Editing VH_Range and VL_Range Online in Siemens CFC Charts

David Krause8 min read
HMI ProgrammingSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

Siemens CFC (Continuous Function Chart), used inside SIMATIC PCS 7 and the optional CFC editor for S7-300/S7-400, places a channel driver block on every analog signal wired into a chart. The channel driver exposes the engineering range of the connected transmitter through two inputs:

  • VH_Range – value corresponding to the high end of the analog input (e.g., 20 mA or 10 V).
  • VL_Range – value corresponding to the low end of the analog input (e.g., 4 mA or 0 V).

How these two inputs are parameterized in the chart determines whether the range can be changed at runtime. A literal constant forces a re-download to the AS; a REAL-tag pointer makes the range fully variable and editable online without stopping the CPU. This guide covers the latter, field-proven approach.

Prerequisites

Item Requirement
Engineering station PCS 7 V9.0 SP2 or higher, or STEP 7 V5.6 + optional CFC V9.0
Automation Station S7-300 (CPU 319 series) or S7-400 (CPU 410 / CPU 416 / CPU 417) in RUN mode
Analog module SM 331 (6ES7331-…); SM 332 (6ES7332-…) for output scaling symmetry
Online connection Active MPI / PROFIBUS / Industrial Ethernet link from ES to AS
Operator rights CFC editor open with project in "Online" state, monitoring enabled
Tag type REAL (32-bit floating point) DB or M-address with sufficient free space (≥ 8 bytes per channel for both limits)
Safety note: Changing a live range affects every downstream block that reads the scaled value (CTRL_PID, MOT_SPEED, ADD, etc.). Validate the impact in the SFC/CFC cross-reference before editing.

Understanding the Channel Driver Inputs

The CH_AI (and CH_AO) channel drivers shipped in the PCS 7 master data library expose engineering-unit limits as standard inputs. The internal scaling formula implemented by the driver is:

Output = (Raw / 27648) × (VH_Range − VL_Range) + VL_Range

Where Raw is the integer 0…27648 delivered by the SM 331 module. Because both limits enter the formula as REAL, the channel driver will accept any 32-bit floating-point source. This is the technical reason a constant and a variable produce identical scaling behavior but radically different lifecycle behavior.

Constants vs. Variables: Lifecycle Comparison

Aspect Constant (literal) REAL Variable (pointer)
Storage Compacted into the chart's load image at compile time
Edit path Edit chart → Compile → Download entire program to CPU (CPU goes STOP if CRST required)
Edit while AS in RUN No – requires offline edit and download
Edit while AS in RUN Yes – Monitor the chart, double-click the input, type the new REAL value, press Enter, acknowledge any operator prompt
Typical use Transmitter range fixed for the plant's lifetime
Typical use Transmitter swap-out, multi-product batch, calibration drift compensation
Audit trail Source-controlled in the ES project, change-managed in PCS 7 Asset Management
Audit trail Captured in the AS online change log only; not visible in ES offline unless "Online → Back-annotate" is executed

Reference: see the PCS 7 Process Automation System manual collection, section "CFC – Editing charts online".

Step-by-Step: Wiring VH_Range and VL_Range to a REAL Variable

  1. Allocate a REAL DB. In the S7 Program, create a data block (e.g., DB 150 "RANGE_LIMITS") and declare two REAL words per channel – for example, RNG_HI_001 at byte offset 0.0 and RNG_LO_001 at byte offset 4.0. Initial values can be set to the current transmitter range (e.g., 100.0 / 0.0).
  2. Open the chart in the CFC editor and locate the CH_AI block for the signal you want to make range-editable.
  3. Select the VH_Range input on the block. Right-click → Interconnection to address… (German: Verschalten mit Adresse…). Enter the absolute symbolic name, e.g., DB150.DBD0 or the symbolic address "RANGE_LIMITS".RNG_HI_001.
  4. Repeat for VL_Range, pointing it to the matching low-limit REAL (e.g., DB150.DBD4).
  5. Compile the chart (Charts → Compile → Charts only). Resolve any address-conflict warnings.
  6. Download the delta to the AS. With S7-400 / CPU 410, an online delta download is supported without CPU STOP. For S7-300, certain CRST/WRAM scenarios still require a STOP/RUN transition – verify with the STEP 7 online download FAQ.
  7. Verify in the online view that the new pointers show the correct REAL value next to each input pin.

Step-by-Step: Changing the Range While the PLC Is Running

  1. In the CFC editor, switch the project view to Online (button bar: Online → Monitor).
  2. Open the same chart. The channel driver block is now drawn in the "monitoring" color scheme.
  3. Single-click the value displayed on the VH_Range pin. The field turns into an editable numeric control.
  4. Type the new engineering-unit high limit (e.g., 250.0) and press Enter.
  5. Repeat for VL_Range.
  6. Observe the Output pin of the CH_AI block; the scaled process value will reflect the new span within one OB1 cycle (typically 10–100 ms depending on the cycle time of OB35).
  7. Optionally, write the new value into the operator faceplate's engineering view so the OS shows the updated range to operations.
Tip: When typing REAL values, use the dot as the decimal separator even on German-locale engineering stations; the CFC input mask does not localize the decimal point.

