Configuring GPRS Telecontrol for WinCC v7.5 SP2 with SINAUT ST7

1. Overview: Connecting 1000+ GPRS Gas Meters to WinCC v7.5 SP2

The deployment described involves approximately 1,116 G4EUS-2 ultrasonic gas meters equipped with integral GPRS modems, geographically distributed across a utility's distribution grid, all reporting back to a central SIMATIC WinCC v7.5 SP2 SCADA station. Each G4EUS-2 unit exposes its consumption, diagnostic, and configuration data over a GPRS bearer using a vendor-specific application protocol; the field units do not natively support any of the WinCC v7.5 SP2 channel drivers (Mitsubishi, Modbus TCP, OPC, S7, Allen-Bradley, etc.). The challenge is therefore twofold: (a) terminate the GPRS transport on hardware that the WinCC v7.5 SP2 channel can subscribe to, and (b) scale the system so the SCADA server is not flooded with 1,116 simultaneous TCP/GPRS sessions.

Siemens' sanctioned path for this class of deployment is the SINAUT ST7 telecontrol architecture, in which each remote site is polled by a local S7 PLC (typically an S7-1200) acting as a telecontrol station, with the GPRS link terminated on a CP 1242-7 communication processor or, on older S7-300/400 sites, on a TIM 3V-IE / TIM 4R-IE Telecontrol Interface Module. The WinCC v7.5 SP2 server then reads the buffered data from the master S7 via the native S7 channel, dramatically reducing the number of GPRS bearers visible to the HMI/SCADA layer.

2. System Architecture and Data Flow

The SINAUT ST7 architecture implements a three-tier hierarchy:

1. Remote terminal unit (RTU): G4EUS-2 meter → S7-1200 CPU (e.g. CPU 1214C DC/DC/DC, 6ES7214-1AG40-0XB0) via RS-485 Modbus RTU or local M-Bus.
2. Telecontrol station: S7-1200 + CP 1242-7 GPRS module (6GK7242-7KX31-0XE0) over a private APN or public GPRS/UMTS bearer.
3. Telecontrol master: S7-1500 or S7-400 master station equipped with a TIM 4R-IE (6NH7800-4BA00) or a CP 1243-1 (S7-1500 variant), communicating to the WinCC v7.5 SP2 server over Industrial Ethernet (Profinet/TCP).

The WinCC v7.5 SP2 server reads process values from the master PLC using the SIMATIC S7 Protocol Suite channel (channel DLL: s7chn.dll). The HMI tags in WinCC are bound to DB areas of the master S7; the master S7 itself maintains the SINAUT frame store, time-stamps the buffered telegrams, and forwards them as standard S7 data blocks.

3. WinCC v7.5 SP2 Communication Channels

WinCC v7.5 SP2 ships the following native channel drivers in C:\Program Files (x86)\Siemens\Automation\WinCC\bin\:

The S7 Protocol Suite is the only channel that supports the high tag density required for 1,116 GPRS endpoints. A single WinCC v7.5 SP2 server license (RC 1,024) can hold up to 65,536 power tags in the standard edition and 256,000 in the WinCC/Server edition. For 1,116 meters with ~50 tags each (volume, flow rate, pressure, temperature, alarms, status words), 55,800 tags are typical - well within a single server. If the count approaches 80,000, deploy a WinCC/Server pair in redundant mode (RC 2,048).

4. SINAUT ST7 Protocol Stack

SINAUT ST7 (Siemens Network Automation, Telecontrol protocol over S7) is a Siemens-proprietary, OSI layer-7 protocol riding on TCP/IP or GPRS. The frame structure (per Siemens manual A5E00139845) is:

| STX(0x02) | LEN(2B) | ADR(2B) | TYPE(1B) | PAYLOAD(n) | BCC(1B) | ETX(0x03) |
TYPE values: 0x01 = S7-Data   0x02 = S7-Status
0x10 = Telecontrol-Data (G4EUS-2 register map forwarded as raw DB)
0x20 = Time-sync   0x30 = Config-upload
LEN = number of bytes between LEN and BCC, inclusive

The CP 1242-7 implements the Subscriber side; the TIM 4R-IE on the master implements the Master side. Frames are store-and-forward: the CP 1242-7 buffers up to 16,384 telegrams in internal flash if the GPRS link drops, with a 1-second time stamp. The SINAUT watchdog timer (default 30 s, configurable 5-300 s) flags a station as interrupted in WinCC if no frame is received within the window.

