System Bits and System Words
Original instructions
About us
System Bits
The following subsets of %S system bits are supported:
Bit
Symbol
Function
Description
%S0
COLDSTART
cold start
Normally at 0, this bit is set to 1 by:
  • power restoration with loss of data (battery fault)
  • the user program
  • the termina,
  • a change of cartridge
This bit is set to 1 during the first complete restored cycle of the PLC either in RUN or in STOP mode. It is reset to 0 by the system before the following cycle.
NOTE: When %S0 is set to 1, the messages in the diagnostic buffer are deleted.
NOTE: %S0 is not set to 1 using Reset with the PLC simulator (in contrast to a real PLC).
%S0 is not always set in the first scan of the PLC. If a signal set for every start of the PLC is needed, %S21 should be used instead.
%S1
WARMSTART
warm restart
(not for safety PLCs)
Normally at 0, this bit is set to 1 by :
  • power restoration with data save
  • the user program
  • the terminal
  • action on change of cartridge
It is reset to 0 by the system at the end of the first complete cycle and before the outputs are updated.
%S1 is not always set in the first scan of the PLC. If a signal set for every start of the PLC is needed, %S21 should be used instead.
%S4
TB10MS
time base 10 ms
(not for safety PLCs)
An internal timer regulates the change in status of this bit.
It is asynchronous in relation to the PLC cycle.
Graph:
%S5
TB100MS
time base 100 ms
(not for safety PLCs)
Similar wave structure as %S4
%S6
TB1SEC
time base 1 s
(not for safety PLCs)
Similar wave structure as %S4
%S7
TB1MIN
time base 1 min
(not for safety PLCs)
Similar wave structure as %S4
%S11
WDG
watchdog overflow
Normally at 0, this bit is set to 1 by:
  • power restoration with data save
  • the user program
  • the terminal
  • action on change of cartridge.
It is reset to 0 by the system at the end of the first complete cycle and before the outputs are updated.
%S12
PLCRUNNING
PLC in RUN
This bit is set to 1 by the system when the PLC is in RUN.
It is set to 0 by the system as soon as the PLC is no longer in RUN (STOP, INIT, etc.).
%S13
1RSTSCANRUN
first cycle after switching to RUN
Normally set to 0, this is set to 1 by the system during the first cycle of the master task after the PLC is set to RUN.
%S15
STRINGERROR
character string fault
(not for safety PLCs)
Normally set to 0, this bit is set to 1 when the destination zone for a character string transfer is not of sufficient size (including the number of characters and the end of string character) to receive this character string.
The application stops in error state if the %S78 bit has been to set to 1.
This bit must be reset to 0 by the application.
%S17
CARRY
rotate or shift output
normally at 0
During a rotate or shift operation, this bit takes the state of the outgoing bit.
%S18
OVERFLOW
overflow or arithmetic error
Normally set to 0, this bit is set to 1 in the event of a capacity overflow if there is:
  • a result greater than + 32 767 or less than - 32 768, in single length
  • a result greater than + 65 535, in unsigned integer
  • a result greater than + 2 147 483 647 or less than - 2 147 483 648, in double length
  • result greater than +4 294 967 296, in double length or unsigned integer
  • real values outside limits
  • division by 0
  • the root of a negative number
  • forcing to a non-existent step on a drum
  • stacking up of an already full register, emptying of an already empty register
It must be tested by the user program after each operation where there is a risk of overflow, and then reset to 0 by the user if there is indeed an overflow.
When the %S18 bit switches to 1, the application stops in error state if the %S78 bit has been set to 1.
%S19
OVERRUN
task period overrun (periodical scanning)
Normally set to 0, this bit is set to 1 by the system in the event of a time period overrun (i.e. task execution time is greater than the period defined by the user in the configuration or programmed into the %SW word associated with the task). The user must reset this bit to 0. Each task manages its own %S19 bit.
%S20
INDEXOVF
index overflow
(not for safety PLCs)
Normally set to 0, this bit is set to 1 when the address of the indexed object becomes less than 0 or exceeds the number of objects declared in the configuration.
