Siemens S7 Analog INT to REAL: FC105, I_DI, DI_R Conversion

David Krause18 min read
HMI ProgrammingSiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Overview

Converting an analog input from a Siemens SIMATIC S7 PLC into a usable REAL engineering value is a routine task, but the terminology in the STEP 7 help, the TI-S7 library, and the STL instruction set often confuses new programmers. The original question asked which SFC (System Function) or SFB (System Function Block) performs the conversion from analog INT to REAL. The short answer is: none. Type conversion in S7 is handled by elementary bit/word instructions (ITD/I_DI, DTR/DI_R) or by the standard TI-S7 converting block FC105 "SCALE" and its inverse FC106 "UNSCALE". SFCs and SFBs are reserved for operating-system services (time, diagnostics, communication) and are not the right tool for a numeric cast.

This reference covers the conversion path on the SIMATIC S7-300 using the analog module SM 334; AI4/AO2 x 8/8Bit (order number 6ES7 334-0CE00-0AA0) described in the Siemens Industry Online Support manuals, but the same instructions apply to S7-400, S7-1200 (TIA) and ET 200 distributed I/O. The full conversion chain, scaling mathematics, bipolar handling, overrange behaviour, wire-break detection, the special PT100/PT1000 case, and a commissioning checklist are presented below.

2. Module Identification: SM 334 AI4/AO2 x 8/8Bit (6ES7 334-0CE00-0AA0)

The module 6ES7 334-0CE00-0AA0 is a compact, low-cost S7-300 analog I/O module intended for non-precision applications. Its relevant specifications from the official SIMATIC S7-300 module data manual are:

Parameter Value
Inputs 4 AI (single-ended, 1 group)
Outputs 2 AO
Resolution 8 bits (256 steps)
Voltage ranges 0 to 10 V (Ri > 100 kΩ)
Current ranges 0 to 20 mA (per channel) on current variant
Input addressing PIW 256, PIW 258, PIW 260, PIW 262 (default slot 4 in S7-300)
Output addressing PQW 256, PQW 258
Conversion time ~ 5 ms per channel group
Error indication 0x7FFF / 32767 (see Section 9)
Isolation None (non-isolated backplane)
Resolution caveat. Because the hardware is 8 bits, the value seen in the PIW is quantised to 256 discrete levels across the nominal 0 to 27648 count range, i.e. one hardware LSB equals about 108 nominal counts. For high-precision applications a 12-bit (6ES7 334-0KE00-0AB0) or 13/14-bit module (6ES7 331 and 6ES7 332 families) must be used. The conversion procedures below are identical; only the meaning of an LSB changes.

3. Analog Value Representation in SIMATIC S7

All SIMATIC analog modules return a 16-bit signed integer count that is mapped onto a normalised range. The mapping is documented in the SIMATIC S7-300 Module Data reference manual and in the online help of STEP 7. The relevant tables are reproduced below.

Range Value at 0 % Value at 100 % Value at >100 % (overrange) Value at <0 % (underrange)
0 to 10 V (unipolar) 0 27648 32511 -32512 (negative values not physical)
0 to 20 mA 0 27648 32511 -1 (line break indicator on some modules)
4 to 20 mA 0 (4 mA) 27648 (20 mA) 32511 -1 (wire break indication)
±10 V (bipolar) -27648 27648 32511 -32512
±20 mA (bipolar) -27648 27648 32511 -32512

The overrange headroom (27648 to 32511) is reserved for diagnostics: any count above 27648 indicates that the real physical signal has exceeded the nominal range but is still within the diagnostic range. Counts of 32767 (0x7FFF) or 0x8000 (-32768) are reserved as fault indicators and are explained in Section 9.

4. SFC vs SFB vs FC vs FB: Clarifying the Misconception

STEP 7 distinguishes four function-block categories. Mixing them up is a common source of confusion.

