WinAC RTX Time Synchronization with SFC1: Root Cause and Slave Mode Configuration
When the system function SFC1 (READ_CLK) inside an S7 user program running on a WinLC RTX virtual controller returns a timestamp that does not match the host PC clock or the value displayed on a connected HMI panel, the most common root cause is the clock-pulse / synchronization mode assigned to the virtual CPU in the STEP 7 / SIMATIC hardware configuration. This reference consolidates the diagnostic path, the configuration procedure, and the verification steps required to make WinLC RTX, WinCC Flexible, and a SIMATIC TP277B panel share a single, coherent wall-clock time across a local GMP/Audit Trail installation.
1. System Overview: WinAC, WinLC RTX, and SFC1
A Siemens WinAC (Windows Automation Center) installation replaces a hardware SIMATIC S7-CPU with a software-based controller that runs inside a Windows host. The variant WinLC RTX uses the Ardence/RTX real-time subsystem to schedule the PLC scan deterministically, so a user program written in STEP 7 for an S7-300/S7-400 CPU executes inside the virtual CPU exactly as it would on a rack-mounted controller.
Because the controller is a process inside Windows, its real-time clock is a software object. By default the virtual CPU owns its own internal time-of-day clock that is independent from the host PC's wall clock. The WinAC Time Synchronization service is the mechanism that bridges those two clocks; it uses either the host PC time or an external NTP/SNTP source as the master and forces the virtual CPU clock to follow it.
Inside the S7 program the time is read with the system function:
CALL SFC1 // READ_CLK
RET_VAL := #dtSystemTime // DATE_AND_TIME, 8 bytes BCDSFC1 returns the current date and time of the calling CPU in DATE_AND_TIME format (BCD, byte 0 = year, byte 1 = month, byte 2 = day, byte 3 = hour, byte 4 = minute, byte 5 = second, bytes 6-7 = milliseconds + weekday). The function is described in the STEP 7 online help and the WinAC Time Synchronization operating manual (Siemens support entry 22205381).
2. Problem Description: Divergent Clocks Inside One PC
The reported symptom pattern, observed on an iPC477C with WinLC RTX V4.5, WinCC Flexible, and a TP277B 6" panel, is characteristic of the master/slave misconfiguration discussed in this article:
| Source of the displayed time | Observed value | Expected behavior |
|---|---|---|
| Host PC system tray clock | Correct (e.g. 14:32:05) | Reference, synchronized to NTP or set manually |
| WinCC Flexible runtime (iPC477C) | Correct (synchronous with PC) | Tracks host clock |
| TP277B 6" panel | Correct (synchronous with controller) | Tracks the PLC time-of-day as slave |
| SFC1 (READ_CLK) inside the S7 program | Wrong, frozen, or offset (e.g. 02:14:00 or static) | Must match the other three sources |
Three of the four clocks agree, while the fourth — the value reported by SFC1 — drifts, freezes, or sits at an arbitrary offset. Because the WinCC Flexible runtime on the same iPC shows the correct time, the host clock and the WinAC Time Sync service are obviously delivering data. The virtual CPU simply is not consuming that data.
3. Root Cause: Virtual CPU Clock Mode in HW Config
Every SIMATIC CPU exposes, inside its Properties > Diagnostics/Clock dialog in the STEP 7 hardware configuration, a parameter that defines how the on-board clock is treated with respect to other time masters on the MPI/PROFIBUS or Ethernet network. For a WinLC RTX this dialog is part of the WinLC RTX object in the station.
| Mode in HW Config | Effect on the CPU clock | When to use |
|---|---|---|
| None (local) | CPU runs its own internal clock; no correction from outside; broadcasts its clock on the subnet only if it is also time master. | Stand-alone controller not synchronized to any source. |
| Master | CPU actively forwards its own clock onto the subnet; rejects synchronization attempts from other masters. | The controller itself is the plant-wide time source. |
| Slave (without sync on MPI) | CPU accepts incoming time frames and corrects its own clock; it does not broadcast. | A higher-level station (PC, HMI, NTP-relaying CPU) is the master — the case required for a WinLC RTX paired with WinAC Time Sync. |
| Slave (with sync on MPI) | As above, plus the CPU forwards the corrected time on the MPI/PROFIBUS subnet so downstream slaves (TP277B, ET200S, etc.) are also updated. | WinLC RTX as central PLC in a cabinet, with HMI panels and distributed I/O as slaves. |
If the virtual CPU is left in None or Master mode, the WinAC Time Sync service can deliver perfectly valid time frames to the WinLC interface, but the CPU clock is configured to ignore them. SFC1 will then continue to return the value the internal software clock had at the moment the WinLC RTX was started — usually a value from the BIOS clock at boot, or zero. The HMI runtime and the TP277B look correct only because they display the host PC time directly (WinCC Flexible runtime tag) or are themselves slaves of the WinLC RTX which still happens to hold a coherent value internally.
