Resolving NTP Time Zone and Web Messages on CPU 315-2-PN/DP

1. Problem Overview

The S7-300 CPU 315-2 PN/DP (order numbers 6ES7315-2EH13-0AB0 and 6ES7315-2EH14-0AB0) is one of the most widely deployed PROFINET-capable controllers in mid-size STEP 7 / PCS 7 plants. Two recurring field questions on this CPU involve the integrated NTP client on the PROFINET interface and the integrated Web server "Messages" page:

1. The diagnostic buffer records time stamps that appear offset by the local UTC delta (typically +1 / +2 h in CET/CEST) and there is no time-zone field in HW Config to correct the display.
2. The Messages page in the CPU Web server stays empty even though the project is correctly compiled. Engineers expect PCS 7 OS-style alarm lines but the standard Web page does not produce them automatically.

Both behaviours are by design. The CPU 315-2 PN/DP has no internal time-zone parameter; the diagnostic buffer is always written in UTC. The Web "Messages" page is a passive viewer that displays whatever alarms are published by Report System Errors (RSE) or by the S7-300/400 diagnostic FBs; it does not generate messages on its own. The remainder of this reference walks through the exact root cause for each behaviour and the field-proven configuration steps that produce the expected local time and the expected alarm list.

2. Hardware and Firmware Identification

Before any re-configuration, confirm the exact article number and firmware (FW) version. The NTP/Web server behaviour differs between the two MLFBs.

Read the FW version in STEP 7 / TIA Portal under PLC → Online → Diagnostic → Module Information, or browse to http://<CPU-IP>/ → Module Information. The Identification tab returns the article number, FW, and hardware revision. The PROFINET interface supports NTP/SNTP per RFC 2030 starting with FW V2.5; the older 2EH10 / 2EH11 variants require a CP 343-1 or CP 343-1 Advanced for NTP.

3. Root Cause Analysis

3.1 Time stamps in the diagnostic buffer

The diagnostic buffer (SZL 0x00A1) is written by the CPU firmware in UTC. The CPU has no parameter that stores a local offset, daylight-saving rule, or geographic zone. The displayed value is therefore whatever the NTP source provided. If the NTP source is an Internet server, the time is GMT/UTC; if it is a local Meinberg/LAN time-server, it is usually also UTC because the S7 NTP client does not negotiate a TZ extension.

3.2 Empty "Messages" page in the Web server

The CPU Web server has three logical message sources:

• Diagnostic buffer entries — always shown on the Diagnostics page, never on Messages.
• Report System Errors (RSE) — populated by the FBs generated when RSE is activated in HW Config (FB 126, FB 127, DB 126, DB 127). Without RSE, the Messages page is empty.
• SFM / S7-300/400 diagnostic FBs — only if PCS 7 or the optional "S7-RAUT/PCS 7" package is installed and the FBs are wired in the user program.

If the project was built as plain STEP 7 (no PCS 7), the engineer must explicitly turn on Report System Errors in HW Config. The CPU itself is not PCS 7-aware; the Web "Messages" page simply renders the RSE alarm table that the user program fills.

4. NTP Time Synchronization Configuration

4.1 STEP 7 V5.x procedure (HW Config)

1. Open the S7 project in STEP 7 and double-click the CPU 315-2 PN/DP in HW Config.
2. Select the PROFINET interface (X2) → Properties → IP address tab. Assign a unique IPv4 address and the subnet mask.
3. Switch to the CPU's Time-of-Day tab (Properties of the CPU, not the interface).
4. Enable Synchronize with NTP (radio button). The previous Synchronize on MPI and Synchronize via LAN options are not used here.
5. Click Add under "NTP servers" and enter:
   • IP address — e.g. 10.0.0.5 (a local Meinberg LANTIME or another SIMATIC CPU acting as NTP server).
   • Update interval — typical value 60 s (range 10 s … 24 h).
   • Acceptance window — default 100 ms, increase to 2000 ms on noisy WLAN links.
6. Save and download the HW Config to the CPU. The NTP client begins polling after a STOP→RUN or after a power-on.

