TP700 Comfort Date/Time Area Pointer Wrong: S7-300 Time Sync Fix

TP700 Comfort Date/Time Area Pointer Displays Wrong Time: S7-300 Time Synchronization Troubleshooting

The SIMATIC TP700 Comfort panel and a SIMATIC S7-300 controller form a very common HMI/PLC pairing in mid-range machine automation. When the engineer wires the Date/Time PLC area pointer to a data block in the S7-300 and observes the panel clock running ahead or behind the DB value by exactly one or two hours, the fault almost always sits in the panel's interpretation of the incoming timestamp rather than in the PLC program itself. This reference walks through the complete diagnostic path, the underlying UTC/local time model used by WinCC Comfort, and the configuration changes required to bring the panel display back in sync with the controller clock.

1. Problem Statement and Observable Symptoms

A TP700 Comfort (6AV2 124-1JC01-0AX0 or current equivalent 6AV2 124-1MC01-0AX0) is configured in TIA Portal V17 or later. The panel communicates with an S7-300 CPU (for example CPU 315-2 PN/DP, 6ES7 315-2EH14-0AB0) over PROFINET or MPI. The HMI tags read a six-word Date/Time area pointer that points into a standard DB on the CPU. The VAT table on the S7-300 shows the correct local date and time, but the HMI display shows a value offset by a fixed number of hours.

Typical symptoms reported in field service tickets:

• HMI clock is exactly +1 h, +2 h, or +3 h offset from the DB value.
• The Audit Trail log on the panel records entries that also carry the shifted time stamp.
• Trend curves and message time stamps on the panel are shifted by the same offset.
• The offset survives a warm restart of the panel and a STOP/RUN transition on the CPU.
• Setting the time from the panel control panel (Settings > Date/Time) writes back to the PLC correctly, but the moment the PLC pushes time again via the area pointer, the offset reappears.

2. Root Cause: UTC Versus Local Time Model

The WinCC Comfort runtime on every Comfort Panel (TP700, TP900, TP1200, TP1500, TP1900, TP2200) stores two time values internally: a UTC base time and a localized time. The Date/Time area pointer is documented to transfer the time from the panel to the PLC for control jobs 41 (Read date/time) and 42 (Set date/time), but when used as the source of synchronization the PLC-originated time stamp is interpreted against the panel's configured time zone and DST rule. See the official Siemens reference Date/time area pointer (Basic Panels, Panels, Comfort Panels, RT Advanced, RT Professional).

The S7-300 system clock, however, does not natively know about UTC or DST. It maintains a single 64-bit DATE_AND_TIME value starting at 01.01.1990 00:00:00 local time. When the CPU writes the eight-byte DT structure into the DB area the panel polls, the panel first re-interprets that value as if it were already local time, then internally converts it to UTC by subtracting the configured time zone offset, then re-adds the offset on display. If the panel is configured for a time zone that differs from the wall-clock time of the plant, the resulting display shifts by that delta.

The two-hour offset reported in the source ticket corresponds almost exactly to Central European Summer Time (CEST = UTC+2). The DB stored winter time (CET = UTC+1) while the panel was configured to expect summer time interpretation, or the plant was physically located in a CET-only country but the HMI project was created from a template that defaulted to a CEST time zone.

3. Diagnostic Sequence

Perform the checks below in the order listed. Each check produces a definitive yes/no answer and either resolves the fault or narrows the search.

3.1 Inspect the active system alarms on the panel

1. On the TP700 Comfort, open the Control Panel > System Information or trigger the system alarm view on the screen.
2. Filter for alarms whose text contains Date/time, area pointer, Job mailbox, Time synchronization or alarm number 190200, 190300, 190400, 700001 through 700004.
3. A repeating alarm of class Warning about the area pointer indicates the panel is not receiving valid data; this would explain a wrong time as a default fallback value rather than a time zone shift.
4. No alarm about the area pointer but a wrong displayed time confirms the area pointer is healthy and the fault lies in the time model.

3.2 Verify the DB layout

The Date/Time area pointer must point to six consecutive words (12 bytes) when the PLC is the time master, or eight bytes (DT format) when the panel is the master. The standard layout for an S7-300 master:

Confirm in the VAT that each word holds a valid BCD-encoded value. A decimal 9 in the hour byte versus the BCD 0x09 makes a one-hour difference on panels that perform BCD conversion twice.

