C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Viewing and Analyzing Background STL Code of CFC Blocks in SIMATIC PCS 7 - Source Inspection vs Know-How Protection

Viewing and Analyzing Background STL Code of CFC Blocks in SIMATIC PCS 7 - Source Inspection vs Know-How Protection

To view the background STL (Statement List) or SCL coding of a function block used in SIMATIC PCS 7 CFC charts, identify the block type number (e.g., FB500) or symbolic name from the CFC block header, open SIMATIC Manager, and navigate to the S7 Program's 'Blocks' folder (or 'Sources' folder if written in SCL/STL source files). Double-clicking the compiled block in the Blocks folder opens it in the LAD/FBD/STL Editor. However, if the block is protected via 'KNOW_HOW_PROTECT', the code will be locked behind a padlock icon and cannot be viewed without the original source file. For standard Siemens APL library blocks (MotL, PIDConL), code is permanently proprietary and protected; operational functionality must be referenced via the official APL Function Manual.

Table of Contents

Architecture of CFC Blocks: Block Types, Instances, and Underlying Code

In SIMATIC PCS 7, Continuous Function Chart (CFC) is a high-level graphical programming environment. Blocks placed on a CFC chart are not isolated graphic symbols; each block is an instance of an underlying Function Block (FB) or Function (FC) stored within the S7 Program library.

When a block (such as a custom analog scaling algorithm or an Advanced Process Library block) executes in the CPU:

  • Block Type: The reusable compiled machine code residing in the CPU's load/work memory (e.g., FB1201).
  • Instance Data Block (DB): The dedicated data memory structure automatically generated by the CFC compiler (e.g., DB523) containing the block's current input, output, and static internal states.
  • Source Code: The human-authored programming statements written in SCL (Structured Control Language), STL (Statement List), or LAD (Ladder Logic) residing in the Step 7 Sources folder.

Navigating from CFC Instance to S7 Program Blocks and Sources

Junior engineers frequently wonder how to navigate from an instance on a CFC sheet to the underlying programming statements:

  1. Identify Block Identity: Look at the header of the block in CFC. The top line displays the instance name (e.g., SCALE_AI01). Directly beneath it, the block type and symbol are displayed (e.g., SCALE_AI or FB500).

  2. Direct Editor Jump: In CFC Editor, select the block instance, right-click, and choose Open (or press Ctrl+Alt+O). If the block is not know-how protected, Step 7 will directly launch the LAD/STL/FBD Editor displaying the compiled block.

  3. Component View Navigation: In SIMATIC Manager, switch to Component View, expand your project hierarchy: Multiproject > AS Station > CPU > S7 Program > Blocks. Locate FB500 and double-click to inspect.

Decompiled STL vs High-Level SCL Source Code

A vital distinction in Step 7 engineering is the difference between inspecting a compiled block in the Blocks folder versus viewing the author's original source file in the Sources folder:

  • Opening a Block in the Blocks Folder: The LAD/STL/FBD editor displays the low-level compiled machine instructions. Even if the original block was authored in elegant, structured SCL with IF...THEN, FOR loops, and descriptive comments, opening the compiled FB decompiles it into raw Statement List (STL) assembly instructions (L, T, JC, pointer register manipulation). Original variable names may appear as internal offsets (#temp1, L 4.0), and author comments are completely missing.

  • Opening the Source in the Sources Folder: The Sources folder contains the human-readable text file (e.g., Scale_AI.scl or Scale_AI.awl). This file preserves the author's mathematical formulas, structured syntax, and explanatory comments. Always inspect the Sources folder first when attempting to understand custom plant algorithms.

Understanding Know-How Protection (KNOW_HOW_PROTECT)

When attempting to open a block, engineers often encounter a lock/padlock symbol on the block icon, accompanied by the message:

'The block is know-how protected. Code cannot be viewed.'

Siemens Step 7 provides the KNOW_HOW_PROTECT attribute to safeguard proprietary algorithms and intellectual property:

  • In SCL or STL sources, the pragma KNOW_HOW_PROTECT instructs the compiler to strip symbolic debug information and lock the compiled FB.
  • All standard Siemens PCS 7 libraries (such as the Advanced Process Library APL, Industry Library, and standard CFC system blocks) are shipped with KNOW_HOW_PROTECT active.
  • Without the original unprotected source text file and matching authorization, the underlying code cannot be reverse-engineered or viewed.

