Clamp HMI numeric entry limits in PLC ladder logic

Why won't the numeric entry object's min and max work as adjustable limits?

The numeric entry object's minimum and maximum are design-time constants stored in the panel project. A password-protected screen cannot change them at runtime. The workable answer is to clamp the setpoint in ladder logic against limits held in retentive PLC registers.

The object writes the typed value into one register. Its min and max are attributes of the object itself, saved at design time and compared inside the panel, not pointers into controller memory. Changing a limit means editing the project and downloading it to the panel again. That is exactly what a protected setup screen is meant to make unnecessary. Defaults matter too: some editors ship analog entry objects with a 0 to 100 range preset, which clips typed entries before they ever reach the register.

Three shortcuts get tried first, and each fails for a specific reason:

• Type fixed min and max into the entry object. The values travel with the project. Every limit change becomes an edit and a download, and the setup screen has nothing to edit.
• Trust the panel to reject bad entries. Panel-side checking covers that one object. A second operator interface, the programming software's data view, or logic in another task can still put an out-of-range value into the register that drives the analog output.
• Scale in the panel. Panel-side scaling constants are fixed at design time exactly like the limits. Variable scaling is no more available there than variable limiting.

Some current HMI tag systems put limits on the tag itself: a tag definition can carry four range thresholds, two hard limits and two warnings. Where your tag configuration offers that, use it, and keep the ladder clamp as the point every writer passes.

Recommendation: Keep the limits, the scaling endpoints and the setpoint in retentive PLC registers, and clamp in ladder for any operator setpoint that drives an analog output. Rely on the object's typed min and max only when the limits are final for the life of the machine and no other device can write the register.

What registers do you need before you write the clamp?

Set up four retentive registers before you open the ladder editor: one entry register the numeric entry object writes, one active setpoint register the scaling reads, and two limit registers. Put every one in a retentive range so the limits survive power loss.

The names below are illustrative. Assign real addresses from your PLC's user data area, and put the limit and scaling registers in a retentive range.

Match the data format the entry object writes, binary or BCD, to the format your compare and math instructions use. A mismatch makes the clamp trip at values nobody typed. Bind each object to its register address in the project, and clear address-binding problems the way fixing HMI invalid address errors when tagging PLC memory sets out. The panel never writes Sp_Act; only the clamp rungs do.

How do you clamp the setpoint in ladder logic?

Clamp in three rungs that run every scan: validate the limits, then write the smaller of the entry value and the high limit, then the larger of that result and the low limit, into the active setpoint the scaling rung reads.

Work through the rungs in this order:

1. Validate. If Lim_Lo is greater than or equal to Lim_Hi, leave Sp_Act at its last value, set LimitFault, and skip the rest for that scan.
2. Clear LimitFault when the limits are valid.
3. Clamp the high side. If Sp_Entry is greater than Lim_Hi, write Sp_Act = Lim_Hi.
4. Clamp the low side. Otherwise, if Sp_Entry is less than Lim_Lo, write Sp_Act = Lim_Lo.
5. Pass clean values. Otherwise write Sp_Act = Sp_Entry.
6. Write back. Copy Sp_Act into Sp_Entry, so the panel field shows the value the output actually received instead of the value the operator typed.
7. Bound the limits themselves. Keep Lim_Lo and Lim_Hi inside the count range the analog output module can produce for the selected signal range; the module datasheet prints that range.

The same logic in structured text, with the illustrative types declared:

(* Sp_Entry, Sp_Act, Lim_Lo, Lim_Hi : DINT;  LimitFault : BOOL := FALSE *)
IF Lim_Lo >= Lim_Hi THEN
  LimitFault := TRUE;      (* hold last good Sp_Act *)
ELSE
  LimitFault := FALSE;
  IF Sp_Entry > Lim_Hi THEN
    Sp_Act := Lim_Hi;
  ELSIF Sp_Entry < Lim_Lo THEN
    Sp_Act := Lim_Lo;
  ELSE
    Sp_Act := Sp_Entry;
  END_IF;
  Sp_Entry := Sp_Act;      (* write-back: panel shows the applied value *)
END_IF;

In ladder this is two compare-and-move pairs. Either way, the rungs sit between the register the panel writes and the register the scaling reads. They run on every scan of the task that owns the output.

How do you turn the scaling values into variables too?

Store the four scaling endpoints in retentive registers next to the limits and calculate the output counts in ladder. Do the multiply before the divide inside a 32-bit intermediate, because a 16-bit signed product overflows above 32767.

The linear scaling rung computes:

Out_counts = Out_Lo + (Sp_Act - Eng_Lo) * (Out_Hi - Out_Lo) / (Eng_Hi - Eng_Lo)

• Multiply before divide: dividing first throws away resolution, and a 16-bit multiply overflows long before a full span is scaled.
• Guard the divisor: if Eng_Hi equals Eng_Lo, skip the calculation and set a scaling fault bit.
• Take Out_Lo and Out_Hi from the analog output module datasheet for the selected signal range; 0-10 V, ±10 V and 4-20 mA are the common ranges.
• Edit all four endpoints from the same setup screen as the limits, so a re-ranged process needs no download.

