Constructing Dynamic ANY Pointers for BSEND and BRCV in SIMATIC PCS 7 CFC

In SIMATIC PCS 7 CFC, configuring the system communication blocks BSEND (SFB12) and BRCV (SFB13) cannot be done by simply right-clicking and selecting 'Interconnect to Address', because this leaves out the mandatory length specification in the ANY pointer, causing runtime error 16#000A. Because CFC does not support typing raw ANY pointer syntax (P#DBx.DBXx.x BYTE len), the robust solution is authoring an SCL wrapper function block that takes integer inputs for DB number, start address, and byte length, dynamically builds the 10-byte ANY structure, and calls SFB12/SFB13 internally.

Architectural Limitations of ANY Pointers in SIMATIC CFC

In cross-controller industrial communication between SIMATIC PCS 7 (running on S7-410 or S7-400 controllers) and standalone STEP 7 systems (such as S7-300 or S7-400 programmed in classic LAD/FBD/STL), high-volume data exchange is commonly implemented using the coordinated system communication blocks:
* BSEND (SFB12): Block send over configured S7 connections.
* BRCV (SFB13): Block receive over configured S7 connections.

In classic STEP 7 STL, parameterizing the send/receive data buffer pointer (SD_1 / RD_1) is straightforward: the programmer types a complete ANY pointer string directly onto the block pin:

CALL  "BSEND" , DB12
 REQ :=M10.0
 ID  :=W#16#1
 R_ID:=DW#16#1
 SD_1:=P#DB100.DBX0.0 BYTE 256
 LEN :=MW20

In SIMATIC PCS 7 CFC, however, the graphic environment enforces strict type safety and does not permit typing literal string syntax like P#DB100... on ANY-type inputs. Furthermore, right-clicking the input and selecting Interconnect to Address connects only the symbolic start address of a variable, omitting the byte length. While CFC compiles without warning, the S7 CPU rejects the job at runtime with an error, because the firmware strictly mandates an explicit length segment in the ANY pointer structure.

Structure of the 10-Byte S7 ANY Pointer Matrix

An S7 ANY pointer is a packed 10-byte data structure that encodes the data type, repetition count, DB number, and 3-byte memory area offset:

Byte OffsetParameter NameData TypePermissible ValuePurpose and EncodingByte 0Syntax IDBYTE16#10Standard S7 identifier (must always be 16#10)Byte 1Data TypeBYTE16#02 (BYTE) / 16#04 (WORD)Code identifying data type of target elementsBytes 2-3Repetition Factor / LengthWORDInteger count (e.g., 100)Number of elements to be transmittedBytes 4-5DB NumberWORDDB Integer (e.g., 100)Target Data Block number (0 if non-DB memory)Byte 6Memory Area CodeBYTE16#84 (DB) / 16#83 (Bit Memory M)Internal S7 execution memory area prefixBytes 7-9Byte / Bit Address Offset3 BytesByteAddress * 8 + BitAddressExact byte and bit starting offset in memory

Architecture rule: If Bytes 2-3 (Length) are 0, BSEND and BRCV abort with parameter errors.

Why Simple CFC Address Interconnection Fails on BSEND/BRCV

When an engineer right-clicks SD_1 on BSEND in CFC and selects Interconnect to Address pointing to a DB tag:
1. CFC generates a pointer to the specific tag (e.g., DB100.DBD0).
2. The internal repetition factor (Bytes 2-3) defaults to 1 (or 0 for generic structures).
3. Although BSEND has a dedicated LEN parameter, the S7-400 operating system documentation states: The start address and the maximum length of the data to be sent are specified by SD_1. LEN replaces the length section only if SD_1 already contains a valid length.
4. If SD_1 lacks a length, the communication processor considers the memory buffer undefined and sets ERROR = 1 with STATUS = 16#000A (Buffer length mismatch or access error).