4.2 TIA Portal procedure (V13 SP1 and later)

1. Open Devices & Networks and select the CPU.
2. In Properties → Time of day → Time synchronization select the NTP option and add the server (IP, port 123, interval).
3. Compile and download.

4.3 Parameter set in the user program (SFC 100 / SZL)

The NTP server list can be modified at runtime using the "Time sync" SZL (SZL 0x0131) and SFC 100 "SET_CLKSYN". This is useful when a master clock is changed from the engineering station. The relevant system state list for the active NTP status is SZL 0x0132 (time-of-day state).

5. Time Zone Display — Strategies That Work

Because the CPU stores UTC, every consumer of the diagnostic buffer interprets the stamp in its own time zone. The four strategies below are the only field-proven methods.

5.1 Strategy A — Local NTP server that distributes local time

Configure the LAN Meinberg (or DCF77-to-NTP gateway) so that it serves local time on the plant network. The CPU will then store the local time and the diagnostic buffer will show the correct wall-clock value. The cost is that other PLCs on the same network inherit the same offset and lose UTC traceability.

5.2 Strategy B — Use UTC and display locally on every HMI / SCADA

Keep the NTP source at UTC. Set every engineering station and HMI to the correct time zone (Windows: Date and Time → Change time zone; WinCC/PCS 7 OS: Time Zone project setting). The Web server, TIA, STEP 7 online, and WinCC Alarm Logging all then render the buffer stamps in local time. This is the recommended practice for new plants.

5.3 Strategy C — Application-level correction

For PCS 7 OS, the OS Project Editor → Time settings dialog already converts UTC to OS-local. For WinCC flexible / TIA Unified, the Time zone and Daylight saving properties of the HMI tags do the same. If you have a custom S7-300 program (no PCS 7), you can read SZL 0x00A1 and convert it with FB "LOCAL_TIME" from the standard library; the conversion block uses the S7 date-and-time (DTL) format.

5.4 Strategy D — Add a CP for time-zone aware NTP

CP 343-1 Advanced and CP 343-1 Lean (FW ≥ V2.0) have an explicit time-zone correction field in their NTP setup. When the plant contains a mix of older S7-300 CPUs and a CP, the CP can act as the master with a configured offset; the CPU 315-2 PN/DP slaves off the CP and displays the corrected value. This is the cleanest retrofit for existing installations.

6. Web Server Architecture on the CPU 315-2 PN/DP

The integrated Web server is enabled in HW Config → CPU → Properties → Web. The following pages are available on http://<CPU-IP>/:

Detailed description of every page and the relevant firmware behaviour is in the S7-300 Web server Function Manual: SIMATIC S7-300 Web server — Function Manual.

7. Enabling Report System Errors (RSE) for the Web "Messages" Page

RSE is the only function that fills the Messages page on a non-PCS 7 STEP 7 project. Procedure (STEP 7 V5.4 SP3 and later; TIA V13 SP1 and later):

1. Open HW Config (or device view in TIA) and right-click the CPU → Report System Errors….
2. Select the slave / I/O module type. For PROFINET devices, select PROFINET IO System as the source.
3. Choose the FB options: Use FB 126 (SFM_FB) for central and distributed I/O; Use FB 127 (SFM7_FB) if you want PCS 7-compatible SFM messages. Both blocks expose the alarm table that the Web "Messages" page reads.
4. Compile HW Config. The compiler generates:
   • FB 126 SFM_FB + DB 126
   • FB 127 SFM7_FB + DB 127
   • FC 100 / FC 101 for error OB evaluation
   • Diagnostic DBs (DB 0, DB 1, …)
5. Download the blocks. The CPU operating mode does not need to be STOP for the Web message table to populate, but OB 1 must call the generated FBs once per cycle.

7.1 Required software and licensing

Background on RSE and the SFM blocks is in the manual SIMATIC S7-300/400 - Report System Errors.

7.2 Verifying that the Messages page is live

1. Force an error by removing a PROFINET device or by setting a short-circuit at a digital output.
2. Browse to http://<CPU-IP>/messages.htm.
3. The "I/O fault" line should appear within 2-3 scan cycles.
4. Click the line. The drill-down should show the slot / channel / error code (decimal 16#…). This is identical to the PCS 7 OS message text.

