Resolving CP1623 Safety Matrix UTC Time Display in PCS 7

1. Problem Statement: Safety Matrix Event Log Shows UTC While HMI Shows Local Time

In a redundant PCS 7 V7.1 SP2 OS Server pair, each station is equipped with two CP1623 communications processors. After commissioning per the Siemens recommended procedure, the following symptoms are reported in the field:

• WinCC Runtime alarm list and tag logging display local time (UTC+2 in the reference case, e.g. CET / CEST, or UTC+3 in cases such as Egypt prior to DST suspension).
• The Safety Matrix viewer, opened from the integrated WinCC picture, displays the PLC timestamp (UTC) instead of local time.
• The Safety Matrix event viewer (opened from the SM viewer toolbar) also records event times in UTC.
• The CP1623 configuration console (SIMATIC NET Configuration Console) shows the local time of the CP1623 itself as UTC, regardless of the OS regional settings.
• Operators therefore see an alarm at 08:00 local time and a corresponding Safety Matrix trip entry at 06:00, which they interpret as a two-hour discrepancy in the safety log.

Alarm logging, tag logging, and the WinCC message system are all correct. The deviation is isolated to the Safety Matrix Viewer / Safety Matrix Event Viewer, because that viewer reads the timestamp directly from the AS (Automation Station) rather than from the OS time-base translation layer used by WinCC Alarm Control.

2. Affected Components, Catalog Numbers, and Versions

Verify the system against the following part numbers and software versions before applying any corrective measure. The CP1623 ordering data is taken from the Siemens catalog (SIMATIC NET catalog IK PI).

3. PCS 7 Time Synchronization Architecture

PCS 7 implements a hierarchical time model. Understanding the data flow is the only way to understand why the Safety Matrix viewer behaves differently from the rest of WinCC.

3.1 SIMATIC Time Base

Every S7 CPU, every CP1623, and every WinCC station that participates in PCS 7 time sync maintains its local clock in the SIMATIC time base, which is defined as UTC (no offset, no DST). The time is transported in 8-byte TOD (Time-Of-Day) format: 2 reserved bits + 6 bytes BCD-coded time + 2 bytes date (BCD), with the high bits of byte 0 indicating the time-base resolution (0 = 1 ms, 1 = 10 ms, etc.).

The standard TOD format is:

Byte 0    Byte 1    Byte 2    Byte 3    Byte 4    Byte 5    Byte 6    Byte 7
reserved +  sec      min      hour     day+dw   month     year  (BCD)

3.2 The Time Master / Time Slave Roles

In a redundant PCS 7 OS Server pair, the recommended layout per the PCS 7 Time Synchronization manual (V9.1, document ID 109794383) is:

1. An external time source (e.g. SICLOCK TC 400, GPS receiver, or NTP stratum-1) is connected to one OS Server.
2. The CP1623 in the standby server is set as Time Master and forwards UTC to the bus (Industrial Ethernet / PROFINET) using the SIMATIC procedure or NTP.
3. The CP1623 in the master server is set as Time Slave and synchronizes from the partner via the redundancy link.
4. The AS is configured as a Time Slave on the plant bus; it receives TOD frames from the OS Server pair and writes the value into its hardware clock.

The principle that UTC is the only safe common base in a distributed plant is documented in the Siemens Time Synchronization manual: "Use UTC as the common time base in all PCS 7 plants. All plant components running with UTC will display the same time after time synchronization."

3.3 Where the Local-Time Translation Happens

The conversion from UTC to local time occurs at the presentation layer:

• WinCC Alarm Control / Tag Logging uses the OS regional settings (Time Zone, DST) configured in the WinCC Explorer under Computer > Properties > OS Project Editor > Time Settings. The runtime then adds the configured offset and applies DST rules to every timestamp before display.
• Safety Matrix Viewer queries the Safety Matrix FB / DB on the AS via S7 raw read services. The FB writes the timestamp it received from the CPU clock (UTC). The viewer displays the value as-is, without invoking the WinCC local-time conversion.

