Sending SMS from Siemens SIMATIC PLCs via GSM Modems

Overview

Industrial alarm notification and remote telemetry over cellular networks remains one of the most resilient communications channels for SCADA applications. When IP networks are unavailable, unreliable, or cost-prohibitive, GSM Short Message Service (SMS) provides a low-bandwidth, store-and-forward channel that operates independently of customer LAN infrastructure. This reference covers the integration of Siemens SIMATIC S7-1200 and S7-1500 controllers with industrial GSM/GPRS modems for bidirectional SMS exchange, using AT commands issued over the CPU's serial interface or a CM (Communication Module).

Three reference architectures are documented:

1. Direct PLC-to-modem control via TIA Portal function blocks writing AT commands through the onboard RS-232/RS-485 interface (e.g., on S7-1200 CB 1241, CM 1241, or S7-1500 CM PtP RS-232/422/485 modules).
2. HMI-mediated SMS dispatch from a SIMATIC HMI (Comfort Panel, Unified Panel) using the WinCC flexible / TIA Portal script interface, as documented in Siemens Support Entry 21184132.
3. Cloud SMS gateway (Azure Communication Services, Twilio, Sinch), where the PLC publishes the alarm to an MQTT broker or HTTP endpoint, and the cloud operator delivers the SMS. Microsoft's Azure Communication Services SMS quickstart documents the REST contract for the cloud path.

This reference focuses on the on-premises direct-modem path, which remains the dominant industrial practice for retrofit sites where local-area IP is not available or unreliable.

Prerequisites

Hardware Selection

The TC35i remains the most documented modem for Siemens SMS integration; replacement parts in 2024-2026 should specify TC65, Quectel M66, or BG96 for LTE sites. For a fully integrated solution with no separate PLC, the ELSist NETMOS series bundles a small PLC core with an integrated GSM radio and is widely used in Italian industrial plants.

AT Command Reference for SMS

Modems accept Hayes AT commands. Only the commands relevant to SMS exchange are listed below. Each command terminates with <CR><LF>. The PLC must parse the echo and the result code to verify success.

Error responses must be parsed:

• +CMS ERROR: <err> — SMS-specific error; see 3GPP TS 27.005.
• +CME ERROR: <err> — Modem equipment error; see 3GPP TS 27.007.

SMS PDU vs Text Mode

Text mode (AT+CMGF=1) is the simplest: the body is a literal ASCII or GSM 7-bit string. It supports the GSM 7-bit default alphabet (160 characters) and UCS-2 (70 characters). The GSM 7-bit default character set misses several Latin-1 accented characters (e.g., è, à are in the extended table, but € and many others are not). For Italian or German plant text, prefer extended 7-bit (160 chars with escape-prefixed characters) or fall back to UCS-2 (70 chars).

PDU mode (AT+CMGF=0) submits the message as a hexadecimal string (e.g., 079193...). It is mandatory for:

• Unicode messages
• Concatenated SMS longer than 160 characters
• Flash SMS (class 0)
• Delivery reports

Most industrial SMS dispatch can stay in text mode for short 7-bit messages.

Step-by-Step: Sending SMS from TIA Portal

1. Configure the Serial Module

In the device configuration of the S7-1200 or S7-1500:

• Select the CM 1241 (RS-232) or CM PtP module.
• Set the port to Freeport (ASCII) mode.
• Set baud rate to 9600 8N1 (default for TC35i, MC35i, Wavecom).
• Enable "Send/receive break" and "Suppress additional CR/LF" as required by your modem firmware.

2. Build the Send Function Block

The following SCL code implements a state machine that:

1. Waits for bTrigger.
2. Issues AT+CMGF=1\r.
3. Issues AT+CMGS="+39xxxxxxxxx"\r.
4. Sends the message body terminated with <CTRL-Z> (0x1A).
5. Waits for +CMGS: and OK.

