S7-400 FILL Instruction: Resetting Boolean Arrays with SFC21

Overview: Why FILL_BLK Is Missing on the S7-400

The Siemens SIMATIC S7-1500 (TIA Portal V14 and later) exposes the high-level FILL_BLK instruction for assigning a pattern across a contiguous range of memory. The SIMATIC S7-400 firmware and STEP 7 (Classic) instruction set do not ship FILL_BLK; instead, the equivalent function is provided by the system function block SFC21 "FILL". Migrating code that resets a BOOL array (typically embedded inside a UDT) from an S7-1500 to an S7-400, or running the same logic on both platforms, requires:

1. Replacing FILL_BLK with FILL (SFC21) in the S7-400 project.
2. Supplying a BOOL-typed source pattern as the BVAL input.
3. Formatting the destination BLK parameter as an ANY pointer that includes the exact byte length to clear.

This reference covers the exact ANY-pointer syntax accepted by SFC21, the workaround for clearing a UDT-embedded boolean array, the error codes returned in RET_VAL, and the runtime symptoms that arise when the destination ANY is malformed.

Instruction Availability Matrix

Because S7-400 only exposes SFC21, every reset of a multi-element BOOL array, byte array, or UDT structure must be implemented through the FILL system call, not the FILL_BLK box that exists in the S7-1500 instruction catalog. SFC21 is documented in the Siemens manual SIMATIC S7-300/400 System Software for S7-300/400 System and Standard Functions – Volume 1, chapter on basic SFCs.

SFC21 "FILL" — Interface Specification

According to the official SFC21 description, the destination ANY must be defined with a repetition factor and a data type that match the source pattern. For boolean operations the source is supplied as a single-byte ANY pointing to NULL (typed literally, equivalent to a single boolean value of 0). When the destination length exceeds the source size, the firmware repeats the source pattern byte-by-byte. This is the mechanism that lets a one-bit source clear an arbitrarily long boolean range.

ANY Pointer Syntax Accepted by SFC21

Step-by-Step: Resetting a UDT-Embedded Boolean Array on the S7-400

The following procedure documents the canonical implementation of an S7-1500 FILL_BLK routine on an S7-400 CPU using STL and SFC21. The example assumes a DB named DataDB that contains a single UDT instance interfaceTest, which in turn contains an ARRAY[1..16] OF BOOL.

Prerequisites

• STEP 7 V5.5 SPx (or TIA Portal V14 with the S7-400 add-on selected and the project upgraded to a TIA Portal-compatible offline DB).
• Function block (FB) or function (FC) compiled with STL as the active editor language.
• Target DB already compiled and downloaded; the boolean array must be a member of a UDT or declared inline.
• Symbolic I/O enabled in the project (so the ANY can be written symbolically).
• The destination DB must not be opened with write protection at the CPU level (DB attribute "Write-protected" in the DB properties).

Step 1 — Declare a Temporary Source Pattern

SFC21 expects a typed ANY pointer as the source. For boolean clears the simplest valid source is the literal NULL keyword, which the compiler expands to a single-byte ANY pointing to a BOOL 0. If the editor rejects NULL in the parameter position (some older TIA Portal versions do), declare an explicit BOOL temp and assign it before the call.

FUNCTION FC 100 : VOID
VAR_TEMP
    retVal : INT;
    bClear : BOOL;
END_VAR
BEGIN
    // 1. Single-bit pattern = FALSE
    bClear := FALSE;

    // 2. Call SFC21 with BVAL pointing to the temp BOOL
    FILL(BVAL  := bClear,
         BLK   := "DataDB".interfaceTest,
         RET_VAL := retVal);
END_FUNCTION

Step 2 — Format the Destination BLK

The destination must be an ANY. Three valid forms are accepted:

1. Symbolic, full UDT — "MyDB".interfaceTest where interfaceTest is a UDT_Test instance containing the boolean array. Compiler inserts the correct repetition factor from the UDT size.
2. Symbolic, sub-structure — "MyDB".alarms.general when only a slice of a DB must be reset. Useful when only the alarm-bit section of a larger DB needs to be re-initialised.
3. Absolute — P#DB1.DBX0.0 BOOL 10 for a ten-element boolean array anchored at DB1 byte 0. Used when the source project lacks symbolic names.

Step 3 — Compile and Download

After the STL source is saved, the symbolic reference to the UDT member must remain stable across blocks; renaming interfaceTest forces the compiler to re-validate the ANY length. If the destination DB has changed structure, recompile and download the DB before re-downloading the FC/FB.

Step 4 — Test in Runtime

Monitor retVal in the VAT or in the STL watch table. A non-zero value indicates one of the errors listed in the SFC21 RET_VAL table below.

