S7-1200 Gate Remote Control with GSM Modem and Ewon Flexy Router

Overview: Remote Control Options for an S7-1200 Controlled Industrial Gate

Operating an industrial gate from a distance is a common requirement at logistics yards, utility substations, agricultural sites, and multi-tenant facilities where physical keypads or wired push-buttons are impractical. When the gate is driven by a Siemens S7-1200 CPU (for example, a CPU 1214C DC/DC/DC or CPU 1215C DC/DC/DC), the controller already exposes a PROFINET interface and supports a wide set of communication modules, which makes it compatible with several remote-control architectures.

This reference covers four field-proven methods for triggering the gate from a phone, a browser, or a hand-held transmitter:

1. SMS over a GSM/4G modem connected to a CM 1241 RS232 or RS485 module.
2. A custom web HMI hosted on an Ewon Flexy industrial router, reachable over the cellular network through Talk2M.
3. Low-cost multi-channel RF remote receivers (315 MHz / 433 MHz / 868 MHz ISM band) wired into the digital inputs of the CPU.
4. An operator-friendly mobile app built against the PLC's OPC UA server (CPU firmware 4.4 or later) or a Modbus TCP interface exposed through the Ewon.

Each option has different trade-offs in cost per user, latency, security, and the number of simultaneous operators it can support. The decision matrix in Section 3 maps user counts and operational requirements to the correct architecture.

Prerequisites

Before integrating any remote-control path, confirm the following baseline hardware and firmware on site:

• CPU model: S7-1200 with firmware 4.2 or higher. OPC UA server functionality requires firmware 4.4 or higher per the SIMATIC S7-1200 Programmable Controller System Manual (entry ID 109772942).
• STEP 7 (TIA Portal): V15.1 or later for OPC UA configuration; V14 SP1 or later for SCL blocks used in this article.
• Power budget: The gate actuator, PLC, modem, and router each need dedicated fusing. Refer to the S7-1200 Easy Book (entry ID 108551276) for current consumption per CPU.
• Safety circuit: An independent hard-wired safety loop (light curtain, edge sensor, or monitored entrapment device) terminating in a safety relay or F-CPU input, satisfying ISO 13849-1 PL d or higher and the gate operator standard UL 325 or EN 12453.
• Antenna placement: At least 1.5 m of separation between the GSM and RF antenna paths to avoid receiver desensitization.
• SIM card: A machine-to-machine (M2M) SIM with a public static IP or APN access. Consumer SIMs are acceptable when traffic remains inside Talk2M.

Solution Architecture Comparison

The table below summarizes each architecture against the criteria that drive the design decision: number of operators, latency, infrastructure, and cybersecurity effort.

Solution 1: GSM SMS Modem with CM 1241

This is the lowest-effort path for sites that already have cellular coverage. A GSM/4G modem (for example, the Siemens SINAUT MD720-3 or a third-party industrial modem such as the Teltonika TRB140 / TRB245) is wired to a CM 1241 RS232 module on the S7-1200. The PLC reads inbound SMS messages via AT commands issued on the serial port, parses the sender's number and the command, and drives the gate output when both match a whitelisted number and a valid command string.

Hardware Wiring

• CM 1241 RS232 (6ES7241-1AH32-0XB0) inserted in the signal board / communication module slot of the S7-1200.
• RS232 null-modem cable between the CM 1241 and the GSM modem's serial port. Pin 2 (RXD) on the PLC side ties to Pin 3 (TXD) on the modem, and Pin 3 (RXD) on the PLC side ties to Pin 2 (TXD) on the modem; Pin 5 (GND) to Pin 5 (GND).
• SIM card installed in the modem. Disable PIN prompt with the modem's configuration tool, or store the PIN in the PLC data block and issue AT+CPIN="1234" at startup.

