Resolving FC106 Output Stuck at 65535 in Siemens S7-300 STEP 7

Overview

The Siemens SIMATIC S7-300 / S7-400 standard library ships with a pair of well-known scaling blocks - FC105 (SCALE) and FC106 (UNSCALE) - that map between the integer raw counts returned by analog input/output modules (0 to 27648 or -27648 to +27648) and the engineering-unit floating-point values (REAL) used inside the user program. FC105 converts INT to REAL; FC106 converts REAL back to INT. Both blocks live in the TI-S7 Converting Blocks library that is installed automatically with every STEP 7 V5.x release.

A very common field issue, especially on S7-300 CPUs paired with WinCC Flexible 2008 HMI panels, is that the FC106 OUT word locks at 65535 regardless of the value written to its IN input. The HMI accepts new setpoints, the operator drags the slider, the I/O field updates - but the analog output channel never reflects the change, and the diagnostic word always reads W#16#FFFF. The block's own RET_VAL stays at W#16#0000, ruling out an internal block error. The cause is almost always a data type mismatch at the FC106 IN pin: a 16-bit integer written by the HMI is being interpreted by the block as the low word of a 32-bit IEEE 754 REAL, leaving the upper word undefined.

This article documents the exact root cause, the data type conversion ladder required to clear the fault, the HMI-side configuration alternative that removes the conversion from the PLC scan, and the full parameter and error-code reference needed to verify the fix in PLCSIM or on the live CPU.

FC106 UNSCALE Block - Function and Parameters

FC106 is the inverse of FC105. It accepts a REAL engineering-unit value at IN and produces the INT raw count that must be written to an analog output channel or a 16-bit register. The block is functionally equivalent to the modern TIA Portal instruction pair UNSCALE_X / SCALE_X with input/output ranges of 0.0 to 1.0 and 0 to 27648.

The complete parameter table for the FC106 UNSCALE block is reproduced from the STEP 7 Standard Library, TI-S7 Converting Blocks, FB-RFG documentation:

Scaling equations used by the block:

• Unipolar (BIPOLAR = FALSE): OUT = (IN - LO_LIM) / (HI_LIM - LO_LIM) * 27648, clamped to 0 ... 27648.
• Bipolar (BIPOLAR = TRUE): OUT = (IN - LO_LIM) / (HI_LIM - LO_LIM) * 55296 - 27648, clamped to -27648 ... +27648.

The block is fully re-entrant; calling it more than once per OB1 cycle (for example, in OB35 at 100 ms) does not require a separate instance DB. A complete worked example of FC105 plus FC106 wiring (analog-in to engineering value back to analog-out) is published by Siemens as the application note Scaling and Unscaling Analog Values.

Problem Details

Observed symptom: FC106 OUT (a 16-bit word such as MW200) reads 65535 (W#16#FFFF) at all times, regardless of what is written to the IN input. The IN value can be changed in the VAT, in the online monitor, or via HMI - the output never tracks the input. The RET_VAL remains W#16#0000 (no internal block error).

Platforms affected:

• SIMATIC S7-300 CPUs (all firmware versions, e.g. 6ES7 312 / 314 / 315 / 317 / 319 with FW 2.x through 3.x)
• SIMATIC S7-400 CPUs (all firmware versions, e.g. 6ES7 412 / 414 / 416 / 417)
• STEP 7 V5.4, V5.5, V5.6
• WinCC Flexible 2008 SP2 / SP3 / SP4 / SP5 (Compact, Standard, and Advanced)
• OP 77B, TP 177B, TP 277, MP 277, MP 377 panels writing to the CPU tag over MPI, PROFIBUS, or PROFINET

Conditions that trigger the fault:

• The HMI process tag connected to the slider or I/O field is defined as INT (16-bit signed) - the WinCC Flexible default.
• The same tag (or the HMI tag's destination address) is wired to FC106's IN parameter, which expects REAL (32-bit IEEE 754).
• The user has not performed a formal type conversion between the HMI write and the FC106 input.

