S7-300 from entry to the master of 100 classic questions and answers - Database & Sql Blog Articles

NRF24L01 module 2.4G wireless module RF communication NRF24L01 module

1: How to avoid "communication failure" messages when using the CPU 315F and ET 200S?
With the CPU S7 315F, ET 200S and fail-safe DI/DO modules, you will call the fail-safe program of OB35. Also, you have accepted the default settings for all monitoring times and are willing to receive a "communication failure" message. The OB 35 is set to 100 milliseconds by default. You have set the F/monitor time of the FI/O module to 100 milliseconds, so the I/O module is addressed at least once every 100 milliseconds. However, since OB 35 is called every 100 milliseconds, a communication failure occurs. To ensure that the OB35 scan interval and F monitoring time are different, please ensure that the F monitoring time is greater than the OB35 scan interval.
This problem can occur with the S7 distributed safety system up to V5.2 SP1 and 6ES7138-4FA00-0AB0, 6 ES7138-4FB00-0AB0, 6ES7138-4CF00-0AB0. In the new module, the F monitoring time is set to 150 milliseconds.

2: What is the monitoring time of the S7-300 CPU on the PROFIBUS when the DP slave is not available?
When operating a PROFIBUS network with a DP slave on the PROFIBUS interface of the CPU, you want to check whether the desired configuration matches the actual configuration during startup. Two different times are given on the Startup tab in the CPU Properties dialog.

3: How to judge the power or buffer error, such as: battery failure?
If an error occurs in the power supply (S7-400 only) or in the buffer, the CPU operating system accesses OB81. After the error is corrected, revisit OB81. In the event of a battery failure, the S7-400 only accesses OB81 if the BATT.INDIC switch in the battery test is active. If OB81 is not configured, the CPU does not enter the operating state STOP. If OB81 is not available, the CPU will remain running when there is a power failure.

4: What should you watch out for when assigning addresses to I/O modules (centralized or distributed) on the S7CPU?
Please note that the created data area (eg a double word) cannot be configured on the boundary of the process image, since only the area below the boundary can be read into the process image in this data block, so it is not possible to access from the process image. data. Therefore, these configuration rules do not support this situation: for example, configuring an input double word on address 254 of a process image of a 256-byte input. If this is necessary, the size of the process image must be adjusted accordingly (in the Properties of the CPU).

5: How to perform basic communication of global data in S7 CPU? What should I pay attention to when communicating?
Global data communication is used to exchange small-capacity data. Global data (GD) can be:
The data timer and counter function data exchange in the input and output tag data blocks refers to the exchange of data in the form of data packets between CPUs connected to the one-way or two-way GD ring. The GD ring is identified by the GD ring number.
One-way connection: A CPU can send GD packets to multiple CPUs.
Two-way connection: connection between two CPUs: Each CPU can send and receive a GD packet.
It must be ensured that the receiving CPU does not acknowledge the receipt of global data. If you want to exchange data via the corresponding communication block (SFB, FB or FC), you must make a connection between the communication blocks. By defining a connection, the design of the communication block can be greatly simplified. This definition is valid for all called communication blocks and does not need to be redefined each time.

6: Can I use an S7-400 memory card for the CPU 318-2DP?
In normal operation, only the "short" memory card with order numbers 6ES7951-1K... (Flash EPROM) and 6ES7951-1A... (RAM) can be used.

7: Although the LED light is on, why is the CPU 31xC unable to read the full input from the default addresses 124 and 125?
For the following models of CPU, check if the 24V voltage is connected to pin 1. The LED is controlled by the input current. The 24V voltage on pin 1 requires further processing.
313C (6ES7 313-5BE0.-0AB0), 313C-2DP (6ES7 313-6CE0.-0AB0), 313C-2PTP (6ES7 313-6BE0.-0AB0), 314C-2DP (6ES7 314-6CF0.-0AB0), 314C-2PTP (6ES7 314-6BF0.-0AB0)

8: What should I do if the PROFINET interface occasionally has a communication error when configuring the PN interface of the CPU 31x-2 PN/DP?
Make sure that all components (conversions) in Ethernet (PROFINET) support 100 Mbit/s full-duplex basic operation. Avoid center splitting the network because these devices can only work in half-duplex mode.

9: What is the meaning of the “clock” correction factor in the hardware configuration editor?
In the hardware configuration, you can enter a correction factor in the "Clock" > field via CPU > Properties > Diagnostics/Clock. This correction factor only affects the hardware clock of the CPU. The time interrupt is derived from the system clock and has nothing to do with the hardware clock settings.

10: How to realize bidirectional data transmission between master and slave by function block with PROFIBUS DP?
In the master station plc, the data exchange with the slave can be done by calling SFC14 "DPRD_DAT" and SFC15 "DPWR_DAT", while for the slave, FC1 "DP_SEND" and FC2 "DP_RECV" can be called to complete the exchange of data.

11: What identification data can be read from the S7 CPU?
The following identification data can be read out via SFC 51 "RDSYSST":
The order number and CPU version number can be read. To do this, use SFC 51 and SSL ID 0111 and use the following indexes:
1 = module identification
6 = basic hardware identification
7 = basic firmware identification

12: How do you program the loadable communication blocks FB14 ("GET") and FB15 ("PUT") for data exchange on the S7-300 with CPU 317-2PN/DP?
In order to exchange data between two S7-300 stations using the CPU 317-2PN/DP via an S7 connection, the S7 connection is configured using NetPro. In S7 communication, the communication function block must be called. Module FB14 ("GET") is used to retrieve data from the remote CPU and module FB15 ("PUT") is used to write data to the remote CPU. The function blocks are included in the standard library of STEP 7 V5.3. <
Attributes of the communication modules FB14 ("GET") and FB15 ("PUT") of the CPU 317-2PN/DP:
FB14 and FB15 are asynchronous communication functions. The operation of these modules may span multiple OB1 cycles. Activate FB14 or FB15 with the input parameter REQ. DONE, NDR or ERROR indicates the end of the job. PUT and GET can communicate at the same time through the connection.
Note: The communication blocks in the library SIMATIC_NET_CP cannot be used for the CPU317-2PN/DP.

13: What should I pay attention to for the compact CPU 313C-2 PtP and CPU 314-2 PtP job synchronization processing?
In the user program, it is not possible to program both SEND jobs and FETCH jobs.
That is: As long as the SEND job (SFB 63) is not completely terminated (DONE or ERROR), the FETCH job (SFB 64) cannot be called (even when REQ=0). As long as the FETCH job (SFB 64) is not completely terminated (DONE or ERROR), the SEND job (SFB 63) cannot be called (even when REQ=0). When processing an active job (SEND job, SFB 63 or FETCH job, SFB 64), a passive job (SERVE job, SFB 65) can be processed at the same time.

14: Can be MICR. Does master420 to 440 operate as a configuration axis (location external detection) with the CPU 317T?
Yes, but in terms of power and accuracy, the requirements for configuring the axes are very different. In the case of high-speed, the servo drives SIMODRIVE 611U, MASTERDRIVES MC or SINAMICS S must be operated together with the CPU 317T. The MICROMASTER series also meets power and accuracy requirements at low requirements.

15: How do you configure direct data exchange (inter-node communication) between two CPU modules that have been configured as DP slaves?
The two CPU stations are configured as DP slaves and are operated by the same DP master. The communication between them can complete direct data exchange by configuring the switching mode to DX.

