Configuring S7-1200 CP 1242-7 SMS: TC_CON TC_SEND Reference

Configuring S7-1200 CP 1242-7 SMS Messaging with TC_CON, TC_SEND and TC_RECEIVE

This technical reference describes how to send and receive SMS messages on a SIMATIC S7-1200 CPU (such as the CPU 1214C or CPU 1215C) using the CP 1242-7 GPRS V2 communications processor. The instructions TC_CON, TC_SEND, TC_RECEIVE, and TC_DISCON from the TIA Portal "Communication Processor > GPRScomm 1242-7" library handle the GSM/GPRS transport. Field engineers consistently report three blocking problems: (1) the CP is missing from the device catalog, (2) the TC_CON returns status 16#7002 without establishing a connection, and (3) SMS payloads contain leftover characters from prior sends. Each is solved below with documented configuration steps and parameter settings.

1. Hardware Topology and Required Components

The reference topology is a single S7-1200 station feeding one CP 1242-7 GPRS V2 module. A valid subscriber identity module (SIM) with a public mobile-directory number is mandatory; the CP cannot route SMS without an inserted, unlocked SIM that has SMS service class enabled on the mobile account.

Mount the CP on the left side of the CPU in slot 101 or higher. TIA Portal auto-discovers the module once the matching hardware-support package (HSP) is installed; without it, the CP does not appear in the hardware catalog, which is the most common reason engineers report "I don't have CP 1242-7 in my project."

2. TIA Portal Version Prerequisites and HSP Installation

The TC_CON / TC_SEND blocks first shipped with TIA Portal V11 SP2 in the instruction catalog branch Instructions > Communication > Communication Processor > GPRScomm 1242-7. Each subsequent TIA release paired a new CP 1242-7 firmware (V1, V2, V2.1, V2.1.1). Siemens distributes matching HSPs as zip files. Field commissioning depends on three version checks.

1. TIA Portal Service Pack. Verify via Help > Installed Software. Anything older than SP2 lacks the GPRScomm instructions in the catalog.
2. Hardware Support Pack. Download the latest HSP from the Siemens support download page (filter keyword "HSP TIA Portal"). After import with Options > Support Packages, the CP 1242-7 GPRS V2 appears in the hardware catalog under Communication > CP 1242-7.
3. CPU firmware. The S7-1200 system manual recommends firmware 2.2 or higher for CP 1242-7 V2 compatibility. V4.x firmware provides improved PROFINET/CIP coexistence when the CP shares the backplane with other modules.

3. Hardware Configuration of the CP 1242-7

Open the device configuration, select the CP 1242-7 slot, and populate these properties. These values are taken directly from the V1.3 application guide (Entry ID 58638283).

The SCA (Service Center Address) is encoded PDU-style. If the carrier's SCA is +13123149890 (example), enter it in international format without leading 00 or +. Wrong SCA typically surfaces as status 16#800D on TC_SEND with subtype 02 (SMSC address not present or unknown).

4. Block Library: TC_CON, TC_DISCON, TC_SEND, TC_RECEIVE

All four instructions are FB (function blocks), not FCs. Each requires an instance DB. Drop a single instance DB per FB call so the connection state survives a scan-to-scan boundary. Reference FB parameters are:

4.1 TC_CON (Establish the SMS Connection)

TC_CON brings up the SMS-specific connection and registers the local station with the GSM subsystem. The ID you pass here is referenced by every subsequent SMS FB.

4.2 TC_SEND (Send an SMS)

Pins specific to TC_SEND:

4.3 TC_RECEIVE (Receive an SMS)

TC_RECEIVE is best invoked continuously (always TRUE on REQ, no edge). It returns immediately if no message is queued. The receive buffer must be at least 160 bytes (the GSM 03.40 single-message limit when using 7-bit encoding; 153 with 8-bit UCS2).

4.4 TC_DISCON (Tear Down the Connection)

Use when you want to deregister from the SMS service center without powering down the CP, for example at end-of-shift to release signaling resources.

5. Send-Buffer Layout: CHAR Array vs. STRING

The most-reported failure mode is "my SMS arrives with two garbage characters at the front." This is not a bug; it is the STRING header.

A Siemens STRING data type is laid out as:

If you point TC_SEND at a STRING, the CP transmits the header bytes first, which most phones ignore but some display as two corrupted glyphs. The fix is to use a CHAR array such as ARRAY[0..159] OF CHAR and tell TC_SEND the address of char[0]. Set LEN to the count of meaningful characters. Watch-table tip: visualize _msg[0] through _msg[n] as ASCII and _msg.b0 / _msg.b1 as BYTE to confirm pointer alignment.

5.1 Resetting Buffer Between Sends

The most common reported "leftover characters" symptom appears when concatenating messages: SMS1 = "alarm WWTU high level" (19 chars), SMS2 = "alarm heating" (13 chars). The receiver sees "alarm heatinggh level". Cause: a copy/concat instruction left the trailing region of the buffer populated with old data; TC_SEND trusts LEN exclusively.

1. Use a separate CHAR array per message, sized exactly to each payload.
2. After each successful send (DONE=TRUE && ERROR=FALSE), zero the entire buffer with FILL_BLK(srcByte:=0, dst:=ADR(_msg), len:=160).
3. For multi-message DBs, copy the chosen payload into the send buffer immediately before raising REQ. Never assume the buffer is empty.
4. Avoid assigning the STRING constant '' to a STRING variable and passing it to TC_SEND; that only resets the act word but leaves the act characters intact.