Category Stored in Has instance DB? Typical use Used for INT→REAL?
SFC (System Function) Firmware (S7-300/400 OS) No Time, copy, diagnostics (SFC0 SET_CLK, SFC1 READ_CLK, SFC51 RDSYSST) No
SFB (System Function Block) Firmware Yes (user allocates) Communication, PID background, diagnostics (SFB0..SFB5, SFB41 CONT_C, SFB52/54) No
FC (Function) User program No Stateless routines, e.g. FC105 SCALE, FC106 UNSCALE Yes (FC105/106)
FB (Function Block) User program Yes Stateful routines, motor blocks, custom scaling Yes (user FBs)

For a pure type conversion (INT → DINT → REAL) there is no SFC/SFB; the conversion is performed by elementary bit/word instructions found in every S7 CPU's instruction set. When a scaled engineering value (for example 0.0 to 100.0 % or 4.0 to 20.0 mA) is required, the standard library TI-S7 Converting Blocks provides FC105 SCALE and FC106 UNSCALE. The library is shipped with STEP 7 V5.x and with the TIA Portal, and the source is documented in the Siemens Standard PID Control and FM 350-1/-2 Counter Module reference manuals.

5. Type Conversion Path: I_DI and DI_R

The elementary path from a 16-bit process input word (PIW) to a 32-bit floating-point value uses two instructions, executed either in STL, LAD or FBD.

  1. ITD / I_DI – convert INT (16-bit, -32768 to +32767) to DINT (32-bit, -2147483648 to +2147483647). The sign is extended into the upper word.
  2. DTR / DI_R – convert DINT (32-bit signed integer) to REAL (IEEE-754 32-bit float). The conversion is exact because the DINT range is a subset of REAL.

STL implementation, reading channel 0 of the SM 334 on slot 4:

// Read the raw 16-bit analog value
      L     PIW 256                // INT in accumulator-1

// Step 1: INT -> DINT (I_DI / ITD)
      ITD                           // Accu1 = DINT, sign-extended

// Step 2: DINT -> REAL (DI_R / DTR)
      DTR                           // Accu1 = REAL

// Store the unscaled REAL value
      T     MD     100             // RealVal_RAW at MD100 (REAL)

LAD/FBD equivalent using the converter palette:

 |---[ PIW256 ]---[I_DI]--[DI_R]--( MD100 )---|

The value stored in MD100 is now the exact numerical representation of the raw count, for example 2.345000e+003 if the count was 2345. No scaling to engineering units has been performed. This value can be displayed, logged, or used as the input to further arithmetic, but it is rarely the final engineering result.

Negative numbers. On bipolar modules the input can be negative (e.g. -27648 for -10 V). Both ITD and DTR preserve the sign, so the resulting REAL will be correct as long as the input is inside the INT range. A count of 0x7FFF (32767) is a fault flag, not a valid value, and must be filtered before scaling (see Section 9).

6. Engineering-Unit Scaling: FC105 "SCALE"

To obtain a value in engineering units (psi, °C, %, RPM, etc.) the raw count must be linearised. The TI-S7 function block FC105 SCALE applies the standard Siemens conversion formula:

OUT = [ ((FLOAT (IN) - K1) / (K2 - K1)) * (HI_LIM - LO_LIM) ] + LO_LIM

For a unipolar range (BIPOLAR = FALSE) the constants are:

  • K1 = 0
  • K2 = 27648

For a bipolar range (BIPOLAR = TRUE) the constants are:

  • K1 = -27648
  • K2 = +27648

FC105 is a pure FC (no instance DB). The call interface is:

Parameter Type Meaning
IN INT Raw value to be scaled, e.g. PIW 256 or MW10
HI_LIM REAL Engineering value at 100 % input (e.g. 100.0)
LO_LIM REAL Engineering value at 0 % input (e.g. 0.0)
BIPOLAR BOOL FALSE = unipolar (0 to 27648); TRUE = bipolar (-27648 to +27648)
RET_VAL WORD Return code: 0000 hex = OK; 8000 hex = overflow, OUT is set to HI_LIM
OUT REAL Scaled engineering result

STL call example, reading the 0 to 10 V input on channel 0 of the SM 334 and scaling to 0.0 to 100.0 %:

