S7-1200 IEC Timer Preset: KTP HMI Setup Using DINT Scaling

Problem Overview

When commissioning a SIMATIC S7-1200 CPU alongside a SIMATIC KTP Basic Panel (KTP400, KTP700, KTP1000, or KTP1200) in TIA Portal, a common requirement is to let the operator change the preset time of an IEC TON (on-delay timer), TOF (off-delay), or TP (pulse) block directly from the HMI screen. The intuitive approach — declaring the preset tag as Time or IEC_TIMER in the PLC tag table and binding an I/O field with format "Time" on the HMI — fails: the tag is either filtered out of the HMI tag selection dialog, or the value cannot be read/written at runtime.

This behavior is consistent across TIA Portal V15.1 through V18 (and equivalent in V19/V20 with the same constraint on Basic Panels). The limitation stems from the way SIMATIC Basic Panels (KTP series) handle the IEC 61131-3 TIME data type and the IEC_TIMER system data block (DB) in the HMI tag database.

Root Cause: Why TIME and IEC_TIMER Tags Are Not HMI-Accessible

The S7-1200 stores time values internally as a 32-bit signed integer (DINT) representing milliseconds. The Time data type in S7-1200 has a valid range of:

• Lower bound: T#-24d_20h_31m_23s_648ms = -2,147,483,648 ms
• Upper bound: T#+24d_20h_31m_23s_647ms = +2,147,483,647 ms

For full-scale interpretation and naming, see the S7-1200 manual collection on Timer operation (IEC timers).

The IEC_TIMER data type is a system-defined data block (DB) containing the timer struct: PT (preset time, Time), ET (elapsed time, Time), IN (Bool), Q (Bool). When you attempt to expose either a Time-typed tag or an IEC_TIMER instance to a KTP Basic Panel:

1. The HMI tag import in TIA Portal does not map the IEC TIME elementary type to any usable HMI tag format on Basic Panels.
2. The IEC_TIMER DB structure is treated as a complex data type, which KTP panels cannot deconstruct for individual field access.
3. Attempts to set the I/O field format to "Time" or "TimeTick" produce an error or an empty value list at compile time.

The reliable workaround, used in production systems across all S7-1200 firmware versions (V4.2 through V4.7), is to expose a DINT tag to the HMI, scale it by 1000 on the HMI side to display seconds with three decimal places, and convert it to Time in the PLC before assigning to the timer PT input.

Solution Architecture

The recommended pattern decouples the operator-facing representation (seconds with ms granularity) from the PLC-internal representation (DINT in ms → converted to Time). The data flow is:

The PLC does no scaling math. The HMI multiplies the operator entry by 1000 before transmitting (DINT unit: ms), and divides by 1000 on display (DINT unit: seconds). The PLC just passes the raw DINT to the timer's PT input; the implicit conversion from DINT to Time is automatic in SCL/ST or via a single MOVE in ladder.

Prerequisites

• SIMATIC S7-1200 CPU, firmware V4.2 or later (V4.5+ recommended for V18 TIA Portal projects)
• SIMATIC KTP Basic Panel, 2nd generation or Basic 2nd generation (KTP400 Basic, KTP700 Basic, KTP700 Basic DP, KTP900 Basic, KTP1200 Basic)
• TIA Portal V15.1 or later (V17/V18 typical for current projects)
• Project with PLC and HMI devices already configured with an HMI connection
• IEC TON/TOF/TP block instantiated in the PLC program (single-instance or multi-instance)

Step-by-Step Implementation

Step 1: Create the HMI-Facing DINT Tag in the PLC

Open the PLC tag table and add a new tag:

Field	Value
Name	HMI_TimerPreset_ms
Data type	DInt (32-bit signed integer)
Address	%MW100 (example; choose any unused M or DB area)
HMI accessible	Yes (default)

This tag represents the preset value in milliseconds, the same unit the IEC timer uses internally.

