Configuring WinCC Alarm Time Base with SIPROTEC IEC 103 Gateway

Symptom: a WinCC Alarm Control shows the correct GPS-synchronised time stamp on Came In and Went Out events, but the Acknowledged column on a separate Acknowledged-Alarm Picture Display Layer (PDL) shows a different time, often the WinCC station's local clock or a stale SNTP time. This article documents the root cause, the diagnostic path, the configuration fix in WinCC Alarm Control, and the verification steps for SIPROTEC protection-relay installations connected through a third-party gateway over IEC 60870-5-103 and OPC DA.

1. Problem Summary

Typical SCADA topology for a SIPROTEC substation:

• Multiple SIPROTEC 4 / SIPROTEC 5 protection relays (7UT, 7SA, 7SD, 7SJ, 6MD, 7SS).
• A protocol gateway or data concentrator (e.g. Kvaser DigiGate, HMS Anybus, Moxa MGate, Siemens SICAM PAS, or a vendor-specific RTU).
• WinCC V7.x or TIA Portal WinCC Comfort/Advanced SCADA station on a Windows OS.
• GPS clock providing IRIG-B, NTP, or serial time string to the gateway and WinCC station.

Reported behaviour:

The fact that the came-in and went-out columns are correct proves that SNTP, GPS reception, OPC channel health, and the IEC 103 protocol stack on the gateway are all functioning. The fault is isolated to the WinCC Alarm Control object on the acknowledged PDL.

2. System Architecture and Data Flow

Understanding the data path is required before touching any configuration.

GPS Clock
  |--- IRIG-B / NTP ---> Gateway (data concentrator)
  |--- SNTP / NTP ----> WinCC Station
                          |
                          v
                  WinCC OPC DA Client (OPCServer.WinCC)
                          |
                          v
                  WinCC Tag Management (internal tags)
                          |
                          v
                  Alarm Control (Came In / Went Out PDL)
                  Alarm Control (Acknowledged PDL) <-- distinct object
                          |
                          v
                  Operator acknowledgement (mouse click, key, or VB script)
                          |
                          v
                  WinCC writes "Acknowledged" with local station time

Critical observation: the gateway only forwards the IEC 60870-5-103 time tag bytes (CP56Time2a, 7-octet format) on the original event. The acknowledgement is a WinCC-internal action; the relay never sees it, and the gateway never sees it. WinCC writes the current station time into the acknowledged column.

This is also why the time on the acknowledged row can drift if the WinCC station loses SNTP connectivity: the relay-side times are still correct because the gateway remains synchronised, but the WinCC station's local clock has wandered.

3. Root Cause: Time Base Property on the Acknowledged Alarm Control

Every WinCC Alarm Control object carries a Time Base property that defines which time reference the object uses for display, sorting, and storage of events. The property is per-object, not per-database. Changing the time base on the Active Alarm PDL does not propagate to the Acknowledged Alarm PDL.

WinCC supports the following Time Base options on the Alarm Control:

When a new PDL is inserted from the WinCC Graphics Designer library, the default Time Base is Local Time. The Came In and Went Out events are stamped by the gateway with UTC seconds in CP56Time2a format; WinCC converts those to Local Time using the Windows time zone. The Acknowledged event, however, is captured at the moment of acknowledgement using the WinCC station's current Local Time. If the two Alarm Control objects disagree on Time Base, the displayed offset between event time and ack time equals the time-zone offset (or DST offset) between them.

Common observed mismatches:

• Came In shows 14:32:07 IST, Ack shows 09:02:07 UTC. Cause: Active PDL set to Local Time, Ack PDL left at default UTC (or vice versa).
• Came In shows 14:32:07, Ack shows 15:32:07 (one hour off). Cause: DST is being applied on one PDL but not the other because the time bases differ.
• Came In shows 14:32:07, Ack shows 14:32:11 (4-second drift). Cause: SNTP poll interval on WinCC station is too long, and the OS clock is allowed to free-run between polls. The relay and gateway SNTP poll remains tighter.

4. Pre-Diagnostic Checks

Run these four checks before opening Graphics Designer. Each one takes less than 30 seconds and isolates a different failure mode.

1. Confirm the WinCC station clock. Open a command prompt and run w32tm /query /status and w32tm /query /configuration. Verify that the time source is the same GPS-referenced NTP server the gateway uses, and that Last Successful Sync Time is within the poll interval (default 3600 s for Windows Time service).
2. Confirm the gateway clock. From the gateway web UI or serial console, read its internal time. It should match the GPS clock to within 100 ms.
3. Confirm a live event flow. In WinCC Explorer, open Tag Management > OPC > [your OPC channel] and use the diagnostics pane to confirm the OPC DA items for the SIPROTEC alarms are updating. Trip a test alarm on one relay and confirm it lands in the Active Alarm Control with the correct time.
4. Confirm the time zone on the WinCC station. Control Panel > Date and Time > Time Zone. Make sure DST is enabled or disabled consistently with the rest of the SCADA fleet. Mixed DST settings between Active and Ack PDLs are the most common single source of 1-hour offset.

