Configuring Dual Plant Bus Time Synchronization: Resolving Partial AS Synchronization with Redundant OS Servers

In SIMATIC PCS 7 multiprojects utilizing dual separated Industrial Ethernet Plant Bus networks (with dual CP 1623 cards in each redundant OS Server), the failure of 2 out of 4 S7-400 CPUs to synchronize time occurs because the WinCC Time Synchronization Editor is configured with only one active Access Point (CP 1623 #1 on Plant Bus 1). In dual-bus architectures, WinCC must be configured with both Access Point 1 and Access Point 2 enabled as time masters. Additionally, in HW Config for each AS station, the CP 443-1 connected to Plant Bus 2 must have SIMATIC Mode time synchronization enabled as a 'Slave', and the CPU's MPI/DP interface must be set to synchronize on the internal communications bus.

Time Synchronization Architecture in Dual Plant Bus Topologies

To eliminate single points of failure in high-availability PCS 7 installations (such as power generation or offshore oil platforms), facilities deploy Dual Plant Bus networks. Rather than a single Ethernet ring, two completely physically separated Industrial Ethernet networks exist (Plant Bus 1 and Plant Bus 2).

In this architecture, redundant OS Servers house two communications processors (e.g., CP 1623 #1 and CP 1623 #2), and each S7-400 controller connects to both subnets via dual CP 443-1 modules (or redundant sub-racks in an S7-400H). When using the OS Servers as time masters without a central GPS/NTP master clock, WinCC must broadcast time frames into both physical networks.

Why Dual CP 1623 Servers Require Dual Access Point Time Broadcasting

A frequent commissioning flaw occurs when an engineer configures WinCC Time Synchronization and selects only Access Point 1 (pointing to CP 1623 #1):

OS Server Master broadcasts SIMATIC time frames out of CP 1623 #1 into Plant Bus 1.
S7-400 controllers whose primary CP 443-1 listens on Plant Bus 1 receive the broadcast and synchronize perfectly.
S7-400 controllers or sub-racks whose time-slave CP 443-1 resides on Plant Bus 2 receive zero time telegrams. Their internal clocks drift, resulting in out-of-order sequence-of-events alarms and archiving discrepancies in WinCC.

Configuring WinCC Time Synchronization Editor on Redundant Servers

To configure WinCC to broadcast time across both physical network adapters:

In WinCC Explorer on the master OS Server, open Time Synchronization.
Check the box Synchronization via Industrial Ethernet (SIMATIC Mode).
Under Access Point 1, select the network connection bound to CP 1623 #1 (Plant Bus 1). Set 'Operate as: Master'.
Check the box Access Point 2.
In the drop-down menu, select the network connection bound to CP 1623 #2 (Plant Bus 2). Set 'Operate as: Master'.
Set the broadcast cycle (typically 10 seconds).
Repeat this identical configuration on the standby redundant OS Server (setting both access points to Master, as WinCC Redundancy arbitrates active mastership automatically).

Configuring CP 443-1 and S7-400 CPU Synchronization in HW Config

On each of the 4 automation stations in HW Config:

Configure Both CP 443-1 Modules: Double-click CP 443-1 on Plant Bus 1. Navigate to the Time-of-Day Synchronization tab. Check 'Activate time-of-day synchronization' and select SIMATIC Mode (as Slave). Repeat this configuration on the second CP 443-1 connected to Plant Bus 2.
Enable CPU Backplane Synchronization: Double-click the S7-400 CPU to open Object Properties. Navigate to the Diagnostics/Clock tab. Under Clock, set Synchronization Mode to As Slave on the internal communications bus (K-Bus/MPI).
Save, Compile, and Download: Save and compile HW Config and download to all 4 AS stations.

Time Synchronization Topology and Configuration Matrix

The following table compares time synchronization settings across dual-bus components:

Hardware ComponentNetwork InterfaceSynchronization ModeProtocol StandardCritical ParameterOS Server MasterCP 1623 #1Time MasterSIMATIC Mode (Layer 2)Access Point 1 activeOS Server MasterCP 1623 #2Time MasterSIMATIC Mode (Layer 2)Access Point 2 activeAS CP 443-1 (Rack 0)Connected to Bus 1Time SlaveSIMATIC ModeForward time to backplaneAS CP 443-1 (Rack 1)Connected to Bus 2Time SlaveSIMATIC ModeForward time to backplaneS7-400 CPUInternal K-BusClock SlaveS7 Backplane ProtocolClock sync 'As Slave' in HW Config

Verification

Verify plant-wide time synchronization through the following steps:

In SIMATIC Manager, connect online to each of the 4 CPUs. Open PLC > Diagnostic/Setting > Set Time of Day.
Compare the Module Time across all 4 CPUs against the Windows system clock of the master OS Server. All 4 CPUs must display identical hours, minutes, seconds, and milliseconds (+/- 10 ms).
Check the CPU Diagnostic Buffer on all 4 controllers. Confirm that no 'Time-of-day synchronization error' entries exist.
Simulate a digital trip on an I/O card connected to AS 1 and another on AS 4. In WinCC Alarm Logging, verify that both events register with correct chronological order.

Limitations and Operational Precautions

Consider these operational rules when configuring time synchronization:

Never Configure Two Uncoordinated External NTP Masters: If external NTP servers are used, ensure they reference the exact same GPS clock stratum; conflicting time telegrams cause CPU clocks to jump erratically back and forth.
SIMATIC Mode vs NTP Mode Conflict: Never mix SIMATIC Mode (layer 2 MAC broadcast) and NTP Mode (UDP port 123) on the same physical CP 443-1 card; choose one standard universally.
Time Zone Offset: Set all S7-400 CPUs to UTC time in HW Config, and configure WinCC to handle local time display offsets.