Measuring S7-1200/1500 I/O Scan Time: Methods and Limits

The "PLC scan time" reported in TIA Portal's Online & Diagnostics view is the OB1 wall-clock duration - the time the CPU spends executing your program, calling system services, and updating the process image. It is not the same as the I/O scan time. The I/O scan time (also called the I/O update time, image update time, or module acquisition time) is the interval at which physical inputs and outputs are actually refreshed on the backplane or PROFINET segment. Conflating the two is the single most common cause of sluggish control loops, missed interrupts, and unexplained analog noise on Siemens S7-1200 and S7-1500 systems.

This reference explains the architecture behind the two values, three field-proven ways to isolate I/O time on a real PLC, and the published module-level limits you must respect when you size a control loop.

1. PLC Cycle Time vs I/O Scan Time: Why the Confusion Exists

An S7-1200 or S7-1500 CPU executes a repeating sequence on every OB1 pass:

1. Read inputs from the process image partition (PIP) - update phase 1
2. Execute user program in OB1
3. Write outputs to the process image partition - update phase 2
4. Run system services (PROFINET, web server, motion, diagnostics, HMI comms)
5. Wait for the next cycle trigger (OB1 can be cyclic, free-running, or event-driven depending on firmware)

The "scan time" in Online & Diagnostics > Cycle time captures the full wall-clock duration of one OB1 pass. The I/O scan time is only the slice of that pass that the CPU spends copying data between the module buffers and the process image. On a S7-1511-1 PN with eight SM 531 analog cards, that slice may be 200-400 µs out of a 1 ms total cycle. On an S7-1200 CPU 1214C with one SM 1231, the I/O slice may be 80-150 µs out of a 4 ms total cycle. The remainder of the cycle is your code and system load.

2. Architecture: Process Image, Module Buffer, and Channel

Data flows through three buffers, each with its own update rate:

Reading a tag like "Local~AI_0" in user code returns the PIP value. Reading with the direct-access syntax "Local~AI_0:P" forces a read of the module buffer at that instant, bypassing the PIP. The colon-P syntax is the key to measuring real module update rates.

3. Method 1: Isolating I/O Time with the RUNTIME Instruction in OB1

The RUNTIME instruction (added in TIA Portal V14, available in the "Extended instructions" palette) reads the CPU's 64-bit nanosecond system counter without loading the OB. Place it twice in OB1 and subtract the values to get the OB1 wall-clock duration with sub-microsecond resolution.

3.1 Prerequisites

• TIA Portal V14 or later
• S7-1200 firmware V4.2 or later, or S7-1500 firmware V1.8 or later
• An OB1 that is the only OB executing in the cycle (no OB30, OB35, etc. during the test)

3.2 Procedure

1. Open Program blocks > Main [OB1] in TIA Portal.
2. At the first network, insert RUNTIME into a LREAL tag named RT_OB1_start:

// OB1 Network 1 - Start of cycle timing
"RT_OB1_start" := RUNTIME(EN := TRUE, RET_VAL => #dummy);

3. At the last network in OB1, call RUNTIME again into RT_OB1_end:

// OB1 Network 99 - End of cycle timing
"RT_OB1_end" := RUNTIME(EN := TRUE, RET_VAL => #dummy);
"OB1_execution_us" := ("RT_OB1_end" - "RT_OB1_start") / 1000.0;

4. In a second test, place the first RUNTIME at the start of OB1 and capture the value again at the start of the next OB1 pass. The difference is the total cycle time D2.
5. Compute the I/O update contribution:

// I/O time = total cycle - OB1 execution
// (the remainder is system services + OB1 overhead)
"IO_update_us" := "Cycle_D2_us" - "OB1_execution_us";

When the only OB in the system is OB1, the difference D2 - D1 (where D1 is the OB1 execution time and D2 is the full cycle) approximates the I/O update time, system services, and any PROFINET phase. For more accurate isolation, run the test with PROFINET devices disabled, then re-enable them and compare the difference attributable to distributed I/O.

