Siemens 7 km PLC Link Options: 4-20mA, SINAUT, Modem Solutions

Siemens 7 km PLC Link Over 0.8 mm Copper: 4-20 mA, SINAUT, Modem, and Cellular Architectures

This application note solves a recurring field problem: two Siemens automation sites are separated by 7 km of existing two-core 0.8 mm telephone-grade copper cable, and each site must exchange two 4-20 mA analog inputs and two 0/4-20 mA analog outputs at low bandwidth. The goal is to identify which of the realistic Siemens-supported link architectures (direct 4-20 mA loop, SINAUT dedicated-line modem, GSM/GPRS cellular, or single-mode fiber) is technically valid, dimension it with hard numbers, and define the I/O, surge-protection, and commissioning steps required to make it work in the field.

1. Problem Definition and Constraints

The original control requirement decomposes into the following engineering constraints, each of which constrains the link design:

Because the data rate is trivial but the distance and the medium are harsh, the design problem is dominated by electrical survivability (surges, ground rise), loop resistance (for the 4-20 mA option), and link availability (for the digital options). The bandwidth question is essentially free.

2. Direct 4-20 mA Loop Over 7 km: When It Fails and When It Might Work

The first reaction is always to send the 4-20 mA signal directly through the available copper. The arithmetic is unforgiving but the boundary conditions decide whether it is even possible.

2.1 Loop resistance of 0.8 mm copper at 7 km

For a 0.8 mm diameter copper conductor (A = π × 0.4² = 0.5027 mm²) with ρ = 1.724 × 10⁻⁸ Ω·m at 20 °C:

R_km = ρ / A × 10³ = 1.724 × 10⁻⁸ / 5.027 × 10⁻⁷ × 10³ ≈ 34.3 Ω/km

For 7 km one-way = 240 Ω, round-trip (transmit + return on the same pair) = 480 Ω. With temperature coefficient α = 0.00393 /°C referenced to 20 °C, the loop resistance climbs to 555 Ω at 60 °C (typical summer aerial cable temperature) and 606 Ω at 80 °C (a black-jacketed cable in direct sun).

2.2 Voltage drop at 20 mA

At full-scale 20 mA the loop drop is 9.6 V at 20 °C, 11.1 V at 60 °C, and 12.1 V at 80 °C. A 2-wire loop-powered transmitter (e.g. pressure transmitter in 4-20 mA) must generate the loop current and still leave enough headroom for the receiver burden (typically 5-7 V) and for its own compliance. The available budget is therefore:

V_headroom = V_supply − V_drop(cable) − V_{burden(receiver)} − V_{compliance(transmitter)}

With a 24 V supply, 20 °C cable, 7 V burden and 12 V compliance: 24 − 9.6 − 7 − 12 = −4.6 V. A 2-wire 4-20 mA sensor cannot work at 7 km on this cable at 24 V supply, even before considering HART. The same sensor at a 30 V loop supply gives 30 − 9.6 − 7 − 12 = +1.4 V, marginal. At 36 V it is +7.4 V, technically OK at 20 °C but eroded to +0.9 V at 60 °C. Long-term reliability is unacceptable.

2.3 The one scenario that does work

A 4-wire (actively sourced) sensor with separate power and a regulated current output, or a 4-wire valve positioner with a current input, can drive 20 mA through 480 Ω at 24 V because the transmitter's compliance is typically 15-24 V and the receiver's burden is decoupled from the supply. For 4-wire devices, direct analog over the 0.8 mm pair is feasible, but only with:

• Verified sensor and positioner datasheets showing < 9.6 V compliance at 20 mA.
• Supply at the receiving PLC end at 24 V minimum, ideally with a 30 V boost.
• No HART communication (HART requires ~1 V_pp across 250 Ω and is incompatible with 480 Ω of DC loop resistance plus the high cable capacitance at 7 km).
• Calibration trim to compensate for the absolute copper resistance tolerance (±5 % is typical for telecom-grade cable) and temperature derating.

3. Link Architecture Options Compared

Three realistic digital options exist for the 7 km, 0.8 mm copper environment. They are summarized in the matrix below; the recommended option depends on whether the existing cable is in good condition and whether a cellular signal is available at both sites.

4. Option A: SINAUT Over the Existing 0.8 mm Pair (Recommended for This Use Case)

SINAUT (Siemens Network Automation) is the Siemens telemetry stack that historically ran on S7-300 TIM 3V-IE and TIM 4R-IE modules over leased lines, analog telephone, ISDN, GSM, and Ethernet. On the current S7-1200 and S7-1500 generation, the same protocol is exposed by the CP 1243-1 (Ethernet/IPsec) and CP 1242-7 (GPRS) communications processors in combination with the TeleControl server / TIA Portal project, with SINAUT ST7 as the application-layer protocol.

