Every multi-system incident investigation begins the same way: four devices, four clocks, four versions of “when”. The cheapest diagnostic infrastructure a plant can buy is agreement about time.
The payoff
With CPUs, drives, HMIs, switches and servers NTP-disciplined to one source, event buffers align: the drive’s fault at 14:03:07.412, the PLC’s interlock drop at 14:03:07.418, the SCADA alarm at 14:03:07.9 — causality readable at a glance, across vendors. Without it, the same evidence supports any narrative — and the loudest narrative wins the meeting.
The setup, pragmatically
One or two plant time sources (a small NTP appliance with GNSS, or the IT domain’s servers where OT/IT trust allows), advertised on the automation networks; every device that can sync, does — S7 CPUs (NTP client in the interface settings), SCADA/historian hosts, managed switches (their logs matter in network incidents), drive platforms and panels per their capability. Devices that only sync from their PLC inherit through it — fine, as long as the chain is documented.
Then the discipline half: time zones handled deliberately (log in UTC or one plant time — mixed is worse than either), DST behavior verified once (the annual double-hour has hidden real events), and clock health alarmed — a device that silently drifted for a year is the investigation’s landmine.
FAQ
How accurate is NTP on plant networks? Milliseconds-class routinely — transforming for cross-system forensics. Sub-millisecond needs (SOE recording, power systems) step up to PTP-class solutions where hardware supports it.
Who owns the time source, OT or IT? Whoever answers pages when it breaks — decided explicitly. Shared sources with an OT-readable status page have worked well in our deployments.
Zone Otomasyon adds clock sync to every SCADA and monitoring project by default — future incidents are cheaper aligned. Plant infrastructure.