FUNCTION_BLOCK "FB_SendSMS_AT"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 1.0

VAR_INPUT
  bTrigger        : BOOL;              // Rising edge starts a send
  sPhone          : STRING[20];        // E.164 format, e.g. +393331234567
  sBody           : STRING[160];        // GSM 7-bit text
  iTimeoutMs      : INT := 5000;       // Per-state wait limit
END_VAR

VAR_OUTPUT
  bBusy           : BOOL;
  bDone           : BOOL;
  bError          : BOOL;
  wErrCode        : WORD;              // 0 = OK, else timeout/parser code
END_VAR

VAR
  iState          : INT := 0;
  tonWait         : TON;
  sRxBuf          : STRING[256];
END_VAR

BEGIN
  CASE iState OF
    0: // Idle - wait for trigger
      bBusy := FALSE;
      bDone := FALSE;
      bError := FALSE;
      wErrCode := 0;
      IF bTrigger THEN
        bBusy := TRUE;
        iState := 10;
      END_IF;

    10: // AT+CMGF=1
      "SND_SEND"(sCmd := CONCAT('AT+CMGF=1', '$R$L'));
      iState := 20;

    20: // Wait for OK
      "RCV_RECV"(sRxBuf := sRxBuf);
      IF FIND(sRxBuf, 'OK') > 0 THEN
        iState := 30;
      ELSIF FIND(sRxBuf, 'ERROR') > 0 THEN
        bError := TRUE; wErrCode := 16#9001; iState := 99;
      END_IF;

    30: // AT+CMGS="<number>"
      sRxBuf := '';
      "SND_SEND"(sCmd := CONCAT(CONCAT('AT+CMGS="', sPhone), '"$R$L'));
      iState := 40;

    40: // Wait for '>' prompt
      IF FIND("RCV_RECV_BUF"(), '>') > 0 THEN
        iState := 50;
      END_IF;

    50: // Send body + CTRL-Z
      "SND_SEND"(sCmd := CONCAT(sBody, '$1A'));  // 0x1A = SUB = CTRL-Z
      iState := 60;

    60: // Wait for +CMGS confirmation
      IF FIND("RCV_RECV_BUF"(), '+CMGS:') > 0 AND FIND("RCV_RECV_BUF"(), 'OK') > 0 THEN
        iState := 80;
      ELSIF FIND("RCV_RECV_BUF"(), '+CMS ERROR') > 0 THEN
        bError := TRUE; wErrCode := 16#9003; iState := 99;
      END_IF;

    80: // Done
      bDone := TRUE;
      bBusy := FALSE;
      iState := 0;

    99: // Fault
      bBusy := FALSE;
      iState := 0;
  END_CASE;
END_FUNCTION_BLOCK

The integrator must implement SND_SEND, RCV_RECV, RCV_RECV_BUF, RCV_BUF_CLEAR as wrappers around the Siemens Send_P2P / Receive_P2P library blocks from the "SIMATIC S7-1200 / S7-1500 Point-to-Point Communication" package.

3. Map to Ladder for Diagnostics

For field commissioning, expose iState, wErrCode, sRxBuf to a watch table and an HMI tag set. Plant electricians often find it easier to troubleshoot a 0-99 integer state than a nested SCL block; expose the current state on the HMI status line.

4. HMI-Triggered Send

In TIA Portal, create a button on a Comfort Panel screen. On MouseDown, set a tag that triggers bTrigger on the FB. The HMI tag does not need to be on the same CPU; on a Unified Panel you can use the "Send E-mail / SMS" runtime API directly:

Per the Siemens Support Entry 21184132, the HMI can be configured with a dial-up connection (modem or GSM) using RAS, and SMS dispatch is handled via the WinCC flexible / TIA Portal alarm logging SMTP/SMS gateway. This is convenient when the PLC is headless but requires a SIM-equipped Comfort Panel.

