S5 question - LIR / TIR (yes - an old one!)

uptown47

Lifetime Supporting Member
Join Date
Feb 2008
Location
Over there, next to those boxes
Posts
1,146
Hi all,

I'm just looking at an S5 to S7 conversion.

The code contains some LIR/TIR instructions which, through this site and experience, I have part of an idea about. I just wondered if someone could clarify a few things.

Here's the code snippet....

Code:
L KH 7E28          // The CPU map shows that DB blocks are addressed between
                // KH 7E00 and KH 7EFF. I originally thought that 7E28h must 
                // mean DB 40 (ie. 28h = 40) but, there isn't a DB 40. There is
                // a DB 20 so I'm thinking it must mean that. Is that correct?
                // and, if so, why? 
LIR 0
T FW 170             // Are we taking DB20.DBW0 and putting it into FW 170 ?
                 // Or is taking DB20.DBB0 and just putting that into FW 170?
                 // Also, why do it this way? Why not just OPN DB20,
                 // Load DBW0 and then transfer it to FW 170 ??

L KH 7E2A
LIR 0
T FW 172

AN F 20.3
JC =M001

L FY 120
SLW 1
L FW 170
+F
T FW 174

L FW 164
L FW 174
TIR 1       // Anyone know what this is doing? i.e. Where/What is it transferring
          // And what is the significance of the '1' after TIR/LIR instead of '0'
          // Is this some sort of offset?

Thanks for any help you can give on these questions.

Cheers :)
 
I have some experience with S5/S7 convert and I know how hard it is to do the detailed program analysis. Try the instruction manual for more info about LIR/TIR... you can check my homepage for more info...
 
FW170 is being loaded with the address of the start of the DB in question. Later in the code 2*FY120 is added to FW170 to give the offset into the DB. FW164 is written to the DB at the given offset.

Looking at examples of other indirect access to DBs (albeit in a 928 CPU), the offset from the start of the DB list is the DB number (i.e 40 as you suggest). I can't find any examples for the 95U

Are you sure this code is being executed?
 
FW170 is being loaded with the address of the start of the DB in question. Later in the code 2*FY120 is added to FW170 to give the offset into the DB. FW164 is written to the DB at the given offset.

Looking at examples of other indirect access to DBs (albeit in a 928 CPU), the offset from the start of the DB list is the DB number (i.e 40 as you suggest). I can't find any examples for the 95U

Are you sure this code is being executed?


My sincere apologies LD for the lateness of this reply.

I absolutely hate it when people ask for help on a forum and then don't answer back to questions!

I'm embarrassed to say that it was me this time!!

Looking at the date I think it was because I went away on holiday a few days after that post and, after two weeks all inclusive, my memory was reset ready for my return!

Anyways... yes the code is being executed.

Actually this job has been on hold and has only now been put back on the "todo" list. it was whilst I Googled to refresh myself with the info that I found my abandoned question :(:(:(

Apologies my old friend
 
I had to deal with this more than 10-15 years ago... and after refreshing my memory a bit, I think I have the explanation:

The range bytes 7E00h to 7FFFh contains the starting hex address in memory of the DB. Each value is a word, thus 2 bytes. So the memory pointer to DB20 is in 7F28h (28h = 40th byte = 20th word). This pointer points to DW0 of DB20 (whatever value that is - and yes, you don't know it, unless you monitor the FW 170.

L KH 7E28 - pointer to start address of DB20.DW0 into ACCU1
LIR 0 - load the contents of the above in to ACCU1
T FW 170 - pointer to start address of DB20.DW0 transferred from ACCU1 into FW170

L KH 7E2A - pointer to start address of DB21.DW0
LIR 0 - load the contents of the above
T FW 172 - pointer to start address of DB21.DW0

AN F 20.3 - if F20.3 is false, jump to label M001
JC =M001

L FY 120
SLW 1
L FW 170
+F
T FW 174 - pointer to start address of DB20.DW0+offset which is FY120 multiplied by 2

L FW 164 - load value of FW164 into ACCU1
L FW 174 - load value of FW 174 into ACCU1 (FW 164 value moves to ACCU2)
TIR 1 - transfer the contents of FW174 into the data word pointed to by FW164 (should be referring to the last called DB with the C instruction).

TIR 1 is an undocumented instruction in the S5-95U (or any S5 Manual). I only found this information in a VIPA manual here (page 304):

TIR 1
ACCU1 - Contents that is transferred into the memory word (addressed by the destination address in the DB).
ACCU2 - Number of the data word in the DB, where the destination address is stored.
 
Last edited:
I had to deal with this more than 10-15 years ago... and after refreshing my memory a bit, I think I have the explanation:

The range bytes 7E00h to 7FFFh contains the starting hex address in memory of the DB. Each value is a word, thus 2 bytes. So the memory pointer to DB20 is in 7F28h (28h = 40th byte = 20th word). This pointer points to DW0 of DB20 (whatever value that is - and yes, you don't know it, unless you monitor the FW 170.

L KH 7E28 - pointer to start address of DB20.DW0 into ACCU1
LIR 0 - load the contents of the above in to ACCU1
T FW 170 - pointer to start address of DB20.DW0 transferred from ACCU1 into FW170

L KH 7E2A - pointer to start address of DB21.DW0
LIR 0 - load the contents of the above
T FW 172 - pointer to start address of DB21.DW0

AN F 20.3 - if F20.3 is false, jump to label M001
JC =M001

L FY 120
SLW 1
L FW 170
+F
T FW 174 - pointer to start address of DB20.DW0+offset which is FY120 multiplied by 2

L FW 164 - load value of FW164 into ACCU1
L FW 174 - load value of FW 174 into ACCU1 (FW 164 value moves to ACCU2)
TIR 1 - transfer the contents of FW174 into the data word pointed to by FW164 (should be referring to the last called DB with the C instruction).

TIR 1 is an undocumented instruction in the S5-95U (or any S5 Manual). I only found this information in a VIPA manual here (page 304):

TIR 1
ACCU1 - Contents that is transferred into the memory word (addressed by the destination address in the DB).
ACCU2 - Number of the data word in the DB, where the destination address is stored.

Wow!! That is brilliant information! Thank you for clarifying all that for me.

Very much appreciated. :)
 
You're welcome. I hated those programs that dealt with the HEX addresses of the internal memory of the CPU. For the first encounter with this, you had to sit and stare at a dozen lines of code and manuals for a day to figure out what the heck was going on!
 
You're welcome. I hated those programs that dealt with the HEX addresses of the internal memory of the CPU. For the first encounter with this, you had to sit and stare at a dozen lines of code and manuals for a day to figure out what the heck was going on!

Yep. And this a PLC conversion so quite important that I understand what's happening so I can write something equivalent in S7.

That info has helped tremendously. Thanks again :)
 

Similar Topics

OK. You guys helped me out a bunch with my first Siemens question. I found a bunch of issues with integrity checking the PLC programs I was...
Replies
3
Views
105
Hi all, Writng a FB in ST on Beckhoff TC for a pulser which turns on and off on a cycle, is paused by turning bControlInput to FALSE, but resumes...
Replies
4
Views
93
Hello folks! Never been here before but I have a question that's been bugging me for a while. I recently got a job at a chemical plant that's...
Replies
8
Views
282
I am currently backing a Micro Logix 1100 and no-one seems to have the file for me to upload from. Is there a way for me to upload the project off...
Replies
15
Views
341
Good morning crew! Ok my logic works but I am missing something. When the start button is pushed it should like the red light for 4sec then shut...
Replies
13
Views
344
Back
Top Bottom