Siemens S5 to S7 Migration: Replacing BS 60 and OB 160 Calls

1. Overview: The S5 to S7 Migration Problem

When you convert a Siemens SIMATIC S5 program that uses BS 60 references and OB 160 calls, the STEP 7 / TIA Portal converter either flags the statement as a syntax error or generates a SF (System Fault) on the S7 CPU at the first execution. The reason is architectural: BS (system status) registers and the variable time-loop OB 160 are S5-115U hardware features that have no direct equivalent in the S7-300 / S7-400 / S7-1500 register set. A successful migration requires understanding what the original S5 instructions did at the silicon level so the behavior can be re-implemented with S7-300 instructions.

The example below shows a typical migration task. The source is a SIMATIC S5-115U STL program that performs a counted block transfer with a per-iteration delay. The destination is a STEP 7 V5.x or TIA Portal STL program for an S7-300 CPU (for example, CPU 315-2 PN/DP, order number 6ES7315-2EH14-0AB0 or later).

2. BS Registers in S5-115U: Why They Don't Exist in S7

BS in S5-115U nomenclature refers to the system status byte area of the operating system. BS 60 is the 61st byte (zero-indexed) of the internal system data area. It is not a freely usable marker; its meaning depends on the operating mode of the CPU and on the bus peripherals configured. In an S5-115U CPU that has a SINEC L1 slave interface configured, BS 60 carries the address of the CBS (Coordination Byte Send) used by the L1 protocol handler. Other BS bytes serve the scan-time accumulator, the interrupt stack, and the process-image update flags.

The S7-300 / S7-400 / S7-1500 architectures eliminated the BS area in favor of:

• The local stack (L stack) for block-private temporaries.
• The process image of inputs (PII) and outputs (PIQ) for I/O consistency.
• System status lists (SSL) queried with SFC 51 RDSYSST (S7-300/400) or with RD_SINFO / RDREC on S7-1500.
• Direct I/O access (I/O area with :P qualifier) for time-critical access outside the process image.

There is no BS area in S7 and there is no global mapping. If your S5 source touches BS 60, locate the original intent in the S5-115U manual and re-implement it with a system function or a hardware-aware user program. The Siemens Industry Online Support portal hosts the legacy S5-115U manual (entry search by order number 6ES5 998-xABxx) and is the authoritative source for the BS mapping.

3. OB 160: Variable Time Loop on the S5-115U

OB 160 on the S5-115U (CPU 941, 942, 943, 944 family) is a Variable Time Loop provided by the operating system to generate a CPU-independent wait time. From the S5-115U instruction list:

OB 160 simulates operation execution times. This makes you independent of the different operation execution times of the various CPUs and you can program wait times uniformly for all CPUs of the S5-115U range. The waiting time must be loaded into ACCU 1 in microseconds. Range: 120 to 65535 (78H to FFFFH).

Example from the S5-115U manual:

L  KF +1000    // Load 1000 us (1 ms) into ACCU 1
JU  OB 160      // Wait 1 ms, then return

The S7-300 family does not provide an OB 160. Time-based waits in S7 are produced with:

For the per-iteration delay in a counted block-move loop, the S5 OB 160 inside the loop is almost always a workaround for the S5-115U scan-time variation between the 941 / 942 / 943 / 944. On S7-300 the cleanest replacement is SFC 47 "WAIT" with a microsecond-equivalent wait parameter. If the original 1 ms wait is non-critical, you can usually drop it entirely because the S7-300 OB 1 cycle is bounded and the modern scan-time jitter is far smaller than on the S5-115U range.

4. Decoding the Original S5 STL Source

The two S5 networks in the source perform a counted data-block-to-data-block word copy. The parameter interface is implicitly defined by the function block header (not shown) and exposes:

• #_DB - target data block number (AUF #_DB opens the DB).
• #DW - first target data word (offset in 16-bit words, written to MW 220).
• #ANZ - number of words to copy (loop counter, written to MW 220 as a seed and incremented each pass).
• #WERT - per-iteration value placed into MW 222 (the loop body writes #WERT indirectly through AR1).

The loop body in Network 2 saves ACCU 1, ACCU 2, and the status word around an indirect store, increments the pointer, and continues until the counter rolls over. The body also calls OB 160 (the line flagged // CALL OB 160; Need to be replace), which is the only statement in the loop that has no S7 equivalent. The SPB M001 branch uses RLO set by the preceding INC 1 to loop while the counter is still non-zero.

Once you understand that intent, the BS 60 reference disappears from the conversation: BS 60 is not touched directly by this snippet, but the S5-115U system code may be using BS 60 internally for the L1 CBS pointer, which is why the snippet is referenced in a migration context. The S7-300 port should not contain any BS reference and should re-implement only the documented user intent of the loop.

