Overview
Time synchronization between Siemens SIMATIC S7 controllers and an external NTP (Network Time Protocol) server is a routine requirement in process automation, batch recording, event logging, MES data exchange, and WinCC HMI/SCADA timestamping. Whether the PLC is the NTP client and pulls time from a Meinberg, Windows, or Stratum-1 server, or the PLC acts as a master for downstream HMIs, the configuration path differs between the S7-300/400 generation (STEP 7 V5.x / HW Config) and the S7-1200/1500 generation (TIA Portal V15-V20). This reference covers both, the daylight-saving (DST) caveats engineers hit in the field, and the WinCC/WinCC Unified synchronization models.
NTP (RFC 5905) operates over UDP port 123 and supports Stratum levels 1-15. Industrial deployments typically use a local Stratum-1 or Stratum-2 server (Meinberg lantime, GPS-disciplined, or a Windows Server / Linux ntpd instance) to keep the PLC within tens of milliseconds of UTC. The S7 controller stores time as UTC in its system clock; local time, timezone offset, and DST are applied by application code or by the HMI.
READ_CLK and compare it to a wall clock, the difference is your timezone + DST offset. Never assume the PLC stores local time.Prerequisites
Before configuring NTP, verify the following:
- CPU / CP support: Built-in PROFINET interfaces on S7-1500 CPUs (article numbers 6ES7 5xx-xxx00-0AB0 and newer with firmware V2.0+) and S7-1200 CPUs (firmware V4.0+) support NTP client mode natively. For S7-300/400, an Ethernet CP is mandatory: CP 343-1 (6GK7 343-1EX30, 6GK7 343-1CX10, 6GK7 343-1GX30 and later), CP 343-1 Advanced (6GK7 343-1GX31), and CP 443-1 (6GK7 443-1EX20, 6GK7 443-1EX41, 6GK7 443-1GX30, and Advanced variants). Older CP 343-1 IT (6GK7 343-1GX20) does not support NTP client.
- Firmware: TIA Portal V15.1 or later recommended for unified handling of S7-1200/1500 NTP. STEP 7 V5.5 + SP4+ for legacy S7-300/400.
-
Network reachability: UDP/123 must be permitted from the PLC IP to the NTP server. Validate with a Windows
w32tm /monitor /computers:<plc_ip>or Linuxntpq -p <plc_ip>from a service laptop. -
NTP server reachable: Field-proven sources include Meinberg Lantime NTP time servers (industrial Stratum-1 with GPS), Windows Server w32time role, and Linux
chrony/ntpd. Avoid public internet NTP (pool.ntp.org) in air-gapped plants — use a local appliance. - Time zone awareness: Document plant timezone (e.g., Europe/Berlin = UTC+1 / UTC+2 with DST) and the cutover rule (last Sunday of March / October in EU; second Sunday of March / first Sunday of November in US).
S7 System Time Data Types and SFCs
Siemens controllers use several time data types per IEC 61131-3:
| Type | Length | Resolution | Range | Typical CPU |
|---|---|---|---|---|
DATE_AND_TIME (DT) |
8 bytes | 1 s | 1990-01-01 to 2089-12-31 | S7-300/400/1500 |
DTL |
12 bytes | 1 ns | 1970-01-01 to 2554-12-31 | S7-1500/1200 |
TOD (TIME_OF_DAY) |
4 bytes | 1 ms | 00:00:00.000 to 23:59:59.999 | All |
LTIME |
8 bytes | 1 ns | extended | S7-1500 |
Core system blocks for time manipulation:
| Block | Function | Notes |
|---|---|---|
READ_CLK / RD_SYS_T (SFC 0 / SFB 4) |
Read CPU clock → returns DATE_AND_TIME
|
Output is UTC, BCD-encoded for S7-300/400 |
SET_CLK / WR_SYS_T (SFC 1 / SFB 5) |
Write CPU clock from DATE_AND_TIME
|
Use cautiously: forcing time breaks NTP corrections |
WR_TOD (SFC 28) |
Set time-of-day without date | S7-400 only |
RD_TOD (SFC 27) |
Read time-of-day in TOD format |
Returns local status only |
SET_TIMEZONE (SFC 158, S7-1500) |
Configure timezone offset and DST rule | Available in TIA Portal CPU properties > Time of day |
DATE_AND_TIME format is BCD, e.g., year 2024 = 16#24, month 11 = 16#11. Any conversion to a numeric tag requires BCD_TO_INT / INT_TO_BCD instructions. The S7-1500 DTL type is plain binary and contains a DWORD nanosecond field plus separate YEAR, MONTH, DAY, HOUR, MINUTE, SECOND, WEEKDAY fields.Configuring NTP on S7-1500 in TIA Portal (V15-V20)
- Open the TIA Portal project and select the S7-1500 CPU in the project tree.
