Resolving S5TIME Timer Value Mismatch in S7-300/400 STEP 7

When migrating or extending a STEP 7 (S7-300/S7-400) program, one of the most common timer-related defects is the apparent corruption of an S5TIME variable after a MOVE block. The display in the online monitor shows a duration that does not match the active timer's preset, often shifted by orders of magnitude. This article isolates the defect, explains the bit-level format of S5TIME, and provides three field-proven solutions plus a verification procedure.

1. Problem Overview

Symptom: a MOVE instruction in LAD/FBD reads the running value of a standard timer (S_ODT, S_PULSE, S_PEXT, S_ODTS, S_OFFDT) and writes it into a data block word declared as S5TIME. The destination is read back with a different numerical content, e.g. the timer is preset to S5T#6m25s and the DB word shows S5T#1s810ms.

Affected platforms: SIMATIC S7-300, S7-400, C7, ET 200S (IM 151) running STEP 7 V5.x and S7-PLCSIM V5.x. The same logic also applies to S7-1200 and S7-1500 timers using the legacy S5TIME format (with 16-bit width on S7-1200/1500 S5TIME (duration) reference page).

Impact: any HMI tag, archive, recipe, or PID block that reads the S5TIME variable gets an incorrect duration, which can cause:

• Recipe values written back to the timer with the wrong time base.
• Visualization of process timers that are off by 10×, 100×, or 1000×.
• False trip conditions when S5TIME is used as a threshold for comparison or alarm generation.

2. S5TIME Data Type: Bit-Level Structure

S5TIME is a 16-bit value composed of two concatenated fields: a 2-bit time base selector and a 12-bit BCD-coded time value (range 0 to 999). The result of multiplication is the actual time. The reference for the structure is the official Siemens documentation page S5TIME (duration) - S7-300/S7-400.

Total time is calculated as duration = BCD_value × time_base. The BCD field stores the time value as three 4-bit BCD digits (hundreds / tens / ones), which is critical: a MOVE instruction does not perform a BCD-to-binary or binary-to-BCD conversion, it only copies the 16 bits as-is.

Example encoding:

3. Time Base Encoding Reference

For S7-1200/1500, Siemens provides an extended 32-bit S5TIME variant (time bases 1 ms, 10 ms, 100 ms, 1 s, 10 s) that can store up to 9 999 000 ms (~2.78 h) with the same BCD + time-base principle. The 16-bit format documented above applies to S7-300/400 only.

4. Timer Block Outputs: BI vs BCD

Every SIMATIC timer block in LAD/FBD exposes three outputs:

In STL, the same two words are accessed with the two distinct load operations:

• L   T<n> - load current timer value in BCD format (S5TIME).
• LC T<n> - load current timer value as binary integer (BI).

The naming is sometimes confusing: the LAD pin labelled BI corresponds to LC T<n> in STL, and the LAD pin BCD corresponds to L T<n>.

5. Root Cause: Why MOVE on BI Returns the Wrong Value

Three defects accumulate when a developer wires the BI pin into a MOVE box and stores the result in an S5TIME variable:

1. No format conversion. The MOVE (a.k.a. BLKMOV in FBD/STL) block performs a byte-level copy. It does not perform a binary-to-BCD conversion.
2. Missing time-base bits. The BI word is a pure integer; bits 15-14 are always 0b00 (time base 10 ms). When the target is interpreted as S5TIME, the time base is forced to 10 ms regardless of the actual preset.
3. Value field is binary, not BCD. The BI word stores a binary integer, so a timer preset to 385 s with time base 1 s delivers 385 in the BI word. The destination S5TIME interprets those 12 low bits as BCD, giving 385 × 10 ms = 3.85 s instead of 385 s.

Combined effect: a one-line MOVE appears to work because the word size matches, but the time becomes wrong by a factor of 10, 100, 1000, or even 1.5 if the BCD digits happen to look similar (for example 1000b in a BCD nibble makes the value unreadable in S5TIME display).

