Press-and-Hold Increment/Decrement in Siemens PLC TIA Portal

Overview

The "press-and-hold increment/decrement" pattern is a routine requirement on Siemens HMI panels: an operator holds a button and the value of a setpoint, counter, recipe index, or tag ramps upward or downward at a controlled rate until the button is released. On Siemens platforms (S7-1200/S7-1500 with TIA Portal, or legacy S7-300/S7-400 with STEP 7 + WinCC flexible) the function is not a single built-in tag property - it is a combination of:

• An HMI button configured to set a bit while pressed and reset it on release.
• A PLC program block that ANDs the press-bit with a periodic clock bit (CPU clock memory or a user-generated flasher) and adds or subtracts 1 from a tag on each rising edge of the resulting pulse.
• Tag scaling (limits, wrap, saturation) to prevent the value from drifting outside its valid range.

This article documents three field-proven implementations - the clock-bit ramp, the IEC timer + counter ramp, and the edge-tracked accumulator - with full TIA Portal SCL/ST code, WinCC button wiring, parameter tables, and a verification checklist.

Prerequisites

1. Controller: SIMATIC S7-1200 (firmware V4.2 or later) or S7-1500 (firmware V2.0 or later). Logic also runs on S7-300/400 with minor adaptation.
2. Engineering tool: TIA Portal V16, V17, or V18 with installed HSP for the CPU and HMI. Legacy users can use STEP 7 V5.5 + WinCC flexible 2008 SP5.
3. HMI: Comfort Panel (TP/MTP/KTP), or WinCC Runtime Advanced/Professional on a PC. Pattern is identical for Basic panels using the "Set value while button pressed" event.
4. PLC tag type: INT (range -32768 to +32767) or DINT (-2147483648 to +2147483647). Real (floating point) requires integer scaling.
5. CPU clock memory byte: Must be enabled in the CPU device properties under Properties > System and clock memory. The default bit assignments in TIA Portal are shown in the table below.

Architecture and Signal Flow

The signal flow has three segments: the HMI input, the PLC logic core, and the tag output that the HMI displays back. The PLC is the only "smart" element - the HMI merely sets/clears two boolean bits.

State machine summary:

• Idle: Both press bits are FALSE. No pulse generated. Tag holds its value.
• Pressed-INC: HMI sets bIncPress TRUE. The AND of bIncPress and the clock bit produces a 0.5 s (or 1.0 s, depending on selection) periodic TRUE pulse. Each rising edge adds +1 (or +N) to the tag.
• Pressed-DEC: HMI sets bDecPress TRUE. Periodic pulse subtracts -1 (or -N).
• Released: Press bit clears. No further pulses. Tag is latched in the last-written value.

Step 1 - Enable CPU Clock Memory Byte

Open the PLC device in TIA Portal. Navigate to Properties > System and clock memory. Tick Enable the use of clock memory byte and assign an unused input byte, for example MB100. The bit assignments are fixed:

For most operator setpoint ramps, MB100.5 (0.2 s) or MB100.4 (0.5 s) gives the best feel. MB100.3 (1 s) feels coarse; MB100.6 and faster feel jittery on a touchscreen.

Step 2 - Declare the PLC Tags

Create the following tags in the default tag table or in a dedicated UDT_RampCtrl user data type for reuse across multiple setpoints:

Step 3 - PLC Logic Block (SCL Implementation)

Create an FB or FC named FB_RampSetpoint. The example below is written in SCL and is valid for S7-1200/S7-1500. The same logic translates to LAD with an --(P)-- edge detector and an ADD/SUB block.

