Resolving Siemens S7 S5 Timer Failures Below 30ms Time Base

Resolving Siemens S7 S5 Timer Failures Below 30ms Time Base

When a STEP 7 pulse generator built from two S5 timers stops cycling after one or two pulses when its preset value is dropped below 30 ms, the failure is not a programming typo. It is a fundamental conflict between the S5 timer's coarse OS-driven time base, the user's OB1 scan cycle, and the implicit "re-trigger" rule that requires a 0→1 edge at the timer's start input. The same code that runs reliably with PT = 30 ms or PT = 50 ms becomes stochastic or completely dead at PT = 10 ms or PT = 20 ms. This article walks through the root cause, maps the S5 timer time-base table to permissible preset values, contrasts S5 timers with the IEC SFB 3/4/5 timers, and gives field-proven replacement implementations using OB35 cyclic interrupts, SFC64 (TIME_TCK), SFC1 (READ_CLK), and counter-based pulse generation.

1. Problem Description and Observable Symptom

The reported fault occurs in an S7-300 or S7-400 CPU running a user program with an OB1 scan time of approximately 20 ms. The pulse generator is implemented with two S5 timers cross-coupled so that the falling edge of timer T1 triggers T2, and the falling edge of T2 triggers T1. The intent is to produce a continuous square-wave output bit.

Observable behavior:

• PT = 30 ms or higher: pulse generator runs indefinitely as designed.
• PT = 20 ms: generator produces one or two cycles and then stops; output bit latches in either 0 or 1.
• PT = 10 ms: generator typically produces zero or one complete cycle and then stops.

Triggering conditions:

• The CPU's OB1 scan time is in the same order of magnitude as the timer preset.
• The S5 timer is used to re-trigger itself (for example, AN T 7 / SD T 7) without a clean reset path.
• Preset value falls inside the 10 ms time-base bucket of the S5 timer.

2. Root Cause Analysis

Three intertwined mechanisms cause the failure:

2.1 S5 Timer OS Update and Time Base

S5 timers (T0..T511 depending on CPU) are not "counted down" inside the user's program; they are serviced by the CPU operating system. The OS samples each running timer at an interval equal to its time base and decrements it. The time base is selected automatically by the STEP 7 editor from the preset value, not by the user, and it is fixed for the whole time the timer is running. This behavior is documented in the STEP 7 programming reference for S5 timers and the S7-300/S7-400 system manuals. See the SIMATIC S7-300 CPU 31xC and CPU 31x: Technical Data manual and the S7-300 Programmable Controller System Manual.

The four time-base buckets are:

Because the time base is 10 ms when PT < 10 s, the timer can only resolve to 10 ms. PT = 20 ms is internally "20 ms" and the OS decrements it once every 10 ms tick. PT = 10 ms is "10 ms" and is decremented once per 10 ms tick.

2.2 Timer Re-trigger Requires a 0→1 Edge

An S5 timer in pulse mode (SP) starts on a 0→1 edge at input S and runs until time-out or until input R is asserted. The S5 timer's output bit is "1" for the duration. If you use AN T 7 (examine output as 0) followed by SD T 7 (start T7 with preset), the start condition is "T7 is not currently active". On the very first scan after time-out, T7 output is 0, so AN T 7 is true, so T7 is started again. On the next scan 20 ms later, the OS has already decremented T7 (which had PT = 10 ms) once or twice and T7 may already be timed out again. The instruction AN T 7 may or may not be true depending on whether the OB1 read of T7's output bit happens before or after the OS updates the cell.

The failure mode is: by the time OB1 re-evaluates T7, the timer's output bit has already returned to 0 (time-out occurred during the previous OB1 cycle or during the time between OB1 end and OB1 restart). The condition AN T 7 is true, SD T 7 sets the cell, but on the very next OB1 scan the OS has already decremented it past zero again. Without a sustained 1 state on the S input between time-outs, the timer can oscillate or stall.

2.3 Scan Time Approaches Time Base

When the OB1 scan time (≈20 ms in the report) is greater than or equal to two time-base ticks (2 × 10 ms = 20 ms), there is essentially no slack in the schedule. Each OB1 call sees a timer that has either just expired or is about to expire. Combined with the 0→1 edge requirement, this guarantees the reported behavior.

3. S5 Timer vs IEC Timer Comparison

Even IEC timers do not solve the problem at 10-20 ms PT because they are also evaluated inside OB1. They are simply counters with the same scan dependency. The TP (SFB 3) "pulse" mode does re-trigger on a 0→1 edge, but with a 20 ms scan and a 10 ms PT, the same edge-miss problem occurs.

4. Alternative Implementation Strategies

Four field-proven replacement strategies are available, ordered by complexity.

4.1 OB35 Cyclic Interrupt (Recommended for 5-100 ms pulses)

OB35 is a hardware-timed interrupt OB that runs at a fixed interval independent of OB1 scan time. Typical default is 100 ms but can be configured to anything from 1 ms to 60 000 ms through the CPU hardware configuration. At 10 ms OB35 interval, the pulse generator logic executes exactly every 10 ms and never misses an edge. See STEP 7 V5.5 System and Standard Functions Reference Manual for OB35 configuration details.

