S7-300 Remote Download: TeleService and SINEMA RC Setup

Remotely downloading a modified STEP 7 logic to an S7-300 CPU315DP that sits behind a CP343-1 Lean on a customer network is a routine service task. The plant floor has neither an engineer on-site nor a permanent VPN back to the office, but the controller must be updated. This reference covers the three practical paths that survive the realities of the field: legacy TeleService over PSTN/ISDN, TeleService over the public Internet via TS Adapter IE, and modern SINEMA RC remote access. The procedures assume STEP 7 V5.6 for legacy TeleService or TIA Portal V18/V19 for the equivalent S7-300 routes.

1. Hardware and Software Inventory

Confirm the rack content before you plan the remote path. A CPU315DP (e.g., 6ES7 315-2AG10, 6ES7 315-2AH14, or 6ES7 315-2EH14) with firmware version 2.x or 3.x is the controller in the original requirement. The CP343-1 Lean (6GK7 343-1CX00-0XE0 or 6GK7 343-1CX10-0XE0) provides Industrial Ethernet connectivity on the backplane bus. Remote download needs at minimum:

• S7-300 CPU with one of: MPI/Profibus DP port, or CP343-1 Lean with configured S7 connection.
• STEP 7 V5.6 + SP2 (or TIA Portal V18/V19 with S7-300 add-on) on the engineering station.
• Remote access gateway: TS Adapter II (6NH7 800-0BA00, PSTN), TS Adapter IE (6NH7 860-0AA00, Ethernet/ISDN), or SINEMA RC Server appliance/software.
• Static public IP, dynamic DNS service, or SIM card with cellular modem (for cellular variants of the modern adapter).

2. Remote Access Methods Compared

3. Prerequisites

1. Project archive. Export the STEP 7 project (S7P file) and have the hardware configuration (HW Config) in the offline blocks. Verify the offline blocks compile to match the online signature before you attempt any remote download; mismatched FB/FC/DB interfaces are the most common cause of abort during download.
2. CP343-1 Lean IP and subnet. Note the CP's configured IP (e.g., 192.168.0.10/24). Confirm the CP has an S7 connection permitted to the CPU (this is the default for the Lean variant with active S7 communication).
3. Public reachability. The remote adapter must be addressable from your engineering station. Use a static public IP, an OpenVPN or IPsec tunnel to the plant, or a managed cellular SIM with fixed private APN.
4. Firewall openings. See Section 6 for the full port matrix. The default S7 port is TCP 102; SINEMA RC uses TCP 50000-50010 plus UDP 161/162 for SNMP if used.
5. STEP 7 online capability. The PG/PC interface on the engineering station must include the TCP/IP ISO-on-TCP driver that targets the CP. Test this against the CP's IP from inside the plant network before exposing the adapter to the Internet.

4. Path A: TeleService with TS Adapter II (PSTN)

The TS Adapter II (Siemens order number 6NH7 800-0BA00) connects to the MPI/DP port of the CPU315DP and to an analog telephone line. It functions as a thin gateway: the engineering station dials the phone number, the adapter answers, and the TeleService software encapsulates STEP 7 MPI frames over the dial-up connection.

4.1 Hardware wiring

• Plug the supplied MPI cable from the TS Adapter II to the CPU315DP's MPI/DP port (X1). The adapter is a passive MPI node; set its MPI address via the rotary switch or the TeleService software to a free address (default 0 is reserved for the CPU, so use 1 or higher).
• Connect the adapter's RJ-11 jack to the site phone line. The adapter must be the only device on that line during a session, or it must be on a dedicated extension.
• Apply 24 VDC to the adapter's power terminals.

4.2 TeleService software setup

1. Install TeleService from the CD bundled with the TS Adapter. License is tied to the adapter's serial number.
2. Open the TeleService Editor, create a new connection, and select TS Adapter II.
3. Enter the plant's dial-in number, COM port on the engineering PC (no longer used by the adapter itself, but the software references it for the local modem), and the adapter's MPI address.
4. Define the partner MPI address (CPU315DP MPI address, default 2).

