Siemens 6ES7 138-4DA04-0AB0 Counter Module LOAD_VAL and SW_GATE

1. Overview of the 6ES7 138-4DA04-0AB0 Counter Module

The Siemens 6ES7 138-4DA04-0AB0 (also written 6ES7138-4DA04-0AB0) is a 1Count 24V counter module in the ET 200S distributed I/O family. It occupies one slot in an ET 200S station and provides a single 24 V counting channel that can be wired to an incremental encoder, a proximity switch, or any 24 V pulse source. The module supports:

• Continuous counting up to the upper count limit (24-bit: 0 to 16,777,215)
• Single (one-shot) counting with gate control
• Periodic counting
• A load value (preset) function that preloads the counter with any user-defined start value
• Software gate (SW_GATE) and hardware gate (HW_GATE) inputs
• Upper and lower limit comparison with digital outputs

The exact functional order number shipped today is 6ES7138-4DA04-0AB0 (MLFB), hardware product version 04. The earlier -0AA0/-0AB0 versions are functionally compatible for the load-value and SW_GATE interface described in this article, but newer GSD files may be required in STEP 7 / TIA Portal. Always verify the FW state and the matching GSD file in the hardware catalog before commissioning.

The module is documented in the Siemens manual ET 200S 1Count 24V (6ES7138-4DA0x-0AB0) (Siemens entry ID 109751955 in the SIOS support database). Link the online manual in your project documentation: SIOS – ET 200S 1Count 24V Manual (109751955).

2. Module Identification and Hardware Specifications

Before any programming work, confirm the part number printed on the front label matches the catalog entry. Key technical data:

3. Hardware Configuration in STEP 7 / TIA Portal

1. Open the ET 200S station in HW Config (STEP 7 V5.x) or the Device View (TIA Portal).
2. Drag the 6ES7 138-4DA04-0AB0 module from the catalog into a free slot of the ET 200S head module (IM151 / IM151-1).
3. Double-click the module to open Properties – 1Count 24V.
4. Configure the operating mode: Count continuously, Count once, or Count periodically.
5. Set the count direction (none, up, down) and the upper / lower count limits.
6. Enable HW gate if you need a hardware interlock; otherwise leave it disabled and use SW_GATE.
7. Select whether the encoder supplies track A/B (quadrature) or a single pulse with direction.
8. Set the process image start addresses for the 16 input bytes and 16 output bytes. The addresses shown below assume Inputs starting at PIW 256 and Outputs starting at PQW 256 for clarity.

4. Process Image Layout (I/O Address Map)

The 6ES7 138-4DA04-0AB0 reserves 16 bytes in the input process image and 16 bytes in the output process image. The exact layout is shown in the manual section 5.x. The relevant subset for LOAD_VAL is:

Bit names above reflect the Siemens manual convention. STS_SW_G = SW_GATE active feedback; STS_HW_G = HW_GATE active feedback; STS_LOAD = load function currently running; LOAD_DONE = load completed since the last positive edge of LOAD_VAL. The exact names in TIA Portal may appear as STS_SW_Gate, STS_LOAD, LD_OK, etc., depending on the GSD version – always refer to the ET 200S 1Count 24V manual for the firmware you have installed.

5. Understanding LOAD_VAL (Output Byte 5, Bit 0)

LOAD_VAL is the control bit that tells the module “take the value currently sitting in output bytes 0–3 and copy it into the internal counter”. The handshake is rising-edge sensitive:

1. The CPU writes a 24-bit integer (0 to 16,777,215) into output bytes 0, 1, 2, and 3.
2. The CPU sets output byte 5, bit 0 (LOAD_VAL) to 1.
3. The module acknowledges the load by setting input byte 12, bit 0 (LOAD_DONE) to 1.
4. The CPU resets LOAD_VAL to 0.

LOAD_VAL is therefore a command, not a level. Holding LOAD_VAL high does not reload the counter on every cycle. Once the edge has been acknowledged, you must drop LOAD_VAL back to 0 before the next load command – this is the source of the recurring confusion in the original question.

6. Understanding SW_GATE (Output Byte 4, Bit 0)

SW_GATE is the software gate. It enables or disables the internal count gate, regardless of the hardware gate input:

• SW_GATE = 1 → counter increments or decrements (depending on configured direction)
• SW_GATE = 0 → counter is frozen at the current value

SW_GATE is level-sensitive, not edge-sensitive. It can be toggled any time. The feedback bit STS_SW_G (input byte 12, bit 7) mirrors whether the gate is logically open; if STS_SW_G = 0 while SW_GATE = 1, then the HW gate is closed and the counter is held.

7. Step-by-Step Programming in STEP 7 V5.x (LAD/FBD)

The following example loads the value 1000 into the counter and then releases the SW gate to start counting. Addresses assume PIW 256 / PQW 256 start.

Network 1 – Initialize load value and SW_GATE

      L     1000                      // desired start value
      T     DB1.DBD    0              // back up in a data block (optional)
      L     DB1.DBD    0
      T     PQW    256                // write to output bytes 0..3 (load value)
      SET
      S     PQA    256.4              // set SW_GATE (output byte 4, bit 0)

Network 2 – Trigger the LOAD_VAL edge

      U     "M_StartLoad"             // user request, e.g. from HMI
      S     PQA    256.5              // set LOAD_VAL (output byte 5, bit 0)

Network 3 – Reset LOAD_VAL on acknowledge

      U     PIW    256                // placeholder, see corrected address below
      R     PQA    256.5              // reset LOAD_VAL

Corrected acknowledge logic (use the correct input bit):

      U     "E_LoadDone"              // tied to PIW 268 bit (input byte 12, bit 0)
      R     PQA    256.5              // reset LOAD_VAL

The CPU reads input byte 12 of the module at PIW 268 (start 256 + offset 12). Bit 0 of that byte is the LOAD_DONE acknowledge.

