive area in HW Config → CPU Properties → Retentive Memory. The exact size depends on the CPU order number.

15. Comparison: Built-in SFB 2 vs. Custom FB

Use the custom FB whenever the step is anything other than 1, whenever the count must be visible on the HMI as a writable tag, or whenever the application has to handle 32-bit values. Use SFB 2 for a simple 16-bit preset/reset pattern that conforms strictly to the IEC 61131-3 CTUD definition.

16. Frequently Asked Questions