Configuring Siemens S7 IEC Timer Presets from KTP HMI

Overview

This technical reference covers how to expose and edit a SIMATIC S7 timer preset (PT) from a KTP or Comfort Panel in TIA Portal, so that operators can change time values directly on the HMI without a programming station. The key constraint is the timer family: any timer that will be HMI-editable must be an IEC timer instance (SFB3/4/5 on S7-300/400, or the TP / TON / TOF / TONR FBs on S7-1200/1500). The IEC timer's preset is stored as a 32-bit signed integer in milliseconds inside the instance DB, which is the same data format a Comfort or KTP Basic tag can read and write natively. Legacy S5 timers (S_ODT, S_PULSE, S_PEXT, S_ODTS, S_OFFDT) keep the preset in S5TIME BCD and cannot be exposed cleanly to an HMI input field; the standard remediation is to convert the timer to IEC, not to bolt a scaling hack on top of S5TIME.

The procedure below is valid for TIA Portal V16 and later, all SIMATIC HMI panels in the Basic and Comfort families (KTP400 Basic, KTP700 Basic, KTP1000 Basic, KP400 Comfort, TP700 Comfort, TP1200 Comfort, and the MTP unified panels), and the S7-300, S7-400, S7-1200, and S7-1500 CPU families. A short cross-platform comparison at the end shows the equivalent wiring for Allen-Bradley Micro800 + PanelView 800, Omron CP/NJ/NX, Unitronics UniLogic, and AutomationDirect C-more for engineers who are migrating code or supporting mixed fleets.

Why S5TIME Breaks HMI Editing

S5TIME is a 16-bit word formatted as tttttttt bbbb vvvv, where the high 12 bits hold a BCD value (0–999) and the low 4 bits encode the time base. The base can be 10 ms, 100 ms, 1 s, or 10 s, and the choice is made by the PLC compiler based on the value the programmer entered. From the HMI side this creates three issues. First, the panel cannot know which base the PLC chose, so it cannot display the value in a consistent unit. Second, the panel has no native way to assemble the packed word; every write would need a custom script that picks the smallest valid base, divides the integer, BCD-encodes the result, and shifts it into place. Third, S5TIME saturates at 999 × 10 s = 9 990 s ≈ 2 h 46 min, which is too short for many process timers.

The S5TIME format is documented in the SIMATIC S7-300 Automation System Manual and in the S7-1200 Programmable Controller System Manual. The IEC alternatives (TP, TON, TOF) are documented in the same manuals under "IEC timer functions." Both reference manuals confirm that the IEC timer's PT is a 32-bit DINT in milliseconds, with a range of T#-24d20h31m23s648ms to T#24d20h31m23s647ms (DINT saturation).

IEC Timer Family and Instance Structure

SIMATIC offers two equivalent sets of IEC timers. On S7-300 and S7-400, the IEC timers are SFB3 (TP - pulse), SFB4 (TON - on-delay), and SFB5 (TOF - off-delay), located in the STEP 7 Standard Library under "Timers." SFB9 (TONR - retentive on-delay) is added in newer firmware. On S7-1200 and S7-1500, the same functions are implemented as FBs (TP, TON, TOF, TONR) in the TIA Portal instructions tree under "Timers." When you drop the timer FB into a network, TIA Portal prompts for an instance DB; the default is a single-instance DB, which is the recommended choice for HMI exposure because the tag path is short and unambiguous.

The instance DB exposes a static section with the same layout for every IEC timer, regardless of CPU family:

• IN (BOOL) — start input at offset 0.0
• PT (TIME / DINT, milliseconds) — preset time at offset 2.0
• ET (TIME / DINT, milliseconds) — elapsed time at offset 6.0
• Q (BOOL) — output at offset 10.0

Offsets are 32-bit aligned. In a TON instance DB, an example static section in the DB source view looks like:

DATA_BLOCK "TON_DB"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
NON_RETAIN
   VAR
      IN : BOOL;
      PT : TIME;
      ET : TIME;
      Q  : BOOL;
   END_VAR
END_DATA_BLOCK

If the DB is optimized (symbolic only), the offsets are managed by the compiler and the tag is referenced by its symbolic name ("TON_DB".PT). If the DB is standard (absolute addressing), the offsets above are fixed and can be addressed as DB100.DBD2 (PT) and DB100.DBD6 (ET). Either access mode works with the HMI; symbolic is preferred for TIA Portal projects V14 and later.