      CALL  FC   105
         IN       :=    PIW256            // raw count
         HI_LIM   :=    1.000000e+002     // 100.0
         LO_LIM   :=    0.000000e+000     // 0.0
         BIPOLAR  :=    FALSE
         RET_VAL  :=    MW20              // 0000 = OK, 8000 = clip
         OUT      :=    MD30              // scaled REAL (0.0 to 100.0)

A 4-20 mA input scaled to 0.0 to 250.0 °C (typical RTD transmitter output) is scaled by setting LO_LIM = 0.0, HI_LIM = 250.0, BIPOLAR = FALSE; the formula compensates internally for the 4 mA live-zero offset because K1 = 0 corresponds to 0 % of the input range (which is 4 mA on a 4-20 mA transmitter).

7. Reverse Scaling: FC106 "UNSCALE"

To drive an analog output (e.g. the two AO channels of the same 6ES7 334-0CE00-0AA0) a scaled REAL value must be converted back into the raw count that the module expects. FC106 UNSCALE applies the inverse formula:

OUT = [ ((IN - LO_LIM) / (HI_LIM - LO_LIM)) * (K2 - K1) ] + K1

With LO_LIM = 0.0, HI_LIM = 100.0, BIPOLAR = FALSE the block returns the integer count that the SM 334 expects for a 0 to 10 V output, which the program then writes to PQW 256.

      CALL  FC   106
         IN       :=    MD50              // setpoint in %
         HI_LIM   :=    1.000000e+002
         LO_LIM   :=    0.000000e+000
         BIPOLAR  :=    FALSE
         RET_VAL  :=    MW22
         OUT      :=    PQW256            // 0 to 27648 -> 0 to 10 V

8. Bipolar vs Unipolar Configuration

The BIPOLAR parameter of FC105 must match the hardware configuration of the channel in HW Config (STEP 7) or in the device configuration of TIA Portal. The SM 334 (6ES7 334-0CE00-0AA0) is unipolar only (0 to 10 V or 0 to 20 mA). For bipolar signals a different module from the SM 334 family or the SM 331/332 family must be used; in that case BIPOLAR = TRUE selects K1 = -27648 and K2 = +27648. Mixing the parameter with the hardware range is the single most common cause of a factor-of-two or sign-inverted output.

Sensor (4-20 mA) 0 to 100 °C SM 334 AI4/AO2 6ES7 334-0CE00-0AA0 PIW 256 INT 0-27648 FC105 SCALE MD30 (REAL) 0.0 to 100.0 °C Path A (direct cast): PIW (INT) → ITD (DINT) → DTR (REAL) → MD100 Path B (scaled): PIW (INT) → FC105 SCALE → MD30 (REAL engineering units)

9. Error Codes and Diagnostics

Analog modules signal abnormal conditions by returning specific diagnostic counts. These counts must be filtered before scaling, because feeding 32767 into FC105 will produce nonsense engineering values.

Count Hex Meaning Recommended handling
32767 0x7FFF Overflow / range overflow / wire break (4-20 mA live-zero) Trap in user code, set alarm bit, do not scale
-32768 0x8000 Underflow / open wire on bipolar voltage modules Trap and alarm
32512 to 32766 0x7F00 to 0x7FFE Overrange (signal >100 % but <diagnostic limit) Accept as valid; FC105 will clip at HI_LIM
0 0x0000 0 % value (0 V, 0 mA, 4 mA live-zero) Valid measurement

The fault indicator is the same for all SIMATIC analog modules in the S7-300 family, as documented in the SIMATIC S7-300 Module Data manual. A typical guard block:

      L     PIW 256                  // raw count
      L     32767                    // compare to 0x7FFF
      >I                              // ACCU2 > ACCU1?
      JCN   OK1
      S     M    10.0                 // set "Overflow / Wire Break" flag
      JU    DONE
OK1:  L     -32768
      <I
      JCN   OK2
      S     M    10.1                 // set "Underflow / Open Wire" flag
      JU    DONE
OK2:  CALL  FC   105
         IN       :=    MW10
         HI_LIM   :=    1.000000e+002
         LO_LIM   :=    0.000000e+000
         BIPOLAR  :=    FALSE
         RET_VAL  :=    MW12
         OUT      :=    MD30
DONE:  NOP   0

