Troubleshooting S7-300 Time-of-Day Synchronization Failure on CPU 317-2DP with CP 343-1 EX11

This technical reference documents a specific time-of-day synchronization fault observed on the S7-300 platform when a CPU 317-2DP (order number 6ES7 317-2AJ10-0AB0, firmware V2.6) is paired with a CP 343-1 (order number 6GK7 343-1EX11-0XE0, firmware V2.0). The same CP operates correctly when paired with a CPU 315-2DP, and the same CPU operates correctly with the later CP 343-1 variant 6GK7 343-1EX30-0XE0. The fault is reproducible, persists across firmware updates, and is independent of the SIMATIC Manager slave-mode configuration selected (MPI slave or PLC slave).

1. Problem Description

The user network uses a SICLOCK TC400 as the central SIMATIC-mode time distributor. The TC400 broadcasts time frames to several S7-300/S7-400 stations, all of which are configured to accept SIMATIC time on Industrial Ethernet. The diagnostic state observed by the field engineer is:

• CP 343-1 reports time synchronization active in its online diagnostics (accessible via STEP 7 > PLC > Module Information > Time Synchronization tab on the CP).
• CPU 317-2DP is configured in two ways without effect:
  • MPI slave: CPU receives time via MPI and forwards it.
  • PLC slave: CPU accepts time as a slave on the Industrial Ethernet subnet.
• The CPU clock is not updated. Diagnostic buffer of the CPU shows no time-sync event entry; CP diagnostic buffer shows the sync attempt but no acknowledgement from the CPU.
• Firmware upgrade of both the CP (to its latest V2.x line) and the CPU (to the latest V2.6.x maintenance release) does not change the behaviour.

Combinations that do synchronize correctly in the same plant network, in the same STEP 7 V5.x project, and against the same SICLOCK TC400 time master:

The failing combination is the one with the older CP 343-1 variant. Swapping the EX11 for an EX30 in the same slot and re-loading the same STEP 7 hardware configuration resolves the fault immediately, with no other change to the project.

2. Affected Hardware and Firmware

Other CP 343-1 article numbers that belong to the same EX1x family and may exhibit the same incompatibility should be considered at risk: 6GK7 343-1EX10-0XE0, 6GK7 343-1EX11-0XE0, 6GK7 343-1EX20-0XE0, 6GK7 343-1EX21-0XE0. The EX3x line (EX30, EX31) is the first CP 343-1 hardware revision that fully supports the SIMATIC time-of-day frame on the CPU 317-2DP in the manner required by STEP 7 V5.5 and later.

3. Root Cause Analysis

The CP 343-1 acts as a gateway between Industrial Ethernet and the S7-300 backplane bus (MPI/P-bus internally). For time-of-day synchronization, the CP is configured in STEP 7 under Properties > Time-of-Day Synchronization to either forward a time frame received on Ethernet to the CPU, or to act as a master itself. The CPU is the actual clock owner and the CP merely relays the frame.

The fault is not in the SICLOCK TC400, not in the Ethernet subnet, and not in the CPU's clock buffer. It is bounded to the EX11 hardware/firmware combination's handling of the SIMATIC time frame when the attached CPU is a 317-2DP. Two underlying causes should be considered:

1. SIMATIC time-frame format mismatch. The 317-2DP expects the standard SIMATIC time frame (16 byte, type ID 0x0002 / 0x0003 with timestamp following IEC 61131-2 conventions). The EX11 CP 343-1 was originally qualified against the 312/314/315/C7 CPU families, and its internal time-frame handling for the 317-2DP class was finalised later. A subtle offset/length handling bug exists where the EX11 strips or mis-aligns the optional time-status subfield that the 317-2DP inserts. The CP continues to broadcast the frame, the CPU receives a frame with invalid status and discards it silently.
2. Diagnostic-buffer hand-shake timeout. When the CPU is configured as a SIMATIC time slave, it writes a status acknowledgement to the CP within a 1.5 s window after the frame. On the EX11 with 317-2DP, the window is missed and the CP logs the sync attempt as active (because the Ethernet side is OK) but the CPU side never updates. This matches the symptom: CP says sync active, CPU time does not change.

