Machine Translated by Google

CHAPTER 7
7. 1 - Special internal relays (Special memory ) - SM :

Special internal relays are also called special memory bits. Special memory bits enable
communication between the CPU and the program to perform various control functions.
Although these are called special memory bits, they can be accessed as bits, bytes, words and double
words. In other words, it is no different from "M" bits in terms of usage. There are two different types
of auxiliary relays in PLC, non-permanent and permanent. Special auxiliary relays in PLCs can be
used in time relay or counter control so that the program that was running before the power cut
continues from where it left off after the power is cut off. Apart from these, it is possible to use in
many fields.
Flashers (for example 1 sec.) (SM0.5) , (60 sec.) (SM0.4) are permanent
type special auxiliary relays. These special auxiliary relays, which are permanent type, are powered by batteries.

Special auxiliary relays

S7 200 CPU 212 series S7 200 SM0.0.........SM45.7,
CPU 214 series S7 200 CPU SM0.0.........SM85.7,
215....216 series SM0.0.........SM199.7, S7 200 CPU 221....226
series SM0 It is expressed as .0.........SM179.7.

SMB0 Status bits:

Private memory byte 0 (SM0.0......SM0.7) has 8 bits to facilitate programs. • SM0.0 : Always ON
(set to
1. When this bit is used PLC control RUN
It is in the "1" position from the moment it switches to position.

Network 1
Network 1
Q0.0
SM0.0 Q0.0

a b

The moment the PLC is put into RUN mode, the SM0.0 bit is always "1" until it switches to
STOP mode, that is, it is active. Relays are never directly connected to the line (fig. b). If a relay is
desired to operate while the CPU is in RUN mode, it should be connected as in figure a.

• SM0.1 : First scan bit : (On first scan - loop) "1"; "0") in the next. After the PLC is taken from STOP
to RUN mode, the bit that is "1" in the first scan (cycle) is "0" in the other scans (cycles). For
example, the output values of counters and permanent type timers are reset with this bit.

Or this bit can still be used if the loop needs to be redirected from the main page (OB1) to
another page (for example, Subroutine 0 (SBR0)) when the PLC is put into RUN mode.
Network 1 Network 1

I0.0 C1
SM0.1 .
CU CTU
SBR0 . On the first scan it resets
SM0.1 the output and value of
the counter C1' .
R
Switches to SBR0 page on first scan
.
10 PV
.
97
Machine Translated by Google

• SM0.3 : Energized bit : ("1" in the first scan after energization; "0" in the following.
Notice the difference from SM0.1 (it is "1" in the first cycle when SM0.1 is
subordinated to the RUN.).
• SM0.4 : 60 second flasher (30 seconds "0" for 30 seconds; "1" for 30 seconds).

SM0.4

t
30sec 30sec

60 sec. (1 min)

Network 1

SM0.4 Q0.0 Output relay Q0.0 becomes "0" and "1" periodically at
intervals of 60 seconds (1 minute). i.e. it stops for 30 seconds.
It works for 30 seconds. However, it should be noted that there
is a 30 second wait ("0") at startup.

• SM0.5 : 1 second flasher (0.5 second "0"; 0.5 second "1") periodically.

SM0.5
t
0.5 sec 0.5 sec

1 sec

Network 1
Q0.0 output relay turns "0" and "1" periodically at 1-second
SM0.5 Q0.0 intervals. So it stops for 0.5 seconds. It works for 0.5 seconds.
However, it should be noted that there is a 0.5 second cooldown
("0") at the start.

• SM0.6 : Scan generator ("1" on one scan periodically; "0" on the next).

• SM0.7 : (Position of the position switch ("0" TERM, "1" RUN).

It checks if it is in RUN mode.

SMB5 : Input / output status bits :

• SM5.0 : Input / output fault ("0" no fault, "1" any input/output fault)

• SM5.1 : Digital input/output(1) above capacity. S7 200 series CPU 222 PLC devices
(8x3) -2 = 22, CPU 224 and 226 series 8x8 = 64 digital inputs-outputs can be used. If
this number of inputs/outputs is exceeded, this bit will be activated as there will be
usage above the
capacity. • SM5.2 : Analogue input/output(1) above capacity. This bit is activated if an
analog module is used above the capacity in S7 200 series PLC devices.

98
Machine Translated by Google

SM5.3 : Intelligent input/output (1) above capacity.

SM5.7 : DP fault (0 no fault, 1 fault).

