S7-300 S_CU Counter: Why Q Turns On After First Pulse

S7-300 S_CU Counter: Why Q Turns On After First Pulse

The classic SIMATIC S7-300/S7-400 counter S_CU is one of the most commonly misunderstood blocks in STEP 7 Classic. Engineers writing their first up-counter expect output Q to follow the preset value (turn on at the 5th pulse, for example), but the documentation shows that Q is high whenever the count is greater than zero. This article documents the exact behavior of S_CU and its sibling CU, explains the root cause of the "Q-on-first-pulse" symptom seen in PLCSIM, and provides three field-proven remedies: a comparator ladder, the IEC SFB0 CTU, and a custom FC implementation.

1. Problem Overview

Symptom reported in the field: an S7-300 program with the S_CU block wired with PV = C#5 and I0.0 driving the CU input produces a high Q output after a single pulse, not after five. The same code in TIA Portal using an IEC CTU instance behaves correctly, which leads engineers to believe the legacy counter is broken. The counter is not broken; Q has a different definition than most engineers expect.

2. Pin-by-Pin Reference: S_CU (Up Counter)

The S_CU block occupies one counter word in the system memory area of the S7-300 CPU. Each S_CU instance reserves exactly 16 bits of system data; on the CPU 314 and larger these words are addressed as C0..C255. Refer to Siemens entry 44240604 - S7-300 Counter Instructions for the full address map.

The textbook definition reproduced verbatim from the STEP 7 help: "The signal state at output Q is '1' if the count is greater than zero and '0' if the count is equal to zero." This sentence is the entire root cause of the user's confusion.

3. The Simplified CU Counter

CU is the minimal up-counter also found in the standard library. It exposes only the rising-edge input CU and the Q and CV outputs. CU has no S, no PV, and no R pin; the preset is implied by the BCD word limit of 999.

Functionally CU and S_CU produce the same Q bit. If you do not need the preset or reset inputs, CU saves ladder space and avoids the temptation to think PV controls Q.

4. Root Cause of the "Q on First Pulse" Symptom

Beginners read the PV input as a "threshold" that, when reached, raises Q. In reality, PV is only used when S pulses, in which case it pre-loads the counter. Q never compares against PV; it compares against zero. Therefore any single pulse causes count to move from 0 to 1, and Q immediately goes high.

4.1 Signal trace in PLCSIM

The typical trace looks like this:

Time    | CU (I0.0) | Count | Q
--------+-----------+-------+-----
0.000 s |    0      |   0   | 0
0.050 s |    1      |   1   | 1   <-- first pulse, Q already high
0.100 s |    1      |   2   | 1
0.150 s |    1      |   3   | 1
0.200 s |    1      |   4   | 1
0.250 s |    1      |   5   | 1
0.300 s | R=1       |   0   | 0

The user expected Q to step from 0 to 1 between the fourth and fifth pulse. That expectation comes from the IEC CTU rule (Q = (CV >= PV)) which does not apply to S_CU.

4.2 Why the documentation says PV is a BCD word

The preset is encoded in BCD because the underlying counter cell of the S7-300 stores its value as a BCD word in the system memory area. Writing C#5 to PV loads the literal hex pattern W#16#0005, but the value still goes into a 0..999 BCD range. The S7-1200/1500 generation dropped this representation; counters became plain INT values up to 32767.

5. Solution A - Ladder Comparator on CV

The most idiomatic STEP 7 Classic fix is to ignore Q and generate your own status bit with a comparator. Wire the CV output to a GE_I (greater-than-or-equal, integer) compare block and compare against your target count.

Network 1: count
      +----+        +--------+
 I0.0-+ CU  S_CU Z1 +-CV----+- GE_I  +- MyCountDone
      |     +--------+     |
      |     |        PV   +-+- C#5
      |     +--------+
      |     | Q (unused) |
      +-----+ R          |
            +------------+

Symbolic equivalent in STL:

      A     I0.0
      CU    Z1                  // count up
      L     Z1                  // load CV
      L     5                   // load preset (integer, NOT C#)
      >=I                        // GE_I compare
      =     M10.0               // MyCountDone

Use >=I not ==I so that if CV ever skips past the preset (debounce glitch, fast input module) you still catch the event. Also, hold MyCountDone with a separate SR latch until you explicitly reset it, otherwise it falls the moment the count moves to 6.

6. Solution B - IEC SFB0 CTU (Preferred)

For new code on S7-300/S7-400, drop the legacy counter and call the IEC instance SFB0 (or its FB0 counterpart if you need multi-instance capability). The IEC block has the modern Q semantics and supports an INT range of 0..32767.

LAD call example:

      +-----+   +--------+   +-----+
 I0.0-| CU  |---| SFB0   |---| CV--|-- MW100
      | R   |   |  DB1   |   +-----+
 M5.0-|     |   |        |
      +-----+   |  PV=5  |
                +--------+
                |  Q     |-- M20.0 (preset-match bit)
                +--------+

Assign an instance DB (DB1 in the snippet) so that CV and the internal edge flag persist across scans. See Siemens entry 45523987 - SIMATIC S7-300/400 IEC Counter Functions for the formal description and the maximum instance DB count per CPU.