4.1 Bandwidth and Polling

For a G4EUS-2 meter generating 50 useful values every 15 minutes, a single station produces:

P_per_station = 50 tags * 4 bytes * 8 frames/h = 1,600 bytes/h (uplink)
P_total       = 1,600 * 1,116 / 3600 ≈ 0.50 kB/s ≈ 4 kbit/s

This is well below the typical CP 1242-7 ceiling of 85.6 kbit/s upstream. The GPRS connection can therefore be kept persistent (always-on), and the CP 1242-7 "GPRS_Keep_Alive" parameter (default 60 s) prevents the network from NAT-timeout'ing the session.

5. Hardware Components in Detail

5.1 CP 1242-7 GPRS Module

The CP 1242-7 (6GK7242-7KX31-0XE0) is the smallest S7-1200 GPRS telecontrol module. It supports GPRS multi-slot class 10, quad-band 850/900/1800/1900 MHz, and a single SIM card slot (1.8/3 V). It plugs into the left side of the S7-1200 CPU and uses the internal backplane. The relevant STEP 7 (TIA Portal V16 or later) configuration screen is Properties > Telecontrol > SINAUT:

5.2 TIM 4R-IE Master

For deployments above 256 stations per master PLC, the TIM 4R-IE (6NH7800-4BA00) is mandatory. It supports up to 512 SINAUT subscribers per TIM over two independent IP paths, and up to four TIMs can be installed in one S7-400 rack, giving a theoretical ceiling of 2,048 subscribers per master. The TIM is configured with the SINAUT TD7 or, in current projects, the STEP 7 plug-in SINAUT Configuration Tool (part of SIMATIC NET V15.1 or later). Each subscriber entry in the TIM holds:

SUBSCRIBER_NO    = 1..1116
SUBSCRIBER_IP   = (assigned by DHCP of private APN, or static)
TX_CYCLE         = 900 s   (15 min, matches G4EUS-2 sample rate)
ACK_TIMEOUT      = 5 s
RETRY_COUNT      = 3
PASSWORD         = SHA-256 of subscriber_no + plant secret

6. G4EUS-2 Interface and Data Mapping

The G4EUS-2 ultrasonic gas meter is a battery-powered (lithium-thionyl-chloride, 10-year life) residential/light-commercial meter with:

• Flow range: 0.04 - 6 m³/h (G4 size)
• Accuracy class: 1.5 % (Q_t ≤ Q ≤ Q_max)
• Output: integrated GPRS modem (option -G), plus an optical IEC 62056-21 interface
• Open collector pulse output: 1 pulse per 0.01 m³ (default, configurable 0.1 / 0.01 / 0.001)
• Modbus register map (when ordered with RS-485 option): 0x0000 = serial, 0x0002 = V_total (m³, float32, BE), 0x0006 = V_flow (m³/h, float32, BE), 0x000A = T (°C), 0x000C = P (bar), 0x000E = status

Because the GPRS variant does NOT expose Modbus over the wireless link (only the vendor binary protocol is on the GPRS channel), the S7-1200 program must decode the G4EUS-2 vendor telegrams. A typical implementation in TIA Portal uses a structured DB of type "G4EUS2_TLG" sized at 32 bytes and a CRC-16/CCITT-FALSE polynomial checker. The decoded values are then placed in a mirror DB (e.g. DB100) that the CP 1242-7 ships up via SINAUT.

// SCL snippet for G4EUS-2 decode
#status := WORD_TO_INT(IN_BYTE_ARR[#idx+5]) AND 16#000F;
#v_total := REAL(IN_BYTE_ARR[#idx+6]) * 256.0
          + REAL(IN_BYTE_ARR[#idx+7])
          + REAL(IN_BYTE_ARR[#idx+8]) / 256.0;

7. Capacity Planning for 1,116 GPRS Stations

For redundancy, a second master PLC on a second physical Ethernet (e.g. an OSC_2 redundant WinCC pair) reads from the standby TIM. SINAUT ST7 supports up to four redundant paths per subscriber.

