Siemens CPU 412-1 User manual

S7-400 Instruction List
CPU 412, 414, 416, 417
This Instruction List has the order number:
6ES7498-8AA04-8BN0
Edition 04/2004
A5E00267845-01

We have checked the contents of this manual for agreement with the
hardware and software described. Since deviations cannot be
precludedentirely, we cannot guarantee full agreement. However,
the data in this manual are reviewed regularly and any necessary
corrections included in subsequent editions. Suggestions for
improvementare welcomed.
Disclaimer of LiabilityCopyright Siemens AG 2004 All rights reserved
The reproduction, transmission or use of this document or its
contents is not permitted without express written authority.
Offenders will be liable for damages. All rights, including rights
createdby patent grant or registration of a utility model or design, are
reserved.
SiemensAG
Bereich Automation and Drives
Geschaeftsgebiet Industrial Automation Systems
Postfach 4848, D- 90327 Nuernberg SiemensAG 2004
Subject to change without prior notice
Siemens Aktiengesellschaft 6ES7498-8AA04-8BN0

Contents
1
S7-400 Instruction List
A5E00267845-01
Contents
Contents 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Applicability 5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Address Identifier and Parameter Ranges 6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Address Identifier and Parameter Ranges, continued 7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Address Identifier and Parameter Ranges, continued 8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Constants and Ranges 9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Abbreviations and Mnemonics 10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Abbreviations and Mnemonics, continued 11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Registers 12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examples of Addressing 15. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examples of Addressing, continued 17. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examples of how to calculate the pointer 18. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Execution Times with Indirect Addressing1 19. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Examples of Calculations 21. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
List of Instructions 24. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Bit Logic Instructions 25. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Bit Logic Instructions with Parenthetical Expressions 28. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Bit Logic Instructions with Parenthetical Expressions, continued 29. . . . . . . . . . . . . . . . . . . . . .

Contents
2
S7-400 Instruction List
A5E00267845-01
ORing of AND Instructions 30. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Logic Instructions with Timers and Counters 31. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Word Logic Instructions with the Contents of Accumulator 1 33. . . . . . . . . . . . . . . . . . . . . . . . .
Evaluating Conditions Using AND, OR and EXCLUSIVE OR 35. . . . . . . . . . . . . . . . . . . . . . . . .
Edge-Triggered Instructions 38. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Setting/Resetting Bit Addresses 39. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Instructions Directly Affecting the RLO 41. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Timer Instructions 42. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Counter Instructions 45. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Load Instructions 47. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Load Instructions for Timers and Counters 53. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Transfer Instructions 54. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Load and Transfer Instructions for Address Registers 57. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Load and Transfer Instructions for the Status Word 59. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Load Instructions for DB Number and DB Length 60. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Integer Math (16 Bits) 61. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Integer Math (32 Bits) 63. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Contents
3
S7-400 Instruction List
A5E00267845-01
Floating-Point Math (32 Bits) 65. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Square Root and Square Instructions (32 Bits) 67. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Logarithmic Function (32 Bits) 68. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Trigonometrical Functions (32 Bits) 69. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Constants 70. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Adding Using Address Registers 71. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Comparison Instructions (16-Bit Integers) 72. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Comparison Instructions (32-Bit Integers) 73. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Comparison Instructions (32-Bit Real Numbers) 74. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Shift Instructions 75. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Rotate Instructions 77. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Accumulator Transfer Instructions, Incrementing and Decrementing 79. . . . . . . . . . . . . . . . . .
Accumulator Transfer Instructions, Incrementing and Decrementing, continued 80. . . . . . . . .
Program Display and Null Operation Instructions 81. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Type Conversion Instructions 82. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Forming the Ones and Twos Complements 85. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Block Call Instructions 86. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Contents
4
S7-400 Instruction List
A5E00267845-01
Block End Instructions 89. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Exchanging Shared Data Block and Instance Data Block 90. . . . . . . . . . . . . . . . . . . . . . . . . . . .
Jump Instructions 91. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Instructions for the Master Control Relay (MCR) 97. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Oganization Blocks (OB) 99. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Function Blocks (FB) 104. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Functions (FC) and Data Blocks 105. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
System Functions 106. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
System Function Blocks 139. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Sublist of the System Status List (SSL) 148. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Alphabetical Index of Instructions 154. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Applicability
5
S7-400 Instruction List
A5E00267845-01
Applicability
This list of instructions applies to the CPUs listed below.
Name Order number subsequently described as*
CPU 412-1 6ES7412-1XF04-0AB0
CPU 412
CPU 412-2 6ES7412-2XG04-0AB0
CPU 412
CPU 414-2 6ES7414-2XG04-0AB0
CPU 414-3 6ES7414-3XJ04-0AB0 CPU 414
CPU 414-4H 6ES7414-4HJ04-0AB0
CPU 414
CPU 416-2 6ES7416-2XK04-0AB0
CPU 416F-2 6ES7416-2FK04-0AB0 CPU 416
CPU 416-3 6ES7416-3XL04-0AB0
CPU 416
CPU 417-4 6ES7417-4XL04-0AB0
CPU 417
CPU 417-4 H 6ES7417-4HL04-0AB0
CPU 417
* except in the tables, where a detailled differentiation is necessary