In this case, it is as if the index were equal to 0.
It must be tested by the user program after each operation where there is a risk of overflow, and then reset to 0 if there is indeed an overflow.
When the %S20 bit switches to 1, the application stops in error state if the %S78 bit has been set to 1.
%S30
MASTACT
activation/deactivation of the master task
(not for safety PLCs)
Normally set to 1. The master task is deactivated when the user sets the bit to 0.
This bit is taken into consideration by the system at the end of each MAST task cycle.
%S31
FASTACT
activation/deactivation of the fast task
(not for safety PLCs)
Normally set to 1 when the user creates the task. The task is deactivated when the user sets the bit to 0.
%S32
AUX0ACT to
%S35
AUX3ACT
activation/deactivation of the auxiliary tasks 0-3
(not for safety PLCs)
Normally set to 1 when the user creates the task. The auxiliary task is deactivated when the user sets the bit to 0.
%S38
ACTIVEVT
enabling/inhibition of events
(not for safety PLCs)
Normally set to 1. Events are inhibited when the user sets the bit to 0.
%S39
EVTOVR
saturation in event processing
(not for safety PLCs)
This bit is set to 1 by the system to indicate that one or more events cannot be processed following saturation of the queues.
The user must reset this bit to 0.
%S62
MEMPROTOFF
memory protect OFF
(not for safety PLCs)
This bit is the image of the key switch on legacy and high end Quantum PLCs.
%S65
CARDIS
card disable (Mirano)
(not for safety PLCs)
Set to 1 by the user to disable access to the card. The system will detect a rising edge on this bit. When current access is finished (for example application save in progress), then the access LED will be off indicating that extraction is possible. The user has to reset the bit after extracting the card.
%S68
PLCBAT
state of the processor battery
This bit is used to check the operating state of the backup battery for saving data and the program in RAM:
  • set to 0: battery present and operational
  • set to 1: battery missing or non-operational
%S76
DIAGBUFFCONF
configured diagnostics buffer
This bit is set to 1 by the system when the diagnostics option has been configured. Then, a diagnostics buffer for storage of errors found by diagnostics DFBs is reserved.
This bit is read-only.
%S77
DIAGBUFFFULL
full diagnostics buffer
This bit is set to 1 by the system when the buffer that receives errors from the diagnostics function blocks is full.
This bit is read-only.
%S78
HALTIFERROR
stop in the event of error
Normally at 0, this bit can be set to 1 by the user, to program a PLC stop on application fault: %S15, %S18, %20.
%S80
RSTMSGCNT
reset message counters
Normally set to 0, this bit can be set to 1 by the user to reset the message counters %SW80 to %SW86.
%S94
SAVECURRVAL
saving adjustment values
(not for safety PLCs)
Normally at 0, this bit can be set to 1 by the user to replace the initial values of the declared variables with a ‘Save’ attribute (e.g.: DFB variables) with the current values.
For Modicon M340, on a %S94 rising edge, the internal RAM and the memory card content are different (%S96 = 0 and the CARDERR LED is on). On cold start, the current values are replaced by the most recent initial values only if a save to memory card function (Backup Save or %S66 rising edge) was done.
The system resets the bit %S94 to 0 when the replacement has been made.
Note: this bit must be used with care: do not set this bit permanently to 1 and use the master task only.
%S95
RESTINITVAL
restore initial values
(not for safety PLCs)
Normally on 0, this bit can be set on 1 by the user to restore the adjustment values of user function blocks.
%S96
BACKUPPROGOK
backup program OK
(not for safety PLCs)
TSX Micro:
  • on 0: application program saves are invalid
  • on 1: application program saves are valid
    This bit can be read at any time (either by the program or while adjusting), in particular after a cold start or a warm restart. It is significant with regard to a PL7-effected backup application within the internal flash EPROM.
M340:
  • Set to 0 by the system when the card is missing or not usable (bad format, unrecognized type) or card content inconsistent with internal application RAM.
  • Set to 1 when the card is correct and application is consistent with CPU internal application RAM.