This architectural difference is the root cause of the discrepancy seen on the HMI.

4. Root Cause Analysis

The mismatch is not a configuration mistake. It is a documented design behavior of the Safety Matrix runtime in the affected versions:

1. The Safety Matrix FB on the AS stores the trip / acknowledge / bypass events in a circular DB. Each entry contains a timestamp read from the CPU TOD. The CPU TOD is in UTC, because the CPU is configured as Time Slave from the CP1623 (which is, by SIMATIC convention, a UTC source).
2. When the Safety Matrix Viewer opens the event list, it reads the DB rows via S7 Put/Get (or via the configured S7 connection) and formats the TOD using the viewer's internal formatting routine. This routine does not apply the OS regional time zone / DST adjustment; it only formats the raw TOD into a string.
3. The CP1623 Configuration Console > Diagnostics > Time tab always shows the time of the CP1623 module clock, which the firmware stores as UTC. There is no firmware option to display local time in the console; the field exists to verify the SIMATIC time base, not the operator time base.
4. WinCC Alarm Control sits in a different path: alarms raised by the AS are timestamped at the OS, not at the AS. The OS uses its own regional time base, so the displayed time is local.

Siemens support has confirmed, in line with the field report, that the Safety Matrix Event Log on the affected versions always shows UTC time, and that this is a system behavior. Newer releases of the Safety Matrix toolchain (V6.2 SPx and the integrated Safety Matrix in PCS 7 V8.x / V9.x) revised the event-log handling, but the behavior described in this article persists in legacy V6.2 deployments.

5. Why the CP1623 Shows UTC in the Configuration Console

The CP1623 (6GK1162-3AA00) stores the time it forwards to the bus in the SIMATIC time base (UTC). The "Current Time" field in the Configuration Console is the module time, not the PC time. The PC clock is irrelevant to the bus; only the module clock is used to drive time frames. There is no registry or NCM switch to force the CP1623 to show local time. The only legitimate local-time display is the Windows clock of the OS Server itself.

To verify the module time and the forwarded time:

1. Open SIMATIC NET Configuration Console > select the CP1623 > Time tab.
2. Note the value of Current module time (this is UTC).
3. Open PC > Control Panel > Date and Time > confirm that the Windows time is offset by your local zone (e.g. UTC+2 for CET).
4. On a redundant partner, repeat; the two values should be identical to within 5 ms.

6. Field-Proven Workarounds

Because the deviation is in the Safety Matrix viewer display path, four workarounds are used in the field. Pick the one that matches the plant policy on UTC.

6.1 Workaround A – Run the Entire Plant on UTC (the choice used in the Egypt project)

Set the OS regional time to UTC on every OS Server, OS Client, and Engineering Station. Configure the Time Zone as (UTC) Coordinated Universal Time, and disable DST adjustment. The Safety Matrix Event Log will then agree with the WinCC alarm list, because both are reading in UTC.

This is acceptable when:

• The country does not use DST (the case in Egypt from 2014 onward), or
• Operational policy already requires UTC display in all HMIs and operator procedures.

This is the workaround that was applied in the field report and is the simplest to implement.

6.2 Workaround B – Switch the OS Time Zone to UTC While Keeping DST Disabled on the Clients

Leave the OS Servers in UTC (so the Safety Matrix log is correct), and let the OS Clients translate to local time. WinCC Clients receive alarms with UTC timestamps embedded in the message frame; the Client's regional settings add the local offset for display. Safety Matrix, however, is typically opened on the Server, so the operator would have to use a separate Safety Matrix viewer tool on the Client, where the same display rule applies.

