S5T# Timers in Siemens S7: Update Timing and Cycle Behavior

S5T# Timers in Siemens S7-300/400: When the Operating System Updates the Timer

The S5T# (S5 time) format is the legacy time literal carried forward from the SIMATIC S5 family into the SIMATIC S7-300, S7-400, and WinAC controllers programmed with STEP 7 (Classic). Although the IEC 61131-3 TP, TON, TOF, and TONR blocks are now the recommended timing functions in TIA Portal, the S5 timer instructions (SP, SE, SD, SS, SF, FR, R) and the S5T# literal are still present in every S7-300/S7-400 firmware and are used in tens of thousands of installed machines. The single most common field question about these instructions is the same one the source thread captures: at what point in the user-program cycle is the timer actually decremented and the Q output set, and can the Q output flip twice inside one OB1 scan?

This reference answers that question with the underlying hardware architecture, the documented OS update interval per CPU family, the data-consistency consequences, and the working programming patterns that avoid mid-scan toggles. It is written for engineers who maintain installed S7-300/S7-400 code and for anyone migrating such code to TIA Portal where the timer semantics differ.

1. Overview: S5T# Format and S5 Timer Instructions

The S5T# literal is a 16-bit value that combines a time base (2 bits) with a BCD-coded time value (14 bits). STEP 7 accepts the literal in the form S5T#<value><unit>, for example S5T#2s500ms or S5T#9990s. The CPU parses the literal at download/compile time, encodes it into a 16-bit word, and stores it in the timer's two-word area (word 0 = time value, word 1 = time base + control bits).

The five run-time instructions and two control instructions are documented in the STEP 7 programming manual (see SIMATIC S7-300 CPU 31xC and CPU 31x: Technical Specifications):

• SP — Start pulse timer (one-shot)
• SE — Start extended pulse timer (re-triggerable pulse)
• SD — Start on-delay timer (Q follows after TW elapses while IN=1)
• SS — Start retentive on-delay timer (Q follows after TW elapses, latched)
• SF — Start off-delay timer (Q drops TW after IN=0)
• FR — Enable / re-trigger / cancel a running timer
• R — Reset timer (clears the running time and Q output)

Each timer occupies a 16-byte data block in the system memory (the timer area, addressed as T 0 ... T n). The first word holds the remaining time in BCD with the time-base bits in the high byte; the second word holds the status bits (BI, BCD, R, A) used by the binary and BCD outputs.

2. Hardware vs Software Timers: Why the Question Exists

SIMATIC S7-300/400 implements S5 timers as hardware timers maintained by a dedicated timing section of the CPU. The timing section is driven by a hardware counter that is decremented on a fixed internal tick; the time base selects which tick feeds which timer word. The user program never decrements the timer. The user program only:

1. Loads a 16-bit value into a timer word via L S5T#... or an SP/SE/SD/SS/SF instruction.
2. Reads the timer's status and current value through A T 0, L T 0, LC T 0 (BI / BCD / R / A bits).
3. Resets the timer with R T 0.

By contrast, the IEC timer FB instances (TP, TON, TOF, TONR) are software timers. The IEC FB contains a static PT (preset time), ET (elapsed time), Q and ET outputs, and an internal instantaneous-time read. The FB body compares the elapsed time to the preset time and only updates the Q output when the FB is called. This is the fundamental difference: an IEC timer is updated when its instance is processed; an S5 timer is updated when the OS decides to update it.

3. The OS Interrupt: How the S5 Timer Is Decremented

The S5 timer area is updated by an OS-level interrupt that pre-empts the user program at a fixed cadence. The cadence is governed by the smallest time base that the CPU must support (10 ms on the S7-300 family, 1 ms on most S7-400 CPUs and on the S7-318 and S7-319 high-end S7-300 CPUs). The OS schedules a timing task that:

1. Saves the user-program context.
2. Iterates over the active timer words.
3. For each timer with time-base bits matching the current tick, decrements the BCD remaining-time word by one count.
4. When a timer reaches 0000, sets the timer status bits (A = active/expired) and, for pulse and on-delay instructions, drives the Q output through the timer cell.
5. Restores the user-program context and resumes OB1.

