TIA Portal Programming Manual
PLC Programming Practical Manual

Read and write the CPU, power-supply and signal-module article numbers from the labels. Include firmware version when visible.

In Project view select Add new device > Controllers, then expand the exact SIMATIC S7 family used on the trainer.

Match the full article number and firmware. If the firmware is unavailable, stop and check the TIA hardware-support package instead of choosing a similar CPU.

Enter PLC_01 as the device name and click Add. TIA Portal opens Device view.

From the Hardware catalog place the power supply and DI, DO, AI and AO modules in the same order as the physical rack. Do not guess slot positions.

Select every module and confirm article number, firmware, channel count, voltage/current type and configured start address.

Use non-overlapping byte/word ranges. Record each module, slot and address range in the I/O worksheet before changing defaults.

For ET200SP or modular I/O, verify base-unit and potential-group requirements. Mark the load-voltage group used by output modules.

Right-click PLC_01 and select Compile > Hardware (rebuild all). Open the Inspector messages and correct every error.

Export or manually record CPU/modules, article numbers, quantity, firmware and spare recommendation. Save the project as revision R01.

Open Device view and write the DI, DO, AI and AO start/end addresses from module properties. These ranges control the tag table.

Under PLC tags create DI_Tags, DO_Tags, AI_Tags, AO_Tags and Internal_Tags.

Create symbolic BOOL tags such as PB_Start, PB_Stop and Motor_FB using actual %I bit addresses.

Create Motor_CMD, Lamp_Run and Valve_CMD using actual %Q bit addresses and clear comments.

Create input/output tags using the module word addresses, normally %IW... and %QW.... Select INT unless the module documentation requires another type.

Add a small number of test bits/words in the approved %M area. Check that word tags do not overlap bits or adjacent words.

Under Program blocks add global DB DB_Process with members Level_PV: Real, Level_SP: Real, Alarm_High: Bool and Batch_Count: DInt.

Use one language and pattern for all names, add engineering units in comments and avoid spaces, duplicate meanings and device names such as Tag_1.

Open each tag cross-reference and confirm there are no duplicate absolute addresses or unintended overlapping word/double-word tags.

Compile the software, correct data-type/address errors and export the tag tables to the documentation folder as the approved baseline.

Write the engineering-PC IP, PLC IP, subnet mask and PROFINET device name. Confirm that every address is unique.

Open the Windows Ethernet adapter IPv4 settings and assign the approved PC address/subnet. Do not change an in-plant adapter without permission.

In TIA Portal select the CPU PROFINET interface, open Properties > Ethernet addresses and enter the approved PLC IP and subnet mask.

Enter a lowercase PROFINET name such as plc-01. Avoid spaces, underscores and duplicate names.

Select Online > Accessible devices, choose the correct PG/PC interface and Ethernet adapter, then start the search.

Match the discovered MAC address with the CPU label. Use Flash LED where supported so the correct device is confirmed physically.

Assign the planned IP address and PROFINET device name to the verified MAC address. Search again and confirm both values.

Run Hardware (rebuild all), then Software (rebuild all). Resolve errors before selecting Download.

Select Download to device, choose the same adapter, search, select the PLC by MAC/IP, review the load preview and approve only the expected changes.

Complete the load, place the CPU in RUN when safe, select Go online and confirm green status icons plus an empty/uncritical diagnostic buffer.

List each device tag, description, PLC address, normal state, expected test state and actual result. Leave no channel undocumented.

With power in the approved state, verify 24 VDC polarity, commons, PNP/NPN compatibility, analog signal type and output load isolation.

Under Watch and force tables create WT_IO_Test and add all DI, DO, AI and AO tags.

Go online, operate one pushbutton/sensor at a time and compare the field LED, module LED and watch-table value with the expected state.

Use temporary test logic or an approved force for one output at a time. Confirm module LED and load operation, then remove the command/force immediately.

Apply two known values such as 4 mA and 20 mA or 0 V and 10 V. Record raw counts and check channel diagnostics.

Write approved raw test values, measure the actual voltage/current and return the output to its safe value after the test.