The bug is reproducible 100% of the time once the type mismatch exists. Constant values entered in the LAD/FBD editor on FC106's IN pin do not trigger the bug because STEP 7 silently inserts a type-correct 32-bit REAL constant on download.

Root Cause Analysis

FC106's IN input is declared as REAL (32-bit, IEEE 754 single-precision). The block reads four consecutive bytes of the user's data area (for example, MD80 = MB80, MB81, MB82, MB83) and interprets them as a floating-point number.

WinCC Flexible I/O fields and slider controls default to writing 16-bit signed integers (INT). When the operator drags a slider from 0 to 100, the panel writes a value such as +50 to the configured PLC tag - but only two bytes are written. The two upper bytes of the 32-bit REAL area retain whatever was last in memory.

If the upper bytes happen to contain W#16#FFFF (a common default after a CPU restart, a stop-and-go transition, or a download that re-initialised the work memory), the resulting 32-bit REAL is approximately 1.18E-38 - well above the upper limit of any practical engineering range. FC106 then saturates its output, and depending on the OUT address and the diagnostic tool's interpretation, the saturated value can appear as 65535 when the word is monitored as an unsigned value or when the same word is being read by an HMI tag that is itself configured as WORD.

More important than the specific number is the underlying mechanism: STEP 7 will not raise a compile error when a 16-bit INT tag is connected to a 32-bit REAL parameter, but the bit pattern is not numerically converted; it is reinterpreted. This is the source of every "ghost" value seen on the output.

Bit-Level Demonstration

Consider the operator writing the engineering value 50.0 to the I/O field. The HMI, configured as INT, writes the 16-bit two's-complement representation of 50 (16#0032) to MW100 - which is the low word of MD100. The upper word, MW102, retains 16#FFFF from a previous scan or initialisation. The 32-bit pattern seen by FC106 is therefore:

MD100 = 16# FFFF 0032
       = 0xFFFF0032 (IEEE 754 single)
       ~ -1.58E-12  (small negative denormalised number)

With LO_LIM = 0.0 and HI_LIM = 100.0, FC106 will then output a tiny negative value clamped to 0 (unipolar) or a small negative number (bipolar). The fact that the operator sees 65535 in the output instead of 0 indicates the saturated branch is being entered in the unipolar range - which is the more common observation when the upper word is 16#FFFF and the resulting REAL exceeds 1.7E+38 (signed infinity after IEEE 754 rounding), or when an HMI tag is also writing 65535 back to the same address.

Secondary Cause: HMI Writing to the Output Address

Many panel projects also use the same memory word for both the input to FC106 and the HMI's status display. If the tag list contains a duplicate entry pointing to the OUT word, the HMI will write the saturated value back to the same address on every cycle, masking the conversion fix. Always confirm that the HMI tag's write direction is "Read only" for the output side, and use separate address ranges for HMI-in (slider value), HMI-out (display only), and FC106 internal scratch.

Memory Map at a Glance

The diagnostic sequence to follow when the OUT word reads 65535 is therefore:

1. Open a VAT and monitor the four bytes that make up the IN area (e.g. MB80, MB81, MB82, MB83). If MB82 or MB83 shows 16#FF, the upper word is contaminated.
2. Monitor the OUT word and confirm whether it tracks the saturated REAL or whether it is being overwritten by another write (HMI, another network, a forced value).
3. Check the cross-reference (Ctrl+Shift+F in STEP 7) on the OUT address. Any other network that writes to that MW will produce the 65535 symptom.

Solution 1: PLC-Side Ladder Conversion (ITD + DTR)

The reliable, vendor-recommended fix is to perform a two-step conversion between the HMI tag and FC106:

1. ITD (Integer to Double Integer) - converts the 16-bit INT (-32768 to +32767) to a 32-bit DINT, sign-extended.
2. DTR (Double Integer to Real) - converts the 32-bit DINT to a 32-bit IEEE 754 REAL.

