Understanding Legacy PLC Code: Pattern Recognition Guide

Undocumented PLC code looks intimidating but follows predictable patterns. Once you learn to recognize these patterns, you can understand most legacy programs without documentation. This guide teaches the most common patterns found in industrial S5 and S7 programs.

Pattern 1: Self-Holding Circuit (Selbsthaltung)#

The most common pattern in any PLC program. A motor or valve that stays on after a momentary button press.

AWL:

U  E 0.0       // Start (momentary)
O  A 4.0       // OR self-hold
UN E 0.1       // AND NOT Stop
UN E 0.2       // AND NOT E-Stop
=  A 4.0       // Motor output

How to recognize it: An output (A x.y) appears both as a query operand (U/O) and as the assignment target (=) in the same network. The OR with its own output creates the "latch."

SCL equivalent:

IF Start OR Motor THEN
    IF NOT Stop AND NOT EStop THEN
        Motor := TRUE;
    ELSE
        Motor := FALSE;
    END_IF;
END_IF;

Pattern 2: Step Sequence (Schrittkette)#

A process that moves through steps, with each step activating specific outputs and checking transition conditions.

AWL (using marker word as step counter):

// Step 0: Idle
L   MW 10
L   KF +0
!=F
SPBN =M010
U   E 0.0          // Start button
SPB =M011
SPA =M099
M011: L KF +1
T   MW 10           // Go to step 1
SPA =M099

// Step 1: Fill
M010: L MW 10
L   KF +1
!=F
SPBN =M020
=   A 4.0           // Open valve
U   E 1.0           // Level high sensor
SPB =M021
SPA =M099
M021: L KF +2
T   MW 10           // Go to step 2
R   A 4.0           // Close valve
SPA =M099

M020: ... // Step 2, etc.
M099: NOP 0          // End

How to recognize it: A marker word (MW) is loaded, compared with constants, and used for conditional jumps. Each comparison block controls different outputs. The MW value changes when transition conditions are met.

SCL equivalent: CASE statement (shown in B1.10).

Pattern 3: Safety Interlock Chain#

Multiple conditions that must all be TRUE before a dangerous operation is allowed.

AWL:

U  E 0.2       // Safety door closed
U  E 0.3       // Light curtain clear
U  E 0.4       // Pressure OK
U  E 0.5       // Temperature OK
UN E 0.6       // NOT emergency stop
=  M 20.0      // Enable signal

How to recognize it: A long chain of U (AND) and UN (AND NOT) operations, all connected to a single output marker. This marker is then used as a condition in other networks.

Pattern 4: Analog Scaling#

Converting raw analog input values (0–27648 for Siemens, or BCD in older systems) to engineering units.

AWL (S5 — simple linear scaling):

L  PEW 128      // Read analog input (raw)
L  KF +6400     // Subtract offset
-F
L  KF +100      // Scale factor numerator
×F
L  KF +20000    // Scale factor denominator
:F
T  MW 30        // Result in engineering units

How to recognize it: Load from PEW/PEW (peripheral input), followed by arithmetic operations (+F, -F, ×F, :F) with constants, result stored in MW or DW.

Pattern 5: Flashing / Blink Generator#

A timer-based output that alternates between TRUE and FALSE.

AWL:

UN M 50.0
L  KT 005.1     // 500ms
SI T 10
U  T 10
=  M 50.0       // Blink marker (toggles every 500ms)

How to recognize it: A timer whose start condition is the negation of its own output marker. The marker toggles every time the timer expires, creating a 50/50 duty cycle blink.

Pattern 6: Edge-Triggered One-Shot#

Executes an action exactly once when a condition changes.

AWL:

U  E 0.0       // Trigger signal
FP M 60.0      // Positive edge detection
=  M 60.1      // One-shot output (TRUE for one scan)

How to recognize it: FP (or FN) instruction followed by an assignment. The result is TRUE for exactly one scan cycle.

Pattern 7: Data Block Recipe Selection#

Loading recipe data from different data blocks based on a selection.

AWL:

L  MW 100      // Recipe number
L  KF +10
+F              // DB number = recipe + 10
T  MW 102
A  DB [MW102]  // Open calculated DB (indirect)
L  DW 0        // Load first recipe parameter
T  MW 200      // Store in working memory

How to recognize it: A calculated DB number, followed by A DB and multiple L DW / T MW operations. This pattern loads different parameter sets from different data blocks.

How to Approach Unknown Code#

1. Start with OB1: This is always the main program. Follow the block calls to understand the program structure.
2. Look at outputs first: Find where each physical output (A x.y) is written. Trace backward to understand the conditions.
3. Identify the step sequence: Most machines have a main sequence. Find the step counter variable (usually a MW).
4. Map safety logic: Identify all E-stop and interlock patterns early — they appear throughout the program.
5. Use the cross-reference: For any mystery address, look at where else it is used.

How PLCcheck Pro Helps#

PLCcheck Pro automatically recognizes these patterns:

• Labels self-holding circuits, step sequences, safety interlocks
• Identifies blink generators, one-shots, analog scaling
• Maps the complete program flow from OB1 through all called blocks
• Generates plain-language explanations for each recognized pattern

Upload your legacy code →

Maintained by PLCcheck.ai. Last update: March 2026. Not affiliated with Siemens AG.