S7-300 GPRS Remote Monitoring with WinCC via Siemens TeleControl

1. Overview: GPRS Telecontrol for S7-300 and WinCC Systems

General Packet Radio Service (GPRS) is a packet-switched extension to GSM standardised by 3GPP in Release 97. It occupies up to eight timeslots per TDMA frame in the GSM 900/1800/1900 bands and delivers a theoretical maximum of 171.2 kbit/s using coding scheme CS-4 with four downlink plus one uplink timeslot. Real-world throughput on an interference-limited link is typically 30-60 kbit/s with one-way latency in the 400-1500 ms range, driven by the GPRS Attach and PDP Context activation procedure plus RLC/MAC retransmissions over the radio interface. The protocol is documented in 3GPP TS 23.060 and a useful independent overview is published in Bauer et al., "Understanding GPRS: the GSM packet radio service" (Computer Networks, 2001); the technology itself is summarised at en.wikipedia.org/wiki/GPRS.

For industrial telemetry where the remote plant is tens to hundreds of kilometres from the control centre and no leased line or fibre is available, GPRS and its 3G/4G successors UMTS/HSPA and LTE remain the most cost-effective bearer for connecting a Siemens SIMATIC S7-300 station to a central SCADA host running WinCC. This reference covers a CPU 315-2 PN/DP (Siemens article 6ES7315-2EH14-0AB0) with PROFINET distributed I/O at a remote plant and a WinCC Runtime Professional server roughly 100 km away, communicating over a private APN through an industrial cellular router or a Siemens CP/TIM telecontrol module. Documentation for the S7-300 system is available on the Siemens Industry Online Support portal.

2. System Architecture and Topology Options

Three reference architectures are valid for an S7-300 remote station reporting to WinCC. The selection depends on the existing fleet, the cellular coverage, and whether the central site can act as a static IP endpoint.

Option A — Direct TCP/IP via SCALANCE M. The SCALANCE M874/M876 cellular router is connected to the PROFINET interface of the CPU 315-2 PN/DP. The CPU exposes its data on OPC UA or Modbus TCP and the central WinCC station polls it directly across the cellular bearer. Best when the CPU is already in STEP 7 V5.5/TIA and only IP routing to the central site is missing.

Option B — S7-1200 + CP 1242-7 / CP 1243-7 LTE as gateway. A small S7-1200 with a cellular CP is added next to the S7-300 station and exchanges the relevant process values via PROFINET I-Device, PUT/GET, or Modbus. The CP terminates the cellular link and forwards the data to the central WinCC. Best when the legacy CPU cannot be reconfigured and an outboard protocol converter is acceptable.

Option C — TIM 3V-IE on the S7-300 rack. A SINAUT TIM 3V-IE (6NH7800-3BA00) is inserted into the S7-300 rack and communicates via the SINAUT ST7 / SIMATIC TeleControl protocol to a central TIM 1531 IRC. The central TIM publishes the values to WinCC via OPC UA. Best for new telecontrol rollouts where store-and-forward redundancy, event-driven reporting, and time stamping are required.

3. Siemens Hardware Catalog for Cellular Telecontrol

The table below summarises the cellular interfaces Siemens sells for the S7-300 and S7-1200 families and the corresponding cellular bands. All article numbers are Siemens MLFBs — verify against the latest Siemens Industry Mall catalog before ordering, because several CP variants were declared end-of-life after the LTE roll-out.

4. Option A — S7-300 Direct via SCALANCE M Industrial Router

This is the cleanest path for a brown-field S7-300 station that has free IP address space and free CPU connection resources for OPC UA. The cellular network becomes a transparent IP pipe and WinCC at the central site talks to the CPU directly.