Project Configuration in TIA Portal

1. In the device configuration, add the CM 1241 and select protocol "Freeport" with 9600 baud, 8 data bits, no parity, 1 stop bit.
2. Create a global data block GSM_DB with the following tags:

GSM_DB.SMS_Buffer      : STRING[160]
GSM_DB.SMS_Sender      : STRING[20]
GSM_DB.SMS_Command     : STRING[20]
GSM_DB.Whitelist[1..10]: ARRAY[1..10] of STRING[20]
GSM_DB.WhitelistCount  : INT
GSM_DB.GateCommand     : BOOL

3. Call the SCL block FB_GSM_Parser (provided in Section 9) in OB1 with cycle time 200 ms.

AT Command Sequence to Read an SMS in PDU Mode

The modem is initialized once after power-up and then polled for new messages:

// 1) Set SMS to text mode
"AT+CMGF=1\r"

// 2) List unread messages
"AT+CMGL="REC UNREAD"\r"

// 3) Read first message (index from +CMGL response)
"AT+CMGR=1\r"

// 4) Delete the read message to keep memory free
"AT+CMGD=1\r"

For sites that prefer PDU mode (binary), substitute AT+CMGF=0 and decode the PDU with a UCS-2 conversion routine. Text mode is sufficient for ASCII commands such as OPEN, CLOSE, or STOP.

Solution 2: Ewon Flexy Industrial Router with Custom Web HMI

The Ewon Flexy (for example, FLB3202, FLX3271) is the correct choice when the operator needs both a remote-access VPN for engineering and a browser-based control panel for end users. The Cosy 131 is intentionally limited to VPN-only access and does not run custom web pages, so the Flexy variant is required for this solution. Refer to the Ewon Flexy product family page and the Ewon documentation portal for the latest firmware (current stable line is 14.x as of this writing) and the BASIC interpreter reference.

Architecture

• Ewon Flexy WAN port connects to the local 4G/LTE network with a SIM card.
• Ewon Flexy LAN port connects to the S7-1200 PROFINET interface (directly or via an unmanaged switch).
• Talk2M acts as the outbound VPN concentrator. Operators connect from any browser to https://vpn.company.talk2m.com (or the regional equivalent) and are authenticated by their Talk2M account.
• Inside the Flexy, the embedded BASIC interpreter runs a tag poll against the S7-1200 using the ISOTCP / S7 protocol on port 102. The BASIC script publishes the tags and renders an HTML page using the WEBSERVER commands.

BASIC Skeleton for a Gate Web Page

// Flexy BASIC — S7-1200 tag polling and web page rendering

// On startup configure the S7 connection
FUNCTION StartPolling
  $s7Address = "192.168.1.10"     // S7-1200 IP
  $s7Rack     = 0
  $s7Slot     = 1
  $pollPeriod = 1                 // seconds
  SETTAGS "GATE_STATE"
  PRINT "Polling started"
ENDFUNCTION

// Refresh endpoint — invoked by the page every 3 s
FUNCTION Page_Refresh
  GATE_STATE%   = GETTAG "DB100.DBX0.0"; BOOL  // Gate position feedback
  GATE_CMD%     = GETTAG "DB100.DBX2.0"; BOOL  // Operator command echo
  %WebPage$     = "Gate is " + IIF(GATE_STATE% = 1, "OPEN", "CLOSED")
  RETURN
ENDFUNCTION

// Form action — write the command tag
FUNCTION Page_Submit
  IF $FORM_cmd$ = "open" THEN
    SETTAG "DB100.DBX2.0", TRUE
    TSET 2, "{SETTAG 'DB100.DBX2.0', FALSE}"   // Auto-reset after 2 s
  ENDIF
  RETURN
ENDFUNCTION

This template is wrapped in HTML by the Flexy @page directives and served to the operator's browser after Talk2M authentication. Each user can be assigned a role (viewer or operator) inside Talk2M Pro so that read-only users cannot trigger the gate.

Solution 3: Multi-Channel RF Remote Receiver

When cellular coverage is unreliable or unavailable, a wired RF receiver is the lowest-latency solution and is well-suited to small teams of 2 to 12 operators. Industrial-grade 6- or 12-channel receivers with relay outputs (for example, 315 MHz or 433 MHz modules with EV1527 encoding, or 868 MHz LoRa modules for longer range) feed the digital inputs of the S7-1200.