SMB2 : Received character Buffer (Freeport)

Private memory byte is the place where the character received in freeport mode is written. In
other words, in a communication situation (computer, barcode, etc.), the character sent from the
other party will be read from here. • SMB2 : Received character buffer

SMB3 : Parity error (Freeport) Private

memory bit is set to "1" if there is a parity (communication mismatch) error during character
acquisition in 3.0 freeport mode. •
SM3.0 : Parity error. (0 no error, 1 error) • SM3.1 - 3.7 :
Reserved

SMB4 : Interrupt task overflow : If

there is an overflow during the interrupt operations, that is, if the tasks are sent one after the
other that the system cannot accept, this can be seen in private memory byte
4. • SM4.0 : Communication interrupt task overflow (overflow
= 1). • SM4.1 : Input/output interrupt task overflow (overflow =
1). • SM4.2 : Time-controlled interrupt task overflow (overflow = 1). •
SM4.3 : User programming error (0 no error, 1 error) • SM4.4 : Interrupts
allowed (0 allowed, 1 allowed). • SM4.5 : Port 0 transmission free (0
transmission in progress, 1 transmission disabled). • SM4.6 : Port 1 transmission free
(0 transmission in progress, 1 transmission disabled). • SM4.7 : Reserved.

SMB6 : CPU type

Private memory byte shows 6 CPU types.
7 0
xxxxr r r r

xxxx = (SBM 6.4 -6.7)

0000 = CPU 212 - CPU 222 0010 rrrr : reserved
= CPU 214 - CPU 224 1000 = SMB6.0 - 6.3 : Reserved
CPU 215 1001 =
CPU 216 - CPU 226 0110 = CPU
221 1000 = CPU
215

SMB8 - SMB21 : Input / output Module type and fault bytes Special
memory bytes 8 - 21 provide information about input / output modules. One byte is reserved
for each module. The even numbered byte gives the features of the module, the odd numbered byte
gives the fault status.
7 0 7 0

Couple # mtta i I qq Only # c ie obrpf t

m : Presence of qq : 00 : no output
module 0 present, 1 not 01 : 2 AQ or 8 DQ 10 :
present tt : Module type 00 : module without 4 AQ or 16 DQ 11 : 8
input/output AQ or 32 DQ
01 : smart
c: configuration error
module 10 :
ie : smart module error. 0 no faults, 1 faults
i: reserved 11 : reserved 00 : no entry
b: carry or parity fault output
01 : 2 AI or 8 DI r: range fault supply
10 : 4 AI or 16 DI
p: power fault fuse
11 : 8 AI or 32 DI 0 f: blown fault
a : Input/output type digital, 1 analog t: independent terminal fault

99
Machine Translated by Google

SMW 8 : Expansion module 0 (SMB8 and SMB9)

SMW 10 : Expansion module 1 (SMB10 and SMB11)
SMW 12 : Expansion module 2 (SMB12 and SMB13)
SMW 14: Expansion module 3 (SMB14 and SMB15)
SMW 16 : Expansion module 4 (SMB16 and SMB17)
SMW 18 : Expansion module 5 (SMB18 and SMB19)
SMW 20 : Expansion module 6 (SMB20 and SMB21)

SMW22 - SMW26 : Scan time

Special memory words 22 - 26 contain information about the scan time.
• SMW 22 : Scan time in milliseconds (last scan). • SMW 24 : Scan
time in milliseconds (minimum). • SMW 26 : Scan time in
milliseconds (maximum).

SMB28 and SMB29: analog setting values Special

memory bytes 28 and 29 show the setting values of the potentiometers on the CPU. With these
potentiometers, it is possible to roughly adjust the variable values such as time setting and alarm limit.
Since these values are bytes, they can vary between 0 and 255, but it is more appropriate to use between
10 and 200. • SMB28 : The value read from analog setting 0 (updated
once when going from STOP to RUN. CPU 221 and CPU 222 have analog setting 0 potentiometers.

• SMB29 : The value read from analog setting 1 (updated once when going from STOP to RUN.
CPU 216, CPU 224 and CPU 226 have analog setting 0 and analog setting 1 potentiometers.

SMB30 : Freeport communication port

0 Special memory byte 30 regulates communication for port 0.

7 0
SMB30 (PORT 0)
ppdbbbm m
SMB130 (PORT 1)

pp : parity bbb : baud rate mm : protocol selection

00 : no parity 000 : 38,400 baud* 00 : PPI factory setting
01 : even (even) parity 001 : 19,200 baud 01 : freeport protocol
10 : no parity 010 : 9,600 baud 10 : PPI+**
11: odd (odd) parity 011 : 4,800 baud 11 : reserved PPI
D : data (bit/ 100 : 2,400 baud
square) 0 - 8 bits/ 101 : 1,200 baud
character 1 - 7 bits/character 110 : 600 baud
111 : 300 baud

