Integrating SCALANCE M874-2 GSM Modem with S7-300 PLC

Overview

The SCALANCE M874-2 is an industrial GSM/GPRS mobile wireless router designed for remote telemetry, alarm messaging, and SCADA backhaul where Ethernet infrastructure is unavailable. In a typical S7-300 architecture, the M874-2 sits between a CPU 315-2 PN/DP (or any PN-enabled S7-300/400 station) and the cellular network, providing IP-based transport for SMS alarm dispatch, VPN tunnels, or remote programming. This reference covers a working configuration where the modem is dedicated to SMS-only alarm generation from a soft-redundant S7-300 station.

Two physical variants exist in the M-800 family that share the same operating concept:

• M874-2 – 2G/GSM/GPRS, quad-band 850/900/1800/1900 MHz
• M874-3 – 3G/UMTS/HSPA fallback to GPRS
• M876 – 4G/LTE (separate manual set)

The configuration procedure and SMS program logic described here apply identically to M874-3 and are documented in the official SCALANCE M-800 Getting Started (PDF, entry ID 78389746) and the SCALANCE M874/M876 Operating Instructions (PDF, entry ID 74518712).

Prerequisites

Before commissioning, verify the following components and information are available:

• SCALANCE M874-2 or M874-3 with firmware V4.3 or higher (see firmware section).
• CPU 315-2 PN/DP (6ES7315-2EH14-0AB0 or compatible) with STEP 7 V5.5 + SP2 / HF11 or TIA Portal V13+ and SIMATIC NET V14 SP1 or later.
• 24 V DC power supply, minimum 1 A, with the 5-pin terminal block shipped with the device.
• Industrial mini-SIM card (1.8 V/3 V) issued by the cellular carrier with the SIM PIN, APN, APN user name, and APN password confirmed in writing from the carrier.
• SMA male antenna suited to the operating band (850/900/1800/1900 MHz) with adequate VSWR ≤ 2:1 and minimum gain of 2 dBi.
• SIMATIC NET library containing AG_SEND (FC 5) and AG_RECV (FC 6) for ISO-on-TCP transport, plus the AG_CNT blocks for connection management.
• A PC with Web Based Management (WBM) access via HTTPS (default https://192.168.1.1) and current browser (Edge, Chrome, Firefox).

Hardware Installation and LED Diagnostics

The M874-2 ships with a 5-pin power terminal block and a 2-pin digital input terminal block. Connect the power feed, antenna, and SIM as follows:

1. Insert the SIM card with the contacts facing down into the drawer on the underside of the housing. Press with a pointed object (pen tip, paperclip) until the card audibly latches. Close the drawer.
2. Connect the 24 V DC feed to the 5-pin terminal block. Pin assignment: Pin 1 = L+ (24 V), Pin 2 = M (0 V), Pin 3 = functional earth, Pin 4/5 = digital input 1.
3. Mount the SMA antenna to the front-panel connector. Tighten to 0.6–0.8 N·m to avoid connector damage.
4. Connect the CPU PN port or a switch to one of the M874's two RJ45 Ethernet ports (10/100 Mbit/s, MDI/MDIX auto-crossover).

The front bezel carries status LEDs whose state is the primary commissioning indicator. Decode them as follows:

If L and SC are green but Q is off – the exact symptom reported in the source thread – the device has link, has read the SIM, but has not completed PDP context activation. The root cause is almost always APN or PIN configuration, never hardware.

Firmware Update Procedure

The original firmware on early M874-2 shipments contains a bug that prevents PDP context activation with several APN profiles. The fix is a firmware load via WBM. Always update before attempting SMS configuration.

1. Download the latest firmware (LMS file) for the M-800 family from Siemens SIOS. Check the firmware version in Information > Versions of the existing WBM first to determine the upgrade path.
2. Connect the engineering PC to the M874's LAN port. The default IP is 192.168.1.1; set the PC to a static address in the same subnet (e.g. 192.168.1.10/24).
3. Open https://192.168.1.1. Accept the self-signed certificate. Default credentials: user admin, password admin.
4. Navigate to System > Firmware Update. Click Browse, select the .lad/LMS image, then Load & Activate.
5. Wait for the device to reboot (P, L LEDs cycle, then settle). Do not power-cycle during activation – this bricks the file system.
6. Confirm the new version under Information > Versions. A re-login is required.

Web Based Management (WBM) Configuration

Open the WBM and walk through these menus in sequence. Save (Apply) after each step; the device does not buffer changes across sections.

Layer 2 / Interface

Set a fixed LAN IP if the default conflicts with the PLC's PN subnet. The IP you assign here is the value STEP 7 / TIA Portal targets with AGSEND. Typical values used with a CPU 315-2 PN/DP on PN interface 192.168.0.x:

• IP address: 192.168.0.200
• Subnet mask: 255.255.255.0
• Default gateway: leave empty (the M874 uses the cellular interface as default route)

Mobile Wireless Settings

Under Interfaces > Mobile Wireless, populate:

SMS Service

Navigate to Services > SMS. Enable the SMS service and configure:

• Listening port: 25 (default) or 5025 for SMS over ISO-on-TCP integration with S7. This is the port the PLC targets with TCON.
• SMS center number (SCA): Leave empty to use the SIM's stored SCA, or enter the explicit number from the carrier (e.g. +491710760000 for Vodafone DE).
• Character set: GSM 7-bit default. Switch to UCS-2 only if multilingual content is required.
• Max segments: 4 (1 multipart SMS = 4 × 153 chars).