1. Mount the SCALANCE M874-2 on a DIN rail next to the S7-300 cabinet. The router requires 24 V DC ±20 %, 250 mA typical, 500 mA peak during transmit bursts.
2. Install an antenna suited to the cellular band. For GSM 900/1800 use a dual-band antenna such as 6GK5795-1MN00; for LTE, the wideband antenna ANT793-4MN (6GK5793-4MN00) covers 700-2700 MHz. Observe a minimum of 25 cm clearance from the cabinet walls to avoid pattern distortion.
3. Insert an activated mini-SIM (2FF) into the SIM holder. The SIM must carry a private APN subscription or a public APN with a static public IP if the central site must initiate.
4. Connect the SCALANCE M LAN port X1 to the CPU PROFINET port X1 using a Cat-5e cable (M12 D-coded if the cabinet uses ET200S PROFINET). The SCALANCE M acts as the default gateway.
5. Assign the SCALANCE M a fixed IP in the CPU's PROFINET subnet, e.g. 192.168.0.250 / 255.255.255.0.
6. Configure the CPU PROFINET interface with a default route via 192.168.0.250.
7. Activate the GPRS/UMTS PDP context. From the SCALANCE M Web UI (https://192.168.0.250, default user admin, password on the side label), navigate to Interfaces → Cellular → Mobile network and enter the APN, PDP type IPv4, no PAP/CHAP unless the operator requires it.
8. Activate an IPsec tunnel to the central SCALANCE S or SINEMA Remote Connect server (see section 9).
9. On the CPU, expose the relevant DBs as an OPC UA server. TIA Portal V16+ on a CPU 31x with firmware ≥ V3.3 supports OPC UA as a server with security policies None, Basic128Rsa15, and Basic256Sha256.

STEP 7 V5.5 alternative: for a CPU 315-2 PN/DP that is not in TIA Portal, configure a GET/PUT connection from the central WinCC station via S7 communication over TCP. Set up a passive S7 connection on the CPU with Connection properties → Establish connection passively and bind it to the PROFINET interface. From WinCC Explorer use the SIMATIC S7 Protocol Suite channel with the S7TCPIP driver and partner address = the CPU's PROFINET address (192.168.0.1 in this example).

5. Option B — S7-1200 + CP 1242-7 GPRS as Telecontrol Gateway

When the existing S7-300 cannot be reconfigured and the cellular interface must be retrofitted, an outboard S7-1200 station is added beside the S7-300 cabinet. The S7-1200 exchanges a small set of process values with the S7-300 over PROFINET or via PUT/GET and exposes them over GPRS to the central WinCC.

5.1 Wiring and addressing

• CPU 1215C (6ES7215-1AG40-0XB0) mounted next to the S7-300, PROFINET port to the CPU 315-2 PN/DP PROFINET port.
• CP 1242-7 (6GK7242-7KX31-0XE0) inserted on the S7-1200 left side, antenna connected to the SMA jack.
• SIM card in the CP 1242-7 SIM tray, APN subscription from the local mobile network operator (MNO).
• PROFINET device name of the S7-1200 set to s71200-gw, IP 192.168.0.20 / 24.

5.2 TIA Portal project structure

Create a TIA Portal project with both the CPU 315-2 PN/DP (as a partner station, GSD import) and the S7-1200 (as the active station). Add a PUT/GET or S7 connection from S7-1200 to S7-300:

// S7-1200 program block — fetch 20 bytes from S7-300 DB100
"GET_DB100" (REQ := TRUE,
            ID   := 1,
            NDR  => done,
            ERROR=> err,
            STATUS=> status,
            ADDR := P#DB100.DBX0.0 BYTE 20,
            RD_1 := P#M100.0 BYTE 20);

Configure the S7 connection in Devices & Networks → Connections → S7 connection with the S7-1200 as the active end and the CPU 315-2 PN/DP as the partner (passive). Enable PUT/GET access in the S7-300 CPU properties → Connection mechanisms; CPU 31x firmware ≥ V3.0 requires this checkbox.

5.3 CP 1242-7 TeleControl configuration

In the S7-1200 device configuration select the CP 1242-7 and open TeleControl interface. Set the following parameters:

Compile and download. The CP 1242-7 starts GPRS attach, opens the PDP context, and registers with the TIM 1531 IRC. The STATUS word of the TCON instance reports 16#0004 when the addressable station is online.

6. Option C — TIM 3V-IE / SINAUT ST7 Module on the S7-300 Rack

The TIM 3V-IE (Telecontrol Interface Module) is the legacy SINAUT answer and remains relevant for new S7-300 stations because it provides deterministic store-and-forward and time-stamped frames independently of the CPU scan time. The module occupies one slot on the S7-300 backplane and exchanges data with the CPU via S7 communication blocks.

6.1 Hardware

• TIM 3V-IE, article 6NH7800-3BA00, firmware V2 or higher.
• External GSM/GPRS modem MD720-3 (6NH9720-3BA00) connected to the TIM's RS-232 Modem port at 19 200 bit/s.
• Antenna + coax + SIM, kept on the same IP subnet as the LAN.