16: How do I communicate using SFC65, SFC66, SFC67 and SFC68?
For one-way basic communication, the system function SFC67 (X_GET) is used to read data from a passive station and the system function SFC68 (X_PUT) is used to write data to a passive station (server). These blocks are only called in the active station. For a two-way basic communication, the system function SFC65 (X_SEND) in the station is called in which you want to send data to another active station. In an active active receiving station, the data is recorded via the system function SFC66 (X_RCV).
In both types of basic communication, up to 76 bytes of user data can be processed per block call. For S7-300 CPUs, the data consistency for data transfer is 8 bytes, and for S7-400 CPUs it is full length. If connected to the S7-200, it must be taken into account that the S7-200 can only be used as a passive station.

17: What is a freely allocated I/O address?
The free allocation of addresses means that you can freely assign an address to each module (SM/FM/CP). The address assignment takes place in STEP 7. The starting address is defined first, and the other addresses of the module are referenced to it.
Advantages of freely assigning addresses: Since there is no address gap between modules, the available address space can be optimally used. When creating standard software, the configuration of the S7-300 involved can be disregarded during the assignment of the address.

18: What can the diagnostic buffer do?
Improve the availability of your system by identifying fault sources faster. Evaluate the last event before STOP and look for the cause of the STOP.
The diagnostic buffer is a circular buffer with a single diagnostic entry that is displayed in the sequence of events; the first entry shows the most recent event. If the buffer is full, the oldest event will be overwritten by the new entry. Depending on the CPU, the size of the diagnostic buffer is fixed or fixed, or it can be set via parameters in HW Config.

19: What are the entries in the diagnostic buffer?
1) Fault events
2) Operating mode transitions and other operational events important to the user
3) User-defined diagnostic events (with SFC52 WR_USMSG)
In the operating mode STOP, as few events as possible are stored in the diagnostic buffer so that the user can easily find the cause of the STOP in the buffer. Therefore, entries are stored in the diagnostic buffer only when the event requires the user to generate a response (such as scheduling a system memory reset, the battery needs to be recharged) or when important information (such as firmware update, station failure) must be registered.

20: How do you determine the size of the MMC to completely store the STEP 7 project?
In order to choose the right MMC for the project, you need to know the size of the entire project and the size of the block to be loaded. You can determine the size of your project as described below:
1) First archive the STEP 7 project. Then open the archived item in the Windows Explorer and determine its size (check the item and right click). This will tell you the size of the archive.
2) Load the block into the CPU. You still need to select "PLC > Module Information > Memory". Here, in "Load memory RAM + EPROM", you can see the size of the allocated load memory.
3) This value must be added to the size of the archived item that has been determined. This gives you the total amount of memory needed to save the entire project on an MMC.

21: Which settings will be retained after the CPU is fully reset?
When the CPU is reset, the memory is not completely deleted. The entire main memory is completely deleted, but the data loaded in the memory and the data stored on the Flash-EPROM memory card (MC) or micro memory card (MMC) are all retained. In addition to loading memory, timers (except CPU 312 IFM) and diagnostic buffers are also reserved. A CPU with an MPI interface or a combined MPI/DP interface retains the current address and baud rate used by the interface only before all resets. On the other hand, another PROFIBUS address is also completely deleted and can no longer be accessed.
Important: After resetting the PG/PC, communication with the CPU can only be established via the MPI or MPI/DP interface.

22: Why can't I access the CPU online via MPI?
If the MPI parameters have been changed on the CPU, check the hardware configuration. These values ​​can be compared to the parameters under "Set PG/PC interface" to see if there is any inconsistency.
Or you can do this: open a new project and create a new hardware configuration. Set the respective values ​​for the address and transfer speed in the properties of the MPI interface of the CPU. Write the "empty" item to the memory card. Insert the memory card into the CPU and then re-open the voltage of the CPU to transfer the settings on the memory card to the CPU. The current settings of the MPI interface have now been transferred, and as such, the connection can be established as long as the interface is not faulty. This method is suitable for all S7-CPUs with a memory card interface.

23: What is the purpose of the error OB?
If a described error occurs (see file 1), the corresponding OB will be called and processed. If the OB is not loaded, the CPU goes to STOP (exceptions: OB70, 72, 7 3 and 81)
The S7-CPU can recognize two types of errors:
1) Synchronization errors: These errors are triggered during the processing of a particular operation and can be attributed to a specific part of the user program.
2) Asynchronous errors: These errors cannot be directly attributed to a running program. These errors include errors in the priority class, errors in the automation system (faulty modules) or redundant errors.


24: Which "fault OBs" should be programmed in the DP slave or CPU315-2DP type master?
When configuring a CPU315-2DP station as a slave, the following OBs must be programmed in the STEP7 program in order to evaluate the error information of the distributed I/O type:
OB 82 diagnostic interrupt OB, OB 86 subrack failure OB, OB 122 I/O access error
1) Diagnostics OB82: If a module that supports diagnostics and has released a diagnostic interrupt has identified an error, it issues a diagnostic interrupt request to the CPU for both the incoming event and the outgoing event. The operating system then calls OB82. The local variable of OB82 contains the logical base address of the defective module and the diagnostic data of 4 bytes. If you have not programmed OB82 yet, the CPU enters the "Stop" mode. You can block or delay the diagnostic interrupt OB and re-release it via SFC 39 - 42.
2) Subrack failure OB86: If a DP master system is identified or a distributed I/O station is faulty (an event that is also an outgoing event for an incoming event), the operating system of the CPU calls OB 86. If OB 86 is not programmed but such an error occurs, the CPU enters the "Stop" mode. You can block or delay OB86 and re-release it via SFC 39 - 42.
3) I/O access error OB122: An error occurred while accessing the data of a module, the operating system of the CPU called OB 122. For example, if the CPU recognizes a read error while accessing data for a single module, the operating system calls OB 122. The OB 122 operates in the same priority class as the interrupt block. If OB 122 is not programmed, the CPU changes from "Run" mode to "Stop" mode.

25: Why is the reserved area rewritten in some cases?
In the hardware configuration of STEP 7, several operand areas can be defined as "reserved areas". This will preserve the contents of these areas even after the power is turned off, even if there is no backup battery. If a block is defined as a "reserved block" and it does not exist in the CPU or is only temporarily installed, some of these areas will be overwritten. After the power is turned on/off, other content will be found in the relevant area.

26: Why can't I load the contents of the flash card into the S7 300 CPU?
Your project is on a flash card. Now use it to load the S7 300. However, after the end of the load, it is found that the CPU's RAM is still empty. The reason for this problem is that there are unhandled, "wrong" organization blocks in your program (for example, OB86 does not have a DP interface). After resetting and restarting the CPU, the RAM is still empty. The diagnostic buffer will prompt for some information on this "unable to load" block.

27: When using the CPU315-2DP as a slave and the diagnostic address of the CPU315-2DP as a master When configuring a CPU315-2DP station, you use the S7 tool "H/W CONFIG" to assign the diagnostic address. If a fault occurs, these diagnostic addresses are added to the tag "OB82_MDL_ADDR" of the diagnostic OB. You can analyze this variable in OB82 to identify the faulty station and react accordingly.
Here's an example of how to assign a diagnostic address:
Step 1: Configure the slave with the CPU315-2DP and assign a diagnostic address, such as 422.
Step 2: Configure the master via CPU315-2DP Step 3: Link the configured slave to the master and assign a diagnostic address, such as 1022.