6. Solution 1: Wire the BCD Output of the Timer

The most compact fix in LAD/FBD: route the BCD pin of the timer block into a MOVE box whose output is the S5TIME tag in the data block.

Steps:

1. Open the timer block in the network. The default view in LAD/FBD hides the BCD pin; click the small arrow at the bottom of the timer block to expand it.
2. Place a MOVE box. Set EN = TRUE (or wire a condition if you need gating).
3. Wire the BCD output to the IN of the MOVE.
4. Wire the OUT to the S5TIME tag, e.g. DB178.DBW36 of type S5TIME.
5. Download the program. Open the DB online and verify that the value matches the timer preset while the timer runs.

The BI pin can still be used in parallel if you need a pure integer for a comparison (==I, <I, etc.). Do not write the BI value into an S5TIME tag.

7. Solution 2: STL Transfer with L T<n>

If the network is already in STL (typical after a generated FBD-to-STL translation), the BI/BCD ambiguity is resolved with the choice of the load operation:

// Network 19 - transfer S5TIME-format value to DB word
      L     T1                  // Load current value of T1 in S5TIME/BCD
      T     DB178.DBW36         // Store to S5TIME tag

// Network 20 - integer snapshot for math/compare
      LC    T1                  // Load current value of T1 as binary (BI)
      T     MW120               // Store as WORD (integer)

The two operations are intentionally opposite to the LAD pin names. Use L for S5TIME and LC for integer work.

For an IEC timer (SFB 3 / SFB 4 / SFB 5 with multi-instance DB), the elapsed-time output is ET in 32-bit TIME format (milliseconds), not S5TIME. Direct assignment to an S5TIME tag is invalid; you must convert (see Section 9).

8. Solution 3: Direct S5TIME Encoding

Use this solution when the value comes from arithmetic (PID, scaling, recipe) rather than from a hardware timer. Build the word with the time base in bits 15-14 and the BCD value in bits 11-0. The approach is to load the BCD value, shift it left by 4, OR the time-base bits, and transfer.

// Parameters
//   MW100 = time value in tenths-of-seconds (DINT, 0..999)  -- pick whatever scale
//   MW102 = time base code (0=10ms, 1=100ms, 2=1s, 3=10s)
//   DB178.DBW36 = destination S5TIME
      L     MW100                // load integer time value
      ITB                          // INT -> BCD (accumulator low word now BCD)
      SRD   4                     // shift BCD value left by 4 bits: clears time-base slot
      L     MW102                 // reload time base (must be 0..3)
      OW                          // OR with shifted BCD value
      T     DB178.DBW36            // store S5TIME

Decomposition:

• ITB converts the integer time value to BCD in ACCU1-L. After conversion, the low word is the BCD pattern (each 4-bit nibble is a 0-9 digit).
• SRD 4 shifts the doubleword right by 4 bits, which positions the BCD digits into bits 11-0 and clears bits 15-12.
• OW inserts the time-base code (0..3) into bits 15-14.

Resulting layout: bits 15-14 = time base, bit 13-12 = 0, bits 11-0 = BCD value. This matches the S5TIME layout described in Section 2.

9. S5TIME from IEC Timers and TIME Format

IEC timers (SFB 3 TP, SFB 4 TON, SFB 5 TOF) operate on the 32-bit TIME data type: 1 unit = 1 ms, range -2 147 483 648 ms to 2 147 483 647 ms. The block output is at the ET (elapsed time) parameter.

To expose the IEC timer value as S5TIME on a tag, you need a DINT→S5TIME conversion. A common engineering pattern uses a standardized function block (FB) that:

1. Limits the DINT to ≤ 9 990 000 ms (the S5TIME range upper bound is 9 990 s with time base 10 s).
2. Selects the largest time base that keeps the BCD value ≤ 999.
3. Encodes the result as in Section 8.