Block interface (IN/OUT/STAT/TEMP)

FUNCTION_BLOCK "FB_RampSetpoint"
VERSION : 0.1

VAR_INPUT
  iIncPress   : Bool;     // HMI press bit, +
  iDecPress   : Bool;     // HMI press bit, -
  iHiLim      : Int;      // Upper limit
  iLoLim      : Int;      // Lower limit
  iStepInc    : Int;      // Step size up
  iStepDec    : Int;      // Step size down
  iFastFactor : Int := 5; // Acceleration multiplier after 2 s hold
  iClkBit     : Bool;     // Clock memory bit (e.g. %MB100.5)
END_VAR

VAR_OUTPUT
  qValue      : Int;      // Ramped setpoint
  qAtHiLim    : Bool;     // TRUE when value has reached upper limit
  qAtLoLim    : Bool;     // TRUE when value has reached lower limit
END_VAR

VAR
  sClkOld     : Bool;
  sAccelTmr   : TON_TIME;
  sAccelActive: Bool;
  sIncPulse   : Bool;
  sDecPulse   : Bool;
END_VAR

Code body

BEGIN
  // 1. Generate one-shot pulse on rising edge of clock bit
  sIncPulse := iClkBit AND NOT sClkOld;
  sClkOld  := iClkBit;

  // 2. Acceleration: after 2 s of continuous press, multiply step
  sAccelTmr(IN := (iIncPress OR iDecPress), PT := T#2S);
  sAccelActive := sAccelTmr.Q;

  IF sAccelActive THEN
    iStepInc := iStepInc * iFastFactor;   // local copy used below
    iStepDec := iStepDec * iFastFactor;
  END_IF;

  // 3. Increment path (only if not at high limit)
  IF (iIncPress AND sIncPulse) AND (qValue < iHiLim) THEN
      qValue := qValue + iStepInc;
      IF qValue > iHiLim THEN qValue := iHiLim; END_IF;
  END_IF;

  // 4. Decrement path (only if not at low limit)
  IF (iDecPress AND sIncPulse) AND (qValue > iLoLim) THEN
      qValue := qValue - iStepDec;
      IF qValue < iLoLim THEN qValue := iLoLim; END_IF;
  END_IF;

  // 5. Mutual exclusion - both buttons pressed = no change
  // (Already handled because INC and DEC are independent branches)

  // 6. Limit status flags
  qAtHiLim := (qValue >= iHiLim);
  qAtLoLim := (qValue <= iLoLim);
END_FUNCTION_BLOCK

Ladder equivalent (drop-in for STEP 7 V5.x or S7-300)

For S7-300 with STEP 7 V5.5 and WinCC flexible, the same logic is built from the following network chain in OB1 or a dedicated FC:

1. Network 1: --[ MB100.5 ]--[P]-- (positive edge detector) -> coil M_ClockPulse.
2. Network 2: --[ HMI_IncBit ]--[ M_ClockPulse ]--[AW< iHiLim ]-- -> ADD DB_Setpoint + 1 -> store in DB_Setpoint.
3. Network 3: Same as Network 2 but with HMI_DecBit, SUB 1, and AW> iLoLim.
4. Network 4: Limit-clamp with --[ >= iHiLim ]-- resetting DB_Setpoint to iHiLim.
5. Network 5: Lower clamp.

Step 4 - Alternative: Counter-Based Ramp

The legacy technique quoted in the source thread - "on/off timer feeding an up/down counter" - is still useful on older firmware that lacks comfortable edge detection, or on controllers that do not have the clock memory byte enabled. The pattern is:

1. Start a 0.2 s on/off timer (blinker) when the press bit is set.
2. Feed the timer's "1" output into a CTU counter (count-up) or CTD counter (count-down).
3. Move the counter's CV to the setpoint tag.
4. Reset the counter on release.

The drawback is the additional scan-cycle latency: the timer's output is updated in OB1 and the counter increments only when the timer's output transitions FALSE -> TRUE. With the S7 default OB1 scan of 5-10 ms, the perceived ramp is still very close to the clock-bit method. Use the counter method when you need an explicit "number of pulses" count for audit or recipe logging.

Step 5 - Configure the HMI Buttons (TIA Portal / WinCC)

On the Comfort Panel screen, drop two buttons ("+" and "-") and configure the events exactly as listed. The tag HMI_IncBit and HMI_DecBit are the same tags as the PLC's bIncPress and bDecPress - they are the HMI-side names of the same HMI tag in the connection.