28: What settings do I need to make for the DP slave interface of the S7-300 CPU before I can use it for routing?
If you use the CPU as an I-Slave and the CPU also functions as an S7 router, please note the following:
The DP interface of the slave used for routing must be set to active. This can be done in HW Config: in the properties dialog of the DP interface, the option "Commissioning/Test operation" or "Programming, status/modify..." must be activated. Notes on these settings can be found in the table below.
For S7 routing connections, there are 4 available connection resources - independent of any other connection resources. There is no connection resource or S7 basic communication using PG/OP.
If a connection must be made via the DP interface to a communication partner located in its rack (as in the CP 343-1), a routing connection is also used. For a connection to a communication partner located in its rack via the MPI interface, no routing connection resources are used, since in this case, the partner can be reached directly. Note: This does not apply to CPU 318.

29: Why is there no return value when using the internal runtime schedule of the S7-300 CPU?
When the CPU 312IFM to 316-2DP parameterizes the system function blocks SFC2, SFC3 and SFC4, an identifier greater than "B#16#0" is specified for an operating schedule, then an error occurs and the required functions are not possible use. In this case, the identifier "8080h" will be output at the "RETVAL" output of the block.
Note: For these CPUs, only one timer is available. So you should only use the identifier "B#16#0". The system function SFC2 "SET_RTM" must not be called in a cycle block (OB1, OB35), but it should be called at the restart OB (OB100). You can also start the block with an external trigger. Otherwise, the block will always reset the running chronograph and never finish counting.

30: How are variables stored in temporary local data?
The L stack always starts with the address "0". In the L stack, the same number of bytes are reserved for each block of data as static or local data held by each block.
When a block terminates, its space is then re-released. The pointer always points to the first byte of the currently open block.

31: Is the running time counter reset after the CPU has been completely reset?
When using the S7-300, there is a difference between a hardware clock (built-in "real-time clock") and a CPU with a software clock. For CPUs that have a software clock without a backup battery, the runtime counter is deleted after the CPU is completely reset. For CPUs with hardware clocks with backup batteries, the last value of the runtime counter is retained after the CPU is fully reset. Similarly, the runtime values ​​of the CPU 318 and all S7-400 CPUs are retained after the CPU has been completely reset.

32: How do you configure an S7 CPU that is not in the same project as a DP slave of my S7 DP master module?
By default, only one S7 CPU can be configured as a slave in STEP 7, if the station is in the same project. The station then appears as "CPU 31x-2 DP" in the hardware catalog under "PROFIBUS-DP > Configured stations". In this way, you can set up a link between the DP master and the DP slave.
There is also an option to configure an S7 CPU that is not in the same project as the master as a slave. Do as follows:
The DP slave is configured as usual.
Download the GSD file of the S7-300 CPU to be used as a slave from the Internet. This file is located under the "PROFIBUS GSD file / SIMATIC" on the customer support website.
Open the SIMATIC Manager and hardware configuration.
Open "Options; Install new GSD..." and insert the GSD file you just downloaded into the hardware directory. (Note: there is no need to open any windows in HW Config during this process)
Update the hardware catalog with "Options; Update Catalog". <
You can now configure your DP master. The S7-300 CPU as a slave can be found under "PROFIBUS-DP > More Field Devices > SPS".
Note: If you are manually joining the DP slave, to ensure the bus parameters, the PROFIBUS address of the DP slave and its I/O configuration must be identical in both projects.

33: Is the effect of power failure the same as a full reset without a backup battery?
Different. When the CPU is completely reset, its hardware configuration information is deleted (except for the MPI address), the program is deleted, and the residual magnetic memory is also cleared.
The power is turned off without a backup battery and a memory card, and the hardware configuration information (except the MPI address) and the program are deleted. However, the residual magnetic memory is not affected. If the program is reloaded in this case, it works with the old value of the remanent memory. For example, these values ​​usually come from the first 8 counters. Failure to take this into account can lead to dangerous system conditions.
Recommendation: Always perform a full reset after a power outage without a backup battery and a memory card.

34: Is the 2-wire sensor connected to the analog input of the compact CPU?
Two-wire and 4-wire sensors can be connected to the analog input of the CPU 300C. When using a 2-wire sensor, set "I = Current" to the measurement type in the hardware configuration, the same as for the 4-wire sensor.
Note: Please note that the compact CPU only supports active sensors (4-wire sensors). If a passive sensor (2-sensor) is used, an external power supply must be used.
Warning: Please note the maximum input current allowed. 2-wire sensors may exceed the maximum allowable current in the event of a short circuit. The maximum allowable current specified in the technical data is 50 mA (breaking limit). For this situation (for example, a current limit on a 2-wire sensor or a PTC thermistor in series with the sensor), ensure adequate protection.

35: Can the SM322-1HH01 work with a load voltage of 24 V AC?
Yes, you can also use the SM322-1HH01 with a load voltage of 24 V AC.

36: What is the minimum load voltage and current required to ensure the SM322-1HF01 is turned on?
The SM322-1HF01 relay module requires 17 V and 8 mA to ensure proper opening and closing. For the life of the contacts, such values ​​are better than the values ​​of this module (10 V and 5 mA) provided in the manual. The values ​​specified in the manual should be considered as the minimum required value.

37: Which 24V digital input modules (6ES7 321-xBxxx- ...) need to be connected to the power supply?
Power pin connection (L+ / M) for 24V digital input module.

38: Can I use the SM321 module (DI16 x 24V) in the ET200M?
The module SM321 (MLFB 6ES7 321-7BH00-0AB0) can also be used in the ET200M. The CPU 31x-2DP acts as the DP master or the communication processor CP CP342-5 acts as the DP master. The module can also be connected to an S7-400 CPU via the ET200M and S7-400 communication processor CP443-5.

39: What is the address occupied by the SM323 digital card?
The SM323 module is available in 16-bit type (6ES7 323-1BL00-0AA0) and 8-bit type (6ES7 323-1BH00-0AA0). For 16-bit type modules, the inputs and outputs occupy two addresses "X" and "X+1". If the base address of SM323 is 4 (ie X=4; slot is 5), then the input is addressed under addresses 4 and 5, and the output address is also addressed under addresses 4 and 5. In the wiring view of the module, the input byte "X" is at the top of the left and the output byte "X" is at the top of the right.
For 8-bit type modules, the input and output each occupy one byte and they have the same byte address. If a fixed slot is used for addressing, SM323 is inserted into slot 4, then the input address is I 4.0 to I 4.7 and the output address is Q 4.0 to Q 4.7.

40: Can I replace SM321-1CH80 with SM321-1CH20 without changing the hardware configuration?
The technical parameters of the SM321-1CH20 and SM321-1CH80 modules are the same. The difference is that the SM321-1CH80 can only be applied to a wider range of environmental conditions. So you don't need to change the hardware configuration.

41: What must I pay attention to when making direct I/O access?
Note that in an S7-300 configuration, if you make a direct read access to the I/O across the module (using the command to read a few bytes at a time), an incorrect value is read. You can view the specific address through hardware.

42: Does the SM321 module need to be connected to the DC 24V?
No, if it is the SM 321 module with MLFB 6ES7 321-1BH02-0AA0, it is no longer necessary to connect DC 24V.