Firewall and Routing

Open the SMS service port inbound on the cellular WAN interface. By default the M874-2 firewall drops all inbound traffic; for SMS-only deployments, the only inbound rule needed is the listening port above, restricted to the LAN-side PLC IP.

S7-300 Hardware and NETPRO Configuration

HW Config

1. In STEP 7 HW Config, open the station containing the CPU 315-2 PN/DP.
2. From the hardware catalog, drag SIMATIC NET > Industrial Router > SCALANCE M-800 onto the PROFINET subnet. If the catalog is missing, install the latest HSP for SIMATIC NET (HSP 0283 or later) and update the catalog.
3. Assign the M874 an IP that matches the value configured in WBM, e.g. 192.168.0.200. Set the subnet mask to 255.255.255.0.
4. Compile and download HW Config.

NETPRO Connections

Create one ISO-on-TCP connection from the S7 station to the SCALANCE for SMS transport.

1. Open NETPRO. Right-click the CPU, Insert New Connection.
2. Connection partner: Unspecified. Connection type: ISO-on-TCP.
3. Set the partner IP to the M874's LAN address (192.168.0.200), partner port to the SMS service port (e.g. 25). The local port is allocated by STEP 7.
4. Click OK. The connection ID, e.g. 1, is what AGSEND/AGRECV reference.
5. Download the connection table to the CPU.

PLC Program for SMS Dispatch

For SMS dispatch, the S7-300 implements a small state machine that triggers AGSEND with a pre-built payload. The pattern is: the CPU opens the connection, transmits a TCP frame containing the SMS instruction, and the M874-2 converts the frame to an SMS and forwards it via the cellular network.

Sample S7 program (LAD/FBD/ST) for triggering an SMS alarm on a digital fault:

// FB 100 – SMS_Trigger
// Inputs: i_Trigger (BOOL), i_FaultID (WORD), s_Phone (STRING[20])
// Outputs: q_Busy (BOOL), q_Done (BOOL), q_Error (BOOL)

// M1.0 = SMS send enable (latched by user)
// M1.6 = Send request pulse
// M1.7 = Send complete acknowledgement

      A     "M1.0"                  // SMS service enabled
      A     "i_Trigger"             // Fault condition
      S     "M1.6"                  // Latch send request

      U     "M1.6"                  // Send request active
      SPB   SEND                    // Jump to send block

// Wait for done / error and reset request
      U     "M1.7"
      R     "M1.6"                  // Clear request
      SET
      SAVE
      BEA

SEND: CALL  FC   5                  // AG_SEND
            ACT   := TRUE
            ID    := 1              // Connection ID from NETPRO
            LADDR := W#16#0100      // CP / IE address word
            SEND  := "DB_SMS.TxBuf"  // Pointer to ANY with SMS payload
            LEN   := "DB_SMS.TxLen"
            DONE  := "M1.7"         // Done bit mapped to M1.7
            ERROR := "q_Error"
            STATUS:= "DB_SMS.Status"

Memory Bit and Tag Address Reference

Payload Format

The M874 SMS service accepts a simple text protocol on its listening port. Build the DB string in a non-optimised DB and pass its address to AGSEND. The minimum content is:

To:+4917xxxxxxxx\r\n
Body:Boiler high temperature - Trip level 2\r\n

• Phone numbers must be in full international format with leading +.
• Carriage return + line feed terminates each line.
• The blank line + CRLF at the end of the body is mandatory; without it, the M874 will buffer the message and not transmit.

Total payload must be ≤ 160 characters for a single-part GSM 7-bit SMS. For longer text, fragment the message at the application layer before transmission, or rely on the M874's automatic concatenation (≤ 4 segments).

Verification

After commissioning, run this acceptance sequence:

1. Confirm P, L, SC, and Q LEDs all show solid green. Q is the key indicator of cellular registration.
2. Open the WBM, navigate to Information > Mobile Wireless > Status. Verify a public IP is shown and "Connection State" reads Connected.
3. In STEP 7, place the CPU in RUN. Force M1.0 = TRUE. Trigger a test input (M1.6) via the VAT table or HMI.
4. Watch M1.7 latch within a few seconds. If M1.7 never latches, capture DB_SMS.Status and decode against the AGSEND error table.
5. Verify the SMS arrives on the destination handset. If the message is delayed > 30 s, check signal quality (≥ 2 bars on the M874's signal LEDs).

Troubleshooting Matrix

Field-Proven Commissioning Notes

• Always fit a SIM with a static public IP if you also want bidirectional IP access (programming, VPN). SMS-only deployments can use dynamic IPs.
• Set the M874's DNS to a public resolver (8.8.8.8) in the WAN interface. Some carriers filter the DNS at PDP activation and you will not get name resolution otherwise.
• For soft-redundant S7-300 stations (CPU 315-2 PN/DP in H-mode), mount one M874 per CPU and route the SMS to both. Only the active CPU holds the AGSEND resource; on failover, the standby takes over within 2–5 s and the next alarm still leaves the station.
• Enable the device's syslog to a network time server (NTP) during commissioning. Cellular latency statistics in the log reveal coverage problems before the SMS service appears degraded.
• Keep the M874's firmware current. Siemens publishes LMS images every 6–12 months; check SCALANCE M-800 Getting Started (SIOS ID 78389746) for the latest revision notes.