Siemens S7-1200 Binary Output Control with TIA Portal MOVE

Overview

Driving eight digital outputs from a single decimal value entered on an HMI is a recurring requirement when a Siemens S7-1200 has to command an external motion controller, profile selector, or fixture indexer. The application pattern covered in this article uses an S7-1212C CPU feeding an SM 1223 digital signal module, with the HMI value placed into a tag and then copied through a MOVE (a.k.a. Move in earlier TIA Portal versions) box to the process image of the output byte. The technique is generic to any S7-1200/1500 controller but is documented here specifically against the 1212C AC/DC/Relay variant, firmware V2.2, and the TIA Portal V11/V12/V13 engineering stack.

The same pattern is also used when the S7-1200 is acting as a digital "profile selector" for a downstream motion controller such as a Delta RMC100/RMC75 or a LinMot E-series driver. The byte value 0 to 255 selects the active profile stored inside the motion controller; pressing a hardware "launch" button then triggers the curve referenced by that number.

Prerequisites

Before configuring the binary output function, verify the following items are available and matched to the firmware level:

• CPU: SIMATIC S7-1212C AC/DC/Relay (order number 6ES7212-1BE40-0XB0 or equivalent in the original 1212C family). The relay variant exposes 8 DI / 6 DO / 2 AI on board.
• Signal module: SM 1223 (6ES7223-1BH32-0XB0) - 8 DI / 8 DO 24 V DC. This module is required to obtain a full second byte of digital outputs because the 1212C CPU itself only ships with six 24 V DC outputs.
• Firmware: CPU firmware V2.2 or higher (V4.x is recommended for current STEP 7 Basic releases). Older V1.x firmware does not support some of the HMI bit-pattern display options referenced below.
• Engineering software: TIA Portal V11 SP2 Update 5 minimum; V12 or V13 recommended. WinCC Basic is bundled with STEP 7 Basic and is sufficient for an 8-bit binary I/O field on a Basic Panel (KTP400/KTP700).
• HMI: Any SIMATIC Basic Panel, Comfort Panel, or third-party panel with 8-bit binary display support. A KTP700 Basic has been validated for the procedure shown here.
• Documentation set: "S7-1200 Programmable Controller - System Manual" and "S7-1200 Getting Started" PDF from Siemens support entry 39644875.
• Online help: The TIA Portal information system covers the MOVE box under "Basic instructions > Move operations".

S7-1200 Hardware Architecture and I/O Addressing

The S7-1200 modular system has a strict physical layout that determines the I/O addresses before any software is written:

• The CPU occupies slot 1 of the rack.
• Communication modules (CM/CP) are plugged into the left side of the CPU, in slots 101 to 103 (up to three, depending on CPU type).
• Signal modules (SM) are plugged into the right side of the CPU, in slots 201 to 208 (eight maximum). The CPU 1212C accepts a maximum of three SMs, the 1214C accepts seven, and the 1215C accepts eight.
• Signal boards (SB) or communication boards (CB) install inside the top-front "butter-warmer drawer" of the CPU. Only one SB or CB is permitted.

Addressing follows the convention %QB<byte address> (output byte) and %IB<byte address> (input byte). Default byte assignments for a 1212C + one SM 1223 are:

To confirm addresses in your project, double-click the PLC in the project tree, choose Device view, and inspect the I/O addresses column. TIA Portal auto-assigns the byte numbers based on slot order, but they can be manually overridden from the same properties dialog. The example byte %QB8 used later in this article assumes the SM 1223 sits in slot 201.

Configuring the PLC Output Byte in TIA Portal

Two configuration steps must be completed before the MOVE box can be used: define the PLC tags that the HMI will reference, and confirm that %QB8 is not consumed by any other logic.

1. Open the project and expand PLC_1 > PLC tags > Default tag table.
2. Create a tag named TAG_1 of data type Byte. This is the value entered on the HMI.
3. Create a tag named TAG_2 of data type Byte. This tag will be written to %QB8 from the program.
4. Optionally create Cmd_Stop (Bool) and Cmd_Run (Bool) for hardware start/stop pushbuttons.

Verify that no other network already drives the %QB8 bit pattern. If a different FC uses MOVE-to-QB8 for a stop profile, isolate the two paths with an "OR" or write the stop value through a separate variable that is then MOVE'd into %QB8 on demand.

Programming the MOVE Instruction

The MOVE box (or "Move" in the older German-localised build) is located in the instruction tree under Basic instructions > Move operations. The block can be inserted in LAD (ladder), FBD (function block diagram), or SCL/ST (Structured Text). The examples below show LAD and SCL variants.

Ladder logic

Network 1 - main profile selector:

     TAG_1            TAG_2
|----[ MOVE ]-------------------------( %QB8 )---|
|     IN    OUT                              |
+----------------------------------------------+

Network 2 - one-shot stop command (writes value 27 to the same byte without disturbing the HMI-entered TAG_1):

     Cmd_Stop          MOVE            %QB8
|----[ ]----+----[ MOVE ]--------------(    )---|
|             |      27                         |
|             +----------------------------------+
|                                                |
|   (rising-edge optional via TP / M_X)          |
+------------------------------------------------+

Structured Text

// Main profile selector
TAG_2 := TAG_1;
%QB8  := TAG_2;

// Stop-profile injection
IF Cmd_Stop THEN
    %QB8 := 16#1B;   // 00011011b = decimal 27
END_IF;

The stop value 27 (hex 1B, binary 00011011) is an arbitrary profile number that the downstream motion controller interprets as "return to home position". Substitute the value that matches the index reserved for the stop motion in your external command table.