Add DB_IO or structured tags for program-facing inputs, outputs and analog values. Keep physical addresses in one mapping network/block.

Move physical input values into mapped variables and mapped commands to physical outputs. Compile, download and recheck at least one channel of each type.

Remove every force, confirm the force icon is clear, restore safe outputs, sign the I/O sheet and record unresolved wiring issues separately.

Add BOOL tags Test_Enable, Test_Pulse, Test_Reset and status tags plus Count_PV: DInt.

Create titled networks for TON, TOF, TP and CTU. Keep one instruction and its test logic visible per network.

Insert TON, create/assign its IEC instance, connect IN:=Test_Enable and set PT:=T#5s. Map Q and ET to monitored tags.

Insert TOF with PT:=T#3s. Use the same enable only for comparison and a separate instance.

Insert TP with PT:=T#2s. Drive it from Test_Pulse and use a rising-edge pulse during testing.

Insert CTU, connect a one-shot pulse to CU, Test_Reset to R and set PV to 5. Map Q and CV.

Compile the modified software, inspect warnings, download only after zero errors and open all four networks online.

Toggle Enable and measure TON/TOF/TP behavior using ET and a stopwatch. Record actual delay/pulse times.

Generate five distinct rising edges. Confirm CV increments once per edge, Q at PV, and CV/Q clear when Reset is true.

Hold Pulse true, toggle it rapidly and change Reset while counting. Record why edge detection prevents multiple counts and save the tested revision.

Create tags for Start, Stop_OK, Safety_OK, Overload_OK, Auto_Permissive, Motor_CMD, Motor_FB, Trip and Reset.

Monitor Stop_OK, Safety_OK and Overload_OK. Confirm which field contacts are normally closed and how a broken wire is detected.

Create Motor_Permissive as the AND of all required healthy conditions. Display each condition separately online.

Use Start in parallel with Motor_CMD seal-in, in series with Stop_OK, Motor_Permissive and NOT Trip. Drive only the mapped command tag.

Verify that opening Stop_OK or any safety/permissive condition removes Motor_CMD regardless of the Start state.

Start a TON when Motor_CMD is true and Motor_FB is false. After the allowed delay, latch Trip_NoFeedback.

Latch a trip when Overload_OK becomes false. Keep the first fault visible until the fault is healthy and Reset is pressed.

Allow Reset only when Start is false and all healthy inputs are restored. Do not let Reset create a start command.

Test normal start/stop, missing permissive, missing feedback, overload and reset. Record command, feedback and trip for each case.

Cycle PLC/run simulation with Start released. Confirm the motor does not restart unexpectedly and document the selected restart philosophy.

Add Forward, Reverse, Main, Star, Delta, Stop_OK, Overload_OK, Run_FB and changeover timer tags.

Allow Forward only when Reverse command/feedback is false and all motor permissives are healthy.

Allow Reverse only when Forward command/feedback is false. Use independent seal-in and common stop/trip conditions.

Attempt Forward and Reverse together. Confirm only the accepted first command remains and record the result.

When a valid run command starts, energize Main and Star. Start a TON for the configured star duration.

When the star timer completes, remove Star and start a short dead-time timer before Delta is permitted.

Allow Delta only when Main is on, Star is off and dead time is complete. Add reciprocal Star/Delta software interlocks.

Stop, overload or loss of permissive must remove Main, Star and Delta immediately and reset the sequence.

Download and observe Main/Star/Delta outputs with timestamps. Confirm that Star and Delta are never true together.

Stop during star timing and during delta operation. Confirm all timers/states reset and a new Start begins from Star.

Open AI module properties and verify current/voltage range, diagnostics and raw representation from the Siemens module manual.

Add AI_Level_Raw: Int, Level_Norm: Real, Level_PV: Real, alarm limits and bad-signal flags.

Use measured/configured raw values. For the common unipolar Siemens range record zero and full scale, typically 0 and 27648, but verify the selected module.

Insert NORM_X with MIN/MAX equal to the confirmed raw endpoints and VALUE equal to AI_Level_Raw.