43: How do you plan the analog module SM374 in the STEP 7 hardware configuration? How do I find this module in the hardware catalog?
The analog module SM374 can be used in three modes: as a 16-channel digital input module, as a 16-channel digital output module, as a mixed digital input/output module with 8 inputs and 8 outputs.
Now configure the SM374 according to the module you need to simulate, that is to say;
If the SM 374 is used as a 16-channel input module, configure a 16-channel input module - recommended: SM 321: 6ES7321-1BH01-0AA0,
If the SM 374 is used as a 16-channel output module, configure a 16-channel output module - recommended: SM 322: 6ES7322-1BH01-0AA0,
If the SM 374 is used as a hybrid I/O module, configure a hybrid I/O module (8 inputs, 8 outputs) - recommended: SM 323: 6ES7323-1BH01-0AA0.

44: When the current is measured, when the sensor is short-circuited, will the analog input I+ of the module 6ES7 331-1KF0.-0AB0 be destroyed?
When the current is measured, the sensor short circuit occurs and the analog input I+ of the module 6ES7 331-1KF0.-0AB0 is not destroyed. This module has built-in overcurrent protection. Each 50 ohm resistor in the module has a PTC element on the front to prevent the input channel of the module from being damaged.
Note that the maximum allowable long-term input voltage is 12V and the short-term (up to 1 second) value is 30V.

45: If the CPU is turned off, does the 2-wire measurement transmitter continue to supply power?
If the transmitter module is plugged into position "D" and the module is powered by an external voltage on pins 1 and 20, the 2-wire measuring transducer continues to supply power. Even if the CPU is turned off, its supply current remains unchanged.

46: When using the S7-300 analog input module to measure temperature (Fahrenheit), can you use the absolute error limits listed in the module documentation?
It is not possible to use the specified error limit directly. Both basic and operational errors are stated in terms of absolute temperature and Celsius temperature. It must be multiplied by a factor of 1.8 to convert it to a Fahrenheit temperature unit.
Example: S7-300 AI 8 x RTD: The specified temperature input operation error is +/- 1.0 degrees Celsius. The maximum acceptable error when measured in degrees Fahrenheit is +/- 1.8 degrees Fahrenheit.

47: Why can't I read the constant current used to read the impedance on the analog input block with a commercial digital multimeter?
Almost all S5/S7 analog input devices still work in a complex manner, ie all channels are plugged into the only one AD converter in sequence. This principle also applies to the constant current necessary to read the impedance. Therefore, the current flowing through the resistor to be read is only used for short-term readings. For a SM331-7KF02-0AB0 with a selected interface to suppress "50Hz" and 8 parameterized channels, this means that the current will flow approximately every 180ms, with a 20ms read impedance each time.

48: Why is the voltage output of the S7-300 analog output group out of tolerance? What is the purpose of terminals S+ and S-?
The following description applies to all analog output modules SM 332:
When using the analog output module SM 332, care must be taken to return the assignment of the inputs S+ and S-. They serve the purpose of compensating for performance impedance. When a separate wire with S+ and S- is used to connect the two contacts of the actuator, the analog output regulates the output voltage so that the voltage actually present on the operating mechanism is the desired voltage.
If you want to get compensation, the actuator must be connected with 4 wires. This means that for the first channel, you need to:
The output voltage is connected to the actuator via pin 3 and pin 6.
Assign pin 4 and pin 5 of the actuator.
If you do not want to get compensation, simply jump on pins 3-4 and 5-6 on the front switch.
Note: Due to the open sensor terminals (S+ and S-), the output voltage is adjusted to a maximum of 140 mV (for 10V). g For this assignment, the 0.5% voltage output usage error limit cannot be maintained.

49: How to connect a potentiometer to 6ES7 331-1KF0-0AB0?
The sampling end and the head end of the potentiometer are connected to M+, the end is connected to M-, and S- and M- are connected together.
Note: The maximum strip resistance is 6K. If the potentiometer supports direct output of a variable voltage, the potentiometer should be connected to V+ at the head end and M- at the M end.

50: How do I connect a PT100 temperature sensor to the analog input module SM331?
The resistance of the PT100 thermal resistance varies with temperature. If a constant current flows through the thermal resistor, the voltage drop across the thermal resistor changes with temperature. A constant current is applied to the contacts Ic+ and Ic-. The analog module SM331 measures the change in current at M+ and M-. The temperature can be determined by measuring the voltage.
There are three types of connections from the PT100 to the analog input group: the 4-wire connection gives the most accurate measurements.
* Note:
1) The formula for 3-wire connection only indicates the actual measurement process of the analog input module SM331 (MLFB number is 6ES7 331-7Kxxx-0AB0)b".
2) In the S7-300 series, there are some analog inputs that have been measured multiple times. They specify the line resistance of the common return line and make mathematical compensation. The accuracy is almost comparable to a 4-wire connection. An example of such a module is SM331 (MLFB No. 6ES7 331-7PF00-0AB0).
3) The formula given still applies to the main physical relationship, but does not include an efficient measurement process to determine the resistance of the PT100. 51: Can I connect a HART measuring transducer to a conventional analog input module of the SIMATIC S7-300 series?
Other S7-300 analog input modules can also be used if other HART features of the HART measuring transducer are not required. For example, you can use the module 6ES7 331-7KF0x-0AB0 or ​​a 4-channel module with isolation (eg 6ES7 331-7RD00-0AB0). To do this, set the integration time to 16.66ms, 20ms or 100ms. For connecting to a handheld device or communicating with a handheld device, a 250-Ohm resistor must be connected in series in the circuit.
Note: If you want to program a HART measuring transducer via a controller (eg SIMATIC PDM), you must use a corresponding HART module (eg 6ES7 331-7TB00-0AB0 or ​​6ES7 332-5TB00-0AB0).

52: How to avoid the fluctuation of the analog input in the SM335 module?
The following wiring instructions are available for the following analog input/output modules of the MLFB: 6ES7335-7HG00-0AB0, 6ES7335-7HG01-0AB0
Check if you are using an ungrounded sensor mounted on an insulated rack or check that your sensor is grounded.
Sensor mounted on the insulated frame: connect the ground terminal Mana (pin 6) to the measuring channel M0 (pin 10), M1 (pin 12), through the shortest path (possibly connected directly to the connector at the front end). M2 (pin 14) and M 3 (pin 16) and central ground point (CGP).
Grounding sensor: Make sure the sensor has a good equipotential bonding. Then isolate the connection from M to Mana to the central ground point. Place the shield on both sides.

53: In the S7-300F, is it possible to combine the error check and standard modules on the central rack?
Error-proof and non-error-proof (standard) digital E/A modules can be mixed in the central rack of the S7-300F. For this reason, as in the ET200M, an isolation module (MLFB: 6ES7195-7KF00-0XA0) is required to isolate the error-proof module and the standard module in the central and expansion racks.
Please observe the following installation guidelines: Standard modules (IM, SM, FM, CP) must be inserted into the slot on the left side of the isolation module. The error-proof digital E/A module must be inserted into the slot on the right side of the isolation module.

