Interpreting Siemens S7 STL FC111 Analog Limit Monitor Function

Overview of the FC111 Analog Limit Monitor Pattern

The FC111 discussed in field service is a compact Siemens S7 STL (Statement List) function that performs three logical operations on a single analog input channel:

1. Compares the live analog value against a configurable high limit.
2. Holds the violation decision stable for a programmable time constant verz_x_100ms (Verzögerung in 100 ms ticks).
3. Generates a latched error bit that must be explicitly acknowledged by the operator once the process variable falls back below the limit.

This pattern is a recurring utility FC across many S7-300/S7-400 standard libraries, machine builder templates, and retrofitted process cells. Once you understand the FC111 skeleton, you can read any equivalent FC (FC13, FC112, FC115, FC118, etc.) on the same machine without needing the original programmer. The reference documentation for STL syntax is the Siemens SIMATIC S7-300/400 Statement List (STL) Programming Manual, and the analog value scaling rules are defined in the SIMATIC S7-300 Module Data Reference Manual.

Prerequisites for Reading S7 STL Source

Before line-by-line interpreting FC111, the maintenance engineer should have the following items open and configured:

• STEP 7 V5.5 or TIA Portal V16+ with the original project archive (.s7p / .ap16) that contains the FC111 source. The STL cannot be reconstructed from a downloaded block alone because the symbol table and the instance DBs of the calling logic are required for context.
• The S7 program editor set to STL view (View > STL) and not LAD/FBD. Some lines compile into different mnemonics depending on the active language set (German vs International), so confirm Options > Customization > Language matches the original programmer's selection. See the STEP 7 V5.5 Getting Started for the language toggle.
• The symbol table (S7_Zeichen) loaded so that symbolic names such as AI_HighLimit, verz_x_100ms, Err_Ack, and Storung resolve to absolute addresses and DBs. Without symbols the engineer is forced to read every OP code with cross-references.
• Cross-reference (Ctrl+Alt+F7) and the Program Information window available to follow the I/O of the FC up to the OB1 caller and the HMI tag connection.

STL Mnemonics Used Inside FC111

The body of a typical FC111 contains the following elementary operations. The mnemonics listed below are the German/STEP 7 forms; the International equivalents appear in the parenthetical column.

The 100 ms assumption comes from OB35 (cyclic interrupt) being the cycle in which the calling program invokes FC111. If OB35 is configured at a different period (the default for S7-300 is 100 ms, configurable from 1 ms to 1 min in HW Config), the constant "100 ms" in verz_x_100ms must be reinterpreted as "N OB35 cycles". Confirm the OB35 period in HW Config > CPU Properties > Cyclic Interrupts. The configuration rules are documented in the S7-300 CPU 31xC and CPU 31x Manual: Technical Specifications.

Decoding the High-Limit Comparison

The first decision in FC111 is the limit comparison. The reference value is normally stored in a data block rather than hard-coded inside the FC so that operators can change the trip level from the HMI without a recompile. Common placements are:

• DB100 (Recipe data) at offset 0.0 (REAL) for the high limit and offset 4.0 (INT) for the delay in 100 ms ticks.
• DB200 (Machine constants) for permanent design limits that are read-only at runtime.
• An instance DB of an FB that owns the supervision function (preferred in newer TIA Portal code per the S7-1500 Programming Guideline principles).

If the input is below the limit, the code takes the "OK" path: it clears the running counter (MW 200) and skips the error set branch. The output Storung at A 4.0 retains its previous state - it is not automatically cleared on a falling edge of the violation. This is the source of many operator complaints of "the alarm never clears". Acknowledge is mandatory.

Decoding the On-Delay Timer (verz_x_100ms)

The German variable name verz_x_100ms expands to Verzögerung in 100 ms (delay in 100 ms). In FC111 the timer is implemented as a software counter rather than a Siemens SE timer (extended pulse) or SS timer (retentive on-delay) for two reasons:

1. Software counters persist across warm restarts when stored in the flag area M that is configured as retentive, while standard timers reset on RUN-to-STOP-to-RUN transitions.
2. Multiple FC111 instances can be built from the same source by passing the flag word as an IN_OUT parameter; this is impractical with the legacy timer word area (T0..T511).

The delay value in 100 ms ticks is loaded from the recipe DB and compared against the running counter. When the counter reaches the threshold, the trip decision becomes permanent for the duration of the violation, even if the process variable briefly dips below the limit between two OB35 cycles. The hysteresis behavior can be added with a second dead-band comparator, but most plant-level FC111 templates intentionally omit it to keep the code lean.

Decoding the Error Flag and Acknowledgment

Once the violation is confirmed, the FC sets bit A 4.0 (Storung) with the S (Set) operation. The bit remains latched until one of the following occurs:

• The acknowledge pushbutton (E 0.0) generates a rising edge detected by FP M 10.0 AND the live comparison result >R is currently FALSE (i.e., the process has recovered).
• The CPU goes through a cold restart (OB100 clears the process image output area).
• A higher-priority reset from the HMI writes to the flag word directly through a separate FC.

The FP (Flanke Positiv / Positive Edge) operator is critical. A continuous-high acknowledge signal will not clear the alarm every cycle - it only clears it on the transition. This prevents the operator from holding down the button and silencing all alarms, but it also causes confusion when a faulty button provides a noisy contact that retriggers on every scan. For noisy inputs, debounce in hardware (RC filter) or use the S7-1500 built-in input filter as described in the S7-1500 ET 200MP Digital Input Module Manual.

