1. Overview
Converting an analog input from a Siemens SIMATIC S7 PLC into a usable REAL engineering value is a routine task, but the terminology in the STEP 7 help, the TI-S7 library, and the STL instruction set often confuses new programmers. The original question asked which SFC (System Function) or SFB (System Function Block) performs the conversion from analog INT to REAL. The short answer is: none. Type conversion in S7 is handled by elementary bit/word instructions (ITD/I_DI, DTR/DI_R) or by the standard TI-S7 converting block FC105 "SCALE" and its inverse FC106 "UNSCALE". SFCs and SFBs are reserved for operating-system services (time, diagnostics, communication) and are not the right tool for a numeric cast.
This reference covers the conversion path on the SIMATIC S7-300 using the analog module SM 334; AI4/AO2 x 8/8Bit (order number 6ES7 334-0CE00-0AA0) described in the Siemens Industry Online Support manuals, but the same instructions apply to S7-400, S7-1200 (TIA) and ET 200 distributed I/O. The full conversion chain, scaling mathematics, bipolar handling, overrange behaviour, wire-break detection, the special PT100/PT1000 case, and a commissioning checklist are presented below.
2. Module Identification: SM 334 AI4/AO2 x 8/8Bit (6ES7 334-0CE00-0AA0)
The module 6ES7 334-0CE00-0AA0 is a compact, low-cost S7-300 analog I/O module intended for non-precision applications. Its relevant specifications from the official SIMATIC S7-300 module data manual are:
| Parameter | Value |
|---|---|
| Inputs | 4 AI (single-ended, 1 group) |
| Outputs | 2 AO |
| Resolution | 8 bits (256 steps) |
| Voltage ranges | 0 to 10 V (Ri > 100 kΩ) |
| Current ranges | 0 to 20 mA (per channel) on current variant |
| Input addressing | PIW 256, PIW 258, PIW 260, PIW 262 (default slot 4 in S7-300) |
| Output addressing | PQW 256, PQW 258 |
| Conversion time | ~ 5 ms per channel group |
| Error indication | 0x7FFF / 32767 (see Section 9) |
| Isolation | None (non-isolated backplane) |
PIW is quantised to 256 discrete levels across the nominal 0 to 27648 count range, i.e. one hardware LSB equals about 108 nominal counts. For high-precision applications a 12-bit (6ES7 334-0KE00-0AB0) or 13/14-bit module (6ES7 331 and 6ES7 332 families) must be used. The conversion procedures below are identical; only the meaning of an LSB changes.3. Analog Value Representation in SIMATIC S7
All SIMATIC analog modules return a 16-bit signed integer count that is mapped onto a normalised range. The mapping is documented in the SIMATIC S7-300 Module Data reference manual and in the online help of STEP 7. The relevant tables are reproduced below.
| Range | Value at 0 % | Value at 100 % | Value at >100 % (overrange) | Value at <0 % (underrange) |
|---|---|---|---|---|
| 0 to 10 V (unipolar) | 0 | 27648 | 32511 | -32512 (negative values not physical) |
| 0 to 20 mA | 0 | 27648 | 32511 | -1 (line break indicator on some modules) |
| 4 to 20 mA | 0 (4 mA) | 27648 (20 mA) | 32511 | -1 (wire break indication) |
| ±10 V (bipolar) | -27648 | 27648 | 32511 | -32512 |
| ±20 mA (bipolar) | -27648 | 27648 | 32511 | -32512 |
The overrange headroom (27648 to 32511) is reserved for diagnostics: any count above 27648 indicates that the real physical signal has exceeded the nominal range but is still within the diagnostic range. Counts of 32767 (0x7FFF) or 0x8000 (-32768) are reserved as fault indicators and are explained in Section 9.