54: Can I connect the sensor/actuator from explosion-proof zone 0 or explosion-proof zone 1 directly to the S7-300 Ex(i) module?
Sensors/actuators from explosion-proof zone 0 cannot be connected. However, the sensor/actuator from explosion-proof zone 1 can be connected directly.
The Ex(i) module is tested in accordance with [EEx ib] IIC. Therefore, there are two explosion-proof barriers on the module. However, it is necessary to obtain [EEx ia] approval to use the sensor/actuator from explosion-proof zone 0. (There should be three explosion-proof barriers on the module).

55: What should you pay special attention to when using the FM 355 or FM 355-2 in SIMATIC PCS 7?
For example, if you want to use the FM 355 or FM 355-2 in a redundant ET 200M station, please note the following important points:
There are two function blocks available for connecting the FM 355. For example, if you need to use the "Replace module during operation" (hot swap) function, you can use the advanced features of the IM 153-2 HF interface module with order number 6ES7 153-2BA00-0XB0. In this case, you must activate the "Replace module during operation" (hot swap) function when configuring with the "Hardware Configuration" software. The IM 153-2 and all SM/FM/CP are plugged into the active bus module (order no. 6ES7 195-7Hxxx-0XA0).

56: What are the precautions when connecting the output of the first FM 352-5 directly to the input of the second FM 352-5?
If you want to interconnect two FM352-5s, you can do this on the 6ES7 352-5AH10-0AE0 (P-type sink output).
6ES7 352-5AH00-0AE0 has M-type sinking output. This output is only available when first adding a plug-in resistor to each output. Recommended plug-in resistor specifications: 2,2 kOhm / 0,5 W. Ensure switch box There is a short circuit connection inside. The operating frequency in this case can be as high as 100 kHz.

57: Can I replace the FM353/FM354 without a PG?
can. FM353 (MLFB No. 6ES7 353-1AH01-0AE0) and FM354 (MLFB No. 6ES7 354-1AH01-0AE0) can be replaced without PG.
Requirements: Use the configuration package FM353 V2.1 or the configuration package FM354 V2.1 and STEP 7 version V3.1 or higher.
Step: After completing the FM and system startup, you must create a system data block (SDB >=1000) and store it on the PG.在这个SDB中储存FM的全部参数化数据(DB/横移程序，机器数据,递增尺寸表等)。把此SDB传送到CPU 或者传送到CPU 的存储卡上。

58：在FM 350-2 上如何通过访问I/O 直接读取计数值和测量值？
FM 350-2 允许最多四个计数值或测量值直接显示在模块I/O上。可通过使用“指定通道”功能来定义哪个单个测量值要显示在I/O 区。根据计数值或测量值的大小，必须在“用户类型”中将数据格式参数化为“Word”或“Dword”。如果参数化为“Dword”，每个“用户类型”只能有一个计数值或测量值。如果参数化为“Word”，可以读进两个值。在用户程序中，命令L PIW用于Word 访问，L PID用于Dword 访问。

59： FM357－2 用绝对编码器时应注意什么?
FM357－2的固件版本为V3.2/V3.3在下列情况下绝对编码器的采样值可能会不正确， FM357－2固件版本为V3.4时这些问题将被解决。
1) FM357－2启动失败。例如,在启动窗口中定义的时间内掉电。
2) FM357－2在运行中拔插编码器的电缆。
3) 模拟的情况下。例如,FM357－2 在无驱动的情况下准备运行。

60：如何把一个初始值快速下载进计数器组FM350-1 或FM450-1 中？
对于有些应用场合，重要的是，当达到某个比较值时要尽快地把计数器复位为初始值。此外，通常在复位时需要进行一系列计算，以确定下一个比较值(以便优化原料的交点)。没有标准功能FC CNT_CTRL也可以选择进行一次复位。 <
为了快速把计数器复位，如下进行来组态计数器： 在计数器模块的“属性”对话框中的“基本参数”区内，将选项生成中断设成“是”，然后将中断选择设成“过程”。这样，在复位时会生成一个中断。 在“输出”参数标志中组态数字输出DQ0，以便在达到比较值时激活它。 在“输入”参数标志中的“设置计数器”域中，设置选项“多个”。
注意事项：在关联通道数据块中，必须将位DBX 27.0 或DBX 27.1 ( CTRL_DQ0) 设置为1，以便使设置按正确的方向进行。在“中断释放”参数标志中，选择选项“设置计数器”，以便在数字输入SET处出现一个上升沿时触发该中断。 功能模块FM 350-1 / FM 450-1 的数字输入I2是用于把计数器重置为初始值的。该输入与数字输出Q0 相连接(同FM 350-1 / FM 450-1)。
注意事项：在关联通道的数据块中，必须预先将数据双字DBD 14(LOAD_VAL)设置为初始值(如L#0)。数据双字DBD18 (CMP_V1)必须设置成比较值。必须通过在FC 上置相应的触发位一次来用FC CNT_CTRL 把这些值传送到FM 去。

61：为什么在FM350-1中选24V编码器,启动以后,SF灯常亮,FM350－1不能工作?
要检查一下,首先在软件组态中要选择编码器类型(为24V),再检查一下,FM350-1侧面的跳线开关,因为缺省的开关设置为5V编码器,一般用户没有设置,开机后,SF灯就会常亮另外,还可以看看在线硬件诊断,可以看看错误产生的原因,是否模板坏了。


62： FM350－1的锁存功能是否能产生过程中断?
FM350－1的锁存功能是不能产生过程中断,但是可以产生过零中断。
FM350－1的装载值必须为零,随者锁存功能的执行(DI的上升沿开始),当前的计数值被储存到另一地址然后置为初始值零,产生过零中断,在OB40中可以读出中断并相应的值。锁存值也可以从FM350－1的硬件组态地址的前4个字节中读出。

63： 在FM350-1中,怎样触发一个比较器输出?
FM350-1中自带的输出点具有快速性、实时性，不必要经过CPU的映像区处理。输出点一般对应于比较器,首先在硬件组态中定义比较器输出类型,如:输出值为1或为脉冲输出,然后在程序中设置比较值。在FM350-1中,地址在通讯DB(UDT生成)块中为18(比较值1)、22(比较值2),类型为DINT,然后激活输出点28.0(DQ0)、28.1(DQ1),这样比较器就可以工作了。


64：在FM350-2中,工作号的作用是什么?
工作号是S7－300CPU与FM进行通讯的任务号,每次的交换数据只是部分数据交换,而非全部数据,这样可以减少FM的工作负载,工作号又分写工作号和读工作号,例如在FM350－2中指定DB1为通讯数据块,如果把写工作号12写入到DB1.DBB0中,把200写入到DB1.DBD52中,再调用FC3写功能,这样第一个计数器的初始值为200,这里工作号10的任务号是写第一个计数器的初始值,DB1.DBB0为写工作号存入地址,DB1.DBD52为第一个计数器装载地址区,同样读工作号100为读前4路,101为读后4路计数器,读工作号存入地址为DB1.DBB2。 但写任务不能循环写,只能分时写入。

65：如果对于4-20 mA模拟量输入模块来说，小于4 mA后转换的数字量是多少?
如果小于4ma，那么将会是输出负值，例如-1对应的是3.9995mA,而1.185 mA 时，这个数值是-4864 (10进制)但是如果小于1.185mA,如果禁止断线检测，这个值是8000（16进制）如果有断线检测，会变成7FFF（16进制）。

66：怎样对模拟量进行标准化和非标准化？
可以使用以下功能块：
1.在块FC164中，x和y都是整数。
2. FC165中x是整数，y是实数。
3. FC166中x是实数，y是整数。
4. FC167中x和y都是实数。