3.3 Check the configured time zone on the panel

1. In the TIA Portal project tree, select the TP700 Comfort device.
2. Open Properties > General > Time & Date (German: Uhrzeit & Datum).
3. Read the Time zone field. Central Europe should show (UTC+01:00) Sarajevo, Skopje, Warsaw, Zagreb or (UTC+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague in winter.
4. Read the Daylight saving time option. It must be set to Active for any European, North American or other DST-observing region.

3.4 Check whether other PLCs or an NTP server push time to the panel

When multiple connections are configured, the panel applies the time master order of its HMI connections. A second S7-300/400 or an NTP server reaching the panel will overwrite the area pointer value. The order is:

1. NTP server (highest priority when Synchronize with NTP server is enabled in the panel's control panel).
2. PLC #1 time sync (first connection with time sync active).
3. PLC #2 time sync (next connection with time sync active).
4. Local RTC of the panel (fallback).

Disable NTP on the panel during commissioning to isolate the area pointer path. The configuration is in Control Panel > System Properties > Date/Time > NTP on the runtime panel itself, and in TIA Portal under Device Properties > Time & Date > Synchronization via NTP.

4. Step-by-Step Correction of the Time Zone / DST Settings

4.1 Set the correct operating time zone

1. In TIA Portal, select the TP700 Comfort.
2. Open Properties > General > Time & Date.
3. In the Operating time zone drop-down, select the city that matches the physical location of the machine.
4. Compile the project (Hardware and Software) and download to the panel.

4.2 Configure daylight saving time handling

Two methods are available:

Method A - Built-in DST rule (preferred for fixed installations).

1. Under Time & Date, activate Daylight saving time.
2. Select the rule European Union, USA or Custom.
3. For a custom rule, enter the transition dates (last Sunday of March, last Sunday of October for EU; second Sunday of March, first Sunday of November for US).
4. Download to the panel and verify the next DST transition.

Method B - Manual PLC-controlled DST.

Disable Daylight saving time on the panel and let the S7-300 program write the corrected local time to the DB. Use SFC 1 (READ_CLK) for the system clock and apply the DST offset in OB1. This method is documented in the Siemens FAQ on Automatic switching between summer and winter time with SIMATIC HMI Comfort Panels and TIA Portal.

4.3 Ensure the JobMailbox area pointer is present

Time synchronization between a Comfort Panel and an S7-300 is performed via two coordinated area pointers: Date/Time (passive data) and JobMailbox (control jobs). See the official Siemens application document Time Synchronization with an HMI Operator Panel and a SIMATIC PLC (PDF).

4.4 Configure the S7-300 program to feed the area pointer

Sample STL program for an S7-300 that writes its system clock (DATE_AND_TIME) to DB100 in the area pointer layout:

// OB1 - update time area pointer every cycle
CALL  SFC   1                       // READ_CLK
     RET_VAL := MW100               // error code
     CDT     := DB100.DBD0          // 8 bytes DATE_AND_TIME

// Split the 8-byte DT into the 12-byte BCD layout the panel expects
// DB100 layout:
//   DBB0  Year BCD           (e.g. 0x23 for 2023)
//   DBB1  Month BCD          (e.g. 0x09)
//   DBB2  Day BCD            (e.g. 0x15)
//   DBB3  Hour BCD
//   DBB4  Minute BCD
//   DBB5  Second BCD
//   DBB6-7 ms (3 BCD nibbles + reserved)
//   DBB8-9 reserved
//   DBB10-11 reserved

// The WinCC Comfort driver handles the DT-to-BCD conversion
// automatically when you select DT as the area pointer data type.
// Use DATE_AND_TIME as the DB area pointer element type for
// best results.

For best inter-version compatibility, define the area pointer in TIA Portal using data type DATE_AND_TIME rather than manually splitting it. TIA Portal will then generate the correct twelve-byte buffer and the runtime expects to read an unconverted DT.

5. Special Case: S7-300 Has No Concept of Local Time

The S7-300 system clock is purely a free-running counter; there is no time zone database inside the CPU. Any local time or DST offset must be applied by the user program. If the DB stores UTC and the panel is configured for (UTC+02:00), the panel will display UTC+2, which equals local CEST - this is the desired behaviour. If the DB stores local CEST and the panel also applies +2 h, the user sees CEST+2 = 4 hours off.