Step-by-Step: Receiving SMS

Receiving requires unsolicited modem notification. Without it, the PLC must poll AT+CMGL="ALL", which is inefficient and adds radio load.

1. Enable Unsolicited Notifications

Send once at startup:

AT+CNMI=2,1,0,0,0

This causes the modem to issue +CMTI: "SM",<index> whenever a new SMS arrives in the SIM storage.

2. Receive State Machine

FUNCTION_BLOCK "FB_RecvSMS_AT"
VAR_INPUT
  iTimeoutIdle : INT := 60000;   // poll fallback
END_VAR
VAR_OUTPUT
  sLastSender   : STRING[20];
  sLastBody     : STRING[160];
  bNewMessage   : BOOL;
END_VAR
VAR
  sRx           : STRING[256];
  iIdx          : INT;
END_VAR

BEGIN
  // Called every PLC cycle - filter URC tokens from the incoming buffer
  "RCV_RECV"(sRx := sRx);

  IF FIND(sRx, '+CMTI:') > 0 THEN
    // Extract index between commas
    iIdx := STRING_TO_INT(MID(sRx, FIND(sRx, ',') + 1, 3));
    // Issue AT+CMGR=<iIdx> then delete
    "SND_SEND"(sCmd := CONCAT(CONCAT('AT+CMGR=', INT_TO_STRING(iIdx)), '$R$L'));
    bNewMessage := TRUE;
  END_IF;
END_FUNCTION_BLOCK

For typical industrial deployments the body contains short commands such as ON1, OFF, RESET, or RST. Parsing logic compares the body to a fixed list of accepted commands and rejects anything else to avoid spoofed control.

3. Command Parsing

Reply with the same FB_SendSMS block. Always whitelist source numbers (compare sLastSender to a tag list of allowed E.164 numbers) to prevent unauthorized control.

Verification

After commissioning, run the following sequence:

1. Cold-start test: power down the panel and modem; power up; confirm AT returns OK within 10 s.
2. Signal check: AT+CSQ should return rssi ≥ 10 (≥ -85 dBm); below 5 the link is unreliable.
3. SIM check: AT+CPIN? returns +CPIN: READY; if +CPIN: SIM PIN, the SIM still has PIN protection enabled — remove via a phone or use AT+CPIN="1234" with the PIN.
4. Network check: AT+CREG? returns +CREG: 0,1 or +CREG: 0,5.
5. Outbound: trigger an alarm and verify delivery to a mobile phone.
6. Inbound: from a phone, send STAT to the SIM and verify the PLC replies within 30 s.
7. Power-fail: cut modem power for 5 s; on restore, verify the PLC re-initializes the modem (re-issues ATE0, AT+CMGF=1, AT+CNMI=2,1,0,0,0).
8. Watchdog: implement a cyclic heartbeat (PLC writes AT every 60 s); if no OK for 5 cycles, raise an HMI alarm and cycle modem power via a relay.

Troubleshooting Matrix

Security and Operational Notes

Cloud Alternative: Azure Communication Services SMS

For greenfield sites without legacy 2G modems, the PLC can call a cloud SMS gateway over MQTT or HTTPS. The PLC's data block contains the recipient list and message body; an HMI script or a Python runtime on the SIMATIC IOT2050 publishes to an MQTT topic; a Lambda or Azure Function consumes the topic and calls Azure Communication Services SMS send:

POST https://<resource>.communication.azure.com/sms/send?api-version=2021-03-07
Content-Type: application/json
Authorization: Bearer <token>

{
  "from": "+393331234567",
  "smsRecipients": [ { "to": "+393337654321" } ],
  "message": "Alarm: Tank 3 high level",
  "smsSendOptions": { "enableDeliveryReport": true }
}

This trades a hardware modem for an Internet dependency — acceptable for sites with reliable IP, inappropriate for remote sites with no LAN. Latency is typically 1-5 s end-to-end, comparable to direct-modem SMS dispatch (1-3 s).

FAQ