Implementing Ramp Functions on Siemens S7-300/400 Analog Outputs

Overview

A ramp function generator (RFG) shapes an analog output so the controlled variable changes at a defined rate instead of stepping. It is the most-requested missing block on the SIMATIC S7-300 and S7-400 platforms: STEP 7 V5.x does not ship a dedicated Ramp function block in the standard library the way the F-TM Servodrive in TIA Portal exposes one in firmware (see the TIA Portal ramp-function generator documentation for the modern equivalent). On the classic PLCs the engineer must build the RFG in an FB and trigger it from a cyclic-interrupt OB, then drive the value to the hardware with a peripheral write (PQW) because analog-output modules are mapped outside the process image.

Use cases for an analog-output ramp on a SIMATIC controller include:

• Valve position reference (avoid water hammer on hydraulic and pneumatic actuators)
• VFD / soft-starter speed reference (limit dV/dt on the analog setpoint input)
• Heater phase-angle setpoint (limit thermal shock on cartridge heaters and IR emitters)
• DC drive armature reference (limit inrush on the motor)
• PID controller output (smooth setpoint changes between recipe steps)

The physical law is always the same: dV/dt = constant between two setpoints. The implementation differs only in (a) the integration timebase, (b) the slope units (engineering units per second, raw counts per cycle, or percent per scan), and (c) whether the ramp is computed in the PLC, in the drive firmware (e.g. Sinamics r0106 / r0107), or in a dedicated hardware module (F-TM Servodrive).

Why Analog Outputs Use Peripheral Addressing (PQW)

To find the actual PQW address for an analog output module, open the S7 project in SIMATIC Manager, expand the S7-300 / S7-400 station, double-click the SM332 / SM432 slot, and read the "Addresses" line in the object properties. The address is set automatically by the slot rule, or it can be manually assigned; the same value (with a leading P) is what the user program must use.

Hardware Prerequisites: SM332 and SM432 Output Modules

Before implementing the ramp, the analog output channel must be configured correctly in HW Config. Each SM332 and SM432 channel supports a configurable output type, range, and substitute value. A wrong output range is the second most common cause of an apparently dead analog output.

Two resolution ranges matter for the ramp math:

• 12-bit modules (SM332 5H-series): Bipolar nominal range ±27648 counts. The Siemens documentation states that values up to ±32511 are representable, but only ±27648 is the rated nominal; values above 32511 clip the DAC. Unipolar 0-10 V uses 0-27648 counts; 4-20 mA uses 0-27648 with 4 mA = 0 counts, 20 mA = 27648 counts.
• 16-bit modules (SM332 7ND/8TF, SM432): Bipolar nominal range ±27648 as well, but with 15-bit effective resolution. The mapping is identical; the difference is accuracy (0.3% on 12-bit, 0.1% on 16-bit) and step response time.

The Siemens S7-300 Module Data manual (entry 8859629) and the S7-400 Module Data manual (entry 1117740) document the full electrical ratings, settling time, and diagnostics. For a 0.3 s ramp on a 4-20 mA valve reference, a 12-bit SM332 is sufficient. For a 0-10 V reference on a high-resolution heater controller, the 16-bit SM332 7ND02 is preferred.

Siemens Standard Library: What Is and Is Not Available

STEP 7 V5.x ships several relevant FBs in the standard library, but none of them is a dedicated ramp generator. The available building blocks are:

FC3 ("Integrator") is the closest built-in primitive. It accepts an input value, integrates it with a cycle-time tag, and emits the running sum. Used as a leak-free integrator with a constant input, it produces a linear ramp. The downside is that FC3 is purely additive — it does not clamp, does not detect "reached target", and does not handle direction changes cleanly. For production code, write a dedicated FB as shown below.

Step 1: Define the Ramp Parameters

Five parameters fully describe a linear ramp on an analog output:

1. Start value (V_start) — the engineering-units value of the AO at the moment the ramp is armed
2. Target value (V_target) — the EU value to reach at the end of the ramp
3. Ramp time (T_ramp) — the time to traverse from V_start to V_target
4. Cycle time (T_cycle) — the OB execution period (typical 100 ms for OB35)
5. Output range — the EU-to-raw mapping (0-10 V = 0-27648, 4-20 mA = 0-27648 with offset)

The ramp slope and per-cycle step are computed once at ramp start:

slope (EU/s) = (V_target - V_start) / T_ramp
step (EU/cycle) = slope × T_cycle = (V_target - V_start) / (T_ramp / T_cycle)

Worked example: ramp from 20 % to 80 % in 5 s with OB35 at 100 ms:

• V_start = 20.0, V_target = 80.0, T_ramp = 5.0 s, T_cycle = 0.1 s
• slope = (80 - 20) / 5 = 12.0 %/s
• step = 12.0 × 0.1 = 1.2 %/cycle
• Number of steps = 5 / 0.1 = 50 cycles

For a 0.3 s ramp (the original Unitronics / Click question in the source research), a 100 ms OB is too coarse (3 steps). Use OB38 (10 ms) for 30 steps, or OB36 (50 ms) for 6 steps, or OB32 (1000 ms) only for > 10 s ramps. The cycle time of the OB is set in HW Config > CPU Properties > Cyclic Interrupts.

