Fixing Siemens 6ES7 972-0AB01-0XA0 Diagnostic Repeater Time Sync

Problem Description

The SIMATIC Diagnostic Repeater for PROFIBUS-DP, order number 6ES7 972-0AB01-0XA0, carries an internal software real-time clock used to time-stamp every diagnostic event it logs - wire breaks, short circuits, segment dropouts, missing terminations, and topology faults. The clock is not bus-synchronised and is not adjusted by the normal cyclic PROFIBUS I/O exchange. Field engineers discover the problem only when they read out the diagnostic buffer and see that every entry is stamped 01.01.1994 00:00:00 or drifts by hours or days relative to the CPU clock.

Typical symptoms reported from the field:

• Diagnostic buffer entries stamped 00:00:00 01.01.1994 even on a brand-new, freshly commissioned repeater
• Date of an event is correct, but the time-of-day is off by the offset between UTC and the plant time zone
• Clock resets to 01.01.1994 every time the 24 V supply to the repeater is interrupted
• Manual time adjustment attempted from STEP 7 "Online & Diagnostics" or from TIA Portal "Online & Diagnostics" produces no change
• TimeSet and other CPU-side clock instructions update the CPU clock correctly but have no effect on the repeater

Time-of-day and date are written together as a single structure to the repeater. Partial writes are rejected by the firmware. The repeater has no battery, no supercapacitor, and no on-board RTC backup, so the clock is purely volatile: it falls back to 00:00:00 01.01.1994 on every power-up. The plant effect is that diagnostic event correlation against the SCADA historian becomes meaningless, and audit trails for PROFIBUS segment faults lose the correct shift/day boundary.

Root Cause

The diagnostic repeater exposes clock-setting exclusively through the DP-V1 acyclic channel at slot 0, index 60. A pure DP-V0 master that performs only cyclic Read/Write of process data cannot deliver the required write request, even if the GSD imports cleanly and the device is in the hardware catalog. The repeater does not support the PROFIBUS time-master / time-slave protocol pair defined in IEC 61158-6, so a CPU that only sends cyclic I/O will never push the correct time into the repeater.

The clock structure is addressed as Data Record 60 (DS 60). It is a single non-volatile write buffer that holds the full date + time-of-day + day-of-week structure; the buffer cannot be written field-by-field, and a wrong byte layout causes the write to be rejected with a negative DDLM acknowledgement. Because the buffer is volatile across power cycles, every cold start of the repeater must be followed by a fresh DS 60 write from the CPU.

Three classes of failure produce the user-visible symptom:

1. Master is DP-V0 only. The cyclic I/O exchange works, but the master has no acyclic write channel, so the time is never set.
2. Master is DP-V1 capable but the application never issues a WR_REC / WRREC call. The hardware is ready, but the application logic is missing.
3. Master is DP-V1 capable and the application calls WR_REC / WRREC, but with wrong slot, wrong index, or wrong record length. The write is rejected silently, and the diagnostic buffer stays at 01.01.1994.

Affected Hardware and Firmware

Reference: Basic information on the diagnostic repeater (TIA Portal V20) and the Control Engineering diagnostic-repeater field overview describe the same architecture: the device sits between two RS-485 segments, monitors the segment for electrical and topology faults, and exposes its findings only through DP-V1 acyclic services.

Diagnostic Repeater Time Architecture

The repeater maintains a software RTC inside its microcontroller. Time is used solely to stamp events written to the internal diagnostic log; it is not used for any bus timing, token rotation, or slot-time arithmetic. There is no time-master functionality, no time-slave broadcast listener, and no SIMATIC time protocol. The only legitimate path into the clock is a single acyclic write of Data Record 60 over the DP-V1 channel.

Data Record 60 carries the full time structure (date + time-of-day + day-of-week) as a single packed structure. The repeater rejects the record if any of the following are true:

• The master does not have DP-V1 capability
• The slot / index is wrong (must be slot 0, index 60)
• The record length does not match the GSD-defined length for the device revision
• The day-of-week field is inconsistent with the calendar date (firmware cross-check)

Once accepted, the time is held until the next power-down. There is no heartbeat from the CPU; if the CPU clock drifts by 1 second, the repeater clock will drift by 1 second. Periodic re-sync is the only way to keep both clocks aligned.

DP-V1 Acyclic Communication Background

PROFIBUS-DP V1 (IEC 61158 / IEC 61784) extends the original DP-V0 cyclic I/O exchange with acyclic Read/Write services. Acyclic services travel on the same wire but use separate MSAC2 connections established after the cyclic data exchange is up. The diagnostic repeater terminates MSAC2 and exposes a single diagnostic slot with the standard data record map; Data Record 60 is reserved for clock set, and Data Records 0..n are reserved for diagnostic data, statistics, and topology information.

To write the clock the master must:

1. Open an MSAC2 connection to the repeater's diagnostic slot during start-up
2. Issue a DDLM_Write with slot 0, index 60, and length matching the GSD definition (typically 8 bytes for the time structure)
3. Wait for the DDLM_Write_Reply with positive or negative confirmation
4. Close or maintain the MSAC2 connection as configured

S7 CPUs do not expose the raw MSAC2 primitives; they are reached through the system function blocks SFC58 (WR_REC) and SFC59 (RD_REC) on S7-300/400, or RDREC and WRREC on S7-1200/1500. The slot, index, and record length are passed as parameters to these blocks.

