STEP 7 Ladder Programming: Sensors, Motors, and PID with PLCSIM

1. Overview: STEP 7 Ladder Logic for Real-World I/O

STEP 7 is Siemens' integrated engineering framework inside the Totally Integrated Automation (TIA) Portal used to configure, program, commission, and diagnose SIMATIC controllers. The Ladder Logic (LAD) editor is one of three IEC 61131-3 languages supported in STEP 7 and remains the most widely adopted language for discrete I/O, motor control, and PID loop applications because each network maps directly to an electrical schematic.

This reference walks through a complete LAD application covering digital sensors, relay and contactor outputs, three-phase motor control, analog process control with PID_Compact, and full closed-loop simulation using S7-PLCSIM together with WinCC Runtime. Every step is built around the S7-1200/S7-1500 platform, which is the current mainstream controller generation supported by TIA Portal V16 and later.

2. Prerequisites

Confirm the following hardware and software before starting.

3. LAD Fundamentals: Contacts, Coils, and Boxes

LAD networks are read top-to-bottom and left-to-right. Power flow enters on the left rail and exits through a coil or box instruction on the right rail.

STEP 7 LAD provides box instructions for math, timer, counter, and move operations, and it does not cap the number of instructions (rows and boxes) per network. Use bit logic as the foundation and place box instructions only when discrete contacts cannot express the required function.

4. Sensor Integration: Digital and Analog Wiring

Map every field device to a tag before writing code. Naming convention example: "I0.0_Start_PB" for the Start pushbutton on input byte 0 bit 0, or use symbolic tags such as "Start_PB" defined in the PLC tag table.

4.1 Digital sensors (pushbuttons, limit switches, inductive proximity, photoelectric)

1. Wire the sensor to a 24 V DC digital input on the SM 1221 or onboard DI of the CPU.
2. In TIA Portal, open PLC tags and define a Bool tag (default: %I0.0) with a meaningful name.
3. Add a single NO contact to the rung using the symbolic tag.

4.2 Analog sensors (pressure, level, temperature via 4-20 mA / 0-10 V / RTD / TC)

1. Wire the transmitter to the SM 1231 AI4 (12-bit) or AI4/RTD module.
2. Configure the channel: Inputs > AI Configuration for measuring range (e.g., 4-20 mA), smoothing, and overflow diagnostics.
3. Read the raw integer (0-27648 for unipolar, -27648 to +27648 for bipolar) and use the SCALE or NORM_X / SCALE_X box instructions to convert to engineering units.

Example scaling of a 4-20 mA level transmitter with 0-5 m range into a Real in meters:

5. Actuator and Relay Control

Actuator rungs in LAD almost always combine a start condition, a stop condition, an overload/healthy feedback, and a Set/Reset seal-in pattern. The classic pattern for a relay or contactor:

Network 1 — Motor starter seal-in
  --|Start_PB|---|Stop_PB|---|NOT Overload|---+---(S) "Motor_Run"---

Network 2 — Explicit reset on stop
  --|Stop_PB|---(R) "Motor_Run"---

For solenoid valves, lamps, and horns, replace the Set/Reset with a single output coil. For bidirectional (forward/reverse) actuators, add mechanical or electrical interlocks using NC contacts of the opposite direction coil to prevent both contactors energizing at the same time:

--|FWD_PB|---|NOT Rev_Coil|---|NOT Rev_TS|---+---(S) Fwd_Coil
                                                    |
                              --|REV_PB|---|NOT Fwd_Coil|---|NOT Fwd_TS|---+---(S) Rev_Coil

6. Motor Control Patterns in LAD

6.1 Star-delta example with TON

--|Start_PB|---(S) "K_Main"
--|K_Main|---(SET) "K_Star" with TON "T_Star", preset 5 s
--|K_Main|---|T_Star.Q|---(SET) "K_Delta"
--|T_Star.Q|---(RESET) "K_Star"

Add an NC contact of K_Delta in series with the K_Star rung and vice versa to enforce a 100 ms changeover (K-star drops out before K-delta pulls in) and prevent a phase-to-phase short.

6.2 Driving a VFD from LAD

For a SINAMICS G120 connected via PROFINET, map the standard telegram 1 (control word STW1 / status word ZSW1) into two data words using the PUT / GET instructions or the drive's I/O address from the device configuration. A 16-bit control word %QW holds the run/stop and direction bits; a 16-bit speed setpoint lives at the next word. The status word is read at %IW.

7. PID Control with PID_Compact

STEP 7 ships with a self-tuning PID instruction called PID_Compact for S7-1200 and S7-1500. It supports continuous and pulse-width-modulated outputs and performs automatic controller tuning at the push of a button.

7.1 Configuration steps

1. Add a new FB instance DB by dragging PID Control > PID_Compact into a network.
2. Set Input / Output > Input_PER (analog) or Input (engineering units) and Setpoint / ProcessValue.
3. Configure the output as analog (PID_Compact writes to Output_PWM or Output) for a continuous actuator, or as PWM for a heating element driven by a discrete output.
4. Assign Retain.CtrlParams if PID gains must survive a CPU restart.