Example pulse generator in OB35 using SCL/ST for clarity (also implementable in LAD/FBD):

// OB35 - 10 ms cyclic interrupt
// Generate a 50% duty-cycle pulse at OB35 period

FUNCTION_BLOCK FB_PulseGen
VAR
    iCounter : INT;        // Counts OB35 ticks
    bOut     : BOOL;       // Output bit
END_VAR

BEGIN
    iCounter := iCounter + 1;
    IF iCounter >= 5 THEN  // 5 ticks * 10 ms = 50 ms half-period
        iCounter := 0;
    END_IF;
    bOut := (iCounter < 3);  // Adjust ratio as required
END_FUNCTION_BLOCK

LAD equivalent inside OB35:

      L     "iCounter"           // Load current tick count
      +     1                    // Increment
      T     "iCounter"           // Store back
      L     5                    // Half-period divisor (50 ms @ 10 ms OB35)
      MOD                        // Modulo
      T     "iModResult"
      L     2                    // 0, 1, 2 → output HIGH
      <=I
      =     "OutputBit"

4.2 SFC64 TIME_TCK (Free-Running 1 ms Time Tick)

SFC64 returns a 32-bit millisecond counter that increments from CPU power-on. It is read by the user program and is suitable for measuring elapsed times of 1 ms or more without drift. Reference: SFC64 TIME_TCK documentation in the Standard Functions manual.

// Call in OB1 to compute elapsed time since last pulse edge
CALL  SFC 64
      RET_VAL := "dwTimeTick"     // DWORD, milliseconds since power-on

// In pulse generator:
L     "dwTimeTick"
L     "dwLastEdge"
-D                              // Elapsed = current - last
T     "dwElapsed"
L     20                         // Target period 20 ms
>=I
JC    NewEdge

NewEdge:
L     "dwTimeTick"
T     "dwLastEdge"
AN    "OutputBit"
S     "OutputBit"
BE

4.3 SFC1 READ_CLK (Wall-Clock Time)

SFC1 reads the CPU's real-time clock into a DT (date-and-time) buffer. Use it for pulses that must be coherent with the wall clock, not for short cycles. Resolution is 1 s, which makes it unusable below 1000 ms. Reference: SFC1 READ_CLK in the Standard Functions reference.

4.4 Counter-Based Pulse (No Hardware Interrupt)

If OB35 is already used and SFC64 is not desired, a counter incremented in OB1 with a modulo comparison can generate pseudo-pulses. The duty cycle accuracy is degraded by scan jitter; only use this when the application tolerates ±1 scan of jitter.

      L     "scanCounter"
      +     1
      T     "scanCounter"
      L     0
      >I
      SPB   Cont
      L     0
      T     "scanCounter"
Cont: L     "scanCounter"
      L     2
      MOD
      L     0
      >=I
      =     "OutputBit"

5. Selecting the Correct Time Base for the Preset Value

When you must use S5 timers, choose the preset so that it falls unambiguously inside one of the four time-base buckets. Avoid the boundary values (9 s 990 ms → 10 s, 99 s 900 ms → 100 s, 999 s → 1000 s) because rounding can move the preset into a different bucket.

Note that STEP 7 editor may round a value of S5T#25ms up or down depending on the version; some versions display the next-valid value automatically.

6. Verification Procedure

1. Read OB1 scan time. Open the diagnostic buffer or use the system clock in HW Config to confirm the actual scan cycle. Acceptable values for S5 timer pulses are scan < PT/2.
2. Monitor T7 (or equivalent) bit in VAT table. Force a single cycle and observe whether T7 transitions through 1 and back to 0 within a single OB1 scan.
3. Add OB35 at 10 ms. Move the pulse-generation FB into OB35 and observe the output bit with a trace or logic analyzer on the DO module.
4. Run for 10 minutes. Pulse generators built from S5 timers below 30 ms can fail after 100-1000 cycles. Verify with a long-duration test.
5. Check CPU utilization. If OB35 runtime exceeds 80% of the OB35 period, increase the period or shorten OB35 logic.

7. Edge Cases and Field Notes

• S7-300 vs S7-400. On S7-400, IEC timer resolution is 1 ms instead of 10 ms, so PT = 10 ms is reliably achievable with SFB 3/4/5 inside OB1 if scan < 5 ms. On S7-300, IEC timer resolution is 10 ms and the same restrictions apply as for S5 timers.
• S7-1200 and S7-1500. These newer platforms do not expose S5 timers. Use TP, TON, TOF (IEC 61131-3) instructions with the system clock byte. Pulse generation in OB35-equivalent (cyclic interrupt OB) is the recommended pattern.
• Retentive behavior. S5 timers are not retentive; their state is lost on power-cycle. The pulse generator must be re-initialized in OB100.
• Priority and nesting. OB35 can be interrupted by OB80 (time error), OB82 (diagnostic), and higher-priority OBs. If your pulse generator must be glitch-free, ensure OB35 priority is appropriate and that the higher-priority OBs do not exceed their own budgets.
• Watchdog interaction. Some CPU watchdogs (OB1 scan time watchdog) trigger if OB1 exceeds 150 ms. Generating pulses inside OB1 with extended scan times can inadvertently trigger OB80. Using OB35 isolates the pulse generation from OB1 watchdog.

8. Recommended Replacement Patterns

9. Commissioning Checklist

1. Confirm OB35 is configured in HW Config with the desired period.
2. Confirm OB35 priority is appropriate (default 12).
3. Confirm OB35 execution time is < OB35 period - 1 ms.
4. Place the pulse generator FB in OB35; do not place it in OB1.
5. Initialize the FB instance in OB100 (cold restart) and OB101 (warm restart).
6. Monitor the output bit with a trace or external logic analyzer.
7. Run for at least 10 minutes and confirm duty cycle stability.
8. Add error handling for OB35 overrun (OB80 call) if available.

10. Standards and Documentation References

• SIMATIC S7-300 CPU 31xC, CPU 31x: Technical Data manual
• SIMATIC S7-300 Programmable Controller System Manual
• STEP 7 V5.5 System and Standard Functions Reference Manual
• SFC1, SFC64 and IEC timer SFB 3/4/5 reference
• SIMATIC S7-1200 Programmable Controller System Manual

11. FAQ