4.3 Download from STEP 7

1. In STEP 7 V5.6, choose Options → TeleService → Connect to target system. The dial-up session is established first; then STEP 7 sees the CPU as if it were on a local MPI cable.
2. Select the S7 program in SIMATIC Manager, right-click, and choose Download. STEP 7 first downloads the HW Config, then the blocks (OB, FB, FC, DB).
3. Monitor the transfer window. Over 33.6 kbps PSTN, a 2 MB program takes roughly 8-12 minutes; over ISDN it takes under a minute.

5. Path B: TeleService with TS Adapter IE (ISDN/Internet)

The TS Adapter IE (6NH7 860-0AA00) accepts either an ISDN BRI line or a 10/100 Ethernet uplink. The ISDN variant dials in exactly like the TS Adapter II but uses the D-channel for call setup. The Ethernet variant sits on the plant LAN, shares the CP343-1's switch port (or a separate one), and accepts incoming TCP connections from the Internet via port forwarding or a VPN.

5.1 IP configuration

1. Connect a PC to the adapter's configuration port (X2) and browse to https://192.168.1.1. Default credentials are admin / admin.
2. Set the LAN IP (e.g., 192.168.0.50), subnet mask, and default gateway. Disable the DHCP server if the plant already runs one.
3. Under Remote Access, enable the TeleService mode and assign a node name (e.g., PLANT01-CP3431).
4. Configure dial-in number or, for Ethernet mode, the public IP/DDNS name of the customer router.

5.2 STEP 7 over Internet

1. On the engineering PC, install the TeleService software and add a new connection of type TS Adapter IE via TCP/IP.
2. Set the partner IP to the public address of the plant (or DDNS name). Set the local S7 partner address to the CP343-1's LAN IP.
3. Activate S7 routing in STEP 7: Options → Set PG/PC Interface → TCP/IP (Auto) → Properties → S7 routing enabled. This allows STEP 7 to traverse the CP343-1 to the CPU.
4. Test reachability with PLC → Accessible Nodes. The CP343-1 should appear, and beneath it the CPU315DP via S7 routing.
5. Trigger the download as in Section 4.3.

6. Path C: SINEMA RC (Current Standard)

SINEMA RC is the modern replacement for TeleService. It is a client/server architecture that tunnels STEP 7 or TIA Portal traffic through an encrypted channel, supports IPv4/IPv6, and is the only path Siemens still ships new for the S7-300 product line. The server is a software appliance (Linux or Windows) installed at the plant or hosted in a DMZ. The client is a Windows application on the engineering station.

6.1 Server installation

1. Install SINEMA RC Server (order number 6GK1 720-1AH01-0BV0) on a dedicated x86 host with two NICs: one for the plant network, one for the Internet uplink (or VLAN segmentation).
2. Apply the license file from the USB dongle or Siemens License Server.
3. In the web admin, create a user for the remote engineer with role Service (read/write to the S7 subnet only).
4. Add the CP343-1 as a device, enabling the S7 channel and disabling the S7-1200/1500 channels you do not need.

6.2 Client configuration

1. Install SINEMA RC Client on the engineering PC and import the server's address (public IP or VPN endpoint) and user credentials.
2. Once logged in, the SINEMA RC client enumerates all reachable PLCs. The CP343-1 appears as an S7 device with the CPU315DP accessible behind it via S7 routing.
3. Open TIA Portal or STEP 7, set the PG/PC interface to SINEMA RC → TCP/IP, and proceed with the standard download flow.

6.3 Firewall and ports

7. PG/PC Interface and S7 Routing

S7 routing is the mechanism that lets a TCP/IP packet addressed to the CP343-1 be forwarded as a Profibus/MPI frame to the CPU315DP. Configure it once on the engineering PC:

1. Open Set PG/PC Interface from the Control Panel or STEP 7 menu.
2. Select the interface that matches your transport: TCP/IP (Auto) → <your NIC> for direct LAN, SINEMA RC → TCP/IP for the modern tunnel, or the TeleService adapter's virtual driver for legacy paths.
3. Click Properties → S7 Routing and tick Use S7 routing for this interface.
4. In the Accessible Nodes view, the CP343-1 should appear, and the CPU should be visible under the CP with a small arrow icon indicating it is reached through routing.