Scaling instructions in the older ladder instruction sets read their minimum and maximum from registers for exactly this reason. The worked example in scaling min and max kept in registers shows the same pattern on one of those instructions.

How do you lock limit edits to a password screen?

Gate the setup screen with the panel's access control and add a PLC-side enable bit on a 30 s timer. A panel password stops casual edits only while the registers stay writable from programming software and any other device that reaches the PLC.

1. Put the limit and scaling entry objects on one setup screen and gate that screen with the panel's password or security feature; the access-control setup for a protected operator view covers the panel side of that gate.
2. Give the screen its own registers to write: Lim_Lo_New and Lim_Hi_New, plus staging registers for the scaling endpoints if you make those editable too.
3. Add one ladder rung that copies the staged values into Lim_Lo and Lim_Hi only while Edit_Enable is on. Have the setup screen set Edit_Enable while a 30 s timer runs. Thirty seconds is enough to type and confirm a limit pair; widen it if operators work with a manual open.
4. Keep the ladder gate as the permanent repair and the panel password as the first layer. Confirm which security options your panel release supports in the help file of the programming software you actually run.

Group the objects once and copy the screen across the line; reusable HMI equipment panels is the pattern for operator screens that stay consistent between machines.

Example: how does a 0-500 °C setpoint become 4-20 mA counts?

With the limits at 100 and 450 °C, a 0-500 °C setpoint on a 4-20 mA output scaled to 32767 counts maps 100 °C to 6553 counts, about 7.2 mA, and 450 °C to 29490 counts, about 18.4 mA.

The scenario: a tempering oven may run between 100 and 450 °C while its process span is 0 to 500 °C, and the analog card drives a 4-20 mA valve. The example assumes the card's datasheet gives 0 counts at 4 mA and 32767 counts at 20 mA for the selected range. The scaling registers hold Eng_Lo = 0 °C, Eng_Hi = 500 °C, Out_Lo = 0, Out_Hi = 32767.

The operator types 60 °C. The low clamp applies because 60 is below 100, so Sp_Act = 100 °C and the write-back shows 100 °C on the panel. The scaling rung then computes 100 * 32767 / 500 = 3,276,700 / 500 = 6553 counts, and the card delivers 4 mA + 16 mA * 6553 / 32767 = 7.20 mA.

The operator then types 480 °C. The high clamp applies because 480 is above 450, so Sp_Act = 450 °C. The counts are 450 * 32767 / 500 = 14,745,150 / 500 = 29490, and the card delivers 4 mA + 16 mA * 29490 / 32767 = 18.40 mA.

The intermediate product 3,276,700 exceeds the 16-bit signed ceiling of 32767 and sits well inside the 32-bit signed ceiling of 2,147,483,647, so the multiply runs in double words. The largest product this span can produce, 500 * 32767 = 16,383,500, fits the same way. One count is 16,000 µA / 32767 ≈ 0.49 µA, so dropping the fraction after the divide moves the loop by under half a microamp.

Whatever the operator types between 0 and 500 °C, the card receives between 7.20 mA and 18.40 mA, and the panel shows the clamped value.

How do you check the clamp before releasing the machine?

Run seven checks with the field device disconnected or a loop meter in the 4-20 mA circuit. The clamp tests drive a real actuator to both of its limits.

1. Enter 60 °C against the 100 °C low limit: the card sits at 6553 counts and the panel field snaps back to 100 °C.
2. Enter 480 °C against the 450 °C high limit: the card sits at 29490 counts.
3. Enter values exactly at each limit: both pass through to the card unchanged.
4. Set Lim_Lo at or above Lim_Hi, say 450 °C low and 100 °C high: LimitFault sets and the output holds its last good value.
5. Write 9999 into Sp_Entry from the programming software's data view: the clamp catches it, which shows the enforcement point works for writers that never touch the panel.
6. Cycle power to the PLC: the limits and the scaling registers return unchanged from the retentive range.
7. Measure the loop current at the low and high engineering values and compare against the calculated counts: 7.20 mA at 100 °C and 18.40 mA at 450 °C in the example above.

If all seven pass, the adjustable limits are live: the setup screen edits them at runtime, the clamp enforces them for every writer, and the scaling rung tracks the card's real counts. If the clamp passes every check and the measured current still misses the calculated counts, take the panel model, the programming software version, the PLC model and the analog card part number to the panel vendor's technical support.

If the cell also needs a standalone notice or status board that plays its own files beside the machine, that is a separate job from the HMI. The shop-floor display category is where our screens for that job live.

Questions