6.3 Workaround C – Display Conversion Using a WinCC Script in the SM Picture

For projects that cannot change the OS time zone, the Safety Matrix picture can be wrapped in a custom WinCC picture that reads the SM event DB through a raw S7 connection, applies the local offset in C / VBScript, and renders the corrected timestamp in a separate column. Pseudocode:

' VBScript snippet for a WinCC picture button that reads SM event #1 from DB1200
Dim sTimeUTC As String
Dim dTimeLocal As Date
Dim oConn As Object
Set oConn = HMIRuntime.Tags("@SM_DB_Event_Time").Read  ' configure this tag as a raw S7 tag
sTimeUTC = oConn
dTimeLocal = DateAdd("h", 2, CDate(sTimeUTC))        ' UTC+2 in the reference case
HMIRuntime.Tags("@SM_Local_Time_Display").Write dTimeLocal

For DST-aware regions, replace the static offset with a WinCC function that calls Win32 API GetTimeZoneInformation and applies the bias + DST flag automatically:

Declare Function GetTimeZoneInformation Lib "kernel32" (lpTimeZoneInformation As TIME_ZONE_INFORMATION) As Long
' read Bias (in minutes) and StandardBias / DaylightBias
' final local = UTC + Bias + (active DST bias)

6.4 Workaround D – Upgrade Safety Matrix and PCS 7 to a Newer Release

Siemens has revised the Safety Matrix Event Viewer in the versions bundled with PCS 7 V8.1 SP1 and later. The newer viewer honors the OS regional settings when the operator opens it. The migration path is:

1. Upgrade PCS 7 to V8.2 or V9.0 (V9.1 is the current reference; see the Time Synchronization V9.1 manual).
2. Re-install the Safety Matrix that ships with the target PCS 7 version (e.g. SIMATIC Safety Matrix V6.2 SP3 / SP4, or the integrated Safety Matrix in PCS 7 V9).
3. Re-import the S7 program with the new SM library; recompile the AS program; download to the CPU.
4. Verify the event log after a forced test trip.

7. Regional Considerations: UTC vs. Local Time and Daylight Saving

The choice between UTC and local time is not just a display preference; it is an operational decision that affects the plant's compliance with 21 CFR Part 11 / EU Annex 11 audit trails and with the safety case.

The decision must be documented in the project quality plan and communicated to the operator shift logs, because the discrepancy will resurface on every DST transition if the plant mixes the two bases.

8. Verification Procedure After Applying a Workaround

1. Force a Safety Matrix test trip from the engineering station (password required).
2. Open the WinCC Alarm Control on the OS Server and note the alarm timestamp T_alarm.
3. Open the Safety Matrix Viewer > Event Viewer and read the trip timestamp T_sm.
4. For Workaround A: T_alarm should equal T_sm within ±1 second (no offset applied).
5. For Workaround C: T_alarm should equal T_sm + Offset, where Offset is the configured local time zone bias (2 hours for CET, 3 for CEST during summer).
6. Repeat the test on the redundant partner to confirm both OS Servers agree.
7. Capture screenshots and archive them in the project quality folder; the audit trail must show the verification was performed before the next shift handover.

9. Diagnostics Reference Matrix

10. Long-Term Recommendation

For new PCS 7 plants or major retrofits, configure the entire automation network in UTC from day one, document the decision, and train operators to read UTC. The benefits are:

• No DST transition issues in the Safety Matrix log.
• No discrepancy between WinCC alarm list and Safety Matrix Event Log.
• Simpler audit trail under GxP / 21 CFR Part 11 / Annex 11.
• Consistent behavior across the redundant OS Server pair and the AS.

For legacy plants that cannot migrate, deploy Workaround C with a validated VBScript wrapper and add the offset to the operator's standard operating procedure. Re-verify the wrapper after every OS hotfix / Service Pack, because WinCC internal APIs are not part of the certified interface.

11. Related Standards and References

• SIMATIC PCS 7 Time Synchronization manual, V9.1 (Siemens, document ID 109794383) – mandatory reading for the time-master / time-slave assignment.
• SIMATIC Safety – Configuring and Programming, TIA Portal, chapter "Monitoring and response times" – describes the safety toolchain constraints that a Safety Matrix upgrade must respect.
• NIST "How UTC(NIST) Works" – reference for the UTC realization used by external master clocks feeding the SICLOCK / GPS source.