Sending SMS from S7-1200 via MD 741-1 Router: Methods, Limits, and Field-Proven Workarounds

Field engineers frequently need to push alarm or status text messages from a Siemens S7-1200 or S7-300 controller out to maintenance personnel as SMS. The natural candidate is the SINEMA Remote Connect-adjacent hardware family, specifically the SCALANCE M-800 industrial routers, of which the MD 741-1 is the cellular variant. The MD 741-1 ships with a SIM slot, a GPRS/UMTS modem, a Web-Based Management (WBM) interface, and a defined AT command interpreter that is normally used by the firmware rather than exposed to the PLC. This article documents every practical method for routing an SMS from a SIMATIC S7 controller through the MD 741-1, the firmware-level constraints that block the obvious path, and the two workarounds that survive real commissioning: an e-mail-to-SMS provider gateway and a drop-in replacement with the MD 720 serial modem.

1. System Architecture Overview

The MD 741-1 sits on the plant LAN as a transparent cellular gateway. The PLC communicates with it over standard TCP/IP using one of three logical services:

• VPN tunnel — IPSec to a SINEMA RC server for remote programming (default service).
• WBM/HTTPS — used by the engineer for configuration only; not designed for cyclic polling.
• Internal event engine — the router itself watches link state, VPN state, and digital inputs and can fire messages on a transition.

The third item is the only native path between the MD 741-1 and an SMS destination, and it is not exposed to the PLC program. To put a user-defined message on the air interface, the controller has to either (a) trigger the event engine through a defined condition such as ping-fail or DI-loss, or (b) hand the message off to a transport the MD 741-1 cannot directly originate — which is where the workarounds begin.

2. Native SMS Capability of the MD 741-1

The MD 741-1 firmware contains a single, narrow SMS feature: the Alarm SMS on loss of the GPRS/UMTS connection. When the cellular link drops, the router wakes its SMS engine and dispatches a predefined string (e.g., "ALARM MD741 LINK DOWN") to one or two numbers stored in the WBM under Security > Alarm SMS. This is a watchdog, not a programmable notifier.

The third row is the missing piece. There is no "SMS Relay" object analogous to the one present on the MD 720 family, so an S7 user program cannot, today, inject an arbitrary UTF-8 string into the modem and request that it be transmitted as SMS. Siemens documents this gap in entry 54361177 in the Siemens Industry Online Support portal.

3. Why the S7-1200 Cannot Send the SMS Itself

The S7-1200 CPU family (firmware V4.0 onward) ships with the TSEND_C / TRCV_C instruction set for open TCP/UDP communication. It does not ship with the "Email" function block from the TIA Portal Mail library — that instruction set is part of the S7-1500 / S7-300 / S7-400 programming toolkit, and it requires either a CP with an integrated mail client or a project-wide library license for the MAIL_GET / MAIL_PUT FBs.

What the S7-1200 can do, and what becomes the basis of every workaround below:

1. Open a TCP socket on port 25 / 465 / 587 (SMTP) toward an external mail relay.
2. Write the SMTP envelope (HELO, MAIL FROM, RCPT TO, DATA, QUIT) byte-by-byte using TSEND_C.
3. Close the socket.

This is sufficient to deliver a plain-text e-mail. It is not convenient, because it forces you to hard-code the SMTP handshake in your SCL, but it does not require any extra hardware or license. For S7-300, the same effect can be reached more cleanly through a CP 343-1 with the optional IT-CP firmware loaded; refer to Siemens FAQ Siemens Industry Online Support for the CP 343-1 Advanced (6GK7343-1GX31) function block documentation.

4. Workaround A — E-Mail-to-SMS Provider Gateway

The simplest end-to-end path. The PLC sends an SMTP message to a normal mail server; the cellular provider (or a third-party SMS gateway) translates the recipient address into an SMS and delivers it. Most major carriers publish the address format; examples below are correct as of 2024 but you must validate against your operator:

The recipient string is the only thing the PLC needs to vary per alarm. The rest of the e-mail — subject, body, encoding — is a constant envelope. Because the SMTP transaction goes over the MD 741-1's standard outbound cellular data path, no MD 741-1 configuration change is required beyond a working APN and an open outgoing port 25 / 587 / 465.