4. Method 2: Saw-Tooth Test with Cyclic Interrupt OB and Analog I/O

For analog modules, the most reliable field test is the saw-tooth method. It compares the analog output update rate against the analog input update rate using a single PLC, a single cyclic interrupt OB, and a trace capture.

4.1 Wiring

• Install one analog input module (e.g., 6ES7531-7KF00-0AB0 AI 8xU/I/RTD/TC ST on the S7-1500, or 6ES7231-4HF32-0XB0 AI 4xU/I on the S7-1200).
• Install one analog output module (e.g., 6ES7532-5ND00-0AB0 AQ 8xU/I HS on the S7-1500, or 6ES7232-4HB32-0XB0 AQ 2xU/I on the S7-1200).
• Wire channel 0 of the output directly to channel 0 of the input with a shielded twisted pair terminated at the module terminals.

4.2 Configuration

1. Configure the cyclic interrupt OB. OB30 has a minimum period of 1 ms on the S7-1500 and 1 ms on the S7-1200; OB38 allows periods down to 500 µs on the S7-1500. Set the period to the minimum the PLC can reliably call. Start with 1 ms and decrease until the OB time-overrun bit sets.
2. In the OB, increment a global counter iCount every call.
3. Scale the counter to the analog output range and write with direct access:

// Cyclic interrupt OB (OB30) - saw-tooth generator
// Using direct access :P forces immediate write to module buffer

IF "iCount" > 27648 THEN
    "iCount" := 0;
END_IF;

// Ramp the output across the full 0..27648 = 0..10V range
"AQ0_raw" := INT_TO_WORD("iCount");
"Local~AQ0:P" := "AQ0_raw";   // :P = write to module output buffer immediately
"iCount" := "iCount" + 64;     // 64 LSB per call = ~432 steps/cycle at 1 ms

// Read the input with :P to bypass the PIP and see the actual module buffer
"AI0_raw" := "Local~AI0:P";

4. Open Traces in TIA Portal and add three signals at the same sample rate as the OB: iCount, AQ0_raw, and AI0_raw. Trigger on a single trace and capture 5-10 seconds.

4.3 Interpreting the Result

The horizontal width of one AI step, measured in milliseconds at the trace, is the actual input module update interval. Compare this against the data sheet value to confirm whether the module is configured for its published minimum conversion time.

5. Method 3: Reading the Module Data Sheet for Buffer Update Rate

When you cannot modify the running program or wire a test loop, the published data sheet is your reference. Siemens provides one data sheet per module in the SiePortal / Support knowledge base. Look for the section titled "Input filter" or "Analog value formation."

These times are per-channel. If you wire 8 channels on an HF module, the total module buffer update is the sum (with overlap, this can be cut in half - see the module manual for the multiplexed vs. parallel architecture). For digital I/O modules, the buffer update is essentially instantaneous (≤ 50 µs) on the S7-1500 backplane; the limit becomes the OB1 PIP update, not the module itself.

Refer to the S7-1500 system manual ("S7-1500 Automation System / ET 200MP System Manual," entry 59191792) for the backplane architecture and to the individual module manuals for conversion and cycle times.

6. PROFINET and Distributed I/O: Where the I/O Scan Time Really Lives

For distributed I/O over PROFINET, the I/O update time is the sum of:

On a S7-1500 with PROFINET IRT (Isochronous Real-Time) configured, the published minimum update time is 250 µs, but this is the network phase only. End-to-end latency from terminal to OB1 tag is typically 500 µs to 1.5 ms. To achieve the minimum:

• Use only IRT-capable devices (ET 200SP HF, ET 200MP, SINAMICS drives in IRT mode)
• Configure the IRT topology in TIA Portal's "Topology view" with port-interconnect mode
• Assign the PIP to a synchronized isochronous OB (e.g., OB61) using the "isochronous mode" checkbox in the device properties
• Set the send clock in the PROFINET interface properties to 250 µs or 500 µs

For a non-IRT (RT) PROFINET network, expect 1 ms update time per device, plus 100-200 µs per switch hop. A single daisy-chained ET 200SP with four HF modules will deliver an I/O scan time of roughly 1.2-1.5 ms end-to-end - good enough for most PID loops, marginal for high-speed motion.