Comparative Access Matrix: Block Inspection Methods in SIMATIC PCS 7

The following table compares methods for analyzing function block logic in SIMATIC PCS 7:

Inspection MethodSource LocationCode FormatComments Visible?Know-How Protected BlocksCFC Right-Click 'Open'Blocks FolderDecompiled STL / LADNoAccess Denied (Padlock)Step 7 LAD/STL/FBD EditorBlocks FolderCompiled STL AssemblyNoAccess Denied (Padlock)SCL / STL Source EditorSources FolderHigh-Level SCL / Structured STLYes (Full Documentation)Fully Editable (Source File)CFC Dynamic Test ModeOnline ControllerVisual Parameter ValuesN/AFully Visible (Online Values)APL Function ManualSiemens DocumentationAlgorithmic Descriptions & FormulasYes (Official Reference)Unnecessary to View STL

Step-by-Step Procedure to Open and Inspect Block Background Logic

Follow these steps to analyze a custom block's functionality:

  1. Determine the Block Type and Source Identity:
    - In the CFC chart, click the block to select it.
    - Press Alt+Enter to open Block Properties.
    - Note the Block Type (e.g., SCALE_AI) and the Block Number (e.g., FB1205).

  2. Check the Sources Folder First:
    - In SIMATIC Manager Component View, expand S7 Program > Sources.
    - Look for a source file named SCALE_AI or similar.
    - Double-click the source file. If present, it will open in the SCL or STL editor, displaying the clear, commented source code.

  3. Open the Compiled Block in Blocks Folder:
    - If no source file exists, navigate to S7 Program > Blocks.
    - Locate FB1205 and double-click to open it in LAD/STL/FBD.
    - If unprotected, review the STL network instructions.

  4. Analyze Functionality Online in CFC Test Mode:
    - If the block is know-how protected and no source file exists, return to CFC.
    - Activate Test Mode (Ctrl+T).
    - Monitor the inputs, outputs, and internal parameters dynamically to observe how output values change in response to input variations.

Verification

Validate block comprehension and behavior through these verification steps:

  1. Open the block code or source file and verify input/output definitions against the CFC block pins.
  2. In CFC Test Mode, apply known test values to the block inputs (e.g., Raw_Val = 13824 for a 4–20 mA scaling block).
  3. Confirm that the calculated output corresponds exactly to the mathematical formula derived from code inspection (e.g., 50.0%).
  4. Verify that diagnostic bits (e.g., Error, OverRange) activate when boundary limits are exceeded.

Limitations and Operational Precautions

  • Do Not Modify Blocks in Production: Never edit, recompile, or overwrite function blocks in an active production environment. Modifying an FB interface requires updating all chart instances and may force a CPU STOP.
  • Unlocking Protected Blocks: Attempting to bypass know-how protection using unauthorized third-party hex-editing utilities can corrupt the block database and invalidate plant safety certifications.
  • Library Upgrades: If inspecting custom blocks, ensure that modifications are preserved in a custom Master Library rather than the temporary project folder to prevent loss during system upgrades.

Engineer FAQ

Why can't I edit standard Siemens APL blocks like MotL?

Siemens APL blocks are proprietary, safety-certified, and know-how protected. Siemens does not provide source code to ensure software integrity and system stability across all PCS 7 installations. Use the APL Function Manual for detailed block formulas.

Can I view the code of an FC (Function) in the same way as an FB?

Yes. Functions (FC) can be opened in the LAD/STL/FBD editor from the Blocks folder or from the Sources folder, provided they are not know-how protected.

What is the difference between SCL and STL?

STL (Statement List) is a low-level, register-based assembly language. SCL (Structured Control Language) is a high-level, PASCAL-like language optimized for complex mathematical algorithms, loops, and data manipulation.

If I edit a block in the Blocks folder, will CFC update automatically?

No. If you modify a block in the Blocks folder, you must go to CFC and select Options > Block Types > New Version to synchronize existing instances in your charts.

Where can I find comments written by the original programmer?

Programmer comments are stored exclusively in the source text files located in the Sources folder or within the block's Symbol Table and parameter descriptions in CFC.

Technical References

Related Articles

Related Tags

  • STL
  • SCL
  • Know-How Protection
  • CFC Blocks
  • Step 7
  • AS Engineering
  • Function Blocks
6 respuestas