S7-300/400 Solution: SFC58 WR_REC

For an S7-300 or S7-400 acting as DP-V1 master, call SFC58 "WR_REC" with the repeater's diagnostic address as LADDR, slot 0, and record number 60. Populate the source buffer with the time structure defined in chapter 2.5 of the Diagnostic Repeater manual.

// S7-300/400 STL, call from OB1 or OB100
CALL  SFC  58                  // WR_REC
REQ   := TRUE                  // start write on every scan or on rising edge
IOID   := B#16#54              // I/O identifier: B#16#54 = input side, B#16#55 = output side
LADDR  := W#16#03E8            // diagnostic address of the repeater (e.g. 1000 decimal)
RECNUM := B#16#3C              // record 60 decimal
RET_VAL:= MW  100              // return value / STATUS
BUSY   := M  101.0             // BUSY flag
REC    := P#DB 50.DBX 0.0 BYTE 8  // source buffer, 8 bytes per GSD

Parameter notes:

• IOID must match the slot side the GSD assigns to the diagnostic record. For a repeater, it is almost always B#16#54.
• LADDR is the diagnostic address, not the PROFIBUS station address. STEP 7 shows it in the device properties of the repeater; it is typically one byte above the I/O start address.
• RECNUM = B#16#3C (60 decimal) for the clock; B#16#00..B#16#3B are reserved for diagnostic data records.
• REC must be a non-optimised, non-symbolic-access DB or bit-memory area. S7-300/400 STL cannot pass an S7-1200/1500 optimised DB.

Return value analysis (RET_VAL when ERROR = 0):

S7-1200/1500 Solution: WRREC

On S7-1200 and S7-1500, the equivalent is the WRREC instruction. Drop it on a cyclic OB (OB1) and trigger it on cold-start or after a power-good edge of the repeater. Use the device's HW identifier from the device configuration; do not pass a logical address.

// SCL, TIA Portal V16 or later
"WRREC_DB"(
    REQ    := "start_sync",                // BOOL trigger
    ID     := "diag_repeater_HW_ID",        // HW identifier from device configuration
    INDEX  := 60,                            // record 60 decimal
    MLEN   := 8,                             // length in bytes per GSD
    DONE   => "sync_done",
    BUSY   => "sync_busy",
    ERROR  => "sync_err",
    STATUS => "sync_status",
    RECORD := "time_structure"              // P#DB or P#M area, 8 bytes
);

Trigger WRREC from a one-shot in OB100 (warm restart) or OB101 (hot restart) so that every CPU cold start automatically refreshes the repeater clock. Add a periodic OB (e.g. OB35 at 5 s) call to recover from any inadvertent time loss in service.

STATUS analysis (when ERROR = 1):

STEP 7 Classic Configuration

Before the application code can write DS 60, the repeater must be added to the PROFIBUS network in HW Config with the right GSD. The required steps in STEP 7 V5.x:

1. Open HW Config and add the repeater from the catalog under PROFIBUS-DP > Repeater > Diagnostic Repeater. The GSD file SIEM81B1.GSD ships with STEP 7.
2. Assign a unique PROFIBUS station address. Address 1 is the default but is usually reserved for the master; addresses 2..126 are available.
3. In the device properties, open Diagnostic Address and note the diagnostic address. This is the value to pass as LADDR to SFC58.
4. Drag the "Time sync" record from the slot assignment to slot 0 (or confirm the GSD places it at slot 0 by default).
5. Compile and download the hardware configuration. The repeater should appear in Accessible Nodes with the correct diagnostic address.
6. Build the DB that holds the 8-byte time structure and call SFC58 in OB100 with a one-shot trigger.

TIA Portal Configuration

In TIA Portal V16 or later the procedure is similar but uses the device view and the WRREC/RDREC instructions:

1. Open the project and the device view of the S7-1200/1500 CPU.
2. Drag the Diagnostic Repeater for PROFIBUS-DP from the catalog onto the PROFIBUS subnet of the CPU/CM 1542-5 / CP 1542-5.
3. Open the device properties and confirm that the Diagnostic address is set; this is the "HW identifier" TIA exposes to WRREC as the ID parameter.
4. Under Module parameters > Time-of-day confirm the slot the GSD assigns to the time record; for 6ES7 972-0AB01-0XA0 it is slot 0.
5. Add a global DB of 8 bytes to hold the time structure and call WRREC with INDEX = 60, MLEN = 8.
6. Place the WRREC call in OB100 and in a periodic OB (e.g. OB35 at 5 s).

The TIA Portal V20 reference for the diagnostic repeater is published in the Siemens documentation portal at Basic information on the diagnostic repeater (V20) and describes the same DP-V1 acyclic path.

