Siemens S5 115U LIR - TNB

I am working with a Siemens S5 115U 944 program. I have several questions, but probably the most frustrating so far is the following code. I have a tight deadline so any help would be greatly appreciated.

Question #1:

I have researched this code for awhile and can not get a handle on what is going on here. I tried to include what I believe it is, but probably way off base.

L KH E4C8 (is this pointing to DB100??, if so, pointing to what in DB100?)
LIR 0 (Load value at location E4C8 into ACCUM1)
ADD KF127 (Add 127 to ACCUM1)
T FW250 (Move ACCUM1 value to FW250)
ADD KF16 (Add 16 to ACCUM1 = E4C8's value + 127 + 16)
T FW252 (Move ACCUM1 into FW252)
ADD KF240 (Add 240 to ACCUM1)
T FW254 (Move ACCUM1 value to FW254)

L KH EF7F (Source Addr. --Process Image?? Discrete I/O?? address)
L FW250 (Dest. Addr. -- FW186-> FW250 or FW122->FW250 ??)
TNB 128 (XFER 128 bytes)

L FW252 (Source Addr. ??)
L KH EE0F (Dest. Addr. -- FY15 -> FY31)
TNB 16 (XFER 16 bytes)

L KH EFFF (Src Addr. - FY128 -> FY255)
L FW254 (Dest. Addr. - FW190 -> FW254 ???)
TNB 128 (Xfer 128 bytes)

L KH E4CA (Src Addr. - DB101 ??)
LIR 0 (Load E4CA's value into ACCUM1)
ADD KF255 (Add 255 to ACCUM1)
T FW250 (Move ACCUM1 value to FW250)

L KH EEFF (Src Addr. - FY0 -> FY255?? What is the diff. than just above??)
L FW250 (Dest. Addr. - FW123-FW250 ??)
TNB 255
***

Question #2:

Is F200.0 & FY200 & FW200 referencing the same location in memory (i.e. if it were legal in S5 world, could it be said that F200.0 = FY200.0 = FW200.0), where the 1st item is referencing a bit in the lower byte of a memory location, 2nd item is referencing the lower 8 bits of the same location, and the last is referencing 2 consecutive bytes, one byte being the same as FY200?


Any help would be greatly appreciated.

Thanks

Answer #1:

This program in essence copies the entire Process Images and most of the F-range into some DBs:

L	KH E4C8	(pointer to DB100.byte0)

LIR	0	(address of DB100.byte0 into ACCUM1)

ADD	KF 127	(Add 127 to ACCUM1, thus address of DB100.byte127)

T	FW 250	(Move address of DB100.byte127 to FW250)

ADD	KF 16	(Add 16 to ACCUM1 = address of DB100.byte133)

T 	FW 252	(Move address of DB100.byte133 into FW252)

ADD	KF 240	(Add 240 to ACCUM1, result = address of DB100.byte373)

T	FW 254	(Move address of DB100.byte373 to FW254)



L	KH EF7F	(Source Addr. --Process Image Inputs IB127)

L	FW 250	(Dest. Addr. -- DB100.byte127)

TNB	128	(XFER 128 bytes - IOW copy the complete PII to the first 64 DWs of DB100)



L	FW252	(Source Addr. - DB100.byte133)

L	KH EE0F	(Dest. Addr. -- FY15 -> FY31)

TNB	16	(XFER 16 bytes)



L	KH EFFF	(Src Addr. - Process Image Outputs QB127)

L	FW 254	(Dest. Addr. - DB100.byte373)

TNB	128	(Xfer 128 bytes - copy the complete PIQ to DB100 DW123-186)



L	KH E4CA	(Src Addr. - DB101.byte0)

LIR	0	(address of DB101.byte0 into ACCUM1)

ADD	KF255	(Add 255 to ACCUM1, address of DB101.byte255)

T	FW250	(Move address of DB101.byte255 to FW250)



L 	KH EEFF (Src Addr. - Address of FB255)

L	FW250	(Dest. Addr. - DB101.byte255)

TNB	255	(Copy all FY255-FY1 to DB101, bytes 255-1)

***

It surely would have helped you if the program was sufficiently documented.

Answer #2:

F200.0 & FY200 & FW200 reference indeed the same location in memory, BUT they ARE definitely NOT the same. F200.0 is a single bit, FY200 is a collection of 8 bits, ranging from F200.0 (LSB) up to and including F200.7 (MSB) and FW 200 is a collection of 16 bits ranging from F201.0 (LSB) up to and including F200.7 (MSB) - remember that S5 is big-endian memory organisation:

		FY200		FY201

	.7           .0   .7           .0

F200.0	              0

FY200	0 0 0 0 0 0 0 0

FW200	0 0 0 0 0 0 0 0   0 0 0 0 0 0 0 0

I hope this figure has clarified it a little bit.

Kind regards,

jvdcande, thanks for the reply, that really helps clarify some concerns.

If it is not a problem, I have another question or two for further clarification.

First question:
In the following logic, does the transfer copy the source in a "high address" to "low address" (i.e. DB100DW64 to DB100DW0) or reverse (i.e. DB100DW0 to DB100DW64) and does the destination (IB0 to IB127 go the same direction as the source (i.e. High to low (same dir) or opposite direction as the source)?

L KH EF7F (Source Addr. -- Process Image Inputs IB127)
L FW 250 (Dest. Addr. -- DB100.byte127 (byte 0 to 127, correct?))
TNB 128 (Copy the complete PII to first 64 DWs of DB100)
***

Second question:
In the above example, what is the order that the bytes are copied into the DW? Is byte2 loaded into DW1 or DW62 and is it loaded in the high byte (bits 8-15)) or in the low byte (bits 0-7)?

Third Question:
In your reply to my 2nd question (from my first post, your Answer #2), you said "FW200 is a collection of 16 bits ranging from F201.0 (LSB) up to and including F200.7 (MSB)". This seems to be reverse of what I expected, I thought that it would be F201.7 is MSB and F200.0 is LSB. Can you clarify?

Thanks

First answer: both source and destination are handled from th ehighest downto the lowest address (127 to 0).

Second answer: I don't know, I should have to check it out. Maybe it can be determined based on the rest of the program, or maybe somebody else has the answer for you.

Third answer: yes, that's exactly what you might expect in a microprocessor, because those work with little-endian system. PLC is reverse. Pitty or not, I don't know. I've got used to it.

Kind regards,