%S97
SAVEMWOK
save %MW OK
(not for safety PLCs)
on 0: %MW saves are invalid
on 1: %MW saves are valid
This bit can be read at any time (either by the program or while adjusting), in particular after a cold start or a warm restart.
NOTE: Quantum Safety PLCs specific system bits usage is described in the Unity_Pro_XLS Software Operating Modes Specifics guide.
System Words
The following subsets of %SW system word are supported:
Word
Symbol
Function
Description
%SW0
MASTPERIOD
master task scanning period
This word is used to modify the period of the master task via the user program or via the terminal.
The period is expressed in ms (1...255 ms)
%SW0=0 in cyclic operation.
On a cold restart: it takes the value defined by the configuration.
%SW1
FASTPERIOD
fast task scanning period
(not for safety PLCs)
This word is used to modify the period of the fast task via the user program or via the terminal.
The period is expressed in milliseconds (1...255 ms).
On a cold restart, it takes the value defined by the configuration.
%SW2
AUX0PERIOD to
%SW5
AUX3PERIOD
auxiliary task scanning period
(not for safety PLCs)
This word is used to modify the period of the tasks defined in the configuration, via the user program or via the terminal.
The period is expressed in tens of ms (10ms to 2.55s).
%SW10
TSKINIT
first cycle after cold start
(not for safety PLCs)
If the value of the current task bit is set to 0, this means that the task is performing its first cycle after a cold start:
  • %SW10.0: assigned to the MAST task
  • %SW10.1: assigned to the FAST task
  • %SW10.2 to 5: assigned to the AUX 0...3 tasks
%SW11
WDGVALUE
watchdog duration
Reads the duration of the watchdog. The duration is expressed in milliseconds (10...1500 ms).
This word cannot be modified.
NOTE: The duration range in Quantum Safety PLCs is: 20...990 ms.
%SW12
APMODE
mode of application processor
(for safety PLCs only)
This word indicates the operating mode of the application processor. Possible values are:
  • 16#A501: application processor is in Maintenance Mode
  • 16#5AFE: application processor is in Safety Mode
Any other value is interpreted as a detected error.
This system word is not available for the standard Quantum CPU.
%SW13
INTELMODE
mode of Intel processor
(for safety PLCs only)
This word indicates the operating mode of the Intel Pentium processor. Possible values are:
  • 16#501A: application processor is in Maintenance Mode
  • 16#5AFE: application processor is in Safety Mode
Any other value is interpreted as a detected error.
This system word is not available for the standard Quantum CPU.
%SW15
OSCOMMPATCH
PLC processor patch version
This word contains the commercial version of the PLC processor patch.
It is coded onto the least significant byte of the word.
coding: 0 = no patch, 1 = A, 2 = B...
Example: 16#0003 corresponds to patch C.
%SW17
FLOATSTAT
error status on floating operation
(%SW17 System word is also managed by Quantum Safety PLCs)
When an error in a floating arithmetic operation is detected, bit %S18 is set to 1 and %SW17 error status is updated according to the following coding:
  • %SW17.0 = Invalid operation / result is not a number
  • %SW17.1 =Denormalized operand / result is acceptable (flag not managed by Modicon M340 or Quantum Safety PLCs)
  • %SW17.2 = Division by 0 / result is infinity
  • %SW17.3 = Overflow / result is infinity
  • %SW17.4 = Underflow / result is 0
  • %SW17.5 to 15 = not used
This word is reset to 0 by the system on cold start, and also by the program for re-usage purposes.
%SW18
%SW19
100MSCOUNTER
absolute time counter
%SW18 is the low and %SW19 the high word for calculating durations. Both are incremented every 1/10th of a second by the system (even when the PLC is in STOP, they are no longer incremented if it is powered down). They can be read and written by the user program or by the terminal.
%SW20
%SW21
MSCOUNTER
absolute time counter
The low word %SW20 and the high word %SW21 are incremented every 1/1000th of a second by the system (even when the PLC is in STOP, they are no longer incremented if it is powered down). They can be read by the user program or by the terminal. %SW20 and %SW21 are reset on a cold start, but not on a warm start.