SFC1 continues to return a value that has no relation to the host PC clock.
4. Prerequisites and Affected Versions
Before changing the clock mode, confirm that the following prerequisites are met on the iPC477C target:
- STEP 7 project is open with the WinLC RTX station, and the station can be downloaded to the virtual CPU without errors.
-
WinLC RTX V4.5 (or later V4.x) is installed as a Windows service. The service name is
WinLC RTXand the executable iswinlcsvr.exe. - WinAC Time Synchronization is installed. The package is the WinAC Time Sync component shipped on the WinAC Toolkit DVD and is also referenced in Siemens support entry 22205381.
- WinCC Flexible 2008 SP3 (or later) runtime is loaded on the iPC477C.
- TP277B 6" panel project with a configured area pointer Date/Time (pointer 0) or an HMI tag of type Date/Time for clock synchronization with the controller.
- The user has administrator rights on the iPC477C to stop/start the WinLC RTX service and to edit the registry key
HKLM\SOFTWARE\Siemens\WinLC\TimeSyncif needed.
5. Step-by-Step Configuration Procedure
- Stop the WinLC RTX service. Open Start > Run > services.msc, select WinLC RTX, click Stop. This is required because the hardware configuration cannot be downloaded to a running virtual CPU.
- Open the STEP 7 project containing the WinLC RTX station and double-click the WinLC RTX object inside the station (HW Config).
- Open the Diagnostics/Clock tab in the Properties dialog of the WinLC RTX.
- Set the clock mode to "Slave (with sync on MPI)" if the TP277B and any further HMI panels should also receive a forwarded time. Use "Slave (without sync on MPI)" if the WinLC RTX is itself a leaf node and the HMI panels are slaves of the host PC clock via a different mechanism. Do not leave the setting on None or Master.
- Click OK to close the dialog, then Station > Save and Compile followed by PLC > Download to Target. Confirm the warning that the target is being reset.
- Configure the time-master address. Still in HW Config, select the WinLC RTX object and open Properties > Diagnostics/Clock > Clock Synchronization via…. For a local iPC477C station select "Synchronization via Ethernet (NTP)" only if you want the host PC to act as the NTP source; otherwise the simpler "Synchronization via WinAC Time Sync Service on the local PC" is the right choice.
- Start the WinLC RTX service in services.msc. Watch the Windows event log (Application log, source WinLC RTX) for the message "Clock synchronized".
- Start the WinAC Time Synchronization service if it is set to Manual startup. By default it starts automatically with the WinLC RTX service.
- Verify by reading SFC1 in the S7 program (see section 10).
6. WinAC Time Synchronization Service Parameters
The WinAC Time Sync service is configured through a small dialog that is launched from Start > Programs > Siemens Automation > SIMATIC > WinAC > Time Synchronization. The following parameters determine the behavior:
| Parameter | Allowed values | Default | Notes |
|---|---|---|---|
| Time source | Local PC clock | External NTP server | Local PC clock | For a stand-alone iPC477C that may later be connected to a plant network, set to Local PC clock; the host clock is then itself synchronized to the customer NTP server. |
| Synchronization interval | 1 s to 86 400 s | 10 s | WinAC Time Sync does not need to run every cycle; 10 s is sufficient for Audit Trail granularity. |
| Time zone handling | UTC (GMT) | Local time | Local time | Select UTC if downstream consumers expect UTC; otherwise select Local time and keep the host PC's time-zone setting correct. |
| Service startup | Automatic | Manual | Disabled | Automatic | Must be Automatic on a GMP-relevant station so the controller is resynchronized after every reboot. |
If the service is unable to reach the configured NTP server — for example because the iPC477C has not yet been connected to the customer network — the service logs a warning to the Application event log and the WinLC RTX clock is not corrected. This is the second most common reason for a divergence between the host PC clock and SFC1. Setting the source to Local PC clock removes the dependency on the external server and is the recommended default for a stand-alone machine.
For Windows-based controllers, the host clock itself can be configured to follow an external NTP source. If this Windows Time service fails to synchronize, configure it in client mode as described in the Microsoft article Time synchronization may not succeed (Windows Server).