TI Series PLC Limitations

The TI 500/505 series and TI 505-to-PROFIBUS gateways do not implement DP-V1 acyclic write to slave slot 0. The TI controller's PROFIBUS option exposes the DPS function block, which supports DP-V1 acyclic read but not the matching write. The TISOFT programming environment provides TimeSet for the CPU's own RTC, but no equivalent for downstream PROFIBUS devices, and no NTP client. As a result, the time cannot be pushed from a TI master into the diagnostic repeater.

The TISOFT manual confirms the gap: time-setting instructions operate only on the local CPU clock, and the PROFIBUS option's DPS block returns read-only data from the bus. There is no built-in way to write a slave's data record 60. The hardware is fully DP-V1 capable on the Siemens side, but the TI master cannot issue the request.

Workarounds for TI installations:

• Add an S7 co-master. Install an S7-1200/1500 CPU with a CM 1542-5 / CP 1542-5 as a second DP-V1 master on the same segment, dedicated to writing DS 60 on every power-up. The S7 co-master does not need to own the I/O exchange; it only needs to write the clock record to the repeater.
• Replace the repeater. A PROCENTEC COMbricks head station has a battery-backed RTC, an integrated Ethernet port, and accepts NTP. It will keep the segment time correct across power cycles without CPU intervention.
• Accept the fallback date. Leave the time at 01.01.1994 and use only the relative time between events in the diagnostic buffer for troubleshooting. This is the cheapest option but provides no absolute time correlation.

COMbricks Alternative

PROCENTEC's COMbricks repeater head station has a battery-backed RTC and an integrated 10/100 Mbit Ethernet port. It supports NTP over the Ethernet management port, and can forward the synchronised time to the local PROFIBUS segment. The diagnostic log timestamps remain stable across power cycles of the COMbricks itself, and the COMbricks can also serve as a passive tap to a SCADA system over Modbus TCP for live diagnostic data.

The COMbricks replaces the Siemens diagnostic repeater 1:1 in segment topology, but exposes a different GSD, so the master's GSD import must be updated and the device configuration recompiled. Consider COMbricks when:

• The master cannot perform DP-V1 writes (TI/Modicon/legacy)
• Multiple diagnostic repeaters on the same plant must remain synchronised
• An NTP source is available on the plant network
• The site needs live diagnostic data over Ethernet, not just a logged buffer

The COMbricks approach is the most expensive of the three workarounds but eliminates the per-power-up CPU-side write code and gives the plant an Ethernet-facing diagnostic tap for free.

Time-Sync Behaviour Across Power Loss

The 6ES7 972-0AB01-0XA0 has no RTC battery. Every power-down erases the clock and on the next power-up the repeater reports 00:00:00 01.01.1994 again. The clock write must therefore be repeated on every cold start, not just on first commissioning. Best practice is to trigger WRREC from OB100 (restart) and to retrigger it from a periodic OB (e.g. OB35 at 5 s) so that any inadvertent loss of time is corrected automatically.

For a plant with frequent, brief power interruptions, a 5-second re-sync is cheap (one MSAC2 write) and prevents the operator console from showing 01.01.1994 after a 30-second outage. For a plant with stable 24 V supplies, a 60-second re-sync is sufficient.

Periodic Re-Sync Strategy

The recommended re-sync strategy depends on the master platform:

Verification Steps

1. Open STEP 7 or TIA Portal and connect online to the CPU.
2. Navigate to Accessible Nodes and read the diagnostic buffer of the repeater.
3. Confirm the most recent event timestamp matches the CPU clock within ±2 s.
4. Power-cycle the repeater (24 V off, wait 10 s, 24 V on).
5. Wait 30 s for OB100 to fire on the CPU and the WRREC to complete.
6. Re-read the diagnostic buffer and confirm the timestamp is no longer 01.01.1994 and matches the CPU clock within ±2 s.
7. Disconnect the CPU from the network, reconnect after 1 minute, and confirm the timestamp refreshes from OB100 on the new CPU start-up.

If the timestamp remains stuck at 01.01.1994 after a power-cycle, the most likely cause is that the WRREC/SFC58 call is being made before the MSAC2 connection is open (early in OB100, before the PROFIBUS stack has completed start-up). Insert a startup delay of 5-10 s before the call, or trigger it from OB1 once the device reports "OK" status.

Troubleshooting Matrix

Best Practices

• Trigger the time write from OB100 (cold start) and from a periodic OB (5-60 s) so that power cycles and slow drifts are handled automatically.
• Build the 8-byte time structure from the CPU's RTC and convert UTC explicitly; do not rely on the CPU's local-time flag for DS 60.
• After writing, read back Data Record 60 with SFC59 / RDREC to confirm the write actually took effect; do not rely on STATUS = 0 alone.
• For multi-master segments, designate one master as the "clock owner" and lock the other masters out of DS 60 to avoid a 0x80D0 lock conflict.
• Document the re-sync interval in the plant's PROFIBUS maintenance procedure. Operators will look at the diagnostic buffer during a fault, and stale timestamps are the most common complaint.
• For TI installations, do not spend time hunting for a TI-side fix; the TI PROFIBUS option has no write path. Add an S7 co-master or replace the repeater with a PROCENTEC COMbricks head station.

Frequently Asked Questions