Searching a Value in an Array Using STL/AWL on STEP 7 V5.5

Problem Overview

This reference describes how to implement a deterministic value search inside a multi-region INT array using STL (Statement List / AWL) on STEP 7 V5.5 with an S7-300 CPU. The technique generalizes to any cross-record value lookup that an SCL FOR...EXIT...END_FOR resolves in one line, but is required when STL is mandated by code-style conventions or when a deterministic, cycle-budgeted memory scan is preferred over compiler-generated SCL.

The concrete scenario: a single data block (DB2) holds 20 models, each occupying a fixed 174-byte record. Within each record a 20-element INT array Line_Code[0..19] is repeated. The first model's array starts at DB2.DBW235; the next model starts at DBW235 + 174. When an operator enters a new line code from an HMI panel, the PLC must determine whether that code already exists anywhere in the 400 stored values (20 models x 20 codes) before the entry is accepted.

What STL Provides That SCL Hides

STEP 7 V5.5 includes an SCL compiler that can express the same scan in a few lines, but several production environments still restrict source code to AWL for traceability, version-control diffing, or cycle-time determinism. AWL exposes:

• Address register manipulation (LAR1, +AR1, TAR1)
• The LOOP instruction with implicit decrement of ACCU1-L
• ANY pointer construction for area-cross access (P#DBX, area/DB/length prefix)
• 3-LSB bit-offset arithmetic that the SCL compiler hides

For engineers familiar with web development, the conceptual parallel is the Array.prototype.find() method, which returns the first element that satisfies a predicate. The STL implementation below replicates that behaviour with explicit pointer arithmetic because the S7-300 instruction set has no built-in FIND primitive for DB-resident arrays.

Prerequisites

Confirm the following before opening the STL editor:

• STEP 7 V5.5 with Service Pack 2 or later. The base AWL editor is included with every STEP 7 install; SCL is optional and not required for this article.
• S7-300 CPU from the 312, 314, 315, 317, or 319 family. The instruction set used here (LOOP, +AR1, area-internal DBW[AR1,P#x.y]) is supported across the entire S7-300 range; no special technology CPU is needed.
• DB2 compiled and downloaded with the 20 model records. Open the DB in View > Data View to confirm the start offset of each Line_Code array.
• FB container rather than FC. The FB retains the Position, ModelIndex, and InnerIndex outputs in its instance DB so the HMI can poll them between scans.

Data Layout Analysis

The data block is a 20-record, fixed-stride structure. The byte offset for any model's Line_Code array is:

Offset(M) = 235 + M x 174   (where M = 0..19)

The byte offset increments in steps of 174 even though only the first 40 bytes of each record hold the array. The remaining 134 bytes are reserved for other fields (scaling factors, status flags, timestamps, recipes) that the search must skip without examining.

Total scan volume: 20 models x 20 INTs = 400 comparisons covering 800 bytes of INT data plus 20 x 134 = 2,680 bytes of skip space, for a record footprint of 3,480 bytes (174 x 20).

STL/AWL Indirect Addressing Fundamentals

The S7-300 CPU offers three addressing modes relevant to this task:

For this scan the area-internal form is sufficient because the same DB (DB2) is open throughout. The pointer format stored in AR1 is a 32-bit double word:

• Bits 0-2: bit offset within the addressed byte (always 0 for INT access)
• Bits 3 onwards: byte offset within the area
• Upper bits: area identifier (ignored by area-internal DBW[AR1,P#x.y])

A constant such as P#235.0 is encoded by the STL editor into this 32-bit layout. Loading it via LAR1 places byte offset 235 into AR1 with bit offset 0. Reference: Statement List (STL) for S7-300 and S7-400 Programming.

Pointer Increment for INT Step

Because each Line_Code element is an INT (16 bits, 2 bytes), the pointer must advance by 2 bytes between comparisons. The instruction +AR1 P#2.0 adds the bit-encoded constant P#2.0 to AR1. For the model-boundary jump (after the 20th element of each model) the increment is 134 bytes, encoded as P#134.0.