For a 7 km dedicated line of 0.8 mm copper, the modern Siemens-supported path is:

1. One S7-1200 CPU 1214C (or 1215C) at each site, with the local SM 1231 AI and SM 1232 AO modules wired to the field devices.
2. One industrial FSK leased-line modem at each end (e.g. Westermo TD-32, Phoenix Contact PSI-MODEM, or a Siemens-recommended equivalent). The S7-1200 serial interface (RS-232 / RS-422) connects to the modem. The modem's line side connects to one 0.8 mm pair.
3. SINAUT ST7 frames the data; the modem translates them to a 300-1 200 bps FSK signal on the copper pair. With 50 nF/km × 7 km = 350 nF total, the achievable data rate is on the order of 1 200 bps with careful receiver equalization. This is more than enough for 8 analog values every 100-200 ms.
4. The second twisted pair of the 10 available is used as a hot-standby link, with the S7-1200 selecting the live path on loss-of-carrier.

For reference, the older TIM-based path is still maintained by Siemens for S7-300/400 fleets: the TIM 3V-IE (6NH7800-3BA00) or TIM 4R-IE (6NH7800-4BA00) module plugs into the S7-300 rack and provides dedicated-line, analog dial, ISDN, and Ethernet on a single device. Verify exact catalog numbers, firmware, and availability with the Siemens Industry Mall and the SINAUT system manual at Siemens Industry Online Support.

4.1 Siemens module selection (verify current ordering data with Siemens)

5. Option B: GSM/GPRS Cellular with PSTN or CSD Backup

If the 0.8 mm copper is degraded, of unknown integrity, or the operator does not want to maintain surge protection on a 7 km aerial run, the cleanest answer is to remove the long copper path entirely and use cellular. For a 7 km hop the typical cell tower is line-of-sight if the site has elevation, and a high-gain directional LTE antenna (e.g. ANT 794-4MR or a third-party 5-9 dBi Yagi) usually resolves coverage problems.

The Siemens-native components are:

• CP 1242-7 GPRS for the S7-1200, supporting GPRS (2G/3G) plus CSD fallback for legacy dial-up. Connects to the S7-1200 backplane and is configured from TIA Portal.
• CP 1243-7 LTE for the S7-1200, supporting 4G LTE in EU bands (B1/B3/B7/B8/B20/B28) plus 2G/3G fallback. Higher data rate and a more future-proof cellular path.
• Telecontrol Server Basic (SINAUT ST7cc / TeleControl Server) running on a central SCADA host, terminating the SINAUT frames from each site.
• SINEMA Remote Connect for IPsec-encrypted VPN into a private APN, avoiding the public Internet attack surface.

Redundancy: a CP 1242-7 (cellular) plus a CM 1241 dial-up modem on the existing PSTN service gives true media diversity. The S7-1200 program polls both links and switches on heartbeat timeout. Failover time is 30-90 seconds — acceptable for analog process values at second-scale, unacceptable for motion or safety.

For an isolated 2-sensor / 2-valve plant with a private APN, a typical data plan is 5 MB/month, dominated by SINAUT keep-alive frames.

6. Option C: Single-Mode Fiber Ethernet

If the 0.8 mm cable must be retired or replaced, or if latency and bandwidth drive the design, single-mode 9/125 µm fiber with SCALANCE media converters is the cleanest answer. At 1310 nm a typical SCALANCE XC-100 or third-party media converter reaches 30 km on single-mode fiber with no repeater — 7 km is well within budget.

For Siemens-native Ethernet on the S7-1500, the CP 1542-1 or CP 1543-1 provides PROFINET IO and TCP/IP S7 communication. The SCALANCE XC-200 / XR-200 / MM900 families provide managed switch ports and SFP cages for single-mode optics. Power over Ethernet is not required for this link. Verify SFP module (e.g. 6GK5900-1SD00-0AA0 for LC-LX 1310 nm 10 km or the 30 km LX variant) using the SCALANCE configuration manual on Siemens Industry Online Support.

Note that pulling 7 km of new single-mode aerial or buried fiber is the dominant cost in this option and is usually justified only when the existing 0.8 mm cable is already condemned or when the operator needs future-proofed capacity for video, IIoT, or additional SCADA points.