5. S5-to-S7 STL Opcode Translation Table

The snippet uses only S5-115U STL operations. The following table maps each to STEP 7 V5.x / TIA Portal STL on the S7-300. The mnemonics shown are German (default for S5); STEP 7 also supports English, but the converter preserves the German form, so it is useful to read both.

6. Building the S7-300 Replacement Architecture

Two practical replacement strategies are available. Choose based on the S5 block type you are converting.

6.1 Strategy A: Re-implement as a System Function (FC) wrapper

Best for PB (program blocks) and SB (step blocks) that contain a self-contained copy routine. Encapsulate the loop in an S7-300 FC with the same parameter interface as the original S5 PB. Use marker words (MW 200..MW 254) for the loop counter and the pointer seed, or pass them as IN/OUT parameters and let the caller allocate them in an instance DB.

6.2 Strategy B: Lift the snippet into an FB with multi-instance capability

Best when the loop body is one of several copy operations in a larger S5 FB. The S5 parameters #conv_akku1, #conv_akku2, #conv_stw are already FB STAT/TEMP variables; re-create them as TEMP in the S7 FB and assign them via a STAT block of the multi-instance DB. The S7 FB multi-instance model is the cleanest target for re-entrancy: every OB that calls the FB gets its own static state.

For both strategies, define a clean interface:

Marker words MW 220, MW 222, MB 221 used in the S5 source must be replaced with TEMP variables in the S7 FB, not with the global bit memory (M) area, to keep the routine re-entrant and IEC 61131-3 compliant. Re-entrancy is essential: the S5-115U has no multi-instance concept, but the S7-300 OB priority model (OB 1, OB 35, OB 40, ...) can call the same FB concurrently, and global M will be clobbered if you do not re-bind.

7. Network 1 Replacement in STEP 7 STL

The S5 Network 1 sets up the pointer seed (MW 220) and the value (MW 222) before entering the loop. The S7-300 equivalent:

//  S7-300 STL, Network 1 - setup
//  Replaces S5 Reseau 1: AUF #_DB; L #DW; T MW 220; L #ANZ; T MW 222
      OPN   DB [#i_DB]                 //  Open target data block
      L     #i_DW                      //  Load first DW offset
      T     #t_ptr_seed                //  Save as loop pointer seed (TEMP WORD)
      L     #i_ANZ                     //  Load count
      T     #t_counter                 //  Save as loop counter (TEMP INT)
      L     #i_WERT                    //  Load per-iteration value
      T     #t_value                   //  Save for the loop body

Notes:

• OPN DB [#i_DB] accepts a 16-bit operand on S7-300 (CPU 31x) as of firmware V2.0. For older CPU 312 / CPU 313 with firmware V1.x, the DB number must be loaded into ACCU 1 first and the indirect form OPN DB [AR1,P#0.0] used after LAR1.
• All markers MW 220 / MW 222 are now TEMP variables #t_ptr_seed / #t_value. The instance DB carries them per call.
• If the FB is configured with optimized block access (the default in TIA Portal from V13 onward), indirect access to instance data via AR1 must use the AR2-based standard access path; either disable optimized access for this FB, or pass the data via a global DB that you control with a fixed layout.

8. Network 2 Loop Replacement in STEP 7 STL

The S5 loop body saves ACCU 1, ACCU 2, and the status word, computes the byte offset, performs the indirect store, increments the pointer, and loops. In S7-300, two implementation choices are common. The literal translation follows:

//  S7-300 STL, Network 2 - loop body
//  Replaces S5 Reseau 2: ... SPB M001 ; with OB 160 removed
M002: NOP   0

      L     #t_value                  //  Load per-iteration value
      T     #t_akku1                  //  Save ACCU 1 (was #conv_akku1)

      TAK                             //  Swap ACCU 1 / ACCU 2
      T     #t_akku2                  //  Save ACCU 2 (was #conv_akku2)

      L     STW                       //  Load status word
      T     #t_stw                    //  Save status word

//  Build byte pointer: word offset to byte address
      L     #t_ptr_seed               //  Pointer seed (16-bit word offset)
      SLW   3                         //  Convert word offset to byte offset
      LAR1                            //  AR1 := byte pointer

      L     #t_stw
      T     STW                       //  Restore status word
      L     #t_akku2
      L     #t_akku1
      T     DBW [AR1, P#0.0]          //  Indirect write into target DB

//  Increment pointer seed (16-bit word units)
      L     #t_ptr_seed
      +     1
      T     #t_ptr_seed

//  Increment and test loop counter
      L     #t_counter
      +     1
      T     #t_counter

      L     #t_counter
      L     #i_ANZ
      <I                               //  S7-300: ACCU 2 < ACCU 1 ?
      JC    M002

Three important corrections versus a literal S5-to-S7 line-for-line translation:

1. The S5 snippet shifts the byte pointer left by 4 (SLW 4) and uses LAR1. In S5-115U bit-memory addressing, that effectively converts a 16-bit "data word index" to a byte address. In S7-300 the canonical conversion is SLW 3 (left-shift by 3 multiplies the word index by 8 bytes per word). The extra SLW 1 in the S5 source corresponds to the 115U's byte-into-word packing; S7 stores data block words in pure byte addressing, so the shift count changes.
2. The S5 SPB M001 uses RLO from the INC 1 operation: INC sets RLO when the result is non-zero, so the loop continues while the counter is non-zero. The S7 replacement tests the counter directly with <I / JC because STEP 7's + instruction does not set RLO. The S7 idiom is the most common and the easiest to read at the maintenance stage.
3. If a per-iteration wait is functionally required (per Section 3), insert CALL SFC 47 with a wait time in microseconds immediately before the JC M002 branch:

      L     #i_WaitMs                //  e.g., 1 (1 ms)
      ITD
      SLD   3
      CALL  SFC 47                    //  WAIT
      IN:   WT
      L     #t_counter
      L     #i_ANZ
      <I
      JC    M002

SFC 47 documentation: SFC 47 "WAIT" pauses the user program for the number of microseconds passed in WT (range 1 us to 32767 us on S7-300, 100 ns to 1 s on S7-1500). A 1 ms wait is more than the S7-300 SFC 47 minimum, so pass WT := 1000 (microseconds). The CPU remains in RUN, OB 1 cycle time grows by exactly the wait amount, and the time-interrupt OBs (OB 30..OB 38) are not serviced during the wait. If the loop must remain interruptible, replace SFC 47 with an OB 35 cycle-tick counter or an IEC timer.

9. The CBS Coordination Byte on SINEC L1

If the original S5-115U was used as a SINEC L1 slave, BS 60 carried the address of the CBS (Coordination Byte Send) used by the L1 protocol handler. The S5-115U manual (CPU 941 to 944 family) documents this in chapter 12.2.3. On S7-300, the SINEC L1 interface is no longer present. The migration path depends on what the higher-level system expects:

If you are uncertain whether the L1 interface is active, the S5-115U manual chapter 12.2.3 lists the system data area assignments. On S7-300, no byte behaves like BS 60. The closest S7-300 analogy is the SSL (system status list) partial list 0x0019 / 0x0119, which returns Communication status information. Query with SFC 51 RDSYSST if the original program used BS 60 for diagnostics. The S7-300 SFCs are documented in the Siemens Industry Online Support portal under entry "Standard and System Functions for S7-300/400."

10. CPU 941-944 Reference Matrix and Chapter 12.2.3

The S5-115U CPU family covered by the S5-115U manual (chapter 12.2.3) is summarized below. Use this table to confirm which CPU your original program targeted before you port the BS 60 logic.

The reference for chapter 12.2.3 is the S5-115U Programmable Controller, CPU 941/942/943/944 System Manual. Confirm the exact chapter numbering against the manual edition bundled with the S5 package you are migrating from; Siemens released several editions (6ES5998-xAB01, -xAB11, and later printings). Use the Siemens Industry Online Support entry search with the order number 6ES5 998-xABxx to retrieve the matching PDF.

11. Commissioning, Verification, and Troubleshooting

11.1 Offline static checks

• Open the converted FB/FC in STEP 7 and confirm no S5 mnemonics (AUF, JU PB, SPB, SLD in their S5 sense) survive. The cross-reference view (Ctrl+Shift+F3 on the classic STEP 7 editor) on the S7 project should show zero hits in the converted block for any of the S5-only mnemonics.
• Confirm all markers used in the S5 source have been re-bound to TEMP or to a clearly documented DB.
• Confirm any OB 160 calls have been replaced with SFC 47 "WAIT," IEC timers, or removed entirely. Use the project-wide Find in Project dialog with the search strings OB 160 and OB160 (no space) to catch both forms.
• Run PLC > Check Block Consistency across the S7 program. Resolve every warning before downloading.

11.2 Online commissioning on the S7-300 CPU

1. Download the converted blocks to the CPU in STOP mode.
2. Switch to RUN-P. Open the diagnostic buffer (PLC > Module Information > Diagnostic Buffer) and confirm no SF entries.
3. Trigger the calling OB 1 segment manually with the Monitor/Modify tool. Verify the target DB is populated correctly by reading back DBW offsets through the Monitor view.
4. Use the S7-300 cycle-time viewer (SFC 78 READ_RTM + SFC 79 SET_RTM, or the PLC > Module Information > Scan Cycle Time tab) to confirm the loop body does not exceed the configured OB 1 max cycle time (default 150 ms on S7-300, 6 s on S7-1500). If it does, extend OB1_PRG_TIME via HW Config or shorten the loop with a different copy strategy (for example, SFC 20 BLKMOV for bulk copy).
5. On the first full run, set a breakpoint on the loop label M002 and single-cycle to confirm the pointer arithmetic is correct for the first three iterations.

11.3 Troubleshooting matrix

12. Frequently Asked Questions