%SW26
number of requests processed
This system word allows to verify on server side the number of requests processed by PLC per second.
NOTE: This system word is available only for Modicon M340 CPU.
%SW30
MASTCURRTIME
master task execution time
This word indicates the execution time of the last master task cycle (in ms).
Note: In general %SW30 works, but keep in mind that a PC is much faster as a PLC. For a short application a scan time less than 1ms is possible, in such a case %SW30 remains at 0. %SW30 will not be updated when an exception (division by 0, overflow, etc.) occurs during execution of the user logic or after any user debug activity. If an application throws an exception in each cycle, %SW30 will remain at 0 and %SW31, %SW32 will remain at 32768 and 32767 from the beginning.
%SW31
MASTMAXTIME
maximum master task execution time
This word indicates the longest master task execution time since the last cold start (in ms).
%SW32
MASTMINTIME
minimum master task execution time
This word indicates the shortest master task execution time since the last cold start (in ms).
%SW33
FASTCURRTIME
fast task execution time
(not for safety PLCs)
This word indicates the execution time of the last fast task cycle (in ms).
%SW34
FASTMAXTIME
maximum fast task execution time
(not for safety PLCs)
This word indicates the longest fast task execution time since the last cold start (in ms).
%SW35
FASTMINTIME
minimum fast task execution time
(not for safety PLCs)
This word indicates the shortest fast task execution time since the last cold start (in ms).
%SW36
AUX0CURRTIME
%SW39
AUX1CURRTIME
%SW42
AUX2CURRTIME
%SW45
AUX3CURRTIME
auxiliary task execution time
(different function in Safety PLCs)
Those words indicate the execution time of the last cycle of the AUX 0...3 tasks (in ms).
NOTE: %SW36 and %SW39 words have a different function in Quantum Safety PLCs and the other words are not available on Quantum safety PLCs.
%SW37
AUX0MAXTIME
%SW40
AUX1MAXTIME
%SW43
AUX2MAXTIME
%SW46
AUX3MAXTIME
maximum auxiliary task execution time
(different function in Safety PLCs)
Those words indicate the longest task execution time of AUX 0...3 tasks since the last cold start (in ms).
NOTE: %SW37 word has a different function in Quantum Safety PLCs and the other words are not available on Quantum safety PLCs.
%SW38
AUX0MINTIME
%SW41
AUX1MINTIME
%SW44
AUX2MINTIME
%SW47
AUX3MINTIME
minimum auxiliary task execution time
(different function in Safety PLCs)
Those words indicate the shortest task execution time of AUX 0...3 tasks since the last cold start (in ms).
NOTE: %SW38 word has a different function in Quantum Safety PLCs and the other words are not available on Quantum safety PLCs.
%SW48
IOEVTNB
number of events
(not for safety PLCs)
This word indicates the number of IO events and telegram processed since the last cold start. This word can be written by the program or the terminal
NOTE: TELEGRAM is available only for PREMIUM (not on Quantum neither M340).
%SW49
DAYOFWEEK
%SW50
SEC
%SW51
HOURMIN
%SW52
MONTHDAY
%SW53
YEAR
real-time clock function
System words containing date and current time (in BCD):
  • %SW49:
    Day of the week:
    • 1 = Monday,
    • 2 = Tuesday,
    • 3 = Wednesday,
    • 4 = Thursday,
    • 5 = Friday,
    • 6 = Saturday,
    • 7 = Sunday,
  • %SW50: Seconds (16#SS00),
  • %SW51: Hours and Minutes (16#HHMM),
  • %SW52: Month and Day (16#MMDD),
  • %SW53: Year (16#YYYY).
These words are managed by the system when the bit %S50 is set to 0.
These words can be written by the user program or by the terminal when the bit %S50 is set to 1.
For M580:
  • The current time is in UTC (Coordinated Universal Time). If a local time is needed, use the RRTC_DT function.