67：S7系列PLC之间最经济的通讯方式是什么？
MPI通讯是S7系列PLC之间一种最经济、数据量最小的一种通讯，需要做连接配置的站通过GD通讯，GD通讯适合于S7－300之间,S7－300、S7－400、MPI之间一些固定数据的通讯。不用作连接的MPI通讯适用于S7-300之间、S7-300与400之间、S7-300/400与S7－200 系列PLC之间的通讯，建议在OB35(循环中断100ms)中调用发送块,在OB1(主循环组织块)调用接收块。

68:整个系统掉电后，为什么CPU在电源恢复后仍保持在停止状态？
整个系统由一个DP主站S7-300/400以及从站组成。而从站通过一个主开关被切断了电源。由于内部的CPU电压缓冲器，CPU 仍继续运行大约50ms到100ms。此阶段里CPU 识别出所连接的从站的故障。如果没有编程OB86和OB122的话，CPU 就会因为这些有故障的从站而继续保留在停止状态。

69:在点到点通信中，协议3964(R)和RK 512 之间的区别是什么？
这两个协议的主要区别在于消息报头和响应消息的不同。使用RK 512，提供有最高的数据完整性,程序3964(R) 当传送信息数据时，程序3964(R)将控制字符(安全层)添加到信息数据上。这些控制字符激活通信伙伴，检查数据是否全部接收，是否无错误。

70:当一个DP从站出故障，如何在输入的过程映像被清成“0”以前保存它们？
当一个DP从站出故障时，OB86(通过S7-300/400)被调用。可用下列方法“保存”输入的过程映像：
1. 把从站的所有输入循环地复制到一个独立的区里。
2.如果从站出问题，则OB86 被启动。在此OB 里你可设一个标志位来可防止进一步的循环复制操作。
3. 当从站返回总线后，你把OB86 里的标志位复位。

71：对模拟量模块而言，如何处理未使用的通道？
如果模块带有MANA : 短接所有的未使用通道的M-到MANA ，如果可能，连接MANA 到接地极，把模块的测量模式设置为： 0 - 20/ + -20mA. ，短接未使用的COMP+/COMP-. IC+ / IC-可以保持悬空。
如果模块不带有MANA : 把所有未使用的通道M-连接到使用通道的M-.等在输入端UCM > 2.5V 时，连接所有未使用的M-到cpu的接地或系统的接地. 把模块的测量模式设置为： 0 - 20/ + -20mA. ，短接未使用的COMP+/COMP-. IC+ / IC-可以保持悬空。
对于SM 331-7NF10-0AB0模块在4通道模式：禁止未用的通道，这些输入端悬空即可对于Ex模块SM 331-7RD：未使用的通道可以保持悬空72：上位机与plc进行通讯，硬件都需要哪些？

72：哪些软件里含有CP5511，CP5512，CP5611，RS232 PC-Adapter 的驱动？
如果安装了相应的软件后包含“Set PG/PC Interface …”组件，那么这些软件都含有CP5511，CP5512，CP5611，RS232 PC-Adapter 的驱动，只需在“Set PG/PC Interface …”->“Select…”->选择相应的驱动，然后“Install－－>”即可。
具体的软件有Step7，Step7 MicroWin，Simatic Net，WinCC，Protool，Flexible，PCS7。

73:当试图通过TeleService建立PRODAVE MPI和样列程序之间的通讯时，为什么会出现出错消息4501？
调制解调器没有响应，并产生了出错消息4501。在这个情况下，工作站的规范不正确。 在TeleService对话框中检查工作站的名称和工作站(standort)规范。此处可能有个不正确的缺省设删除“station”(“standort”)域中的缺省名，或输入正确的工作站名。那么就可以使用调制解调器在PRODAVE MPIY和TeleService之间建立连接。

74：是否可以将数据块的当前值作为初始值从AS传送到项目中?
可以。从AS中“ONLINE，打开相关数据块(DB).使用软盘图标“OFFLINE”保存DB.
通过“File > Generate Source”在DB中产生STL源代码. 通过手动操作将BEGIN和END_DATA_BLOCK行之间的当前值与相应的声明(初始值)逐行连接起来，从而得到下列声明语句：
STRUCT
wordVar : WORD := W#16#ABCDï¼›
...
END_STRUCT ï¼›
编译STL源代码。

75：在通讯任务中，在哪些OB中必须调用SFB？
在启动型OB(如用于S7-300的OB100和用于S7-400的OB100和OB101)和循环模式OB(OB1)中，必须调用数据通讯或程序管理(把PLC切换到STOP或RUN)所需的所有SFB。 OB100是启动型OB，并在重新启动CPU时运行。例如，在该OB中，用标记M1.0和M0.1来释放第一个通讯触发器。

76：怎样编程间接访问一个ARRAY类型变量的元素？
一个位、字节或者字符域的尺寸是按照字节限制排列的——在所有其它情况下是按照字对齐的。表T6-1中给出了一个域的存储示例。操作系统计算域中单个元素末端位置的位地址。域被分配到从下一个字地址(或字节地址)。下一个数据类型从下一个整字开始(或者整字节).
声明部分：
在声明部分，必须定义一个与将被间接寻址的ARRAY有着同一结构的ARRAY。不一定非要将ARRAY声明为IN-OUT变量；也可以声明为TEMP、IN或OUT变量。
网络：
域宽度(OFFSET)在网络中定义。ARRAY中的单个元素的最小常规数据宽度是一个字节；即使在两个变量之间定义一个BOOL。有必要确定相关的域的宽度和确定下一个期望域的起始地址。可使用下面的算法： 地址(指数)：b = 元素长度*(指数- 1)
创建具有不同数据类型的结构时，必须注意，在特定的环境下可能会自动插入填充字节。
保存ARRAY数据类型示例：ARRAY 【1..2,1..3】 OF 整数将生成下列域：
多维域是按照顺序保存的。在本例中整数【1,1】后面是整数【1,2】，整数【1,3】后面是整数【2,1】。

77：STEP 7 以哪种格式存储POINTER参数类型？
STEP 7以6 个字节保存POINTER参数。显示了用于保存POINTER参数类型的内存区域以及每个字节中保存的数据。POINTER参数类型保存了下列信息： DB号(如果DB中没有保存任何数据时为0)。 CPU中的内存区域(表格中列出了不同内存区域的十六进制代码)。
数据的地址(按照Byte.Bit格式)。
如果将形式参数声明为POINTER参数类型，则只需要指定内存区域和地址。STEP 7自动将输入项目的格式转换为指针格式。

78：因为总是要首次调用Alarm8P(SFB35)块，怎样避免OB 1初始化过程花费太长时间?
激活(首次调用)报警块Alarm(SFB33)、A larm_8(SFB34)和Alarm_8P(SFB35)比简单地执行作业检查需要多花费2 到3 倍的运行时间。当传送告警时，块的运行时间也会同样长。 然而警报通常不会成群发生，当编程时，需要注意警报块的首次调用，因为此处用到的所有块需要很长的运行时间，因此被调用OB的运行时间在某些情况下将显著增加。将警报块的首次调用移动到OB 100/101/102，可以将较长的运行时间转换到启动过程。此处处理时间也会较长，但是由于与模块的参数设置同时进行，启动时间不会太长。

