Resolving WinCC Flexible 2007 Linear Scaling Bug with S5TIME Tags

Problem Overview

Operators commissioning a WinCC Flexible 2007 runtime frequently report that the I/O field bound to an S5TIME tag accepts the entered value but the PLC receives a value that is exactly 1/1000 of the input. A user who enters 100 on the HMI expecting S5T#100s at the timer block instead observes a runtime of 100 ms. The same project file applied to WinCC Flexible 2005 SP3 or WinCC Flexible 2008 SP1/SP2 compiles and runs the linear scaling correctly, which isolates the defect to the WinCC Flexible 2007 baseline release (without the post-release hotfix roll-ups).

This article documents the engineering root cause, the S5TIME format that drives the math behind linear scaling, the proven corrective paths (Hotfix install, manual scaling, platform migration), and a verification procedure suitable for a factory acceptance test (FAT) or site acceptance test (SAT).

Affected Versions and Environment

The defect is specific to the original WinCC Flexible 2007 build. Subsequent releases - 2008, TIA Portal, and WinCC Unified - either inherited the corrected code or implemented an entirely new tag-property workflow that does not exhibit the issue.

S5TIME Data Format Reference

Linear scaling depends on knowing what the HMI driver writes into the PLC tag. S5TIME (also written S5T# in STEP 7 classic) is a packed 16-bit timer word used by S7-300/S7-400 timer functions (SP, SE, SD, SS, SF, SPB) and by the IEC-compatible CEIL / FLOOR / PULSE blocks that take a time argument in legacy libraries. The high nibble stores a time base; the low 12 bits store a BCD time value (0-999). The PLC computes the actual elapsed time as:

elapsed_time = time_value_BCD × time_base

For a desired value of 100 s, the STEP 7 editor selects time base 2 (1 s) and BCD value 100, yielding the bit pattern 2#0010 0000 0110 0100 = W#16#2064. The same nominal duration cannot be encoded using the 10 ms or 100 ms bases because the BCD word saturates at 999.

Root Cause Analysis

When WinCC Flexible processes an I/O field bound to an S5TIME tag, it converts the entered numeric literal into the 16-bit timer word according to the configured linear scaling. Linear scaling in WinCC Flexible 2007 is implemented as a two-point affine transform:

PLC_value = Lower_PLC + (HMI_value - Lower_HMI) × (Upper_PLC - Lower_PLC) / (Upper_HMI - Lower_HMI)

In the 2007 baseline, the conversion path branches incorrectly when the target tag type is S5TIME. The HMI's numeric buffer is interpreted as raw milliseconds, the conversion routine returns HMI_value / 1000 as a packed timer word without re-encoding the time base, and the result is downloaded into the PLC tag. Operators therefore see a 1000:1 shrinkage regardless of any scaling values they entered in the tag properties dialog.

Engineering debugging sequence:

1. Open the WinCC Flexible project, right-click the HMI tag connected to the S5TIME PLC tag, and inspect Properties > Linear Scaling. Confirm the scaling pair, for example Lower HMI 0 / Lower PLC 0 and Upper HMI 1 / Upper PLC 1000.
2. Compile the project. From a command prompt on the engineering station, launch HMIRtm.exe with the compiled runtime file.
3. In the I/O field, enter 100. Read back the timer word from the PLC using a watch table in STEP 7. The PLC word reads W#16#0064 (base 0, value 100 = 100 ms) instead of the expected W#16#2064 (base 2, value 100 = 100 s).
4. Cross-check the WinCC Flexible build: Help > About shows the baseline 2007 + SP0 string without any HF designation.

If the four checks line up, the runtime is suffering from the documented WinCC Flexible 2007 S5TIME linear scaling defect. Continue with the corrective procedure below.

Solution A - Apply Hotfix 1 or Later

The supported and recommended corrective action for WinCC Flexible 2007 is to layer the official Siemens Hotfix on top of the existing installation. Hotfix 1 introduced the corrected S5TIME handling; Hotfix 2 through Hotfix 4 are cumulative roll-ups that include the original fix plus additional tagged corrections.

