S7-1200 GPRS with Teltonika RUT 241 Modbus TCP Hub-and-Spoke

S7-1200 GPRS with Teltonika RUT 241: Modbus TCP Hub-and-Spoke Design

1. Overview

Connecting four SIMATIC S7-1214C CPUs through cellular (GPRS/2G fallback) networks using Teltonika RUT 241 routers requires a deliberate split between three engineering domains: the radio link, the IP transport layer, and the PLC application layer. The architecture in question places one brain PLC that initiates all data exchanges with three remote spoke PLCs; the traffic is bidirectional, but the master/slave relationship is fixed. This reference documents a stable, supportable design using the Modbus TCP application layer on top of an APN-terminated cellular link, with optional OpenVPN / WireGuard tunneling for environments where the APN does not provide private addressing or where the SIM is on a public mobile network.

Although the original installation used a Siemens CP 1242-7 (CP 1242-7 GPRS Module), the customer-supplied Teltonika routers allow an equivalent IP path using the CPU's onboard PROFINET port. Modbus TCP is the recommended application protocol because:

• It is stateless request/response, ideal for lossy cellular links.
• The S7-1200 firmware provides native MB_SERVER and MB_CLIENT instructions in the S7-1200 Programmable Controller System Manual.
• Connection diagnostics and re-establishment are simpler than S7 PUT/GET over ISO-on-TCP (port 102), which is sensitive to NAT and middlebox timeouts.
• Modbus TCP works transparently across most public APNs, with port 502 either directly routable or forwarded through the RUT 241.

2. Architecture: Hub-and-Spoke vs Alternatives

Three topologies are viable for four PLCs over GPRS. The decision is driven by message direction, not by the number of nodes.

The hub-and-spoke layout with the brain as the Modbus TCP client matches the user's stated requirement ("a PLC that takes over and gives commands") and gives the most predictable timing because the brain controls the scan rate.

2.1 Logical Diagram

3. Hardware Reference

3.1 Siemens S7-1200 CPUs in scope

Per the S7-1200 system manual, each CPU supports up to 16 open user communication connections when used as a Modbus TCP server, and the Modbus client can be instantiated as many times as the work-memory allows. For three simultaneous spokes, three MB_CLIENT instances on the brain are conservative and well within the connection budget.

3.2 Teltonika RUT 241 specifications

Reference: Teltonika RUT 241 Wiki and the RUT 241 product page.

3.3 Optional: CP 1242-7 GPRS module

The CP 1242-7 (6GK7242-7KX31-0XE0) is the Siemens-native GPRS module. It plugs into the left bus of the S7-1200 and presents itself as a separate PROFINET device. If the fielded hardware already includes it, configure it as a backup path and use the Teltonika router as the primary IP gateway. The two can coexist; the CPU simply routes outbound traffic through whichever interface is reachable.

4. Protocol Selection: Modbus TCP vs S7 Communication

Recommendation: Modbus TCP for the cellular leg, and put S7 communication on the LAN side if/when the S7-1200 fleet is later consolidated behind a CP 1243-1 or a SCADA OPC UA server. The brain PLC can still be programmed via the S7 protocol on its own LAN port; the cellular link only carries Modbus TCP.

5. Network Prerequisites

1. SIM card and APN. Provision four SIMs from the same carrier. Prefer a private APN (also called APN with private addressing or corporate APN) that issues static private IPs; this avoids the need for a VPN and keeps all four routers in a routable subnet.
2. Public or routable address for the brain. If the APN does not provide static IPs, the brain site must obtain a fixed public IP (or use dynamic DNS, but this adds a failure mode).
3. Port 502 reachability. If using a public APN, the cellular carrier must permit inbound TCP/502 to the brain, or you must deploy a VPN.
4. Antennas and signal. Use an external 2G/3G/LTE antenna with at least 3 dBi gain at each remote site; indoor-only antenna placement is the most common cause of GPRS flapping.
5. Power. The S7-1200 PS and the RUT 241 each need stable 24 VDC; budget 1 A peak for the router during transmission bursts.

