S7-1200 GPRS Communication: CP 1242-7 Direct vs Telecontrol Mode

Overview of S7-1200 Wide-Area Communication Architectures

When a central S7-1200 station must exchange data with one or more remote S7-1200 stations across a cellular network, the SIMATIC S7-1200 family relies on the dedicated Communication Processor (CP) 1242-7 GPRS module. The reference topology in SCADA telemetry is: a remote site running as Modbus master to local field slaves, a central site aggregating that data, and an HMI/SCADA system in front of the central PLC. The transport selection between those two CPUs determines whether the fleet is maintainable or a constant source of pager incidents.

CPU-to-CPU (also called S7 communication or programmatic peer-to-peer) is a Siemens-proprietary application protocol that runs on top of several layer-4 transports. On S7-1200 firmware V4.x, the available CPU-to-CPU transports are:

• S7 connections (used by PUT/GET) over ISO-on-TCP (RFC 1006) on port 102.
• Open User Communication using native TCP (TSEND_C, TRCV_C, TCON, TDISCON).
• OPC UA server, available on S7-1200 firmware V14 SP1 and later (port 4840).

Each transport behaves differently over a wireless WAN. The official CPU-CPU Communication with SIMATIC Controllers manual (entry ID 78028908) describes the application-side mechanics of S7 connections, PUT/GET, BSEND/BRCV, and USEND/URCV. The S7-1200 system manual communication section lists which protocols the CPU itself supports and which require an external CM/CP module.

Why GPRS Constrains the Protocol Choice

The CP 1242-7 is a layer-3 gateway: it terminates the GPRS/UMTS bearer, optionally sets up an IPsec tunnel to a partner, and presents a standard Ethernet/IP interface on the S7-1200 backplane. To the application in the CPU, the wide-area link looks like a routed IP network. The choice of transport is, however, constrained by three properties of cellular telemetry:

1. Private APNs are typical. The PLC has no public internet and often no DNS. Static IPs are assigned by the operator or negotiated by the concentrator.
2. The CP 1242-7 supports a fixed number of connection partners per module: 1 partner in telecontrol mode for the partner itself plus 4 additional, totaling 5 partners in direct mode, and 1 telecontrol server plus 4 additional S7/TCP partners when running in telecontrol mode.
3. The S7-1200 CPU does not expose ISO transport (TPKT without RFC 1006) directly. ISO-on-TCP (port 102, RFC 1006) is the standard S7 transport, and the CP 1242-7 fully supports it.

These constraints immediately eliminate several options that look reasonable on a LAN.

Transport Option Comparison for CPU-to-CPU over GPRS

PUT/GET (S7 Connections) over GPRS

PUT and GET instructions (programmatic S7 communication) require S7 connections that the S7-1200 CPU establishes as ISO-on-TCP connections to the partner CPU on port 102. In a GPRS topology, the central CPU must reach the remote CPU's port 102 across the WAN. Two practical issues arise:

• S7 connections are kept open and require bidirectional keep-alive. GPRS NAT timers and private-APN routing can drop idle S7 connections within minutes.
• The CP 1242-7 in telecontrol mode terminates ISO-on-TCP at itself, not at the partner CPU. PUT/GET to the CPU behind a telecontrol CP 1242-7 is therefore not a true S7-connection target; the telecontrol server does the S7 bridging.

Verdict: PUT/GET is not recommended for direct CPU-to-CPU over GPRS. It is intended for LAN use where both CPUs are on the same Profinet/Profibus subnet or where a routed IP path with low latency and no aggressive NAT exists.

OPC DA Server (SIMATIC NET / WinCC)

OPC DA servers (SIMATIC NET OPC Server or third-party) use DCOM (RPC/EPM) over TCP/IP. DCOM is hostile to GPRS: it requires multiple dynamic ports, broadcast/multicast for service discovery, and is generally not supported across cellular NAT or private APNs. OPC UA over GPRS works (binary profile, port 4840) but requires a UA server on the S7-1200 (firmware V14 SP1+).

Verdict: Legacy OPC DA is impractical over GPRS. OPC UA is viable if both stations run firmware V14 SP1 or later and the CP 1242-7 firmware supports UA passthrough.

Native TCP (Open User Communication)

Open User Communication on S7-1200 uses TSEND_C, TRCV_C, TCON, TDISCON, TSEND, TRCV. Native TCP without ISO-on-TCP works across NAT and private APNs, but you must handle fragmentation, connection loss, and partner monitoring yourself.