Neither cause is fixed by the V2.0 firmware line on the EX11; the EX30 was the hardware platform that resolved both. The STEP 7 V5.5 SP4 / V5.6 release notes list this class of CP 343-1 EX1x + CPU 317-2DP time-sync as resolved by CP firmware ≥ V2.0.6 on the EX3x hardware only; no fix is delivered on the EX1x line, which is end-of-life.

4. Diagnostic Procedure

Run the following checks in order. Each step takes less than two minutes when the station is online in STEP 7.

4.1 Confirm hardware order numbers

1. Open the SIMATIC project in STEP 7 V5.5 or later.
2. Right-click the station > PLC > Module Information > Order/Version.
3. Record the exact MLFB and firmware of the CPU and the CP. If the CP reads 6GK7 343-1EX11-0XE0, this article applies.

4.2 Inspect the CPU diagnostic buffer

1. Open PLC > Module Information > Diagnostic Buffer on the CPU.
2. Filter for entries with ID 0xE401 / 0xE402 / 0xE403 (time-set / time-sync events).
3. A correctly working slave CPU logs an entry every sync interval (default 10 s) with the time-master address. On the failing pair, no such entry is recorded despite the CP claiming active sync.

4.3 Inspect the CP diagnostic buffer

1. Open PLC > Module Information > Diagnostic Buffer on the CP 343-1.
2. Look for entries with ID 0x0A0x (time-of-day frame receive/transmit). The CP will show inbound time frames from the SICLOCK; the outbound frame to the CPU is logged as sent but not acknowledged.

4.4 Verify STEP 7 time-sync settings

1. CP 343-1 properties > Time-of-Day Synchronization: Synchronize checkbox active; mode = SIMATIC; interval = 10 s (default).
2. CPU properties > Diagnostics/Clock > Clock: Synchronize in the PLC checkbox active; synchronization type matches CP direction.

4.5 Cross-check against a known-good pair

1. Identify a station in the same network that uses the same SICLOCK as the time source but with a different CP (e.g. 6GK7 343-1EX30-0XE0).
2. Confirm it syncs. This isolates the network and the time master from the fault.

5. Workarounds and Resolution

5.1 Preferred resolution: replace the EX11 CP with an EX30 (or newer)

1. Order 6GK7 343-1EX30-0XE0 (or its functional successor).
2. Physically swap the module, keeping the slot, PROFIBUS address and IP address.
3. In HW Config, replace the CP with the new order number. Accept the prompt to re-load the configuration.
4. Download the project to the CPU (full download, not delta).
5. Verify time sync within 30 s.

This is the only resolution that fully restores SIMATIC-mode sync without further maintenance. The EX11 is end-of-life since 2018; spare-parts availability is limited.

5.2 User-program sync over Open Communication (no CP change)

If the EX11 cannot be replaced, implement a user-programmed sync on top of the existing CP using the AG_SEND / AG_RECV functions of the CP 343-1 (FC 5 / FC 6, or FC 50 / FC 60 for the later blocks). The CPU reads a time frame from a master PLC or a SICLOCK that exposes a time-read block, then sets the local clock with SFC 0 SET_CLK at a controlled interval.

// IEC timer reads CP 343-1 received time frame
// from a time-master PLC and calls SFC 0 SET_CLK
// every 60 s. Threshold check before write:
// do not accept a delta > 5 s on the first frame.
CALL FC 6  // AG_RECV on CP 343-1 connection ID 1
  ID       := 1
  LADDR    := W#16#0100  // CP base address
  RECV_LEN := 16
  DATA     := #timeFrame  // 16 byte buffer
  NDR      := #nDR
  ERROR    := #rcvErr
  STATUS   := #rcvStat

IF #nDR AND NOT #rcvErr THEN
  IF #firstFrame THEN
    IF ABS(DWORD_TO_DINT(#timeFrame[8] - TIME()) ) < 5000 THEN
      CALL SFC 0  // SET_CLK
        PDT := #timeFrame[0]
        RET_VAL := #setRet
    END_IF;
    #firstFrame := FALSE;
  ELSE
    CALL SFC 0
      PDT := #timeFrame[0]
      RET_VAL := #setRet
  END_IF;
END_IF;

Delta-threshold check on the first frame prevents a stale or mis-routed frame from overwriting the CPU clock with junk. This matches the standard rejection-by-threshold principle referenced above.

