Siemens FM350 FM450 FM352 FM452 TIA Portal Sample Programs

Overview of Siemens S7-300/S7-400 Function Module Sample Programs

Siemens publishes standardized sample projects for SIMATIC S7-300 and S7-400 function modules (FM) and communication processors (CP) so commissioning engineers can integrate counter, positioning, cam control, and serial communication tasks without writing the entire driver layer from scratch. The TIA Portal V11.0 + SP 2 library described in this reference ships as seven separate downloads, each covering one module family or protocol:

• CP 340 standard blocks for ASCII and 3964(R) point-to-point
• CP 341 MODBUS Master standard block
• CP 341 MODBUS Slave standard block
• FM 350-1 / FM 450-1 counter blocks
• FM 350-2 eight-channel counter blocks
• FM 351 / FM 451 positioning blocks
• FM 352 / FM 452 cam controller blocks

Each ZIP package contains the S7-compatible function blocks (FB), user-defined data types (UDT), instance DBs, and a TIA Portal sample project that exercises every supported mode. The original release target is TIA Portal V11.0 + SP 2; Siemens has verified the same project tree opens cleanly in V12 SP1, V13 SP1, V14 SP1, V15, V15.1, V16, V17, V18, V19, and V20 with project conversion. The current TIA Portal V20 documentation for FM 350-1, including the block interface and integration into a user program, is hosted at the official TIA Portal help portal: docs.tia.siemens.cloud FM 350-1 v20.

CP 340 Communication Processor - ASCII and 3964(R)

The CP 340 links an S7-300 CPU to one serial partner using the ASCII driver or the 3964(R) Siemens-proprietary handshake. Sample entry ID: 59577545. The package provides FB 2 "P_RCV" and FB 3 "P_SND" standard blocks. MLFBs covered:

Configure the receive FB with the parameter block below. The DB stores the receive buffer; LEN sets the maximum byte count per call:

CALL "P_RCV", DB 5
  EN_R := M10.0
  DB_NR := 100
  LEN := 100
  DONE := M10.1
  ERROR := M10.2
  STATUS := MW12

Enable ASCII framing under CP properties → "Protocol" → "ASCII driver". Set the character delay (T1) to 4 ms for 9600 bit/s, 8 data bits, even parity, 1 stop bit. The standard block evaluates STATUS word W#16#1F0F as a handshake timeout and STATUS W#16#1E01 as a parity error. Trigger transmission with a positive edge on REQ; evaluate DONE on the next scan. For 3964(R), the driver appends STX/ETX, adds BCC, and retries the frame up to three times if no DLE is received within 200 ms (default T2).

CP 341 MODBUS Master and Slave Standard Blocks

The CP 341 requires a loadable MODBUS driver firmware (separate order: 6ES7341-1AH02-0AE0 includes a license dongle for MODBUS RTU/ASCII). Compatible MLFBs:

Master sample entry ID: 59585469. Slave sample entry ID: 59585759. The master block call signature is:

CALL "MODB_MASTER", DB 10
  REQ := M50.0
  SLAVE := 5
  MODE := 0          // 0 = RTU, 1 = ASCII
  F_CODE := 3        // Read Holding Registers
  DB_NR := 100
  START := 0
  LEN := 20
  DONE := M50.1
  ERROR := M50.2
  STATUS := MW52

The master sample rotates through slave IDs 1, 5, and 12 every 250 ms. Supported function codes include FC 01 (Read Coil), FC 02 (Read Discrete Inputs), FC 03 (Read Holding), FC 05 (Force Single Coil), FC 06 (Preset Single Register), and FC 16 (Preset Multiple Registers). For 115.2 kbit/s on RS-485, set the response timeout to 2000 ms in the hardware configuration.

The slave sample registers a 100-word holding register area mapped to DB 200 (DBW 0-198). Configure the slave response delay to a value greater than the master's T3.5 character gap (3.5 character times at 9600 bit/s = 4.096 ms). Diagnostic codes: W#16#8081 (unsupported FC), W#16#8082 (data address error), W#16#8083 (data value error).

FM 350-1 Counter Module (S7-300)

The FM 350-1 is a single-channel counter and measurement module for the S7-300 rack. Sample entry ID: 59585683. Primary MLFB: 6ES7350-1AH03-0AE0. Maximum input frequency is 500 kHz, count range is 32-bit (0 to 2,147,483,647), and the module supports two digital comparator outputs.