Step-by-Step SCL Wrapper Block Implementation (Send_DB / Recv_DB)

The industry-standard solution in PCS 7 is wrapping BSEND inside an SCL function block that dynamically constructs the ANY pointer:

Create SCL Source File in SIMATIC Manager:
```scl
FUNCTION_BLOCK FB2603
TITLE = 'Send_DB_Wrapper'
VERSION : '1.0'
AUTHOR : 'PCS7_ENG'
FAMILY : 'COMM'

VAR_INPUT
REQ : BOOL; // Send request trigger
R : BOOL; // Reset communication
ID : WORD; // S7 Connection ID from NetPro
R_ID : DWORD; // Message pair ID
DB_NUM : INT; // Source Data Block Number
START_BYTE: INT; // Starting Byte Offset in DB
BYTE_LEN : INT; // Number of bytes to transmit
END_VAR

VAR_OUTPUT
DONE : BOOL;
ERROR : BOOL;
STATUS : WORD;
END_VAR

VAR
BSEND_Inst : SFB12; // Embedded system function block instance
END_VAR

VAR_TEMP
AnyStruct : STRUCT
SyntaxID : BYTE;
DataType : BYTE;
Length : WORD;
DB_Number : WORD;
AreaPointer : DWORD;
END_STRUCT;
AnyPointer AT AnyStruct : ANY;
SendLen : WORD;
END_VAR

BEGIN
// 1. Construct 10-Byte S7 ANY Pointer dynamically
AnyStruct.SyntaxID := 16#10; // S7 Syntax ID
AnyStruct.DataType := 16#02; // Type BYTE
AnyStruct.Length := INT_TO_WORD(BYTE_LEN); // Transfer length
AnyStruct.DB_Number := INT_TO_WORD(DB_NUM); // DB Number
AnyStruct.AreaPointer := 16#84000000 OR SHL(IN := INT_TO_DWORD(START_BYTE), N := 3); // DB area (16#84) + byte offset

 SendLen := INT_TO_WORD(BYTE_LEN);

 // 2. Call BSEND with complete constructed ANY pointer
 BSEND_Inst(
   REQ  := REQ,
   R    := R,
   ID   := ID,
   R_ID := R_ID,
   SD_1 := AnyPointer,
   LEN  := SendLen
 );

 DONE   := BSEND_Inst.DONE;
 ERROR  := BSEND_Inst.ERROR;
 STATUS := BSEND_Inst.STATUS;

END_FUNCTION_BLOCK
`` 2. **Compile SCL Source and Instantiate in CFC**: * Compile the source intoFB2603. * Drag the block into the CFC chart. * ParameterizeDB_NUM = 100,START_BYTE = 0,BYTE_LEN = 256` as simple integers.
* Execute a Full Compilation and Download to ensure instance DB pointers are aligned.

Verification

Verify cross-PLC communication:
1. Trigger input REQ with a clock pulse (e.g., 500 ms).
2. Online in CFC: Confirm that DONE transitions to 1 every pulse and ERROR = 0, STATUS = 16#0000.
3. In the partner controller (STEP 7 side), verify that the receive DB buffer updates with matching data within one cycle.

Limitations and Operational Precautions

Always perform a Full Compilation and Download in STOP after introducing custom SCL communication wrappers; delta compilation can cause instance DB descriptor mismatches for communication blocks.
Ensure the target Data Block exists in the CPU and its declared size is at least equal to START_BYTE + BYTE_LEN; writing past the DB boundary causes an OB 121 programming fault.
Do not call BSEND in rapid OB 35 (100 ms) cycles continuously if DONE has not returned to 1; concurrent send triggers overload the communication FIFO queue.

Engineer FAQ

Why must the bit address in the ANY pointer be shifted left by 3?

In S7 memory pointers, the lower 3 bits represent the bit offset (0-7), while the upper 21 bits represent the byte offset. Shifting the byte offset left by 3 (or multiplying by 8) aligns the address to the byte boundary.

Can BRCV use the exact same SCL wrapper pattern?

Yes. Create an identical wrapper replacing SFB12 with SFB13 (BRCV), mapping the constructed ANY pointer to RD_1.

Does this approach work with optimized data blocks in S7-1500?

No. S7 ANY pointers are classic S7-300/400 memory pointers. S7-1500 controllers must configure non-optimized (standard) DB access to communicate via BSEND/BRCV.