Configuring WinCC S5TIME Tag for S7 On-Delay Timer TV Input

The S5TIME data type occupies a single 16-bit word in the S7 data block, but WinCC 6.2's Simatic Timer tag requires a 32-bit double word container. When an engineer attempts to map DB100.DBW20 (S5TIME) directly to a single-word WinCC tag, the values written to the PLC become unproportional because WinCC does not perform the BCD-to-binary conversion automatically on a 16-bit tag. The fix is to create a DWORD tag, map it to the timer word plus the following word, and apply the DwordToSimaticBCDTimer adapt format. This article documents the exact format, the encoding rules, the configuration steps, and the verification procedure.

Problem Statement

An integrator wants to change the preset time (TV input) of an S7 on-delay timer from a WinCC 6.2 I/O field. The timer cell is declared in a STEP 7 symbol table as:

When the user creates a WinCC tag of type Word pointing at DB100.DBW20 and enters a numeric value in the I/O field, the value that lands in the PLC is not proportional to the requested time. For example, entering 5000 in the I/O field results in an S5TIME encoding that decodes to an unexpected duration (e.g., 50 seconds instead of 5 seconds, or a completely off-scale value). The timer either never expires, expires instantly, or generates a PLC diagnostic entry.

Root Cause Analysis

The S5TIME data type in SIMATIC S7 is a 16-bit field, but the value is stored in Binary-Coded Decimal (BCD) with a 4-bit time-base field. The PLC's timer instructions (SP, SE, SD, SS, SF, SP) interpret the word as time base plus BCD mantissa, not as a binary integer. When WinCC writes a 16-bit binary integer to DB100.DBW20, the PLC's timer interpreter sees a non-decimal mantissa and produces nonsense timings.

WinCC's Simatic Timer tag is designed to work with a 32-bit container so that the full conversion from milliseconds (a binary unsigned 32-bit integer) to the BCD-encoded 16-bit S5TIME word can be performed automatically. The conversion logic lives in WinCC's "Adapt format" facility. With a 16-bit tag, the adapt-format conversion is unavailable because the input range overflows the container immediately on the first 10-second boundary.

Three contributing factors:

1. Container width: S5TIME is logically 16 bits, but the WinCC adapt-format converter requires 32 bits to hold the millisecond value across the full S5TIME range (10 ms to 9 990 s).
2. Encoding mismatch: WinCC presents the value as a binary unsigned integer in milliseconds; the PLC expects BCD mantissa + time base in the upper 4 bits.
3. Adjacent-word collision: The DWORD container that WinCC needs to use for the conversion will read/write two consecutive 16-bit words in the DB. The integrator must ensure the adjacent word is unused or is part of the same logical timer variable.

S5TIME Data Format Specification

The S5TIME word is laid out as follows (per the STEP 7 programming reference and the S7-1200/1500 system manual family, which preserves the S5TIME layout for compatibility):

The full-scale encoded value of W#16#3999 means: time base 2#11 (10 s), BCD mantissa 999, decoded as 9 990 seconds (2 h 46 min 30 s). The minimum is W#16#0001 = 10 ms with BCD mantissa 1, decoded as 10 ms. The value W#16#0000 means "no time set" and the timer does not start.

For I/O field display purposes, WinCC must convert between the internal 16-bit BCD word and a 32-bit unsigned millisecond count. The forward direction (WinCC writes ms → PLC stores BCD) and reverse direction (PLC stores BCD → WinCC shows ms) both require a 32-bit scratch register to hold the intermediate value during the conversion.

Solution: WinCC Tag Configuration with DwordToSimaticBCDTimer

The supported workflow is to declare the WinCC tag as a DWORD (32-bit unsigned), address the same DBW plus the next DBW, and select the Adapt format converter DwordToSimaticBCDTimer in the tag properties. WinCC then performs the S5TIME BCD encode/decode automatically, and the I/O field shows and accepts a value in milliseconds.