6.2 STEP 7 V5.5 configuration

1. Insert TIM 3V-IE into the S7-300 hardware catalog under SIMATIC 300 → Telecontrol → TIM 3V-IE.
2. In NetPro, create a SINAUT station with the TIM as the WAN node and the CPU 315-2 PN/DP as the LAN node.
3. Define the partner station (the central TIM 1531 IRC) and assign a project-wide node number; TIM 3V-IE node numbers must be unique in the SINAUT network (1-16383, with 16383 reserved for the master).
4. Configure the SINAUT frame list — for each data point, specify source/destination CPU slot, DB number, byte offset, length, and trigger mode (spontaneous, cyclic, or on threshold).
5. Download the configuration to the TIM. The TIM's BSET (basic settings) include the dial number of the central station, APN, and PDP type.

6.3 CPU program

The TIM exchanges data via standard S7 PUT/GET blocks. The TIM 3V-IE exposes its memory as DB 100 on the S7-300 CPU side and as DB 200 on the central TIM side. The application simply writes process values into DB 100 of the CPU and the TIM takes care of framing, time-stamping, retransmission, and dial-up.

// Structured Text on CPU 315-2 PN/DP, OB1
"TCON_IPv4"(REQ := TRUE,
            ID   := 1,
            CONNECT := "TCON_STRUCT");
"TSEND"(REQ := send_trigger,
        ID  := 1,
        LEN := 20,
        DATA := P#DB100.DBX0.0 BYTE 20);

7. SINAUT ST7 / SIMATIC TeleControl Protocol Details

The SINAUT ST7 protocol uses an ISO-on-TCP (RFC 1006) transport with port 102 over a TCP connection between the central TIM 1531 IRC and each remote station. Frames are variable length, with the following structure:

The TIM performs spontaneous with repetition when an event has occurred but the radio link is down: the event is stored in non-volatile RAM and re-transmitted on every link re-establishment until an acknowledgement is received. Maximum buffered frame count is 4096 on a TIM 3V-IE / TIM 1531 IRC, equivalent to several days of hourly events.

8. Cellular Bearer Configuration (APN, SIM, Band, QoS)

Most failures of GPRS telecontrol roll-outs are not protocol issues but APN / radio issues. Apply the following checklist when commissioning a new SIM:

1. Private APN from the MNO. The MNO assigns the SIM a fixed private IP from a dedicated range (e.g. 10.10.0.0/16) and routes all SIM traffic to the central site's VPN gateway. Avoid public APNs because they require the SCALANCE M to dial a TCP connection out — this works, but exposes the central WinCC server to the public Internet.
2. Static private IP per remote site. The MNO binds a static IPv4 address to the SIM's IMSI so the central TIM 1531 IRC can address the remote even when the remote initiates the connection.
3. SIM PIN — leave the PIN disabled on the SIM if the CP does not cache it across reboots; the CP 1243-7 and SCALANCE M do support PIN caching, but the field-engineering cost of recovering a wrong PIN is high.
4. RSSI threshold — set the SCALANCE M's "Reject GPRS attach if RSSI < -100 dBm" guard, otherwise the CP will repeatedly try to attach to a tower with no usable signal and exhaust the SIM's RACH budget.
5. Band lock in LTE areas. If the MNO refarmed GSM 900 to LTE, lock the CP to LTE Cat-1 only to prevent the CP from camping on a distant GSM 900 cell that is kept alive for voice.
6. APN QoS profile — request a non-real-time, best-effort, low-priority traffic class if the MNO offers it. Telemetry data tolerates 5 s polling latency, but a real-time traffic class may cost more.

Typical RSSI values for a working link are -75 dBm (excellent) to -95 dBm (usable). Below -100 dBm the radio link will attach but TCP throughput collapses to single-digit kbit/s. Use the SCALANCE M's web interface Information → Cellular page to confirm RSSI, RSRP (LTE), and the current cell ID.

9. VPN and Security with SINEMA Remote Connect

Industrial GPRS telecontrol links must be encrypted — a flat private APN only protects against passive sniffing, not against a compromised device inside the operator's network. Siemens bundles the SINEMA Remote Connect (SINEMA RC) VPN server for this purpose. SINEMA RC is a TLS-based reverse VPN where the central SINEMA RC server has a fixed public IP (or sits behind the SCALANCE S firewall) and each remote SCALANCE M / CP 1242-7 / CP 1243-7 initiates an outbound TLS tunnel to it. See IEC 62443-3-3 for the relevant industrial cybersecurity requirements on remote access.

9.1 SINEMA RC server

• Article number 6GK1720-1AH01-0BV0 (software, runs on Windows Server 2016/2019/2022).
• Default listening port TCP 443 (configurable) for the inbound tunnel from the field devices.
• Up to 128 remote nodes per server instance; license scales by node count.

