Configuring SINUMERIK 840D SMS Alarm Notification via GSM Modem

System Overview and Alarm Path on SINUMERIK 840D

The SINUMERIK 840D integrates an S7-300-compatible PLC, an NCK (numerical control kernel), and an HMI on a single platform. Alarm information originates from three distinct sources: the NCK (drive, axis, and channel alarms in the 000.000-999.999 range), the integrated PLC (FB/FC generated errors, peripheral faults), and the HMI (operator-side notifications). All three converge into a unified alarm buffer that the HMI displays on the operator screen and that the PLC can read from dedicated data blocks.

For SMS notification, the PLC is the natural source point: it can read the same alarm bits that drive the HMI alarm display, format the message text, and forward it to a GSM modem. The Siemens Teleservice option provides the runtime blocks and the physical interface to make this possible. The Teleservice Adapter (TS Adapter) handles the modem connection over RS-232 and exposes standardized function blocks (FBs/FCs) to the S7-300 program. These blocks manage the GSM AT command sequence, error recovery, and connection state.

The data flow is: NCK/HMI event → PLC bit in DB2 (user alarm area) → PLC logic detects rising edge → Teleservice FB formats SMS → TS Adapter sends AT commands → GSM modem transmits SMS → recipient receives alarm text. The same logic that drives the red alarm lamp on the machine cabinet can be used to drive the SMS dispatch without any extra wiring on the alarm side.

Prerequisites

Hardware

The minimum hardware configuration for SMS alarm notification on a SINUMERIK 840D system consists of:

• SINUMERIK 840D controller (NCU 561.x, 571.x, or 572.x depending on the variant). The integrated PLC must be a CPU 314 or higher equivalent with at least 64 KB of work memory available for the Teleservice library.
• Teleservice Adapter (TS Adapter II) with catalog number 6FC5111-0CA01-0AA0 or the current equivalent. The TS Adapter connects to the MPI/Profibus of the NCU and provides a serial port for the external modem. The TS Adapter has its own MPI address and is configured in the S7 project like any other Profibus DP slave.
• GSM/GPRS modem with serial (RS-232) interface. Siemens offered the MC35, TC35, and MC55 industrial modems; current production options include the TC65 family. The modem must support AT+CMGS for SMS in PDU mode (text mode is optional but useful for ASCII characters only). Quad-band modems (850/900/1800/1900 MHz) are recommended for multi-region operation.
• SIM card with active SMS service. The SIM must be provisioned for circuit-switched SMS (not only data). Disable PIN lock or hardcode the PIN in the Teleservice configuration to avoid boot-time block.
• Antenna matched to the modem band, mounted outside the control cabinet with adequate RF separation from VFD cables and servo motor leads.
• Cabling: RS-232 null-modem cable (female-female, 9-pin D-Sub) from the TS Adapter serial port to the modem DB9. Keep cable length under 3 m to avoid signal integrity issues. For sites with electrical noise, use a shielded cable with metal hoods bonded to the cabinet ground at both ends.
• Power supply: The TS Adapter typically receives 24 VDC from the cabinet power bus. The GSM modem may require a separate 24 VDC or 12 VDC supply depending on the model; verify the spec sheet before wiring.

Software and Firmware

Older 840D systems (PCU 50 HMI, NCU 561) may need to upgrade to the SW 6.5 line or later to get stable Teleservice integration. The Teleservice FCs were substantially reworked between SW 5.x and SW 6.x, and old blocks will not link on a new project without recompilation.

SINUMERIK 840D Alarm Architecture and DB2 Layout

The 840D alarm system maintains three primary alarm lists in the HMI: the NCK alarm list (showing axis, channel, and drive alarms), the PLC alarm list (showing alarms raised by the integrated PLC), and the HMI alarm list (showing system/operator alarms). Each list is also mirrored in the PLC as one or more data blocks.

The PLC alarm list is driven primarily by DB2 (and the extended alarm DBs, DB3-DB9 in some configurations). The user alarm area in DB2 follows this structure:

To raise user alarm 600000, the PLC sets DB2.DBX0.0 = TRUE. To clear, reset the bit. Alarm text and parameter substitution are configured in the alarm configuration file (typically almcfgdb.ini or via the COM interface). Parameters 1-8 are filled into %1 through %8 placeholders in the alarm text.