Prerequisites

• STEP 7 Basic or Professional, TIA Portal V16 minimum; V18 or later recommended for the latest Comfort Panel image and the unified MTP panels.
• A configured S7-300/400 (with Ethernet or MPI/Profibus), S7-1200, or S7-1500 station in the TIA project.
• A configured HMI device (KTP400 Basic, KTP700 Basic, KTP1000 Basic, KP/TP Comfort, or MTP) with an HMI connection to the CPU. The connection must be in the project, not a runtime-only connection.
• The IEC timer must be in a block that compiles without errors. Open the block, verify the instance DB is generated, and check that the PLC tag table is up to date.
• If the HMI uses WinCC Comfort or Basic V18 image, the device image and panel firmware should match. KTP Basic panels use the Basic image; Comfort panels use the Comfort image; mismatched images prevent download.

Step 1: Create or Convert the Timer to an IEC Timer

Open the OB (OB1, OB100, OB123, or a cyclic OB) where the timer is called. Delete any S5 timer block (S_ODT, S_PULSE, S_PEXT, S_ODTS, S_OFFDT) from the network. From the Instructions task card, expand "Basic Instructions > Timer operations" and drag TON (or TP / TOF / TONR as required) into the network. TIA Portal will prompt for an instance DB; accept the default single-instance option and click OK. Note the instance DB number in the project tree — for this article it is referred to as DB100 or the symbolic name "TON_DB". Expand the instance DB and confirm the IN / PT / ET / Q static variables exist and have the correct data types (BOOL, TIME, TIME, BOOL).

Step 2: Wire the Timer in Ladder or SCL

The PT input is the only signal that needs to be operator-writable; the other inputs and outputs can be wired as usual. The PT input can be a literal during commissioning (T#30s) and a PLC tag during runtime.

Ladder (TON example):

// Network 1 - Start input
A "Start_Button"
= %DB100.DBX0.0    // IN (alternative symbolic form: "TON_DB".IN)

// Network 2 - Timer call
CALL "TON_DB", %DB100
IN := "Start_Button"
PT := t#30s
Q  := "Output_Run"
ET := "Time_Elapsed"

SCL equivalent:

"TON_DB".IN := "Start_Button";
"TON_DB".PT := T#30s;
"TON_DB"(PT := "Operator_Preset_s" * 1000,  // ms = seconds * 1000
         Q  => "Output_Run",
         ET => "Time_Elapsed");

The SCL form shows the seconds-to-milliseconds conversion inline; if the HMI scaling is configured correctly, the multiplication is unnecessary and the HMI tag can be written directly to PT. The literal T#30s compiles to DINT 30 000 (ms). The instance DB static section is what holds the operator-editable value at runtime.

Step 3: Expose the Instance DB Tag to the HMI

1. Select the HMI device in the project tree.
2. Open the "HMI tags" editor.
3. Add a new tag and name it Timer_Preset_ms (or Timer_Preset_s if scaling is applied — see Step 5).
4. Set the connection to the HMI-to-CPU connection configured in the Devices & Networks editor.
5. Click the PLC tag field and browse the PLC tags; pick the instance DB symbol "TON_DB".PT from the dropdown. Do not retype the tag name manually — the dropdown ensures the data type is pulled from the instance DB and the cross-reference is updated.
6. Set the access mode to read/write (HMI tag must be read/write to allow operator entry).
7. Set the acquisition cycle to 1 s for normal use, or 500 ms for a more responsive bar display.

After the tag is created, save and compile the HMI station. TIA Portal will list the new tag in the HMI tag table with the same data type as the PLC source (DInt / TIME). If the tag table is empty after step 5, the PLC has not been compiled since the timer was added; recompile the PLC station and re-import.

Step 4: Add the Tag to the HMI Screen

1. Open the target screen on the HMI device.
2. From the toolbox, drag an I/O field onto the canvas.
3. In the Properties pane, link the field to Timer_Preset_ms (or the scaled name).
4. Set the mode to Output / Input so the operator can both read and write the value.
5. Under "Appearance > Format", select decimal, no sign, 5 digits. This covers 0–99 999 ms (≈ 0–100 s) without truncation.
6. Position the field next to a text label, e.g., "Process Timer (ms)."

