Sending SMS from WinCC Alarms: GSM, OPC, and SMTP Methods

Overview

WinCC does not include a native SMS dispatcher. Alarm events generated by Alarm Logging can still be delivered to mobile phones, pagers, and voice subscribers through one of seven field-proven integration paths, each with its own trade-offs in cost, latency, reliability, and engineering effort:

1. SIMATIC S7-1200 + CP 1242-7 GPRS/GSM module triggered by a WinCC tag.
2. CDO/SMTP e-mail sent from a WinCC Global Script, then forwarded through a mobile carrier's e-mail-to-SMS gateway.
3. External GSM modem connected to the WinCC station's serial (RS-232/USB) port, controlled with Hayes AT commands from VBScript.
4. Custom Windows executable spawned by the GMsgFunction() alarm hook that writes parameters to disk and shells out to a modem utility.
5. OPC-DA client such as GSM-Control V4.44, subscribed to binary WinCC tags whose edges correspond to alarm events.
6. Siemens Alarm Control Center (ACC) addon integrated into WinCC.
7. Hybrid e-mail-to-SMS gateway (e.g., commercial SMS providers) where WinCC simply sends SMTP mail and the provider delivers it as SMS.

This reference consolidates configuration, VBScript, alarm-hook, and hardware notes for each method. Select the path that matches the existing PLC, network, and licensing footprint; most sites land on (1) or (7) for new deployments, and (3)–(5) for retrofit work.

Prerequisites

• WinCC V7.x or WinCC Professional (TIA Portal) runtime license with Alarm Logging Runtime active on the operator station.
• Configured alarm classes and messages in Alarm Logging Editor with the Trigger Action checkbox enabled for any message that should generate an SMS.
• Global Script Runtime running on the WinCC server (default on WinCC V7, verify under Computer > Properties > Startup).
• For method 1: S7-1200 CPU with firmware V4.x or later, CP 1242-7 V2 (6GK7242-7KX30-0XE0) or CP 1242-7 GPRS V1 (6GK7242-7KX31-0XE0), valid SIM card, and antenna (6NH9860-1AA00).
• For method 3/4: Industrial GSM/GPRS modem supporting PDU mode SMS, RS-232 or USB interface (e.g., Siemens TC65, Teltonika COM/G10, Sierra Wireless Fastrack). Verify COM port availability on the WinCC node and that no other process opens the same port.
• For SMTP variants: outbound TCP/465 (SMTPS) or TCP/587 (STARTTLS) access from the WinCC station, plus either an internal relay or a third-party provider (Gmail, Outlook, SendGrid, SMS-Gateway services).
• For OPC-DA: OPC entry in WinCC (Computer Properties > OPC) enabled and the third-party OPC client installed on a node that can reach the WinCC server over DCOM.
• Administrator rights on the WinCC station to register COM components (CDOSYS, MSADO) and to allow outbound firewall rules.

Architecture Comparison

Method 1 — S7-1200 + CP 1242-7 GSM/GPRS Module

The CP 1242-7 sends SMS messages directly from the PLC using the TC_CON / TC_SEND library blocks. WinCC sets a trigger tag, the S7-1200 detects the rising edge, and the CP transmits the SMS via the GSM network. This approach isolates the SMS path from the WinCC node: the SCADA station can reboot or lose its e-mail connection without affecting alarm delivery.

Hardware Wiring

• Insert the SIM into the CP 1242-7 (gold contacts down, beveled corner aligned). Disable the SIM PIN if the CP firmware does not support SINEC PIN caching; otherwise store it in the CP configuration.
• Mount the antenna (6NH9860-1AA00) on a grounded metal surface at least 30 cm from the CP to avoid RF detuning.
• Connect the CP to the S7-1200 via the supplied ribbon to the left side of the CPU (CM/CF slot) — not via PROFIBUS.
• Apply 24 V DC to terminals L+/M on the CP.

TIA Portal Configuration

1. In the device view, drag the CP 1242-7 into the project and assign it the same PROFINET subnet as the CPU.
2. Open Properties > Mobile wireless communications > SMS, enable the SMS service, and enter the SMSC (Short Message Service Center) number from your carrier (e.g., +491710760000 for T-Mobile DE, leave blank for auto-retrieve).
3. Under Security, set the PIN code or clear the PIN requirement with a SIM tool.
4. Compile and download to the CPU.