6. Teltonika RUT 241 Configuration

Procedure applies to firmware RUT2M_R_00.07.x and later. Reference: RUT 241 Web UI manual.

6.1 APN setup

1. Log into http://192.168.1.1 (default).
2. Navigate to Network → Mobile → Mobile.
3. Set APN to the carrier-provided string (e.g., scarda.m2m or internet).
4. If the APN requires authentication, fill Username and Password.
5. Set Authentication to CHAP or PAP per the carrier.
6. Disable Roaming unless required.
7. Apply. The status page should show a WAN IP within 30 s.

6.2 LAN addressing (each site)

6.3 Port forwarding (public APN case)

When the brain's RUT 241 has a public IP and the spoke routers have only carrier-grade NAT, the spoke RUT 241 must forward TCP/502 from the cellular interface to the local S7-1200. Path: Network → Firewall → Port Forwarding.

The brain then connects to <spoke_public_ip>:5021/5022/5023. Mapping 502 → non-standard 5021–5023 on the WAN side keeps the public attack surface on a port most scanners skip, but you still should not expose it to the open internet without VPN.

6.4 WireGuard (recommended for public APN)

1. On the brain RUT 241, Services → VPN → WireGuard, create a new instance, generate keys, set Listen port 51820, and assign tunnel address 10.10.0.1/24.
2. Add three peers (spokes) with their public keys; the AllowedIPs should be 10.10.0.11/32, 10.10.0.12/32, 10.10.0.13/32.
3. On each spoke, create a WireGuard instance pointing to the brain's public endpoint; tunnel IP 10.10.0.1x; AllowedIPs 10.10.0.0/24, 192.168.10.0/24.
4. Add static routes on the brain to reach each spoke's PLC subnet (192.168.11.0/24, etc.) through the WireGuard interface.

With WireGuard up, the brain addresses each spoke's MB_SERVER at 10.10.0.11:502 (or 10.10.0.12, 10.10.0.13) on the tunnel interface, and the cellular link only carries encrypted UDP/51820. See the Teltonika WireGuard configuration page.

7. S7-1200 Modbus TCP Server Configuration (Spokes)

Use the S7-1200 as a Modbus TCP server. The user application exposes a defined tag map that the brain will read and write. Reference: S7-1200 Modbus TCP Communication.

7.1 TIA Portal setup

1. In the device view, open the CPU → Properties → Communication interfaces → PROFINET interface.
2. Set IP and subnet per Section 6.2.
3. Add the MB_SERVER instruction from the Instructions → Communication → Modbus palette. Place one instance in a cyclic OB (e.g., OB1).
4. Configure the instance DB:

7.2 Tag map (DB10 example)

DATA_BLOCK "SpokeDB"
{ S7_Optimized_Access := 'FALSE' }  // MB_SERVER requires non-optimized DB
  STRUCT
    Heartbeat         : WORD;        // offset 0   – 0xA5A5 toggled by spoke
    StatusBits        : WORD;        // offset 2
    AnalogIn_1_4      : ARRAY[1..4] OF INT;  // offset 4..11
    AnalogOut_1_2     : ARRAY[1..2] OF INT;  // offset 12..15
    DigitalIn_8       : BYTE;        // offset 16
    DigitalOut_8      : BYTE;        // offset 17
    SetpointSpeed     : REAL;        // offset 18 (read by brain, written by brain to spoke)
    SpareWords        : ARRAY[1..80] OF WORD;  // offset 22..181
  END_STRUCT;
END_DATA_BLOCK

Offset 0..181 occupies 91 words. Reserve the full 100-word block (200 bytes) for future expansion. Strictly use a non-optimized DB — MB_SERVER does not support optimized access.

8. S7-1200 Modbus TCP Client Configuration (Brain)

One MB_CLIENT instance per spoke, all on the brain CPU. Use an array-driven state machine in OB1 so the three connections are polled sequentially in the same cycle.