// Pseudocode (ST) for DINT-to-S5TIME conversion
//   IN  : LTime  (DINT, ms)
//   OUT : S5Time (WORD)
IF LTime < 100 THEN          // < 0.1 s  -> 10 ms base
    S5Time := (LTime / 10) * 16#0001;            // base bits = 00
ELSIF LTime < 1000 THEN      // < 1 s    -> 100 ms base
    S5Time := (LTime / 100) * 16#0001 + 16#4000; // base bits = 01
ELSIF LTime < 10000 THEN     // < 10 s   -> 1 s base
    S5Time := (LTime / 1000) * 16#0001 + 16#8000;// base bits = 10
ELSE                          // 10 s..9990 s -> 10 s base
    IF LTime > 9990000 THEN LTime := 9990000; END_IF;
    S5Time := (LTime / 10000) * 16#0001 + 16#C000;// base bits = 11
END_IF;

The same FB can be reused in reverse (S5TIME→DINT) for recipe loads. For HMI drivers that already accept ms integer, e.g. Beijer iX panel drivers for S7 ISO-over-TCP/IP, the value can be written directly to a DINT tag; the driver expects the millisecond range 10-9 990 000 per the Beijer Electronics S7 addressing reference. The driver does the S5TIME encoding internally.

10. Verification Procedure

Use the following check sequence after applying any of the three solutions.

1. Static check (no timer running). With the timer reset, the S5TIME tag should show S5T#0ms or W#16#0000. If it shows a small non-zero value, the BI pin is still wired and the bug persists.
2. Preset snapshot. Set the timer TV to a known value, e.g. S5T#1m30s. Trigger the timer (rising edge on S) and immediately read the destination. The hex word should be W#16#8090 (BCD 090, time base 1 s) - if it is W#16#0090 the time base is wrong, if it is W#16#805A the value was interpreted as binary 90 instead of BCD 090.
3. Dynamic check. Monitor the destination online for at least one full time-base tick. The value should count down, in BCD, until it hits zero. A linear binary decrement indicates the wrong pin was wired.
4. HMI round-trip. From the HMI, force a new preset into the timer. The destination should match the new preset (BCD + time base) within one CPU scan.
5. Cross-reference sweep. Use Options > Cross Reference in STEP 7 to confirm the destination S5TIME tag is not also written by other blocks (e.g. recipe download, OP input) that use the BI pin elsewhere - duplicate writers can re-introduce the bug.

11. Troubleshooting Matrix

12. Field Notes and Best Practices

• Prefer IEC timers for new code. SFB 4 (TON) gives a clean DINT ET and integrates with IEC 61131-3 idioms. Use S5TIME only for compatibility with existing HMIs, recipes, or S5-converted code.
• Document the time base. Tag names like CycleTime_S5 are useless; use CoolDown_S5_1sBase or annotate the time base in the DB header.
• Never mix BI and BCD writers. If a recipe loads the S5TIME tag in BCD form (e.g. via HMI driver) and the timer logic also writes it via BI, the last-writer-wins race will produce intermittent faults. Use a single owner of each S5TIME tag.
• Watch the 999/1000 boundary. STEP 7 silently changes the time base when entering a value through the editor. 999s uses base 1 s; 1000s uses base 10 s. Do not transcribe by hand; always read the resulting hex from the editor.
• S7-300/400 timer areas are 256 words. T0-T255. In STL use only the absolute area address; the symbolic name (e.g. Timer_1) in some projects does not resolve on the L/LC operation - use the absolute name in the address field.
• PLCSIM parity. The same code reproduces the same hex patterns in S7-PLCSIM. You can validate the fix offline in seconds without hardware.
• Cross-platform consistency. On S7-1200/1500 the IEC timer output ET is also 32-bit TIME. The same FB from Section 9 can be reused; the time-base code 0..3 maps to the S5TIME 16-bit layout supported by the S7-1200/1500 firmware for backward compatibility.