This pre-emption is invisible to the user program. There is no OB raised, no event, no interrupt you can hook. The S5 timer cell is updated asynchronously to the OB1 cycle. If the OB1 scan is 200 ms and the timer is a 100 ms SD (time base 0.1 s, decrementing every 100 ms), the Q output can transition inside the OB1 scan without any user instruction having executed the transition.

4. Update Interval by CPU Family

The OS update tick is the most important number for the consistency question. Published values (see the S7-300/CPU 31xC Technical Specifications manual and the S7-400 CPU data sheets on the Siemens support portal) are:

The 10 ms / 1 ms distinction is the reason a 100 ms SD timer on an S7-313 can appear to overshoot by up to 10 ms but a 100 ms SD on an S7-416 will appear to be more precise. The S5T# time base is the dominant factor in user-visible behaviour; the OS tick only smooths the underlying counter.

5. The Data-Consistency Problem: Q Output Toggling Inside One OB1 Scan

Because the S5 timer is updated by an OS pre-emption that has no awareness of where the user program is, the following scenario is real and reproducible in PLCSIM:

1. OB1 begins execution. Timer T1 is loaded with S5T#1s and started with SD on the previous cycle. The Q bit is read as 0.
2. OB1 reaches the middle of its scan. The OS tick fires, decrements T1 to 0000, sets the A and Q bits. OB1 is pre-empted; the user program is unaware.
3. OB1 resumes and later in the same scan reads A T 1 again. The Q bit is now 1.

The same OB1 execution will have observed two different values for the same Q output. Any logic that uses the Q bit in a downstream set/reset or arithmetic operation will see a non-deterministic value depending on where in the scan the Q bit is sampled. The classic field symptom is a sequencing fault that happens once every few hours, always on the same OB1 scan, never reproducible in slow-motion single-step mode.

5.1 Mitigation patterns

• Sample once per scan. Read the Q bit into a temporary flag at the top of OB1 and use only that flag for the rest of the scan. This is the standard pattern in SIMATIC S7 programming guidelines.
• Use a rising-edge detection on Q. Wrap the read in a FP (rising-edge) instruction so a transition that occurred inside the scan is acted upon exactly once at the next cycle boundary.
• Increase the time base above the OB1 scan time. Pick a base 01 (0.1 s) or base 10 (1 s) timer if the application allows; the Q bit can no longer flip inside the scan.
• Use a hardware timer module. For sub-millisecond or sub-OB1-scan accuracy, off-load the timing to a digital input module with timer function or an FM 350 / FM 450 counter module.

6. Comparison: S5 Timers vs IEC Timers

7. Reading an S5 Timer in STL: Word Layout and Bit Decoding

The 16-bit timer word has the following layout (see STEP 7 manual § 27.3.2.5 “Programming timer functions”):

  Bit:   15 14  13 … 12  11 … 8   7 … 4   3 &hellips 0
        +----+----+------------+------------+------------+------------+
        | TB1| TB0|  hundreds  |   tens     |   units   | 0.1-units |
        +----+----+------------+------------+------------+------------+

• Bits 15:14 = time base (00 = 10 ms, 01 = 100 ms, 10 = 1 s, 11 = 10 s).
• Bits 13:0 = BCD remainder (3 BCD digits for the integer part, 1 BCD digit for the fractional part of the current time base).

STL snippet to extract the time base and the BCD remainder of T 0:

      L     T      0          // accumulator 1 = timer word of T0 (BI output)
      T     MW    10          // store for inspection
      L     W#16#0FFF         // mask out the time base
      AW                       // accumulator 1 = BCD remainder only
      T     MW    12          // BCD remainder
      L     MW    10
      L     W#16#C000         // mask the time-base bits
      AW
      SRW   14                 // shift right 14 places; ACCU1.L = 0..3
      T     MB    14          // 0=10ms, 1=100ms, 2=1s, 3=10s

To read the BCD value in a human-readable format, use the LC instruction (load BCD), which is the form typically shown in the online monitor.

