HMI setpoint validation: keep low below high before the PLC

Symptoms and what each points to

Each symptom points at one layer:

• The panel accepts a low setpoint above the high setpoint. Both entries sat inside their own ranges, so the range check passed. The pair rule lives nowhere yet; build it in the PLC.
• An entry snaps back to the old number right after typing. The object's range refused the value. Re-read the min and max fields on that object; the panel is doing its job.
• The loop follows a number the screen never showed. Something else wrote the active registers: PLC logic, a second panel or a communications master. Object ranges guard entries typed at that panel only.
• The loop reads a wrong value after a valid entry. Scaling or data type mismatch between the object and the register, seen as a value ten times off or a sign flip. The faults list at the end covers both.

Set the absolute range on each numeric entry object

Open the entry object's properties. The min and max fields sit with the tag assignment. Enter the physical limits: the sensor span at the bottom, the equipment limit at the top. On a loop with a 0 to 100 °C sensor and equipment safe to 100 °C, that is 0.0 and 100.0 °C. From then on, the panel refuses any entry outside those numbers and writes nothing to the register.

The fields take minutes to set, so do this first; it removes out-of-span entries permanently. A walkthrough of configuring command input min and max value validation shows the fields and the refusal behavior.

Then reproduce the fault you are chasing: type a low setpoint above the high setpoint with both values in range. The panel accepts the pair. That is a range check doing exactly its job, and it is the signal to move the pair rule into the PLC.

Two panel-side workarounds exist, and neither survives as the permanent guard:

• A fixed split point. Cap the low object where the high object starts, say low 0.0 to 60.0 °C and high 60.0 to 100.0 °C. This does keep low below high, and it deletes every combination on the wrong side of 60.0 °C. Use it only while the process genuinely never runs below the split.
• Tag-based limits. Some programming packages accept a tag or variable in the min and max fields; the help for your version says which yours does. If yours does, point the low object's maximum at the high setpoint tag so the limit follows the live value. It still guards only entries typed at that one panel.

Move the pair check into the PLC

Stage the operator's entries in registers the control loop never reads, and let the PLC decide when they become active. Ladder and structured text are two of the IEC 61131-3 PLC programming languages, and this logic is one rung or a few lines in either. Seven example tags carry it; the names are examples, so use your own and match the types to your registers:

Point the two entry objects at the staging registers and keep their absolute ranges. Power-up values come from your retentive settings; the compare runs on whatever pair is stored. Letting the operator change a PLC value from a screen follows the same staging pattern as letting the HMI change a timer preset instead of a constant, and the Apply bit works like the handshake a numeric entry can raise when an entry lands, covered in numeric entry notification and handshake bits explained.

On the rising edge of Apply_PB, run one compare:

IF Low_Entry < High_Entry - Min_Gap THEN
  Low_Active  := Low_Entry;
  High_Active := High_Entry;
  SP_Reject   := FALSE;
ELSE
  SP_Reject   := TRUE;
  Low_Entry   := Low_Active;   (* fields refresh to the last good pair *)
  High_Entry  := High_Active;
END_IF;

A momentary button holds the bit for a few scans, and every line in both branches repeats safely, so no one-shot instruction is required. The failure branch copies the active pair back over the staging registers, so the entry fields display the last good numbers on the next read.

Validate on Apply, not per entry. Moving a whole band up forces the low entry through values above the current high, so a check on each entry refuses a change the operator has to make anyway. The pair check accepts any final combination that is valid. If you prefer to pull a bad entry back to the nearest legal value, clamping HMI numeric entry limits in PLC ladder logic shows that version.

Pick Min_Gap from the control action. Two-position control switches the output each time the process crosses a band edge, so a gap smaller than the measurement noise lets the output toggle on noise around the switching point. For on/off control, set Min_Gap at or above the swing the process shows between one switch-off and the next switch-on. For a modulating loop, leave Min_Gap at 0 and let the compare enforce only low below high.

Example: validating a 70.0 °C / 85.0 °C oven band

A drying oven holds a band: heating off above the high setpoint, on below the low one. The registers hold tenths of a degree as signed integers and the panel shows one decimal place, so 70.0 °C is 700, 85.0 °C is 850, and Min_Gap is 20, which is 2.0 °C.

Three Apply presses cover every path:

1. Valid pair. The operator stages 700 and 850. The compare reads 700 < 850 - 20 = 830. True: the active pair becomes 700 and 850, SP_Reject stays FALSE, and the loop follows the new numbers.
2. Whole band moves up. The operator stages high 900, which is 90.0 °C, and low 870, which is 87.0 °C. A per-entry check would fire on the low value first: 870 is above the current active high of 850, so the change dies there. The pair check waits for Apply: 870 < 900 - 20 = 880. True: both values copy over and the band moves in one press.
3. Rejected pair. The operator stages low 845, which is 84.5 °C, with the high unchanged at 850. The compare reads 845 < 850 - 20 = 830. False: SP_Reject goes TRUE, the PLC copies 700 and 850 back over the staging registers, and the fields show 70.0 and 85.0 again. The loop never saw 84.5 °C.

Show the operator why the entry was refused

A silent refusal looks like a touch fault, so animate a text or indicator object from SP_Reject with a message in plain words: 'Low setpoint must be below high setpoint.' One tag drives it; if your visibility logic wants more than one condition, driving object visibility from one PLC tag collapses them into a single bit. Clear SP_Reject on the next successful Apply or on an acknowledge button, and decide the power-up state once: cleared at startup is the simpler choice.

Then check the refresh path: after a rejected Apply, the fields should return to the last good pair on their own. If they hold the typed value, the objects are keeping local edit state and the copy-back never reaches the display.

Run the reject-path tests before release

Watch the registers in the PLC for every row, not the screen: the screen can display a typed value that never took effect.

The last row is the one teams skip. An invalid pair that survives a power cycle defeats every check above it, so store the active pair retentively and copy the active pair into the staging registers at startup.

Faults that defeat the check

• Scaled units. The panel shows one decimal place and the register holds tenths, so every range field and Min_Gap is in tenths too: a 5.0 °C gap is 50, and a 100.0 °C maximum is 1000. A maximum of 100 typed into a tenths register guards 10.0 °C.
• Data type. Match the object's type to the register. A low limit of -10.0 °C is -100 in tenths; read as unsigned 16-bit it arrives as 65,436, which trips the object maximum or drives the loop to a nonsense value.
• A second writer. PLC logic, a second panel or a comms master writing the active pair bypasses both layers. If another device must write, put the same compare in front of that write too, or remove its write access.
• Range on one object only. Set min and max on both the low and the high object. An unguarded register accepts the full span of its type, -3,276.8 to 3,276.7 °C on a signed 16-bit tag in tenths.
• Fields stuck at 0. If a staging field shows 0 after entry instead of the typed value, work through why a numeric entry resets to 0 after entry before touching the compare logic.

The decision

Recommendation: set the absolute min and max on every numeric entry object for the physical limits, stage both setpoints in PLC registers, and run the compare Low_Entry < High_Entry - Min_Gap on an Apply bit before anything copies to the pair the loop reads. Use a fixed split point only as a stopgap during commissioning, and use tag-based limit fields as a convenience on top of the PLC compare where your software offers them. Set Min_Gap to 0 for a modulating loop and to the swing between switch points for on/off control; the worked example uses 2.0 °C.

Questions