Beyond DB2, the NCK raises its own alarms that are not directly bit-mapped in the PLC. To react to NCK alarms from the PLC, the application must read the NCK alarm buffer via the NC variable interface (FB2/FB4 for PUT/GET to NCK) or use the HMI's PLC interface that exposes the active NCK alarm number as a DWORD accessible from the PLC program. Refer to the Siemens Industry Online Support portal for the PLC Interface Description manual matching your SW version.

For a complete SMS notification system, the PLC program should:

1. Monitor DB2 for rising edges on user alarm bits.
2. Poll the NCK alarm number (e.g., via DBxx.DBDxx populated by an HMI job) to capture NCK-side faults.
3. Maintain a "last alarm" register to avoid duplicate SMS dispatch when the same alarm remains active.
4. Format a single-line text body combining machine number, timestamp, alarm number, and alarm text.
5. Call the Teleservice SMS FC and handle the returned status word.

Wiring the Teleservice Adapter (TS Adapter II) to the GSM Modem

The TS Adapter has three physical interfaces: MPI/Profibus to the NCU (X1), RS-232 to the external modem (X2), and a 24 VDC power input (X3). The MPI connection is daisy-chained into the existing MPI/Profibus bus. The TS Adapter must be assigned a unique MPI address (default 14 for the Teleservice Adapter; verify in the project's HW Config).

X2 pinout (RS-232, DB9 male on the TS Adapter):

• Pin 2: TXD (transmit data, output from TS Adapter)
• Pin 3: RXD (receive data, input to TS Adapter)
• Pin 5: GND (signal ground)
• Pins 1, 4, 6: tied together (DCD, DTR, DSR handshake for legacy modems)
• Pins 7, 8: tied together (RTS, CTS hardware handshake)

Modem side DB9 female (DTE):

• Pin 2: RXD
• Pin 3: TXD
• Pin 5: GND

Use a null-modem (crossover) cable. Do not use a straight-through cable; the TX/RX lines must cross.

The SIM card slot is on the modem itself, not on the TS Adapter. Insert the SIM before applying power. Lock the SIM in place with the retention clip. Power up the modem and verify the LED sequence (typically a slow blink for registered-on-network, fast blink for searching, solid for data call active).

If the cabinet is in a low-signal area, mount the antenna on the roof or on a mast external to the building. RF losses in the cable between modem and antenna must be kept below 3 dB at 900 MHz; for runs over 5 m, use a low-loss coax such as LMR-400 or equivalent.

Teleservice SMS Dispatch and AT Command Layer

The Teleservice library wraps the AT command layer, but it helps to understand the underlying sequence in case field troubleshooting is required. For SMS in text mode, the typical sequence is:

For PDU mode (the default in most Teleservice configurations), the sequence uses AT+CMGS with a TPDU length byte followed by the hex-encoded TPDU. PDU mode is required for any non-ASCII characters (e.g., German Umlauts) and is the only mode that supports concatenated SMS (longer than 160 characters).

Common error responses:

• +CMS ERROR: 500 – Unknown error (often SIM not inserted, or no network)
• +CMS ERROR: 515 – Facility not supported (SIM PIN locked, SMSC address missing)
• +CMS ERROR: 330 – SMSC address unknown
• +CME ERROR: 10 – SIM not inserted

When using PDU mode, encode the destination number in BCD with the length nibble, and encode the message body in 7-bit GSM default alphabet (or UCS-2 for full Unicode). The Siemens Teleservice blocks handle this automatically; if you write your own AT-handler in the PLC, use a pre-built PDU library to avoid encoding errors.

Siemens' Teleservice option ships with FCs that abstract the modem interface. The user program calls one FC per SMS send. The FC manages the AT command dialog, retries, and returns a status code. The FC needs an instance DB (allocated by the user) that holds the connection state, message buffer, and intermediate variables.