5. Step-by-Step: Aligning the Time Base on the Acknowledged Alarm PDL

5.1 Open the Acknowledged Alarm PDL in Graphics Designer

1. In WinCC Explorer, expand Graphics Designer.
2. Open the PDL that hosts the Acknowledged Alarm list (commonly named @AlarmControl_Ack.pdl or similar).
3. Locate the Alarm Control object on the canvas. It is the WinCC Alarm Control, not the Microsoft ListView it wraps.

5.2 Open the Alarm Control Configuration Dialog

1. Right-click the Alarm Control and select Configuration Dialog (or double-click the object, depending on the WinCC version).
2. In the dialog, switch to the Message Blocks tab.
3. Note the columns currently selected: Date, Time, Acknowledgement Time, State. The relevant column for the mismatch is Acknowledgement Time.
4. Switch to the Parameters tab (this is where Time Base lives).

5.3 Set the Time Base Property

1. In the Parameters tab, find the Time Base property (in WinCC V7.x it is under Display > Time Base or directly visible as a dropdown in the property sheet, depending on service pack).
2. Select the value that matches the Active Alarm Control. If you do not remember what that value is, the correct choice for a SCADA display intended for operators is Local Time with the same DST setting as the station clock.
3. Click Apply, then OK.
4. Save the PDL.

5.4 Verify the Time Column Display Format

Even with the correct Time Base, a custom column format can mask the fix. In the Message Blocks tab, double-click the Time column header. Set the format string to:

dd.MM.yyyy HH:mm:ss

This forces a 24-hour local-time display, eliminating AM/PM ambiguity that has been known to give the appearance of a 12-hour offset in operator logs.

5.5 Repeat for Every Alarm Control on the Project

Open each PDL in the WinCC project that hosts an Alarm Control: Active Alarms, Acknowledged Alarms, Historical Alarms, Logged Alarms, and any operator-filtered subset. Set every Time Base to Local Time. Inconsistent Time Base values across PDLs is the single most common cause of acknowledged-time drift in a multi-PDL SCADA screen.

6. Verification Procedure

1. Save the PDL and activate the WinCC runtime.
2. Trip a test alarm on a SIPROTEC relay by forcing a binary input or using the relay's test mode. The alarm must appear in the Active Alarm Control with the correct GPS time.
3. Acknowledge the alarm from the operator station.
4. Open the Acknowledged Alarm Control. The Acknowledgement Time column should now match the Came In column to within one second (the round-trip delay between the operator click and the WinCC runtime writing the timestamp).
5. Repeat the test with a relay whose IEC 103 time tag is in a different DST season. The acknowledged time must follow the same DST rule as the active time.
6. Force a network outage between the WinCC station and the GPS NTP server. The relay and gateway still stamp the events correctly. The acknowledged time will start to drift in lockstep with the WinCC station OS clock. Restore NTP and confirm the drift stops within the next w32tm poll interval.

7. SNTP / NTP Time Synchronization Hardening

Once the Time Base is aligned, harden the time synchronisation so future drift is bounded.

7.1 Configure Windows Time Service to the Same NTP Server as the Gateway

w32tm /config /manualpeerlist:"192.168.10.5,0x9 10.10.0.5,0x9" /syncfromflags:manual /reliable:YES /update
w32tm /resync /rediscover

The example uses the 0x9 client mode flag and lists two NTP servers (one for the gateway NTP feed, one for a backup GPS receiver on the SCADA LAN). Replace with the IP addresses of the actual GPS-disciplined NTP servers on the substation LAN.

7.2 Tighten the Poll Interval

The default 3600 s poll interval is too coarse for protection event auditing. Reduce it to 60-300 s for SCADA stations and 15-60 s for gateway servers:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config" /v MinPollInterval /t REG_DWORD /d 6 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Config" /v MaxPollInterval /t REG_DWORD /d 10 /f
net stop w32time && net start w32time

The values 6 and 10 correspond to 2^6 = 64 s minimum and 2^10 = 1024 s maximum poll interval. Adjust to the operator's audit requirements.

7.3 Configure the Gateway SNTP

Every gateway vendor exposes a different menu, but the fields are common:

7.4 Configure SIPROTEC Relays for IEC 60870-5-103 Time Sync

On the SIPROTEC 4 (DIGSI 4) and SIPROTEC 5 (DIGSI 5) relay side, the time synchronisation source must be set to IEC 60870-5-103 or SNTP depending on the gateway implementation. Confirm in DIGSI:

• For SIPROTEC 4: Settings > Clock > Time synchronisation > Source = IEC 60870-5-103 master (the gateway acts as the 103 master and distributes the time).
• For SIPROTEC 5: Settings > Time > Time source 1 = SNTP, Time source 2 = IEC 60870-5-103. The relay prefers source 1 and falls back to source 2 if SNTP fails.