Step 2: Add an Intermediate Time Tag in the PLC

Create a second tag that will feed the TON block's PT input:

Field	Value
Name	Ton1_PT
Data type	Time
Address	%MW104 (32-bit DINT, same range as DINT — milliseconds)

The address can be the same M-word range as the DINT tag because both are 32-bit values; ensure no overlap.

Step 3: Wire the DINT to the Timer PT in the PLC

In the OB1 or FB that contains the IEC TON block, add a simple MOVE instruction (LAD) or assignment (SCL) just before or in the same network as the timer call:

Ladder (LAD/FBD):

Network 1:
  MOVE
  EN  --[ ]--   IN: "HMI_TimerPreset_ms"   OUT: "Ton1_PT"   ENO--[ ]--
  TON
  IN: "Start_Command"
  PT: "Ton1_PT"
  Q:  "Ton1_Done"
  ET: "Ton1_Elapsed"

Structured Text (SCL):

// Network 1
"Ton1_PT" := DINT_TO_TIME("HMI_TimerPreset_ms");

// Network 2 - TON instance "TON_1"
"TON_1"(
    IN := "Start_Command",
    PT := "Ton1_PT");
"Ton1_Done"   := "TON_1".Q;
"Ton1_Elapsed" := "TON_1".ET;

Note: DINT_TO_TIME in SCL is a direct type conversion (no value change) because both DINT and Time are 32-bit signed integers representing milliseconds. A plain assignment Ton1_PT := HMI_TimerPreset_ms; is also valid because the implicit conversion is performed.

Step 4: Create the HMI Tag with Linear Scaling

Switch to the HMI device in TIA Portal. Open HMI Tags, create a new tag, and link it to the PLC tag HMI_TimerPreset_ms:

Field	Value
Name	HMI_TimerPreset_s
Connection	HMI_Connection_1
PLC tag	HMI_TimerPreset_ms
Data type	DInt
Length	4
Acquisition mode	Cyclic continuous
Scaling	Linear

On the HMI tag Scaling properties, configure linear scaling so the displayed value equals PLC_value / 1000:

Parameter	Value	Meaning
PLC end value to HMI end value (a)	1	Numerator for input direction
HMI end value to PLC end value (b)	1000	Multiplier for output direction
Decimal places	3	Display milliseconds

With this scaling, an operator entering 5.500 on the HMI transmits 5500 to the PLC. The PLC passes 5500 to the timer PT, which the timer interprets as 5500 ms. The HMI displays 5.500 s.

Step 5: Place the I/O Field on the HMI Screen

1. Open the desired HMI screen in the project tree.
2. Drag an I/O Field from the toolbox onto the screen.
3. Configure the I/O field properties:
   • Tag: select HMI_TimerPreset_s
   • Mode: Input/output (allows the operator to change the value)
   • Display format: 999.999 (three decimal places)
4. Add a label, e.g., "Preset Time (s)".
5. Compile the HMI and download to the panel.

Step 6: Optional — Display the Elapsed Time

To show the running elapsed time, expose the timer's ET (elapsed time) on a second DINT tag. The cleanest method is to add a second HMI tag, point it at the same TON instance's ET, and scale by 1 (no scaling needed; ET is already milliseconds, divide by 1000 on the HMI side):

// Expose elapsed time (Time) as DINT to HMI
"Ton1_Elapsed_ms" := TIME_TO_DINT("TON_1".ET);

On the HMI, link the I/O field to HMI_ElapsedTime_s with the same linear scaling (1:1000). Use Output mode only and set the acquisition cycle to 100 ms for smooth updates.

Alternative Approaches

Approach A: Direct DINT to Timer PT (No Conversion Block)

Because the Time data type and DINT share the same internal representation, the MOVE instruction in Step 3 is optional. You can wire the timer's PT input directly to the HMI DINT tag by declaring the timer PT as a DInt literal of the same DWord — but this defeats type safety. The recommended pattern is the explicit Ton1_PT tag of type Time with one MOVE.