Step 2: Select the Execution Timebase

Eight cyclic-interrupt OBs are available, with default cycle times:

Selection rule: T_cycle should be 1/30 to 1/100 of T_ramp. A 0.3 s ramp with 30-100 steps requires an OB cycle of 3-10 ms. On a CPU 314, the smallest usable OB cycle is 50 ms (OB36). On a CPU 317-2 PN/DP or S7-400 CPU, OB38 (10 ms) is available and is the right choice. The original Unitronics / Click 0.3 s ramp requirement (from the source research) maps cleanly to OB38 on an S7-300/400 with the right CPU.

Step 3: Implement the Ramp FB in STEP 7

The cleanest implementation is a Function Block written in SCL (Structured Control Language) under STEP 7 V5.5 or TIA Portal. The same logic can be expressed in STL or LAD; the SCL version is shown because it is readable and the integration step is unambiguous.

FUNCTION_BLOCK FB1000
{ S7_m_c := 'true' }
VERSION : '1.0'
VAR_INPUT
    i_Enable       : BOOL;     // 1 = start or continue ramp
    i_TargetEU     : REAL;     // Target in engineering units
    i_RampTime     : TIME;     // Time to reach target
    i_CycleTime    : TIME;     // OB cycle time
    i_MinEU        : REAL;     // Lower clamp (EU)
    i_MaxEU        : REAL;     // Upper clamp (EU)
    i_EU_at0       : REAL;     // EU value corresponding to raw 0
    i_EU_at100     : REAL;     // EU value corresponding to raw full-scale
    i_Raw_0        : INT;      // Raw value at EU_at0  (e.g. 0 for unipolar)
    i_Raw_100      : INT;      // Raw value at EU_at100 (e.g. 27648)
END_VAR
VAR_OUTPUT
    q_CurrentEU    : REAL;     // Current ramped EU value
    q_RawOut       : INT;      // Value to write to PQW
    q_Busy         : BOOL;     // 1 = ramp in progress
    q_Done         : BOOL;     // 1 = target reached this cycle
    q_RateEU_s     : REAL;     // Effective rate (EU/s)
END_VAR
VAR
    s_StartValue   : REAL;     // EU at start of this ramp
    s_StepEU       : REAL;     // Per-cycle increment in EU
    s_RampActive   : BOOL;     // 1 = ramp in progress
    s_FirstScan    : BOOL;     // 1 = first cycle after enable / new target
END_VAR
BEGIN
    IF i_Enable THEN
        // Detect new ramp: enable just went high, or target changed
        IF NOT s_RampActive OR s_FirstScan THEN
            s_StartValue := q_CurrentEU;
            IF TIME_TO_REAL(i_RampTime) > 0.0 THEN
                s_StepEU := (i_TargetEU - s_StartValue)
                          / (TIME_TO_REAL(i_RampTime)
                          /  TIME_TO_REAL(i_CycleTime));
            ELSE
                s_StepEU := (i_TargetEU - s_StartValue); // instant
            END_IF;
            s_RampActive := TRUE;
            s_FirstScan := FALSE;
        END_IF;

        // Integrate one cycle
        q_CurrentEU := q_CurrentEU + s_StepEU;

        // Overshoot detection: if overshot, snap to target
        IF (s_StepEU >= 0.0 AND q_CurrentEU >= i_TargetEU)
        OR (s_StepEU <  0.0 AND q_CurrentEU <= i_TargetEU) THEN
            q_CurrentEU := i_TargetEU;
            s_RampActive := FALSE;
            q_Done := TRUE;
        ELSE
            q_Done := FALSE;
        END_IF;

        // Clamp to configured range
        IF q_CurrentEU > i_MaxEU THEN q_CurrentEU := i_MaxEU; END_IF;
        IF q_CurrentEU < i_MinEU THEN q_CurrentEU := i_MinEU; END_IF;

        q_Busy := s_RampActive;
    ELSE
        s_RampActive := FALSE;
        s_FirstScan := TRUE;
        q_Busy := FALSE;
        q_Done := FALSE;
    END_IF;