7.2 Manual pre-tune (pretuning)

Drive the process manually to a stable operating point within 50% of the setpoint range. Call PID_Compact_Instance.Pretune := TRUE in a one-shot rung, monitor the rising/falling deviation, and let the instruction compute initial Gain, Ti (reset time), and Td (derivative time) values.

7.3 Fine-tune references

8. Simulation with S7-PLCSIM and WinCC Runtime

S7-PLCSIM turns the engineering PC into a virtual S7-1200 or S7-1500 controller. The simulated CPU runs the same firmware image and the same instruction set as the real hardware, which makes it ideal for FAT (Factory Acceptance Testing) before the cabinet ships.

8.1 Starting a PLCSIM instance

1. In the project tree, right-click the CPU and choose Start simulation.
2. TIA Portal launches the PLCSIM V16+ UI, loads the compiled hardware configuration, and shows a virtual S7-PLC.
3. Download the program blocks with Download to device > CPU / PLCsim.
4. Toggle the virtual CPU to RUN via the PLCSIM toolbar.

8.2 Stimulating inputs and observing outputs

Open the Project tree > SIM table in PLCSIM, or use the watch table. A typical table for a motor starter application:

8.3 Pairing PLCSIM with WinCC Runtime

1. Configure a WinCC RT Advanced or Professional panel in the same TIA Portal project. Point its HMI connection to the PLCSIM instance, not a physical PLC.
2. Start the HMI runtime; WinCC exchanges tags with the simulated CPU over the local S7ONLINE interface.
3. Use HMI buttons to actuate virtual inputs and animated graphics to show the pump, valve, and motor moving in real time. This is the closest equivalent to a Proteus-style schematic-level animation when working with SIMATIC controllers.

9. Example Project: Pump-Down Tank Level Control

The following walkthrough ties all the building blocks together and is reproducible on a single S7-1200 CPU 1214C with PLCSIM.

9.1 Hardware list

• 1× Start PB (NO), 1× Stop PB (NC), wired to %I0.0 and %I0.1
• 1× High-level float switch (NC, failsafe), %I0.2
• 1× 4-20 mA level transmitter at SM 1231 AI, %IW64
• 1× Pump contactor on SM 1222 DO, %Q0.0
• 1× Speed reference to VFD on second output byte, %QW2

9.2 Tag list

Start_PB : Bool    // %I0.0
Stop_PB : Bool     // %I0.1
High_LS : Bool     // %I0.2
Level_Raw : Int    // %IW64
Level_m : Real     // scaled engineering value
Level_SP : Real    // setpoint in meters
Motor_Run : Bool   // %Q0.0
Fault_Active : Bool

9.3 Program structure (OB1 main scan)

1. Network 1 — Scale raw input. Use SCALE_X to convert Level_Raw into Level_m (0-5 m).
2. Network 2 — Auto/Manual selector. Two rungs: manual mode forces Motor_Run from a discrete tag; auto mode lets PID_Compact drive the run bit.
3. Network 3 — Seal-in motor. Standard Set/Reset pattern with Stop_PB NC, High_LS NC, and a fault NC in series.
4. Network 4 — PID_Compact instance. Input = Level_m, Setpoint = Level_SP, Output (Bool) wired into the auto-mode rung of the motor seal-in network. Output_PER drives the VFD reference at %QW2.
5. Network 5 — Fault handling. Any diagnostic bit from the AI module OR a sustained deviation > 1.0 m for 30 s sets Fault_Active and latches a horn output.

9.4 Verification in PLCSIM

1. Download the program and the WinCC RT to the simulated CPU.
2. Force Level_Raw = 4000 (≈ 0.7 m) and Level_SP = 2.5. PID_Compact should ramp Motor_Run ON.
3. Force Level_Raw = 25000 (≈ 4.5 m). The pump must shut off when the level crosses the setpoint and stays off above it.
4. Force High_LS = FALSE. The seal-in must drop immediately regardless of the PID output.
5. Toggle Fault_Active to TRUE; confirm the motor cannot be restarted from the Start_PB until the fault is acknowledged from the HMI.

10. Troubleshooting Matrix

11. Field-Proven Best Practices

• Always declare symbolic tags and disable the option "Access to absolute addresses" in the CPU properties for production code. It forces structured design and avoids hard-to-trace I/O references.
• Build every motor in a reusable FC or FB so the seal-in, overload, and fault logic are coded once and instantiated per drive.
• Separate the HMI tag DB from the I/O tag DB. The HMI should never read a raw %I address; it should read a flag the program itself has validated.
• Keep PID tuning results, machine constants, and recipe data in the Retain area of the data block so they survive power cycle and firmware update.
• When in doubt, simulate first. PLCSIM catches roughly 80% of logic bugs before the panel is powered, and WinCC RT animation catches the HMI wiring mistakes that the eye often misses in the static screen layout.