Address Identifier and Parameter Ranges
6
S7-400Instruction List
A5E00267845-01
Address Identifier and Parameter Ranges
Addr. ParameterRange Description
ID CPU 412 CPU 414 CPU 416 CPU 417
Description
Q** 0.0 to 127.7 0.0 to 255.7 0.0 to 511.7 0.0 to 1023.7 Output (in PIQ)
QB** 0 to 127 0 to 255 0 to 511 0 to 1023 Output byte (in PIQ)
QW** 0 to 126 0 to 254 0 to 510 0 to 1022 Output word (in PIQ)
QD** 0 to 124 0 to 252 0 to 508 0 to 1020 Output double word (in PIQ)
DBX 0.0 to 65533.7* 0.0 to 65533.7 0.0 to 65533.7 0.0 to 65533.7 Data bit in data block
DB 1 to 511 1 to 4095 1 to 4095 1 to 8191 Data block
DBB 0 to 65533* 0 to 65533 0 to 65533 0 to 65533 Data byte in DB
DBW 0 to 65532* 0 to 65532 0 to 65532 0 to 65532 Data word in DB
DBD 0 to 65530* 0 to 65530 0 to 65530 0 to 65530 Data double word in DB
DIX 0.0 to 65533.7* 0.0 to 65533.7 0.0 to 65533.7 0.0 to 65533.7 Data bit in instance DB
DI 1 to 511 1 to 4095 1 to 4095 1 to 8191 Instance data block
DIB 0 to 65533* 0 to 65533 0 to 65533 0 to 65533 Data byte in instance DB
DIW 0 to 65532* 0 to 65532 0 to 65532 0 to 65532 Data word in instance DB
DID 0 to 65530* 0 to 65530 0 to 65530 0 to 65530 Data double word instance DB
*Also restricted by the size of the working memory.
** Default setting can be changed, see Technical Specifications

Address Identifier and Parameter Ranges
7
S7-400Instruction List
A5E00267845-01
Address Identifier and Parameter Ranges, continued
Addr. ParameterRange Description
ID CPU 412 CPU 414 CPU 416 CPU 417
Description
I** 0.0 to 127.7 0.0 to 255.7 0.0 to 511.7 0.0 to 1023.7 Input bit (in PII)
IB** 0 to 127 0 to 255 0 to 511 0 to 1023 Input byte (in PII)
IW** 0 to 126 0 to 254 0 to 510 0 to 1022 Input word (in PII)
ID** 0 to 124 0 to 252 0 to 508 0 to 1020 Input double word (in PII)
L** 0.0 to 4095.7 0.0 to 8191.7 0.0 to 16383.7 0.0 to 32767.7 Local data
LB** 0 to 4095 0 to 8191 0 to 16383 0 to 32767 Local data byte
LW** 0 to 4094 0 to
8190 0 to 16382 0 to 32766 Local data word
LD** 0 to 4092 0 to 8188 0 to 16380 0 to 32764 Local data double word
M0.0 to 4095.7 0.0 to 8191.7 0.0 to 16383.7 0.0 to 16383.7 Bit memory
MB 0 to 4095 0 to 8191 0 to 16383 0 to 16383 memory byte
MW 0 to 4094 0 to 8190 0 to 16382 0 to 16382 memory word
MD 0 to 4092 0 to 8188 0 to 16380 0 to 16380 memory double word
** Default setting can be changed, see Technical Specifications