Approach B: Two Separate I/O Fields (Seconds + Milliseconds)

For applications requiring integer-second entry with a millisecond trim field, use two HMI tags and combine them in the PLC:

// User enters integer seconds
"HMI_PresetSeconds" : DInt;  // operator value
// PLC combines
"HMI_TimerPreset_ms" := ("HMI_PresetSeconds" * 1000) + "HMI_PresetMilliseconds";

Approach C: Use a Comfort Panel Instead

SIMATIC Comfort Panels (TP700 Comfort, TP900 Comfort, TP1200 Comfort, TP1500 Comfort, TP1900 Comfort, TP2200 Comfort) and WinCC Runtime Advanced support the Time data type directly in HMI tags and I/O fields. If the application requires true time format display, upgrading the panel from a KTP Basic to a Comfort Panel removes the workaround entirely.

Verification

1. Download the PLC program and HMI project.
2. On the HMI, enter 2.500 in the preset I/O field.
3. In TIA Portal, go Online > Watch & Force Tables and confirm HMI_TimerPreset_ms reads 2500.
4. Confirm Ton1_PT reads 2500 (DINT 000009C4 hex).
5. Trigger the timer input; after 2.5 s, Ton1_Done should latch to TRUE.
6. Set HMI_TimerPreset_ms to 0 and confirm the timer never finishes (sanity check that PT is dynamic).
7. Test boundary: set HMI_TimerPreset_ms to 2,147,483,647 (max DINT); PT becomes T#24d_20h_31m_23s_647ms — within range.

Troubleshooting Matrix

Symptom	Likely Cause	Resolution
Tag does not appear in HMI tag selection	PLC tag is type Time or IEC_TIMER	Change PLC tag to DInt; create intermediate Time tag for PT
HMI shows 0.000 s but PLC has correct value	Scaling inverted or not applied	Verify HMI tag linear scaling: a=1, b=1000
HMI entry is exactly 1000× the displayed value	PLC already stores in ms but HMI tag has no scaling	Either apply HMI scaling or divide by 1000 in PLC before MOVE
Timer never finishes despite HMI value	Ton1_PT is wired to static constant, not the HMI tag	Verify MOVE source is HMI_TimerPreset_ms
Compile error: "Tag is not a valid HMI data type"	Trying to use Time-typed tag in HMI connection	Use DInt tag for HMI side; convert in PLC
Value jitters or updates slowly	Acquisition cycle too long	Set HMI tag acquisition to 100 ms or "Cyclic continuous"
Operator cannot edit field at runtime	I/O field mode set to Output only	Set mode to Input/output
Download fails with "Address conflict"	PLC tag address overlaps with another tag	Choose non-overlapping M or DB address

Performance and Cycle-Time Notes

The MOVE instruction adds negligible load — typically under 1 µs on an S7-1214C. The DINT→Time conversion in SCL is a compile-time type cast, not a runtime operation, so no additional OB1 time is consumed.

For multi-instance timer use (recommended for FBs), reference the S7-1200 manual section on Timer operation (IEC timers) when declaring the instance. The PT field of the multi-instance DB is still of type Time, and the same DINT-scaling workaround applies.

Field-Commissioning Checklist

• PLC tag HMI_TimerPreset_ms exists, type DInt, address defined
• PLC tag Ton1_PT exists, type Time
• MOVE block transfers HMI_TimerPreset_ms → Ton1_PT
• Ton block PT input is wired to Ton1_PT
• HMI tag HMI_TimerPreset_s points to PLC tag, scaling 1:1000
• I/O field on screen: input/output mode, 3 decimal places
• Online test with 1.000 s preset, 2.500 s preset, 10.000 s preset
• Boundary test with 0 (timer should never trigger)
• Document preset in the operator's manual with units "seconds"