S7-1200 Remote Pumping Station: SCALANCE M876-4 VPN Setup

Overview

Remote pumping stations are typical industrial edge sites where a small Siemens S7-1200 PLC handles local pump control while a cellular router maintains an IPsec-secured VPN tunnel back to the central control room. This technical reference covers the complete commissioning path for a station built around the SIMATIC S7-1200 CPU 1212C DC/DC/Relay (MLFB 6ES7212-1HE40-0XB0), the SCALANCE M876-4 4G/LTE router, TIA Portal STEP 7 Basic V16, and the SINEMA Remote Connect virtual appliance. Each component is field-proven in unattended water and wastewater sites where only a cellular backhaul is available.

The architecture is deliberately compact. One PLC handles the discrete and analog I/O for pump run feedback, seal-leakage detection, wet-well level, and discharge pressure; the cellular router terminates a SINEMA Remote Connect (SINEMA RC) tunnel that the central engineering workstation can join without exposing the PLC directly to the public internet. The same channel carries TIA Portal project download, web-server pages, PUT/GET S7 communication, and remote firmware updates to the cellular router.

Three software entitlements are mandatory for this topology:

1. A TIA Portal STEP 7 Basic license that authorizes the engineer to develop, compile, download, and commission the S7-1200 program. For V16 the floating download entitlement is 6ES7822-0AE06-0YA5.
2. A SINEMA Remote Connect Server entitlement that runs the VPN concentrator in the central data center. For a 4-tunnel starter pack the entitlement is 6GK1720-1AH01-0BV0.
3. Operator-side SINEMA RC Client software (free of charge) that allows individual engineering workstations to dial into the SINEMA RC server.

Bill of Materials and MLFB Decoding

Siemens part numbers encode the function, hardware variant, firmware, and packaging. Verify every digit against the official Siemens Industry Mall entry before ordering; a single letter often changes the I/O mix or the power-supply variant.

S7-1200 CPU 1212C Hardware Specifications

The 6ES7212-1HE40-0XB0 is the DC/DC/Relay variant of the CPU 1212C. The MLFB breaks down as 6ES7 212-1 HE 40-0XB0:

• 212: CPU 1212C family (versus 211, 214, 215, 216 for the larger siblings).
• 1: Single PROFINET interface on the bottom of the CPU body.
• HE: DC/DC/Relay — 24 V DC power supply, 24 V DC digital inputs, relay outputs.
• 40: Hardware functional state of the PCB; later codes denote newer revisions.
• 0XB0: Packaging and documentation set.

Key specifications for this variant (verify against the latest datasheet at order time):

For full hardware details consult the official S7-1200 Programmable Controller System Manual and the S7-1200 entry on the Siemens Industry Mall catalog page.

SCALANCE M876-4 Cellular Router Specifications

The SCALANCE M876-4 is a 4G/LTE cellular router in the SCALANCE M family. It is intended for unattended outdoor and industrial cabinets, with an extended temperature range and ruggedized housing. Confirm the regional variant against the cellular bands licensed by the local carrier — for Canadian deployments choose a variant that includes B4 (AWS) and B12/B13 (lower 700 MHz) to cover Rogers, Bell, and Telus LTE deployments.

TIA Portal V16 — STEP 7 Basic Licensing

STEP 7 Basic V16 was released as part of the TIA Portal V16 update package in December 2020. It supports the S7-1200 family from firmware V4.2 onward and the S7-1500 family up to firmware V2.9. For projects that mix S7-1200 and S7-1500, upgrade to STEP 7 Professional. For a stand-alone S7-1200 station, STEP 7 Basic is the correct and most economical choice.

A floating license means the license key can be assigned to any one engineering workstation at a time but can be moved to another workstation by returning it to the Automation License Manager (ALM). For teams that share a license, deploy the Automation License Server (a service that runs on a server-class machine and hands out licenses on demand).

Activation procedure (for the floating download entitlement):

1. Install TIA Portal V16 from the Siemens Online Software Delivery (OSD) portal download.
2. Open the Automation License Manager.
3. Click Activate License and select Activate Floating License.
4. Enter the License Key (a 20-character alphanumeric string supplied by Siemens by email once the OSD download is acknowledged).
5. The license is now bound to that PC. To move it, right-click the license and choose Return Floating License on the source machine, then re-activate on the destination machine.

For larger engineering teams, install the Automation License Server (a separate Siemens download) on a Windows Server and use the ALM to borrow/return floating licenses. The server itself needs a license-key file generated from the purchased MLFB.

