Explaining Timestamp Discrepancies Between Alarm Lists and Trend Curves in SIMATIC PCS 7

In SIMATIC PCS 7, timestamp discrepancies between the alarm list and trend curves during plant trip investigations occur because alarms and analog archive tags use fundamentally different timestamping sources and sampling mechanisms. Process alarms generated by AS blocks (such as ALARM_8P) receive millisecond-accurate timestamps in the automation station CPU when the trip threshold is crossed. In contrast, trend tags are sampled by the WinCC OS Server according to configured acquisition cycles (e.g., 1 to 5 seconds) and filtered by compression algorithms like Swinging Door, creating apparent multi-second offsets.

Disparate Timestamping Mechanisms in PCS 7 Architectures

During post-incident forensic analysis of a plant trip, engineers frequently observe that the trip alarm in the Sequence of Events (SOE) or Alarm Logging window indicates one timestamp (e.g., 23:44:50.120), whereas trend curves in WinCC Trend Control show the process variable plunging 5 to 12 seconds later (e.g., 23:45:02).

This time skew is caused by the interaction of three distinct architectural layers:

1. AS Event Timestamping (Alarm Logging)

Protection and trip alarms are generated within the S7-400 / S7-410 controller using standard system function blocks (ALARM_8P / Alarm_DQ inside APL blocks like MonAnL or MotL).
The AS timestamps the alarm event at the exact cyclic interrupt execution cycle (e.g., OB35 running at 100ms) with millisecond precision.
The message packet containing the immutable AS timestamp is transmitted via raw data packets to the WinCC OS Server.

2. OS Server Cyclic Archiving (Tag Logging)

By default, WinCC Tag Logging acquires analog process values via cyclic polling from the OS Server over the Plant Bus.
Acquisition Cycle: The interval at which the OS reads the variable from the CPU (typically configured as 500ms, 1s, or 2s).
Archiving Cycle: The interval at which values are evaluated for storage into the Microsoft SQL Server historical database (typically 1s, 5s, or longer).
The timestamp attached to the archive tag is generated by the WinCC OS Server clock, not by the AS CPU, at the moment the sample is processed.

3. Data Compression and Smoothing (Swinging Door)

WinCC Tag Logging supports the Swinging Door algorithm to optimize archive disk space.
If process values remain within configured slope tolerance bands, intermediate samples are discarded, and only significant deviation points are recorded. This can cause recorded curve inflection points to lag behind instantaneous discrete trip events by several archiving cycles.

+-------------------------------------------------------------+
| AUTOMATION STATION (AS)                                     |
| Fault Condition Occurs -> ALARM_8P Timestamps Event:        |
| Millisecond precision (AS CPU Clock: 23:44:50.125)          |
+-------------------------------------------------------------+
                              |
                              v Raw Event Message Packet
+-------------------------------------------------------------+
| PLANT BUS (SIMATIC Time Sync Required)                      |
+-------------------------------------------------------------+
                              |
                              v
+-------------------------------------------------------------+
| OPERATOR STATION (OS SERVER)                                |
| 1. Alarm Journal: Displays Immutable AS Timestamp           |
| 2. Tag Logging: Polled every 2s, Archived every 5s,         |
|    Compressed via Swinging Door (OS Clock: 23:45:01)        |
+-------------------------------------------------------------+

Investigation and Diagnostic Procedure for Trip Analysis

Follow this procedure to reconcile timestamps and establish the true sequence of events during a plant incident.

Prerequisites

Access to WinCC Explorer on the OS Server or an OS Client with administrative privileges.
Plant Bus time synchronization status verified across all controllers and servers.

Step 1: Establish Primary Authority from Alarm Logging

Always treat the Alarm Logging event timestamp as the absolute chronological authority for discrete trips, interlock trips, and operator actions.
In the WinCC Alarm Control, filter the view to display the 60-second window surrounding the incident.
Review the exact millisecond values to construct the cause-and-effect sequence (e.g., Low-Low Level Trip at 23:44:50.120, followed by Pump Trip Feedback at 23:44:50.350).