The LOOP Instruction

LOOP <label> decrements the low word of ACCU1 and jumps to <label> if the result is non-zero. The instruction is the canonical AWL loop construct because it sets the CC1/CC0 status bits based on the decremented value, leaves the RLO untouched, and executes in a single micro-operation on every S7-300 CPU.

Single-Array Search with LOOP and AR1

Before scaling to 20 models, build the single-array search. The following FB network scans DB2.DBW235..DBW274 for a match against SearchValue and reports the 0-based index in Position.

// FB101 - Single Array Search (Model 0 only)
// INPUT:  SearchValue (INT)
// OUTPUT: Found (BOOL)
//         Position (INT) - 0..19, -1 if not found

      L     0
      T     #Position              // Default clear

      AUF   DB 2                   // Open DB2 (or OPN DB [#SearchDB])

      L     P#235.0                // Pointer to first element
      LAR1

      L     20                     // Loop counter
      T     #LoopCounter

LOOP_BODY:
      L     DBW [AR1, P#0.0]      // Indirect load
      L     #SearchValue
      ==I
      JC    FOUND                  // Jump on equal

      +AR1 P#2.0                   // Advance to next INT

      L     #LoopCounter
      LOOP  LOOP_BODY              // Decrement and jump if > 0

// Not found - fall through
      CLR
      =     #Found
      L     -1
      T     #Position
      BE

FOUND:
      SET
      =     #Found
      L     #LoopCounter
      L     20
      -I                           // Position = 20 - LoopCounter
      T     #Position
      BE

The position decode exploits the property that LOOP decrements before testing the jump condition. If the counter was 20 on entry and the match occurs at index 0, no decrement has happened before the JC, so the counter still holds 20. After a match at index 1 the counter has decremented to 19, and so on. The arithmetic 20 - LoopCounter recovers the original 0-based index.

Multi-Model Scan: Nested Loop Structure

Scaling to 20 models adds an outer loop and a fixed-byte skip at each model boundary. The complete algorithm is:

1. Open DB2.
2. Initialize AR1 to P#235.0 (start of Model 0 array).
3. Initialize Position to 0 and OuterCount to 20.
4. Outer loop body: Initialize InnerCount to 20.
5. Inner loop body: Load DBW [AR1, P#0.0], compare to SearchValue, jump to FOUND on match. Otherwise add P#2.0 to AR1, increment Position, and LOOP.
6. After inner loop ends without a match, add P#134.0 to AR1 to skip the remaining 134 bytes of the model record.
7. Decrement OuterCount, loop if > 0.
8. Both loops fallen through: set Found = FALSE, Position = -1, ModelIndex = -1, InnerIndex = -1.

Why Position, ModelIndex, and InnerIndex

Returning three indices trades a few extra clock cycles for a clearer HMI display:

• Position (0..399): linear offset, useful for diagnostics or data export
• ModelIndex (0..19): the model whose array held the match
• InnerIndex (0..19): the array element inside that model

The decode uses the integer division instruction /I, which leaves the quotient in ACCU1 and the remainder in ACCU2:

      L     #Position              // ACCU1 = Position
      L     20                     // ACCU2 = 20
      /I                           // ACCU1 = Position / 20 = ModelIndex
                                   // ACCU2 = Position MOD 20 = InnerIndex
      T     #ModelIndex            // Save quotient
      TAK                          // Swap ACCU1 and ACCU2
      T     #InnerIndex            // Save remainder

Complete FB Code with Interface

The following FB returns Found, Position, ModelIndex, and InnerIndex as static outputs of the instance DB. Wire it to OB1 (or a cyclic interrupt OB such as OB35 on a 100 ms tick) and pass the HMI-entered value to SearchValue. The rising edge on Execute initiates the scan; the outputs remain stable in the instance DB until the next Execute pulse.