SINEMA Remote Connect Licensing

SINEMA Remote Connect is the Siemens VPN concentrator that terminates the tunnel initiated by the SCALANCE M876-4 and any SINEMA RC client. It is delivered as a virtual appliance (.ova for VMware ESXi and .vhd for Microsoft Hyper-V) and runs on a server in the central data center.

The Basic Package entitlement is suitable for a single pumping station with one SCALANCE M876-4 tunnel plus one or two engineering clients. Each tunnel consumes one connection credit regardless of the underlying device; SINEMA RC Client connections from engineers count the same as router-to-router tunnels. When the pool of four is exhausted, additional tunnel upgrade entitlements can be purchased and applied to the same appliance without redeploying the VM.

Procurement in Canada

Siemens sells its Canadian automation catalog through a mix of direct and authorized-distributor channels. For TIA Portal, SINEMA RC, and SCALANCE hardware the most common legitimate channels are:

• Siemens Canada direct sales: The national office in Oakville, Ontario serves as the entry point for direct commercial offers, framework agreements, and project pricing. Contact details are listed on the Siemens Canada site and the Siemens Distributor Locator.
• Authorized industrial automation distributors: Electrical wholesale houses that carry Siemens automation typically stock STEP 7 licenses, SCALANCE routers, and S7-1200 spare parts. They can also broker SINEMA RC entitlements.
• Siemens Industry Mall: Online portal at mall.industry.siemens.com for direct purchase of software downloads (TIA Portal, SINEMA RC) and configured hardware MLFBs that are shipped from regional hubs.

Network Architecture and IP Plan

The recommended topology is hub-and-spoke: one SINEMA RC server in the data center, one M876-4 router at each remote station, and any number of SINEMA RC clients on the engineering workstations.

Address plan example for one station:

All cellular-facing devices receive their WAN IP from the LTE carrier. The SINEMA RC server should be reachable from the public internet on UDP 500 and UDP 4500 (for IPsec NAT-traversal) and TCP 443 (for SINEMA RC client connections over TLS).

For multiple stations, increment the third octet on the station network: station 1 = 192.168.10.0/24, station 2 = 192.168.11.0/24, and so on. Avoid overlapping the LAN of the data center.

SCALANCE M876-4 Configuration

The M876-4 is configured through its Web Based Management (WBM) at https://192.168.1.1 on initial commissioning. Change the LAN IP to match the station plan before connecting it to the field network.

Required configuration steps:

1. Connect a PC to the LAN port of the M876-4, set the PC to DHCP, browse to https://192.168.1.1, log in with admin / admin.
2. Navigate to System > General, set the device name (e.g. PUMP01-M876), set the time zone, and configure NTP (pool.ntp.org or a local NTP source).
3. Under Interfaces > WAN, select Mobile as the connection type, enter the APN supplied by the carrier (Bell, Rogers, and Telus typically use inet.bell.ca, internet.com, or isp.telus.com; confirm with the issued SIM card kit), and set the authentication credentials if required.
4. Install both antenna leads to the SMA MAIN/AUX connectors and torque to 0.6 N·m to maintain the IP rating of the antenna bulkhead.
5. Under Security > SINEMA RC, enable the SINEMA RC client, enter the FQDN or public IP of the SINEMA RC server, and paste the device-specific pre-shared key generated by the SINEMA RC server during device enrollment.
6. Under Layer 3 > Firewall, create an inbound rule that allows IPsec IKE/ESP from the SINEMA RC server IP and a corresponding outbound rule for return traffic. Block all other inbound WAN traffic.
7. Under Layer 3 > Static Routes, add a route to 10.50.0.0/24 with the SINEMA RC tunnel as the next-hop interface. The M876-4 sets this automatically once the SINEMA RC tunnel is up.

Test the cellular link by navigating to Information > Mobile and confirming that the SIM registers on the carrier (signal RSSI > -100 dBm is the minimum acceptable, RSRP > -110 dBm for LTE). A poor signal is the single biggest source of remote-site VPN instability — add an external MIMO antenna on the cabinet roof if the indoor RSSI is borderline.

SINEMA Remote Connect Server Configuration

The SINEMA RC Virtual Appliance is deployed on VMware ESXi or Microsoft Hyper-V. Minimum host requirements:

• 2 vCPU, 4 GB RAM, 40 GB disk
• 1 NIC bridged to the corporate LAN
• Static IP address (e.g. 10.50.0.10)
• DNS A-record pointing to sinema-rc.example.com

Initial setup procedure:

1. Import the .ova (or .vhd) into the hypervisor, set the management IP, and power on.
2. Browse to https://<sinema-rc-ip>, accept the self-signed certificate, and log in with admin / admin.
3. Change the default password and upload the license key supplied with the Basic Package entitlement. The license count increments in the Licensing panel.
4. Under User Accounts, create one account per engineering workstation. Generate a one-time password that the user changes at first login.
5. Under Devices > Routers, create a device entry for the M876-4. The server generates a device-specific PSK; copy that PSK into the M876-4 SINEMA RC client configuration.
6. Under Remote Connections > Connection Groups, create a group named Pumping Stations with the participating devices and user accounts. Save.