%SW54
STOPSEC
%SW55
STOPHM
%SW56
STOPMD
%SW57
STOPYEAR
%SW58
STOPDAY
real-time clock function on last stop
System words containing date and time of the last power failure or PLC stop (in Binary Coded Decimal):
  • %SW54: Seconds (00SS),
  • %SW55: Hours and Minutes (HHMM),
  • %SW56: Month and Day (MMDD),
  • %SW57: Year (YYYY),
  • %SW58:
    The most significant byte contains the day of the week (1 for Monday through to 7 for Sunday), and the least significant byte contains the code for the last stop:
    • 1 = change from RUN to STOP by the terminal or the dedicated input,
    • 2 = stop by watchdog (PLC task or SFC overrun),
    • 4 = power outage or memory card lock operation,
    • 5 = stop on hardware fault,
    • 6 = stop on software fault. Details on the type of software fault are stored in %SW125.
%SW70
WEEKOFYEAR
real-time clock function
System word containing the number of the week in the year: 1 to 52.
%SW71
KEY_SWITCH
position of the switches on the Quantum front panel
This word provides the image of the positions of the switches on the front panel of the Quantum processor. This word is updated automatically by the system:
  • %SW71.0 = 1 switch in the "Memory protected" position,
  • %SW71.1 = 1 switch in the "STOP" position,
  • %SW71.2 = 1 switch in the "START" position,
  • %SW71.8 = 1 switch in the "MEM" position,
  • %SW71.9 = 1 switch in the "ASCII" position,
  • %SW71.10 = 1 switch in the "RTU" position,
  • %SW71.3 to 7 and 11 to 15 are not used.
%SW75
TIMEREVTNB
Timer-type event counter
This word contains the number of timer-type events in the queue.
(1): Not available on the following processors: TSX 57 1•/2•/3•/4•/5•.
This word is not available on Quantum Safety PLCs.
%SW75
TIMEREVTNB
timer-type event counter
(not for safety PLCs)
This word contains the number of timer-type events in the queue.
%SW76
DLASTREG
diagnostics function:
recording
Result of the last registration:
  • = 0 if the recording was successful,
  • = 1 if the diagnostics buffer has not been configured,
  • = 2 if the diagnostics buffer is full.
%SW77
DLASTDEREG
diagnostics function:
non-recording
Result of the last deregistration:
  • = 0 if the non-recording was successful,
  • = 1 if the diagnostics buffer has not been configured,
  • = 21 if the error identifier is invalid,
  • = 22 if the error has not been recorded.
%SW78
DNBERRBUF
diagnostics function:
number of errors
Number of errors currently in the diagnostics buffer.
%SW87
MSTSERVCNT
communication flow management
Number of requests processed by synchronous server per master (MAST) task cycle.
The requests processed may come from communication ports (having access to the server Modbus/UNI-TE, each of them having its own limitation). This means also that requests from other clients, then communication EFs like IO Scanner, connected HMI and so on should be counted.
%SW90
MAXREQNB
maximum number of requests processed per master task cycle
This word is used to set a maximum number of requests which can be processed by the PLC per master task cycle.
When the CPU is the server: This number of requests must be between 2 (minimum) and N+4 (maximum).
N: number differs depending on the model.
When the CPU is the client:
N: number differs depending on the model.
The value 0 will not work. If a value that is outside of the range is entered, it is the value N that is taken into account.
%SW93
memory card file system erasing command and status
Can be read and written by the user program or the terminal. This word is used by the customer to erase the memory card. Erasing is possible only in Stop mode:
  • %SW93.0 = 1 a rising edge starts the erasing operation.
%SW93.1 gives the file system status after an erasing request:
  • %SW93.1 = 0 invalid files system (bad format, erasing in progress),
  • %SW93.1 = 1 valid files system.
%SW96
CMDDIAGSAVEREST
command and diagnostic of save and restore
This word is used to copy or delete the current value of %MW to or from internal flash memory and to give the action’s status. It can be read by the user program or by the terminal:
  • %SW96.0: Request to copy current value of %MW to internal Flash memory. Set to 1 by the user to request a save, and set to 0 by the system when a save is in progress.
    NOTE: You must stop the processor before copying via %SW96.0.