Working STL Snippets

Snippet A — Clear an Entire UDT Instance

// STL inside an FC / FB
      L     0                          // BOOL pattern = 0
      T     #bClear

      CALL  FILL
        BVAL    := #bClear            // ANY -> single BOOL = 0
        RET_VAL := #retVal            // INT  -> error code
        BLK     := "DataDB".interfaceTest
      NOP   0

Snippet B — Clear a Slice of a DB

      CALL  FILL
        BVAL    := NULL               // keyword NULL expands to ANY*BOOL=0
        RET_VAL := #retVal
        BLK     := "AlarmDB".alarms.general
      NOP   0

Snippet C — Clear a Flag-Byte Range

      CALL  FILL
        BVAL    := NULL
        RET_VAL := #retVal
        BLK     := P#M100.0 BYTE 10
      NOP   0

Snippet D — Manual Loop Alternative (Dynamic Length)

If the destination length is computed at runtime, a loop is preferred over SFC21 because the ANY length is statically bound by the editor:

      L     0
      T     #i                         // loop counter reset

LOOP: L     #i
      L     16                         // 16 boolean elements
      >=I
      JC    DONE

      L     0
      T     "DataDB".flags[#i]         // boolean array indexed by loop var

      L     #i
      +     1
      T     #i
      JU    LOOP

DONE: NOP   0

Snippet E — Time-of-Day Reset of an Alarm Word

// At midnight, clear the entire alarm UDT
      A     "Clock".midnightPulse     // one-cycle pulse from OB1 cyclic flag
      JCN   END

      CALL  FILL
        BVAL    := NULL
        RET_VAL := #retVal
        BLK     := "AlarmDB".alarms   // entire UDT, all 32 bits cleared
END:  NOP   0

Error Code Reference (SFC21 RET_VAL)

Troubleshooting Matrix

UDT Sizing and the Symbolic BLK Trick

When the destination is a UDT member, SFC21 inherits the size from the UDT definition. This means a single FILL call clears every bit inside the UDT, not just the boolean array. If you only need to clear a slice, declare a sub-structure inside the UDT:

TYPE UDT_Alarm
  STRUCT
    enable   : BOOL;         // bit 0.0
    active   : BOOL;         // bit 0.1
    flags    : ARRAY[1..16] OF BOOL;  // bits 0.2 .. 1.1 (2 bytes)
    spare1   : BYTE;         // byte 2
    counter  : INT;          // bytes 3..4
  END_STRUCT;
END_TYPE

If only the boolean array must be cleared, address "AlarmDB".alarm.flags symbolically; the resulting ANY automatically reflects 16 bits. If the entire alarm must be reset, address "AlarmDB".alarm; the resulting ANY reflects 6 bytes (clearing the counter as a side effect). For partial-byte clears of an unaligned array length (e.g., 7 elements), inspect the remaining bits after the call — they will be zero because SFC21 operates on whole bytes.

Step-by-Step Verification

1. Open the project online and add the FC/FB containing the FILL call to a watch table (VAT).
2. Set a breakpoint immediately after the call and force the FC's retVal tag to 0.
3. In the DB, force the boolean array elements to TRUE before the call.
4. Trigger a single scan via the test function "Single Step" (OB1) or by toggling an enable tag.
5. Confirm the boolean array reads back as all zeros and retVal is unchanged.
6. Repeat with the destination set to P#DB1.DBX0.0 BOOL 32 and confirm that RET_VAL = 0 in the VAT.

Migration Checklist: S7-1500 FILL_BLK → S7-400 SFC21

• [ ] Identify every FILL_BLK usage in the S7-1500 source.
• [ ] Replace each occurrence with a call to SFC21 FILL.
• [ ] Convert any BOOL literal pattern to either NULL or a declared BOOL temp.
• [ ] Verify the destination ANY carries the correct repetition factor when written in absolute form.
• [ ] Validate the destination DB is writable (no read-only attribute).
• [ ] Confirm the destination range lies inside the DB; an off-by-one ANY pointer is the most common cause of 8092 after download.
• [ ] Disable optimised block access on the calling FB until the routine is validated; re-enable after commissioning.
• [ ] Download the modified FC/FB and the destination DB in the same PG session.
• [ ] Run the program in single-step mode and inspect retVal after every call.
• [ ] Document the call site in the program comment so future maintenance engineers recognise the SFC21 dependency.

Performance Considerations

SFC21 executes on the priority class of the calling OB. The execution time on a CPU 416-3 (firmware V6.0) is approximately 1.5 µs per byte for the BLK range when BVAL is a 1-byte source. A 256-bit boolean clear therefore completes in roughly 32 µs, well within a typical OB1 cycle budget. For ranges larger than 1 KB, consider executing the call from OB35 (cyclic interrupt) at a slower tick rate to avoid starving OB1 of processing time. The CPU 412-2 is roughly 30 % slower than the CPU 416-3; the CPU 417-4 is roughly 40 % faster. Memory-protection boundaries are enforced automatically — SFC21 will not write across block boundaries.

Interaction with Optimised Block Access (S7-1500 only)

When a ported SFC21 call runs on an S7-1500 with optimised block access enabled, the BVAL temp must be declared with the {S7_HMI_Accessible = 'True'} attribute or it may be stripped from the instance DB. On the S7-400 this attribute is ignored; classic STEP 7 always retains every declared temp.

Symbolic vs Absolute ANY Trade-offs

Related System Functions

FAQ