Siemens TS Adapter II: Migrating from Analog PSTN to GSM and Ethernet/VPN

The Siemens TS Adapter II (MLFB 6NH972-0CB35-0XA0) is the standard tele-service gateway used to remote-program, remote-diagnose, and remote-maintain SIMATIC S7-300 CPUs (S7-300, S7-300F, C7-300) over a serial point-to-point link. The original design assumption was that the adapter would dial into a public analog PSTN (POTS) line, and the engineering station on the other side of the line would answer with another TS Adapter II or a PC running the SIMATIC TeleService software with a matching dial-up modem. The global sunset of analog PSTN services and the rise of GSM/UMTS/LTE cellular networks has stranded many of these installations. This reference documents the three practical migration paths: (1) GSM via the SINAUT MD720-3, (2) general-purpose cellular modems such as the MC35i and MC52i, and (3) the modern Ethernet/VPN path using SCALANCE S industrial security modules over IPSec.

1. TS Adapter II Hardware and Interface Map

The TS Adapter II is a slim-line module designed to mount on the SIMATIC S7-300 DIN rail next to the CPU. It draws power from the backplane and connects to the CPU's MPI/DP port via the supplied bus connector. The operator side of the adapter is a DB-9 male RS-232 (V.24) port that is meant to be cabled (1:1, shielded, max 10 m at 115.2 kbps) to an external modem.

The TS Adapter II firmware implements a slim PPP/LCP stack and uses Siemens telecontrol protocol frames (ST7/STM, also known as SINAUT ST1) encapsulated inside PPP. Once the link is up, the unit behaves like a transparent MPI/DP bridge to the remote PG (STEP 7 V5.x or TIA Portal with TeleService add-in), so that Online > Accessible Nodes, program upload/download, and diagnostic buffer reads all work exactly as they would on a direct MPI cable.

2. The Analog-PSTN Sunset — Why the Field Fails Today

Most public telecom operators in Europe, North America, and parts of Asia have either retired or are scheduled to retire their copper-pair analog service. Field engineers typically see the failure mode as a dial-in modem returning NO DIALTONE or NO CARRIER at the AT command level, followed by STEP 7 reporting Error 33:0001 "Connection to partner cannot be established". Three root causes dominate:

1. Loss of the 48 V DC on-hook battery feed from the local exchange. The TS Adapter II or its partner modem cannot detect a dial tone.
2. PCM/SIP media gateways in the access network do not transport 56 kbps modem audio. V.90/V.92 handshakes fail; the fallback is V.34 or V.32, which is borderline on long loops.
3. Pulse dialing is dropped; only DTMF is accepted. Older modems that default to pulse must be reprogrammed.

The migration therefore needs to replace the L1/L2 service from the modem outwards. The RS-232 side of the TS Adapter II does not need to change.

3. Compatibility Assessment: MC52i and MC35i as Direct Replacements

The Siemens MC35i (Cinterion, predecessor family) and the MC52i are general-purpose industrial GSM/GPRS modems with a 15-pin HD-sub RS-232 interface and a standard AT command set. They are mechanically and electrically designed for embedded M2M integration, not specifically for SINAUT telecontrol. There are four real reasons they are usually not the right answer for a TS Adapter II retrofit:

The bottom line: an MC35i or MC52i can be made to work with a TS Adapter II in CSD (Circuit-Switched Data) mode if the operator's GSM network still supports CSD, and if the engineer writes a script of ATD, AT+CBST, ATDT, and ATO commands to bring up the PPP session. In practice, this is brittle, undocumented at the SINAUT protocol level, and unsupported by Siemens. The officially supported GSM migration path for S7-300 telecontrol is the MD720-3.

4. Recommended Path 1 — SINAUT MD720-3 GSM/GPRS Modem

The SINAUT MD720-3 is the GSM/GPRS terminal modem that Siemens designed and tested against the TS Adapter II, the TIM (Telecontrol Interface Module) family, and the SINAUT ST7 protocol suite. It provides:

• Quad-band GSM/GPRS (850/900/1800/1900 MHz), EDGE class 10.
• RS-232 to the TS Adapter II or to a TIM (DB-9, hardware flow control RTS/CTS).
• Integrated PPP server, transparent TCP/UDP tunneling, and SINAUT ST7 over GPRS.
• Auto-dial and auto-answer behaviour configurable by AT-like service commands.
• DIN-rail housing, antenna SMA connector, industrial temperature range.