7. Solution C - Custom FC Counter

When the application needs a preset, an accumulated value, countdown-to-done, and a done bit all in one block, building a small FC is straightforward. The advantages are:

• No system counter word is consumed, leaving C0..C255 free for legacy S_CU/S_CD/S_CUD uses.
• The PV range becomes a full INT (-32768..32767) or even DINT if you need more.
• You control the polarity and the edge-vs-level reset behavior.

ST source for a minimal "Up Counter with Done" FC:

FUNCTION FC100 : VOID
VAR_INPUT
    CU      : BOOL;   // count input, edge-evaluated inside
    RESET   : BOOL;   // level-sensitive reset
    PRESET  : INT;    // target count
END_VAR
VAR_OUTPUT
    DONE    : BOOL;   // set when CV >= PRESET, sticky until RESET
    CV      : INT;    // current count
END_VAR
VAR
    CU_EDGE : BOOL;   // edge memory for rising-edge detection
END_VAR
BEGIN
    // Reset has priority
    IF RESET THEN
        CV := 0;
        DONE := FALSE;
        CU_EDGE := FALSE;
    ELSE
        // rising edge on CU
        IF CU AND NOT CU_EDGE THEN
            CV := CV + 1;
            IF CV >= PRESET THEN
                DONE := TRUE;
            END_IF;
        END_IF;
        CU_EDGE := CU;
    END_IF;
END_FUNCTION

Calling sequence in OB1:

  CALL FC100
       CU     := I0.0
       RESET  := I0.1
       PRESET := 5
       DONE   := M30.0       // "done after 5th pulse"
       CV     := MW40

If you need the counter value to survive a power cycle or CPU restart, swap the FC for an FB backed by an instance DB. The FB retains its static variables in the instance DB after STOP->RUN, while an FC's VAR area is reinitialized each cycle.

8. Common Pitfalls and Field Caveats

8.1 MW / MB Overlap

On the S7-300, MW0 is the bit-stitched word of MB0 and MB1, so MW0 shares bits with M0.0..M1.7. If any program segment uses M0.0..M1.7 as a one-shot (positive edge memory flag) and another segment uses MW0 as an integer counter, the two will corrupt each other. This is one of the most common reasons a counter shows a "random" initial value in PLCSIM. Use the diagnostic table to verify no overlapping writes exist.

Rule of thumb: dedicate whole word ranges to integer use and whole byte ranges to bit use; never mix.

8.2 PLCSIM Accumulator Persistence

PLCSIM does not fully clear the simulated accumulators (ACCU1, ACCU2) or the work memory between STOP and RUN, especially across reloads of the same project. After multiple "downloads" the same MW may show the leftover value from a prior simulation. To reset:

1. Select CPU > Clear/Reset in PLCSIM.
2. Power-cycle the simulated PLC (MRES not sufficient on PLCSIM).
3. Re-download the hardware configuration before testing.

8.3 Counter Overflow

S_CU overflows silently at 999 and wraps to 0. The classic mistake is to leave the counter running after the target event, causing Q to flap. If the count can exceed 999, use SFB0 CTU with an INT limit of 32767, or implement your own saturating counter in an FB.

8.4 Input Debounce

Mechanical contacts produce multiple edges per press. The S7-300's onboard digital inputs debounce in hardware (filter time set in HW Config, default 6.4 ms), but if the program counts both edges (e.g., a fast counter with no debounce flag), the count can race past the preset. Use a FP (positive edge) instruction before the CU input.

8.5 Re-Triggering PV with the S Input

Many first-time users wire S high continuously and expect the counter to reload every cycle. The S input is rising-edge; a permanently high S loads the preset exactly once. To load on demand, drive S with a one-shot from a comparator output or a pushbutton.

9. Verification Procedure

1. Download the project to the CPU or PLCSIM and place it in RUN.
2. Open the "Monitor/Modify" table and force CV, Q, and your done bit visible.
3. Toggle I0.0 once. Confirm CV = 1 and Q = 1 (this is correct for S_CU).
4. Toggle I0.0 four more times. CV should now equal 5.
5. Observe the comparator result or the IEC CTU Q; it must be 1.
6. Pulse R; CV must return to 0 and the done bit must clear.
7. Run for 1500 pulses and verify the counter saturates or wraps according to design.

10. Troubleshooting Matrix

11. Migrating to S7-1200/1500

The S7-1200 and S7-1500 generations removed the legacy S_CU, S_CD, and S_CUD blocks entirely. The replacement is the IEC counter system block CTU, placed from the "Instructions" task card under "Counter operations." TIA Portal auto-generates the instance DB. The semantics are exactly those of SFB0 on the S7-300, so any program ported across needs only the signal wiring updated. For context on global data block integration on the S7-1200, see the SiePortal S7-1200 basic questions thread referencing the SIMATIC S7 system manual page 193 for assigning counter values to a global DB.

12. Recommended Defaults

• New S7-300/S7-400 code: use SFB0 CTU with an instance DB; do not consume a system counter word.
• New S7-1200/S7-1500 code: use the system CTU block from the TIA Portal instruction palette.
• Legacy S_CU only when a pre-existing program already uses a system counter cell and you cannot touch the I/O mapping.
• Always latch the "done" bit with an SR flip-flop; never trust the IEC Q to remain high after the count advances past PV.
• Reserve separate MW ranges for integers and M-byte ranges for booleans to avoid MW/MB overlap.

FAQ