8. STEP 7 Download Procedure (Common to All Paths)

1. Open the project in SIMATIC Manager or TIA Portal.
2. From Online → Accessible Nodes, verify the CPU is visible and reachable. Note the diagnostic buffer entry "Online: Connection established to partner".
3. Compare the offline and online block list. Resolve any FB/FC/DB interface mismatches before continuing; STEP 7 will refuse the download otherwise.
4. Set the CPU operating mode. For program changes only, leave it in RUN-P. For configuration changes, place the CPU in STOP first (use PLC → Operating Mode).
5. Select the S7 Program → Blocks folder and press the download icon. STEP 7 prompts to download HW Config first if it has changed. Confirm.
6. Monitor the transfer. The CPU's SF/BF LEDs should remain off, and the run LED should stay green (or flash for RUN-P, depending on version).
7. After completion, the diagnostic buffer should contain a user-defined entry. If you have an OBl call to SFC 6 "RD_SINFO" or a timestamped event, confirm the new logic is active.

9. Verification

• Online signature check: In PLC → Compare Online/Offline, all modified blocks must show identical content hashes.
• Diagnostic buffer: No events of class "communication error" or "module parameter assignment error" should appear after the download.
• Watch table smoke test: Force a known input and verify the output using a VAT table. Toggle force values in the VAT and confirm the physical output or the in-CPU tag changes accordingly.
• Process verification: With the line under the customer's permissive, exercise the changed logic path end-to-end.
• Session log: SINEMA RC stores session logs; TeleService stores them in the local project folder. Archive them to the project ticket for audit.

10. Troubleshooting Matrix

11. Security Hardening

• No direct S7 exposure. Never publish TCP 102 on a public IP. Use SINEMA RC, IPsec, or OpenVPN.
• Strong credentials. SINEMA RC supports RADIUS and LDAP; integrate with the customer's directory and enforce MFA where possible.
• Role-based access. Grant the service engineer only the S7 subnet he needs. Block PLC-to-PLC routes if the change does not require them.
• Audit trail. SINEMA RC records user, time, source IP, and session duration. Export the log per change ticket.
• Firmware hygiene. Keep CP343-1 and CPU315DP firmware on the latest released version for the product line. As of 2025, the S7-300 is in the extended product support phase; Siemens still ships corrections to known security issues.

12. Quick-Start Cheat Sheet

• Legacy plant, no LAN: TS Adapter II + TeleService over PSTN.
• Plant has Ethernet but no DMZ host: TS Adapter IE behind the existing firewall with IPsec back to your office.
• New build or major upgrade: SINEMA RC server on a hardened host, engineer connects via the SINEMA RC client over the Internet.
• One-off emergency and no time to deploy: install STEP 7 on any PC at the plant, then use AnyDesk/TeamViewer + VPN to drive it remotely. The CPU sees a local engineer; the network sees a remote desktop.

13. Field-Proven Caveats

• The CP343-1 Lean is half-duplex on its external port; full-duplex negotiation must be forced off on the connected switch or you will see late collisions and dropped S7 connections.
• S7-300 firmware older than V2.0 does not support S7 routing across the CP343-1. Upgrade the CPU firmware to V2.0 or higher before relying on routed downloads.
• SINEMA RC versions prior to V2.0 do not support ISO-on-TCP through a NAT. If you are behind a carrier-grade NAT, upgrade the server.
• STEP 7 V5.6 does not recognize the TIA Portal S7-300 project format. If the customer's project was migrated to TIA, you need TIA Portal V18 or V19 to download back, even if the controller is a legacy S7-300.
• A 2 MB STEP 7 program typically contains 1.5-2.0 MB of blocks; the rest is documentation/HMI. Over a 10 Mbps SINEMA RC tunnel, a full download takes 6-10 minutes. Over a 3G cellular uplink with 1 Mbps effective throughput, budget 25-40 minutes.

14. Related Siemens Documentation

• Download to CPU (S7-300, S7-400) - STEP 7 / TIA Portal V20
• SIMATIC S7-300 CPU 315-2 DP Manual
• SINEMA RC Server Operating Instructions

FAQ