Insert SCALE_X with MIN 0.0 and MAX 100.0 (or actual process range). Write the output to Level_PV.

Set a fault if raw input is below/above the permitted diagnostic range. Substitute a safe value only according to the approved process philosophy.

Compare Level_PV with High and Low limits. Add delay/hysteresis so normal noise does not repeatedly toggle alarms.

Apply/test 0%, 50% and 100%. Record raw, normalized and engineering values and calculate the error.

Move slowly across Low and High limits and confirm delay, hysteresis, latch and reset behavior.

Record signal type, raw range, engineering range, test instrument and results; save the tested block revision.

Write the interface module, server module, base units and I/O module order/article numbers from the physical station.

Select Add new device > Distributed I/O > ET 200 and choose the exact interface module and firmware.

In Device view place DI, DO, AI and AO modules in the same slots and potential groups as the physical station.

In Network view connect the ET200 PN interface to the same subnet as PLC_01.

Set the approved ET200 IP and a unique lowercase device name such as et200-01. Record its I/O address ranges.

Compile the PLC and ET200 hardware. Resolve missing server module, wrong base unit, slot and firmware errors.

Use Accessible devices, MAC address and Flash LED to confirm the correct ET200 before assigning name/IP.

Assign the project device name, then download hardware configuration to the PLC/IO controller as required by the selected station.

Open Online & diagnostics and confirm the interface and each module is healthy. Read any channel/module diagnostic text before testing I/O.

Using the P05 checklist method, test at least one DI, DO, AI and AO channel and document address, actual value and result.

Record the trainer-approved drive IP, device name, telegram and motor safety state. Do not change motor, power or drive commissioning parameters.

In TIA Network view add/select the correct G120 interface and connect it to the PLC subnet using the approved device/description file.

Enter the planned IP and device name. Use Accessible devices and MAC/Flash LED to verify the physical drive interface.

Configure the telegram provided by the trainer, commonly Standard telegram 1, and record PLC output/input word addresses.

Create WORD/INT tags for control word, speed setpoint, status word and actual speed at the mapped addresses.

Map ready, operation-enabled, running, warning and fault status bits into named BOOL tags. Verify status before issuing commands.

Generate enable/start/stop and fault-acknowledge bits from the P07 motor pattern. Keep run false until all permissives and trainer approval are true.

Convert the approved engineering-speed command to the telegram representation and clamp it to the trainer-defined minimum/maximum.

With run inhibited, monitor control/status words and communication healthy state. Correct address/telegram problems before rotation.

Under trainer control, command start, two speed values and stop. Record setpoint, actual speed, status and the response to a communication interruption.

Write client port, slave address, baud rate, parity, stop bits and the exact vendor register numbers/function codes.

Power down as required and verify A/B polarity, common reference, shield, termination and that only the bus ends are terminated.

In Device view add the correct CB/CM module if required, compile hardware and record its hardware identifier/port.

Insert Modbus_Comm_Load in a startup/controlled initialization network with the recorded port and serial settings.

Create tags/DB members for request trigger, mode/function, data address, length, data pointer/buffer, done, busy, error and status.

Insert the Siemens Modbus master/client instruction for the CPU/module version and connect its unique instance DB.

Trigger the next read/write only after DONE or ERROR; never hold REQ permanently true or overlap requests.

Read a harmless status/actual-value register. Confirm DONE, buffer value and correct byte/word interpretation before any write.

Write the trainer-approved command/reference register, then read back status/actual value. Keep motor run inhibited until mapping is proven.

Test wrong slave address or disconnected cable, record STATUS/ERROR, restore the cause and verify controlled automatic/manual recovery.

Under Program blocks create group Level02_SCL, then add FC FC_ProcessLimits with language SCL.

Add inputs PV: Real, LowLimit: Real, HighLimit: Real, Mode: USInt and outputs Low, Normal, High: Bool.

At the top of the block detect LowLimit >= HighLimit and set an error output instead of calculating misleading states.