Step 2: Inspect Tag Logging Acquisition and Archiving Cycles

In WinCC Explorer, open Tag Logging.
Locate the analog archive tag associated with the trip variable (e.g., LT_101_PV).
Inspect the configured properties:
* Acquisition type: Confirm whether set to Cyclic, continuous.
* Acquisition cycle: Check the sampling frequency (e.g., 1 s or 2 s).
* Archiving cycle: Check the write frequency (e.g., 5 s). An archiving cycle of 5 seconds inherently introduces up to 5 seconds of display delay.

Step 3: Inspect Swinging Door Compression Parameters

In Tag Logging tag properties, check if Swinging Door algorithm is enabled.
If enabled, review the Deviation threshold. A wide tolerance band suppresses data points during slow transitions, recording a point only after rapid acceleration occurs, distorting the apparent onset time.
For mission-critical trip signals, reduce the archiving cycle or disable compression to capture higher-resolution transitions.

Step 4: Verify Plant Bus Time Synchronization

If the difference between alarms and trends exceeds the sum of the archiving cycle and compression window (e.g., offset is 30 seconds or multiple minutes), check for time synchronization drift.
Verify that the AS and OS clocks are synchronized via SIMATIC Time Synchronization or NTP to a master clock (e.g., SICLOCK or central NTP server).

Verification

In WinCC Runtime, open an active Trend Control and an Alarm Control side-by-side.
Trigger a controlled test trip (or adjust an analog setpoint past a limit).
Confirm that the alarm appears immediately with the current AS time.
Verify that the trend curve registers the shift within the duration of exactly one acquisition/archiving cycle.
Check the WinCC diagnostic file WinCC_Sys_01.log to confirm that time synchronization messages report Time synchronized with Master without time jump warnings.

Limitations and Operational Precautions

Tag Logging Bandwidth Limits: While setting all analog tags to 100ms archiving would eliminate trend delays, doing so overwhelms the SQL Server database engine. Siemens recommends an aggregate logging limit of approximately 1,500 archive tags per second per OS Server.
Process-Driven Archiving: For critical variables requiring cycle-accurate correlation with alarms, configure Process-Driven Tag Archiving (using AR_SEND blocks in CFC) so that the AS CPU bundles timestamped analog samples directly into data blocks and pushes them to the OS.
Never Rely on Ruler Tools for Sub-Second Forensic Audits: WinCC Trend Control interpolation between discrete archive points creates visual curves that do not reflect exact millisecond trip instances.

Engineer FAQ

Which timestamp should be submitted to regulatory or incident audit teams?
Always report the timestamp from the Alarm Logging Sequence of Events (SOE). It represents the true hardware-detected trip instance recorded at the AS CPU level.
Can analog trends achieve millisecond accuracy like alarms?
Yes, but only by implementing process-driven archiving using the AR_SEND block (FB 44) in CFC, where the S7 CPU timestamps each analog value in real time. Standard cyclic WinCC Tag Logging cannot achieve millisecond precision.
Why did the trend show sudden changes 10 seconds after the alarm?
A combination of a 5-second acquisition cycle, a 5-second archiving buffer, and Swinging Door compression delay accounts for a 10 to 12-second visual offset on standard trend controls.
Does GPS time synchronization eliminate this difference?
GPS synchronization ensures that the AS clock and OS clock agree to the millisecond. However, it does not change the fact that cyclic tag logging samples data at multi-second intervals.
What is the default archiving cycle in PCS 7?
By default, PCS 7 standard wizard creates archive tags with a 1-second or 2-second acquisition cycle and a 1-second to 5-second archiving cycle depending on template selections.

Technical References

Siemens Industry Online Support Entry ID 109760739: Process Data Archiving and Swinging Door in WinCC / PCS 7.
Siemens System Manual: SIMATIC Process Control System PCS 7 - Time Synchronization.
Siemens WinCC V7.5 Manual: Archiving Process Values (Tag Logging).

Explaining Timestamp Discrepancies Between Alarm Lists and Trend Curves in SIMATIC PCS 7