Recommended canonical setup for European installations:

Or the UTC-everywhere variant:

6. Verification Procedure

After applying the changes, verify end-to-end with the following steps:

1. STOP the CPU, perform a cold restart to clear any RAM-resident time offsets.
2. Download the HMI project (complete download, not delta) to the TP700 Comfort.
3. On the TP700, open Control Panel > Date/Time and confirm the displayed time matches the wall clock to the second.
4. Trigger control job 41 by setting the JobMailbox word to 41. The panel reads the DB and updates its display. Confirm the displayed value equals the VAT value to the minute.
5. Set the DB time manually with a test value (for example 12:00) and wait ten seconds. The panel display should follow to 12:00 without offset.
6. Switch the DB time by exactly +1 h and confirm the panel display follows by exactly +1 h.
7. Force a DST transition: temporarily set the panel rule to Custom with a transition one minute from now, observe the time jump.
8. Trigger a power cycle on the panel. On reboot the panel should re-synchronize within one poll cycle (10 s default) and show the same value as the DB.
9. Export the Audit Trail and confirm that the recorded time stamps match the DB time.

7. Quick Diagnostic Matrix

8. Common Configuration Pitfalls

• Optimized DB access on S7-300/1500 with TIA Portal V15+. When the area pointer DB has optimized access enabled, the symbolic address may not match the byte offset the panel driver expects. For time area pointers, always use a standard (non-optimized) DB. The driver cannot reach optimized-block data unless the DB is in a non-optimized area of the CPU; on an S7-300 the default is already standard, but copying the block from an S7-1500 template may carry optimized access forward.
• Two area pointers sharing the same start address. Date/Time and JobMailbox must not overlap. JobMailbox must immediately follow the Date/Time area or be placed in a separate DB region.
• Time format mismatch (DT versus DATE). Some TIA Portal versions default the Date/Time area pointer to data type DATE_AND_TIME (8 bytes). Selecting Date (2 bytes) or Time (4 bytes) makes the panel read garbage from the high bytes and produce unpredictable offsets.
• PLC write order. If the S7-300 program writes the seconds word before the year word, the panel may momentarily read an invalid BCD combination and reject the whole packet until the next cycle. Always write the year and month first, then the day, hour, minute and second last. WinCC Comfort accepts partial updates, but the safer pattern is to gate the area with a handshake byte in the JobMailbox.
• Mixing time zones inside one project. A TP700 at the operator station and a WinCC Runtime on a PC may use different default time zones. Check both under Time and Date.

9. Relationship to the JobMailbox Control Job 41 / 42

Control job 41 instructs the panel to read the current date and time from the PLC and to apply it to its internal clock. Control job 42 instructs the panel to write its current clock to the PLC. The JobMailbox structure is four 16-bit words:

If the JobMailbox is missing from the project, control job 41 cannot be triggered and the panel falls back to its own RTC. The displayed time then equals the panel's internal RTC plus the configured time zone offset - exactly the symptom of a +2 h shift when the panel's RTC was last set to UTC or to winter time.

10. Commissioning Checklist

Use this checklist when commissioning a new TP700 / S7-300 pairing:

1. Define the canonical time reference (UTC vs local). Document the decision in the project functional specification.
2. Configure the S7-300 to call SFC 1 in OB1 and write the result into the area pointer DB. Verify with VAT.
3. Add both Date/Time and JobMailbox area pointers to the HMI connection.
4. Set the TP700 Operating time zone to match the decision above.
5. Enable Daylight saving time only if the canonical time is local; disable it for UTC.
6. Disable NTP on the panel and on the project unless explicitly required.
7. Verify with control job 41 and 42 round-trip.
8. Trigger a DST transition in simulation or live and confirm the panel display jumps at the right moment.
9. Document the area pointer addresses and the time zone in the plant documentation.

11. Related Standards and References

The behavior of the Comfort Panel time model follows standard POSIX-style UTC plus offset rules as documented in IEC 61131-3 for DATE_AND_TIME encoding. The DST transition rules follow the EU directive 2000/84/EC and the US Energy Policy Act of 2005 for North America. Always verify your local DST rule against the relevant national authority - the panel's built-in EU and US rules cover the majority of installations but cannot anticipate every country's historical rule changes.

12. FAQ