NOTE: * Selecting a communication rate of 38400 bits/sec for CPU 212 results in a 19200 bits/sec setting. Because
CPU 212 does not support higher speed.
**
PPI+ mode corresponds to master in PPI network. CPU 212 does not support this mode. This
Therefore, it is assumed that mm = 00.
When PP+ mode is selected, bits 2 and 7 are ignored as the CPU comes as a master
communicating with NETR (read from network) and NETW (write to network) commands.
Likewise, in PPI mode, these bits are irrelevant. In other words, these bits need to be set only
in feeport mode.

one hundred
Machine Translated by Google

SMB31 and SMB32 : Write to EEPROM

Special memory bytes 31 and word 32 allow the V memory values in the user program to be written to
the internal EEPROM of the CPU. So this data can be stored even without battery and discharge of super
capacitor.
NOTE : This operation does not update the data on the memory cartridge. One byte, word in each transaction
or you can write a double word.
Warning: Remember that EEPROMs have a write life (minimum 100,000, typical 1,000,000 times).

SMB31 :
SMB31 0
Software commands
7c00000ss

ss : size of data to be written c : print command

00 : byte 0 : no write request
01 : byte 1 : The user wants to write the program from the system to the EEPROM,
10 : word The system resets this bit after each write attempt.
11 : double word

SMW32 : Memory address to be written to EEPROM

15 87 0
SMW32 V memory address

The specified address will be written to the memory area corresponding to the EEPROM.
In Microwin 16 program and 1st generation PLCs (CPU 212, 214, 215, 216), if the 13, 14 and 15 bits are
different from zero, no writing is done, the command bit is reset.
If the entered address (or any byte in word or double word selection) is outside the write address
limits specified below to the EEPROM, the write command is reset and no operation is performed.

CPU 212 :VB0 - VB199 CPU

214 :VB0 - VB1023 CPU
215/1216 : VB0 - VB5119 In both
error states SM4.3 is set, error code is 91 and SMW32
value does not change.

SMB34 and SMB35 : Time-controlled Interrupt values: Special memory

bytes 34 and 35 are for entering the values of interrupts 0 and 1.
If interrupts are defined and allowed correctly, an interrupt occurs in a user program at the entered time. To
change these times, it is necessary to reassociate them after the interrupt is changed. Because the CPU only
looks at the values below, and hence their change, during the association.

SMB34 : Time value for time controlled interrupt 0 (1 - 255 ms)

SMB35 : Time value for time controlled interrupt 1 (1 - 255 ms)
Various examples are given in the following topics related to this subject.

SMB36 - SMB65 : Fast counter programming bytes : Detailed

information is given about fast counters regarding these special memory bytes.

SMB66 - SMB85 : PTO/PWM functions: These special

memory bytes are explained extensively in the PTO and PWM functions section.

101
Machine Translated by Google

SMB86 - SMB94 and SMB186 - SMB194 : Port 0 and port 1 message

reception Special memory bytes 86 - 94 contain status and control information about
message
reception over port 0. Special memory bytes 186-194 contain status and control information
about receiving messages over port 1.
SMB 86 and SMB186 : (SMB86 for port 0, SMB186 for port 1)

7 0
SMB86 and SMB 186
Software commands n re 0 0 tcp

n : 1 - message reception interrupted by user command: otherwise n = 0. r : 1 - Message

reception has ended . Missing input parameters, start or end state. e : 1- ending character received: otherwise e = 0.
t
: 1 - message reception interrupted : not completed within a certain time, otherwise t =
0. c : 1 - message reception interrupted: the maximum number of characters that can be received has
been reached, otherwise c = 0. p : 1 - message reception interrupted : parity error, otherwise p = 0.

SMB 87 and SMB 187 : (SMB87 for port 0, SMB187 for port 1)

SMB87 and SMB 187 7 0

Message reception nxyzmt bk 0
control byte

n : This bit is checked in each execution of the RCV (AL) instruction. If this bit is 0, no receive operation is performed. 1 is done.
x : 0 - ignore SMB 88 or SMB 188; 1 - as the starting character in SMB 88 or SMB188
accept the value.
y : 0 - ignore SMB 89 or SMB 189; 1 - the value in SMB 89 or SMB189 as the start character
admit it.
z : 0 - ignore SMW 90 or SMW190; on the SMW90 or SMW190 to detect the idle line status.
use value. m : 0
- see time between two characters; 1 - look at the time between two messages. t
: 0 - Ignore SMW92 or SMW192; 1 - End reception if the time on SMW92 or SMW192 is exceeded.

NOTE : In case of parity error, reception is automatically terminated.

bk : 0 = Ignore intermediate states

1 = Use intermediate states when initial message is received.

