Data storage, memory areas and addressing

Each level allows certain functions to be accessible without a password. The default

condition for the CPU is to have no restriction and no password-protection. To restrict access to a CPU, you configure the properties of the CPU and enter the password.

Entering the password over a network does not compromise the password protection for the CPU. A password-protected CPU allows only one user unrestricted access at a time.

PLC-to-PLC communications (using communication instructions in the code blocks) are not restricted by the security level in the CPU. HMI functionality is also not restricted. Entering the correct password provides access to all of the functions.

Security level Access restrictions

No protection Allows full access without password-protection.

Write protection Allows read-only access to the CPU, HMI access, and PLC-to-PLC communications without password-protection.

Password is required for modifying (writing to) the CPU and for changing the CPU mode (RUN/STOP).

Read/write protection Allows HMI access and all forms of PLC-to-PLC communications without password-protection.

Password is required for reading the data in the CPU, for modifying (writing to) the CPU, and for changing the CPU mode (RUN/STOP).

With password protection, you can use instructions for process control, monitoring, and communications without restrictions. Some functions, such as the "Set time of day/date"

instruction, should not be locked with a password. For example: To modify the tags in a CPU that was configured for read/write protection, you must enter the configured password because this function requires write access.

3.2 Data storage, memory areas and addressing

The CPU provides several options for storing data during the execution of the user program:

● Memory locations: The CPU provides a variety of specialized memory areas, including inputs (I), outputs (Q), bit memory (M), data block (DB), and local or temporary memory (L). Your user program accesses (reads from and writes to) the data stored in these memory areas.

● Data block (DB): You can include DBs in your user program to store data for the code blocks. The data stored in a DB is not deleted when the data block is closed or when the execution of the associated code block comes to an end. There are two categories of DBs:

– Global DB: Stores data that can be used by all other blocks

– Instance DB: Stores data for a specific FB and is structured by the parameters for the FB

● Temp memory: Whenever a code block is called, the operating system of the CPU allocates the temporary, or local, memory (L) to be used during the execution of the block. When the execution of the code block finishes, the CPU reallocates the local memory for the execution of other code blocks.

● References such as I0.3 and Q1.7 access the process image. To access the physical input or output, append the reference with ":P" (such as I0.3:P, Q1.7:P, or "Stop:P").

长沙工控帮教育科技有限公司整理

PLC concepts

3.2 Data storage, memory areas and addressing

Each different memory location has a unique address. Your user program uses these addresses to access the information in the memory location.

Memory area Description Force Retentive

Copied from physical inputs at the beginning

of the scan cycle Yes No

I Process image input

I_:P

(Physical input) Immediate read of the physical input points

on the CPU, SB, and SM No No

Copied to physical outputs at the beginning

of the scan cycle Yes No

Q Process image output

Q_:P

(Physical output) Immediate write to the physical output points

on the CPU, SB, and SM No No

M Bit memory Control and data memory No Yes

L Temp memory Temporary data for a block local to that

block No No

DB Data block Data memory and also parameter memory

for FBs No Yes

To access a bit in a memory area, you specify the address, which includes the memory area identifier, the byte address, and the bit number. An example of accessing a bit (which is also called "byte.bit" addressing) is shown below. In this example, the memory area and byte address (I = input, and 3 = byte 3) are followed by a period (".") to separate the bit address (bit 4).

③ Period separates the byte address from

the bit number ⑥ Bits of the selected byte

You can access data in most memory areas (I, Q, M, DB, and L) as bytes, words, or double words by using the "byte address" format. To access a byte, word, or double word of data in the memory, you must specify the address in a way similar to specifying the address for a bit. This includes an area identifier, data size designation, and the starting byte address of the byte, word, or double word value. Size designators are B (byte), W (word) and D (double-word). (Examples: IB0, MW20, QD8)

To immediately access the physical inputs and physical outputs, append a ":P" to the address or tag (such as I0.3:P, Q1.7:P, or "Stop:P").

长沙工控帮教育科技有限公司整理

PLC concepts 3.2 Data storage, memory areas and addressing

Accessing the data in the memory areas of the CPU

The TIA Portal facilitates symbolic programming. Typically, tags are created either in PLC tags, a data block, or in the interface at the top of an OB, FC, or FB. These tags include a name, data type, offset, and comment. Additionally, in a data block, an initial value can be specified. You can use these tags when programming by entering the tag name at the instruction parameter. Optionally you can enter the absolute operand (memory, area, size and offset) at the instruction parameter. The examples in the following sections show how to enter absolute operands. The % character is inserted automatically in front of the absolute operand by the program editor. You can toggle the view in the program editor to one of these: symbolic, symbolic and absolute, or absolute.

I (process image input): The CPU samples the peripheral (physical) input points just prior to the cyclic OB execution of each scan cycle and writes these values to the input process image. You can access the input process image in bits, bytes, words, or double words. Both read and write access is permitted, but typically, process image inputs are only read.

Bit I[byte address].[bit address] I0.1

Byte, Word, or Double Word I[size][starting byte address] IB4, IW5, or ID12

By appending a ":P" to the address, you can immediately read the digital and analog inputs of the CPU, SB or SM. The difference between an access using I_:P instead of I is that the data comes directly from the points being accessed rather than from the input process image. This I_:P access is referred to as an "immediate read" access because the data is retrieved immediately from the source instead of from a copy that was made the last time the input process image was updated.

Because the physical input points receive their values directly from the field devices connected to these points, writing to these points is prohibited. That is, I_:P accesses are read-only, as opposed to I accesses which can be read or write.

I_:P accesses are also restricted to the size of inputs supported by a single CPU, SB, or SM, rounded up to the nearest byte. For example, if the inputs of a 2 DI / 2 DQ SB are configured to start at I4.0, then the input points can be accessed as I4.0:P and I4.1:P or as IB4:P.