Wiring

• Receiver common terminal to 24 VDC.
• Each channel's NO relay contact to a dedicated S7-1200 digital input (I0.0 through I0.5 for a 6-channel receiver).
• Receiver's 5 V or 12 V power input fed from the same DIN-rail PSU used for the PLC.

PLC Logic

Each transmitter button is matched to a "learn" sequence: the receiver is put into pairing mode, the transmitter button is pressed, and the receiver stores the rolling-code ID in EEPROM. The PLC sees only a momentary pulse on the input, which it debounces and converts into a one-second open or close command. A block such as FB_RF_Dispatch (see Section 9) maps each input to a named action and rejects commands from paired-but-not-whitelisted IDs by reading a learned-ID table from data block RF_IDs.

Security Caveats

• Plain fixed-code receivers (no rolling code) are vulnerable to replay attacks and are not acceptable for unattended industrial gates.
• Use receivers with KeeLoq or AES-128 rolling-code hopping. Document the pairing procedure in the site's commissioning report so that revoked transmitters can be unpaired.

Solution 4: Mobile App via OPC UA or Modbus TCP

S7-1200 CPUs with firmware 4.4 or later expose an OPC UA server directly on the PROFINET interface. A third-party SCADA app or a custom-developed Android/iOS application can read the gate state and write the command tag over OPC UA with certificate-based authentication. For older firmware (4.2 and 4.3), a Modbus TCP server can be enabled in the user program and consumed by any of the common SCADA mobile clients.

OPC UA Tag Exposure

1. In TIA Portal, mark the DB you wish to expose as "Accessible from HMI/OPC UA" in the DB properties.
2. Enable the OPC UA server in the CPU properties and configure an authentication list (anonymous disabled in production).
3. Export the server endpoint certificate and install it on the mobile client to establish trust.

Modbus TCP Mapping

The MB_SERVER instruction (block available in the S7-1200 instruction palette) binds Holding Registers to a data block. Example mapping for a single-gate site:

Safety, Compliance, and Audit

Any remote-control interface must respect the local safety chain. The integration rules below should be reviewed with the site's safety officer and documented in the Functional Safety file.

• ISO 13849-1: The remote command path is a non-safety input. Performance Level (PL) for the overall safety function is determined by the safety circuit (light curtain, edge sensor, monitored contact), not by the radio or cellular path.
• EN 12453 / EN 12445: Industrial gates must limit the closing force and provide an entrapment sensor. The remote command must be inhibited while the entrapment sensor is active.
• UL 325: For North American sites, the gate operator must be a UL 325 listed device. The remote signal is treated as a Class I or Class II control depending on the visibility requirement.
• Audit log: Every remote command should be timestamped and logged. The Ewon Flexy BASIC script and the OPC UA server both provide event history; for SMS, the PLC should append each whitelisted command to a circular log DB or push to a syslog server.

SCL Programming Examples

The SCL blocks below are written for firmware 4.4 of the S7-1200 CPU and are intended to drop into a standard project.

FB_GSM_Parser — SMS Dispatch from CM 1241

FUNCTION_BLOCK "FB_GSM_Parser"
VAR
    rcvBuffer : STRING[160];
    sender    : STRING[20];
    cmd       : STRING[20];
    i         : INT;
    j         : INT;
    allowed   : BOOL;
END_VAR
BEGIN
    // Trigger AT+CMGL poll from the user program via PtP_Send
    // (omitted for brevity; cycle every 5 s with a TON timer)

    // Parse the +CMGL response to extract sender and command
    // Expected shape: "+CMGL: 1,"REC UNREAD","+4917...",,"24/10/19,10:32:11+00"\r\nOPEN\r\n"
    IF FIND(rcvBuffer, 'OPEN') > 0 THEN
        cmd := 'OPEN';
    ELSIF FIND(rcvBuffer, 'CLOSE') > 0 THEN
        cmd := 'CLOSE';
    ELSIF FIND(rcvBuffer, 'STOP') > 0 THEN
        cmd := 'STOP';
    ELSE
        RETURN;
    END_IF;