7. Siemens PLC and I/O Module Configuration

The user requirement is two 4-20 mA inputs and two 0/4-20 mA outputs per site. The minimum S7-1200 configuration that satisfies this without further expansion is:

• CPU 1214C DC/DC/DC with 14 digital inputs (the onboard 2 analog inputs are 0-10 V on most variants and not 4-20 mA — confirm variant). Digital I/O unused here.
• SM 1231 AI 4 × 13 bit (4-20 mA variant), occupying the first I/O slot. Only 2 channels used; the other 2 are wired to ground and disabled in TIA Portal to suppress open-circuit diagnostics.
• SM 1232 AO 2 × 14 bit, in the second I/O slot. Channels 0 and 1 drive the two 4-20 mA valves. The module accepts either 0-20 mA or 4-20 mA per channel and is selected in the device configuration under "Outputs".

7.1 4-20 mA wiring conventions

For the SM 1231 AI in 4-20 mA mode, the channel is a current input; the field loop current flows into the module's I+ terminal and returns on the M terminal. The module provides the loop excitation voltage; the transmitter regulates the current. A 2-wire sensor connects I+ to the sensor's + terminal and M to the sensor's − terminal. A 4-wire sensor uses its own power supply and its regulated output drives the I+ terminal; the M terminal returns to the sensor's signal ground. Shield the cable and ground the shield at the cabinet entry only, leaving the field end floating, to avoid ground-loop currents.

For the SM 1232 AO, the output is a current source. Wire I+ to the valve positioner's + input and M to the − input. Open the valve positioner's input to confirm it is a passive (voltage-input) device, not an active current source; if it is active, the PLC output and the valve output will fight and the 4-20 mA value will be undefined. Most industrial valve positioners are passive current inputs and accept the standard 0/4-20 mA from a PLC.

7.2 Diagnostics and scaling

In TIA Portal, scale the raw 0-27 648 integer to engineering units using the NORM_X and SCALE_X blocks:

PV_eng = SCALE_X(IN := NORM_X(VALUE := AI_raw, MIN := 0, MAX := 27648), MIN := 0, MAX := 100.0)

For 4-20 mA, the AI raw value of 0 corresponds to 0 mA (a broken wire) and 27 648 corresponds to 20 mA. Below 0 mA, the module flags "Overflow / underflow" in the channel status word; the user program should treat any raw value < 0 or > 27 648 as a faulty input and force the controlled output to its fail-safe position.

8. Surge Protection and Ground Potential Rise at 7 km

A 7 km outdoor cable is a 7 km lightning antenna. A direct or induced strike on the cable route will inject tens of kiloamperes of surge current into the PLC cabinet unless the cable is properly bonded and protected. Even on a sunny day, the two sites are likely at different ground potentials because the local earth electrodes differ in resistance and the soils differ in moisture.

8.1 Surge protection on the analog pair

At each cabinet entry, install a two-stage surge protector on each analog pair:

1. Stage 1 (coarse): a gas discharge tube (GDT) rated 230 V or 350 V (sized above the loop voltage) on the line side, with a 10 kA 8/20 µs surge rating. Example: Dehn Blitzductor BXT ML2 BD 180 or Phoenix Contact PT-IQ-2x2-24DC.
2. Stage 2 (fine): a TVS diode clamp at the module terminal, with a response time < 1 ns, clamping at 30-33 V. Example: Phoenix Contact PT 4- 24DC or Weidmüller VPU series.
3. Insert an inductor or PTC between stage 1 and stage 2 to decouple the two stages; without this, the stage 2 TVS is the first to fail.

For the SINAUT modem pair, the same treatment applies; an FSK modem front-end is particularly sensitive to surge because the receiver input is at high impedance.

8.2 Ground potential rise

With a 7 km aerial or buried cable, a nearby lightning strike can produce a ground potential rise of several kV between the two site grounds. The PLC and the modem on each side must be galvanically isolated from the long cable pair, and the cable shield must be bonded to local ground at each end through a heavy-gauge bonding conductor, not directly. For SINAUT over a leased-line modem, the modem provides the isolation barrier — confirm the modem's working voltage (typically 1.5-2.5 kV) and surge withstand (5-10 kV) match the calculated site exposure. If the modem is not isolated, fit an isolation transformer (1.5 kV or 2.5 kV) on the line side.

9. TIA Portal Configuration: SINAUT and Analog I/O

The following procedure is generic to TIA Portal V16 or later; the exact menu paths vary by firmware but the objects are stable. Verify against the current TIA Portal help and the S7-1200 system manual on Siemens Industry Online Support.