- Navigate to Properties > General > Time of day.
- Set the Time zone for the plant (e.g., (UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna with daylight-saving rule).
- Open Properties > PROFINET interface [X1] > Time synchronization.
- Enable "Synchronize with NTP server".
- Add up to four NTP servers in priority order. Each entry requires:
IP address,port(default 123), andpolling interval(default 10 s; range 1-86400 s). Multiple servers provide redundancy — the CPU selects by stratum and reachability. - Optionally enable "Forward time of day to station" so the S7-1500 becomes an NTP source for downstream devices. When enabled, the CPU acts as an NTP server on UDP/123 and serves time derived from its own clock (which is the NTP-corrected value). This is the recommended method when the S7-1500 must be the master for ET 200SP IMs, SCALANCE switches, or SINAMICS drives.
- Compile and download. The configuration writes to the active PROFINET interface parameters; no user program is required.
Per the WinCC Unified Time Synchronization documentation, at least one NTP server must be specified when the option is enabled, and the same Inspector window path is used for HMI panels in the Unified Comfort line.
Verifying NTP on S7-1500
- From TIA Portal online: Online & diagnostics > Time of day shows the CPU's current system time, status, and last synchronization source.
- From a service laptop, run
w32tm /stripchart /computer:<plc_ip> /dataonly /samples:5(Windows) orntpdate -q <plc_ip>(Linux) to query the offset. - Read
RD_SYS_Tin a watch table and compare against a reference wristwatch or GPS-disciplined source. Acceptable offset for MES/batch is typically < 1 s; for OPC UA pub/sub with microsecond timestamps use PROFINET IRT synchronization (separate mechanism, not NTP).
Configuring NTP on S7-300/400 via STEP 7 V5 (HW Config)
- Open SIMATIC Manager and the project; launch HW Config.
- Double-click the Ethernet CP (e.g., CP 343-1, 6GK7 343-1EX30).
- Open the Time-of-Day Synchronization tab.
- Select NTP Mode > Activate NTP time-of-day synchronization.
- Check "Forward time of day to station" if downstream S7-300 stations or HMIs should receive the corrected time from this CP.
- Enter the NTP server IP address (e.g., 192.168.10.50 for a Meinberg Lantime). Multiple NTP servers can be specified comma-separated on capable CP firmware.
- Set the synchronization interval (default 10 s; minimum 1 s).
- Download the HW Config to the CPU/CP. The CP becomes the NTP client on UDP/123 and updates the CPU clock at the configured interval.
Configuring NTP on S7-1200 in TIA Portal
- Open CPU properties > General > Time of day and set the timezone.
- Open PROFINET interface > Time synchronization (S7-1200 firmware V4.0+; G2 CPUs 6ES7 2xx-1AG40-0XB0 and later support NTP).
- Enable NTP and add the server. Polling interval default 10 s.
- Compile and download.
S7-1200 acts as NTP client only — there is no "forward time of day" server mode on 1200. To synchronize a downstream device, use a separate S7-1500 or external server.
PLC as NTP Master for HMIs and Drives
When the S7-1500 should serve time to WinCC Unified panels, ET 200SP stations, or SINAMICS S120 drives, two models exist:
| Scenario | Master | Configuration Path |
|---|---|---|
| HMI pulls from PLC (TIA) | S7-1500 | Devices & networks > HMI connection > Inspector > General > Time synchronization > Set HMI as slave and PLC as master |
| HMI pulls from external NTP | External NTP server | HMI Properties > Time synchronization > NTP server entry, e.g., per the WinCC Unified Synchronization (RT Unified) manual |
| WinCC server syncs WinCC clients | WinCC server | Per the WinCC time sync KB: open Time synchronization on the server, activate "Synchronization via System Bus", select access point, set role to Master |
| Drive (SINAMICS) pulls from PLC | S7-1500 via PROFINET | Enable "Send clock and time" on the PROFINET IO device; PLC is the sync master and SINAMICS follows |
Daylight Saving Time (DST) Handling
Legacy S7-300/400 PLCs do not automatically apply DST rules. NTP delivers UTC, and the S7 system clock is UTC. If the HMI displays "local time" with DST applied, you must either:
- Configure the timezone (including DST rule) in TIA Portal on the S7-1500/1200 under Time of day > Time zone. The CPU will then expose the local time via the system clock register for HMI display.