Mapping the FC111 to a TIA Portal Equivalent

If the engineer needs to migrate FC111 from STEP 7 V5.5 to TIA Portal V17, the STL must be re-imported as a source file and then converted. The TIA Portal STL editor can be set under Options > Settings > PLC programming > STL to International or German mnemonics. The SIMATIC STEP 7 V5 to TIA Portal Migration Guide recommends keeping the FC111 in STL during the initial migration and only re-engineering into SCL or LAD once functional equivalence has been proven on the test bench. The recommended target form is:

FUNCTION_BLOCK FB111
VAR_INPUT
    AI_Raw      : INT;     // 0..27648
    HighLimit   : REAL;
    DelayTicks  : INT;     // 100 ms units
    Ack         : BOOL;
END_VAR
VAR
    Counter     : INT;
    Edge        : BOOL;
END_VAR
VAR_OUTPUT
    Storung     : BOOL;
END_VAR
BEGIN
    IF INT_TO_REAL(AI_Raw) > HighLimit THEN
        Counter := Counter + 1;
        IF Counter >= DelayTicks THEN
            Storung := TRUE;
        END_IF;
    ELSE
        Counter := 0;
    END_IF;
    Edge := Ack AND NOT Edge;
    IF Edge AND NOT (INT_TO_REAL(AI_Raw) > HighLimit) THEN
        Storung := FALSE;
    END_IF;
END_FUNCTION_BLOCK

Verification Procedure After Re-Commissioning

1. Open the online block view of FC111 in STEP 7, force the analog input word to a value 5 % above the configured high limit, and confirm in the VAT (Variable Table) that the running counter MW 200 increments by exactly 1 per OB35 cycle. Use Monitor/Modify (Ctrl+F7) and tick the "Update" column for the flag word.
2. Wait for the configured delay (e.g., 5 s for a recipe setting of 50) and verify that A 4.0 transitions from 0 to 1 in the VAT at the expected OB35 tick.
3. Force the analog input back below the limit and confirm A 4.0 remains at 1 (latched). Pulse E 0.0 to TRUE for one PLC cycle and confirm A 4.0 transitions back to 0.
4. Cross-check the HMI alarm log shows the same timestamp as the OB35 tick at which the bit was set, ensuring the time stamping of the alarm is performed in the HMI rather than the PLC (a common source of off-by-one OB35 cycle mismatches).
5. Test the edge case of a brief violation shorter than verz_x_100ms: the input should exceed the limit for half the delay time, return below, and the alarm should not be raised. Confirm the counter MW 200 has been reset to 0.

Troubleshooting Matrix for Common FC111 Field Issues

Edge Cases and Field-Proven Caveats

Three operational scenarios consistently surface during the second decade of a Siemens S7-300 fleet and are worth highlighting for any engineer who has to maintain an FC111:

1. OB35 not running. If OB35 is not configured or has been removed in a later edit, the counter MW 200 never increments and the FC becomes a no-op. The PLC does not raise a system error in this case. Diagnose by inserting a temporary L OB35_TIME and a comparison inside the FC, or by checking the diagnostic buffer for OB35 start/stop events. The OB35 behaviour is described in the S7-300 CPU 31x Manual: Organization Blocks.
2. Analog input wire break. SM331 returns 32767 (7FFFh) or 0x8000 depending on the configured diagnostic behaviour. A wire break typically results in 32767, which is well above most high limits and will trigger the alarm after the delay. If the plant requires distinguishing wire break from real over-range, the diagnostic interrupt OB82 must be wired into the analog module and the FC111 augmented with a wire-break qualifier.
3. Counter overflow at long delays. With a 16-bit INT, the maximum representable delay is 32767 ticks (about 54 minutes at 100 ms). For shift-end batch timers exceeding one hour, FC111 should be modified to use a DINT counter or a Siemens IEC timer (TP, TON, TOF) per SIMATIC S7-300/400 STL Programming Manual.

Reading STL Step-by-Step: A Field Workflow

When handed a previously unknown FC and asked to explain its function (the original poster's situation), the systematic workflow is:

1. Open the FC and identify the variable interface (IN, OUT, IN_OUT, STAT, TEMP) to know which I/O addresses are read and written.
2. Scan the FC top to bottom looking for jump labels. Every label is a branch decision; map them on paper with arrows.
3. For each label, identify the condition that causes the jump: SPB/JC (jump if RLO=1), SPZ/JZ (jump if zero), SPN/JN (jump if not zero), SPO/JO (jump on overflow).
4. For each load instruction, follow the loaded value to its source - input word, flag word, DB word, or constant - and document the meaning from the symbol table.
5. For each set (S) and reset (R) instruction, identify the latched bit. If the bit is not reset anywhere in the FC, the reset must come from outside; trace it with cross-reference.
6. For each timer or counter instruction, identify the time base and the value range. Compare with the OB35 period and the recipe data to confirm the engineering intent.
7. Draw a state diagram on paper showing the OK, Violation, Latched, and Acknowledged states and the events that move between them.

Once the state diagram is drawn, the function is fully understood. The interpretation is then a matter of translating the diagram back to the maintenance technician in plain language and updating the inline comments so the next engineer does not need to redo the work.