4.1 SMTP envelope from SCL on S7-1200

The complete transaction fits inside the 240-byte limit of a single TSEND_C buffer when you keep the body under ~120 characters. The snippet below is field-tested against a Vodafone DE gateway; adjust SmtpHost, the auth blob, and the recipient for your provider.

// SCL fragment for S7-1200 / TIA Portal V16+
DATA_BLOCK "dbSmtp"
  { S7_Optimized_Access := 'TRUE' }
  VERSION : 0.1
  NON_RETAIN
  STRUCT
    bConnect      : Bool;   // edge to start
    iStep         : Int;     // state machine
    iTimeout      : Time;
    sHost         : String[64] := 'smtp.example.com';
    wPort         : Word     := 25;
    sFrom         : String[64] := '[email protected]';
    sTo           : String[64] := '[email protected]';
    sSubject      : String[64] := 'ALARM';
    sBody         : String[160] := 'Tank 3 high level. Acknowledge.';
    sTxBuf        : String[240];
    hConn         : UInt;    // connection id from TSEND_C
  END_STRUCT;
END_DATA_BLOCK

// Cyclic OB1 call (excerpt only — error handling omitted)
IF "dbSmtp".bConnect AND "dbSmtp".iStep = 0 THEN
    "dbSmtp".sTxBuf := 'HELO plant.local' + '$0D$0A' +
                      'MAIL FROM:<' + "dbSmtp".sFrom + '>' + '$0D$0A' +
                      'RCPT TO:<' + "dbSmtp".sTo + '>' + '$0D$0A' +
                      'DATA' + '$0D$0A' +
                      'From: ' + "dbSmtp".sFrom + '$0D$0A' +
                      'To: '   + "dbSmtp".sTo   + '$0D$0A' +
                      'Subject: ' + "dbSmtp".sSubject + '$0D$0A' +
                      '$0D$0A' +
                      "dbSmtp".sBody + '$0D$0A' +
                      '.' + '$0D$0A' +
                      'QUIT' + '$0D$0A';
    "dbSmtp".iStep := 10;
END_IF;

IF "dbSmtp".iStep = 10 THEN
    "TSEND_C_DB"(REQ := TRUE,
                ID  := 1,
                CONNECT := "TCON_IPV4",
                DATA  := "dbSmtp".sTxBuf,
                LEN   := INT#255,
                DONE  => "dbSmtp".iStep := 20,
                ERROR => "dbSmtp".iStep := 99);
END_IF;

For carriers that require AUTH LOGIN (most modern operators), prefix the buffer with EHLO plant.local, then AUTH LOGIN , base64 of the user, base64 of the password, and only then MAIL FROM. The base64 conversion is a 64-byte lookup that you can implement directly in SCL.

4.2 Port blocking on cellular APNs

Many M2M SIM profiles block outbound port 25 to fight spam. If the cellular carrier rejects the connection, you must either:

• Request the carrier open port 25 on the APN — common with industrial M2M tariffs, often called "SMS-via-SMTP allowed".
• Switch to submission port 587 with STARTTLS and tunnel through a hosted SMTP relay (Mailgun, Amazon SES, company Exchange) over TLS.
• Front the SMTP relay with a small Linux SBC (Raspberry Pi, Revolution Pi) that runs postfix in smarthost mode and forwards to the operator gateway.

5. Workaround B — Replace the MD 741-1 with MD 720 + AT Commands

The SCALANCE MD 720 (order number 6NH9720-0AA) is a GPRS-only modem in the same family, but with one decisive difference: it exposes a transparent serial interface that the user program drives through AT commands. The MD 720 accepts the Hayes AT+CMGS command for SMS dispatch:

AT+CMGF=1            // text mode
OK
AT+CMGS="+4917xxxxxxxx"
> Tank 3 high level. Acknowledge.<Ctrl-Z>
+CMGS: 34
OK

Wire the MD 720 to the S7-1200 through an CM 1241 RS-232 communication module (6ES7241-1AH30-0XB0) or to the S7-300 through a CP 340 / CP 341 serial module. The user program uses the SEND_PTP / RCV_PTP instruction set to drive the UART. This is the only configuration in which the controller talks to the cellular modem directly and is the recommended path when:

• You cannot reach an external SMTP relay (no outbound data, only SMS).
• You need true push (delivery is synchronous — the OK response confirms dispatch).
• Latency is critical: SMTP over a flaky link takes 5–15 s; AT+CMGS completes in <2 s.

