Displaying Siemens S7 TIME Format on HMI and SCADA Systems

David Krause12 min read
HMI / SCADASiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview: The S7 TIME Display Problem

The Siemens S7 TIME data type (IEC 61131-3 standard) is stored as a 32-bit signed integer (DINT) with the unit milliseconds. A tag declared as TIME in STEP 7 or TIA Portal occupies 4 bytes and ranges from T#-24d20h31m23s648ms (-2,147,483,648 ms) to T#+24d20h31m23s647ms (+2,147,483,647 ms). Although the PLC editor renders the value naturally as T#12s456ms, most HMI panels and SCADA drivers transport the raw DINT and the visualization layer receives an opaque 32-bit integer. Displaying 123456 as 00:02:03.456 or 2 m 3 s 456 ms therefore requires explicit conversion logic on the PLC, the HMI tag side, or both.

This reference covers the engineering-grade methods used to present S7 TIME values on Siemens Comfort/MTP panels, WinCC Runtime, and third-party SCADA packages such as InduSoft/Web Studio, Ignition, FactoryTalk View, and WinCC OA. Three conversion strategies are detailed: (1) direct DINT-to-string formatting in the HMI, (2) conversion of TIME to legacy S5TIME using the IEC library block and presenting it via the driver, and (3) PLC-side conversion to a packed display structure.

TIA Portal and STEP 7 TIME Format Specification

The IEC 61131-3 TIME type used in S7-300/400/1200/1500 controllers follows this binary layout:

Attribute Value
Width 32 bits (DWORD/DINT)
Unit Milliseconds
Signed Yes (two's complement)
Min -2,147,483,648 ms (approx. -24 d 20 h)
Max +2,147,483,647 ms (approx. +24 d 20 h)
Bit pattern example 12 s 456 ms = 0x00003038 = 12,456 decimal

Three related legacy formats coexist in Siemens projects:

Format Width Encoding Used by
TIME (IEC) 32 bit Signed ms integer S7-1200/1500, all IEC timers (TP, TON, TOF)
S5TIME 16 bit BCD value + 2-bit time base S7-300/400 legacy timers (S_PULSE, S_PEXT, S_ODT…)
TIME_OF_DAY (TOD) 32 bit Unsigned ms since 00:00 Real-time clock tags
DATE_AND_TIME (DT) 64 bit BCD year/month/day/hour/min/s.ms Legacy date/time stamps

The S5TIME layout (relevant to the FC40 conversion discussed below) is composed as: bits 15–12 carry the time base (00 = 10 ms, 01 = 100 ms, 10 = 1 s, 11 = 10 s), while bits 11–0 store the BCD value in the selected base. Drivers that surface S5TIME therefore need to decode both nibbles plus the base flag to reconstruct a millisecond figure.

Why Direct Display Fails on Most HMIs

When a TIME tag is added to an HMI connection, the driver typically exposes it as a signed 32-bit value without any unit information. Several platforms apply their own default scaling that further obscures the meaning:

  • WinCC Comfort/Advanced: shows raw decimal milliseconds in the tag list unless a custom conversion is bound to the IO field.
  • WinCC Professional / Runtime Advanced: exposes the value but the formatting field only accepts numeric patterns such as 999,999 or 9.999e+3—no T# macro is provided.
  • Third-party OPC servers (KEPServerEX, OPC Router, Softing): deliver the value as VT_I4 / signed 32-bit and rely on the SCADA to format.
  • InduSoft Web Studio / IWS: when the driver class is set to S5TIMER the panel decodes the legacy format natively; when it is set to a generic 32-bit integer the SCADA shows raw ms.

Consequently, any of three engineering routes must be taken: build the conversion in the PLC, format inside the HMI/SCADA, or use a vendor library.

Method 1 - PLC-Side Conversion Using FC40 / TIM_S5TI

The legacy STEP 7 standard library provides conversion blocks between TIME and S5TIME. FC40 in some STEP 7 / TIA Portal distributions (function name TIM_S5TI) converts an IEC TIME value (DINT in ms) into the legacy BCD S5TIME image. The reverse direction is handled by FC33 (TIM_S5I). Because the S5TIME binary is only 16 bits wide, the conversion truncates milliseconds below the selected time base and limits the maximum to 9990 s when the 10 s base is selected. Use this method only when the SCADA driver is configured to interpret S5TIME natively (as documented for InduSoft's S7 MPI/TCP driver).