Program Logic

Use the LBC_SMS blocks supplied with the CP library, or call the standard TC_SEND directly. A minimal trigger follows:

// Send SMS on rising edge of "AlarmTrigger" from WinCC
IF "AlarmTrigger" AND NOT "AlarmTriggerOld" THEN
    "smsDB".PHONE  := '+4915112345678';
    "smsDB".MSG    := WLC#'Alarm at ' + DT_TO_STRING(CLK) + ' ' + 'Tag=' + 'PumpTemp';
    TC_SEND_REQ(
        REQ    := TRUE,
        ID     := 1,
        DB     := "smsDB",
        DONE   => "smsDone",
        ERROR  => "smsErr",
        STATUS => "smsStatus");
END_IF;
"AlarmTriggerOld" := "AlarmTrigger";

WinCC triggers the bit by writing a WinCC tag (e.g., AlarmTrigger) from an alarm action. The CP accepts up to 10 recipients per call when the PHONE field is repeated in the UDT.

Verification

• Online → CP → Diagnostics → Mobile wireless status must show Logged in and a registered signal level.
• Force AlarmTrigger TRUE in the watch table; expect a STATUS of W#16#0001 (SMS sent) on TC_SEND and an SMS on the target handset within 5 s.
• Check the CP buffer (Diagnostics → Buffer) for SMS_RECEIVED confirmations.

Method 2 — CDO/SMTP E-mail from WinCC Global Script

WinCC Global Scripts execute VBScript against internal runtime objects. The CDOSYS component built into Windows exposes SMTP over SSL/TLS without extra libraries. The script below sends a mail with an Excel attachment, but it also forms the basis for an e-mail-to-SMS gateway (Method 3).

Function SendReportViaSMTP()
    Dim iMsg, iConf, Flds, schema
    Set iMsg   = CreateObject("CDO.Message")
    Set iConf  = CreateObject("CDO.Configuration")
    Set Flds   = iConf.Fields
    schema = "http://schemas.microsoft.com/cdo/configuration/"
    Flds.Item(schema & "sendusing")        = 2   ' cdoSendUsingPort
    Flds.Item(schema & "smtpserver")       = "smtp.gmail.com"
    Flds.Item(schema & "smtpserverport")   = 465
    Flds.Item(schema & "smtpauthenticate")  = 1   ' cdoBasic
    Flds.Item(schema & "sendusername")     = "[email protected]"
    Flds.Item(schema & "sendpassword")     = "AppPwd-NotPersonalPwd"
    Flds.Item(schema & "smtpusessl")       = 1
    Flds.Update
    With iMsg
        .To       = SmartTags("EMAIL_IDS")
        .From     = "[email protected]"
        .Subject  = Now & " Report from SCADA"
        .HTMLBody = "<h3>Autogenerated 12 h Report</h3>"
        .AddAttachment "C:\Logs\Parameters Report.xls"
        Set .Configuration = iConf
        .Send
    End With
    Set iMsg = Nothing : Set iConf = Nothing : Set Flds = Nothing
End Function

Call this routine from a cyclic Global Action (e.g., every 60 s) that reads pending alarms from the WinCC Alarm Logging COM interface, or from a per-alarm GMsgFunction() hook (covered in Method 5).

Alarm Trigger Pattern

To fire only on new alarms, latch a "previously sent" hash:

Function OnAlarm(msgID, msgText, msgDT, msgState)
    Dim key, fso
    key = msgID & "|" & msgState
    If HMGet(key) Then Exit Function           ' already sent
    HMSend "[email protected]", _
           msgDT & " " & msgText, _
           "+4915112345678"
    HMSet key, Now
End Function

Persist HMSet/HMGet via an INI or SQLite file so reboots do not re-send historical alarms.

Common CDO Error Codes

Method 3 — E-mail-to-SMS Gateway

Most mobile carriers expose a domain that converts any e-mail to [email protected] into an SMS terminated on that handset. Examples:

• T-Mobile (US): [email protected]
• Vodafone (DE): [email protected] (legacy, varies by region)
• Swisscom: [email protected]

Build the recipient list inside the CDO call by concatenating SmartTags("RECIPIENT_LIST") as a semicolon-delimited string. The body becomes the SMS text. Important: carriers truncate at 160 chars (GSM-7) or 70 chars (UCS-2). Strip or summarize alarm text accordingly.