Verdict: Viable for low-complexity polling, especially when the central site writes Modbus registers into the remote S7-1200. Requires custom retry and state logic in the CPU program.

ISO-on-TCP (RFC 1006) - Recommended

ISO-on-TCP is the Siemens standard transport for S7 connections. On S7-1200 it is the transport the CP 1242-7 fully supports in both direct and telecontrol modes. Key advantages over plain TCP:

• Connection establishment, keep-alive, and partner monitoring are built in.
• Compatible with S7 PUT/GET, BSEND/BRCV, and USEND/URCV blocks.
• Survives moderate NAT and GPRS latency (typical 300-1500 ms RTT).
• The CP 1242-7 handles the S7-connection multiplexing when several remote stations connect to one central CP.

Verdict: ISO-on-TCP is the recommended transport for CPU-to-CPU over GPRS. It is the only practical option for the central PLC to talk to more than one remote PLC without bespoke code on each station.

Transport Selection Summary

CP 1242-7 Hardware and Firmware Baseline

The CP 1242-7 GPRS module is the SIMATIC part number 6GK7242-7KX30-0XE0 (with antenna variant 6GK7242-7KX30-0AX0). Key specifications from the data sheet:

• GSM/GPRS quad-band (850/900/1800/1900 MHz), GPRS multi-slot class 10.
• IPsec VPN via SINEMA Remote Connect (SINEMA RC) or third-party VPN concentrator.
• One Ethernet (RJ45) port for the S7-1200 backplane connection.
• Supported S7-1200 CPU firmware: V4.x and later; V4.4 or later is recommended for current security patches.
• Power consumption: 2.2 W typical, 2.8 W peak during GPRS attach.

The CP 1242-7 supports two operating modes for the wide-area side:

• Direct mode: The CP acts as a TCP/IP gateway. Up to 5 connection partners can be defined. The central partner can be another CP 1242-7, an S7-1200/1500/300/400 CPU with a static IP, or a Telecontrol Server.
• Telecontrol mode: The CP is managed by a Telecontrol Server (TCSB) or Telecontrol Basic Server. Up to 5000 connection partners can be addressed via the server's multiplexing.

Direct Mode vs Telecontrol Mode

Direct Mode

In direct mode, the CP 1242-7 establishes a permanent connection to a partner (a central CP 1242-7 or a central S7-1200/300/400/1500 CPU with a static IP). The partner list can contain up to 5 entries. Each entry can be an ISO-on-TCP target or a TCP target. The CP 1242-7 owns the connection lifecycle; the CPU sees the partner as a normal ISO-on-TCP connection.

Direct mode is appropriate when:

• You have a small, fixed number of remote stations (1-5 per central CP).
• You do not have, or do not want, internet access at the central site.
• You use a private APN with no inbound traffic from the public internet.
• You want the PLC to own the connection logic (no Windows or Linux server in the path).

Direct mode is not appropriate when:

• You need more than 5 remote stations per central partner.
• You need dynamic discovery or roaming between SIM providers.
• You need a central event buffer and historical connection diagnostics that the PLC alone cannot provide.

Telecontrol Mode

In telecontrol mode, the CP 1242-7 connects to a Telecontrol Server (Telecontrol Server Basic, or TCSB). The TCSB multiplexes connections from many remote stations to one or more central control systems. The server keeps permanent connections open, handles retries, and provides a buffered event store on disk. A central S7-1500 or WinCC can read the remote data via the server's S7 interface or OPC UA.

Telecontrol mode is appropriate when:

• You have more than 5 remote stations.
• You want a server-side buffer for offline stations (events queued while GPRS is down).
• You can route the central site via a static IP or VPN into the cellular network.
• You want to use the Siemens TeleControl Basic Server for redundant central sites.

Telecontrol mode is not appropriate when:

• The central site has no internet at all.
• You need sub-200 ms latency (the server adds one hop).

Direct vs Telecontrol Mode Comparison Table

GSM Signal Quality Diagnostics

The CP 1242-7 exposes GSM signal quality through the diagnostics interface. The official Siemens support entry 58099765 documents two variants:

• Variant 1: Diagnostics of the CP 1242-7 module via the Web server and TIA Portal online diagnostics. Read-only, no PLC program changes needed.
• Variant 2: Programmatic read of the GSM signal strength from the CPU using SFB52 (RDREC) on the CP's slot, or the SIMATIC library block "TC_DIAG" (from the TeleControl library).