Set exactly one Low/Normal/High output based on PV. Assign all outputs on every scan so old states cannot remain.

Use CASE Mode OF to select disabled, monitor-only and active behavior, including an ELSE fallback.

Create a test array in a DB and a second FC or code section that uses a bounded FOR loop to count TRUE alarm elements.

Call FC_ProcessLimits from OB1 using tags in DB_Process. Connect every interface parameter explicitly.

Compile software and correct unassigned outputs, type conversions and invalid array indexes before download.

Test below Low, exactly Low, normal, exactly High, above High, invalid limits and unsupported Mode. Record every output.

Monitor the SCL block, add network/block comments, confirm no loop exceeds its array bounds and save revision L02_R01.

Under PLC data types add UDT_Equipment with Command, Permissive, Feedback, Running, Fault and RuntimeHours members.

Add global DB DB_Equipment containing Motor01 and Motor02 of type UDT_Equipment.

Add SCL FB FB_Motor. Define inputs for command/permissive/feedback/reset and outputs for run command/running/fault.

Create static members for feedback timer instance, fault latch and runtime accumulator. Explain why these values require FB instance memory.

At each scan establish safe defaults, then apply permissive, command, feedback timeout, trip and reset logic.

Call FB_Motor for Motor01 and allow TIA Portal to create named instance DB DB_Motor01. Connect Motor01 structure members.

Create DB_Motor02 and call the same FB with Motor02 data. Do not share one instance DB between independent motors.

Use or create a small stateless FC for scaling/selection and document why it does not own persistent static memory.

Download and command Motor01 only, then Motor02 only. Confirm timers, faults and runtime values remain independent.

Open block and DB cross-references to verify each instance call and UDT usage; save the library-ready revision.

Create PLC data types for UDT_Inputs, UDT_Outputs and UDT_DriveData using meaningful BOOL/INT/WORD/REAL members.

Add DB_Interface with Inputs, Outputs and Drive structures plus communication-healthy flags.

Add SCL FC FC_IO_Map. Keep physical addresses outside equipment/sequence blocks.

Assign each approved local and ET200 input tag into the corresponding structured input member with comments matching the I/O list.

Where required add normal-state inversion, debounce or plausibility status, but keep raw and conditioned values distinguishable.

Assign structured output commands to physical outputs only after master enable and safety/permissive conditions.

Copy G120 telegram or Modbus receive words into named status/actual members using explicit type conversion and scaling.

Build control/reference words from structured commands only when communication and equipment permissives are healthy.

Call FC_IO_Map at the beginning of OB1 for inputs/receive data and at the controlled output stage for commands. Compile and inspect order.

Change one physical input and one communication value; trace raw address to mapped member to consumer block, then command back to output.

Create an enumerated-equivalent USInt convention: 0 Disabled, 1 Manual, 2 Auto, 3 Local. Document invalid-mode behavior.

Provide separate ManualCmd, AutoCmd and Local status inputs plus selected command/mode status outputs.

Use CASE on mode so exactly one command source is accepted. Default invalid values to Disabled.

Pass the selected command through safety, process interlock, maintenance lock and fault conditions.

Use run feedback timeout, overload/fault latch and controlled reset from the proven Level 1 motor pattern.

For a valve instance, supervise open/closed limit switches, contradictory feedback and travel timeout.

Require a new command edge or command-off state when changing modes so a held command cannot start equipment unexpectedly.

Provide selected mode, selected command, permissive summary, first fault and feedback timeout to the interface DB.

For Disabled, Manual, Auto, Local and invalid mode, test command accepted/rejected, mode transition and active fault response.

Run at least one motor and one valve instance from the reusable architecture and record independent results.

Before coding, list state number/name, actions, transition condition, timeout, abort action and expected next state.

Add current state, previous state, step timer, Hold, Abort, Reset, BatchID, recipe values and fault fields.

Use CASE CurrentState OF with named constants for Idle, Fill, Mix, Drain, Complete and Fault.

Accept Start only when equipment is healthy, recipe values are valid and BatchID is available; then initialize timers and move to Fill.

