BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (white paper)
Siemens S7 Indirect Addressing Help - PLCS
-
Upload
hashempour -
Category
Documents
-
view
224 -
download
3
Transcript of Siemens S7 Indirect Addressing Help - PLCS
![Page 1: Siemens S7 Indirect Addressing Help - PLCS](https://reader031.fdocuments.in/reader031/viewer/2022021219/577c82dc1a28abe054b29101/html5/thumbnails/1.jpg)
8/18/2019 Siemens S7 Indirect Addressing Help - PLCS
http://slidepdf.com/reader/full/siemens-s7-indirect-addressing-help-plcs 1/7
4/5/2016 Siemens S7 Indirect addressing help - PLCS.net - Interactive Q & A
http://www.plctalk.net/qanda/showthread.php?t=18972 1/7
This board is for PLC Related Q&A ONLY. Please DON'T use it for advertising, etc.
Try our online PLC Simulator- FREE . Click here now to try it.
---------->>>>>Get FREE PLC Programming Tips
your first name your email address Get The PLC Tips Now!
New Here? Please read this important info!!!
PLCS.net - Interactive Q & A > PLCS.net - Interactive Q & A > LIVE PLC Questions And Answers
Siemens S7 Indirect addressing help
User Name User Name Remember Me?
Password Log in
Register FAQ Calendar Downloads PLC Reviews PLCS.net Store Today's Posts Search
Thread Tools Display Modes
November 27th, 2005, 06:05 PM #1
You are not registered yet. Please click here to register!
![Page 2: Siemens S7 Indirect Addressing Help - PLCS](https://reader031.fdocuments.in/reader031/viewer/2022021219/577c82dc1a28abe054b29101/html5/thumbnails/2.jpg)
8/18/2019 Siemens S7 Indirect Addressing Help - PLCS
http://slidepdf.com/reader/full/siemens-s7-indirect-addressing-help-plcs 2/7
4/5/2016 Siemens S7 Indirect addressing help - PLCS.net - Interactive Q & A
http://www.plctalk.net/qanda/showthread.php?t=18972 2/7
PLCKeef Member
Join Date: Nov 2005Location: AustraliaPosts: 65
Siemens S7 Indirect addressing help
Hi allI need a bit of help with the program below.I have a thumwheel switch and I want to transfer the left hand three digits to a dat wod specified by theright hand digit.The program works , but seems to transfer to the wrong data word.for example if I have 1234 dialed up on the thumbwheel switch , 123 should be transfered to data word 4.But it actuall goes to data word 8?
The data at MW20 seems to be doubled when put into the pointer ?
Any ideas ?thanks
//Indirect adddressing exampleOPN DB 10 //open data block 10 as the resident DB
L IW 124
L W#16#F
AW
T MW 20 //left hand digit on it's own
//
L IW 124
AW W#16#FFF0
SRW 4
T MW 50 //right hand 3 digits on their own
//
//
L MW 20
![Page 3: Siemens S7 Indirect Addressing Help - PLCS](https://reader031.fdocuments.in/reader031/viewer/2022021219/577c82dc1a28abe054b29101/html5/thumbnails/3.jpg)
8/18/2019 Siemens S7 Indirect Addressing Help - PLCS
http://slidepdf.com/reader/full/siemens-s7-indirect-addressing-help-plcs 3/7
4/5/2016 Siemens S7 Indirect addressing help - PLCS.net - Interactive Q & A
http://www.plctalk.net/qanda/showthread.php?t=18972 3/7
SLD 4
LAR1 //put the right hand digit in the correct pointer format
//
//
L MW 50
T DBW[AR1, P#0.0] //transfers the data to the DW specified by MW20
November 28th, 2005, 01:00 AM #2
tehuMember
Join Date: Nov 2005Location: TønsbergPosts: 1
The code looks Ok. Siemens is doing the numbering in bytes, so actually word 4 equals byte 8.
November 29th, 2005, 04:50 PM #3
PLCKeef Member
Join Date: Nov 2005Location: AustraliaPosts: 65
I still don't understand , looking at what I have below , if MW20 has 4 in itL MW 20
SLD 4LAR1
then when I execute the next part
L MW 50T DBW[AR1, P#0.0]
MW 50 gets transferred to DBW 8 , not 4 as I would expect ?
![Page 4: Siemens S7 Indirect Addressing Help - PLCS](https://reader031.fdocuments.in/reader031/viewer/2022021219/577c82dc1a28abe054b29101/html5/thumbnails/4.jpg)
8/18/2019 Siemens S7 Indirect Addressing Help - PLCS
http://slidepdf.com/reader/full/siemens-s7-indirect-addressing-help-plcs 4/7
4/5/2016 Siemens S7 Indirect addressing help - PLCS.net - Interactive Q & A
http://www.plctalk.net/qanda/showthread.php?t=18972 4/7
November 29th, 2005, 04:58 PM #4
SimonGoldsworthyMember
Join Date: Mar 2005Location: EnglandPosts: 1,079
If you want to write to a byte address, you shift the number left 3 bits. You are shifting the number 4bits left (as you should if you are writing a DBW), hence why you are writing to DBW 8.
November 29th, 2005, 07:23 PM #5
PLCKeef
Member
Join Date: Nov 2005Location: AustraliaPosts: 65
Ok thanksBut how does 4 become 8 ?