Once the configuration is saved, the SINEMA RC server sits and waits for inbound IPsec connections. To verify, watch the Connections panel as the M876-4 attempts its first dial-in.

S7-1200 Program Development

Open TIA Portal V16 and create a new project for the S7-1200 station.

1. In Project Tree, add a new device S7-1200 > CPU 1212C DC/DC/Relay > 6ES7212-1HE40-0XB0 with firmware V4.4 (or higher, depending on what the CPU ships with).
2. Open Device Configuration > PROFINET Interface, set the IP address to 192.168.10.10, subnet 255.255.255.0, and the router address to 192.168.10.1 (the M876-4 LAN IP).
3. Open Device Configuration > Web Server, enable the web server, and tick Enable user-defined web pages.
4. Under PLC Tags, create the following standard tag table for a pumping station:

5. Create an FC100 "Pump_Alternation" function block that implements duty rotation between the two pumps based on number of starts and elapsed run time. Use IEC timers (TP, TON) and counters (CTU) from the standard instruction library.
6. Create an FC110 "Level_Control" that scales the AIW64 raw value (0-27648) to engineering units (0-100%) using the SCALE block from the "Convert" library.
7. Build the OB1 cycle with the standard pattern: read inputs, evaluate alarms, run pump logic, write outputs.
8. Configure a Watch Table with the most important tags and a Force Table for commissioning.
9. Compile, download to the CPU over the VPN tunnel, and verify the green RUN LED.

Example ladder snippet for pump 1 run logic:

// Network 1: Auto run
A    "i_AutoMode"
A    "i_StartCmd"
AN   "i_StopCmd"
AN   "i_SealLeak"
=    "o_Pump1Run"

// Network 2: Manual run
AN   "i_AutoMode"
A    "i_StartCmd"
AN   "i_StopCmd"
=    "o_Pump1Run"

// Network 3: Seal-leak interlock (drops both pumps on alarm)
A    "i_SealLeak"
R    "o_Pump1Run"
R    "o_Pump2Run"
S    "o_AlarmHorn"

For project setup details refer to the Introducing the S7-1200 PLC chapter in the S7-1200 manual collection.

Commissioning Procedure

Commission in five stages, each gated by a sign-off:

1. Bench test (off-site). Wire the CPU, M876-4, and a 24 V DC power supply on the bench. Update the CPU firmware via SD card to V4.4 or newer. Verify that the CPU reaches RUN, the M876-4 establishes the SINEMA RC tunnel, and that TIA Portal can download a project. Validate the pump logic with simulated inputs.
2. Site installation. Mount the CPU and M876-4 in the cabinet, land the antenna cables outside, fit the SIM card, and apply 24 V DC. Power up.
3. Cellular verification. From the M876-4 WBM, check the RSSI, RSRP, RSRQ, and SINR. Target: RSRP > -100 dBm, SINR > 5 dB. If the values are marginal, swap the antenna for a higher-gain MIMO external model.
4. VPN tunnel test. From the central engineering workstation, launch the SINEMA RC client, connect to the server, and verify that the M876-4 endpoint shows online. Ping the PROFINET IP of the S7-1200 from the engineering workstation over the tunnel. A successful ping confirms routing and NAT-traversal.
5. I/O loop check. With the pumps locked out, force each output individually and verify the contactor pulls in. Run each pump in manual mode for 10 seconds and verify the run feedback reaches the CPU.

Verification and Diagnostics

After the commissioning sign-off, the following diagnostics should be wired into the central SCADA or monitoring dashboard so remote faults are visible without dispatching a technician:

• CPU diagnostic buffer download over the VPN tunnel (TIA Portal > Online > Diagnostics > Diagnostic Buffer). Look for Communication error events with error codes such as 0x02 0x03 (IP connection failed).
• M876-4 event log via WBM or via the SINEC NMS server. Filter on VPN, Mobile, and Firewall events.
• S7-1200 web server user-defined page showing current pump run state, level percentage, and runtime hours for each pump.
• Cellular signal strength logged hourly into a data block and pushed to the central SCADA via S7 PUT/GET on the PROFINET interface.

Troubleshooting Matrix

Frequently Asked Questions