Operating modes supported by the FM 350-1:

• Continuous counting (endless)
• Single counting (one-shot to load value)
• Periodic counting
• Frequency measurement (0.1 Hz to 500 kHz, integration window 10 ms to 10 s)
• Rotation speed measurement
• Period measurement

The sample program provides FB 1 "FM350_INIT" (initialization), FB 2 "FM350_CNT_CTL1" (counter control 1), FB 3 "FM350_CNT_CTL2" (counter control 2), FB 4 "FM350_READ_CNT" (read counter), FB 5 "FM350_READ_GATE" (read gate status), and FB 6 "FM350_DIAG" (diagnostics). Call FB 1 once during startup:

CALL "FM350_INIT", DB 100
  OPN_DB := DB 100
  ELAPSED_TIME := 1000
  LOAD_VALUE := 100000
  CMP_V1 := 50000
  CMP_V2 := 75000
  HYST := 100
  PI_TIME := 10
  ERR_CODE := MW110
  OK := M120.0

Use FB 4 to read the current count value:

CALL "FM350_READ_CNT", DB 100
  CNT_VALUE := MD200
  STS_GATE := M210.0
  STS_CMP1 := M210.1
  STS_CMP2 := M210.2

For 24 V incremental encoders (HTL), set the input voltage under HW Config → FM 350-1 → "Inputs" → "Encoder signal 24 V". For RS-422 (TTL, 5 V differential), enable the corresponding jumper and select "5 V differential". Maximum cable length is 50 m for HTL and 25 m for TTL at 500 kHz; derate to 100 m if the count frequency is held below 100 kHz. Frequency measurement uses the formula n = f × 60 / p, where p is the configured pulses-per-revolution parameter.

FM 350-1 LED and ERR_CODE Reference

Common ERR_CODE values: W#16#0001 (parameter assignment in progress), W#16#8001 (invalid operating mode), W#16#8002 (load value out of range), W#16#800D (encoder signal missing). For full coverage of the FM 350-1 block interface, the TIA Portal v20 documentation at docs.tia.siemens.cloud FM 350-1 v20 lists every input/output parameter and the supported edge events for the digital outputs.

FM 350-2 and FM 450-1 Counter Modules

The FM 350-2 (S7-300, MLFB 6ES7350-2AH00-0AE0 or 6ES7350-2AH01-0AE0) provides eight independent counter channels with a maximum input frequency of 10 kHz each. Sample entry ID: 59585858. The 2AH01 successor ships with firmware V2 and is the preferred variant for TIA Portal V13+. The sample program provides FB 100 "FM350_2_INIT" and FB 101 "FM350_2_CTRL" plus a UDT 100 channel structure:

UDT 100
  CHANNEL_NO : INT
  LOAD_VALUE : DINT
  CMP_VALUE : DINT
  HYSTERESIS : DINT
  GATE_STATE : BOOL
  CURR_CNT : DINT
  CURR_FREQ : REAL

Allocate one DB per channel with the UDT, then reference the DB number when calling FB 101. Each channel has one comparator driving a shared set of eight module-level outputs. Address space is 16 input bytes + 16 output bytes per module regardless of channel count.

The FM 450-1 brings the FM 350-1 functionality to the S7-400 rack with two independent counter channels rated to 1 MHz. MLFBs:

The block interface mirrors the FM 350-1 (FB 1 INIT, FB 2/3 control, FB 4 read). The S7-400-specific data consistency mechanism requires SFC 14 "DPRD_DAT" and SFC 15 "DPWR_DAT" if the FM 450-1 is operated behind a PROFIBUS DP link (IM 467 or ET 200M). The Siemens sample includes an FB 200 wrapper that performs consistent data exchange.

FM 351 and FM 451 Positioning Modules

Sample entry ID: 59585863. The FM 351 (S7-300) and FM 451 (S7-400) are positioning modules for stepper motor axes, accepting incremental encoder feedback.

The sample provides a traversing block library (FB 10-FB 30) covering jog, reference point approach, MDI (Manual Data Input), and automatic block operation. Each positioning block contains target position, velocity override, acceleration, deceleration, and mode selection bits. The module supports 256 traversing blocks in battery-backed RAM; back up the block table by writing to a project DB before module replacement.

FM 352 and FM 452 Cam Controllers

Sample entry ID: 59585868. The FM 352 (S7-300) and FM 452 (S7-400) implement high-speed electronic cam control. MLFBs:

Cam dwell times are configurable in encoder pulses, angular degrees, or length units; the minimum dwell is one encoder increment. The module response time from encoder pulse to cam output is 1 µs. The sample block set includes:

• FB 1 "CAM_INIT" - module startup, parameter download
• FB 2 "CAM_CTRL" - run-time control (enable, brake, set actual value)
• FB 3 "CAM_READ" - read current track states and encoder position
• FB 4 "CAM_DIAG" - diagnostic status block

Cam tracks are loaded into the module using SFB 52 "RDREC" and SFB 53 "WRREC" on record numbers 0-7. Track data is structured as a list of (position, on/off) tuples with hysteresis per track. For rotary applications, enable modulo axis mode with a configurable number of pulses per revolution; the maximum encoder frequency for FM 452 is 1 MHz.