Call interface (SCL / Structured Text):

// S7-300/400 with STEP 7 V5.x
// DB block for the conversion
DATA_BLOCK "dbTimeConv"
  STRUCT
   tIEC  : TIME;        // Input, e.g. from TP/ton IEC timer
   s5Img : WORD;        // Output S5TIME image (BCD)
  END_STRUCT
END_DATA_BLOCK

FUNCTION "FC_TimToS5" : VOID
VAR_INPUT
  iTimeMS : TIME;
END_VAR
VAR_OUTPUT
  qS5Time : WORD;
END_VAR
BEGIN
  // Call library block
  "TIM_S5TI"(  // library number FC40 in some installations
      IN  := iTimeMS,
      RET := qS5Time);
END_FUNCTION

Ladder equivalent (STEP 7 classic):

  1. Open the LAD/FBD editor and insert a CALL box referencing FC40 from the Standard Library > IEC Function Blocks > Timers.
  2. Assign IN = DB_TIME.tIEC (TIME tag).
  3. Assign RET = DB_TIME.s5Img (WORD tag).
  4. Compile and download.

On the HMI side configure the driver to interpret the WORD as an S5TIMER. In InduSoft Web Studio the steps are: Project > Database > Tags > add tag of class S5TIMER, point to the matching DB offset, restart driver. The panel will then render the value as a string similar to 1h12m10s123ms, automatically selecting the optimal unit.

Limitation: S5TIME truncates milliseconds. If the application requires millisecond precision at the operator panel, prefer Method 2 or Method 3.

Method 2 - DINT Scaling and String Formatting on the HMI

The cleanest cross-platform approach is to keep the PLC tag as TIME and to convert the integer milliseconds into a formatted string on the HMI/SCADA. This avoids data loss and works identically on WinCC, FactoryTalk, Ignition, IWS, and WinCC OA. A reusable conversion routine computes hours, minutes, seconds, and milliseconds and writes them into a 14-character display field of the form HHHH:MM:SS.mmm.

PLC Pre-Computation (SCL, TIA Portal)

FUNCTION_BLOCK "fbTimeToAscii"
VAR_INPUT
  iTime : TIME;
END_VAR
VAR_OUTPUT
  sDisplay : STRING[14];   // e.g. '0023:59:59.999'
END_VAR
VAR
  absMs : DINT;
  h, m, s, ms : DINT;
END_VAR
BEGIN
  absMs := ABS(DWORD_TO_DINT(iTime));
  h  := absMs DIV 3600000;
  m  := (absMs MOD 3600000) DIV 60000;
  s  := (absMs MOD 60000) DIV 1000;
  ms := absMs MOD 1000;
  sDisplay := '';
  // Use IEC string functions or manual concatenation
  sDisplay := CONCAT(IN1 := sDisplay, IN2 := DWORD_TO_STRING_HELP(h,4));
  sDisplay := CONCAT(IN1 := sDisplay, IN2 := ':');
  sDisplay := CONCAT(IN1 := sDisplay, IN2 := DWORD_TO_STRING_HELP(m,2));
  sDisplay := CONCAT(IN1 := sDisplay, IN2 := ':');
  sDisplay := CONCAT(IN1 := sDisplay, IN2 := DWORD_TO_STRING_HELP(s,2));
  sDisplay := CONCAT(IN1 := sDisplay, IN2 := '.');
  sDisplay := CONCAT(IN1 := sDisplay, IN2 := DWORD_TO_STRING_HELP(ms,3));
END_FUNCTION_BLOCK

Expose sDisplay as a STRING[14] tag and bind it to a text field on the HMI. The leading zeros preserve column alignment, which is valuable when the panel shows multiple timers side by side.

WinCC Comfort / Unified Formatting

WinCC does not natively decode TIME, but it allows multi-line scripts in the IO field that re-format the raw integer every cycle:

// VBScript in WinCC Comfort, attached to the Output / OutputValue property
Dim ms, h, m, s
ms = CLng(SmartTags("RawTimeMs"))
If ms < 0 Then ms = -ms
h = ms \ 3600000
m = (ms Mod 3600000) \ 60000
s = (ms Mod 60000) \ 1000
ms = ms Mod 1000
SmartTags("DisplayText") = _
   Right("0000" & h, 4) & ":" & _
   Right("00" & m, 2) & ":" & _
   Right("00" & s, 2) & "." & _
   Right("000" & ms, 3)

For WinCC Unified, replace VBScript with a JavaScript expression on the dynamic property of the text view.