8. Behaviour in OB1, OB35, and OB82/OB85

The OS pre-emption has the same priority class as the cyclic interrupt OB, so an OB1 with priority 1 and a 10 ms OS tick means the user program can be pre-empted up to 100 times during a 1 s OB1 scan on an S7-300. The pre-emption does not occur inside an OB82 / OB85 / OB121 / OB122 error OB — the error OBs run with interrupts disabled at the S5 timer level, so a timer that expires while the CPU is in an error routine will be processed after the error OB returns. This is a documented behaviour and is the reason an SD timer started immediately before a power-loss OB can show a −1 count error in the diagnostic buffer.

The cyclic interrupt OB (e.g. OB35, default 100 ms) is the recommended place to read S5 timers in any application where the OB1 scan is long or unpredictable. Sample the Q bit at the top of OB35 and copy it to a flag for OB1 to consume.

9. STEP 7 (Classic) Programming Reference

9.1 LAD / FBD ladder example — sample-once pattern

// Network 1: sample T1 Q at the top of OB1
A      T      1
=      M      10.0       // "T1_Q_this_scan" flag, sampled once per OB1

// Network 2: downstream logic uses only the flag, never T1 directly
A      M      10.0
AN     M      20.1
S      M      30.0

9.2 STL example — rising-edge detection on a 1 s SD timer

      A      T      1        // 1 s SD timer started in net 1
      FP     M      12.0     // edge memory bit
      JC     DOIT            // jump to action block on rising edge
      JU     NEXT
DOIT: S      M      50.0     // set the action flag exactly once per expiry
NEXT: NOP 0

9.3 Structured Text (SCL) example — IEC timer as the safe replacement

FUNCTION_BLOCK FB_Sequence
VAR
    StepTimer : TON;        // IEC on-delay FB instance
    StepActive : BOOL;
END_VAR
BEGIN
    StepTimer(IN := StartCmd, PT := T#2s500ms);
    IF StepTimer.Q AND NOT StepActive THEN
        StepActive := TRUE;        // action triggered once at expiry
        // ... downstream sequencing ...
    END_IF;
END_FUNCTION_BLOCK

Note how the IEC TON Q output is computed inside the FB on every call. The caller is in full control of the update point in time — exactly the opposite of the S5 timer semantics. See the TIA Portal reference page Timer operation (IEC timers) for the canonical update rule.

10. Diagnostics in PLCSIM and Online

Two PLCSIM test cases are useful when verifying timer behaviour on a real S7-300/400:

1. Long-time-base drop test. Load S5T#9990s (the maximum of the 10 s time base), start with SS, monitor the value in STEP 7 → Monitor/Modify. The display will count down in 10 s steps because the OS only writes the new value at every 10 s tick; the intermediate 1 s OS tick does not change the displayed word. This proves the time-base > OS-tick rule.
2. Mid-scan transition test. Set the OB1 scan time to 300 ms (insert a WAIT or a long loop), start a 100 ms SD timer, and read the Q bit at two different points in the same scan. The second read will differ from the first.

The STEP 7 diagnostic buffer logs the last 10 ms / 1 ms tick that overran the user program as a “Communication / time-out” event when the overrun exceeds the configured maximum cycle time. This is a useful first-line check on whether timer pre-emption is the source of jitter in your application.

11. Migration to TIA Portal and S7-1200/S7-1500

When a STEP 7 (Classic) S7-300/S7-400 program is ported to TIA Portal, the S5T# literal is automatically accepted and the S5 timer instructions continue to work on the S7-300/S7-400 target. On S7-1200 and S7-1500 targets, however, the S5 timer instructions are no longer available; the migration tool rewrites them to IEC timer FBs. The IEC FB updates the Q output inside the FB, not in the OS, so any data-consistency code written assuming the S5 mid-scan transition is no longer required and can be deleted. The timer range also widens from 9 990 s to ~24.8 days, which often allows a single IEC timer to replace a chain of S5 timers.

Reference for IEC semantics: Timer operation (IEC timers) - TIA Portal manual. Reference for S7-300 hardware timer behaviour: SIMATIC S7-300 CPU 31xC and CPU 31x: Technical Specifications (Section § 4.4 “Timer”).

12. Common Pitfalls and Edge Cases