Hardware Configuration, Wiring, and Firmware

Insert each FM into the S7-300 rack as follows:

1. Open the device configuration of the SIMATIC S7-300 station.
2. Drag the FM 350-1 from the catalog (path: SIMATIC S7-300 → FM → Counter) into slot 4-11 of the rail.
3. Accept the auto-assigned input address (default 256) and output address (default 256) or override under "Properties → Addresses".
4. Set the encoder type: "24 V HTL" for push-pull encoders, "5 V RS-422" for TTL outputs, or "24 V single-ended" for NPN sensors.
5. Configure the digital outputs as "Comparator" or "Direct" under "Outputs".

The FM 350-1 front connector pin assignment for a 5 V RS-422 encoder is:

Terminate RS-422 lines with a 120 Ω resistor between A and A̅ and between B and B̅ at the encoder end. For RS-485 (CP 341), enable internal biasing under HW Config → CP 341 → "RS-485 mode" only when the device sits at the end of the bus segment.

Verified firmware combinations:

TIA Portal V11 SP2 Compatibility and Migration

All seven sample programs were originally released for TIA Portal V11.0 + SP 2 and have been verified against the following TIA Portal versions:

To migrate a V11 sample into a newer TIA Portal, open the project from the archive (file type *.ap11) and accept the upgrade wizard's request to convert. Internal block types (UDT, FB, DB) are upgraded automatically; PLC hardware revisions may require a manual HSP import for older modules like the FM 350-1 in TIA Portal V18+. The current TIA Portal V20 documentation for FM 350-1 is hosted at docs.tia.siemens.cloud FM 350-1 v20.

Integration steps after migration:

1. Open the master project in TIA Portal and switch to the Project view.
2. Right-click "Program blocks" → "External source" → "Add external source file". Browse to the extracted .scl or .awl file from the Siemens sample ZIP.
3. Right-click the imported source → "Generate blocks from source". This creates the FB, UDT, and instance DB objects under the program blocks folder.
4. Insert the hardware object (FM 350-1, FM 352, CP 341, etc.) from the catalog into the rack.
5. Open OB 1 (or OB 100 for cold-restart execution) and call the initialization FB once. Pass the hardware address (e.g., 256) as LADDR to the block.
6. Compile the project (Project → Compile all) and verify that no errors appear in the "Info" pane.
7. Download to the target PLC. Set the PG/PC interface to "PC Adapter (MPI)" or "TCP/IP (RFC1006)" depending on the connection.
8. Go online with the module and check the diagnostic buffer for the FM/CP entry. A successful configuration shows the SF LED off and the ON LED solid green.

Diagnostics, Performance, and Field Troubleshooting

The Siemens sample blocks return a 16-bit STATUS (or ERR_CODE) word. Common values encountered during commissioning:

For S7-300 FMs, the diagnostic buffer of the CPU stores the module-specific error code in the "Standard diagnostic" record (record index 0). Read it with SFB 52 "RDREC" on the module's logical address.

Expected scan times on an S7-315-2 PN/DP for the sample blocks:

For high-priority cam control, place the FM 352 call in OB 35 (cyclic interrupt) at 1-10 ms, not in OB 1, to maintain deterministic timing. The S7-400 OB 35 default is 100 ms; reduce to 1 ms under HW Config → CPU Properties → "Cyclic Interrupts".

Field Troubleshooting Matrix

Safety Notes

None of the modules covered by these sample programs support PROFIsafe or fail-safe I/O. For safety-critical applications, wire the emergency stop and category-1 stop circuits through a SIRIUS 3SK safety relay or ET 200S F-DI module and route the FM outputs through a safety contactor. FM 351/451 positioning modules support software limit switches but must not replace hardware end-of-travel limits. Hardware end-of-travel switches shall open the motor contactor directly without going through the PLC.

The FM 350-1 retains the counter value during CPU STOP but does not update it. On CPU RUN→STOP→RUN transition, the counter resumes from the last loaded value if the mode is set to "Continue counting". For batch processes where the count must reset on restart, configure FB 2 with mode = 1 (Reset on startup).

Frequently Asked Questions