Based on the quite useful reverse engineered schematic at https://hackaday.io/project/174308-tradfri-pir-motion-sensor-hacking the measurements were somewhat sabotaged by the 2N7002 (see Connors comment "enables voltage dividers only when triggered").
the transistor is controlled by the Elmos E931.96 PIR motion controller IC.
The latter is programmable by the IKEA TRÅDFRI ICC-1 module's EFR32MG1P132F256GM32 MCU.
E.g.

2. Blind Time 
Ignores motion after the interrupt output is switched back to 0 
Range: 0.5s... 8s. 
The blind time is [Register Value] *0.5s 
 
3. Programmable pulse counter 
1... 4 pulses with sign change in between 
Amount of pulses = [Register Value] + 1 
 
4. Window time 
For noisy environments 
2s... 8s window 
Window time = [Register Value] * 2s + 2s

https://github.com/basilfx/TRADFRI-Hacking gives a good overview on that.

What is the issue with tose 60s?

With 1 probe to ground I tested:

Pos leg with dial at 1 minute (min): 2.97V
Pos leg with dial at 15 mins (max): 2.97V
Neg leg with dial at 1 minute (min): 2.96V
Neg leg with dial at 15 mins (max): 2.95V
Variable leg with dial at 1 minute (min): 2.96V
Variable leg with dial at 15 mins (max): 2.97V

Seems like a very small change.. is this enough of a change to be useful?

But, when I set the potmeter to minimum the Voltage = 2.95, and this doesn't change... the potmeter set to max is still 2.95V... :disappointed:

So with one probe on the variable leg, where to I test with the other probe?

Always to ground

@bob21 said in Modifying IKEA Tradfri Sensor (E1525) timeout help wanted:

It looks like the variable leg first goes to TP5_1, then to TP5_2, then to the MCU, but it is not clear which pin: https://imgur.com/a/hbgOOBU

With the continuity function of your multimeter (when it beeps if you short the probes) you can trace where it goes to.

I am looking at the potmeter, and I think I can fairly say the legs are like this: https://imgur.com/a/1bTBnUo

So with one probe on the variable leg, where to I test with the other probe?

It looks like the variable leg first goes to TP5_1, then to TP5_2, then to the MCU, but it is not clear which pin: https://imgur.com/a/hbgOOBU

Edit
Now you should find out where this third leg is going to

All 3 potmeter legs to MCU (blue): 2.9V - Does not change when potmeter moved
All 3 potmeter legs to MCU (red): ~0.2mV-0.3mV - Does not change when potmeter moved

Resistance:

Top green on potmeter to MCU (red): 67K (turning dial does not change)
Bottom green dot on potmeter to MCU (red): 67K at max time, 110K at minimum time
Unmarked leg to MCU (red): 110K and does not change when potmeter moved

The Blue pin, which I originally said was connected to the VDD pin appears to actually be connected to the ground shield over the chip - I got a reading of zero. The Red pin, I got a reading of 3V (there abouts) and this is the one connected to the VDD pin on the E93196. Turning the potentiometer did not change the voltage on this.

I remeasured the resistance from the ground leg of the potmeter to top green dot is 77K, bottom green dot is zero when at 1 minute, both are at 77K when at 15 minutes

Looks like I can get some continuity between these points: https://imgur.com/a/PKPOJdk

So that would be connecting connecting VDD to ground?

But, with a DMM set to 200k, I get a resistance reading of 66.7 between these points: https://imgur.com/a/4K0NPbP because of R12....

Could this be the resistance that is putting that to 60 seconds? Could I connect those 2 green points? Or remove that Resistor and bridge with solder?

Ok understood. I have traced the other 2 legs.. One looks like a common between the 2 potentiometers, so input voltage? And the other appears to go to the MCU

https://imgur.com/a/fjbcjA3