Configuring the HMI Binary I/O Field

The operator interface consists of one numeric I/O field that accepts decimal input and one output field that displays the binary representation of the byte currently being driven out of %QB8.

1. Open the HMI device configuration and add an I/O field element from the toolbox.
2. Set the Process value to TAG_1 on the PLC_1 connection. Mode = "Input/output".
3. Under Properties > Representation > Format, choose Binary. The format pattern is critical: change the digit count to 8 for the byte-wide display. The dropdown next to the binary pattern often defaults to 4 digits in WinCC Basic; switch it explicitly to 8.
4. Add a second I/O field bound to TAG_2 in "Output" mode using the same 8-digit binary format so the operator can see what the byte currently looks like on the wire.
5. For the numeric entry field, set limits 0 to 255 to enforce valid byte range. Mode "Input/output" is acceptable when the displayed value should also echo back the live value.

Loading and Verifying the Project

1. Compile the PLC project (Project tree > PLC_1 > Compile > Software (rebuild all)).
2. Download to the CPU: select PLC_1 in the project tree, click the "Download to device" toolbar icon, set the PG/PC interface to the correct Ethernet or PROFIBUS adapter, and confirm the IP address matches the CPU. CPU V2.2 and higher allow online password protection to remain enabled.
3. Compile the HMI project and download to the panel.
4. From the HMI, enter the decimal value 25 (binary 00011001) into the input I/O field and confirm the eight output LEDs on the SM 1223 light in the pattern 1-0-0-1-1-0-0-0 (LSB Q8.0 on the right).
5. Enter 255 and verify that all eight outputs are high.
6. Enter 0 and verify that all eight outputs are low.
7. Press the hardware Stop button while a non-zero value is still in TAG_1. The eight outputs should immediately switch to the stop-profile pattern (e.g. 00011011 for decimal 27). TAG_1 and the displayed decimal on the HMI remain unchanged.
8. Release the Stop button and confirm the outputs return to the pattern originally requested by TAG_1.

If the panel reports Connection interrupted, verify the HMI connection in Devices & Networks and that both the panel and the CPU share the same subnet. The S7-1200 default IP is 192.168.0.1 with PROFINET device name "S7-1200".

Signal Modules, Signal Boards, and the "Butter-Warmer Drawer"

A frequent point of confusion when extending a 1212C is the difference between a signal board and a signal module. Both add I/O, but their physical location is different:

Signal boards are particularly useful when the application needs only a handful of additional points and cannot tolerate the footprint of a full SM. For an 8-bit output byte, however, an SM is the only practical option because SBs top out at two digital outputs.

Integrating with External Motion Controllers

The binary-output pattern described here is frequently used as a "profile selector" for motion controllers such as the Delta RMC100/RMC75 and the LinMot E-series driver. The downstream controller reads the byte on its digital input port and executes the pre-loaded curve indexed by the value.

• Profile selection: Write 1 to 255 to %QB8 to choose the matching curve in the motion controller's command table. Value 0 is usually "no motion" or "halt".
• Stop / home return: Reserve a fixed index (commonly 27) for the home-return sequence. Drive %QB8 to that index from a hardware stop pushbutton without disturbing the HMI-entered decimal.
• Sign / direction extension: When the downstream controller reads direction from bit 7 of the byte (a common convention on +/-10 V analog-style profile interfaces), the value 0 to 127 selects forward profiles and 128 to 255 selects reverse profiles. In this mode the maximum forward-only count is 127, not 255.
• Launch handshake: A separate digital output (e.g. Q0.0 of the on-board CPU) is pulsed to inform the motion controller that the value in %QB8 is now stable and the curve should start. The launch pulse can be derived from an HMI button tied to a Bool tag and a one-shot timer (TP, IEC type) of 50 ms.

Troubleshooting Matrix

Best-Practice Notes

• Keep a separate tag (e.g. TAG_Requested_Profile) and a separate output tag (e.g. TAG_Active_Profile) so the HMI can display both "what the operator asked for" and "what is currently being driven". This avoids confusion when the stop button has forced a temporary override.
• Validate the entered value against a permitted range (1 to 255 for profiles, 0 reserved) inside the PLC using a comparator. Drive an HMI status indicator red if out-of-range.
• For safety-critical applications, use the SM 1223 outputs only for non-safety signalling (profile selection, status). Use a dedicated failsafe module such as SM 1226 (6ES7226-6BA32-0XB0) or a safety controller for any stop category above category 0.
• Always check the firmware version of the CPU before commissioning. CPU firmware V2.2 brought several HMI binary display fixes; V4.x is the current mainstream and is the recommended baseline for new projects.
• Document the wiring of each bit of %QB8 in the project documentation. Eight LEDs in a panel are easy to mis-label during commissioning; a one-line table in the EPLAN drawing saves hours later.

Frequently Asked Questions