- In S7-300/400, write application logic that compares the current
DATE_AND_TIMEagainst the DST cutover dates (e.g., last Sunday of March and last Sunday of October for the EU) and adds/subtracts one hour. A typical block:
// Pseudocode for EU DST transition
IF (Month = March) AND (Day = LastSunday) AND (Hour >= 1 AND Hour < 2) THEN
// Spring forward: 02:00 becomes 03:00 UTC+1 → UTC+2
END_IF;
IF (Month = October) AND (Day = LastSunday) AND (Hour >= 2 AND Hour < 3) THEN
// Fall back: 03:00 becomes 02:00 UTC+2 → UTC+1
END_IF;
For S7-1500 the recommended approach is to enable the time zone with the correct DST rule in the CPU properties — Siemens encodes the IANA tz database transitions for the selected region. No code required.
2024-10-27T01:30:00Z) in the PLC and convert to local time only at the HMI/Reporting layer. This eliminates DST ambiguity in batch records, audit trails, and OPC UA publish/subscribe payloads.Recommended NTP Server Setup
For industrial deployments, deploy a local Meinberg Lantime Stratum-1 NTP server (e.g., Lantime M600, M1000, M3000) with GPS or DCF77 reference. The Meinberg firmware supports the industrial NTP/PTP/SNTPv4 daemon with full RFC 5905 implementation. Configure the S7 PLC, HMIs, SCALANCE XC/XR switches, and SINAMICS drives as NTP clients pointing to this single local server; never use a public internet NTP source in OT networks.
For cost-sensitive sites, a Linux server running chrony or ntpd synchronized to a USB GPS receiver (e.g., u-blox) provides comparable Stratum-1 quality. On Windows, enable the W32Time service in NTP mode (w32tm /config /manualpeerlist:<gps_host> /syncfromflags:manual /reliable:YES /update).
Alternative: PC-Set Time via S7 Link (Non-NTP)
When the CP does not support NTP client mode (e.g., older CP 343-1 IT or CP 343-1 Lean without NTP), a Windows PC can be configured as the NTP server and the time can be pushed to the PLC using the IP-S7-LINK or a custom S7 connection that calls SET_CLK (SFC 1) on the PLC. The PC must run an NTP server (Meinberg NTP daemon for Windows, or chrony in WSL) and a service that periodically reads the OS time and writes it to the PLC's DATE_AND_TIME tag via S7 PUT/GET or OP-communication. This is a workaround, not preferred — use only when a CP upgrade is not feasible.
Troubleshooting Matrix
| Symptom | Likely Root Cause | Diagnostic | Resolution |
|---|---|---|---|
| PLC clock drifts, no NTP sync | CP does not support NTP, or NTP not enabled in HW Config / TIA | CP diagnostic buffer; CPU online > Time of day | Upgrade CP firmware/hardware; verify NTP mode checkbox |
| Sync works for 1-2 h, then drift | Asymmetric firewall, UDP/123 blocked intermittently | Continuous ntpq -p from a laptop | Open UDP/123 bidirectional; route PLC NTP through SCALANCE ACL |
| Time correct, but DST shifts 1 h late/early | Timezone rule not configured in TIA, or legacy PLC has no DST support | Compare HMI time to a reference phone in DST mode | Configure timezone with DST rule in S7-1500; add manual DST code in S7-300/400 |
| HMI shows UTC instead of local time | No timezone configured on HMI | WinCC Unified > Time settings > Time zone | Set the HMI timezone to match the PLC's local-time setting |
| WinCC clients show server time, but HMI tags offset | WinCC clients are not configured as slaves via System Bus | WinCC Time Synchronization dialog > Slave | Enable "Synchronization via System Bus" on each client; set role to Slave per the Siemens KB on WinCC time sync |
| NTP server unreachable from PLC | Routing/gateway missing on PROFINET interface | Ping NTP server from a laptop on the same subnet | Configure the router IP in the PROFINET interface properties |
| Stratum 16 received — server not synced itself | Local NTP server cannot reach its own upstream | ntpq -c as on the server | Add a second external upstream; ensure GPS lock |
| S7-1500 reports "NTP: no response" | Firewall on NTP server blocks UDP/123 from PLC subnet | Server log (chrony/ntpd) shows source rejection | Add allow 192.168.0.0/16 (or appropriate) in ntp.conf |
Verification Procedure
- Online diagnostic: In TIA Portal, go to Online & diagnostics > Time of day. The "Status of time synchronization" must show the NTP server IP and "synchronized" or "synchronized, server not reachable temporarily".