For a seconds-based display, see Step 5. For a bar indicator, see Step 6.

Step 5: Apply 1:1000 Linear Scaling (Seconds ↔ Milliseconds)

As written, the I/O field shows the raw DINT in milliseconds. Most operators want to enter seconds. The TIA Portal HMI tag supports a linear scaling mode that multiplies the PLC value on its way to the panel and divides on the way back. Configure scaling in the HMI tag properties:

1. Open the HMI tags table and select Timer_Preset_ms.
2. In the Properties pane, scroll to the Scaling section.
3. Enable Linear scaling.
4. Set the PLC end value to 1 000.
5. Set the HMI end value to 1.
6. Rename the tag to Timer_Preset_s to reflect the new unit.

Result: an operator enters 30 on the panel; TIA multiplies by 1 000 on the way to the PLC, so the instance DB receives 30 000 ms. The TON block interprets this as 30 s. The same scaling works in reverse for the elapsed time (ET) tag so the operator sees the countdown in seconds.

For sub-second resolution (e.g., a 5.5 s purge timer), use the same 1:1 000 ratio but allow a decimal on the I/O field:

• I/O field format: 999.9 (one decimal place)
• Scaling: PLC end value 1 000, HMI end value 1.0
• Display range: 0.0–99.9 s with 100 ms resolution

For higher resolution (centiseconds), scale 1:100 and let the operator enter 0–9 999 (representing 0.00–99.99 s). The decimal in the format string is the only change required on the HMI side; the scaling math is identical.

Step 6: Display the Elapsed Time and Optional Progress Bar

Create a second HMI tag Timer_Elapsed_s pointing to the instance DB symbol "TON_DB".ET. Drop a second I/O field on the screen, set mode to Output only, and link to Timer_Elapsed_s. Apply the same 1:1 000 scaling so the value is shown in seconds. Format: 999 for whole seconds or 999.9 for tenths.

For a progress bar, drag a Bar object from the toolbox. In Properties, set Process value to Timer_Elapsed_s (with the same scaling). Set Maximum to the operator-entered preset, or to a fixed 60 s if the bar is sized for the longest expected run. To make the bar track the preset dynamically, the HMI bar object can take its maximum from a separate tag; bind that tag to a non-volatile copy of the preset stored in a data block that the PLC copies from PT on every scan.

Step 7: Download, Verify, and Document

1. Compile the PLC station. The cross-reference should show "TON_DB".PT as a write target from the HMI tag.
2. Compile the HMI image. The compilation report must show "0 errors, 0 warnings."
3. Download the PLC program and the HMI image to the live stations (or simulate with PLCSIM and WinCC Runtime Advanced).
4. On the panel, enter 5 in the I/O field. From TIA, open "Online > Tags" and read the instance DB; the PT value should be 5 000.
5. Trigger the start input and verify the elapsed time counts up (TON) or down (TOF).
6. Change the preset while the timer is running. TON and TOF accept the new PT on the next scan; TP completes its current pulse regardless of mid-flight changes.
7. Power-cycle the CPU and verify the preset survives — only if the instance DB is marked retentive. See the Edge Cases table.
8. Document the operator procedure on the HMI help screen: range limits, units, and acknowledge step if a confirmation button is used.

Edge Cases and Troubleshooting Matrix

Multi-Instance vs Single-Instance DBs

When the same timer type is called multiple times in the same FB, TIA Portal can use a multi-instance structure, where the timer data lives inside the parent FB's instance DB at an offset. Multi-instances are memory-efficient but harder to expose to the HMI, because the tag path becomes "Parent_FB"."TON_Instance".PT and the path can change if the FB is edited. For HMI-editable timers, prefer a single-instance DB per timer. If a multi-instance is required, expose the PT as an IN_OUT parameter on the parent FB, and bind the HMI tag to the IN_OUT symbol; this decouples the HMI path from the internal layout.

Scaling Math: Worked Examples

For a process timer with a fixed 60 s range, scale 1:1 000 and clamp the HMI input to 0–60 (so 0–60 000 ms). This is the cleanest operator experience and the safest default.