79：当不能卸载STEP 7时，该怎么办？
设法通过控制面板卸载STEP 7。如果安装文件已损坏，卸载程序常会出错，并伴随出错信息。 另外STEP 7 CD包含文件Simatic STEP7.msi。可以通过这个文件卸载STEP 7。

80：加密的300PLC MMC处理方法？
如果您忘记了您在S7-300CPU Protection属性中所设定的密码，那么您只能够采用siemens的编程器PG（6ES7798-0BA00-0XA0）上的读卡槽或采用带USB接口的读卡器（USB delete?S7 Memory Card?prommer 6ES7792-0AA00-0XA0），选择SIMATIC Manager界面下的菜单File 选项删除MMC卡上原有的内容，这样MMC就可以作为一个未加密的空卡使用了，但无法对MMC卡进行jie密，读取MMC卡中的程序或数据。

81： 以314C为例计数时如何清计数器值？
有两种方法：
1：在参数设置中“Gate function”选“Cancel count”软件门为0，在为1时，值将清零，
2：利用写“Job”的方式，写计数值的任务号为1。

82：CP342-5能否用于PROFIBUS FMS协议通讯？
CP342-5支持PROFIBUS DP协议，不能用于PROFIBUS FMS协议通讯，同样CP343-5只支持PROFIBUS FMS协议，不能用于PROFIBUS DP协议通讯，而CP342-5和CP343-5都支持PROFIBUS FDL的链接方式；

83：为什么CP342-5 FO无法建立通讯？如何配置？
CP342-5 FO不支持3MB，6MB的通讯速率，如果您购买的是5.1版本的CP342-5，而STEP7中没有V5.1版的CP342-5时,则可以插入一个V5.0版的CP342-5模块，功能不受影响。CP342-5在S7-300系统中的安装位置与普通的S7-300 I/O模块一样，可以插在4至11这8个槽位中的任何一个。

84：CP342-5的3中工作方式有什么区别？
No DP方式下：可以用CP342-5通讯口进行S7编程或进行PROFIBUS的FDL连接，连接人机界面；
DP Master方式下：CP342-5除了作为网络中的PROFIBUS主站之外，也可用于S7编程、FDL连接和连接人机界面。DP delay time参数一般不需设定，除非您采用FDL连接时，要与DP的I、O点刷新时间相一致，才根据PROFIBUS网络性能进行调整；
DP Slave方式下：CP342-5除了作为网络中的从站之外，如果选择了The module is an active node on the PROFIBUS subnet选择框，那么CP 342-5也可用于S7编程、FDL连接和连接人机界面，否则CP342-5只能作为从站使用；

85：CP342-5 最多能完成多少数据交换？
一套S7-300系统中最多可以同时使用4块CP342-5模块，每块CP342-5能够支持16个S7 Connection，16个S5-Compatible Connection。当CP342-5处在No DP模式下工作时，最多同时支持32个通讯链接，而处在DP Slave或DP Master模式下时，最多同时支持28个通讯链接。CP342-5 作为PROFIBUS DP主站时，最多链接124个从站，和每个从站最多可以交换244个输入字节（Input）和244个输出字节（Output），与所有从站总共最多交换2160个输入字节和2160个输出字节。CP342-5 作为从站时，与主站最多能够交换240个输入字节和240个输出字节。CP342-5 可以最多连接16个操作面板（OP）以及最多创建16个S7 Connnection。

86：如何实现在从站断电、通讯失败或从站通讯口损坏等现象出现时，主站能够不停机？
需要在您的STEP7项目中插入相应组织块。插入这些组织块时，不需要编程内容，当从站断电、通讯失败等现象出现时，主站只报总线故障，但不停机。这样，无论从站先上电，还是主站先上电，系统都能正常运行：
在S7-300中加入OB82、OB86、OB122； 在S7-400中加入OB82～OB87、OB122；

87：CP342-5连接上位机软件或操作面板时应该选择什么工作模式？
如果您只是用CP342-5连接上位机软件或操作面板（OP），这时通讯采用的是S7协议，那么建议您选择No DP模式，并且不需要调用FC1（DP_SEND）和FC2(DP_RECV)功能块，它们只是在PROFIBUS DP通讯时才使用；

88：为什么系统上电后，即使CP342-5开关已经拨至Run，但始终处于STOP状态？
应当检查STEP7程序和组态是否正确（删除程序，只下载硬件组态）、检查CP342-5连接的24V电源线是否正常、M端是否与CPU的M端短接、通讯电缆连接是否正确（确认通讯电缆未内部短路），CP的firmware是否正确。如果您确认可以排除以上原因，那么可能您的CP342-5已经损坏，请更换；

89：如何用CP342-5组态PROFIBUS从站？
1.在STEP7中生成一个新的项目，并插入一个S7-300站。
2.在硬件组态窗口中选择一个S7300的导轨以及相应的CPU。
3.硬件组态窗口中，在路径"SIMATIC 300 > CP 300 > PROFIBUS > CP342-5" 选中于您订货号和版本号对应的CP342-5，插入到S7300站对应的槽位中，注意如果您购买的是Version5.1，而组态中只能够找到Version5.0，您可以选用Version5.1替代Version5.0.。
4.在插入CP342-5的过程中，会弹出一个PROFIBUS属性窗口，请点击”New…”按钮，创建一个PROFIBUS网络PROFIBUS(1) ，并设定CP342-5作为从站的站地址为3。
5.双击CP342-5，打开CP342-5的属性窗口，在"Operating Mode" 标签页下选择"DP Slave" 选项，此时会弹出一个警示窗口，告知您如果要用CP342-5实现CPU和PROFIBUS从站的通讯，必须调用FC1(DP_SEND)和FC2（DP_RECV）功能块，实现CPU与CP342-5之间的数据交换，而CP342-5与PROFIBUS的数据交换是自动完成的，不用编程。FC3和FC4用于诊断和通讯功能的控制，一般不用调用。
6.点击OK ，存盘编译。.

90：如何用CP342-5组态PROFIBUS主站？
1.在STEP7的SIMATIC Manager窗口中在插入一个S7300站；
2.重复以上组态从站步骤的2-4步，注意插入CP342-5时，不能点击”new…”按钮，而直接用鼠标选中以上创建的PROFIBUS(1)网络，点击OK；
在"Operating Mode"标签页中选择"DP Master"选项；

91：采用CP342-5的DP通讯口与采用CPU集成的DP通讯口进行通讯有什么不同，这两种通讯口功能有什么不同？
可以通过CPU集成的DP通讯口或CP443-5模板的DP通讯口，调用Load/Transfer指令（语句表编程，如图2）、Mov指令（梯形图编程）或系统功能块SFC14/15访问从站上的I/O数据；
如果您使用342-5模块的DP通讯口进行通讯，那么您就不能使用Load/Transfer指令（语句表编程）、Mov指令（梯形图编程）直接访问PROFIBUS从站的I/O数据。采用CP342进行PROFIBUS通讯包括两个步骤：
1.CPU将数据传输到CP通讯卡的数据寄存器当中；
2.数据从CP342-5的数据寄存器当中写到PROFIBUS从站的Output数据区（反过来就是CPU读取从站Input数据的过程）；CP342-5与从站的Input/Output数据区的通讯过程是自动进行的，但是您还必须自己手动的调用功能块FC1（”SEND”）和FC2 （”RECV”），完成CP342-5与CPU之间的数据交换。