1. Identify the current installation. From the engineering PC, open Start > Control Panel > Programs and Features and record SIMATIC WinCC flexible 2007 and any installed Hotfix entries.
2. Obtain the hotfix package through the Siemens Industry Online Support portal entry ID 38478958 (the entry aggregates the WinCC Flexible 2007 hotfix roll-up). If your company has a support contract, the file is available through the legacy support portal under Downloads > HMI Software > WinCC flexible > Hotfixes.
3. Close WinCC Flexible and any ES services. Disable antivirus real-time scanning on the engineering station for the duration of the install.
4. Run the hotfix installer with administrator privileges. The installer detects the existing WinCC Flexible 2007 path and replaces the affected components (Wcflex.exe, HMIRtm.exe, the tag-conversion DLLs).
5. Reboot the engineering station. Confirm the fix by repeating the read-back in step 4 of the diagnostic procedure; the PLC word should now contain W#16#2064 for an HMI entry of 100.

Solution B - Workaround Without Hotfix

When the hotfix cannot be installed (frozen image, locked-down OT environment, vendor-supplied HMI without patch authority), the project can be reworked so the linear scaling step is performed outside the buggy WinCC Flexible code path. Two proven approaches follow.

B.1 - Indirect scaling through a DWord shadow tag

1. In the STEP 7 project, create a new tag of type DWORD or INT in a DB; call it, for example, DB100.DBD0 - TimeSeconds.
2. On the HMI, bind the I/O field to the new INT/DWORD tag and enable linear scaling with Lower HMI 0 / Lower PLC 0 and Upper HMI 1 / Upper PLC 1000 - this will work in the baseline build because the scaling path for integer tags is not defective.
3. Insert a STEP 7 FC (or SCL FB) that converts the integer/dword seconds value to a packed S5TIME word. Sample STL:

// Convert integer seconds DB100.DBW0 -> S5TIME word DB100.DBW2
// Time base selection table:
//   < 10 s    : base = 0 (10 ms)
//   < 100 s   : base = 1 (100 ms)
//   < 1000 s  : base = 2 (1 s)
//   <= 9990 s : base = 3 (10 s)
L     DB100.DBW0        // seconds requested
L     0
>I                       // seconds > 0 ?
JC    POS
L     0
T     DB100.DBW2
BEU
POS: L     DB100.DBW0
L     10
>I
JC    B1                  // >10 s use 100 ms base
L     DB100.DBW0          // base 0, 10 ms
ITB                       // BCD of seconds*100
T     DB100.DBW2
BEU
B1:  L     DB100.DBW0
L     100
>I
JC    B2
L     DB100.DBW0          // base 1, 100 ms
L     10
*I
ITB
OW    W#16#1000
T     DB100.DBW2
BEU
B2:  L     DB100.DBW0
L     1000
>I
JC    B3
L     DB100.DBW0          // base 2, 1 s
ITB
OW    W#16#2000
T     DB100.DBW2
BEU
B3:  L     DB100.DBW0
L     9990
>I
JC    ERR
L     DB100.DBW0          // base 3, 10 s
L     10
/I
ITB
OW    W#16#3000
T     DB100.DBW2
BEU
ERR: L     W#16#3999        // saturate to max
T     DB100.DBW2
BE

4. Wire the converted DB100.DBW2 to the timer block's TV input.

B.2 - Pre-converted W#16# constants from a script tag

An alternative - used when a project will not be re-compiled - is to add a WinCC Flexible "Set value" event on the I/O field's Change value action. The event calls a script that computes the packed S5TIME word from the entered seconds and writes it through a different tag of type WORD using SmartTags("TargetWord") = value. The script bypasses the broken linear scaling branch because the tag type passed to the runtime is now WORD, not S5TIME.

' VBScript - convert seconds to S5TIME WORD
Dim s : s = SmartTags("HMI_Seconds")
Dim base : base = 2            ' default 1 s base
Dim val  : val  = s
If s >= 9990 Then base = 3 : val = Int(s/10)
If s >=  999 Then base = 3 : val = Int(s/10)
If s >=  100 Then base = 2 : val = s
If s >    10 Then base = 1 : val = s * 10
If s >=    0 Then base = 0 : val = s * 100
' Encode: top nibble = base, low 12 bits = BCD(value)
Dim wordOut : wordOut = (base * 4096) Or Int(val)
SmartTags("TimerWord") = wordOut

The PLC then receives the correctly packed timer word and the operator-facing input remains in seconds.