Constraint: Adjacent Word Reservation

Because the WinCC tag reads/writes two consecutive words, the user must reserve the word immediately following the S5TIME cell. In the example above, DB100.DBW20 is the S5TIME cell; therefore the WinCC tag must be addressed at DB100.DBD20 (DWORD, bytes 20-23). DB100.DBW22 must not be used by any other variable, or that variable will be corrupted on every write from WinCC.

If DB100.DBW22 is already in use, the integrator has two options:

1. Re-pack the DB so that the S5TIME cell is the start of a DWORD-aligned variable (the simplest fix).
2. Use a separate "shadow" DBW in unused space, perform the conversion in the PLC using STEP 7, and expose a DWORD of milliseconds to WinCC. This is the only way to avoid the adjacent-word collision without repacking the DB.

Step-by-Step Tag Configuration in WinCC 6.2

1. Open the WinCC Explorer and select Tag Management → right-click the desired channel/unit (e.g., S7 Protocol Suite → MPI or TCP/IP) → New Tag.
2. In the Tag Properties dialog, set:
   • Name: TMR_PRESET_ms (descriptive; the suffix _ms reminds the engineer that the value is in milliseconds)
   • Data type: Unsigned 32-bit value (DWORD)
   • Address: DB 100, DBD 20 (DWORD at byte offset 20)
3. Click Select... next to Adapt format and pick DwordToSimaticBCDTimer from the dropdown. Confirm the dialog.
4. Click OK to save the tag.
5. In the Graphics Designer, drop an I/O field on the screen. Bind its Output/Input property to the new tag TMR_PRESET_ms.
6. Configure the I/O field as Output/Input with the data format Decimal. Set the field width to at least 6 digits (so 9990000 ms = 9 990 000 — note: the encoded S5TIME caps at 9 990 000 ms; values above this will saturate).
7. Compile and activate the WinCC runtime.

Verify the Tag Connection

Open WinCC Tag Simulation or use the Online view in Tag Management. The tag value should now show the timer preset in milliseconds when the PLC has loaded a value, and writes from the I/O field should update the PLC's TV input correctly.

S5TIME Value Encoding Rules

When the operator types a millisecond value into the I/O field, WinCC encodes it into the 16-bit S5TIME word. The encoder selects the largest valid time base that can hold the value, then quantises the mantissa to the resolution of that time base. The rules below are enforced by the adapt-format converter:

Values below 10 ms are not representable and will be coerced to 10 ms. Values above 9 990 000 ms (2 h 46 min 30 s) will saturate at the maximum. A value of exactly zero disables the timer preset; do not use zero as a "stop" command because the timer instruction interprets it as "no time loaded" and the block will not start.

Example Encodings

Verifying the Timer Behaviour in STEP 7 / TIA Portal

After configuring the WinCC tag and writing a value from the runtime, perform the following cross-checks:

1. Open the online view in STEP 7 (or TIA Portal with the corresponding S7-300/400 project) on the timer DB and read DB100.DBW20. The word should match one of the hex patterns from the encoding table.
2. Open a VAT or watch table and force the timer coil (e.g., A "Timer_Start" with an L S5T#5s load to set the TV if the timer is being preset indirectly). Confirm that the elapsed time matches the value typed in the WinCC I/O field within the quantisation tolerance of the chosen time base.
3. Use the WinCC Online Trend control to plot the timer cell (BI/BCD output) versus the elapsed time. The output bit should transition after the requested duration, ±1 quantisation step.
4. Test boundary values: 10 ms, 9 990 ms, 10 000 ms, 99 900 ms, 100 000 ms, 999 000 ms, 1 000 000 ms, and 9 990 000 ms. Each should produce the expected hex word and the expected delay.