92：功能块DP_SEND、DP_RECV"的返回值代表什么意思，如何理解？
"DP_SEND"功能块包括有"DONE"，"ERROR" 和"STATUS"三个参数，用来指示数据传输的状态和成功与否。"DP_RECV"功能块包括有"NDR", "ERROR", "STATUS" 和"DPSTATUS"四个参数，用来指示数据传输的状态和成功与否。您可以定义相应的数据地址区，存放这些返回值，分析返回的值的意思，当Error＝False，STATUS＝0，DONE=True，NDR＝True时，说明CPU与CP342-5之间的数据交换成功进行。

93： DP从站，CP模板以及CPU之间的数据通讯过程是如何进行的？
使用CP342-5模块，无论调用"DP_SEND" 功能块还是"DP_RECV" 功能块，您都不能直接读写某个PROFIBUS从站的I/O数据。CP342-5模块有一个内部的Input和Output存储区，用来存放所有PROFIBUS从站的的I/O数据，较新版本的CP342-5模板内部存储器的Input和Output区分别为2160个字节，Output区的数据循环写到从站的输出通道上，循环读出从站输入通道的数值存放在Input区，整个过程是CP342-5与PROFIBUS从站之间自动协调完成的，您不需编写程序。您可以在PLC的用户程序中调用"DP_SEND"和"DP_RECV"功能块，读写CP342-5这个内部的存储器。

94：通过CP342-5，如何实现对PROFIBUS网络和站点的诊断功能？
用功能块"DP_DIAG" (FC 3) 可以在程序中对cp模块进行诊断和分析，可以通过job类型如DP 诊断列表,诊断单个dp状态，读取dp从站数据，读取cp或cpu的操作模式，读取从站状态等等。

95：为什么当CP342-5模块作为PROFIBUS DP主站，而ET200（如IM151-1或IM153-2）作为从站时，CP342-5上的SF等不停闪烁？
当S7-300系统中的CP342-5作为DP主站，下挂IM153-2 模块时，IM153-2只能作为DP主站，而不是S7从站运行。 可以采取通过GSD文件将ET200从站组态进你的系统。随后IM153模块可作为DP 标准从站运行。为此，您必须将GSD文件安装到硬件目录中（通过菜单序列Tools > "Install new GSD file"）。在更新了硬件目录后您会在"PROFIBUS-DP > Additional Field Devices".中发现DP从站。

96：在STEP7中打开一些对象时出错是什么原因？
有的时候您在打开某些项目中的对象时，STEP7会弹出报错窗口，错误信息为'*.dll'文件无法被装载，代码是257:5，
错误信息是一个或多个对象不能被显示，出现这种错误的原因是您没有安装与要打开对象相关的软件包。

97：如果想通过上位或触摸屏对PLC中S5TIME类型的参数进行设定，有什么方法？
1、 从上位机写整型数INT或实数REAL到PLC，首先该数值需包含以毫秒为单位的时间值，在写入PLC的数据存储区后，利用ITD（Integer to Double Integer）或RND（Real to Double Integer with Rounding Off）将该值转换为双整形，然后将该值写到类型为TIME的变量里，在程序中调用FC40，将TIME转换成S5TIME即可。
2、 从上位机写WORD到PLC，首先该数值需包含以某时基为单位的时间值，在写入PLC的数据存储区后，用Word Logic下的WOR_W指令将该值与其时基相或，再利用MOVE指令将得到的数值写入S5TIME类型的变量中。
3、 如果使用WinCC作为上位软件，或上位软件支持32位带符号浮点数，可以从上位写32位带符号浮点数到PLC中定义为TIME的变量，然后在程序中调用FC40，将TIME转换成S5TIME即可。

98：STEP 7中相关时间处理和转换的功能块有哪些？
SFC 0 "SET_CLK" 设置CPU时钟SFC 1 "READ_CLK" 读出CPU时钟FC 3 "D_TOD_DT" 从DATE_AND_TIME 中取出DATE。
FC 6 "DT_DATE" 从DATE_AND_TIME 中取出the day of the week，即星期几FC 7 "DT_DAY" 从DATE_AND_TIME 中取出时间FC 8 "DT_TOD"
FC33用于S5TIME到TIME的转换FC40用于TIME到S5TIME的转换

99：如何实现带电拔出或插入模板，即热插拔功能？
硬件要求:
使用普通的S7-300导轨和U型总线连接器是不能实现热插拔功能的，您必须购买有源总线底板，才能实现该功能。另外，您在配置时，必须使用MLFB 6ES7 153-1AA02-0XB0版本以上的接口模块，因为它支持DP协议的DPV1版本，而MLFB IM153-1AA00-0XB0模块是不支持该功能的。目前您能够购买到的IM153接口模块都支持热插拔，只有2-3年以前的IM153接口模块不支持热插拔。
软件要求：您必须在STEP7 5.1版本以上进行配置；
如果您采用S7-400 CPU或S7-400 CP作为DP主站，那么您可以直接在IM153的属性窗口的"Operating Parameters"标签页里配置热插拔功能。
1：在STEP7的硬件组态窗口的PROFIBUS DP目录中选择相应IM153模块，可以看出该模块支持“module exchange in opration”（热插拔）；
2：将IM153模块拖到PROFIBUS总线上；
3：选择I/O模块，插入到ET200M站的各个槽位中；
4：双击ET200M站，打开属性窗口，选中“Replace modules during operation“(热插拔)选项；
5：属性窗口中提供了ET200M站热插拔功能所需的有源总线导轨的订货号；
6：属性窗口中提供了该型号IM153，插入的I/O模块对应使用的有源总线底板的订货号；
除了以上的硬件组态之外，还要向S7-400中下载OB82、OB83、OB84、OB85、OB86、OB87、OB121、OB122等组织块。当ET200M从站上进行模块的热插拔时，中断组织块OB83 ，OB85，OB122被调用。
如果您采用S7-300 CPU 或CP 342-5作为DP主站，那么您只能够通过安装GSD文件的方式将IM153模块组态成DP从站，并双击IM153，打开它的属性窗口，进行设置。否则您在STEP7的硬件组态窗口中直接将PROFIBUS DP目录ET200M文件夹下IM153模块挂在PROFIBUS总线上。

100：我如何做到对自己的程序块进行加密保护？
您能够通过STEP7软件的KNOW_HOW_PROTECT功能实现对您程序代码的加密保护。
如果您双击鼠标打开经过加密的程序块时，您只能看到该程序块的接口数据（即IN, OUT 和IN/OUT 等类型的参数）和注释信息，而程序块中的代码及代码的注释，临时/静态变量是不能被看到的。同时您也无法对加密保护的程序块做出任何改动。
如何实现程序块保护：
1.打开程序编辑窗口LAD/FBD/STL；
2.将要进行加密保护的程序块生成转换为源代码文件（通过选择菜单File— ;Generate source 生成）；

3.在LAD/FBD/STL 窗口中关闭您的程序块，并在SIMATIC
Manager项目管理窗口的source文件夹中打开上一步所生成的source文件；

4.在程序块的声明部分，TITLE行下面的一行中输入”KNOW_HOW_PROTECT

CAT-M Personal GPS Trackers

CAT-M Personal GPS Trackers,Small size GPS trackers,GPS trackers with panic button,mini waterproof personal GPS tracker

eSky wireless Inc , https://www.eskygpsiot.com