    // Convert EU to raw counts (linear, with EU-at-0 / EU-at-100 anchors)
    q_RawOut := REAL_TO_INT(
                  (q_CurrentEU - i_EU_at0)
                / (i_EU_at100 - i_EU_at0)
                * INT_TO_REAL(i_Raw_100 - i_Raw_0)
                + INT_TO_REAL(i_Raw_0)
              );

    // Rate in EU/s
    IF TIME_TO_REAL(i_RampTime) > 0.0 THEN
        q_RateEU_s := (i_TargetEU - s_StartValue)
                    / TIME_TO_REAL(i_RampTime);
    ELSE
        q_RateEU_s := 0.0;
    END_IF;
END_FUNCTION_BLOCK

The same function in STL (the most compact expression, useful for CPU 312/314 with no SCL license):

// Called from OB35 (100 ms default)
      L     #i_Enable
      JC    RMP1
      L     0
      T     #s_RampActive
      JU    CONV

RMP1: L     #s_RampActive
      L     1
      ==I                       // 1=continue, 0=new
      JC    INTEG

      // New ramp: capture start value, compute step
      L     #q_CurrentEU
      T     #s_StartValue
      L     #i_TargetEU
      L     #s_StartValue
      -R
      L     1.0
      T     #s_StepEU        // placeholder
      L     #i_TargetEU
      L     #s_StartValue
      -R
      L     0.1              // T_cycle in seconds; edit per OB
      *R
      L     #i_RampTime
      DTR
      /R
      T     #s_StepEU
      SET
      S     #s_RampActive

INTEG: L     #q_CurrentEU
      L     #s_StepEU
      +R
      T     #q_CurrentEU

CONV:  L     #q_CurrentEU
      L     0.0
      >=R
      JC    POS
      L     0
      JU    WR
POS:   L     #q_CurrentEU
      L     2764.8
      *R
      RND
WR:    T     PQW 272         // PERIPHERAL WRITE - mandatory for AO
      BE

The LAD equivalent uses MOVE, ADD, GT, and LT blocks feeding a single MOVE block that targets the PQW address. The critical instruction is the one that writes the result: it must be a coil on a symbol typed as WORD with the symbolic name PQW 272, or a MOVE block with the OUT terminal pointing to PQW 272. The compiler will not warn if the programmer accidentally drops the P; only the runtime behaviour will expose the bug.

Step 4: Wire the FB to the Peripheral Output

The FB call lives in OB35 (or whichever cyclic OB the engineer chose). For a 0-10 V / 4-20 mA valve on SM332 channel 0 at PQW 272, the call is:

// OB35 - 100 ms cyclic interrupt
      CALL FB   1000 , DB1000
      i_Enable       := M 100.0        // ramp-armed flag from HMI or sequence
      i_TargetEU     := MD 200         // target from HMI, REAL (0.0-100.0 %)
      i_RampTime     := T#5s           // recipe parameter
      i_CycleTime    := T#100ms        // matches OB35 setting
      i_MinEU        := 0.0
      i_MaxEU        := 100.0
      i_EU_at0       := 0.0
      i_EU_at100     := 100.0
      i_Raw_0        := 0
      i_Raw_100      := 27648
      q_CurrentEU    := MD 210
      q_RawOut       := MW 212
      q_Busy         := M 100.1
      q_Done         := M 100.2
      q_RateEU_s     := MD 220

      L     MW 212
      T     PQW 272                    // PERIPHERAL WRITE to SM332 CH0

The T PQW 272 instruction is unconditional and runs in OB35, so the DAC is updated every cycle. The PID FB (FB41) can be inserted between q_RawOut and the peripheral write, or the PID can be the source of i_TargetEU with the ramp in front. The decision depends on whether the PID output itself should ramp, or only the operator's setpoint changes should ramp.

Step 5: Commissioning and Verification

Commissioning should follow a fixed sequence to expose the most common ramp bugs before they reach the field:

1. Open a Watch Table in STEP 7 / TIA Portal on DB1000. Force i_Enable := 1, i_TargetEU := 50.0, i_RampTime := T#5s. Monitor q_CurrentEU and q_RawOut. Confirm q_CurrentEU increases by 1.0 each OB35 cycle (5 %/s, 0.5 %/100 ms = 0.5 %/cycle here, scaled to match the parameters).
2. Read the PQW back with a VAT. If the value matches q_RawOut after the OB35 boundary, the peripheral write is working. If the PQW stays at zero, the write is hitting the process image instead — re-check the P prefix.
3. Connect a digital multimeter or HART communicator to the field device. Confirm the current or voltage matches the expected value (50 % should be 12 mA on a 4-20 mA loop, 5.0 V on 0-10 V).
4. Trigger a step change in the target from 50 % to 100 % via the HMI. Observe the field device for 5 seconds. The valve / drive / heater should follow the linear ramp with no audible chattering and no overshoot.
5. Test the negative ramp: from 100 % to 0 %. Confirm q_CurrentEU decreases monotonically and does not go negative (the lower clamp prevents it).
6. Test direction change mid-ramp: while ramping from 0 % to 100 %, change the target to 50 %. The ramp should re-arm with a new s_StartValue equal to the current value, and the slope should re-compute. If the output jumps, the s_FirstScan logic is wrong.
7. Test the disable path: drop i_Enable. q_Busy should clear, q_CurrentEU should freeze at its current value, and the PQW should hold the last ramped value. The output should not jump to zero.
8. Test CPU STOP behaviour: with the CPU in STOP, the SM332 substitutes a configurable value (0, 100 %, or hold-last). Verify the substitute value is set correctly in HW Config > SM332 > Outputs > Behaviour on CPU STOP.

For a longer commissioning record, use the STEP 7 trace / TIA Portal trace to record q_CurrentEU and the corresponding PQW 272 over one ramp cycle. The curve should be a straight line from start to target, with no kinks at direction changes and no chatter at the end.

Output Value Clamping, Bumpless Transfer, and Limits

Three edge cases must be handled by the FB and not by external logic, because they will eventually be hit by every operator:

1. Clamping. The FB's i_MinEU and i_MaxEU inputs enforce the safe range of the AO, independent of the operator's target. A common pattern is to clamp to the actuator's mechanical limits (e.g. 5-95 % on a control valve to avoid seat hits). The raw output is also clipped to 0-27648 because REAL_TO_INT wraps modulo 2^16; a negative raw value would set the output to a large positive value at the DAC.

2. Bumpless transfer. When the operator hands off from manual (jog from HMI) to auto (PID), the ramp should not produce a step. The standard technique is to seed q_CurrentEU with the actual AO value (PIW of a paired input, or a readback from the drive) at the moment the FB is enabled, so the start value equals the current output.

3. Direction change. When the operator changes the target mid-ramp, the FB must re-initialize s_StartValue to the current value, not the value at the original arming. The s_FirstScan flag in the implementation above triggers this when the target differs by more than a deadband from the previous target.

A S-curve profile (jerk-limited ramp) is implemented by inserting a second integrator on the output of the first one, with the second integrator's input clamped to a maximum rate. This is the same approach used by Sinamics drives (p1115 / p1120 / p1121) and by the F-TM Servodrive's ramp-function generator. The linear ramp above is the degenerate case where the S-curve smoothing constant is zero.

Troubleshooting Matrix

Migration to S7-1500 / TIA Portal

On the S7-1500 generation, the same peripheral-access discipline is still required for AO modules, but the syntax changes:

• PQW 272 becomes %QW272 (TIA Portal absolute addressing)
• OB35 becomes the standard OB "CyclicInterrupt" in TIA Portal, with cycle time set in the OB properties in nanoseconds
• S7-1500 OB time resolution is 1 ms, with a minimum cyclic-interrupt cycle of 1 ms (vs 10 ms on S7-300 OB38)
• The standard library now includes the PID_Compact and PID_3Step blocks; for ramps, the engineering-team typically uses the SYSTEM_CLOCK block with an integrator, or a self-written FB equivalent to the one above

The TIA Portal F-TM Servodrive ramp-function generator implements the same shape entirely in module firmware, offloading the PLC scan. For new designs, that is the right answer. For retrofit of an existing S7-300/400 ramp application, the FB above ports unchanged: only the address syntax needs updating.

Safety and Field Wiring Considerations

Three safety points often missed on the first revision of an analog-output ramp:

1. Substitute value on CPU STOP — for a heating application, the safe state is 0 % output. For a cooling / valve-closing application, the safe state may be 100 % output. Set the SM332 substitute value in HW Config accordingly. The FB does not run in STOP, so it is the substitute value that defines field behaviour.
2. Wire break on current outputs — on a 4-20 mA output, a wire break is detected by the module and signalled in the diagnostic byte. The S7 program can read this via SFC13 / RD_REC on diagnostic interrupt OB82 and force the ramp output to a safe value (typically 0) until the wiring is restored. A 0-10 V output cannot detect wire break, so use a 4-20 mA output where fail-safe is required.
3. Galvanic isolation — analog outputs on SM332 / SM432 are not isolated channel-to-channel by default; they share a common ground. For a multi-channel application driving devices at different potentials, use the 6ES7332-8TF00-0AB0 (high-speed, isolated) or fit external signal isolators. Without isolation, ground loops can add offsets that the FB's output-to-raw conversion will faithfully write to the DAC.