7. I/O Scan Time Requirements by Application

The right scan time is a function of the control loop bandwidth, not the CPU speed. A temperature loop on a furnace with a 30-second time constant needs 1-2 second I/O updates; a pressure loop on a hydraulic cylinder needs 10-20 ms; a web tension loop needs 1-5 ms. The following table summarizes typical published guidance.

These ranges are derived from the "Rule of Ten" in process control: the loop sample time should be at most one tenth of the dominant plant time constant. For a VFD-driven pressure loop with a 100 ms time constant, the sample time must be ≤ 10 ms - which is why a S7-1200 SM 1231 with default 50 Hz filter (20 ms) is too slow.

8. S7-1200 vs S7-1500: Platform Comparison for I/O Performance

For most PID and SCADA applications, the S7-1200 is sufficient. For motion, hydraulic, or sub-millisecond deterministic applications, the S7-1500 with IRT and isochronous OBs is the only viable choice on the Siemens PLC side.

9. Verification Checklist

After you implement any of the three measurement methods, verify the result against these acceptance criteria:

1. The measured I/O time matches the module data sheet within ±10% at the configured filter setting.
2. With OB1 disabled (force CPU to STOP, then RUN with no user code), the I/O update continues at the module's published rate. This confirms the PIP is not the bottleneck.
3. The PROFINET diagnostic buffer shows no "LifeSign" warnings or "Station failure" entries during a 10-minute test run.
4. Trace capture shows consistent saw-tooth with no missed steps, no phase jitter > 5% of the OB period, and no vertical jumps.
5. Loop tuning (Ziegler-Nichols or Lambda tuning) converges with the published loop gain at the measured I/O time. If it does not, the I/O time is the suspect parameter.

10. Troubleshooting Matrix

11. Reference Architecture and Timeline

The following state diagram summarizes the relationship between the CPU cycle, the cyclic interrupt OB, and the analog I/O buffers. It is useful when explaining the architecture to control engineers new to the Siemens platform.

The cyclic interrupt OB (OB30 in this example) executes independently of OB1. It writes to the output buffer using the :P direct-access syntax, which means the analog output is updated at the OB30 period, not the OB1 period. The PIP is the synchronization point: the user code in OB1 reads inputs that were captured at the start of OB1, not the most recent analog value. If you need the most recent value, use :P reads in your control code as well.

12. Field-Proven Caveats

• PIP is the hidden bottleneck. If your cyclic OB writes 64 channels per call but the PIP only refreshes 16 per OB1 pass, the effective I/O scan time is the OB1 period, not the OB period. Always check the PIP assignment in PLC tags > I/O addresses.
• Module diagnostic buffer lies about update time. The module's diagnostic buffer records the last time the channel value was converted, not the last time the PIP was updated. Treat the diagnostic timestamp as the module conversion time, not the user-visible scan time.
• Web server and HMI compete for cycle time. Each active HMI connection on a S7-1200 adds 1-3 ms of background load. For timing-sensitive applications, disable the web server and use only one HMI panel.
• Direct access disables the PIP. Reading "Local~AI0:P" inside a high-priority OB disables the PIP update for that channel in that OB, which is exactly what you want for low-latency reads - but it also disables diagnostics and limit-value monitoring on that channel in that OB.

13. Standards and Further References

For deterministic I/O conformance, refer to PROFINET International for the Conformance Class C specification (IRT) and IEC 61131-3 for PLC programming language definitions. For loop tuning methodology, IEC 61512 (batch control) and ISA 5.1 (instrumentation symbols) provide the framework but do not specify scan time - that decision is engineering judgment based on the loop's dominant time constant.

FAQ