-
Offset measurement: From a service laptop, run
w32tm /stripchart /computer:<plc_ip> /samples:30for 5 minutes. The offset should converge to under 10 ms for a local Meinberg server. Stratum should be 1 or 2. - DST transition test: Force a time on the NTP server that crosses the DST boundary and verify the PLC's local-time display (e.g., in a tag visible on the HMI) jumps forward or back by 1 h at the correct wall-clock moment.
- Power-cycle test: Restart the CPU and confirm the time re-syncs within one polling interval after boot. On S7-1500 the buffered RTC retains time across power loss within capacitor hold-up (~6 weeks typical), but re-syncing from NTP must be observed.
- Failover test: If two NTP servers are configured, disconnect the primary and verify the CPU switches to the secondary within a few poll intervals and continues to keep time within tolerance.
Standards and Further Reading
- RFC 5905 — NTPv4 protocol (IETF) — defines the packet format and stratum hierarchy used by the S7 PROFINET NTP client.
- IEC 61131-3 — defines
DATE_AND_TIME,DTL, andTODdata types used in S7 system time. - Siemens Function Manuals: S7-1500 Communication (article ID 109751654), S7-1200 System Manual, CP 343-1 Operating Instructions (6GK7343-1EX30 manual, A5E02682276).
Which Siemens S7 CPUs support NTP client natively?
S7-1500 CPUs (firmware V2.0+) and S7-1200 CPUs (firmware V4.0+, e.g., 6ES7 214-1AG40-0XB0 G2) support NTP client on the built-in PROFINET interface. S7-300/400 require an Ethernet CP such as CP 343-1 (6GK7 343-1EX30 / 6GK7 343-1GX31 Advanced) or CP 443-1. Older CP 343-1 IT (6GK7 343-1GX20) does not support NTP.
How is daylight saving time handled on S7-300/400 vs S7-1500?
S7-1500/1200 apply DST automatically when the timezone with a DST rule (e.g., "(UTC+01:00) Amsterdam, Berlin, Rome, Vienna") is configured in CPU Properties > Time of day. S7-300/400 do not apply DST automatically — you must write PLC logic to detect the last Sunday of March/October and add/subtract one hour, or rely on the HMI to render local time.
What NTP server do engineers typically use for Siemens plants?
Meinberg Lantime industrial NTP appliances (Stratum-1 with GPS or DCF77) are the most common choice. The Meinberg NTP/PTP daemon is also available as a free Windows/Linux port. Configure the S7 PLC as a client and the Meinberg box as the local server — never use public internet NTP in an OT network.
Can the S7-1500 be an NTP server for HMIs and drives?
Yes. In TIA Portal, enable "Forward time of day to station" on the PROFINET interface Time synchronization page. The CPU then serves time on UDP/123, which WinCC Unified panels, SINAMICS drives on PROFINET, and SCALANCE switches can use. For WinCC, configure the HMI connection as Time synchronization > Slave in the Devices & networks editor.
What port does Siemens NTP use and what is the default polling interval?
NTP uses UDP/123 in both directions. The default polling interval in TIA Portal and HW Config is 10 s; the allowed range is 1-86400 s. Lower intervals increase accuracy at the cost of network and CPU load. For most plants, 60-300 s is more than sufficient when paired with a local Stratum-1 server.