"+" button (Button_1)

"-" button (Button_2)

Output field

Place an I/O field bound to qValue (or to the shared HMI tag pointing at iSetpoint in the DB) with display format DEC +/- and a length of 5-6 characters. Set the field to output mode if the operator cannot type a value, or to input/output mode if they can also key in a value directly.

Step 6 - Edge Cases and Field-Proven Caveats

• Wrap-around: If you allow the setpoint to increment past INT_MAX (32767) on an S7-1200 with default INT arithmetic, the value wraps to -32768. Always include the saturation IF qValue > iHiLim THEN qValue := iHiLim; clause shown above.
• Both buttons pressed: A user can hold both buttons simultaneously. The mutually exclusive branches above net to zero net change, which is the correct behaviour. If you want the most-recent-pressed to win, add a priority resolver.
• Network jitter: On a 100 ms PROFINET update, the press bit can bounce 1-2 cycles. The 0.2 s clock period masks this completely. If you switch to MB100.6 (0.1 s), bouncing can skip pulses - increase the integrator debounce or use the 0.2 s bit.
• Power cycle: On S7-1200, retainable tags (set with the "Retain" attribute) preserve iSetpoint across power-off. Mark the DB or the tag as retainable if the operator expects the value to persist.
• HMI tag area conflict: On legacy WinCC flexible, the HMI tag for the press bit must be in a region the HMI can write to (default: DB or M area). It cannot be the same tag as the output if you are using point-to-point without a PC station.

Step 7 - Verification

1. Go online with the PLC. Add iSetpoint, bIncPress, bDecPress, and clk02s to a watch table. Set iSetpoint to 50 and iSetpointHi/iSetpointLo to 100/0.
2. Force bIncPress := TRUE from the watch table (simulates the HMI button). Confirm that iSetpoint increases by 1 every 0.2 s. At 0.2 s/bit, the value should reach 100 in (100-50) * 0.2 = 10 s.
3. Release (bIncPress := FALSE). The value should stop incrementing immediately on the next clock edge.
4. Force bDecPress := TRUE and verify decrement. Verify that at iSetpoint := 0 the value clamps and does not go negative.
5. Force both bits TRUE simultaneously and confirm the value does not change.
6. Hold the button for >2 s. Verify the acceleration multiplier kicks in: step size jumps from 1 to 5 (default iFastFactor).
7. On the HMI, simulate the same scenario with a finger press on a TP700 Comfort. Confirm tactile response matches the 0.2 s cadence.

Troubleshooting Matrix

Performance and Scan-Time Notes

The added scan-time cost on an S7-1511 is approximately 0.005-0.010 ms per FB instance. A typical machine HMI has 5-15 setpoint ramp blocks; the aggregate cost is below 0.2 ms and is irrelevant on a 1 ms OB1. On S7-1200 with firmware V4.4 and one FB instance, the cost is approximately 0.04 ms. Reference the S7-1500 System Manual, section "Program execution", for cycle-time accounting.

The clock memory byte is updated by the priority class "cyclic interrupt" OB30-OB38 if configured, but on most projects the default background update is sufficient. The default S7-1500 OB1 priority is 1; clock memory is generated at priority 1 and is therefore phase-locked with OB1.

Quick-Reference Parameter Table

Field Commissioning Checklist

1. CPU clock memory byte enabled, address recorded in the project documentation.
2. Press bits configured on HMI as SetBit (Press) and ResetBit (Release) - not as "Set value while pressed".
3. Edge detector single instance per clock bit; no duplicates in other networks.
4. Setpoint tag type matches the HMI I/O field format.
5. Upper and lower limits set to valid engineering range.
6. Setpoint tag marked Retain if the process requires persistence.
7. Acceleration timer PT parameter set and tested with a 5-second hold.
8. Final ramp rate tested on the actual HMI panel, not the simulator.