.To       = "[email protected]"
.Subject  = "ALARM"
.TextBody = Left(msgDT,10) & " " & Left(msgText,140)

For non-carrier-grade reliability, use an HTTP/SMS provider (Twilio, MessageBird, Sinch, AWS SNS) where WinCC submits via HTTP instead of SMTP. A VBScript HTTP call is feasible using MSXML2.ServerXMLHTTP but introduces JSON parsing that requires a JSON library or a custom COM wrapper.

Method 4 — GSM Modem with AT Commands

A serial GSM modem connected to the WinCC station accepts SMS in two encodings: text mode and PDU mode. Text mode is easier; PDU mode is required for non-ASCII content or flash SMS. The modem is opened via MSComm (WinCC does not ship this; install an OCX) or via the System.IO.Ports.SerialPort accessed from PowerShell. The most robust WinCC-native approach shells out to a tiny helper executable (Method 5).

AT Command Sequence (Text Mode)

AT+CMGF=1            ' text mode
AT+CSCA="+491710760000"  ' service center
AT+CMGS="+4915112345678" '> (prompt)
Alarm 2025-01-15 12:34 PumpTemp high 92.4 C<CTRL-Z>
+CMGS: 1
OK

PDU Mode Skeleton

AT+CMGF=0
AT+CMGS=165           ' length of PDU in octets
> 0791...            ' SMS-SUBMIT PDU, SCA + DA + PID + DCS + VP + UDL + UD

Field engineers should pre-build the PDU string in VBScript and convert it to a byte stream, since most modems reject ASCII text once CMGF=0 is set. Validate each PDU with the GSM 03.40 calculator before sending.

Serial Port Setup

Verification

1. Open a terminal (Tera Term, PuTTY) at 9600 8N1 and run AT — expect OK.
2. Check signal: AT+CSQ — first value 0–31; below 10 is unreliable.
3. Send a manual SMS via AT+CMGS and confirm receipt on the handset.
4. Close the terminal, then run the VBScript path.

Method 5 — Custom Executable Driven by GMsgFunction()

The WinCC Alarm Logging runtime calls GMsgFunction() on every alarm state change (come, go, acknowledge). Parameters passed include MsgNumber, MsgText, MsgState, Time, Date, and Tagname. Engineers embed a call to a local executable that writes the message to a file, database, or directly to the COM port.

Minimal GMsgFunction()

Function GMsgFunction(ByVal MsgID As Long, _
                         ByVal MsgState As Long, _
                         ByVal MsgText As String, _
                         ByVal AckTag As String)
    Dim f, line
    line = Format(Now,"yyyy-mm-dd hh:nn:ss") & "|" _
         & MsgID & "|" _
         & MsgState & "|" _
         & Replace(MsgText,Chr(10)," ") & "|" _
         & AckTag
    Set f = CreateObject("Scripting.FileSystemObject")
    Dim ts : Set ts = f.OpenTextFile("C:\Logs\alarms.log", 8, True)
    ts.WriteLine line : ts.Close
    ' Trigger external helper
    CreateObject("WScript.Shell").Run _
        """C:\Tools\SendSMS.exe"" " & Chr(34) & MsgText & Chr(34), 0, False
End Function

The companion SendSMS.exe opens the COM port, writes the AT commands, and exits. Writing the full alarm description (rather than just the message number) into the helper requires passing every desired field through GMsgFunction() via the message's User text blocks or via the Alarm Logging ProcessControlled tag references.

Send_SMS Helper Skeleton (C# .NET 4.8)

static int Main(string[] args)
{
    using (var sp = new SerialPort("COM3", 9600, Parity.None, 8, StopBits.One))
    {
        sp.Handshake = Handshake.RequestToSend;
        sp.Open();
        sp.WriteLine("AT+CMGF=1");
        WaitForOK(sp, 2000);
        sp.Write("AT+CMGS=\"+4915112345678\"\r");
        sp.Write(args[0].Substring(0, Math.Min(150, args[0].Length)));
        sp.Write(new byte[]{0x1A}, 0, 1);          // CTRL+Z
        return WaitForOK(sp, 5000) ? 0 : 1;
    }
}

The helper isolates the WinCC Global Script from low-level serial issues, surviving temporary COM port errors with a retry loop.

