Why an HMI numeric entry stops at 65535 and how to raise it

Why the ceiling is exactly 65,535

An unsigned 16-bit integer stores its value in 16 binary digits, each holding 1 bit. Sixteen digits form 2^16 = 65,536 different codes, numbered 0 through 65,535. The value 72,000 needs a 17th digit, so the type cannot represent it, and the entry refuses it before anything reaches the PLC. If the tag is signed 16-bit, one digit carries the sign and the positive ceiling is 32,767.

A 32-bit unsigned integer, listed in most tag databases as an unsigned double word, holds 0 to 4,294,967,295 across 32 binary digits. That is the type to move to, and that is why the fix is a type change in both projects, not a new number in the entry's maximum field.

Symptoms and what each one points to

• The keypad refuses every entry above 65,535. The tag is unsigned 16-bit; the type is the limit.
• The ceiling is 32,767. The tag is signed 16-bit.
• The screen accepts 72,000 but the PLC destination register reads 6,464. The PLC side is still one 16-bit register: it kept the low word, 72,000 - 65,536 = 6,464, and the high word 1 landed in the register after it.
• The PLC reads 423,624,705 after you enter 72,000. The tag and the controller disagree about which register of the pair carries the high word.
• The value reads back correctly but the machine behaves wrong. A copy, scale or compare downstream of the destination still runs on 16 bits.

A ceiling that is a digit count, not a value cap, is a separate fault with its own fix; see Enter 5 digits on an HMI numeric entry limited to 4.

Confirm the cause before you edit

Work down this list; it takes about 10 minutes and prevents a second download.

1. Open the tag in the HMI tag database and read its data type. Unsigned 16-bit explains a 65,535 ceiling exactly.
2. Open the PLC destination and read its type. A 16-bit integer or a single register means the wider value has nowhere to land.
3. List every screen object bound to the tag, then every rung, copy or compute in the PLC that carries the value to its final use.
4. Check the register address after the destination. A 32-bit value spans two consecutive 16-bit registers, so a neighboring tag at the next address collides once you widen. Modbus registers are 16 bits wide, which is why the pair is unavoidable on a Modbus path.

During the test, read the PLC register each time; the screen value only reports what the HMI believes it sent.

Example: raising a counter setpoint to 72,000

A parts counter must accept targets up to 72,000 counts. Its entry is bound to a tag typed unsigned 16-bit and pointed at data register 100 in the PLC.

• Current ceiling: 2^16 - 1 = 65,535. The new maximum 72,000 sits 72,000 - 65,535 = 6,465 beyond it, so the type has to go.
• New type: unsigned 32-bit double word, ceiling 2^32 - 1 = 4,294,967,295. The value 72,000 fits easily; the entry object's maximum stays at 72,000 so operators cannot type past the process limit.
• Register span: the widened tag occupies registers 100 and 101, two 16-bit words in place of one. The timer preset whose address is 101 moves to 102, and the rungs that read it are edited to match.
• Boundary test, machine in a safe state, budget 15 minutes and read the PLC data table after each entry: 65,535, the old ceiling, reads back as 65,535. 65,536, the first value needing the high word, reads back as 65,536, with high word 1 and low word 0. 72,000 reads back as 72,000, high word 1 and low word 6,464, because 72,000 - 65,536 = 6,464. 72,001 is refused by the entry object, since its maximum is 72,000.
• Word order check: 72,000 splits as 0x0001 in the high register and 0x1940, decimal 6,464, in the low register. If the pair assembles as 6,464 × 65,536 + 1 = 423,624,705, the halves are swapped; correct the word order in the tag's or driver's 32-bit configuration and retest.

Keep the machine in a safe state while the boundary values are live in it; a setpoint that arrives wrong moves the process.

The fix, in order

1. Back up the HMI project and the PLC program.
2. Change the HMI tag from unsigned 16-bit to an unsigned 32-bit double word in the tag database.
3. Change the PLC destination to a 32-bit type, and widen every copy, move and compute that carries the value on the way to its final use.
4. Move any tag whose address is the one the high word now occupies, and update the logic that reads it.
5. Delete the entry objects bound to the tag and place new objects on the widened tag. Re-enter the minimum, 0, the maximum, 72,000, and the decimal format.
6. Compile or validate both projects and download under your site's change procedure.
7. Run the boundary test from the example at the PLC register: 65,535, 65,536 and 72,000 read back correctly, and 72,001 is refused at the entry. If the value must survive a power cycle, repeat the 72,000 entry after the next restart and read the register again.

The entry maximum is a screen-side convenience. The PLC should enforce its own limit on the setpoint before the value reaches an output; clamp the value in PLC ladder logic shows the ladder pattern. Stored recipes need the same check, covered in recipe value limits in the PLC.

Where a leftover 16-bit hides

If the PLC register disagrees with what you typed, trace from the entry to the final destination and check these elements in this order:

• the copy or move that lifts the value out of the entry register, still sized for one register;
• a scaling multiply or divide whose result is written back to a 16-bit tag;
• a message or communications mapping that exports the tag as a single 16-bit register;
• a recipe or saved-setpoint file storing the value in a 16-bit field;
• the compare instructions, still reading one register.

One remaining 16-bit element anywhere on the path re-imposes the 65,535 ceiling or cuts the value down without a fault message.

The decision

Recommendation: change the HMI tag and the PLC destination to an unsigned 32-bit double word in the same session, recreate the entry objects on the widened tag with the maximum at 72,000, and release only after 65,535, 65,536 and 72,000 read back correctly in the PLC data table and 72,001 is refused at the entry. If the old ceiling was 32,767, run the same change with a signed 32-bit type so negative values stay available. Make the edit in a commissioning window of at least 30 minutes with backups in hand; if either project refuses to compile after the type change, restore the backups and take the tag list and software versions to the HMI vendor's support channel.

Questions