4. SFC vs SFB vs FC vs FB: Clarifying the Misconception
STEP 7 distinguishes four function-block categories. Mixing them up is a common source of confusion.
| Category | Stored in | Has instance DB? | Typical use | Used for INT→REAL? |
|---|---|---|---|---|
| SFC (System Function) | Firmware (S7-300/400 OS) | No | Time, copy, diagnostics (SFC0 SET_CLK, SFC1 READ_CLK, SFC51 RDSYSST) |
No |
| SFB (System Function Block) | Firmware | Yes (user allocates) | Communication, PID background, diagnostics (SFB0..SFB5, SFB41 CONT_C, SFB52/54) |
No |
| FC (Function) | User program | No | Stateless routines, e.g. FC105 SCALE, FC106 UNSCALE
|
Yes (FC105/106) |
| FB (Function Block) | User program | Yes | Stateful routines, motor blocks, custom scaling | Yes (user FBs) |
For a pure type conversion (INT → DINT → REAL) there is no SFC/SFB; the conversion is performed by elementary bit/word instructions found in every S7 CPU's instruction set. When a scaled engineering value (for example 0.0 to 100.0 % or 4.0 to 20.0 mA) is required, the standard library TI-S7 Converting Blocks provides FC105 SCALE and FC106 UNSCALE. The library is shipped with STEP 7 V5.x and with the TIA Portal, and the source is documented in the Siemens Standard PID Control and FM 350-1/-2 Counter Module reference manuals.
5. Type Conversion Path: I_DI and DI_R
The elementary path from a 16-bit process input word (PIW) to a 32-bit floating-point value uses two instructions, executed either in STL, LAD or FBD.
- ITD / I_DI – convert INT (16-bit, -32768 to +32767) to DINT (32-bit, -2147483648 to +2147483647). The sign is extended into the upper word.
- DTR / DI_R – convert DINT (32-bit signed integer) to REAL (IEEE-754 32-bit float). The conversion is exact because the DINT range is a subset of REAL.
STL implementation, reading channel 0 of the SM 334 on slot 4:
// Read the raw 16-bit analog value
L PIW 256 // INT in accumulator-1
// Step 1: INT -> DINT (I_DI / ITD)
ITD // Accu1 = DINT, sign-extended
// Step 2: DINT -> REAL (DI_R / DTR)
DTR // Accu1 = REAL
// Store the unscaled REAL value
T MD 100 // RealVal_RAW at MD100 (REAL)
LAD/FBD equivalent using the converter palette:
|---[ PIW256 ]---[I_DI]--[DI_R]--( MD100 )---|
The value stored in MD100 is now the exact numerical representation of the raw count, for example 2.345000e+003 if the count was 2345. No scaling to engineering units has been performed. This value can be displayed, logged, or used as the input to further arithmetic, but it is rarely the final engineering result.
ITD and DTR preserve the sign, so the resulting REAL will be correct as long as the input is inside the INT range. A count of 0x7FFF (32767) is a fault flag, not a valid value, and must be filtered before scaling (see Section 9).6. Engineering-Unit Scaling: FC105 "SCALE"
To obtain a value in engineering units (psi, °C, %, RPM, etc.) the raw count must be linearised. The TI-S7 function block FC105 SCALE applies the standard Siemens conversion formula:
OUT = [ ((FLOAT (IN) - K1) / (K2 - K1)) * (HI_LIM - LO_LIM) ] + LO_LIM
For a unipolar range (BIPOLAR = FALSE) the constants are:
- K1 = 0
- K2 = 27648
For a bipolar range (BIPOLAR = TRUE) the constants are:
- K1 = -27648
- K2 = +27648
FC105 is a pure FC (no instance DB). The call interface is:
| Parameter | Type | Meaning |
|---|---|---|
| IN | INT | Raw value to be scaled, e.g. PIW 256 or MW10
|
| HI_LIM | REAL | Engineering value at 100 % input (e.g. 100.0) |
| LO_LIM | REAL | Engineering value at 0 % input (e.g. 0.0) |
| BIPOLAR | BOOL | FALSE = unipolar (0 to 27648); TRUE = bipolar (-27648 to +27648) |
| RET_VAL | WORD | Return code: 0000 hex = OK; 8000 hex = overflow, OUT is set to HI_LIM |
| OUT | REAL | Scaled engineering result |
STL call example, reading the 0 to 10 V input on channel 0 of the SM 334 and scaling to 0.0 to 100.0 %:
CALL FC 105
IN := PIW256 // raw count
HI_LIM := 1.000000e+002 // 100.0
LO_LIM := 0.000000e+000 // 0.0
BIPOLAR := FALSE
RET_VAL := MW20 // 0000 = OK, 8000 = clip
OUT := MD30 // scaled REAL (0.0 to 100.0)
A 4-20 mA input scaled to 0.0 to 250.0 °C (typical RTD transmitter output) is scaled by setting LO_LIM = 0.0, HI_LIM = 250.0, BIPOLAR = FALSE; the formula compensates internally for the 4 mA live-zero offset because K1 = 0 corresponds to 0 % of the input range (which is 4 mA on a 4-20 mA transmitter).