    // Extract the sender string between the second pair of double quotes
    i := FIND(rcvBuffer, '"');
    j := FIND(INSTRING1 := rcvBuffer, INSTRING2 := '"', START := i+1);
    sender := MID(IN := rcvBuffer, L := j-i-1, P := i+1);

    // Whitelist check
    allowed := FALSE;
    FOR i := 1 TO "GSM_DB".WhitelistCount DO
        IF sender = "GSM_DB".Whitelist[i] THEN
            allowed := TRUE;
        END_IF;
    END_FOR;

    IF allowed THEN
        CASE cmd OF
            'OPEN' : "GSM_DB".GateCommand := TRUE;
            'CLOSE': "Motor_Output"        := TRUE;
            'STOP' : "Motor_Output"        := FALSE;
        END_CASE;
        // Auto-reset after 2 s to emulate momentary push-button
        "AutoReset_TON"(IN := TRUE, PT := T#2s);
        IF "AutoReset_TON".Q THEN
            "GSM_DB".GateCommand := FALSE;
            "AutoReset_TON"(IN := FALSE);
        END_IF;
    END_IF;
END_FUNCTION_BLOCK

FB_RF_Dispatch — Multi-Channel RF Input Mapping

FUNCTION_BLOCK "FB_RF_Dispatch"
VAR_INPUT
    CH0, CH1, CH2, CH3, CH4, CH5 : BOOL;  // Raw receiver inputs
END_VAR
VAR
    debounce : ARRAY[0..5] OF BOOL;
    edge     : ARRAY[0..5] OF BOOL;
END_VAR
BEGIN
    // Debounce 30 ms, generate rising-edge triggers
    "FB_Debounce[0]"(IN := CH0, PT := T#30ms);
    "FB_Debounce[1]"(IN := CH1, PT := T#30ms);
    // ...repeat for CH2..CH5

    // Map channel 0 to OPEN, channel 1 to CLOSE, channel 2 to STOP
    IF "FB_Debounce[0]".Q AND NOT edge[0] THEN
        "Motor_Cmd" := CMD_OPEN;
        edge[0] := TRUE;
    ELSIF NOT "FB_Debounce[0]".Q THEN
        edge[0] := FALSE;
    END_IF;
    // Repeat pattern for the remaining channels.
END_FUNCTION_BLOCK

Verification and Commissioning Steps

1. From a connected engineering station, force each command tag (Open, Close, Stop) and confirm the gate actuator responds as expected through the local HMI and hardwired E-Stop.
2. Send an SMS from a non-whitelisted number; the PLC must reject it and increment a counter in GSM_DB.RejectedCount.
3. Send OPEN from a whitelisted number; verify the gate opens and that GSM_DB.LastAcceptedSender and GSM_DB.LastAcceptedTime are updated.
4. Log into Talk2M from a remote browser, open the Flexy web page, and verify that the role assigned to the user allows or denies the open command.
5. With each paired RF transmitter, press the assigned button and confirm the corresponding tag is set for 1 second. Replay an old (out-of-range) transmitter to confirm the receiver rejects it.
6. Trigger the entrapment sensor while issuing a remote close; the actuator must stop within the time defined in Safety_DB.MaxCloseTime_ms and must not restart from the remote channel.
7. Disconnect the cellular antenna for 60 s and verify the PLC raises Alarm_LinkDown in the diagnostic buffer.

Troubleshooting Matrix

Field Commissioning Checklist

• Operator list, phone numbers, and PINs documented in the site's access-control register.
• Whitelist loaded into GSM_DB from a secure engineering station; backup copy on the engineering server.
• Talk2M accounts provisioned with role-based access (viewer vs operator).
• RF transmitter IDs paired and stored in RF_IDs with date-stamped entries.
• OPC UA server certificate exported and a copy archived.
• Safety verification record signed by the safety officer per EN 12453 / UL 325.
• Network password policy in place: minimum 12 characters, rotation every 90 days.