8. Step-by-Step Configuration

8.1 Prerequisites

• WinCC v7.5 SP2 with Update 10 installed on Windows Server 2016 / 2019 (x64)
• STEP 7 Professional V16 (TIA Portal) for the S7-1200 / S7-1500 configuration
• SIMATIC NET V15.1 or later for the TIM 4R-IE master
• Private APN with static IP pool (size 1,200 addresses /29 prefix minimum)
• All 1,116 SIM cards provisioned with the same APN and the SINAUT subscriber number written to the SIM's MSISDN or a custom field
• Dongle licenses: WinCC RC 1,024 + AS 1,024 (or RT 128 for a client)

8.2 Procedure

1. Build the project in TIA Portal. Add the S7-1200 CPU and CP 1242-7 to a new project. Set the CP 1242-7 mode to "SINAUT subscriber" and assign a unique subscriber number (1 ... 1,116). Configure the APN, DNS, and the master IP.
2. Implement the G4EUS-2 decode. Add a cyclic OB1 block that reads the serial buffer of the meter, decodes the vendor telegrams, and writes to a mirror DB (e.g. DB100 "mirror").
3. Configure SINAUT frame storage on the master TIM. In the SINAUT Configuration Tool, create one entry per subscriber (1 ... 1,116). Each entry points to a unique source DB in the master (e.g. DB1 = sub 1, DB2 = sub 2, ...). Set the polling cycle to 900 s.
4. Connect the master S7 to WinCC. In WinCC Explorer, right-click Tag Management > SIMATIC S7 Protocol Suite > TCP/IP and add a new connection. Enter the master S7's IP address, rack/slot 0/1 (S7-1500) or 0/2 (S7-400 with TIM).
5. Create the tag structure. For each of the 1,116 stations, create a tag group with five external tags: V_total (DB 0, offset+6, REAL), V_flow (DB 0, offset+6, REAL), T (DB 0, offset+10, REAL), P (DB 0, offset+12, REAL), Status (DB 0, offset+14, WORD).
6. Enable time synchronization. On the S7-1200, set the CP 1242-7 "time-of-day sync" to receive a daily SINAUT time frame from the master. Distribute this with the SFC 48 on the master to all CPUs.
7. Set up OPC UA (optional). If you prefer OPC UA, activate the OPC UA server on the S7-1500 master (TIA: Properties > OPC UA Server > Activate) and add the OPC UA Client channel in WinCC instead of S7.
8. Activate the WinCC project. Start the WinCC Runtime and verify in the Channel Diagnosis tool (Start > SIMATIC > WinCC > Channel Diagnosis) that all 1,116 S7 connections reach state "Connected".

9. Commissioning and Verification

1. Power up the first five stations and check the SINAUT log on the master (SINAUT > Logbook). The "Subscriber is reachable" entry must appear within 60 s of the CP 1242-7 registering with the APN.
2. Trigger a value change on the G4EUS-2 (blow a small quantity of air through it) and observe the matching tag in WinCC online. The end-to-end latency should be < 30 s (5 s G4EUS-2 internal sample + 15 s APN connect + 5 s SINAUT frame + 5 s S7 channel).
3. Run wincc.exe -v and confirm the tag count matches the license RC 1,024 limit minus 5 % headroom.
4. Pull the antenna from one station. Within 30 s the WinCC status tag should change to 0x0002 (interrupted). Plug the antenna back in and verify automatic reconnection within 60 s.
5. Verify the S7-1500 buffered frames: open the SINAUT frame monitor (SINAUT > Frame Monitor) and confirm that, during a planned APN outage, the CP 1242-7 stored telegrams are still being delivered when the link returns.

10. Troubleshooting Matrix

11. References to Official Documentation

The following Siemens manuals and application notes are the canonical sources for the configuration above. Use them to verify part numbers, firmware baselines, and SINAUT parameter ranges before commissioning:

• Siemens Support entry "Simatic Telecontrol for WinCC v7.5 (SINAUT)" – application description: 109814522
• Siemens Support entry "S7-1200 telecontrol with CP 1242-7 application example": 39863979
• Siemens Support entry "S7-1200 GPRS communication with CP 1242-7 – example project": 58638283

12. FAQ