Method 6 — OPC-DA Third-Party SMS Clients

OPC-DA clients such as GSM-Control V4.44 (Klinkmann catalog item PR000673/PR00067 family) connect to WinCC as an OPC client (WinCC exposes its tags via the OPC-DA server). The third-party tool subscribes to one or more binary tags whose rising edges correspond to "new alarm." Each tag can carry a recipient list, message template, and optional acknowledgment behavior.

Setup

1. Enable WinCC OPC under Computer Properties > OPC and start the OPC DA Server Windows service.
2. On the WinCC server, open dcomcnfg and grant the OPC client's service account DCOM launch & activation rights on Siemens OPC DAAutomation Server and OPCServer.WinCC.
3. Configure the firewall to allow TCP/135 plus the dynamic RPC range (or restrict to a fixed port via OPCEnum settings).
4. In GSM-Control, add the WinCC OPC server, browse to the alarm tags, and bind each tag's edge to an SMS template such as %TAGNAME%: %VALUE% at %TIME%.
5. Insert a SIM into the GSM-Control host's modem or attach a virtual SIP/VoIP GSM gateway.

Method 7 — Siemens Alarm Control Center (ACC)

The Alarm Control Center is a licensed WinCC addon distributed through Siemens IT4Industry. It hooks directly into the WinCC alarm pipeline and supports:

• SMS to smartphone or GSM cell phone (via internal GSM modem or service-provider integration).
• Pager messages (alphanumeric TAP, ESPA-X).
• Voice output over PSTN or SIP.
• E-mail with attachments and HTML bodies.
• HiPath/Hicom enterprise telephone integration.
• On-call scheduling, escalation, and shift handover.

Engineering is performed inside the WinCC Explorer under Alarm Control Center: define recipients, schedules, and message templates. ACC monitors the WinCC alarm database and dispatches via its own internal gateway, so it does not depend on OPC, CDO, or external helpers. Licensing is per server; verify the project setup with the Siemens Industry Online Support entry for ACC before quoting.

Alarm Logging Configuration for Trigger Actions

Regardless of dispatch method, configure Alarm Logging so the chosen trigger fires reliably:

1. Open Alarm Logging Editor, select the message (e.g., "PumpTemp_High"), and open Properties.
2. Set the Trigger Action checkbox to Yes; this enables GMsgFunction() for that specific message number.
3. Define any Process-controlled tags that should be embedded into the message body. Reference them as @TagName% placeholders inside User text.
4. For methods that key off a binary tag, create a derived tag (e.g., AlarmTrigger_OT) whose PLC address flips on each new alarm via an edge detector in the CPU.
5. For cyclic SMTP dispatch, create a WinCC user archive or use the Alarm Logging COM API (HMIGO.dll) to enumerate pending unacknowledged alarms from a Global Action running every 30–60 s.

Example: Building a Single SMS Line per Alarm Cycle

' Cyclic action @ every 30 s
Dim alm, list
Set alm = CreateObject("WinCC-AlarmLogging.0")
list = ""
Do While alm.MoveNext() = True
    list = list & alm.GetField("Time", i) & " " _
                & alm.GetField("Text", i) & vbCrLf
Loop
If Len(list) > 0 Then SendSMS list, SmartTags("RECIPIENT_LIST")

Use the Alarm Logging runtime API documented in the WinCC V7 Information System under Working with WinCC > ANSI-C / VBScript > Alarm Logging Functions.

Verification & Commissioning Checklist

Troubleshooting Matrix

Field-Proven Caveats

• Use a dedicated SIM card or carrier SMS bundle; some carriers throttle or block A2P (application-to-person) traffic on consumer SIMs.
• Set AT+CNMI=2,1,0,0,0 on the modem so the helper can detect inbound delivery reports (DSR).
• For multi-recipient dispatching, prefer carrier gateway e-mail over multiple modems — modems serialize sends and a single offline recipient stalls the queue.
• Encrypt credentials with DPAPI (Windows Data Protection API) before storing them in scripts. VBScript can call DPAPI through CryptProtectData via a small wrapper.
• For 24/7 plants, add a watchdog tag that toggles every minute; if the WinCC station fails to update, the SMS path escalates to a backup PLC channel.
• Time zones: log SMS dispatch in local time AND UTC; mobile carriers deliver in their own zone which can confuse operators reviewing the log against the alarm history.

Choosing the Right Method for Your Plant