  • %SW96.1 is set to 1 by the system when a save is finished, and set to 0 by the system when a save is in progress.
  • %SW96.2 = 1 indicates an error on a save or restore operation (see %SW96.8 to 15 for error code definitions).
  • %SW96.3 = 1 indicates that a restore operation is in progress.
  • %SW96.4 may be set to 1 by the user to delete %MW area in internal Flash memory.
  • %SW96.7 = 1 indicates that internal memory has valid %MW backup.
  • %SW96.8 to 15 are error codes:
    When %SW96.2 is set to 1:
    • %SW96.9 = 1 indicates that the saved %MW number is less than the configured number,
    • %SW96.8 = 1 and %SW96.9 = 1 mean that the saved %MW number is greater than the configured number,
    • %SW96.8 = 1, %SW96.9 = 1 and %SW96.10 = 1 indicate a write error in internal flash memory.
%SW97
CARDSTS
card status
Can be read by the user program or by the terminal. Indicates the status of the card.
%SW97:
0000 = no error.
0001 = application backup or file write sent to a write-protected card.
0002 = card not recognized, or application backup damaged.
0003 = backup of the application requested, but no card available.
0004 = card access error, for example after a card has been removed improperly.
0005 = no file system present in the card, or file system not compatible. Use %SW93.0 to format the card.
%SW108
FORCEDIOIM
number of forced I/O module bits
This system word counts the number of forced I/O module bits. This word is incremented for every forcing, and decremented for every unforcing.
%SW109
FORCEDANA
number of forced analog channels
This system word counts the number of forced analog channels. This word is incremented for every forcing, and decremented for every unforcing.
%SW124
CPUERR
type of processor or system error
This system word is updated when the PLC is put in the error state.
The possible values are:
  • 0x0065: execution of HALT impossible,
  • 0x0080: system watchdog.
When the PLC is put in safety error state the content of %SW125 is updated and can be read after the next restart of the PLC (see below).
%SW125
BLKERRTYPE
last fault detected
The code of the last fault detected is given in this word: The following error codes cause the PLC to stop if %S78 is set to 1. %S15, %S18 and %S20 are always activated independently of %S78:
  • 16#0002: verification of PCMCIA signature fails,
  • 16#2258: execution of HALT instruction,
  • 16#2302: call to non supported system function in a user function block,
  • 16#9690: error of application CRC detected in background,
  • 16#DE87: calculation error on floating-point numbers (%S18, these errors are listed in the word %SW17),
  • 16#DEB0: Watchdog overflow (%S11),
  • 16#DEF0: division by 0 (%S18)
  • 16#DEF1: character string transfer error (%S15),
  • 16#DEF2: arithmetic error (%S18),
  • 16#DEF3: index overflow (%S20).
Note: The codes 16#8xxx and 16#7xxx do not stop the application and indicate an error on function blocks.
In case of a safety error, the PLC will stop. After power off and restart of the PLC, %SW125 will contain the code of the cause of the error:
  • 0x5AF1: Sequence check error (unpredictable execution in CPU)
  • 0x5AF2: Error in memory (address fault)
  • 0x5AF3: Comparison error (execution results of Intel and application processor differ)
  • 0x5AF4: Real-time clock failure
  • 0x5AF5: Error initializing double code execution
  • 0x5AF6: Watchdog activation error
  • 0x5AF7: Error during memory check (takes more than 8 hours)
  • 0x5AF8: Error in memory check (RAM failure)
Note: %SW125 is only reset after init or complete download or restart (it always contains the last fault detected).
%SW126
ERRADDR0
%SW127
ERRADDR1
blocking error instruction address
Address of the instruction that generated the application blocking error.
For 16 bit processors:
  • %SW126 contains the offset for this address,
  • %SW127 contains the segment number for this address.
For 32 bit processors:
  • %SW126 contains the least significant word for this address,
  • %SW127 contains the most significant word for this address.
In case of a safety error, the content of %SW126 and %SW127 is for Schneider Electric use only.
NOTE: Quantum Safety PLCs specific system words usage is described in the Unity_Pro_XLS Software Operating Modes Specifics guide.