Accesses to I4.2:P through I4.7:P are not rejected, but make no sense since these points are not used. Accesses to IW4:P and ID4:P are prohibited since they exceed the byte offset associated with the SB.

Accesses using I_:P do not affect the corresponding value stored in the input process image.

Bit I[byte address].[bit address]:P I0.1:P

Byte, Word, or Double word I[size][starting byte address]:P IB4:P, IW5:P, or ID12:P

Q (process image output): The CPU copies the values stored in the output process image to the physical output points. You can access the output process image in bits, bytes, words, or double words. Both read and write access is permitted for process image outputs.

Bit Q[byte address].[bit address] Q1.1

Byte, Word, or Double word Q[size][starting byte address] QB5, QW10, QD40

By appending a ":P" to the address, you can immediately write to the physical digital and analog outputs of the CPU, SB or SM. The difference between an access using Q_:P instead

长沙工控帮教育科技有限公司整理

PLC concepts

3.2 Data storage, memory areas and addressing

of Q is that the data goes directly to the points being accessed in addition to the output process image (writes to both places). This Q_:P access is sometimes referred to as an

"immediate write" access because the data is sent immediately to the target point; the target point does not have to wait for the next update from the output process image.

Because the physical output points directly control field devices that are connected to these points, reading from these points is prohibited. That is, Q_:P accesses are write-only, as opposed to Q accesses which can be read or write.

Q_:P accesses are also restricted to the size of outputs supported by a single CPU, SB, or SM, rounded up to the nearest byte. For example, if the outputs of a 2 DI / 2 DQ SB are configured to start at Q4.0, then the output points can be accessed as Q4.0:P and Q4.1:P or as QB4:P. Accesses to Q4.2:P through Q4.7:P are not rejected, but make no sense since these points are not used. Accesses to QW4:P and QD4:P are prohibited since they exceed the byte offset associated with the SB.

Accesses using Q_:P affect both the physical output as well as the corresponding value stored in the output process image.

Bit Q[byte address].[bit address]:P Q1.1:P

Byte, Word, or Double word Q[size][starting byte address]:P QB5:P, QW10:P or QD40:P

M (bit memory area): Use the bit memory area (M memory) for both control relays and data to store the intermediate status of an operation or other control information. You can access the bit memory area in bits, bytes, words, or double words. Both read and write access is permitted for M memory.

Bit M[byte address].[bit address] M26.7

Byte, Word, or Double Word M[size][starting byte address] MB20, MW30, MD50

Temp (temporary memory): The CPU provides temp (local) memory for each of the three OB priority groups: 16 Kbytes for startup and program cycle, including associated FBs and FCs;

4 Kbytes for standard interrupt events including FBs and FCs; and 4 Kbytes for error interrupt events including FBs and FCs.

Temp memory is similar to M memory with one major exception: M memory has a "global"

scope, and temp memory has a "local" scope:

● M memory: Any OB, FC, or FB can access the data in M memory, meaning that the data is available globally for all of the elements of the user program.

● Temp memory: Access to the data in temp memory is restricted to the OB, FC, or FB that created or declared the temp memory location. Temp memory locations remain local and are not share by different code blocks, even when the code block calls another code block. For example: When an OB calls an FC, the FC cannot access the temp memory of the OB that called it.

The CPU allocates the temp memory on an as-needed basis. The CPU allocates the temp memory for the code block at the time when the code block is started (for an OB) or is called (for an FC or FB). The allocation of temp memory for a code block might reuse the same temp memory locations previously used by a different OB, FC or FB. The CPU does not initialize the temp memory at the time of allocation and might contain any value.

You access temp memory by symbolic addressing only.

长沙工控帮教育科技有限公司整理

PLC concepts 3.2 Data storage, memory areas and addressing

DB (data block): Use the DB memory for storing various types of data, including intermediate status of an operation or other control information parameters for FBs, and data structures required for many instructions such as timers and counters. You can specify a data block to be either read/write or read only. You can access data block memory in bits, bytes, words, or double words. Both read and write access is permitted for read/write data blocks. Only read access is permitted for read-only data blocks.

Bit DB[data block number].DBX[byte

address].[bit address] DB1.DBX2.3 Byte, Word, or Double Word DB[data block number].DB

[size][starting byte address] DB1.DBB4, DB10.DBW2, DB20.DBD8

Addressing the I/O in the CPU and I/O modules

When you add a CPU and I/O modules to your configuration screen, I and Q addresses are automatically assigned.

• CPU inputs are bits addressed from I0.0 to I0.7 and I1.0 to I1.5 (14 total points)

• CPU outputs are bits addressed from Q0.0 to Q0.7 and Q1.0 to Q1.1 (10 total points)

• CPU analog inputs are addressed by the words IW64 and IW66 (2 analog points, 4 bytes total)

• DI16 inputs are address I8.0 through I9.7

• AI4 / AO2 inputs are IW112, IW114, IW116, IW118 and outputs are QW112 and QW114

• DI8 / D08 inputs are I16.0 through I17.7 and outputs are Q16.0 through Q17.7 The figure shows an example of a CPU 1214C with two SMs.

You can change the default addressing by selecting the address field in the configuration screen and typing new numbers. Digital inputs and outputs are assigned in complete 8 bit bytes, whether the module uses all the points or not. Analog inputs and outputs are assigned in groups of 2 points (4 bytes). In this example, you could change the address of the DI16 to 2..3 instead of 8..9. The tool will assist you by changing address ranges that are the wrong size or conflict with other addresses.

长沙工控帮教育科技有限公司整理

PLC concepts