I have0000 0000 0000 0100in MW20I shift it left 4 spaces0000 0000 0100 0000
so the pointer would be 4.0 ?
November 30th, 2005, 03:41 AM #6
SimonGoldsworthyMember
Join Date: Mar 2005
The bottom 3 bits of a pointer define the bit address, the remainder of the bits (when shifted right 3bits) define the byte address. Pointer addresses increment as below:
0000 0000 = 0.00000 0001 = 0.10000 0010 = 0.20000 0011 = 0.30000 0100 = 0.4
![Page 5: Siemens S7 Indirect Addressing Help - PLCS](https://reader031.fdocuments.in/reader031/viewer/2022021219/577c82dc1a28abe054b29101/html5/thumbnails/5.jpg)
8/18/2019 Siemens S7 Indirect Addressing Help - PLCS
http://slidepdf.com/reader/full/siemens-s7-indirect-addressing-help-plcs 5/7
4/5/2016 Siemens S7 Indirect addressing help - PLCS.net - Interactive Q & A
http://www.plctalk.net/qanda/showthread.php?t=18972 5/7
Location: EnglandPosts: 1,079
0000 0101 = 0.50000 0110 = 0.60000 0111 = 0.70000 1000 = 1.00001 0000 = 2.00001 1000 = 3.00010 0000 = 4.00010 1000 = 5.00011 0000 = 6.0
0011 1000 = 7.00100 0000 = 8.0etc.
Last edited by SimonGoldsworthy; November 30th, 2005 at 03:44 AM .
November 30th, 2005, 07:53 AM #7
seppoalanenMember
Join Date: Jan 2003Location: FinlandPosts: 1,132
S7 indirect pointing is simple. Pointer (DWORD) points the bit number in open memeory space.
"SLD 3", "LAR1" etc. are not necessary, but mostly helpful.
L L#3T #Pointer // points bit 3 (from zero)L L#1+DT #Pointer2 // 1-bit more (4) than #Pointer (3)
L DBD[#Pointer] // Loads bits 3-34 to accuT DBD[#Pointer2]// Writes from accu to bits 4-35
November 30th, 2005, 09:29 AM #8
SimonGoldsworthyMember
Quote:
Originally Posted by seppoalanenS7 indirect pointing is simple
Unfortunately, the code you have posted may have caused more confusion than anything else.
![Page 6: Siemens S7 Indirect Addressing Help - PLCS](https://reader031.fdocuments.in/reader031/viewer/2022021219/577c82dc1a28abe054b29101/html5/thumbnails/6.jpg)
8/18/2019 Siemens S7 Indirect Addressing Help - PLCS
http://slidepdf.com/reader/full/siemens-s7-indirect-addressing-help-plcs 6/7
4/5/2016 Siemens S7 Indirect addressing help - PLCS.net - Interactive Q & A
http://www.plctalk.net/qanda/showthread.php?t=18972 6/7
Twitter Reddit Digg del.icio.us
StumbleUpon Google
Join Date: Mar 2005Location: EnglandPosts: 1,079
Firstly using the variable #Pointer is not possible because it is a reserved word. I would recommendcutting/pasting example code from the block editor into the thread - that way you can only post code
that will be acceptable to the Step 7 block editor.
Secondly, you cannot reference a DBD from any address unless the bit number is zero (i.e. the bottom 3bits of the pointer must be zero). Attempting to execute this code will cause the plc to fault out with analignment error. I would recommend running code in the plc simulator before posting it, that way youknow the posted code will do as you say.
Jump to Live PLC Question and Answer Forum
Bookmarks
« Previous Thread | Next Thread »
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
Posting Rules
You may not post new threadsYou may not post repliesYou may not post attachmentsYou may not edit your posts
BB code is OnSmilies are On[IMG] code is OnHTML code is Off
Forum Jump
LIVE PLC Questions And Answers Go
Similar Topics
Thread Thread Starter Forum Replies Last Post
![Page 7: Siemens S7 Indirect Addressing Help - PLCS](https://reader031.fdocuments.in/reader031/viewer/2022021219/577c82dc1a28abe054b29101/html5/thumbnails/7.jpg)
8/18/2019 Siemens S7 Indirect Addressing Help - PLCS
http://slidepdf.com/reader/full/siemens-s7-indirect-addressing-help-plcs 7/7
4/5/2016 Siemens S7 Indirect addressing help - PLCS.net - Interactive Q & A
http://www.plctalk.net/qanda/showthread.php?t=18972 7/7
Siemens S7 indexed addressing PLCdave LIVE PLC Questions And Answers 15 March 25th, 2015 05:43 PM
S7: Problem with Pointer and indirect addressing douyi LIVE PLC Questions And Answers 18February 2nd, 2010 04:17
AM
Siemens s7 ladder indirect addressing guest LIVE PLC Questions And Answers 21 June 27th, 2009 06:39 AM
S7 indirect addressing examples? Johnny T LIVE PLC Questions And Answers 2 October 3rd, 2005 04:32 AM
S7 Indirect Addressing of Array douyi LIVE PLC Questions And Answers 3September 21st, 2005
08:25 AM
All times are GMT -5. The time now is 04:53 AM.
Contact Us - PLCS.net - Text - Top
.