Variant 2 is the way to get GSM signal quality into your PLC program for alarm or routing decisions. A typical implementation reads the following from the CP 1242-7 diagnostic record DS0/DS1:

• Signal strength (RSSI) in dBm: -113 dBm (no signal) to -51 dBm (excellent).
• Signal quality (0-31): 0 = no signal, 31 = excellent.
• Bit error rate (BER): 0-7, lower is better.
• Cell ID, LAC, MNC, MCC: useful for tracking SIM movement and roaming.
• Connection state: idle, GPRS attached, IPsec up, partner connected.

These values are then used in the S7-1200 program to generate a "low signal" alarm when RSSI falls below -95 dBm for more than 5 minutes, allowing proactive site visits before the link becomes unstable. The S7-1200 sample SCL for the RDREC call:

// Read CP 1242-7 diagnostic record DS0 (index 0)
// Slot = 1 (CP plugged left of CPU)
#status := RDREC(
    REQ     := TRUE,
    ID      := 1,
    INDEX   := 0,
    MLEN    := 32,
    VALID   => #valid,
    BUSY    => #busy,
    ERROR   => #error,
    STATUS  => #rec_status,
    LEN     => #rec_len,
    RECORD  := #diag_buffer
);
// Parse RSSI from byte 4 of DS0 (signed INT)

Configuration Procedure for ISO-on-TCP in Direct Mode

Prerequisites

• S7-1200 CPU 1214 DC/DC/DC, firmware V4.4 or later.
• CP 1242-7 (6GK7242-7KX30-0XE0), firmware matching the CPU.
• TIA Portal V16 or later.
• Antenna (6GK7242-7KX30-0AX0) and SIM with private APN.
• Static IP or hostname at the central site (if remote is initiating).

Step 1: Insert the CP 1242-7 in TIA Portal

In the device configuration of the S7-1200 station, drag the CP 1242-7 onto the left of the CPU. This assigns the slot and lets TIA Portal discover the module after download.

Step 2: Configure the CP 1242-7

Open the CP 1242-7 properties. Under "Ethernet interface", set the IP address to the local backplane address (default 192.168.0.10 works for direct-mode partner lookup). Under "Mobile network", enter the APN, SIM PIN if required, and the dial number (*99***1# is common for GPRS). Enable "Permanent connection" if you want the CP to maintain an always-on IPsec tunnel.

Step 3: Define Connection Partners

In the CP's connection table, add up to 5 partners. For each partner, choose ISO-on-TCP (port 102) and set the partner address to the central CP's IP or hostname. Enable "Establish connection actively" on the side that dials (the remote station typically initiates, so it dials).

Step 4: Configure the CPU for ISO-on-TCP

In the CPU properties, under "Communication > ISO-on-TCP", add a connection. Choose "Partner" type "CP 1242-7 in remote station" or "S7 CPU with known IP". The connection ID is used in the PUT/GET or BSEND/BRCV blocks.

Step 5: Program PUT/GET in the CPU

Use the PUT and GET instruction blocks. The connection ID must match. ADDR_1 and ADDR_2 are pointers to the source and target data blocks. The remote DB number must match the central station's DB. For multi-station polling, use a sequencer in the central CPU that cycles through connection IDs.

Step 6: Verify

Download to both stations. In TIA Portal, open "Online & Diagnostics" on the central CP 1242-7. The connection table should show all 5 partners with state "Established". The CPU's diagnostic buffer will log "Connection established to partner X" events. Open a watch table on the central CPU and confirm the remote data block values are updating.

Configuration Procedure for Telecontrol Mode

Step 1: Install Telecontrol Server Basic

Install TCSB on a Windows Server 2019 or later. Import the project with the S7-1200 station configuration. TCSB requires a license (Telecontrol Server Basic 6GK1720-1AH01-0BV0 or current equivalent). Configure the OPC UA server endpoint and the S7 connection to the central S7-1500/300/400.

Step 2: Configure CP 1242-7 for Telecontrol Mode

In the CP's properties, switch the operating mode to "Telecontrol". Enter the TCSB address (static IP or hostname), the station number, and the project key. The CP will dial the TCSB and authenticate using the project key.

Step 3: Configure Data Points

In TCSB, define the data points (DBs, tags) that the remote station publishes. TCSB then makes these available as tags to the central S7-1500 via S7 connections or OPC UA to WinCC.