FB Interface Declaration

AWL Code (Network 1: Trigger and Reset)

NETWORK 1  // Trigger and reset outputs
      U     #Execute
      FP    #ExecuteTrg           // Edge memory, static
      SPBN  NO_TRIG

// New search requested - clear results
      CLR
      =     #Found
      L     -1
      T     #Position
      T     #ModelIndex
      T     #InnerIndex
      SET
      =     #Busy
      JU    SCAN

NO_TRIG:
      UN    #Busy
      BEB                          // Skip if not busy
SCAN: NOP  0

AWL Code (Network 2: Multi-Model Scan)

NETWORK 2  // Multi-model scan
      AUF   DB 2                   // Open DB2

      L     0
      T     #Position              // Linear position counter

      L     P#235.0                // Pointer to first element of Model 0
      LAR1

      L     20                     // Outer loop counter
      T     #OuterCount

OUTER: L     20                    // Inner loop counter
      T     #InnerCount

INNER: L     DBW [AR1, P#0.0]     // Load current INT
      L     #SearchValue
      ==I
      JC    FOUND

      +AR1 P#2.0                   // Advance to next INT
      L     #Position
      L     1
      +I
      T     #Position

      L     #InnerCount
      LOOP  INNER

// Skip remaining 134 bytes of this model's record
      L     P#134.0
      +AR1

      L     #OuterCount
      LOOP  OUTER

// Not found - cleanup
      CLR
      =     #Found
      =     #Busy
      L     -1
      T     #Position
      T     #ModelIndex
      T     #InnerIndex
      BE

AWL Code (Network 3: Match Decode)

NETWORK 3  // Match found - decode indices
FOUND: SET
      =     #Found
      CLR
      =     #Busy

      L     #Position
      L     20
      /I                           // Quotient (ModelIndex) in ACCU1
                                   // Remainder (InnerIndex) in ACCU2
      T     #ModelIndex
      TAK
      T     #InnerIndex

      BE

Verification and Commissioning Tests

Use the following four test cases to confirm the FB behaviour on the target CPU. Run them from the STL editor's Monitor/Modify view with the CPU in STOP for DB write operations, then in RUN for FB observation.

Add the test sequence to the CPU's commissioning function for repeatable regression after firmware updates. If any test fails, consult the Common Pitfalls section below before reloading the FB. Reference: STEP 7 V5.5 Basic Information.

Cycle-Time Budget

Per iteration the inner loop executes roughly eight AWL instructions (L DBW[AR1,P#0.0], L #SearchValue, ==I, JC taken-or-not, +AR1 P#2.0, two L/+/T for Position, and LOOP). On a CPU 315-2 DP at nominal clock that is approximately 18 microseconds per comparison. The 400-comparison scan therefore consumes about 7.5 ms worst-case (no match), and an early-exit on the first match takes under 25 microseconds.

If the OB1 cycle is 50 ms or shorter, schedule the scan in a lower-priority cyclic interrupt (e.g. OB35) to avoid jeopardizing I/O update timing. A CPU 312 with a 10 ms OB1 cycle should refactor the FB into a per-scan state machine as described in the FAQ below.

Common Pitfalls and Edge Cases

ANY Pointer Alternative (Optional)

When the search must span multiple DBs or include marker/timer/IO areas, build an ANY pointer that encodes the source type, length, DB number, area, and byte offset. The standard ANY layout (10 bytes) is:

Construction in AWL:

      L     B#16#05               // Type = INT
      T     LB 0
      L     20                    // Length = 20 INTs
      T     LW 2
      L     2                     // DB number
      T     LW 4
      L     B#16#84               // Area = DB
      T     LB 6
      L     DW#16#0               // Reserved
      T     LD 7
      L     P#235.0               // Byte offset
      T     LD 10

      LAR1  P##temp_any           // Pass ANY pointer to system FB

ANY pointers are the formal mechanism the STEP 7 editor uses internally when passing arrays to system FBs (e.g. FC21 FILL, FC20 BLKMOV, SFC20 BLKMOV). For the single-DB case above they are unnecessary, but they scale the technique to multi-DB data archives and to S7-400 CPUs that accept the area-cross form. Reference: Statement List (STL) for S7-300 and S7-400 Programming, chapter on ANY pointer handling.

Frequently Asked Questions