InduSoft Web Studio / IWS Driver Setting

IWS exposes the S7 driver under Main Driver Sheet > S7 MPI/TCP. Tags whose declaration in STEP 7 is TIME must be classified as S7 32-bit Signed in the IWS database. Then create a derived display tag with the conversion formula:

// IWS expression on a String tag
DisplayTime = STR(FIX(Tag1 / 3600000) MOD 10000, 4) + ":" +
              STR(FIX(Tag1 / 60000) MOD 60, 2) + ":" +
              STR(FIX(Tag1 / 1000) MOD 60, 2) + "." +
              STR(Tag1 MOD 1000, 3)

Bind the display tag to a Text object on the screen. IWS evaluates the formula on every screen refresh (default 250 ms), so the field always reflects the current timer.

Method 3 - Display via Standard Siemens HMI Library

For pure Siemens panel projects the fastest path is the Siemens WinCC Toolbox library shipped with TIA Portal. The blocks TimeToString and DintToTime live under Libraries > Siemens HMI > Utilities > Time. Drop the block on the screen, connect the PLC tag, and the IO field renders 12s 456ms automatically with the IEC notation preserved. The same library provides dynamic limits, color animation based on remaining time, and a built-in bar-graph gauge.

Configuration steps in TIA Portal V18 or later:

  1. Open the HMI device view and drag HMI Time Functions > Time to String onto the screen.
  2. Wire Tag to the PLC TIME variable.
  3. Select Format: HH:mm:ss.fff or D:HH:mm:ss.fff.
  4. Optionally enable Auto Reset to zero the timer once it reaches the target.

Method 4 - Script-Based Formatting for Third-Party SCADA

Ignition by Inductive Automation, FactoryTalk View, and WinCC OA all expose scripting languages that can format a TIME tag locally. The logic is identical to Method 2 but executed in the SCADA. The following Ignition expression binds a numeric TIME tag to a label:

// Ignition expression function bound to a Label component
def formatTime(ms):
    if ms is None: return "00:00:00.000"
    ms = abs(int(ms))
    h = ms // 3600000
    m = (ms % 3600000) // 60000
    s = (ms % 60000) // 1000
    millis = ms % 1000
    return "{:04d}:{:02d}:{:02d}.{:03d}".format(h,m,s,millis)

# Use as: formatTime({[~]Path/ToTimer})

FactoryTalk View SE uses the = calculation command inside a numeric display with a String display element. The same algorithm applies.

Edge Cases and Engineering Considerations

Scenario Risk Mitigation
Negative TIME value Modulo operation on negative numbers returns negative in Python/Ignoition; the ABS call protects the algorithm. Wrap the input with ABS() or carry a sign flag separately.
Overflow when rolling counter An unbounded IEC timer that resets via subtraction may briefly cross the 24-day limit. Detect values > 2,147,000,000 ms and clamp the display.
Resolution loss via S5TIME FC40 output uses a 10/100 ms / 1 s / 10 s base; sub-base values are truncated. Round the input value before conversion or switch to Method 2.
Time-of-day vs duration confusion TOD (TIME_OF_DAY) is unsigned; the conversion described here will wrap at 24 h. Use a dedicated formatter that treats the tag as TOD.
Locale and decimal separator European panels expect , instead of . Replace . with the regional decimal separator at display time.
Connection loss during update String tags initialized empty can flicker to empty on reconnect. Default the STRING tag to '00:00:00.000' in the PLC initial values.

Verification Procedure

  1. Online watch in STEP 7 / TIA Portal: Force the timer tag to a known value (e.g. T#1h2m3s456ms = 3,723,456 ms). Verify the HMI display reads 01:02:03.456.
  2. Cyclic test: Let a real IEC timer (TP, TON) run. Confirm the display increments smoothly without jitter and resets to zero when the timer elapses.
  3. Boundary test: Set the value to T#23h59m59s999ms and confirm the field shows 23:59:59.999. Set to T#-1s and confirm the ABS-protected formatter still produces a sensible string.
  4. Driver log: In IWS enable driver trace; verify the tag is read with the expected data length (4 bytes) and class (S7 32-bit Signed for TIME).
  5. Cross-reference with WinCC tag diagnostics: Open WinCC Runtime > Tag Management > Diagnostics and confirm the underlying integer matches the PLC value.