Address Identifier and Parameter Ranges
8
S7-400Instruction List
A5E00267845-01
Address Identifier and Parameter Ranges, continued
Addr. ParameterRange Description
ID CPU 412 CPU 414 CPU 416 CPU 417
Description
PQB 0 to 4095 0 to 8191 0 to 16383 0 to 16383 Peripheral output byte
(direct I/O access)
PQW 0 to 4094 0 to 8190 0 to 16382 0 to 16382 Peripheral output word
(direct I/O access)
PQD 0 to 4092 0 to 8188 0 to 16380 0 to 16380 Peripheral output double word
(direct I/O access)
PIB 0 to 4095 0 to 8191 0 to 16383 0 to 16383 Peripheral input byte
(direct I/O access)
PIW 0 to 4094 0 to 8190 0 to 16382 0 to 16382 Peripheral input word
(direct I/O access)
PID 0 to 4092 0 to 8188 0 to 16380 0 to 16380 Peripheral output double word
(direct I/O access)
T0 to 2047 0 to 2047 0 to 2047 0 to 2047 Timer
C0 to 2047 0 to 2047 0 to 2047 0 to 2047 Counter

Constants and Ranges
9
S7-400Instruction List
A5E00267845-01
Constants and Ranges
Constant Range Description
B(b1,b2)
B(b1,b2,b3,b4) –Constant,2 or 4 bytes
D# Date –IEC date constant
L# Integer –32-bit integer constant
P# Bit pointer –Pointer constant
S5T# Time value –S7 time constant 1)
T# TIme value –Time constant
TOD# Time value –IEC time constant
C# Count value –Counter constant (BCD code)
2#n – Binary constant
W#16#
DW#16# –Hexadecimal constant
1) For loading of S7 timers.

Abbreviations and Mnemonics
10
S7-400Instruction List
A5E00267845-01
Abbreviations and Mnemonics
The following abbreviations and mnemonics are used in the Instruction List:
Abbrev. Description Example
k8 8-bit constant
0 to 255 32
k16 16-bit constant
256 to 32 767 28 131
k32 32-bit constant
32 768 to 999 999 999 127 624
i8 8-bit integer
-128 to +127 -113
i16 16-bit integer
-32768 to +32767 +6523
i32 32-bit integer
-2 147 483 648 to [phone] 222
mPointer constant P#240.3
nBinary constant 1001 1100
pHexadecimal constant EA12
Label Symbolic jump address (max. 4 characters) DESTINATION
aByte address

Abbreviations and Mnemonics
11
S7-400Instruction List
A5E00267845-01
Abbreviations and Mnemonics, continued
Abbrev. Description Example
bBit address
cAddress area I, Q, M, L, DBX, DIX
dAddress in: MD, DBD, DID or LD
eNumber in: MW, DBW, DIW or LW
fTimer/counter No.
gAddress area IB, QB, PIB, PQB, MB, LB,
DBB, DIB
hAddress area IW, QW, PIW, PQW, MW,
LW, DBW, DIW
iAddress area ID, QD, PID, PQD, MD, LD,
DBD, DID
qBlock No.

Registers
12
S7-400 Instruction List
A5E00267845-01
Registers
ACCU1 to ACCU4 (32 Bits)
The accumulators are registers for processing bytes, words or double words. The address identifiers are loaded into the accumulators,
where they are logically gated. The result of the logic operation (RLO) is in ACCU1 and can be transferred from there to a memory cell.
The accumulators are 32 bits long.
Accumulator designations :
ACCU Bits
ACCUx (x = 1 to 4) Bit 0 to 31
ACCUx-L Bit 0 to 15
ACCUx-H Bit 16 to 31
ACCUx-LL Bit 0 to 7
ACCUx-LH Bit 8 to 15
ACCUx-HL Bit 16 to 23
ACCUx-HH Bit 24 to 31