Solution C - Migrate to TIA Portal or WinCC Unified

For long-term support, migrate the project to TIA Portal WinCC Comfort/Advanced or to the newer WinCC Unified runtime. Both toolchains re-implement linear scaling and are not subject to the WinCC Flexible 2007 defect. The Siemens TIA Portal Migration Tool can convert WinCC Flexible 2007 projects to TIA Portal with most screens, tags, and alarms transferred automatically; user-defined functions and the legacy Linear Scaling property are mapped to the modern tag properties dialog.

For WinCC Unified V20, linear scaling is configured in the tag Inspector:

1. Open the project in TIA Portal V20.
2. Select the HMI tag that you want to scale.
3. In the Inspector window, choose Properties > Properties > Linear scaling.
4. Click Linear scaling to enable it, then enter the Upper HMI and Upper PLC pair as well as the corresponding Lower pair.

Refer to the Siemens documentation for the full property description: Applying linear scaling to a tag (RT Unified) - WinCC Unified V20.

Step-by-Step Linear Scaling Configuration

The recommended scaling pair for an S5TIME tag driven by a user-friendly seconds input is shown below. Apply this on a post-hotfix WinCC Flexible 2007 install or on any later release.

The transform therefore multiplies any value entered on the HMI by 1000 before writing it to the PLC. Entering 100 writes a packed S5TIME word of 100 000 ms, which STEP 7 stores as W#16#2064 = S5T#100s.

Verification Procedure

After applying the corrective action, run a structured verification to confirm the fix on every screen that displays or accepts an S5TIME value. Capture each test row in the SAT log.

1. Open STEP 7 and connect online to the PLC with the HMI runtime stopped.
2. Open a VAT and monitor the timer word tag bound to the HMI I/O field (for example DB100.DBW2).
3. From the HMI, enter 5, 15, 100, 500, and 999 in turn. Record the timer word value returned in the VAT.
4. Decode the read-back against the expected packing:

5. For each entry, the displayed seconds and the resulting timer word must match the table above. A 1:1000 mismatch (e.g. 5 entered, 0x0005 returned) indicates the runtime still suffers from the baseline defect and requires another corrective pass.
6. Trigger a power-cycle of the panel to confirm the scaling pair is persisted across reboots.

Related Issues and Edge Cases

• S7-1200/S7-1500 do not use S5TIME. The IEC timer (IEC_TIMER, TP, TON, TOF) takes a 32-bit TIME (millisecond DWORD). If you migrated a 300/400 program with timer inputs to a 1200/1500 CPU, the legacy tag type changes to TIME and the WinCC Flexible 2007 defect no longer applies; the linear scaling then uses a direct ms-to-ms ratio.
• BCD boundary at 999. When the HMI entry approaches the maximum for the chosen time base, the runtime must roll the base up automatically; the hotfix includes that selection logic. The baseline build does not, so users who enter 250 s on a defective runtime observe either a wrap to 250 ms or a saturated W#16#3250 depending on how the baseline miscodes the base.
• Multi-language projects. Scaling pair fields are not localized; the Upper HMI / Upper PLC strings remain identical across languages, so the workaround can be applied without re-translation.
• OPC DA / OPC UA gateways. When WinCC Flexible 2007 publishes the S5TIME tag through an OPC server, the OPC client receives the already-scaled value. A second scaling step on the OPC client side will compound and reproduce the symptom; configure the OPC client with a 1:1 passthrough.
• Audit / GMP environments. Some regulated sites prohibit the use of legacy hotfixes. The DWord shadow-tag workaround (Solution B.1) is the audit-friendly alternative because it remains in the original, signed runtime.

Field Commissioning Checklist

1. Record the WinCC Flexible build under Help > About; reject any engineering station reporting 2007 + SP0 without a hotfix tag.
2. For every screen containing an I/O field bound to an S5TIME tag, confirm that the linear scaling pair is (0, 0) / (1, 1000).
3. Run the five-row verification table above; sign each row in the SAT log.
4. Archive the compiled .fwx runtime, the source .hmi project, and a screenshot of the corrected scaling dialog under Documentation > Commissioning > HMI.
5. If a hotfix was installed, record the Siemens Hotfix identifier (for example WinCC flexible 2007 HF4) in the project's change log and link to the support entry used to obtain it.

Frequently Asked Questions