Recipe dependent HMI entry limits enforced in PLC logic

Why the object limits stay fixed

The minimum and maximum on a numeric-entry object are screen-project settings. On some HMI platforms the product documentation for numeric input states that the minimum and maximum cannot be bound to variables, and points to a clamp in the PLC program as the way to handle a range that changes. Some HMI software also ships analog entry tags with 0 and 100 as the default minimum and maximum, so a raised maximum is the vendor's documented fix when the process needs more headroom.

So on those panels, fixed object limits are the documented behavior, and the PLC is the documented place for a range that changes with the recipe. A software update changes that only when its release documentation states that numeric entry now accepts variables for the minimum and maximum; check there before rewiring the project.

If your bounds never change, a clamp rung is all you need, and clamping HMI numeric entry limits in PLC ladder logic covers that case. This article is for the case where every recipe carries its own range.

Symptoms and what each points to

• The entry box refuses a value the recipe sheet allows. The configured guard is narrower than the recipe range, which is exactly what an untouched default produces on a process that runs higher. Widen the guard so it sits outside every recipe range.
• The entry box accepts a value the recipe sheet forbids. The guard is wider than the active recipe range. That is the expected case, and the PLC compare is what rejects the value.
• The limits are retyped by hand on every recipe change. The guard is static, and every manual edit is a chance to type the wrong bound. Load the bounds from the recipe table in the PLC instead.
• A software update was installed hoping the limits would follow variables. That works only when the release documentation says so. Otherwise the ladder pattern below is the fix.

The ladder pattern

The tag names here are illustrative; use your project's naming convention. STG, RCP_MIN, RCP_MAX and SP share one numeric type, a signed integer in counts, and SP_REJ is a boolean reject flag.

1. Load the bounds when the recipe is selected. Copy the active row's minimum and maximum into RCP_MIN and RCP_MAX, then check that RCP_MIN is less than or equal to RCP_MAX. On a mismatch, set a recipe-data fault and block acceptance until it is cleared. The table layout and the load rung are covered in storing HMI recipe tables in PLC memory and loading the values.
2. Stage the entry on the write event. The Enter move is the hook: the submitted value lands in STG and nowhere else. Moving an HMI numeric entry into PLC memory on Enter shows that rung. Nothing writes to SP from the screen.
3. Compare in one unit system. Declare the scaling once in the project, and compare in the PLC's unit. Never mix the displayed value and the stored count in one rung.
4. Run the range check. Two rungs (STG greater than or equal to RCP_MIN, and STG less than or equal to RCP_MAX) or one limit instruction both work. A LIMIT instruction is common across PLC instruction sets: it tests whether a test value lies within a low limit and a high limit, so one rung does the work of two compares. Check your own instruction set's reference for its exact boundary behavior. Decide inclusive or exclusive at each boundary, and wire the comparison to match what the recipe sheet says.
5. Copy on pass, hold on fail. When the range check passes, move STG into SP and clear SP_REJ. When it fails, leave SP unchanged, set SP_REJ, and show a screen message that names the allowed range.
6. Read SP downstream. Machine logic consumes SP only. STG feeds the compare and nothing else, so a rejected entry has no path to an output.
7. Handle the recipe change. When the recipe switches and the standing SP falls outside the new RCP_MIN and RCP_MAX, hold the value and raise a flag for the operator or the process owner. Add an automatic clamp only when the clamped value is an approved safe output. Letting the PLC catch an HMI recipe load with a handshake tag keeps the bounds in the PLC matched to the recipe on the screen.

Example: a 150 to 200 °C oven recipe checked against a 0 to 1000 °C guard

Inputs, and where each comes from:

• Entry guard: minimum 0, maximum 1000, in °C, configured in the screen project and set outside every recipe range. It replaces the untouched default some software ships on analog tags, which sits far below this recipe.
• Recipe A bounds: minimum 150 °C, maximum 200 °C, from the oven's process sheet.
• Scaling: 0.1 °C per count, declared once in the project; the screen shows one decimal, the PLC stores signed integer counts. RCP_MIN is 1500 counts (150 ÷ 0.1) and RCP_MAX is 2000 counts (200 ÷ 0.1).
• Entries tested: 175.0, 250.0 and the boundary 200.0, all typed in °C.

Rule in words: an entry is accepted when the staged count is greater than or equal to the minimum bound and less than or equal to the maximum bound. On a pass the staged count becomes the accepted setpoint; on a fail the accepted setpoint holds its last value and SP_REJ sets.

Arithmetic, entry by entry:

Result: two of the three entries reach the oven setpoint, and the 250.0 entry stops at the compare with a message naming 150.0 to 200.0 °C. Had the untouched default guard stayed in place, the box would have refused the legal 150.0 minimum before the PLC ever saw a value, which is the first symptom above.

Decision: whenever the guard range is wider than the active recipe range, the PLC compare is the authority and the guard is a typing filter. Keep the guard outside every recipe: the recipes here span 120.0 to 200.0 °C, so the 0 to 1000 °C guard clears them all, while a process that ever ran above 1000 °C would need the guard raised first or the box would refuse a legal entry. The fixed-limit version of this same temperature entry is in setting a temperature setpoint with HMI numeric entry limits.

What to check before you run it

Run these with outputs forced safe or the machine in a commissioning state, and watch the PLC tag the machine consumes: a rejection message on the screen does not prove the machine never saw the bad value, so verify at SP.

1. Enter a value under the loaded minimum. SP holds and SP_REJ sets.
2. Enter a value over the loaded maximum. Same result.
3. Enter exactly RCP_MIN and exactly RCP_MAX. Both pass under the inclusive rule; if a recipe sheet wants exclusive bounds, the comparison must say so.
4. Enter a mid value. It is accepted, copied, and the downstream logic sees it at SP.
5. Switch recipes while an entry is pending. Test the policy you chose in step 7: either the entry is judged against the bounds latched when the screen opened, or it is discarded on the recipe change.
6. Switch to a recipe whose bounds exclude the standing SP. The flag raises and the machine holds for an operator decision.
7. Power-cycle. The bounds, the accepted value and the bounds-valid condition initialize as designed, and no acceptance is allowed until RCP_MIN and RCP_MAX have loaded.

Record the recipe values used, the tags involved and the results, so the next engineer inherits the test and the rungs together.

Recommendation

Recommendation: keep the numeric-entry object's fixed limits as a coarse guard set outside every recipe range, and make the PLC compare the authority for the recipe bounds. Stage every entry into one tag, compare the staged count against the loaded minimum and maximum, copy it to the accepted setpoint on a pass, and on a fail hold the last accepted value with a message that names the allowed range. When a recipe change leaves the standing setpoint outside the new bounds, hold it and flag it; add an automatic clamp only when the process owner has approved the clamped value as a safe output.

More shop-floor screen and control answers are collected in the factory and plant screens section.

Questions