10. PT100 and Temperature-Scaling Special Case

When a temperature input channel is configured as a thermocouple type (PT100, PT1000, Ni1000, type J/K, etc.) in HW Config, the module no longer returns a normalised count. Instead, it returns the temperature multiplied by ten (PT100, type K, type J) or by one (PT1000 with 0.1 ° resolution on newer modules). This behaviour is documented in the chapter "Representation of the Analog Values of Resistance Thermometers and Thermocouples" of the S7-300 module data manual.

Sensor type Module returns Conversion to °C
PT100 standard Count / 10 REAL_Temp = DTR( ITD( PIW ) ) / 10.0
PT100 clim. (climatic range) Count / 10 Same
PT1000 (newer modules) Count / 10 (0.1 °C resolution) Same
Ni100 / Ni1000 Count / 10 Same
Type J / K / N thermocouple Count / 10 Same
Type T / E / R / S / B Count / 10 (0.1 °C) or /1 (1 °C) depending on module Check module manual

Do not pass a PT100 raw count to FC105 SCALE with LO_LIM = 0, HI_LIM = 100. The block will treat the count as a percentage and produce wrong temperatures. Use the explicit division path instead:

      L     PIW 256                  // e.g. 2345 (= 234.5 °C)
      ITD                            // I_DI
      DTR                            // DI_R  -> 2345.0
      L     1.000000e+001
      /R                             // divide by 10.0
      T     MD 200                   // REAL: 234.5 °C
Fault indication on PT100. 32767 on a PT100 channel means open wire or measurement out of range (e.g. below -200 °C or above +850 °C for PT100). The same guard from Section 9 applies.

11. SFC51, SFB52 and SFB54 – Reading Module Diagnostics

When the analog value is 32767, it is often useful to read the diagnostic record of the module to identify the root cause. Siemens provides three system calls for this:

Block Purpose Typical use
SFC51 RDSYSST Read partial system status list (SSL) Identify which slots report an error
SFB52 RDREC Read a data record (DS0/DS1) from a module Get the structured diagnostic data of SM 334
SFB54 RALRM Receive a complete interrupt-based alarm Process diagnostic interrupts in OB82

A diagnostic interrupt for the SM 334 will deposit information about the failing channel (e.g. "Channel 0 wire break", "Channel 2 overrange") in the diagnostic data record DS0/DS1. The S7-300/400 standard and system functions reference describes the byte layout. If a recurring OB82 is observed and the count is 32767, the diagnostic record distinguishes wire break from overrange from short circuit, allowing the HMI message to be specific.

12. Custom FC/FB with Overflow and Wire-Break Alarms

For applications that require more than the standard FC105 provides, a wrapper FB is recommended. The wrapper:

  1. Traps 32767 and -32768 before scaling.
  2. Traps overrange (counts between 27649 and 32766).
  3. Traps underrange (counts between 1 and 0; only for ranges that do not include zero, e.g. 4-20 mA).
  4. Applies FC105 to the validated range.
  5. Exposes the scaled value, the limit flags, the raw count, and a quality byte to the HMI.

The data structure for the instance DB of such an FB on a S7-300 (S7-300 supports 8-bit quality field and BOOL flags packed in byte):

DATA_BLOCK DB200 // AI scaling FB instance
STRUCT
   Quality       : BYTE;     // 0=Good, 1=Overflow, 2=Underflow, 3=WireBreak, 4=Bad
   Overflow      : BOOL;     // M100.0 alias in DB
   Underflow     : BOOL;
   WireBreak     : BOOL;
   Bad           : BOOL;
   RawCount      : INT;      // Mirror of PIW
   ScaledValue   : REAL;     // Result of FC105
   Hi_Lim        : REAL;     // Pass-through
   Lo_Lim        : REAL;
END_STRUCT
END_DATA_BLOCK

Calling the FB once per channel inside OB1 (or in OB35 for cyclic execution) consolidates the alarm logic in one place and avoids scattering limit checks across the program.