7. Reverse Scaling: FC106 "UNSCALE"
To drive an analog output (e.g. the two AO channels of the same 6ES7 334-0CE00-0AA0) a scaled REAL value must be converted back into the raw count that the module expects. FC106 UNSCALE applies the inverse formula:
OUT = [ ((IN - LO_LIM) / (HI_LIM - LO_LIM)) * (K2 - K1) ] + K1
With LO_LIM = 0.0, HI_LIM = 100.0, BIPOLAR = FALSE the block returns the integer count that the SM 334 expects for a 0 to 10 V output, which the program then writes to PQW 256.
CALL FC 106
IN := MD50 // setpoint in %
HI_LIM := 1.000000e+002
LO_LIM := 0.000000e+000
BIPOLAR := FALSE
RET_VAL := MW22
OUT := PQW256 // 0 to 27648 -> 0 to 10 V
8. Bipolar vs Unipolar Configuration
The BIPOLAR parameter of FC105 must match the hardware configuration of the channel in HW Config (STEP 7) or in the device configuration of TIA Portal. The SM 334 (6ES7 334-0CE00-0AA0) is unipolar only (0 to 10 V or 0 to 20 mA). For bipolar signals a different module from the SM 334 family or the SM 331/332 family must be used; in that case BIPOLAR = TRUE selects K1 = -27648 and K2 = +27648. Mixing the parameter with the hardware range is the single most common cause of a factor-of-two or sign-inverted output.
9. Error Codes and Diagnostics
Analog modules signal abnormal conditions by returning specific diagnostic counts. These counts must be filtered before scaling, because feeding 32767 into FC105 will produce nonsense engineering values.
| Count | Hex | Meaning | Recommended handling |
|---|---|---|---|
| 32767 | 0x7FFF | Overflow / range overflow / wire break (4-20 mA live-zero) | Trap in user code, set alarm bit, do not scale |
| -32768 | 0x8000 | Underflow / open wire on bipolar voltage modules | Trap and alarm |
| 32512 to 32766 | 0x7F00 to 0x7FFE | Overrange (signal >100 % but <diagnostic limit) | Accept as valid; FC105 will clip at HI_LIM |
| 0 | 0x0000 | 0 % value (0 V, 0 mA, 4 mA live-zero) | Valid measurement |
The fault indicator is the same for all SIMATIC analog modules in the S7-300 family, as documented in the SIMATIC S7-300 Module Data manual. A typical guard block:
L PIW 256 // raw count
L 32767 // compare to 0x7FFF
>I // ACCU2 > ACCU1?