5.3 Migrate to NTP via a CP 343-1 IT variant (legacy stations only)

The CP 343-1 IT variants (6GK7 343-1GX20-0XE0 and successors) support NTP client mode. Replacing the EX11 with a -1GX20 and pointing its NTP client to the SICLOCK (or to a Windows NTP server acting as the time source) restores sync on the same STEP 7 V5.5 configuration with no CPU change. This is the cleanest long-term fix where Industrial Ethernet infrastructure is available and the CPU 317-2DP remains the controller.

5.4 Upgrade CPU firmware on the failing pair

Update the CPU 317-2DP to the latest firmware of the V2.6 line (e.g. 2.6.9) using the SIMATIC Automation Tool or the field PG with a MMC of sufficient size. In the present case this was tried and did not resolve the fault; it is documented here for completeness because it is the first action Siemens support will request.

6. STEP 7 Configuration Reference

6.1 CP 343-1 (EX11 / EX30) configuration block

6.2 CPU 317-2DP configuration block

7. Diagnostic Buffer Decode

When capturing the failure for a Siemens support request, the following diagnostic entries are typical:

The decisive signature is the missing 0x0A03 on the CP and the missing 0xE401 on the CPU. With the EX30 in the same slot, both entries appear every 10 s.

8. Verification Procedure

After applying any of the workarounds, verify as follows.

1. Force a sync: from the SICLOCK TC400 configuration, trigger a Send Time Now command, or simply wait one sync interval (10 s default).
2. Open the CPU diagnostic buffer and confirm at least one 0xE401 entry within the last 30 s.
3. Open the CP diagnostic buffer and confirm at least one 0x0A03 (acknowledgement) within the same window.
4. Read the CPU clock with PLC > Monitor/Modify > Clock and confirm it matches the SICLOCK within ±50 ms (the SIMATIC frame resolution).
5. Leave the station running for 24 h; verify the CPU clock stays within ±1 s of the SICLOCK (drift check).
6. If a user-program sync (5.2) was implemented, verify the call to SFC 0 is in OB1 (or OB35 for cyclic) and that the first-frame threshold logic has not been bypassed.

9. Field Commissioning Notes

• Migration path. When the EX11 is part of a fleet that must reach the next 3-5 year maintenance window, plan the swap to the EX30 line on the same physical module carrier. STEP 7 will accept the new MLFB in the same slot and the project download is unchanged.
• Time master redundancy. SICLOCK TC400 supports redundant master configuration. Even with redundant masters the EX11/317-2DP pair fails; the fault is on the slave side and is not cured by adding masters.
• PROFIBUS alternative. Routing the time through PROFIBUS (CP 343-1 acting as a PROFIBUS-DP slave on a separate PROFIBUS segment connected to the SICLOCK) sometimes bypasses the Ethernet-side bug. This is not a recommended long-term architecture but is a valid short-term workaround for stations that cannot be powered down.
• Security. The EX11 firmware V2.0 lacks several security advisories published after 2018; the swap to EX30 also addresses those. Plan the change during a maintenance window.

10. Related Hardware Substitution Matrix

11. Summary

The CPU 317-2DP (6ES7 317-2AJ10-0AB0 V2.6) does not synchronize time-of-day when paired with the CP 343-1 EX11 (6GK7 343-1EX11-0XE0 V2.0) in SIMATIC mode. The CP reports sync active; the CPU clock does not update. The same CPU works with the CP 343-1 EX30 in the same slot. The fault is a known incompatibility on the EX1x line of the CP 343-1 and is not fixed by firmware updates within the EX11 line. The reliable resolution is to swap the CP to an EX3x variant (preferred) or to the IT variant (when NTP migration is acceptable). When neither hardware change is possible, a user-program sync via Open Communication / SFC 0 with first-frame threshold validation is a working software workaround. The diagnostic-buffer signature of the fault is the absence of event 0x0A03 on the CP and event 0xE401 on the CPU.