Verification

After the online edit, perform the following checks before walking away from the station:

  • Read back the new REAL from the tag with a VAT (Variable Table) – confirm the floating-point representation is exact, not a rounded substitute.
  • Force a known current on the transmitter (e.g., 12 mA, the midpoint) and verify the scaled value equals (Raw/27648) × (VH_Range − VL_Range) + VL_Range.
  • Check the OS faceplate for any "Range changed" or "Bad quality" alarm; these should clear on the next OS update cycle.
  • Run an Online → Back-annotate (Rückübersetzen) so the offline project mirrors the runtime value. This step is required if you want the new range to be permanent across a full offline/online sync.

Troubleshooting Matrix

Symptom Likely Cause Corrective Action
Input is grayed out, cannot be edited online VH_Range is still wired to a literal constant Replace literal with a REAL address and re-download delta
New value flashes back to the old one Another chart or SFC is writing to the same REAL Use the cross-reference (Ctrl+F) to find all writers; refactor into a single source-of-truth DB
Scaled output jumps to +Inf / -Inf VL_Range accidentally written larger than VH_Range Add an FB that enforces VH_Range > VL_Range; clamp at the input
Quality code "BAD" on the OS faceplate Underlying SM 331 channel failed or wire break Check SF LED on the AI module; clear with module replacement if persistent
CPU goes STOP during delta download S7-300 with insufficient work memory to apply the delta in RUN Use "Download user program to memory card" approach, or schedule a short maintenance window

Best Practices for Range Variables

  • Reserve a dedicated DB per plant area (e.g., DB 150..159) for engineering range REALs. Keep them out of the cyclic process DBs to avoid unintended pointer collisions.
  • Document every range variable with a comment that includes the transmitter P&ID tag, the physical units, and the calibration date. PCS 7's "Symbolic comment" field supports multi-line notes.
  • If you also need to change the raw-side scaling (e.g., switching from 4–20 mA to 0–10 V on the same module), update the SM 331 hardware configuration in HW Config and download that delta first; the channel driver inputs then take the new range on the next cycle.
  • For multi-product (recipe-driven) plants, drive the range REALs from the recipe parameter set rather than the operator faceplate. The faceplate should display the active range read-only, not be the entry point.

Notes on Scaling Math and Adjacent Standards

The linear scaling formula shown above is consistent with the generic 4–20 mA → engineering-unit conversion widely used in process automation. For precision analog front-ends, scaling accuracy is dominated by the resistor tolerance on the input conditioner; a Texas Instruments reference design (see 3 ways to scale an analog input signal) provides a spreadsheet for selecting non-inverting op-amp gains. The PLC-side algorithm does not change – only the integer delivered by the module changes when the analog front-end is modified.

If you ever migrate from CFC-based PCS 7 to a controller that delivers raw counts in a different range, remember that Omron NJ/NX-series analog modules use a 0–4000 or 0–8000 raw scale (see Omron scaling knowledge base). The REAL-variable approach described here ports unchanged to those platforms – only the integer constant in the formula changes.

When You Still Need a Re-Download

Even with REAL variables, a full program download is unavoidable in the following cases:

  • Changing the channel driver type (e.g., CH_AI 8x16Bit → CH_AI 8xRTD for RTD inputs).
  • Replacing the underlying hardware (SM 331 → SM 331 with different channel count).
  • Renaming the block instance, which alters its symbolic address in the symbol table.
  • Changing the data type of the range variable itself (e.g., REAL → LREAL). This is rare in PCS 7 but can occur in custom FCT blocks.

Field-Commissioning Checklist

  1. Before powering the transmitter, verify the SM 331 measurement range jumper matches the new transmitter output type (current vs. voltage, 2-wire vs. 4-wire).
  2. Power the loop, force 4 mA, and read the raw value with a VAT. Expect ~0 (with 0.0% overrange) or a small negative number; adjust VL_Range to match the engineering low.
  3. Force 20 mA, expect ~27648; adjust VH_Range to match the engineering high.
  4. Force the midpoint (12 mA) and confirm linear scaling.
  5. Back-annotate the chart so the offline project reflects the new range.
  6. Archive the modified project with a clear revision comment referencing the transmitter's calibration certificate.

FAQ

Can I change VH_Range and VL_Range while the PLC is in RUN?

Yes, provided the inputs are wired to REAL variables (DB or M-addresses). If they are wired to literal constants, you must stop the CPU, edit the chart, recompile, and download – the value cannot be edited online.

What data type should the range variable be?

Use REAL (32-bit IEEE-754). Avoid INT or WORD – the channel driver will reject the implicit type mismatch at compile time or produce undefined scaling at runtime.

Will editing the range online trigger a CPU STOP on S7-300?

Editing an existing tag's value in Monitor mode is a pure online value change and does not stop the CPU on either S7-300 or S7-400. A CPU STOP is only required if the change needs a delta download that exceeds available work memory.

How do I make the new range survive a project reload?

After editing online, run Online → Back-annotate connections / Back-annotate parameters in the CFC editor, then save and archive the project. Otherwise the next full download will revert the runtime value to the original offline constant.

Does this approach work for analog outputs (CH_AO) too?

Yes. The CH_AO channel driver exposes the same VH_Range / VL_Range input pair, and the same REAL-variable technique applies, mirroring the 0…27648 integer scale to the engineering range commanded by the controller.

Back to blog