8. Step-by-Step Programming in TIA Portal (SCL example)

When the 1Count module is plugged into a PROFINET-attached ET 200S head, TIA Portal exposes the I/O directly through process image tags. The cleanest implementation is an SCL block in OB1:

// Load-counter FB logic (cyclically called)
IF "i_cmdLoad" THEN
    "i_loadValue"   := 1000;                       // desired preset
    "qw_loadValue"  := INT_TO_DWORD("i_loadValue");
    "qx_swGate"     := TRUE;                       // open SW gate
    "qx_loadVal"    := TRUE;                       // raise LOAD_VAL
    IF "ix_loadDone" THEN                          // acknowledge received
        "qx_loadVal" := FALSE;                     // drop LOAD_VAL
        "i_cmdLoad"  := FALSE;                     // one-shot complete
    END_IF;
ELSE
    "qx_swGate" := TRUE;                           // keep gate open after load
END_IF;

The tag prefix qx_ is output process image (PQA area), ix_ is input process image (PIA area). Map these in the PLC tag table against the configured slot start address, e.g.:

Offsetting the input byte correctly is critical. PIW 256 covers input bytes 0–1; the LOAD_DONE feedback lives at input byte 12, so the bit reference is I 268.0 (12 = 0x0C, byte address = 256 + 12 = 268).

9. Using the Built-in Counting FB / FC from the Library

Siemens ships a ready-made FB for the ET 200S 1Count module inside the STEP 7 library “ET 200S 1Count 24V (FM-CNT) Block Library”. The block (commonly called FB 21 / FC 21 “CNT_CTL1” or, in newer versions, the “Count24V” FB) hides the manual I/O handshake behind a clean interface:

• SW_GATE – BOOL, write 1 to open the gate
• LOAD_VAL / LOAD – BOOL, raise for one cycle to execute the load
• LOAD_VALUE – DWORD, the desired preset
• STS_LOAD_DONE – BOOL, mirror of input byte 12 bit 0
• STS_SW_GATE – BOOL, mirror of input byte 12 bit 7
• CUR_COUNT – DWORD, current 24-bit counter value

Using the FB removes the need to manipulate raw PQA bytes, but it is helpful to know the underlying bits so you can debug when the FB refuses to load the value. Open the FB online in TIA Portal and look at the i_loadDone and i_swGate internal tags – these are wired straight to input byte 12.

10. Verification and Commissioning Checklist

1. Module reachable. From the CPU, perform “Online > Accessible nodes” in TIA Portal and confirm the ET 200S head is online and the 1Count slot has no diagnostic entries (orange “!” icon = parameter error, red “!” icon = module fault).
2. Process image consistent. In the watch table, force the configured output bytes. With SW_GATE forced to 0 and LOAD_VAL forced to 0, the current counter value should remain static.
3. SW_GATE opens. Force SW_GATE = 1. The STS_SW_G status (input byte 12, bit 7) should go high immediately. If it does not, the HW gate is closed (physical wiring problem at terminal 4 / HW_G input).
4. Counter increments. Apply a slow pulse to track A (terminal 8) and watch input bytes 0–3 climb. If the counter stays at 0, the encoder supply may be missing or the polarity is reversed.
5. LOAD_VAL handshake. Write 1000 into bytes 0–3, raise byte 5 bit 0, observe byte 12 bit 0 going high, then drop byte 5 bit 0. The current count value should jump to 1000 on the rising edge of LOAD_VAL.
6. Limit compare. Configure an upper limit (e.g. 5000). When the counter crosses 5000, digital output Q0 (terminal 9/10) should energize. If it does not, re-check the comparison mode in the module properties.

11. Troubleshooting Matrix

12. Edge Cases and Field-Proven Caveats

• Double-buffering in different CPUs. When the module is on PROFINET, the I/O update is asynchronous to OB1. Forcing LOAD_VAL inside a single scan without giving the module time to echo LOAD_DONE will make the load look as though it didn't happen. A small timer (≥ 1 OB1 cycle) or a polling loop on LOAD_DONE is required.
• Multiple loads in one scan. If you must load two different values back-to-back (e.g., retooling), drop LOAD_VAL for at least one OB1 scan between commands. The module ignores the second rising edge if LOAD_VAL was never cleared.
• PROFIBUS vs PROFINET timing. PROFIBUS-DP adds additional bus-cycle latency (typically 1–2 ms). The watch window for LOAD_DONE is therefore longer; the manual states up to 5 ms in the worst case. Increase the watchdog in the FB if your application is close to the limit.
• OB1 vs OB35. Do not execute the LOAD_VAL handshake inside OB35 only – if OB1 also writes the same output byte, the OB1 write will win on the process image. Put the handshake in a single OB, ideally OB1 or a dedicated cyclic OB.
• Diagnostic interrupts. The module can be configured to raise a diagnostic interrupt on parameter error or wire break. Enable this in HW config so the diagnostic OB (OB82) runs and the HMI lights up properly.
• CPU restart behavior. After a STOP → RUN transition, the load value bytes default to 0 and SW_GATE = 0. The counter will sit at 0 until SW_GATE is re-armed. If the process needs the preset to survive a restart, write it in OB100 (warm restart) before the first OB1 cycle.
• Substitute value behavior. On PROFINET, if the controller fails, you can configure a substitute value for SW_GATE and LOAD_VAL. Use substitute 0 unless the process specifically requires the gate to remain open in a fault condition.

13. FAQ