Sample STL (Statement List) implementation that reads the HMI tag from MW100, converts it, and feeds FC106:

Network 1: Read 16-bit INT from HMI and convert to REAL
      L     MW    100          // slider / IO field value (INT, 16-bit)
      ITD                       // INT -> DINT (sign-extended to 32-bit)
      DTR                       // DTR -> REAL (IEEE 754 single)
      T     MD    104          // store clean REAL in MD104

Network 2: Scale REAL into INT raw via FC106
      CALL  FC   106
        IN       := MD104
        HI_LIM   := 1.000000e+002    // 100.0 engineering units
        LO_LIM   := 0.000000e+000    // 0.0 engineering units
        BIPOLAR  := FALSE
        RET_VAL  := MW108
        OUT      := MW110            // 0 .. 27648 (unipolar)

Equivalent FBD representation:

MW100 --[ ITD ]--[ DTR ]--MD104 --[ FC106 IN ]--
                                     |
                                  HI_LIM: 100.0
                                  LO_LIM: 0.0
                                  BIPOLAR: 0
                                  OUT  -> MW110  (0 .. 27648)
                                  RET_VAL -> MW108

Why this works: ITD sign-extends the 16-bit value to a 32-bit DINT (filling the upper word with 16#0000 for positive numbers or 16#FFFF for negative numbers), and DTR then performs a true numeric conversion to REAL. The result is a clean, single-precision floating-point number that FC106 can scale without ambiguity. The MW102 high word of MD104 is guaranteed to be the correct sign extension of the original INT, not stale memory.

LAD Implementation

In LAD (Ladder Diagram), the conversion is performed by inserting an ITD coil and a DTR coil in series, with the source INT at the start and the destination REAL at the end. The four instructions fit in a single network:

|    MW100    |    ITD    |    DTR    |    MD104    |
|  (INT in)   |           |           | (REAL out)  |

The destination REAL (MD104) is then wired to FC106's IN parameter in the following network. The two-coil sequence is the canonical Siemens pattern and is documented in the STEP 7 Help under Basis Operations > Conversion Operations.

SCL Equivalent

For S7-300 projects using SCL (Structured Control Language) blocks, the equivalent conversion is a single type cast:

// SCL equivalent of ITD + DTR
FC106_IN_REAL := INT_TO_REAL(HMI_INT_TAG);   // implicit sign extension
FC106(IN := FC106_IN_REAL,
      HI_LIM := 100.0,
      LO_LIM := 0.0,
      BIPOLAR := FALSE,
      RET_VAL := FC106_RET,
      OUT := FC106_OUT);

The INT_TO_REAL SCL operator compiles to the same ITD + DTR instruction pair in the generated STL, so the runtime cost is identical. Use the SCL form only when the surrounding code is already SCL; do not mix STL and SCL in the same FC just to perform a conversion.

Solution 2: HMI-Side Conversion in WinCC Flexible

The conversion can be performed on the panel side, removing the ITD + DTR pair from the PLC scan. WinCC Flexible 2008 supports two independent mechanisms: reconfiguring the I/O field or slider to use a REAL process tag, or applying a Linear Scale conversion at the tag level.

Method A: Reconfigure the Process Tag Data Type to Real

1. Open WinCC Flexible and load the project that ships to the panel.
2. In the project tree, open Communication > Tags.
3. Locate the tag used for the slider/I/O field (for example, FC106_IN).
4. Set the Data type field from Int to Real. WinCC Flexible will automatically adjust the address range to occupy a 32-bit MD area (4 bytes).
5. Update the tag address to point at the same MD that FC106 reads (for example, MD 80).
6. Save, compile, and transfer the runtime to the panel.

Method B: Configure the I/O Field Display Format

Even with an INT tag, the I/O field can be displayed as a decimal number with fractional digits. This is purely cosmetic and does not change the underlying tag width. To perform an actual conversion, use the Linear Scale property of the tag (next method). Method B is useful only when the operator must see a fractional display value while the underlying tag is INT.

