Understanding WinCC Redundant OS Server Time Synchronization States and Detecting Rogue Bus Masters

In a SIMATIC PCS 7 redundant OS server pair synchronized by an external SICLOCK time master on the Plant Bus, both OS servers legitimately display '@TimeSyncDevice1State = Standby Master'. Because the external SICLOCK serves as the primary active time master, both WinCC servers remain in standby time-master mode while synchronizing their internal clocks to SICLOCK telegrams. If SICLOCK fails, the active WinCC OS master server transitions to 'Active Master' to transmit bus telegrams, while the redundant partner remains 'Standby Master'. Rogue bus masters can be detected using Wireshark filtering for Ethernet Type 0x8892 or SNAP SAP 0xFE.

PCS 7 Time Synchronization Architecture with External Master

In plant-wide SIMATIC PCS 7 installations, maintaining millisecond-precise time synchronization across Automation Stations (AS), OS Servers, and OS Clients is critical for chronological sequence of events (SOE) reporting.

The industry standard architecture employs an external dedicated hardware clock (such as a Siemens SICLOCK TC400 or TM) connected to the Industrial Ethernet Plant Bus. In WinCC Explorer -> Time Synchronization, the engineering configuration assigns:
* Access Point 1 (Plant Bus / CP 1623): Configured with the SIMATIC mode (time synchronization via ISO Industrial Ethernet multicast telegrams) or NTP mode.
* Master / Slave Definition: Both redundant WinCC OS servers are configured as time masters on the Plant Bus so they can act as fallback time transmitters if the central hardware clock fails.

Interpretation of @TimeSyncDevice1State Operating States

Engineers inspecting internal WinCC tags often observe that @TimeSyncDevice1State reports Standby Master on both Server A and Server B, assuming one should indicate "Active Master".

The runtime state machine operates as follows:
1. Normal Operation (SICLOCK Healthy):
* SICLOCK actively broadcasts time telegrams across the Plant Bus at regular intervals (typically every 10 seconds).
* Both OS Server A and OS Server B receive these telegrams, synchronize their operating system clocks, and evaluate the bus as externally mastered.
* Because an external master is healthy and broadcasting, neither WinCC server assumes active transmission duty. Therefore, both servers report Standby Master.
2. SICLOCK Failure / Cable Disconnection:
* Telegrams from SICLOCK cease.
* After the configured monitoring timeout expires, the OS Server holding active WinCC runtime master status promotes itself to Active Master and begins transmitting SIMATIC time telegrams to maintain AS synchronization.
* The redundant partner server remains in Standby Master mode, listening to the new active master.
3. Active OS Server Shutdown:
* If the active OS server is shut down for maintenance while SICLOCK remains offline, the standby partner server assumes the Active Master role.

Detecting Rogue SIMATIC-Method Time Masters on the Plant Bus

If time synchronization becomes unstable, or if system clocks jump erratically, an unauthorized or misconfigured device may be transmitting rogue SIMATIC time frames.

To detect and locate rogue time masters:
1. Wireshark Network Capture:
* Connect an engineering laptop to a mirrored switch port on the Plant Bus.
* Launch Wireshark and capture traffic on the industrial Ethernet interface.
* Apply one of the following capture filters:
* ether proto 0x8892 (PROFINET / Siemens Real-Time frames).
* llc[0:2] == 0xfefe (ISO-on-Ethernet SNAP SAP 0xFE used by SIMATIC time broadcast telegrams).
* eth.dst == 09:00:06:01:ff:ef (Siemens standard multicast address for time synchronization).
2. Identify Source MAC Address:
* Inspect the source MAC address (eth.src) of incoming time synchronization frames.
* If frames originate from a MAC address other than the SICLOCK hardware or the authorized OS servers, cross-reference the MAC address against HW Config to identify the rogue AS CPU, CP card, or third-party device.
3. Review WinCC TimeSync Diagnostics:
* Inspect the log file C:\Program Files (x86)\Siemens\WinCC\Diagnostics\TimeSync.log on both OS servers for warnings indicating "Telegram received from unexpected master".

Verification

In WinCC Explorer -> Tag Management, open internal tags and monitor @TimeSyncDevice1State. Confirm the value is Standby Master when SICLOCK is online.
Temporarily disconnect SICLOCK from the switch in a test environment.
Confirm that @TimeSyncDevice1State on the primary OS server transitions from Standby Master to Active Master within 30 seconds.
Reconnect SICLOCK. Confirm that the primary server relinquishes active transmission and returns to Standby Master.

Limitations and Operational Precautions

Never configure an AS (PLC CPU) as an active time master when an external SICLOCK or redundant OS servers are present on the same Plant Bus.
In virtualized environments, ensure that hypervisor guest time synchronization (e.g., VMware Tools time sync) is completely disabled on OS servers to prevent conflicting clock adjustments.
Ensure that the Terminal Bus and Plant Bus utilize separate physical network adapters (e.g., CP 1623 for Plant Bus and standard NIC for Terminal Bus).

Engineer FAQ

Is it a problem that neither server is 'Active Master'?
No. As long as SICLOCK is functioning, both servers must remain in Standby Master mode. Having a server act as Active Master while SICLOCK is active would create dual-master collisions.
What is the difference between SIMATIC Mode and NTP Mode?
SIMATIC Mode utilizes Layer 2 Ethernet multicast frames specific to Siemens controllers, achieving millisecond precision without IP overhead. NTP operates at Layer 3/4 via UDP port 123.
Can a redundant pair have two different external SICLOCK units?
Yes. High-availability installations can utilize dual redundant SICLOCK units configured in master/standby mode to eliminate single points of failure.

Technical References

SIMATIC PCS 7 Time Synchronization System Manual (A5E41356410-AA).
Siemens Industry Online Support Entry ID 109801081: Configuring Time Synchronization with SICLOCK and WinCC.
WinCC V7/V8 System Diagnostics and Redundancy Architecture Manual.