Retentive Behavior and Power-Up Recovery

By default, the instance DB of a TON / TOF / TP timer is non-retentive. The operator's last preset is lost on power cycle. Two options exist for recovery:

1. Mark PT as retentive in the instance DB properties. The value is written to the CPU's retentive memory area and restored at startup. The downside is that the preset occupies a slot in the CPU's retentive budget (relevant on S7-1200 CPUs with limited retain memory).
2. Store the preset in a separate retentive DB on every operator change. Use a rising-edge detect on the HMI write to copy PT to a retentive "Last_Preset" tag. On startup, the OB100 copies "Last_Preset" back to PT.

Option 2 is preferred when the instance DB is shared with non-retentive state or when the project enforces a strict retentive-memory budget. Option 1 is preferred for simple single-timer applications.

Migration Path from S5 to IEC Timers

For legacy STEP 7 projects migrating to TIA Portal, the S5 timers (S_ODT, S_PULSE, S_PEXT, S_ODTS, S_OFFDT) can be replaced with the IEC equivalents without changing the surrounding logic. The mapping is:

• S_PULSE → TP (SFB3 / TP FB)
• S_ODT → TON (SFB4 / TON FB)
• S_ODTS → TON with IN inverted (hold start signal low to run)
• S_OFFDT → TOF (SFB5 / TOF FB)
• S_PEXT → TP with extended start edge (rare; usually a TON with custom edge handling)

The S5 timer's TV (current time, MW-compatible) maps to ET in the IEC timer, and the S5 timer's BI (BCD current time) has no direct equivalent — it was rarely used in modern code. The S5 timer's S (preset, S5TIME) maps to PT in the IEC timer. After migration, expose the new PT to the HMI as described in Steps 3–5.

Cross-Platform Notes

The Siemens IEC-timer-from-HMI pattern is conceptually identical across PLC platforms: the timer must be a function block whose preset is a writable memory location, and the HMI must have a tag bound to that location.

• Allen-Bradley Micro800 + PanelView 800: The TON instruction in Connected Components Workbench stores the preset in a separate variable referenced by the .PRE field, not in a tag named after the timer. To make the preset HMI-editable, use a separate data variable (e.g., Timer1_PRE) and pass it to the .PRE field. Map that variable to the PanelView tag. The Micro800 and PanelView 800 integration guide covers the Modbus mapping in the controller configuration.
• Omron CP1H, CP1L, NJ, NX: In CX-Programmer or Sysmac Studio, the timer's SV (set value) is bound to a data word (D register) by the programmer. Bind the NB, NS, or NB7 HMI tag to that D register. The CJ/CP/NJ/NX series supports direct symbolic binding from Sysmac Studio and the NB-series panels.
• Unitronics UniLogic + Vision / Samba: The UniLogic environment has a dedicated HMI element for timers that displays both ET and PT and accepts a new preset via the panel keypad. The PLC code does not need a separate instance DB; the HMI element is wired to a tag of type "timer."
• AutomationDirect C-more + Productivity / Click / DirectLOGIC: The timer preset in the PLC is a memory location (e.g., V-memory for ProductivitySeries, DS for DirectLOGIC). The C-more tag is bound to that memory location. The PLC reads the new value on the next scan; no scaling required because the preset is already in the PLC's native time format.

Operator Limits and Safety

Always clamp the operator input to a process-sane range. For a 30 s dosing timer, allow 1–300 s; for a 10 s alarm timer, allow 1–60 s. Use the HMI tag's "Limits" tab to enforce min/max on the panel, or add a clamp in the PLC to defend against a malicious or mistaken tag write. The IEC timer itself does not validate the new PT — any DINT value within the data-type range is accepted, including negative values and zero.

Performance and Cycle Time

Each IEC timer call adds 50–200 bytes of instance memory and roughly 5–15 µs of execution time on a modern S7-1500 CPU (more on S7-300/400). The HMI read of PT is on the configured acquisition cycle, not every PLC scan; 1 s is the usual setting and adds negligible load to the HMI connection. Avoid setting the HMI acquisition cycle to 100 ms or faster for tags that drive IEC timers — the resulting write contention can produce visible jitter in the elapsed-time display.

FAQ