8.1 FB and instance DB

FUNCTION_BLOCK "MB_Poller"
{ S7_Optimized_Access := 'FALSE' }
VAR_INPUT
    Execute       : BOOL;
    RemoteIP      : ARRAY[1..4] OF BYTE;  // IP octets, e.g. [10,10,0,11]
    RemotePort    : UINT;                  // 502
    UnitID        : BYTE;                  // 255 for TCP per Modbus spec
END_VAR
VAR_OUTPUT
    Done          : BOOL;
    Busy          : BOOL;
    Error         : BOOL;
    Status        : WORD;
END_VAR
VAR
    MBInst        : MB_CLIENT;             // one per spoke, instantiated 3x
    ReqTrigger    : BOOL;
END_VAR

8.2 Connection parameters per spoke

Use a single OB1 cycle to trigger the next MB_CLIENT only after the previous call returns Done=TRUE or Error=TRUE. Do not retrigger on the same cycle; doing so causes connection overload on flaky GPRS links.

8.3 Sample ST (brain OB1 segment)

// Sequential poller for 3 spokes
IF NOT "Poller[1]".Busy AND NOT "Poller[2]".Busy AND NOT "Poller[3]".Busy THEN
    IF "Trig".Spoke1 THEN
        "Poller[1]"(Execute := TRUE, ...);
        "Trig".Spoke1 := FALSE;
        "Trig".Spoke2 := TRUE;
    ELSIF "Trig".Spoke2 THEN
        "Poller[2]"(Execute := TRUE, ...);
        "Trig".Spoke2 := FALSE;
        "Trig".Spoke3 := TRUE;
    ELSIF "Trig".Spoke3 THEN
        "Poller[3]"(Execute := TRUE, ...);
        "Trig".Spoke3 := FALSE;
        "Trig".Spoke1 := TRUE;
    END_IF;
END_IF;
// Reset Execute on Done / Error
"Poller[1]".Execute := "Poller[1]".Busy;
// repeat for 2 and 3

9. Polling Cycle, Latency, and Bandwidth

Engineer the scan rate from the worst link, not the best. On 2G/GPRS the realistic profile is:

With 3 spokes, one in-flight at a time, and a poll that reads/writes 100 words, the minimum cycle is 3 × (1.5 s + 0.5 s handshake) ≈ 6 s. Engineer the application for an 8-second nominal scan with retries and treat any value older than 30 s as stale.

Bandwidth check: 3 × 100 words × 2 bytes × 8 bits × 3 (TCP + Modbus + IP overhead) ≈ 14.4 kbit per scan. At 6 s scan and 1 spare, the steady-state data rate is ~2.4 kbit/s per link, well within GPRS.

10. Verification Procedure

1. Power the S7-1200 and the RUT 241 at the brain site. Confirm the PLC's PROFINET port is in RUN with no diagnostics.
2. From the brain LAN, ping each spoke's 192.168.xx.10 over the WireGuard tunnel. A failed ping means VPN is broken, not Modbus.
3. Open TIA Portal online → Diagnostics → Connection information on the brain CPU. The Modbus TCP connections should be listed and show Connected.
4. From the brain HMI or watch table, force Spoke1.AnalogOut_1[1] := 5000 (50.00%) and observe the corresponding variable on Spoke 1 within one poll cycle.
5. Run a 30-minute stability test with each spoke unplugged in turn. The brain should mark the missing spoke as Error with Status = 0x80C8 (connection aborted) and recover automatically when the link returns.
6. Disable the cellular signal at one spoke and re-enable it. Confirm the brain re-establishes the connection without a CPU restart.

11. Troubleshooting Matrix

For the full Modbus TCP error code reference, see the S7-1200 Modbus TCP manual section.

12. When to Switch Back to CP 1242-7

The CP 1242-7 becomes the better choice in three situations:

• The S7-1200 must dial into a private Siemens TeleControl server (TCSB) and the customer requires remote programming via STEP 7 Remote Service.
• The cellular carrier does not permit port forwarding or inbound traffic and WireGuard is not an option.
• Redundancy is required and the CPU's PROFINET port is consumed by an HMI — the CP 1242-7 adds a second independent IP interface.

In those cases, keep the Teltonika RUT 241 as a backup LTE link with a separate SIM, and use the CP 1242-7 as the primary. Reference: SINAUT TeleControl documentation.