6. Step-by-Step Commissioning Procedure

1. Install HSPs. Download the latest TIA Portal HSP pack from the Siemens Online Support download area (search "HSP TIA Portal"). Import via Options > Support Packages. Restart TIA Portal.
2. Update CPU firmware. Use the online > accessible nodes path to bring the CPU to a firmware compatible with the CP version. V4.x is recommended for any current installation.
3. Insert the CP. From the hardware catalog Communication > CP 1242-7, drag the CP to slot 101 or higher. Verify the article number 6GK7242-7KX31-0XE0 matches the V2 module.
4. Configure the SIM. Enter the PIN, SCA, and a station identifier. Confirm the SIM has SMS class 0 enabled by the carrier and is unlocked.
5. Insert the instruction blocks. In a new OB (or in OB1), drag TC_CON, TC_SEND, TC_RECEIVE, and TC_DISCON from Instructions > Communication > Communication Processor > GPRScomm 1242-7. Each generates its own instance DB.
6. Wire the ID. Use a constant WORD (e.g. W#16#0001) on all four blocks. The CP uses the ID to multiplex the SMS channel with optional GPRS data channels.
7. Wire the receiver phone number. On TC_SEND, fill RCP_ADDR with international-format digits only (no "+", no spaces). Example: "4915112345678" for a German mobile.
8. Provide a CHAR send buffer. Declare "TXT_SEND" : ARRAY[0..159] OF CHAR in a global DB; pass its ADR to TC_SEND.
9. Build a CHAR receive buffer. Declare "TXT_RECV" : ARRAY[0..159] OF CHAR in the same DB; pass to TC_RECEIVE.
10. Edge-trigger REQ. Use the DONE or BUSY-to-NOT_BUSY transition from TC_CON to trigger TC_SEND. This guarantees one-shot behavior.
11. Compile and download. Compile the program block-by-block; download all blocks + DBs. Bring the CPU to RUN.
12. Watch-table monitor. Add a watch table with REQ bits, DONE, BUSY, ERROR, STATUS, and the CHAR buffers. Display STATUS as HEX.

7. Sample Ladder Logic Skeleton

The following is a compact ladder sequence implementing "dial" → "send" → "disconnect". Replace the names with project-specific tags.

Network 1: Trigger TC_CON on start
     startPulse                       startEdge                              TC_CON.REQ
──┤ ├──────┬──────────────[P_TRIG]──┬─────────────────────────────[ TC_CON ]─────────────────────
           │                          ID := W#16#0001                                  
           │                          Instance DB := iDB_TC_CON
           │                                                                              DONE, BUSY, ERROR, STATUS
           └────────────────────────────────────────────────►[set] conEstablished

Network 2: Trigger TC_SEND only after CON completes
     conEstablished    sendEdge                       TC_SEND.REQ
──┤ ├──────[P_TRIG]──┬───────────────────────────────[ TC_SEND ]───────
                      ID := W#16#0001
                      LEN := textLen
                      DATA := ADR("gDB_Msg"."TXT_SEND")           
                      RCP_ADDR := +4915112345678   // intl format

Network 3: Always-on TC_RECEIVE (no edge needed)
              TRUE                       TC_RECEIVE.REQ
──┤ ├────────────────────────────[ TC_RECEIVE ]───────
                                          ID := W#16#0001
                                          ADDR := ADR("gDB_Msg"."TXT_RECV")
                                          NDR, ERROR, STATUS, LEN

Network 4: Tear down on shutdown
              stopCmd                     TC_DISCON.REQ
──┤ ├────────────────────────────[ TC_DISCON ]───────
                                          ID := W#16#0001

8. Status Codes and Error Matrix

STATUS is a hex word. The high byte typically encodes the instruction-class error, the low byte the cause. Common values documented in TIA Portal help and the V1.3 application guide:

9. Diagnostic Procedure When Messages Are Not Delivered

1. Open Online & Diagnostics > CP 1242-7 > Diagnostics. Confirm the CP is in OPERATE and reports network registration.
2. Check the Signal Strength field. Anything < -95 dBm causes sporadic SMS loss.
3. Send a known-good SMS from a phone to the SIM to verify the SIM is active for inbound delivery.
4. Inspect DONE / ERROR / STATUS cycle on the watch table. If DONE is never observed, REQ was never edge-triggered — confirm with a forced pulse.
5. Verify SCA. The Phone Network parameters document of the carrier lists the service-center MSISDN.
6. If status is 16#800D, open the CP properties and ensure the SCA prefix field is non-empty.
7. Inspect the CHAR buffer for stray leading bytes if the message looks "cut off": most likely the STRING header is being transmitted.

10. SIM and Network Provider Checklist

11. Performance and Timing

SMIs typically deliver within 4 to 12 seconds once the connection is up. Re-connect after a dropped signal can take 30 to 60 seconds due to the GSM attach procedure. Always keep a slow TON (e.g. 2 minutes) before declaring the CP "down" and triggering SMS alarms on PLC fall-back channels. Buffer the outgoing SMS payload in a FIFO of PLC messages to avoid losing notifications during re-connect.

12. Verification Checklist

Use this list as the official sign-off before handing the system to operations.

• CP 1242-7 online, OPERATE, network registered, signal above -90 dBm.
• TC_CON completes with STATUS = 0000 within 10 s of REQ edge.
• Outbound SMS to a known mobile arrives with exact payload (no leading two characters).
• Inbound SMS populates the CHAR receive buffer; LEN matches the GSM 03.40 transport length.
• Subsequent shorter messages do not include trailing characters of previous messages.
• CP diagnostics page shows recent SMS in/out traffic counters incrementing.
• Watch table: DONE pulsed TRUE, BUSY returned FALSE, ERROR remained FALSE on every successful send.
• Project documentation includes SCA, modem ID, and receiver whitelist.

13. Frequently Asked Questions