Resolving SICLOCK Time Jumps and Permanent Slave Mode on Redundant PCS 7 OS Servers

In SIMATIC PCS 7 V8.2, a redundant OS Server transitioning to permanent slave mode with diagnostic alarms such as "Time jump - switched to permanent slave mode (OS Server B)" and "CP1623.ISO.1 cannot receive time signal" occurs when time telegrams broadcast by a central SICLOCK TC400 master are corrupted, misconfigured, or filtered across the Plant Bus. When a PCS 7 OS Server configured as a time receiver detects a clock discrepancy exceeding the maximum allowable time jump threshold (typically 1000 ms), the WinCC Time Synchronization service permanently demotes the station to prevent chaotic archive fragmentation. Resolving the fault requires configuring the SICLOCK TC400 strictly for SIMATIC Mode (PCS 7-compatible 10-second broadcast), verifying CP 1623 HW Config time reception, and resetting internal status tags.

Time Synchronization Architecture with Central SICLOCK

Plant-wide deterministic time synchronization is mandatory in SIMATIC PCS 7 to ensure that process alarms, operator actions, and Tag Logging archives maintain strict sequence of events (SOE) across controllers and operator stations.

In standard architectures, a central hardware master clock—such as the SICLOCK TC400 (6MD1024-0AA00-0AA0) synchronized via GPS or DCF77—broadcasts high-precision time telegrams onto the Industrial Ethernet Plant Bus:
1. Plant Bus Tier: Controllers (S7-400 / CPU 410) and OS Servers receive time frames directly on the Plant Bus via their communications processors (CP 443-1 and CP 1623). Both OS Server A and OS Server B act as Slaves to the SICLOCK on the Plant Bus.
2. Terminal Bus Tier: OS Server A and OS Server B act as Time Masters toward OS Clients on the Terminal Bus, distributing time over standard Windows / NTP protocols.

Root Causes of Time Jumps and Permanent Slave Demotion

When OS Server B reports that it has switched to 'permanent slave mode', the WinCC Time Synchronization daemon has detected a severe timing inconsistency:

Diagnostic IndicatorSystem ObservationTechnical Root CauseResolutionTime jump - switched to permanent slave modeOS Server B stops synchronizing Terminal BusTime jump > 1000 ms detected against local hardware clockSynchronize local BIOS clock; check SICLOCK modeCP1623.ISO.1 cannot receive time signalCP 1623 reports zero valid SIMATIC framesSwitch multicast filtering or bad SICLOCK protocol modeConfigure SICLOCK for SIMATIC Mode; check VLANs@TimeSyncDevice1State = Empty / SlaveInternal tag indicates failed synchronizationTime master arbitration failure between Server A and BAlign HW Config CP 1623 time reception settingsAsymmetric RedundancyServer A is Master, Server B stuck in SlaveServer B rejects SICLOCK frames due to checksum errorUpdate SICLOCK firmware and re-initialize time service

If an operator or NTP client manually shifts the Windows system clock on Server B while Runtime is active, the time jump detection threshold is exceeded, triggering protective lockouts.

Hardware Configuration and WinCC Time Settings

Time synchronization configuration must match precisely between STEP 7 Hardware Configuration and WinCC Explorer:

CP 1623 Properties in HW Config:
- In SIMATIC Manager, open HW Config for OS Server A and OS Server B.
- Open properties for the CP 1623 card -> Options -> Time-of-day Synchronization.
- Verify that Time-of-day synchronization is enabled and set strictly to Slave (time receiver).
- Save, Compile, and download the PC station configuration.
WinCC Explorer Time Synchronization:
- Open WinCC Explorer on OS Server A and Server B.
- Open Time Synchronization editor.
- Under Access Point 1 (CP1623(ISO)), configure the server to receive time from the Plant Bus.
- Under Access Point 2 (Terminal Bus commercial NIC), configure the server to act as Master to transmit time frames to OS Clients.

SICLOCK TC400 Telegram Configuration and Reset Procedure

To configure the SICLOCK TC400 and clear the permanent slave fault:

Configure SICLOCK Broadcast Mode:
- Access the SICLOCK TC400 web management console or front keypad.
- Navigate to Ethernet Network Settings (ETH1).
- Under Telegram Type, select SIMATIC Mode (configured for PCS 7-compatible mode, every 10 seconds).
- Do NOT select S5-compatible mode or pure standard NTP on the Plant Bus ISO interface; CP 1623 in ISO mode requires SIMATIC SNAP layer-2 multicast frames (09-00-06-01-FF-EF).
Reset Permanent Slave Lockout:
- On OS Server B, deactivate WinCC Runtime.
- Correct the Windows local system clock in Control Panel to within 1 second of the true GPS time.
- Restart the SIMATIC WinCC Time Synchronization service (or reboot the OS Server).
- Reactivate WinCC Runtime.
Inspect Internal Status Tags:
- In WinCC Explorer -> Tag Management -> Internal Tags -> SplitScreenManager.
- Monitor @TimeSyncDevice1State and @TimeSyncDevice2State; confirm that Server A and Server B show valid synchronized operational states.

Verification

To verify reliable time synchronization across the redundant server pair:
1. In WinCC Explorer on OS Server B, open the Time Synchronization editor and verify that 'Synchronization active' is checked without error messages.
2. In the Windows Event Viewer and WinCC Diagnose window (apdiag.exe), verify that no new 'Time jump' or 'cannot receive time signal' events are logged.
3. Inspect @TimeSyncDevice1State on OS Server A and Server B; verify that both servers report healthy reception from the central master clock.
4. Verify that alarms generated on controllers display millisecond timestamps matching the OS Server alarm banner.

Limitations and Operational Precautions

Never adjust the system clock manually on a running PCS 7 OS Server or controller. Backward time jumps can corrupt SQL Server transaction logs, overwrite Tag Logging archives, and cause catastrophic historical data loss. If a massive time discrepancy exists, place all connected controllers in a safe state, shut down WinCC Runtime on all servers and clients, adjust BIOS clocks uniformly, and restart the system.

Engineer FAQ

Why does WinCC switch to permanent slave mode when a time jump occurs?

If an OS Server were to propagate a sudden backward or forward time jump to the rest of the plant, it would compromise alarm chronological order and corrupt historical databases. WinCC locks into permanent slave mode to isolate the erratic clock.

Can SICLOCK synchronize stations using NTP instead of SIMATIC mode?

Yes, on the Terminal Bus via standard IP network adapters. However, on the Plant Bus with CP 1623 running ISO protocol, SIMATIC Mode is required for hardware time-stamping.