Method C: Linear Scaling on the Tag

1. In the tag properties, open Properties > Linear Scale.
2. Enable Linear scale.
3. Set the PLC end (raw) values and the HMI end (scaled) values. For a slider operating in the range 0 to 100 engineering units mapped to 0 to 27648 raw counts, set PLC end values 0 and 27648 and HMI end values 0 and 100.
4. WinCC Flexible will write the scaled REAL directly to the configured MD address, with full IEEE 754 precision.

With Method A or Method C, the PLC can connect the MD directly to FC106's IN pin with no ITD/DTR conversion required. The operator still sees a 0-100 range on the panel; the panel performs the integer-to-float conversion on the device side, completely isolating the PLC from the tag-width question.

Method D: Convert in the HMI's VB Script

For panels that run WinCC Flexible 2008 SP3 or later with the scripting option enabled, a tag can be post-processed in a VBScript event (for example, the OnChange event of the slider):

' VBScript in WinCC Flexible
Dim scaledValue
scaledValue = CDbl(SmartTags("HMI_INT_TAG"))  ' CDbl converts to Double
SmartTags("HMI_REAL_TAG") = scaledValue       ' write to 4-byte REAL tag

Method D is only recommended when Methods A and C are not feasible (for example, when the source INT tag is part of a library or third-party screen that cannot be reconfigured). It adds a per-event VB overhead of approximately 5 to 20 ms and should be used sparingly.

FC106 RET_VAL Error Codes

The RET_VAL output of FC106 follows the standard SIMATIC error reporting convention. The return value is a WORD (16-bit) and is W#16#0000 for normal operation. The full error-code table:

If the OUT word shows 65535 (W#16#FFFF) but RET_VAL is W#16#0000, the cause is almost always the data type mismatch described in this article, not an FC106 block error. Cross-check the four bytes of the IN area in the VAT before assuming a fault in the scaling logic itself.

FC105 (SCALE) vs FC106 (UNSCALE) Comparison

FC105 and FC106 are functional inverses. They are commonly used together, particularly on systems with both analog input and analog output modules. The same ITD/DTR pitfall applies to FC105 when a 16-bit HMI tag is written to its OUT address (an unusual but possible wiring mistake when the user wants to preview the raw count in the HMI).

Both blocks share the same RET_VAL semantics and the same BIPOLAR / HI_LIM / LO_LIM behaviour. The same ITD/DTR conversion pitfall applies to FC105 when a 16-bit HMI tag is written to its OUT address (an unusual but possible wiring mistake when the user wants to preview the raw count in the HMI).

Verification Steps

After applying either fix, perform the following verification sequence. The sequence is designed to be run on PLCSIM first, then repeated on the live CPU to confirm identical behaviour.

1. Compile the STEP 7 project. No new errors or warnings should appear. Existing conversion warnings can be ignored only if the conversion has been confirmed by an online trace.
2. Download to the CPU in STOP mode if the program structure has changed; RUN-mode download is acceptable for adding the ITD/DTR conversion.
3. Open a VAT (Variable Table) online and monitor MW100 (raw HMI INT), MD104 (converted REAL), MW110 (FC106 OUT), and MW108 (FC106 RET_VAL).
4. Force MW100 = 50. MD104 should read 50.0, MW110 should read 13824 (= 50/100 * 27648), and MW108 should read 0.
5. Force MW100 = 0 and 100. OUT should reach 0 and 27648 respectively.
6. Force MW100 = 150 (over-range). OUT should clamp to 27648, RET_VAL should be W#16#0008.
7. Force MW100 = -50 (under-range in unipolar mode). OUT should clamp to 0, RET_VAL should be W#16#0009.
8. Force MW100 = -27648 (full bipolar negative range with BIPOLAR = TRUE). OUT should reach -27648.
9. Toggle the HMI slider from 0 to 100 and confirm the OUT word tracks linearly on the online monitor. Sample at three points (0, 50, 100) to verify linearity.
10. Power-cycle the CPU and re-test. The fix must survive a cold start; the ITD/DTR pair guarantees a clean REAL on every scan, independent of memory residual content.