Troubleshooting Matrix

Alternative: S7-1200/1500 IEC Timers and TIA Portal

On the S7-1200 and S7-1500 families, the legacy S5TIME-based timer instructions (SP, SE, SD, SS, SF) are retained for compatibility, but the recommended practice is to use the IEC timer instructions TP (pulse), TON (on-delay), TOF (off-delay), TONR (retentive on-delay), and TOF variants from the Basic Instructions panel. Each IEC timer uses its own dedicated instance DB (or multi-instance DB) with a structured data block of type IEC_TIMER / IEC_LTIMER / TIME fields. The preset (PT input) is a TIME data type (32-bit signed milliseconds, DINT) rather than S5TIME (16-bit BCD).

The S7-1200 manual collection — Timer operation (IEC timers) documents that each timer uses its own timer structure in DB memory and the continuously-running internal CPU timer to perform timing. The PT input is a TIME/DINT field and can be driven directly from a WinCC tag without any adapt-format conversion — simply create a WinCC tag of type Signed 32-bit value mapped to the PT field of the IEC timer instance DB.

For mixed installations (an existing S7-300/400 program with S5TIME timers feeding a WinCC runtime, plus a new S7-1500 program with IEC timers), the conversion workflow differs:

If you are migrating a STEP 7 V5.x program to TIA Portal, convert legacy S5TIME-based timer blocks to IEC timer blocks where the rest of the program permits it; the migration removes the BCD encode/decode burden from WinCC and replaces it with a plain DINT read/write.

Field-Proven Caveats

1. Tag-qualifier visibility: In WinCC 6.2, the adapt-format dropdown is greyed out for tags whose data type is not DWORD. If you cannot see the DwordToSimaticBCDTimer option, the tag's data type is wrong — fix the data type first.
2. Operator input format: The I/O field will accept negative numbers even though they are invalid. Add a limit validation (Lower limit = 10, Upper limit = 9 990 000) to the I/O field properties to prevent out-of-range writes.
3. Step 7 symbol-table mismatch: If the symbol in the symbol table is declared as WORD rather than S5TIME, STEP 7 will allow a binary write to the word, which then breaks the timer. Always declare S5TIME cells as S5TIME in the symbol table or in the DB declaration.
4. WinCC version drift: The DwordToSimaticBCDTimer adapt format is available in WinCC 6.0 SP3 and later, including all WinCC 6.2 builds and the WinCC 7.0/7.x lines. Earlier WinCC 6.0 versions require the legacy "SimaticBCDTimer" path with manual conversion in the PLC.
5. Round-up behaviour vs. round-down: The quantisation rules above use round up, not round-to-nearest. This means an operator typing 12 500 ms gets the same effective delay as typing 12 600 ms (rounded up to 12 500 ms = 125 × 100 ms = 12 500 ms, and 12 600 ms is rounded up to 12 600 ms / 100 = 126 × 100 ms = 12 600 ms; values in between are coalesced to the next 100 ms step). Document this in the operator HMI tooltip to avoid confusion.
6. Two's-complement trap on DBD 20: If the adjacent word (DBW22) is signed and carries a negative value, the upper 16 bits of the DWORD are sign-extended. The adapt-format converter still works correctly because it operates on the lower 16 bits of the DWORD (which contain the S5TIME BCD word) and ignores the upper 16 bits. However, the upper 16 bits must be zero (or the S5TIME word will be corrupted on writes). Validate by reading the full DBD20 online before commissioning.

Commissioning Checklist

1. Confirm the timer cell is declared as S5TIME in the STEP 7 symbol table / DB declaration.
2. Reserve the adjacent 16-bit word (the one immediately after the S5TIME cell) as scratch space; do not use it for any other variable.
3. Create the WinCC tag as a 32-bit unsigned DWORD addressed to DBD <n> where <n> is the byte offset of the S5TIME cell.
4. Apply the DwordToSimaticBCDTimer adapt format in the tag properties.
5. Bind the I/O field to the new tag, set the data format to Decimal, and apply limit validation (10–9 990 000).
6. Test boundary values and quantisation behaviour from the runtime.
7. Document the field as "value in milliseconds" in the I/O field tooltip and the screen text.