Totaling S7-1200 CTUD Counters Across Multiple PLCs in TIA Portal

Overview

When three (or more) SIMATIC S7-1214 CPUs each accumulate their own production, cycle, or event counts in CTUD (Count Up/Down) instances, operations teams frequently need a fourth CPU that mirrors the grand total of every counter on every PLC. The challenge is twofold:

1. Each CTUD instance's CV (current value) must be reduced to an arithmetic-compatible tag inside its own CPU.
2. That sub-total must be transported to a central S7-1200 over Profinet/S7 and added with the sub-totals from the other CPUs.

This reference covers both halves: the local summing block in TIA Portal V17/V18/V19 and the cross-PLC transport via the legacy PUT/GET pair, the modern I-Device topology, and Open User Communication (OUC) with TSEND_C/TRCV_C. The pattern applies to any S7-1200 firmware V4.0 through V4.6 (S7-1214 DC/DC/DC, S7-1214 DC/DC/Rly, S7-1214 AC/DC/Rly), and to S7-1211/S7-1212/S7-1215 CPUs that expose the same instruction set.

Prerequisites

• TIA Portal V17, V18, or V19 with the S7-1200 CPU HSP installed (HSP 0307 for FW V4.6, HSP 0299 for FW V4.5).
• CPU firmware ≥ V4.2 if you intend to use I-Device on a real PROFINET interface; firmware V4.4 or later is required for shared-Device and GDS-pushed configuration (PN).
• Each CPU's Protection > Connection mechanisms > Permit access with PUT/GET must be enabled for the legacy S7 path. Do not enable this in plant zones exposed to untrusted networks — restrict the affected interface with a firewall or use a CPU with a separate Profinet interface in I-Device mode.
• Profibus/Profinet topology: if the three field PLCs and the central PLC sit on the same subnet (e.g. 192.168.0.0/16), you can address them directly. If routers separate them, configure the IP router and use the remote TSAP/Port.
• Library S7 Communication is auto-installed with every TIA Portal installation; no extra add-on is required.

Step 1 — Sub-Total Inside Each Field PLC

Each S7-1214 contains an array of CTUD instances (e.g. "Counters_DB".CTUD_1 … CTUD_N). Add their CVs into one DINT tag using the ADD instruction. The block accepts up to 7 inputs; chain further ADDs if the counter count per PLC exceeds 7.

1.1 Recommended Data Block Layout

Create a global DB named "Totals_DB" with the following tags so the sub-total and the per-counter buffer share a single source of truth:

1.2 Ladder Snippet (Single Segment)

Network 1:  Sum of first 7 counters
   ADD                                 EN     ENO
   |      "Totals_DB".CounterValues[1] |
   |      "Totals_DB".CounterValues[2] |
   |      "Totals_DB".CounterValues[3] |
   |      "Totals_DB".CounterValues[4] |  -->  "Totals_DB".SubTotal
   |      "Totals_DB".CounterValues[5] |
   |      "Totals_DB".CounterValues[6] |
   |      "Totals_DB".CounterValues[7] |

Network 2:  Accumulate remaining counters into SubTotal
   ADD   "Totals_DB".SubTotal  EN     ENO
        "Totals_DB".CounterValues[8]
        "Totals_DB".CounterValues[9]   -->  "Totals_DB".SubTotal
        "Totals_DB".CounterValues[10]
        "Totals_DB".CounterValues[11]
        "Totals_DB".CounterValues[12]
        "Totals_DB".CounterValues[13]
        "Totals_DB".CounterValues[14]

1.3 Structured Text Equivalent

// FB "Counter_Summation" body
#Sum1 := 0;
FOR #i := 1 TO 16 DO
    #Sum1 := #Sum1 + "Totals_DB".CounterValues[#i];
END_FOR;
"Totals_DB".SubTotal := #Sum1;

Step 2 — Move CVs into the Array

Inside the same OB1 (or a cyclic interrupt OB30 at 100 ms), assign each CTUD's CV output into the array slot. The MOVE block accepts any integer length, so the source is typed as INT/DINT depending on the CTUD instance configuration.

Network 1:  Refresh CounterValues[]
   MOVE  EN    ENO
         "Counters_DB".CTUD_1.CV   -->  "Totals_DB".CounterValues[1]
   MOVE  EN    ENO
         "Counters_DB".CTUD_2.CV   -->  "Totals_DB".CounterValues[2]
   ...
   MOVE  EN    ENO
         "Counters_DB".CTUD_16.CV  -->  "Totals_DB".CounterValues[16]

If any counter may exceed INT range, configure that CTUD as DINT from the start; do not mix INT and DINT in a single ADD — the compiler will warn and runtime will silently truncate.

Step 3 — Push the Sub-Total to the Central PLC

Three production-grade options exist on S7-1200. The choice depends on the existing topology and security policy.

3.1 PUT/GET (S7 Communication, legacy path)

Smallest amount of code; supported on every S7-1200 ≥ FW 4.0. The central PLC uses GET to read SubTotal from each of the three remote PLCs; the remote PLCs use PUT only if the central PLC is the polling master (which is the recommended direction so all writes originate in one place).

Local DB on the central PLC: "GrandTotal_DB".Remote1, Remote2, Remote3 (DINT). Three GET instances at different IDs read 1 DINT each from PLC 1, 2, 3.

// Central PLC — Network 1, GET from PLC 1
   GET  EN    ENO
        ID        := 1
        REQ       := %M0.5
        ID        := 1                  // (already shown)
        NDR       :=
        ERROR     :=
        STATUS    :=                     // (illustrative)
        ADDR_1    := P#DB10.DBX0.0 DINT 1
        SD_1      := P#DB100.DBX0.0 DINT 1
        RD_1      := P#DB100.DBX0.0 DINT 1
        LADDR     := 0

Grant access on the remote CPU: Device configuration > Properties > Protection > Permit access with PUT/GET communication from remote partner. If the box is greyed out, a connection resource is already in use; lower the max number of PUT/GET connections in the same dialog (default is 4).