Troubleshooting Matrix

Symptom Likely Cause Corrective Action
Display shows raw integer (e.g. 123456) HMI field bound directly to TIME without formatting Apply Method 2 or 3
Display shows 00:00:00.000 despite active timer Driver reports unsigned value; negative ms from a TOF Wrap with ABS in script or check tag class is signed
Display shows 1h12m10s but no milliseconds S5TIME conversion chosen, base rounds to 1 s Switch to DINT-formatting method
Display flickers / shows ######## STRING tag length too short Increase to STRING[14] or STRING[16]
FC40 / TIM_S5TI not found in library Library version mismatch; TIA Portal V16+ uses different naming Use the IEC block from Libraries > Standard > IEC Timer Operations
Ignition label shows None Tag is uninitialized; PLC offline Add if ms is None guard or seed PLC initial value
Hour field displays negative number on overflow Counter wrapped past 24 days Add overflow guard or reset timer before max
Panel shows value but decimal separator wrong Locale-specific separator Substitute . with , in the formatter

Related Siemens Blocks and Catalog Numbers

Block / Function Use Library
IEC TP / TON / TOF / TONR Generate TIME values Standard > IEC Timers
FC33 TIM_S5I S5TIME → TIME (ms) STEP 7 Standard Library > IEC Function Blocks
FC40 TIM_S5TI (varies by version) TIME → S5TIME STEP 7 Standard Library > IEC Function Blocks
Time_Tick_10ms / Time_Tick_100ms Generate time tick base Standard > IEC Timers
WinCC Comfort Toolbox > Time functions HMI-side display formatting Siemens HMI Toolbox
S7-1500 catalog 6ES7 516-3xxxxx CPU used for examples Siemens Industry Mall
TP900 Comfort 6AV2 124-1JC01-0AX0 Reference HMI panel Siemens Industry Mall

The exact block numbers (FC33, FC40) are reserved by the STEP 7 V5.x standard library. TIA Portal V16 and later no longer expose FC40 with that name—instead the IEC block is added as a multi-instance capable FB and named automatically. Always verify the block is present in the current library snapshot of your TIA Portal installation before deploying.

Summary of Recommended Path

For modern TIA Portal projects with S7-1200/1500 controllers, Method 2 (PLC pre-compute + STRING tag) is the most robust. It preserves millisecond resolution, is independent of the SCADA vendor, and survives PLC firmware updates. Method 1 (FC40 + S5TIME) remains useful only when the HMI driver natively decodes S5TIME and the millisecond truncation is acceptable. Method 3 is the fastest if the project is restricted to Siemens WinCC panels. Whichever method is chosen, include the verification checklist in the SAT (Site Acceptance Test) and document the conversion in the PLC code comment header so future maintainers can recognise the display mapping at a glance.

FAQ

What is the internal representation of a Siemens S7 TIME value?

S7 TIME is a 32-bit signed integer (DINT) where each increment represents one millisecond. The value 12,456 therefore represents exactly T#12s456ms. The valid range is -2,147,483,648 ms to +2,147,483,647 ms.

Does WinCC automatically format a TIME tag as T#12s456ms?

No. WinCC Comfort/Advanced/Professional exposes the raw millisecond integer. To render it as T#12s456ms or HH:MM:SS.mmm you must bind it to a script or use the Siemens HMI Toolbox time functions, then assign the resulting STRING to the text field.

Which FC converts TIME to S5TIME in STEP 7?

FC40 (function name TIM_S5TI) is the legacy converter. It produces a 16-bit S5TIME image that some SCADA drivers (for example the InduSoft S7 driver configured as S5TIMER) can decode natively. Be aware that the conversion truncates sub-base milliseconds and is limited to 9990 s maximum.

How do I display milliseconds on an InduSoft panel when the driver is set to S7 32-bit Signed?

Create a derived STRING tag whose expression divides the raw value by 3600000, 60000, and 1000 to compute hours, minutes, seconds, and milliseconds, then concatenates them with separators. Bind the string to a Text object on the screen.

Why does my negative timer (TOF) display as 00:00:00.000 on the HMI?

TOD and TIME are signed. If the script or driver interprets the value as unsigned, negative numbers wrap to large positive values and the formatter produces zero. Wrap the input with ABS() or carry a separate sign tag.

Back to blog