13. Step-by-Step Implementation Guide

  1. Configure the module in HW Config. Drag the SM 334 (6ES7 334-0CE00-0AA0) to its slot, set the input range (0 to 10 V or 0 to 20 mA), enable diagnostic interrupt if the CPU supports OB82, and download the hardware configuration.
  2. Open the symbol table and assign symbolic names to the PIW and PQW addresses (e.g. AI_Ch0_Raw for PIW 256).
  3. Install the TI-S7 Converting Blocks library. In STEP 7 V5.x: File → Open → Libraries → TI-S7 Converting Blocks; copy FC105 and FC106 into your S7 program container.
  4. Create the instance DB for your custom scaling FB (Section 12) or use global flags/MWs.
  5. Insert the call in OB1 (or in a cyclic OB such as OB35 for 100 ms update). Wire the input from PIW 256 and the limits from constants or operator-adjustable data blocks.
  6. Add the fault guard from Section 9 around the FC105 call.
  7. Compile and download the program to the PLC.
  8. Verify online using Monitor/Modify in STEP 7: force a known input (e.g. 5 V from a calibrator) and confirm the scaled REAL matches expectations.
  9. Document the channel in the HMI tag list with engineering unit, range, and quality mapping.

14. Verification Checklist

Step Expected Result
Apply 0 % of input range PIW = 0, MD30 = LO_LIM (0.0) OK / Not OK
Apply 50 % of input range PIW ≈ 13824, MD30 = (HI_LIM + LO_LIM)/2 OK / Not OK
Apply 100 % of input range PIW = 27648, MD30 = HI_LIM OK / Not OK
Apply 110 % of input range (overrange) PIW ≈ 30000, MD30 clipped to HI_LIM, overflow flag set OK / Not OK
Disconnect 4-20 mA wire PIW = 32767, MD30 = last valid (frozen), wire-break flag set OK / Not OK
Apply negative voltage on bipolar channel PIW < 0, MD30 < 0, sign correct OK / Not OK
Cycle power and warm up 5 minutes Drift < 0.5 % of full scale (8-bit module; expect 1 LSB quantisation) OK / Not OK

15. Troubleshooting Matrix

Symptom Likely cause Diagnostic Remedy
PIW always 32767 Wire break, open input, module fault Check wiring, LED on module, OB82 diagnostic buffer Repair cable, replace sensor, evaluate SFB52/OB82
PIW always 0 Sensor shorted, wrong channel configured, address error HW Config → Inputs tab; force address in VAT Reconfigure channel, correct PIW address
Scaled value stuck at HI_LIM FC105 RET_VAL = 8000, raw input saturated Check actual input voltage with multimeter Reduce signal, check scaling limits
Scaled value doubled / halved BIPOLAR flag set on unipolar module (or vice-versa) Compare HW Config → Channel → Range with FC105 BIPOLAR input Set BIPOLAR = FALSE for 0-10 V module
Scaled value always 0 with raw count non-zero LO_LIM = HI_LIM (division by zero in FC105) Monitor LO_LIM and HI_LIM Correct the limits
Value jumps ±108 counts (one LSB) on stable input 8-bit resolution of 6ES7 334-0CE00-0AA0 Module data sheet Acceptable; replace with 12/13/14-bit module for higher resolution
PT100 reads 10× too high Forgot to divide by 10 after DTR Module configured as RT, not as voltage Insert division by 10 (Section 10)
PT100 reads -273 °C Wrong input wiring polarity on 4-wire RTD Check sensor wiring Swap or reconnect according to module manual
PIW = -32768 (0x8000) Open wire on bipolar voltage input, common-mode out of range Hardware diagnostics Repair cable, check grounding
FC105 "Block not found" during compile FC105 not copied into the S7 program Program blocks container Copy FC105 from the TI-S7 Converting Blocks library