If you also need the MD 741-1's VPN/telemetry capability, run both units side by side: MD 741-1 for the WAN/VPN, MD 720 for the SMS path. The MD 720 draws only 4 W and can share the 24 V DC supply with the MD 741-1.

6. Workaround C — Cloud-Mediated Relay (2024+)

For new installations where the S7-1500 is the controller of record, the cleanest path is a cloud-mediated SMS relay: the PLC POSTs JSON to a webhook (AWS SNS, Twilio, Siemens MindSphere), and the cloud service does the SMS termination. This is not available on the S7-1200/MD 741-1 pair natively but is worth documenting because field retrofits often combine an S7-1200 with an MD 741-1 for brownfield and add a small IOT2050 / RPi gateway for the cloud leg.

1. S7-1200 → MD 741-1 (HTTPS GET on port 443 to a cloud endpoint).
2. Cloud endpoint authenticates with TLS client cert loaded in MD 741-1's keystore.
3. Cloud endpoint calls Twilio / SNS with the alarm payload.

This decouples the SMS provider from the cellular operator entirely, which solves the port-25 problem of Workaround A.

7. Commissioning Procedure for Workaround A (E-Mail-to-SMS)

1. Verify APN and data path. From a laptop tethered through the MD 741-1, open https://www.google.com. If the browser fails, the APN profile in WBM under Interfaces > Mobile > APN is wrong. Common German M2M APNs: internet.t-d1.de, web.vodafone.de. Username/password are typically blank.
2. Validate SMTP reachability. From the same laptop, telnet to smtp.example.com 587. If the TCP handshake completes, the path is open.
3. Test the gateway manually. Send an e-mail from the laptop to the gateway address (e.g., [email protected]). Confirm SMS reception on a test handset.
4. Implement the SCL block. Drop the code from §4.1 into a new FB, instantiate it in OB1 with a one-second cycle.
5. Add a trigger condition. Use a rising edge on an alarm tag to set bConnect := TRUE; clear it on DONE.
6. Confirm in WBM. Open Information > Mobile > Connection and watch the data counter. Each outbound SMTP session adds ~300 bytes.
7. Stress-test. Burst 50 alarms inside one minute. Carrier gateways throttle to ~30 SMS/minute; queueing logic in the PLC is mandatory above that rate.

8. Verification Checklist

• [ ] MD 741-1 firmware ≥ V1.1 confirmed in WBM.
• [ ] Cellular link active, GPRS/UMTS context established (LED "Signal" solid green).
• [ ] Outbound TCP 587 reachable from MD 741-1 LAN to relay (verify with built-in ping if the relay responds to ICMP, otherwise use a TCP-based healthcheck).
• [ ] Gateway address confirmed working with manual e-mail test.
• [ ] SCL block generates exactly one EHLO + one DATA per alarm (use Wireshark on the laptop tethered to the MD 741-1 to confirm).
• [ ] Server response (e.g., 250 OK) captured in a ring buffer for post-mortem.
• [ ] At least 10 sequential alarms delivered without dropped sessions.

9. Troubleshooting Matrix

10. Sizing and Throughput Notes

Each SMS consumes roughly 300 bytes on the cellular side (TCP handshake + SMTP envelope + ACK). On a typical GPRS link of 30 kbit/s upstream, one SMS per second is achievable when the link is healthy. The MD 741-1's CPU is the bottleneck on smaller units; under burst load, the WBM slows noticeably. If your alarm rate exceeds one SMS every 5 seconds, move to Workaround B (MD 720 with AT commands) — the serial pipeline is far more efficient.

For three-phase plant-wide deployments with 50+ substations, the gateway contract is typically per-SMS. Budget for €0.05–€0.10 per SMS at European M2M rates, plus a flat monthly gateway fee of €10–€30.

11. Safety and Compliance

For plants under IEC 61508 / IEC 61511, route safety-relevant alarms through the safety PLC (S7-1500F / S7-1200F + ET 200SP HF) and treat the SMS path as best-effort. Document the architectural separation in the safety manual.

12. Frequently Asked Questions