3.2 I-Device (intelligent Device)

Configure the central PLC as the PN-IO controller and the three field PLCs as PN I-Devices in the same TIA project (or in a GSD-imported sub-project). Each I-Device exposes a defined slot/submodule range; the field CPU's SubTotal tag is mapped into the I-Device transfer area, and the central CPU reads it like any Profinet IO input word.

• Right-click the remote CPU > Properties > PROFINET interface > Operating mode > I-Device.
• Add a transfer area of type Input, length 4 bytes (one DINT), start address 0.
• In the central PLC's device view, drag the I-Device from the network topology into its PROFINET subnet; the transfer area appears under "<RemoteCPU>_Head".Slot 1 / I Address Area.

Advantage: deterministic update every PN cycle, no extra connection resources, no IP-based firewall holes. Disadvantage: the central PLC must own the IO controller role, which means the three field CPUs are no longer peers of each other.

3.3 Open User Communication (TCP / ISO-on-TCP)

Use when the field PLCs are scattered across routed networks or when a non-Siemens device (PC, HMI, edge gateway) is part of the aggregation. From TIA Portal's Instructions > Communication > Open User Communication drop a TSEND_C on each field PLC and a matching TRCV_C on the central PLC.

// Field PLC — send SubTotal every 200 ms
   TSEND_C  EN   ENO
            REQ       := %M0.0
            ID        := 1
            LEN       := 4
            DATA      := "Totals_DB".SubTotal
            CONNECT   := "Connect_DB_1".TCPconn
            DONE      :=
            BUSY      :=
            ERROR     :=
            STATUS    :=

"Connect_DB_1".TCPconn is a TCON_Param data block preconfigured with the central PLC's IP, remote port 2000, local port 2001, and active connection establishment.

Step 4 — Grand Total Inside the Central PLC

Once the three remote DINTs are present locally (Remote1, Remote2, Remote3), a single ADD block produces the grand total. Add an EQ block to compare it against a per-day target for a pass/fail output if needed.

// GrandTotal = Remote1 + Remote2 + Remote3
   ADD  EN   ENO
        "GrandTotal_DB".Remote1
        "GrandTotal_DB".Remote2   -->  "GrandTotal_DB".GrandTotal
        "GrandTotal_DB".Remote3

   // Optional: shift register for daily roll-over
   ADD  EN   ENO
        "GrandTotal_DB".GrandTotal        
        "GrandTotal_DB".Shift_Offset   -->  "GrandTotal_DB".GrandTotalDay

Step 5 — Verification

1. On each field PLC, force CTUD_1.CU ten times in the watch table; confirm Totals_DB.SubTotal advances by 10.
2. Online > Go online to the central PLC; open the watch table and read Remote1, Remote2, Remote3. Each should equal the field PLC's SubTotal.
3. Force a further 25 counts on PLC 2; GrandTotal_DB.Remote2 must change within one PN cycle (I-Device) or within the GET/TSEND cycle (≈1 s for PUT/GET @ 1 Hz, ≤200 ms for TSEND_C).
4. On the central HMI, bind a numeric output to GrandTotal_DB.GrandTotal; verify the displayed value matches the sum of the three watch tables.
5. Power-cycle PLC 1; once re-established, GET/TSEND must resume and the central total must include PLC 1's last value without manual reinit.

Troubleshooting Matrix

Edge Cases & Field-Proven Caveats

• Reset semantics. When you reset a CTUD with the R input, the CV drops to zero. If your sub-total aggregates the CVs at a slower cycle (e.g. 100 ms OB30), the central grand total can briefly decrease on reset. Either gate the reset with a one-shot or freeze the array copy at the end of each cycle before any reset is applied.
• Lost counts on power-fail. The S7-1200's retainable memory is limited to a few KB. If SubTotal must survive a brown-out, place the DINT in a retentive tag and re-arm the count-up pulse from a high-speed counter (HSC) on the same CPU. The central PLC cannot recover counts that were never sent.
• Order of operations with I-Device. A PROFINET IO failure on a remote I-Device causes the central CPU to substitute 0 for the input words. This zeroes the grand total. Add a watchdog: if the I-Device status byte (slot 0) is not OK for > 2 s, freeze the previous value instead of replacing it with 0.
• Multiple central aggregators. Avoid sending the same SubTotal to two central PLCs using two GET blocks; use a single GET and route the value to both via internal tag transfer to keep diagnostic data consistent.

Performance & Cycle-Time Budget

A S7-1214 DC/DC/DC executes the typical workload — 16 CTUD instances, 16 MOVEs, 1 ADD chain, 1 PUT — in well under 1 ms of OB1 time. Adding three GET instructions on the central PLC costs roughly 0.3 ms each on first call and 0.05 ms on subsequent calls. With cycle time set to 10 ms the headroom remains > 8 ms for I/O and the rest of the user program.

Standards & Reference Documents

• IEC 61131-3:2013 — Programmable controllers, Part 3 (defines CTU, CTD, CTUD semantics).
• SIMATIC S7-1200 Programmable Controller System Manual (Siemens, edition 06/2023) — covers CTUD, data type selection, retain behaviour.
• SIMATIC S7-1200 Programmable Controller Communication Function Manual — PUT/GET, TSEND_C, TRCV_C reference, TSAP conventions.
• PROFINET Function Manual for SIMATIC S7-1200/S7-1500 — I-Device configuration, transfer area, and update time.
• S7-1200 CPU 1214C datasheet — connection-resource limits, retain memory budget.