Step 4: Verify

Use the TCSB diagnostic tool to view the connection state of each station. The S7-1500 will see the remote data as if it were a local S7 connection. Confirm round-trip time is within expected GPRS latency (300-1500 ms).

Security Considerations for GPRS CPU-to-CPU

GPRS CPU-to-CPU links are exposed to the cellular network. Even with a private APN, the SIM can be moved to another device, and the APN can be misconfigured by the operator. Layered security is mandatory:

• Private APN with no public internet routing. Confirm with the operator that the APN is closed and not bridged to the public internet.
• IPsec tunnel between CP 1242-7 and central concentrator (SINEMA RC or third-party). StrongSwan and Cisco ASA are common concentrators.
• Disable unused services: Web server, DCP, SNMP on the CP and CPU. These are off by default but must be re-disabled after firmware updates.
• CPU access protection: Put the CPU in RUN with limited write access from the WAN side using the S7-1200's protection levels in TIA Portal.
• SIM PIN enabled on the CP 1242-7 to prevent SIM swap by a third party.
• Firewall at central site: Only port 102 (or 4840 for OPC UA) open from the private APN IP range.

Reliability Considerations

GPRS adds 300-1500 ms RTT latency, plus 1-5% packet loss under typical signal conditions. The application must be designed for this:

• Polling intervals of 5-30 seconds are normal; sub-second polling is not realistic.
• Use BSEND/BRCV with larger blocks (up to 8192 bytes) rather than many small PUT/GET calls.
• Monitor partner connection state; on disconnect, hold last known good values and alarm.
• Avoid time-critical interlocks over the WAN link. Use local I/O and let the WAN carry only supervisory data.
• Use a watchdog at the central site: if no successful update from a remote in 60 seconds, declare the station "stale".
• Implement a heartbeat: the remote S7-1200 increments a counter every cycle; the central site declares the link down when the counter stops incrementing.

Performance and Bandwidth

GPRS multi-slot class 10 offers up to 53.6 kbps uplink and 26.8 kbps downlink in theory; in practice, with overhead and signal quality, expect 10-30 kbps usable. A 200-byte Modbus register read uses 200 bytes × 8 = 1600 bits, so about 50-160 ms of air time per poll. For 10 remote stations polled every 10 seconds with 200 bytes of data, total air time is:

10 stations × 200 bytes × 8 bits / 20000 bps = 8 seconds per cycle, leaving headroom for retries and TCP overhead.

For larger payloads, use BSEND/BRCV with multiple frames to amortize the TCP/IP overhead. S7-1200 supports up to 8192 bytes per BSEND/BRCV call. The minimum time to send an 8192-byte frame over a 20 kbps link is 8192 × 8 / 20000 = 3.3 seconds, before TCP/IP headers.

Troubleshooting Matrix

Notes on Standard CPU-CPU Communication

The official Siemens manual CPU-CPU Communication with SIMATIC Controllers (entry ID 78028908) covers the application-side configuration of S7 connections, PUT/GET, BSEND/BRCV, and USEND/URCV. It is a required reference for any engineer designing S7 peer-to-peer networks, including the GPRS use case, because the WAN-specific constraints (latency, NAT, partner counts) are not covered in the CPU manuals themselves.

The S7-1200 system manual communication section (TIA Portal V20 / S7-1200 manual collection) covers the CPU-side communication blocks and the diagnostics interface. The "CPU communication" section describes which protocols are supported by the CPU itself and which require a CM/CP module.

Choosing the Right Architecture for Your Site

• 1-2 remote stations, no internet at central site: Direct mode with ISO-on-TCP, no server.
• 1-5 remote stations, central site has a static IP and internet: Direct mode with ISO-on-TCP, central PLC acts as partner.
• 5-5000 remote stations, central SCADA exists: Telecontrol mode with TCSB and OPC UA to SCADA.
• Many stations with WinCC: Telecontrol mode with TCSB OPC UA server feeding WinCC.
• Mixed fleet with very different protocols: Direct mode per cluster, TCSB as the central hub.

The decision is rarely about features; it is about connection count and who owns the connection lifecycle. PUT/GET fails on GPRS because the WAN cannot keep an S7 connection open reliably. OPC server fails because DCOM is hostile to GPRS. Pure TCP works but is bespoke. ISO-on-TCP is the standard, supported, and field-proven choice. Direct mode is the right answer for 1-5 stations; telecontrol mode is the right answer for fleets.

FAQ