JCN OK1
S M 10.0 // set "Overflow / Wire Break" flag
JU DONE
OK1: L -32768
<I
JCN OK2
S M 10.1 // set "Underflow / Open Wire" flag
JU DONE
OK2: CALL FC 105
IN := MW10
HI_LIM := 1.000000e+002
LO_LIM := 0.000000e+000
BIPOLAR := FALSE
RET_VAL := MW12
OUT := MD30
DONE: NOP 0
10. PT100 and Temperature-Scaling Special Case
When a temperature input channel is configured as a thermocouple type (PT100, PT1000, Ni1000, type J/K, etc.) in HW Config, the module no longer returns a normalised count. Instead, it returns the temperature multiplied by ten (PT100, type K, type J) or by one (PT1000 with 0.1 ° resolution on newer modules). This behaviour is documented in the chapter "Representation of the Analog Values of Resistance Thermometers and Thermocouples" of the S7-300 module data manual.
| Sensor type | Module returns | Conversion to °C |
|---|---|---|
| PT100 standard | Count / 10 | REAL_Temp = DTR( ITD( PIW ) ) / 10.0 |
| PT100 clim. (climatic range) | Count / 10 | Same |
| PT1000 (newer modules) | Count / 10 (0.1 °C resolution) | Same |
| Ni100 / Ni1000 | Count / 10 | Same |
| Type J / K / N thermocouple | Count / 10 | Same |
| Type T / E / R / S / B | Count / 10 (0.1 °C) or /1 (1 °C) depending on module | Check module manual |
Do not pass a PT100 raw count to FC105 SCALE with LO_LIM = 0, HI_LIM = 100. The block will treat the count as a percentage and produce wrong temperatures. Use the explicit division path instead:
L PIW 256 // e.g. 2345 (= 234.5 °C)
ITD // I_DI
DTR // DI_R -> 2345.0
L 1.000000e+001
/R // divide by 10.0
T MD 200 // REAL: 234.5 °C
11. SFC51, SFB52 and SFB54 – Reading Module Diagnostics
When the analog value is 32767, it is often useful to read the diagnostic record of the module to identify the root cause. Siemens provides three system calls for this:
| Block | Purpose | Typical use |
|---|---|---|
| SFC51 RDSYSST | Read partial system status list (SSL) | Identify which slots report an error |
| SFB52 RDREC | Read a data record (DS0/DS1) from a module | Get the structured diagnostic data of SM 334 |
| SFB54 RALRM | Receive a complete interrupt-based alarm | Process diagnostic interrupts in OB82 |
A diagnostic interrupt for the SM 334 will deposit information about the failing channel (e.g. "Channel 0 wire break", "Channel 2 overrange") in the diagnostic data record DS0/DS1. The S7-300/400 standard and system functions reference describes the byte layout. If a recurring OB82 is observed and the count is 32767, the diagnostic record distinguishes wire break from overrange from short circuit, allowing the HMI message to be specific.
12. Custom FC/FB with Overflow and Wire-Break Alarms
For applications that require more than the standard FC105 provides, a wrapper FB is recommended. The wrapper:
- Traps 32767 and -32768 before scaling.
- Traps overrange (counts between 27649 and 32766).
- Traps underrange (counts between 1 and 0; only for ranges that do not include zero, e.g. 4-20 mA).
- Applies FC105 to the validated range.
- Exposes the scaled value, the limit flags, the raw count, and a quality byte to the HMI.
The data structure for the instance DB of such an FB on a S7-300 (S7-300 supports 8-bit quality field and BOOL flags packed in byte):
DATA_BLOCK DB200 // AI scaling FB instance
STRUCT
Quality : BYTE; // 0=Good, 1=Overflow, 2=Underflow, 3=WireBreak, 4=Bad
Overflow : BOOL; // M100.0 alias in DB
Underflow : BOOL;
WireBreak : BOOL;
Bad : BOOL;
RawCount : INT; // Mirror of PIW
ScaledValue : REAL; // Result of FC105
Hi_Lim : REAL; // Pass-through
Lo_Lim : REAL;
END_STRUCT
END_DATA_BLOCK
Calling the FB once per channel inside OB1 (or in OB35 for cyclic execution) consolidates the alarm logic in one place and avoids scattering limit checks across the program.