In order to detect the beginning of a message, the beginning of the message criterion with the "AND" logical command must
both be true and occur in an order. (Empty lines or intermediate commands must be followed by the start characters.) To detect the
end of a message, the end of the active message criterion must be logically determined. It should be Ored.
The equations of the start and end criteria are given below:

* *
Message start = province sc + bk sc
End of message = ec + tmr + maximum number of characters reached

Programming the beginning of the message

criteria: 1.Specifying an empty (Idle) line:
, il = 1 sc = 0, bk = 0,
SMW90 > 0 2.Determining the start character: , il = 0 sc = 1, bk = 0, SMW90
unimportant 3.Search status determination: , il = 0 sc = 0, bk = 1, SMW90
unimportant 4. Respond to request: il = 1 sc , = 0, bk = 0, SMW90 = 0 (if no response, press to terminate receive
message timer can be used.)
5.Intermediate state and starting character: il = 0, sc = 1 6.Blank line , bk = , SMW90 junk
and starting character: il = 1, sc = 1 7.Blank line and starting , 1 bk = , SMW90 > 0
character: (invalid) il = 1, sc = 1 , 0 bk = 0, SMW90 = 0

NOTE : In case of timeout or parity error (if activated), buying will be terminated automatically.

102
Machine Translated by Google

SMB88 : Port 0 : Message start character.

SMB188 : Port 1 : Message start character.
SMB89 : Port 0 : Message ending character.
SMB189 : Port 1 : Message ending character.
SMB90-91 : Port 0 : Idle line time in milliseconds. The first character received after this period is
considered the beginning of the new message. SMB90 is the left byte.
SMB190-191 : Port 1 : Idle line time in milliseconds. The first character received after this period is
considered the beginning of the new message. SMB190 is the left byte.
SMB92-93 : Port 0 : The time that can pass between two messages/characters in milliseconds according to the
selection in m. If this period is exceeded, the purchase will be terminated. SMB92 is the left byte.
SMB192-193 :Port 1 : The time that can pass between two messages/characters according to the selection in m in
milliseconds. If this period is exceeded, the purchase will be terminated. SMB192 is the left byte.
SMB94 : Port 0 : maximum number of characters to be received (1 - 255 bytes).
SMB194 : Port 1 : maximum number of characters to be received (1 - 255 bytes).

SMB 110 to SMB 115 : DP protocol status Special

memory bytes 110 to 115 contain PROFIBUS DP protocol status and configuration information.

NOTE : These fields are for monitoring status only. These fields should not be overwritten.
The bytes specified here are changed by the DP master during configuration.

SMB 110 : DP standard protocol status byte (only for CPU 215)

7 0
SMB110 0 0 0 0 0 0 s1 s0

DP status byte : s0, s1

00 : DP communication not done since power up 01 : There
is control/parameter error.
10 : Data transfer is still in progress.
11 : Data transmission finished.

NOTE: SMB111 and SMB115 are updated each time the CPU accepts 215 parameterization
information. Although there is a parameterization error, this value is still updated and reset when
the power is cut off.

SMB111 : Port 1 : DP standard protocol - Master address (0 - 126)

SMB112 -113 : Port 1 : DP standard protocol - address of output data field in V memory.
SMB112 is left byte
SMB114 : Port 1 : DP standard protocol - bytes of output data SMB115 :
Port 1 : DP standard protocol - bytes of input data

103
Machine Translated by Google

7.2 - Variable memory area: The VV memory

area is used to store the intermediate results that occur during the execution
(application) of the control program. It is possible to access this memory area as bit ,
byte (byte), word or
double word. : V2.0 :
Example : VB10 :
Bit as Byte VW50
As Word As Double Word : VD4

7.3 - Local memory area:

L S7- 200 CPUs have 64 bytes of local memory area. 60 bytes of these fields are
used as a write field or to send variable parameters to subprograms (such as interrupt
or Subroutine).
In ladder or FBD program usage, the microWIN32 program allocates the last four
days of L bytes for its own usage. In the STL program, 64 bytes can also be used.
Local memory is generally similar to V memory space. However, V memory has a
general scope, while L memory has regional scope. General scope, it is possible to reach
the same memory area from different regions (Main program-Main, Subprogram, Interrupt,
Soubroutine). In local scope, a memory area with a specific address is limited to a
program segment. S7-200 CPUs allow the use of 64 bytes of memory space per zone. For
example, a 64-byte L field can be used in the main program, while a 64-byte L field can
be used individually in all subprograms (it is recommended not to use the last four
bytes).
It is not possible to access an L address used for the main program from
subprograms. Likewise, it is not possible to reach an L address used in subprograms
from the main program. Also, it is not possible to reach the L addresses used in other
subprograms. So the use of L is regional.
It is possible to access this memory area as bit , byte (byte), word or double word.
Example : Bit : L1.0 Byte : LB15
Word : LW6 Double Word :
LD4

104