Key parameters in the FC interface:

• REQ (BOOL): Rising edge triggers send
• DEST_NUMBER (STRING): Destination phone number in international format
• TEXT (STRING): Message body
• BUSY (BOOL): Output, TRUE while the FC is mid-send
• DONE (BOOL): Output, TRUE on successful send (one-shot)
• ERROR (BOOL): Output, TRUE on failure
• STATUS (WORD): Output, error/status code (0 = OK, 0x8001 = no modem, 0x8002 = no SIM, 0x8003 = no network, 0x8004 = send timeout, 0x8005 = SMSC reject)
• MSG_REF (DWORD): Output, message reference from the network (useful for tracking)

Place the FC call in a slow OB (e.g., OB35 cyclic interrupt at 100 ms) or in OB1 if the dispatch volume is low. Avoid calling the FC from a fast OB; the underlying AT dialog takes 2-5 seconds to complete. For multiple recipients (e.g., different numbers for different shifts), call the FC in a loop. Sequence the sends with a small delay (1-2 s) to avoid overwhelming the modem. The TS Adapter can only have one active SMS session at a time.

PLC Programming: Reading Alarms from DB2 and Triggering SMS

The PLC program in the 840D is structured as a standard S7-300 project. The Teleservice library installs a set of FBs and FCs into the S7 program. The SMS-dispatch sequence in the user program is typically:

1. Detect new alarm: Edge detection on DB2.DBX0.0–DBX3.7. Use a positive-edge (FP) instruction to catch the transition from 0 to 1.
2. Read alarm text and parameters: From the alarm configuration, or by hard-coding a string indexed by the alarm number. For dynamic text (with substituted parameters), use STRING concatenation in STL/SCL.
3. Format phone number and message: Append timestamp, machine number, alarm number, and alarm text into a single message buffer (max 160 chars in text mode, 153 chars per segment in PDU).
4. Call Teleservice FC for SMS send: Pass the formatted message and destination number to the FC. The FC returns a status word indicating success/failure and a message reference number.
5. Handle retries: If the FC returns an error (e.g., W#16#8001 "no connection to modem"), back off and retry. Use a retry counter to avoid an infinite loop.

Example SCL code (illustrative; adapt to your project's style and the Teleservice FC signatures of your library version):

The exact block names and interfaces depend on the Teleservice library version installed. Refer to the Teleservice manual matching your SW version on the Siemens Industry Online Support portal for the correct FC signatures.

BE1 HMI Extension for In-Display Alarm Text

The BE1 option ("Bedienoberfläche ergänzen" – extend operator interface) provides a runtime on the HMI PC that loads custom screens alongside the standard 840D HMI. The custom screen is typically authored in WinCC flexible or in Create MyHMI (the modern equivalent of BE1 for current 840D sl HMI versions). The SINUMERIK product line and the BE1 option are documented on the Siemens SINUMERIK product page.

To use BE1 for SMS-related display, the typical pattern is:

1. Custom screen "Alarm SMS Status" shows the most recent 20 SMS sent, with timestamp, recipient, and success/failure status. The data source is a DB in the PLC that the SMS dispatcher writes to.
2. Custom screen "Alarm Configuration" allows the operator to enable/disable SMS dispatch per alarm number and to assign the recipient phone number per alarm.
3. Soft key integration: Add a soft key on the standard alarm screen that opens the "Alarm SMS Status" custom screen.

Configuration steps:

1. Install the BE1 runtime option (or Create MyHMI option) on the HMI.
2. Author the custom screens in the HMI development tool.
3. Configure the BE1 HMI to read/write the PLC DBs that hold the SMS dispatcher data.
4. Activate the option key in the HMI licensing screen.
5. Restart the HMI to load the new screens.

The standard 840D HMI alarm line on the top of the operator screen will continue to show the active alarm; the BE1 custom screen is a separate window opened by the operator or supervisor for SMS status. This separation keeps the machine-operating screen uncluttered.

Multi-Recipient and Time-Selected Routing

Most plants want different recipients at different times: the day shift maintenance lead, the night shift electrician, the on-call service engineer, the production manager. The SMS dispatcher PLC logic handles this with a time-selector block:

• Time-of-day input: Read from PLC time-of-day (e.g., SFC1 "READ_CLK" for S7-300) or from a synchronized HMI clock.
• Shift table: A DB mapping shift number (1, 2, 3) to time ranges (e.g., shift 1 = 06:00-14:00, shift 2 = 14:00-22:00, shift 3 = 22:00-06:00).
• Recipient map: For each alarm priority (high, medium, low) and each shift, a phone number to dial.
• Escalation logic: If no acknowledgment SMS is received within X minutes, send to the next-tier recipient.