13. Step-by-Step Implementation Guide
- Configure the module in HW Config. Drag the SM 334 (6ES7 334-0CE00-0AA0) to its slot, set the input range (0 to 10 V or 0 to 20 mA), enable diagnostic interrupt if the CPU supports OB82, and download the hardware configuration.
-
Open the symbol table and assign symbolic names to the PIW and PQW addresses (e.g.
AI_Ch0_Rawfor PIW 256). -
Install the TI-S7 Converting Blocks library. In STEP 7 V5.x: File → Open → Libraries → TI-S7 Converting Blocks; copy
FC105andFC106into your S7 program container. - Create the instance DB for your custom scaling FB (Section 12) or use global flags/MWs.
-
Insert the call in OB1 (or in a cyclic OB such as OB35 for 100 ms update). Wire the input from
PIW 256and the limits from constants or operator-adjustable data blocks. - Add the fault guard from Section 9 around the FC105 call.
- Compile and download the program to the PLC.
- Verify online using Monitor/Modify in STEP 7: force a known input (e.g. 5 V from a calibrator) and confirm the scaled REAL matches expectations.
- Document the channel in the HMI tag list with engineering unit, range, and quality mapping.
14. Verification Checklist
| Step | Expected | Result |
|---|---|---|
| Apply 0 % of input range | PIW = 0, MD30 = LO_LIM (0.0) | OK / Not OK |
| Apply 50 % of input range | PIW ≈ 13824, MD30 = (HI_LIM + LO_LIM)/2 | OK / Not OK |
| Apply 100 % of input range | PIW = 27648, MD30 = HI_LIM | OK / Not OK |
| Apply 110 % of input range (overrange) | PIW ≈ 30000, MD30 clipped to HI_LIM, overflow flag set | OK / Not OK |
| Disconnect 4-20 mA wire | PIW = 32767, MD30 = last valid (frozen), wire-break flag set | OK / Not OK |
| Apply negative voltage on bipolar channel | PIW < 0, MD30 < 0, sign correct | OK / Not OK |
| Cycle power and warm up 5 minutes | Drift < 0.5 % of full scale (8-bit module; expect 1 LSB quantisation) | OK / Not OK |
15. Troubleshooting Matrix
| Symptom | Likely cause | Diagnostic | Remedy |
|---|---|---|---|
| PIW always 32767 | Wire break, open input, module fault | Check wiring, LED on module, OB82 diagnostic buffer | Repair cable, replace sensor, evaluate SFB52/OB82 |
| PIW always 0 | Sensor shorted, wrong channel configured, address error | HW Config → Inputs tab; force address in VAT | Reconfigure channel, correct PIW address |
| Scaled value stuck at HI_LIM | FC105 RET_VAL = 8000, raw input saturated | Check actual input voltage with multimeter | Reduce signal, check scaling limits |
| Scaled value doubled / halved | BIPOLAR flag set on unipolar module (or vice-versa) | Compare HW Config → Channel → Range with FC105 BIPOLAR input | Set BIPOLAR = FALSE for 0-10 V module |
| Scaled value always 0 with raw count non-zero | LO_LIM = HI_LIM (division by zero in FC105) | Monitor LO_LIM and HI_LIM | Correct the limits |
| Value jumps ±108 counts (one LSB) on stable input | 8-bit resolution of 6ES7 334-0CE00-0AA0 | Module data sheet | Acceptable; replace with 12/13/14-bit module for higher resolution |
| PT100 reads 10× too high | Forgot to divide by 10 after DTR | Module configured as RT, not as voltage | Insert division by 10 (Section 10) |
| PT100 reads -273 °C | Wrong input wiring polarity on 4-wire RTD | Check sensor wiring | Swap or reconnect according to module manual |
| PIW = -32768 (0x8000) | Open wire on bipolar voltage input, common-mode out of range | Hardware diagnostics | Repair cable, check grounding |
| FC105 "Block not found" during compile | FC105 not copied into the S7 program | Program blocks container | Copy FC105 from the TI-S7 Converting Blocks library |
16. Performance, Cycle Time and Ordering Notes
The elementary ITD + DTR path consumes roughly 2 µs on a CPU 315-2 PN/DP and 1 µs on a CPU 319. FC105 consumes approximately 8 µs on a CPU 315 and 4 µs on a CPU 319, depending on firmware version (FW ≥ V2.6 recommended; see Siemens support entry 109751634 for the documented performance). For a 4-channel module processed in OB1 the additional cycle-time burden is therefore negligible (less than 50 µs even on a CPU 312 IFM).