7. SFC1 (READ_CLK) Behavior in a Virtual Controller
SFC1 on a hardware S7-CPU reads the buffered hardware clock; the same call on a WinLC RTX reads the virtual clock maintained inside the WinLC RTX process. The function is non-blocking and returns immediately with the current value.
// Example: log the current time to a data block on each scan
DATA_BLOCK "dbAudit"
STRUCT
tsSystem : DATE_AND_TIME; // 8 bytes, BCD
tsUser : DATE_AND_TIME;
END_STRUCT
END_DATA_BLOCK
FUNCTION_BLOCK fbAuditTick
VAR_TEMP
dtNow : DATE_AND_TIME;
END_VAR
BEGIN
CALL SFC1 // READ_CLK
RET_VAL := dtNow;
"dbAudit".tsSystem := dtNow;
END_FUNCTION_BLOCKTwo failure modes are observed in the field:
| SFC1 return value | Most likely cause |
|---|---|
DT#90-01-01-00:00:00.000 (zero) |
WinLC RTX has never been time-synchronized; the clock mode is None; the WinAC Time Sync service is not running. |
| Static value, e.g. time at first STOP-to-RUN transition | Clock mode is Master or None; the CPU is broadcasting its own frozen time and rejecting all incoming synchronization frames. |
| Time drifts by 1 s every few cycles | Synchronization interval is too long; the internal software clock has its own drift and is only corrected every N seconds. |
| Time is correct, but HMI shows UTC, SFC1 shows local time (or vice versa) | Time-zone handling mismatch between WinAC Time Sync and the HMI project. |
8. WinCC Flexible and TP277B Time Display
WinCC Flexible Runtime on the iPC477C displays the host PC clock by default, which is why the HMI on the iPC always showed the correct time even when SFC1 was wrong. The HMI is therefore not a useful verification of the WinLC RTX clock unless it is explicitly bound to a controller tag (area pointer 0, Date/Time PLC) or to a tag whose value is read by an SFC1-driven S7 program.
The TP277B 6" panel, in contrast, is configured as a clock slave in the WinCC Flexible project under Connections > Area Pointer > Date/Time. The panel expects the controller to broadcast the time, and the WinLC RTX will do so only if the clock mode is set to Slave (with sync on MPI) or Master. Because the panel is therefore a downstream slave of the same WinLC RTX whose internal clock was wrong, the panel's time matched the host PC clock only by coincidence (or because the panel had been synchronized once at startup from a known-good state).
9. GMP, Audit Trail, and Simatic LogOn Considerations
When the WinAC station runs the GMP option with Audit Trail and Simatic LogOn, every user action, every alarm, and every process value is stamped with a timestamp from the clock of the node that produced the event. If the HMI runtime stamps Audit Trail entries with the host PC clock while the S7 program stamps process events with SFC1, an FDA-style audit reconstruction will show two different times for events that were logged in the same second from the same station.
To guarantee coherence, the time master for the entire station must be a single source. The recommended hierarchy is:
- Host PC clock (synchronized to an external NTP server when the station is networked; manually set otherwise).
- WinAC Time Sync service forwards the host clock to the WinLC RTX virtual CPU at a 10 s interval.
- WinLC RTX (mode: Slave with sync on MPI) accepts the time and re-broadcasts it on the MPI/PROFIBUS subnet.
- TP277B and any other HMI panels accept the re-broadcast and update their internal clocks.
The same hierarchy is preserved when the customer's plant NTP becomes available: only the host PC clock's source is changed (in the Windows Time service, per Microsoft support guidance); the rest of the automation chain requires no modification.
10. Verification Procedure
After changing the clock mode, perform the following checks in order. Each step must succeed before moving to the next.
- Host clock: Confirm that the Windows clock in the system tray shows the expected local time. Open cmd > w32tm /query /status and verify the source.
- WinAC Time Sync service: In services.msc, confirm the service is Started and Startup type: Automatic. Open the Event Viewer, Application, and look for a recent WinAC Time Sync event of type Information reporting successful synchronization.
- WinLC RTX clock mode: In STEP 7 HW Config, open the WinLC RTX properties, Diagnostics/Clock tab, and confirm the mode is Slave (with sync on MPI) or Slave (without sync on MPI) as planned.
-
Live SFC1 read: Add a watch to
dbAudit.tsSystemin STEP 7 (online > monitor/modify) and refresh the view several times. The value must advance in real time and must match the host PC clock to within the configured synchronization interval (default 10 s). - TP277B: On the panel, open System > Date/Time. The displayed time must match SFC1 and the host PC clock.