16. Performance, Cycle Time and Ordering Notes

The elementary ITD + DTR path consumes roughly 2 µs on a CPU 315-2 PN/DP and 1 µs on a CPU 319. FC105 consumes approximately 8 µs on a CPU 315 and 4 µs on a CPU 319, depending on firmware version (FW ≥ V2.6 recommended; see Siemens support entry 109751634 for the documented performance). For a 4-channel module processed in OB1 the additional cycle-time burden is therefore negligible (less than 50 µs even on a CPU 312 IFM).

When ordering spare parts or replacements, be aware that the 6ES7 334-0CE00-0AA0 is a discontinued product. The current equivalent with 8-bit resolution and 4 AI/2 AO is the 6ES7 334-0CE01-0AA0 (ES7 334 module data), and for higher precision the 6ES7 334-0KE00-0AB0 (12-bit) is the recommended replacement. The conversion procedures above apply unchanged to the successors; only the input wiring and the LSB step size change.

17. Frequently Asked Questions

Is there an SFC or SFB that converts INT to REAL on S7-300?

No. SFCs and SFBs are reserved for operating-system services such as time, communication and diagnostics. Numeric type conversion is performed by the elementary instructions ITD (I_DI) and DTR (DI_R) found in every S7 CPU. For engineering-unit scaling the standard FC105 SCALE and FC106 UNSCALE from the TI-S7 Converting Blocks library are used.

Why does FC105 return 8000 hex in RET_VAL and a clipped value?

A RET_VAL of 0x8000 means that the raw input was outside the range that FC105 can represent with the configured LO_LIM/HI_LIM limits. The block clips the result to the closest limit. Common causes are: wrong LO_LIM/HI_LIM values, wrong BIPOLAR flag, or a raw count of 32767 (fault) that was not filtered out before the call.

What does a count of 32767 (0x7FFF) on the SM 334 mean?

It is a fault indicator, not a measurement. On 4-20 mA inputs it usually means wire break (open loop). On voltage inputs it indicates overflow or a hardware error. Use SFC51/SFB52 or evaluate OB82 to obtain the detailed diagnostic record, and trap 32767 in user code before scaling.

Do I have to divide the PIW by 10 for PT100 inputs?

Yes, if the channel is configured as PT100 (or PT1000/Ni100/type J/K thermocouple) in HW Config. The module returns temperature × 10 (0.1 °C resolution). Convert with ITD, DTR, then /R 10.0. Do not pass a PT100 raw count through FC105 with LO_LIM/HI_LIM in °C; the block will misinterpret it as a percentage.

Can FC105 be used on a CPU 314 in TIA Portal?

FC105 and FC106 are part of the standard library that is portable to TIA Portal through the "Program blocks → Libraries → TI-S7 Converting Blocks" path, or they can be rewritten using the IEC-compliant SCL code shipped with newer library versions. The behaviour and parameters are identical to STEP 7 V5.x. For new TIA-only projects, consider the IEC function SCALE from the "Standard library → Conversion operations" palette, which provides the same linear mapping with native IEC types.

How do I detect a wire break on a 4-20 mA input reliably?

On a 4-20 mA input wired correctly, a wire break produces a PIW value of 32767 (0x7FFF). Filter this value in user code and set a dedicated flag. For additional protection enable the diagnostic interrupt in HW Config and evaluate OB82; SFB52 RDREC will return the channel number and the diagnostic event in DS0/DS1.

The scaled value oscillates ±1 LSB even with a stable input. Is my wiring wrong?

On the 6ES7 334-0CE00-0AA0 the resolution is only 8 bits, so one LSB equals about 108 nominal counts (≈ 40 mV on a 0-10 V range, ≈ 0.08 mA on 0-20 mA). The oscillation is the natural quantisation of the ADC, not a wiring problem. For smoother readings either average in software (e.g. across 16 OB35 cycles) or replace the module with a 12/13/14-bit successor.

Back to blog