8. Accessing Status Variables via the Web Interface

8.1 The built-in Variable Status page

The Variable Status page (/varstat.htm) is the simplest way to read process data from a browser. Procedure:

1. Open HW Config → CPU → Properties → Web → tab Watch table.
2. Add up to 50 operands (CPU 315-2 PN/DP limit). Examples:
   • DB100.DBD0 — REAL, current flow in m³/h
   • MW 200 — INT, motor speed setpoint
   • I 1.0 — BOOL, "Pump running"
   • PIW 256 — INT, analog input raw
3. Mark each operand as read (input) or read/write (control). The write option allows the engineer to toggle bits from the browser during commissioning.
4. Compile and download. Browse to /varstat.htm. The page polls every 2 s by default; the interval can be set in the HTML <meta http-equiv="refresh"> tag of the user template.

Limits: 50 operands total, 8 bytes per operand, 30 simultaneous Web users. The exact limit for the CPU 315-2 PN/DP is documented in the S7-300 system manual CPU 315-2 PN/DP / CPU 315F-2 PN/DP Manual.

8.2 User-defined HTML pages with AWP commands

User-defined pages allow you to read and write any data block, render alarms, and embed JavaScript gauges. The CPU firmware (V2.5+ on 2EH13, V3.2+ on 2EH14) interprets Automation Web Programming (AWP) commands in HTML files that are stored in the CPU's internal file system.

Example — read a DB value and display it on a dashboard:

<!-- AWP_In_Variable = '"DB100"."flow_m3h"' -->
<html>
<head><title>Pump 1 dashboard</title></head>
<body>
  <h1>Flow</h1>
  <p>Current value: :="DB100"."flow_m3h": m³/h</p>
  <form method="POST" action="/">
    <input type="hidden" name='"DB100"."setpoint"' value="10.5">
    <input type="submit" value="Set 10.5 m³/h">
  </form>
</body>
</html>

The HTML file is loaded into the CPU with PLC → Web server → Load to file system (STEP 7) or Online → Download to device → User-defined Web pages (TIA). The file is stored in the CPU's web file system (max 1 MB on 2EH13, 4 MB on 2EH14).

9. Diagnostic Buffer Time Stamps — Direct Read

For a programmatic readout of the buffer (for example, to forward to a third-party historian), use SZL 0x00A1. SFC 51 "RDSYSST" with the parameters below returns the same data that the Web Diagnostics page renders:

CALL SFC 51 (
  REQ     := TRUE,
  SZL_ID  := W#16#00A1,           // diagnostic buffer
  INDEX   := W#16#0000,
  RET_VAL := MW 100,
  BUSY    := M 101.0,
  SZL_HEADER := DB200.DBD 0,      // length + number of records
  DR      := P#DB200.DBX 8 BYTE 4000);

Each entry is 20 bytes: 4 bytes time stamp (seconds since 1984-01-01 UTC, BCD), 4 bytes date stamp, 4 bytes event ID, 4 bytes OB / module reference, 4 bytes information. The conversion to local time is done by FB "RTC_LOC" from the standard library.

10. Verification Matrix

11. Troubleshooting Matrix

12. Field-Proven Best Practices

• Always keep NTP at UTC and apply time-zone conversion at the display layer (PCS 7 OS, WinCC, TIA Unified). It is the only configuration that survives DST transitions automatically and that allows distributed plants in different time zones to share a clock source.
• When you install a new plant, activate Report System Errors on every PROFINET device from day one. The CPU 315-2 PN/DP supports it natively; cost is one extra FB call in OB 1.
• For commissioning, use a 60 s NTP update interval. Shorter intervals do not improve time accuracy (the CPU's internal RTC drifts < 5 s/day) and increase network load on the PROFINET ring.
• For a Plant — 1 PC — 1 CPU topology, set the PC to the plant TZ and set the CPU NTP to the same PC; this removes the need for an external Meinberg server in small installations.
• Reserve the user-defined Web file system for diagnostic dashboards. Do not push 50+ KB HTML files for production HMI; PCS 7 OS or WinCC scales better.

FAQ