Actually, Giulietta, you were correct the first time; session-timeout is expressed in minutes. "... The specified timeout must be expressed in a whole number of minutes. If the timeout is 0 or less, the container ensures the default behaviour of sessions is never to time out. If this element is not specified, the container must set its default timeout period." from the Servlet 2.4 spec.
Also, timeout is not precise. It may take minutes more to actually timeout.