9.2 Remote device enrollment

1. Generate a device certificate (X.509) for each SCALANCE M in the SINEMA RC admin UI: Remote nodes → Add → Certificate.
2. Export the certificate as PKCS#12 (file extension .p12) and copy it to a USB stick.
3. Plug the USB stick into the SCALANCE M's USB port. Navigate to System → SINEMA RC and load the .p12 file. The SCALANCE M now trusts the SINEMA RC server.
4. Configure the SINEMA RC server address (FQDN), user name, and password. The SCALANCE M initiates the outbound TLS tunnel on cellular attach.

9.3 Firewall rules

On the central firewall, only two ports need to be opened: TCP 443 to the SINEMA RC server and TCP 4840 (OPC UA) or TCP 102 (S7 / SINAUT) from the SINEMA RC server's internal interface to the WinCC/TIM server. Do not expose the WinCC server directly to the cellular APN.

10. WinCC SCADA Integration as OPC UA / TeleControl Client

The central WinCC server can consume remote data via three channels:

10.1 OPC UA channel setup

In WinCC Explorer, right-click Tag Management → Add new driver → OPC UA WinCC Channel. Configure the connection:

WinCC tag UDT_Remote_Analog:
  OPCServer    := "OPCUA:[email protected]:4840"
  ItemPath     := "S7_300_STATION/DB100/FLOAT[0..19]"
  UpdateRate   := 2000  ; ms
  DeadbandAbs  := 0.5   ; %

The TIM 1531 IRC publishes its SINAUT data points as OPC UA nodes under Objects → S7_300_STATION → DB100. Browsing the namespace from WinCC is done with the OPC UA browser in the tag editor.

10.2 S7TCPIP direct

For Option A (SCALANCE M directly connected to the CPU 315-2 PN/DP), add the SIMATIC S7 Protocol Suite driver in WinCC. Configure a new S7TCPIP connection with the CPU's PROFINET IP as the partner address and Rack/Slot = 0/2 (CPU 315-2 PN/DP slot 2). Use absolute addressing in the tag database:

WinCC tag "Remote_TankLevel":
  Address := DB100, DBD0, FLOAT
  Cycle   := 2 s

11. Commissioning Procedure and Verification

The following sequence assumes Option C (TIM 3V-IE + MD720-3 + central TIM 1531 IRC). Adjust for Option A/B by skipping the TIM-specific steps.

1. Hardware power-up. Apply 24 V DC to the S7-300, the TIM 3V-IE, the MD720-3, and the SCALANCE M (if used). Verify the MD720-3 NET LED is steady on within 30 s and SIGNAL LED shows at least 2 of 4 bars.
2. SIM attach. From the MD720-3 web interface (http://192.168.0.51), verify PDP state = active, IP address assigned by the MNO, and RSSI. If PDP state = inactive, check the APN string and the MNO subscription.
3. TCP connectivity. From a service laptop attached to the TIM's Ethernet port, ping the central TIM 1531 IRC's private IP. If ping fails, the issue is APN routing — not SINAUT — and must be resolved with the MNO before continuing.
4. SINAUT registration. On the central TIM 1531 IRC, open the diagnostics page TeleControl → Diagnostics → Stations. The remote station should appear within 60 s with state online.
5. OPC UA browse. From the central WinCC Engineering Station, use an OPC UA browser to connect to the TIM's OPC UA endpoint at opc.tcp://tim1531:4840 and browse the namespace. Confirm the data points are present.
6. WinCC tag test. Open WinCC Explorer and watch the Remote_TankLevel tag in the tag simulator. The value must update within one polling cycle.
7. Failover test. Pull the antenna. The TIM should buffer frames; re-attach the antenna; the buffered events should appear in WinCC in original time-stamped order.

12. Diagnostic Blocks, Fault Codes, and Troubleshooting Matrix

12.1 CP 1242-7 / CP 1243-7 STATUS word

The TCON instance on the S7-1200 returns a STATUS word whose lower 8 bits are the SINAUT station state and upper 8 bits the connection state. The most useful values are:

12.2 SCALANCE M874 STATUS LEDs

• BF (bus fault) — solid: SIM not detected or APN rejected.
• LINK on LAN port — off: Ethernet cable or PROFINET fault.
• SIGNAL 1-4 bars — RSSI indicator; 0 bars means no attach.
• VPN — solid green: SINEMA RC tunnel up; off: tunnel down; flash: negotiating.

12.3 Common fault matrix