9.1 Add the CP module and define the link

1. Open the project and the S7-1200 device configuration.
2. Insert a CM 1241 (RS-232) in slot 101 or wherever free. Configure the port for 1 200 bps, 8E1, no flow control (the FSK modem handles its own link layer).
3. Insert a CP 1242-7 in slot 102 (only if the cellular backup is used). Under "Mobile wireless settings", enter the APN, SIM PIN, and the SINEMA Remote Connect server address. Activate IPsec and upload the certificate from the SINEMA RC server.
4. Right-click the S7-1200 and choose "Properties > Telecontrol > SINAUT" to enable the SINAUT application.

9.2 Define the data points and partner

1. Create a "Partner" entry for the other site; for the SINAUT dedicated-line path, choose "Dedicated line" as the partner type and enter the partner's station number and the local modem's RS-232 port.
2. Create data points under the local CPU. For each 4-20 mA input, create a "Data point of type Analog input" mapped to the SM 1231 channel's IW address. For each analog output, create "Data point of type Analog output" mapped to the SM 1232 channel's QW address.
3. Set the SINAUT update time to 1 s. With 8 data points at 1 s, the link payload is trivial; the 1 s heartbeat is the dominant bandwidth consumer.
4. Compile and download the project to both CPUs.

9.3 Example program: read AI from remote site, scale, write to local AO

The pattern is a periodic fetch from the partner S7-1200's SINAUT mailbox and a write back. The SINAUT blocks are in the "Telecontrol" library that ships with TIA Portal:

// FB "TC_CONFIG" initialized once in OB100 to load the partner list
// FB "TC_SEND" called every 1 s in OB1 to publish local AI
// FB "TC_RECV" called every 1 s in OB1 to receive partner AI
// On each TC_RECV cycle, scale and write to local SM 1232 AO:

IF "TC_RECV_DB".partner_AI[0].status = 16#0000 THEN
    // 0-27648 raw corresponds to 0-100 %
    "Local_AO_raw[0]" := "TC_RECV_DB".partner_AI[0].value;
ELSE
    // Fault: drive valve to fail-safe position (e.g. 4 mA = 0 % scaled to 0)
    "Local_AO_raw[0]" := 0;
END_IF;

"SM1232_AO[0]" := "Local_AO_raw[0]";

The same pattern in reverse handles the 2 local AI published to the partner's AO. The "value" and "status" fields are populated by the SINAUT firmware; the user program does not implement a transport layer.

10. Commissioning and Verification Procedure

The recommended site acceptance test sequence is below. Each step has a pass criterion; do not sign off the link until every step passes.

1. Cable continuity and insulation. Megger each pair at 500 V DC. Resistance conductor-to-conductor > 100 MΩ / km, resistance conductor-to-shield > 100 MΩ / km. Document for the as-built record.
2. Loop resistance. Measure DC resistance of the working pair end-to-end. Expected 240-260 Ω one-way (Site A to Site B) at ambient. If significantly higher, the cable is degraded; find the fault with a TDR (time-domain reflectometer) before energizing the modems.
3. Modem link test. Loop the far-end modem's TX back to its RX; verify a continuous carrier at 0 dBm and no errors over 5 minutes at 1 200 bps. Then remove the loopback and verify the actual link in both directions.
4. Surge protection verification. With the link active, briefly (≤ 5 s) inject a 1 kV / 2 Ω combination wave per IEC 61000-4-5 at the cabinet terminal block on each pair. The link must remain operational. If it does not, the surge protection needs a series inductor or a heavier GDT.
5. Analog I/O calibration at 4 mA and 20 mA. Apply a calibrated 4.000 mA source to each SM 1231 input; the engineering value must read 0.0 % ±0.1 %. Apply 20.000 mA; must read 100.0 % ±0.1 %. If not, the channel is misconfigured (most often: still in 0-10 V mode) or the burden resistor is missing.
6. End-to-end functional test. From Site A, force AI 0 to 4.00 mA; read the partner's value at Site B. Repeat at 12.00 mA and 20.00 mA. Tolerance ±0.02 mA (typical SINAUT round-trip accuracy for a 13-bit analog with second-scale update). Repeat in the reverse direction.
7. Failover test (if redundant path is used). Disconnect the primary cable pair at the cabinet; confirm failover to backup in < 90 s. Reconnect; confirm return to primary in < 90 s.
8. Sustained run. Run the link for 24 h with no operator intervention. Log SINAUT heartbeat counters and channel status; zero errors expected.

11. Troubleshooting Matrix