Common Pitfalls and Field-Notes

1. Unipolar vs Bipolar Selection

Setting BIPOLAR to TRUE when the signal source is a unipolar sensor (4-20 mA, 0-10 V) will map the engineering value to the bipolar raw range, halving the effective resolution (the output span is 55296 counts instead of 27648). Confirm with the analog output module's wiring diagram and the sensor's datasheet before selecting the mode.

2. Using MD80, MD90, MD100 as Scratch REALs

STEP 7's address cross-reference will not warn of overlap between two REAL tags. If the user program writes to MD80 in one network and reads from MD80 in another, the read may pick up an in-flight value. Use unique, well-spaced addresses such as MD200, MD204, MD208 for FC106 working values, and document the address allocation in the program header comment block.

3. HMI Polling vs PLC Cycle Time

On PROFINET, the panel updates the tag at the configured acquisition cycle (default 1 s). If the operator moves the slider quickly and the OUT appears "stuck", verify that the panel's tag is set to Cyclic continuous rather than On demand or On change. In WinCC Flexible, the setting is under Tag properties > Acquisition cycle.

4. Watchdog and Scan Time

FC106 adds approximately 0.2 ms to OB1 cycle on an S7-316. The ITD/DTR pair adds another 0.05 ms. For high-priority OBs (OB35, OB82) the cumulative cost may be relevant in very fast closed loops; consider calling FC106 in OB1 only and reading the FC106 IN scratch REAL from OB35 if the loop time is critical.

5. Converting DTR Result Before Writing to Analog Output

FC106 produces an INT raw count. To write this to an analog output module (for example, 6ES7 332-5HD01-0AB0), use the standard SFC WR_PAL (SFC 29) or the record-writing SFBs (WRREC, SFB 53) for the output to be applied, or assign the OUT word directly to a Peripheral Output Word (PAW) in the hardware configuration. The OUT word of FC106 should be assigned to a PAW directly in the hardware configuration, not a flag word, unless the analog output module's hardware address is symbolic or the I/O is updated via process image partition PIP 0.

6. Mismatched Sign Extension in ITD

ITD sign-extends the 16-bit INT: positive values produce an upper word of 16#0000, negative values produce an upper word of 16#FFFF. If the HMI tag is unsigned (WORD) and the operator enters 50000, ITD will interpret 50000 as a negative INT (-15536) and the upper word will be 16#FFFF. DTR will then produce a small negative REAL, which FC106 will saturate to the lower limit. The remedy is to add an explicit range check before ITD, or to define the HMI tag as a positive-only INT and limit the operator input range to 0 to 32767.

7. TIA Portal Migration Note

When migrating an S7-300 STEP 7 V5.x project to TIA Portal (S7-300 or S7-1500), FC105 and FC106 are automatically replaced by the instruction pair NORM_X / SCALE_X (SCALE_X for analog output) with input range 0.0 to 1.0 and output range 0 to 27648. The same data type discipline applies: the SCALE_X input must be a REAL; the output is INT. Migrate the ITD + DTR conversion pattern unchanged, and the HMI tag must still be configured as REAL (or Linear Scaled) to avoid the same 65535 symptom. The TIA Portal SCL equivalent of the ITD + DTR pair is the type cast INT_TO_REAL, which compiles to a single MOVE into a 32-bit REAL slot.

8. PLCSIM Simulation Pitfall

On PLCSIM, the work memory is initialised to zero on each download, so the upper word of the REAL area is normally 16#0000 rather than 16#FFFF. This is why the bug can be difficult to reproduce in PLCSIM: the HMI writes 2 bytes, the upper 2 bytes are 0, and the resulting REAL is in the valid range. The bug becomes visible only on the live CPU after a stop-and-go transition or an MRES. To reproduce in PLCSIM, force the upper word to 16#FFFF from the VAT and observe the OUT saturate.