But that doesn't work very well since he has an upper AND a lower bound to check. He'd have to LDD one, check it and save the result, then LDD the other limit, check, and combine. My first inclination is to do:
wad-o-logic --> and NO SP4 --> CNT C0 K9999
with appropriate reset, and range check CTA0. SP4 should be a differential contact to be sure not to count the same second multiple times if the timed event flashes on and off rapidly during the on-phase of SP4, but the differentials won't accept SP4 as an address, so you'd have to set up an intermediate coil and use the differential from that.
So the better solution is:
PLC 260
// Rung 1
// Address 0
STR X1
STRN SP1
TMRAF T0 K9999
// Rung 2
// Address 5
STR TA0 K100
STR C0
CNT CT0 K9999
// Rung 3
// Address 11
STR TA0 K100
MATHBCD TA0 "V0 - K100"
// Rung 4
// Address 29
STR CTA0 K1500
ANDN CTA0 K1800
OUT C1
#BEGIN ELEMENT_DOC
"X1","","","Event to Time"
"C0","","","Reset Condition"
"C1","","","Output"
"T0","","","Second Timer"
"CT0","","","Second Counter"
"CTA0","","","Seconds Elapsed"
#END
In the first solution, the counter mostly takes care of the accumulation, so you could get by with the SP4 contact (with differential logic) or a non-accumulating recycling timer. But the second one is better, because it's accumulating down to the 10ms/1 scan level, so you don't have to worry about phasing issues between the event being timed and SP4.
This way also minimizes scan-time dependency, because of only subtracting 100 from the timer ACC value if it's over 100, as opposed to actually resetting the timer. Otherwise, you'll accumulate error of 1/2 scan time per second.