In each state set equipment requests explicitly. Do not leave actions dependent on a previous state's output.

Advance only when the defined process/feedback condition is true. Record state entry time and previous state.

Start/reset a timer on state entry and move to Fault with a specific code if the transition does not complete in time.

Hold freezes permitted progression without losing the state; Abort sends every request safe and enters a controlled aborted/fault state.

Allow reset only after the cause is cleared. Define whether recovery returns to Idle or a verified restart state; never jump blindly.

Test normal batch, each timeout, Hold/Resume, Abort in every active state, invalid recipe and loss of equipment permissive.

Define alarm Active, Latched, Acknowledged, ResetAllowed, FirstOut, Code and timestamp/sequence fields as supported by the project.

Evaluate raw conditions, apply delays/hysteresis, latch required alarms and separate acknowledgement from process-cause reset.

Capture the first alarm code in a trip event and provide group warning/trip plus individual statuses.

Prove condition active, latch, acknowledge while condition remains, cause clears, reset allowed and final reset.

Create SP, PV, manual output, automatic output, mode, limits and status/error members with correct REAL types and engineering units.

Create/configure the technology object or instruction according to the TIA/CPU version, select control direction and place the call in the recommended cyclic OB.

Configure output minimum/maximum and start in manual. Verify that increasing output changes the simulated process in the expected direction.

Use the commissioning view/manual test or approved tuning method, then test SP changes without exceeding process limits.

Expose Commands, Setpoints, Status, Actuals, Alarms and Diagnostics structures. Keep raw physical addresses outside this DB.

Compile, download and use a watch table to test command validation, setpoint limits, alarm lifecycle and PID mode/status fields.

Check CPU technical data, firmware, OPC UA support/licence and TIA Portal requirements before enabling the server.

Record PLC IP, OPC UA port, endpoint URL, security policy, message mode, user method and client PC time/date.

Open CPU properties and enable the OPC UA server. Configure endpoint/security settings using the labels available in the installed TIA version.

Add an OPC UA server interface or expose only the approved DB/tag members. Mark read-only and writable variables deliberately.

Create/assign the approved user credentials and certificate/trust settings. Avoid anonymous write access.

Compile hardware/software, review OPC UA resource/security messages and download the configuration to the verified CPU.

In UAExpert add a server using the recorded opc.tcp://PLC-IP:port endpoint and select the matching security policy/user.

Review certificate identity, trust the expected PLC certificate and, where required, trust the UAExpert client certificate in the PLC configuration.

Browse the namespace, add approved tags to Data Access view and verify value, quality and timestamp. Test write only on a designated safe test tag.

Try one controlled wrong credential/certificate or stop communication, record UAExpert status and PLC diagnostics, then restore a healthy secure session.

Write the process description, I/O list, operating modes, sequence table, alarm list, communication scope and acceptance criteria.

Restore/open the approved baseline, save as Final_Project_R00 and update project information/change history.

Match CPU/local I/O/ET200 hardware, network identities and addresses. Compile hardware before writing application logic.

Implement documented tag tables, UDTs, DB_Interface, DB_OperatorInterface and network/drive data structures without overlaps.

Call I/O mapping first, reusable motor/valve blocks next and final output mapping after safety/permissive logic.

Implement the approved state table, transitions, timeout, Hold, Abort and controlled Reset behavior.

Scale analog values, limit setpoints/output, configure approved PID behavior and test alarm/first-out/acknowledge/reset lifecycle.

Configure ET200 and, when included, PLC-side PROFINET telegram, Modbus RTU or OPC UA interfaces using the proven lab patterns.

Rebuild hardware/software, resolve errors, review warnings, cross-references, unused tags, block call order and unsafe output paths.

Download to the verified CPU, perform I/O checks, normal-cycle test and every defined fault/timeout/mode/communication test.

Remove forces/test bypasses, return commands and PID to the agreed state, verify diagnostic buffer and repeat the safe-start test.

Create final archive, export tag/I/O/alarm/parameter records, complete FAT deviations and obtain trainer/student sign-off.