The dispatcher block looks up the current shift, looks up the number for the active alarm, and calls the Teleservice SMS FC. The escalation can be implemented with a timer (SFB4 TON) and a retry counter. A simpler approach: send to the primary recipient immediately, and to a secondary recipient (e.g., shift supervisor) on the same alarm after 10 minutes if it is still active and no ACK.

The PLC time synchronization is critical. The 840D PLC clock can drift if the NCU battery is weak. Use the SFC1 "READ_CLK" to read the NCU master clock, and if the application has a higher-resolution requirement, configure an external NTP source via the NCU's Ethernet port and the S7 time synchronization (SFC48 / SFC60). Refer to the S7-300/400 time-of-day functions in the Step 7 help for the exact SFC signatures for your CPU firmware.

Verification and Commissioning Procedure

The commissioning step cannot be skipped. A 840D machine in production that fails to alarm via SMS leaves the operator unaware, which is a safety and quality risk. Run the following verification:

1. Modem communication test: Send an AT command from the Teleservice diagnostic tool (Teleservice Setup → Diagnostics → Test connection). Verify the modem responds with OK within 2 seconds.
2. Network registration test: Send AT+CREG? and verify response +CREG: 0,1 (registered, home network) or +CREG: 0,5 (registered, roaming).
3. Test SMS send: Use the Teleservice diagnostic to send a test SMS to your own mobile phone. Verify receipt within 30 seconds.
4. PLC integration test: Force a user alarm bit (DB2.DBX0.0 = TRUE) from the PG and verify the SMS arrives. Force a clear (DB2.DBX0.0 = FALSE) and verify no follow-up SMS.
5. NCK alarm test: Trigger a known NCK alarm (e.g., by unplugging a drive encoder cable) and verify the PLC dispatcher reads the alarm number and sends the SMS.
6. Multi-recipient test: Configure two recipients in the dispatcher, force a high-priority alarm, and verify both numbers receive the SMS.
7. Time-shift test: Manually set the PLC clock to a different shift, trigger an alarm, and verify the correct recipient for the simulated shift receives the message.
8. Failure mode test: Power off the modem, trigger an alarm, verify the dispatcher retries and reports failure (check the BE1 status screen).
9. Restart test: Cycle power on the 840D NCU and the modem, wait for boot, verify the dispatcher comes back online without manual intervention.
10. Long-duration test: Run for 72 hours with a controlled alarm-injection script (e.g., once per hour) to verify stability.

Document each step with a screenshot of the SMS received, timestamp, and the dispatched DB state. This becomes part of the machine validation documentation. If the system is part of a CE-marked or UL-certified production line, archive the commissioning record with the machine's technical file.

Alternative: Ignition SMS Notification Module

For plants that are modernizing the SCADA layer and adding a third-party HMI/SCADA platform alongside the 840D HMI, the Ignition SMS Notification Module from Inductive Automation provides a maintained, supported path. The module supports alarm notification and acknowledgment via SMS, integrates with the Ignition tag historian, and can subscribe to OPC UA tags from the 840D (the 840D sl exposes NCK and PLC data via OPC UA starting from SW 4.5 SP2 with the appropriate option).

In this architecture, the 840D continues to drive the operator screen and the PLC alarm DBs. Ignition reads the alarm bits from the PLC (via OPC UA or the existing S7 connection) and triggers SMS dispatch from a server-side service connected to a USB GSM modem or a cloud SMS gateway. The advantage is centralized management of recipients, escalation policies, and acknowledgment logs in a database. The trade-off is the additional software layer and the dependency on the Ignition server being online.

The legacy SCADA path (Geo SCADA / ClearSCADA from Schneider Electric) also supports SMS alarm redirection via a dial-up modem or an attached GSM gateway. The mechanism is similar: the SCADA server reads alarm state from the 840D PLC (via Modbus TCP, OPC, or S7 driver), and on state change sends an SMS through its attached modem. This is a useful pattern for plants that already have a SCADA backbone and want to centralize alarm dispatch across multiple CNCs and other equipment.

Troubleshooting Matrix

FAQ