Registers
13
S7-400 Instruction List
A5E00267845-01
Address Registers AR1 and AR2 (32 Bits)
The address registers contain the area-internal or area-crossing pointers for instructions using indirect addressing. The address registers
are 32 bits long.
The area-internal and/or area-crossing pointers have the following syntax:
•Area-internal pointer 00000000 00000bbb bbbbbbbb bbbbbxxx
•Area-crossingpointer yyyyyyyy 00000bbb bbbbbbbb bbbbbxxx
Legend: bByte address
xBit number
yArea identifier
(see “Examples of Addressing”)

Registers
14
S7-400 Instruction List
A5E00267845-01
Status Word (16 Bits)
The status word bits are evaluated or set by the instructions.
The status word is 16 bits long.
Bit Assignment Description
0 FC First check bit
1 RLO Result of logic operation
2 STA Status
3 OR Or (AND before OR)
4 OS Stored overflow
5 OV Overflow
6CC 0 Condition code 0
7CC 1 Condition code 1
8 BR Binary result
9 to 15 Unassigned –

Examples of Addressing
15
S7-400Instruction List
A5E00267845-01
Examples of Addressing
AddressingExamples Description
Immediate Addressing
L +27 Load 16-bit integer constant “27” into ACCU1
L L#-1 Load 32-bit integer constant “-1” into ACCU1
L 2#1010101010101010 Load binary constant into ACCU1
L DW#16#A0F0BCFD Load hexadecimal constant into ACCU1
L ’ENDE’ Load ASCII character into ACCU1
L T#500 ms Load time value into ACCU1
L C#100 Load count value into ACCU1
L B#(100,12) Load 2-byte constant
L B#(100,12,50,8) Load 4-byte constant
L P#10.0 Load area-internal pointer into ACCU1
L P#E20.6 Load area-crossing pointer into ACCU1
L -2.5 Load real number into ACCU1
L D# 1995-01-20 Load date
L TOD 13:20:33.125 Load time of day

Examples of Addressing
16
S7-400Instruction List
A5E00267845-01
Addressing Examples Description
Direct Addressing
A I 0.0 ANDing of input bit 0.0
L IB 1 Load input byte 1 into ACCU1
L IW 0 Load input word 0 into ACCU1
L ID 0 Load input double word 0 into ACCU1
Indirect Addressing of Timers/Counters
SP T [LW 8] Start timer; the timer number is in local data word 8
CU C [LW 10] Count upwards; the counter number is in local data word 10
Area-Internal Memory-Indirect Addressing
A I [LD 12]
Example: L P#22.2
T LD 12
A I [LD 12]
AND operation: The address of the input is in local data double word 12 as pointer
A I [DBD 1] AND operation: The address of the input is in data double word 1 of the open DB as pointer
A I [DID 12] AND operation: The address of the output is in data double word 12 of the open instance DB as pointer
A I [MD 12] AND operation: The address of the output is in memory double word 12 as pointer

Examples of Addressing
17
S7-400Instruction List
A5E00267845-01
Examples of Addressing, continued
AddressingExamples
Area-Internal Register-Indirect Addressing
A I [AR1,P#12.2]
Area-Crossing Register-Indirect Addressing
For area-crossing register-indirect addressing, the address must also contain an area identifier. The address is in the address register.
The area identifiers are as follows:
Area Coding Area
identifier (binary) hex.
P 1000 0000 80 I/O area
I 1000 0001 81 Input area
Q 1000 0010 82 Output area
M 1000 0011 83 Bit memory area
DB 1000 0100 84 Data area
DI 1000 0101 85 Instance data area
L 1000 0110 86 Local data area
VL 1000 0111 87 Predecessor local data area (access to local data of invoking block)
L B [AR1,P#8.0]
A [AR1,P#32.3]
Addressing Via Parameters
A Parameter

Examples of how to calculate the pointer
18
S7-400Instruction List
A5E00267845-01
Examples of how to calculate the pointer
•Example for sum of bit addresses x7:
LAR1 P#8.2
A I [AR1,P#10.2]
Result: Input 18.4 is addressed (by adding the byte and bit addresses)
•Example for sum of bit addressesu7:
L P#10.5
LAR1
A I [AR1,P#10.7]
Result: Input 21.4 is addressed (by adding the byte and bit addresses with carry over)