When ordering spare parts or replacements, be aware that the 6ES7 334-0CE00-0AA0 is a discontinued product. The current equivalent with 8-bit resolution and 4 AI/2 AO is the 6ES7 334-0CE01-0AA0 (ES7 334 module data), and for higher precision the 6ES7 334-0KE00-0AB0 (12-bit) is the recommended replacement. The conversion procedures above apply unchanged to the successors; only the input wiring and the LSB step size change.
17. Frequently Asked Questions
Is there an SFC or SFB that converts INT to REAL on S7-300?
No. SFCs and SFBs are reserved for operating-system services such as time, communication and diagnostics. Numeric type conversion is performed by the elementary instructions ITD (I_DI) and DTR (DI_R) found in every S7 CPU. For engineering-unit scaling the standard FC105 SCALE and FC106 UNSCALE from the TI-S7 Converting Blocks library are used.
Why does FC105 return 8000 hex in RET_VAL and a clipped value?
A RET_VAL of 0x8000 means that the raw input was outside the range that FC105 can represent with the configured LO_LIM/HI_LIM limits. The block clips the result to the closest limit. Common causes are: wrong LO_LIM/HI_LIM values, wrong BIPOLAR flag, or a raw count of 32767 (fault) that was not filtered out before the call.
What does a count of 32767 (0x7FFF) on the SM 334 mean?
It is a fault indicator, not a measurement. On 4-20 mA inputs it usually means wire break (open loop). On voltage inputs it indicates overflow or a hardware error. Use SFC51/SFB52 or evaluate OB82 to obtain the detailed diagnostic record, and trap 32767 in user code before scaling.
Do I have to divide the PIW by 10 for PT100 inputs?
Yes, if the channel is configured as PT100 (or PT1000/Ni100/type J/K thermocouple) in HW Config. The module returns temperature × 10 (0.1 °C resolution). Convert with ITD, DTR, then /R 10.0. Do not pass a PT100 raw count through FC105 with LO_LIM/HI_LIM in °C; the block will misinterpret it as a percentage.
Can FC105 be used on a CPU 314 in TIA Portal?
FC105 and FC106 are part of the standard library that is portable to TIA Portal through the "Program blocks → Libraries → TI-S7 Converting Blocks" path, or they can be rewritten using the IEC-compliant SCL code shipped with newer library versions. The behaviour and parameters are identical to STEP 7 V5.x. For new TIA-only projects, consider the IEC function SCALE from the "Standard library → Conversion operations" palette, which provides the same linear mapping with native IEC types.
How do I detect a wire break on a 4-20 mA input reliably?
On a 4-20 mA input wired correctly, a wire break produces a PIW value of 32767 (0x7FFF). Filter this value in user code and set a dedicated flag. For additional protection enable the diagnostic interrupt in HW Config and evaluate OB82; SFB52 RDREC will return the channel number and the diagnostic event in DS0/DS1.
The scaled value oscillates ±1 LSB even with a stable input. Is my wiring wrong?
On the 6ES7 334-0CE00-0AA0 the resolution is only 8 bits, so one LSB equals about 108 nominal counts (≈ 40 mV on a 0-10 V range, ≈ 0.08 mA on 0-20 mA). The oscillation is the natural quantisation of the ADC, not a wiring problem. For smoother readings either average in software (e.g. across 16 OB35 cycles) or replace the module with a 12/13/14-bit successor.