8. IEC 60870-5-103 Time Tag Reference

Each event arriving from a SIPROTEC relay carries a CP56Time2a tag (7 octets) defined in IEC 60870-5-4. The gateway passes this tag verbatim in the IEC 103 ASDU. WinCC converts it to the configured Time Base on display.

Note that CP56Time2a does not carry time-zone or DST information. The gateway stores all tags in UTC; the WinCC station applies the local time zone and DST at display time. This is why a Time Base mismatch between Alarm Control objects produces a clean integer-hour offset rather than a random drift.

9. OPC DA Channel Diagnostics

If the Came In time is correct but Acknowledged time is wrong, the OPC channel is exonerated. However, the OPC channel should still be sanity-checked, because a delayed event delivery (event queued in the gateway, late arrival to WinCC) will appear as a Came In time that is later than the actual relay event. Use the following checks.

1. In WinCC Explorer, open OPC > [your channel] > [your connection] and click Diagnostics. Verify Average Update Time < 200 ms and Error Count = 0.
2. For OPC DA 3.0 with subscriptions, set the Update Rate on the OPC group to 250 ms or faster for alarm-class items.
3. For OPC DA 2.0 legacy gateways, confirm the polling rate in the OPC channel properties; 500 ms is acceptable, 200 ms is recommended for protection events.
4. Open WinCC Tag Logging > Alarm Logging > Archive Configuration and confirm the archive size is large enough to retain 30+ days of events. Truncation can hide late-arriving events from the Ack PDL.

10. Parameter Reference Table

The following properties must be aligned across all Alarm Control objects in the project.

11. Troubleshooting Matrix

12. Edge Cases and Field-Proven Caveats

• Multi-monitor operator stations: if a single WinCC project is started on two stations with different Windows time zones (e.g. one in control room, one in engineering office) the Ack time will differ per station. Set both stations to the same time zone or implement a single-server WinCC Client configuration with a shared time base.
• Redundant WinCC servers: the Ack time written by the operator on the standby server will be the standby's local time, not the active server's time. Configure both servers with the same SNTP source and the same Windows time zone to keep the Ack time consistent across failover.
• Summer / winter time changeover: events that straddle the DST boundary will display different offsets if the Time Base is UTC on the Ack PDL. Verify the Ack PDL Time Base at the changeover and adjust if necessary.
• Time tags older than 1970: WinCC can reject CP56Time2a tags whose year rolls over. Configure the gateway to compensate the 1900-vs-2000 base year explicitly.
• Acknowledgement with a script: if acknowledgement is performed by a C or VBS script that writes a manual timestamp, the script overrides the WinCC station time. Audit the script and remove manual SetDateTime calls before changing the Alarm Control Time Base.
• User-time vs. server-time: on a WinCC Client/Server architecture, ensure the server's WinCC Alarm Control > Time Base is the authoritative source, not the client's local cache.

13. Acceptance Test Checklist

Use this checklist on every substation commissioning to prove the fix is in place.

1. All Alarm Controls in the project report the same Time Base value.
2. Operator station time, gateway time, and relay time all match the GPS reference within 1 second.
3. A test alarm forced from a SIPROTEC relay appears in Active Alarm Control with the correct time and in the Ack PDL with the same time after acknowledgement.
4. Alarm Logging archive Time Base matches the Alarm Control Time Base.
5. w32tm /query /status shows the GPS-disciplined NTP server as the time source.
6. SNTP poll interval on the WinCC station is ≤ 300 s.
7. DST setting on the WinCC station matches the fleet policy.
8. Redundant WinCC server pair (if present) reports matching times on both nodes.

14. Summary of the Fix

The Came In and Went Out time stamps come from the SIPROTEC relay via IEC 60870-5-103 and are converted by the gateway. They will always be correct as long as SNTP and the gateway time are healthy. The Acknowledged time stamp is generated by WinCC at the moment of acknowledgement using the local station clock. The mismatch is almost always a per-PDL Time Base misconfiguration on the Acknowledged Alarm Control. Open the Acknowledged Alarm PDL in Graphics Designer, double-click the Alarm Control, and set its Time Base to the same value used on the Active Alarm Control (recommended: Local Time). Repeat the audit for every Alarm Control in the project. With the Time Base aligned and the WinCC station's SNTP service pointing at the GPS-disciplined NTP server, all time stamps on the SCADA will agree with the GPS reference.