- WinCC Flexible runtime: On the iPC, the runtime clock must show the same time. If the runtime is bound to a controller tag (recommended for GMP), the tag must equal the SFC1 value.
11. Troubleshooting Matrix
| Symptom | Probable cause | Remedy |
|---|---|---|
| SFC1 returns zero, HMI correct. | Clock mode = None or Master; WinAC Time Sync not delivering. | Set clock mode to Slave in HW Config; start WinAC Time Sync service. |
| SFC1 returns a static, non-zero value. | WinLC RTX started once, then clock was not resynchronized; clock mode = Master. | Change clock mode to Slave, recompile, download, restart WinLC RTX. |
| SFC1 drifts by 1 s every few scans. | Synchronization interval too long, or NTP source unreachable. | Reduce interval to 10 s; check Windows Time service per Microsoft KB. |
| TP277B correct, WinLC SFC1 wrong. | Panel synchronized from a different source (e.g. direct host PC clock area pointer). | Bind panel via area pointer 0 (Date/Time PLC) so it follows the controller. |
| HMI shows UTC, SFC1 shows local time. | Time-zone mismatch in WinAC Time Sync or in the HMI project. | Set WinAC Time Sync to Local time and disable UTC offset in the HMI project; alternatively, set both to UTC. |
| Time correct, but Audit Trail shows two different times for same event. | HMI tags stamped with PC clock, S7 tags stamped with SFC1. | Route all timestamps through a single source (host PC → WinAC Time Sync → WinLC RTX → SFC1). |
| Time correct after restart, drifts within an hour. | Host PC clock has no NTP source; battery-backed PC clock drifting. | Enable Windows Time service in client mode per Microsoft guidance, or replace the CMOS battery. |
| Clock mode change has no effect. | Configuration was not downloaded to the target, or WinLC RTX was not stopped before download. | Stop WinLC RTX, download HW Config, restart service, re-verify. |
12. Frequently Asked Questions
Why does SFC1 return the wrong time even though WinCC Flexible on the same PC is correct?
The WinCC Flexible runtime reads the host PC clock directly via Windows, not via SFC1. A wrong SFC1 value means the virtual CPU clock is not synchronized. The most common cause is that the virtual CPU is set to None or Master clock mode in HW Config. Change it to Slave (with sync on MPI) so the WinAC Time Sync service can overwrite the CPU clock.
Where do I set the clock mode of a WinLC RTX?
Open the STEP 7 project, double-click the WinLC RTX object inside the station in HW Config, and select the Diagnostics/Clock tab. Choose Slave (with sync on MPI) if downstream HMI panels should also be synchronized, or Slave (without sync on MPI) otherwise. After saving, stop the WinLC RTX service and download the hardware configuration.
Does SFC1 on a WinLC RTX read the host PC clock?
No. SFC1 reads the internal clock of the virtual CPU. The internal clock is bridged to the host PC clock by the WinAC Time Synchronization service, which is why the service and a Slave clock mode on the virtual CPU are both required for SFC1 to return host-PC time.
What synchronization interval should I use for a GMP station?
10 seconds is sufficient for Audit Trail granularity and keeps the drift between two consecutive corrections well below one second. Tighter intervals (1-2 s) are supported but are rarely necessary and increase the load on the WinLC RTX scheduler.
How do I make the station follow the customer's NTP server without changing the S7 program?
Leave the WinAC Time Sync source on Local PC clock. Configure the Windows Time service on the iPC477C to use the customer's NTP server in client mode, as described in the Microsoft article Time synchronization may not succeed. The host clock, and therefore the entire automation chain, will then follow the customer server with no change to the S7 or HMI project.
Can I synchronize the WinLC RTX to an external NTP server directly?
Yes. In the WinLC RTX Properties > Diagnostics/Clock > Clock Synchronization via… dialog, select Synchronization via Ethernet (NTP) and enter the NTP server address. The virtual CPU then becomes a direct NTP client. The WinAC Time Sync service is still required if you want the host PC clock and the WinLC RTX to remain in lockstep when the NTP server is unreachable.
Why is the TP277B clock correct but SFC1 wrong?
The TP277B has its own battery-backed real-time clock and can be synchronized from the controller, from the host PC, or by the user. If the panel was synchronized directly from the host PC (e.g. via an HMI tag) it will show the correct time even when the controller is not synchronized. For a fully consistent station, bind the panel to the controller via the Date/Time area pointer so it follows the same clock source as SFC1.