For an installation that previously had a TS Adapter II + analog modem on each end, the drop-in swap is:

1. Remove the analog dial-up modem from the cabinet.
2. Mount the MD720-3 on the DIN rail next to the TS Adapter II.
3. Connect the supplied 1:1 RS-232 cable between X1 on the TS Adapter II and the serial port on the MD720-3.
4. Insert a SIM card (see §6 for SIM requirements).
5. Connect the GSM antenna to the SMA jack; route the antenna lead away from the S7-300 backplane.
6. Apply 24 V DC to the MD720-3 power terminals.
7. Load the MD720-3 service configuration (see §7).

5. SIM Card Requirements for SINAUT GSM Networks

The SINAUT ST7 protocol and the MD720-3 firmware assume a "machine-to-machine" SIM. The most common commissioning faults are caused by a SIM that has features the modem does not negotiate correctly. The required properties are:

Engagement with the M2M provider before going on-site is mandatory. Confirm that the operator still supports CSD if the field still has legacy CSD-mode TIMs, or that GPRS is provisioned correctly for the MD720-3 GPRS mode.

6. Configuring the TS Adapter II for the MD720-3

The TS Adapter II is parameterized through STEP 7 (V5.x) or TIA Portal, in the same Hardware Catalog as the rest of the S7-300. The parameter editor is opened by double-clicking the TS Adapter II in the station configuration. The fields that matter for the GSM migration are:

For GPRS-mode (packet) operation, the TS Adapter II does not establish the GPRS context itself — the MD720-3 does. The TS Adapter II is told that the link is "permanent" and the MD720-3 is configured to keep the GPRS PDP context alive. The PG then opens a TCP connection to the public static IP of the SIM, on the port the MD720-3 has been told to listen on (default TCP port 26862 for SINAUT).

7. Recommended Path 2 — Ethernet/IPSec via SCALANCE S

If the site now has an Ethernet LAN or a Wi-Fi segment (the original poster explicitly mentioned Ethernet/WiFi being available), the modern, future-proof path is to retire the analog/GSM dial-up entirely and put the S7-300 on a routed network. To preserve the security boundary that the dial-up link used to provide, the connection is wrapped in IPSec using a SCALANCE S industrial security module.

Typical topology:

• SCALANCE S612 (or S623) at the remote plant, between the S7-300 Ethernet (or MPI/PN gateway) and the public Internet / corporate WAN.
• SCALANCE S612 / S623 / SCALANCE M87x at the central engineering office, or alternatively a soft-client IPSec endpoint on the PG.
• An IPSec tunnel is brought up with pre-shared keys or X.509 certificates; inside the tunnel the PG and the S7-300 see each other as if on a private LAN.

Advantages over GSM/PPP:

• Order-of-magnitude higher bandwidth (10–1000 Mbps vs. 9.6 kbps CSD).
• No recurring cellular data fee per remote site.
• No SIM logistics.
• Same STEP 7 / TIA Portal workflow — Online > Accessible Nodes over TCP/IP.
• PG can be inside the corporate IT perimeter, behind an existing firewall; only the SCALANCE S is exposed.

Reference reading: Industrial Security with SCALANCE S Modules over IPSec VPN Tunnels (Siemens Industry Online Support). The application examples cover pre-shared keys, certificate-based authentication, NAT traversal, and the typical 1:1 NAT between the LAN and the tunnel IP of the S7-300.

8. SCALANCE S Commissioning Steps

1. Mount the SCALANCE S module on the DIN rail in the remote cabinet. Apply 24 V DC.
2. Connect the internal port (P1) to the S7-300 Ethernet or to the CPU's PROFINET interface.
3. Connect the external port (P2) to the WAN router / firewall.
4. Connect a PG to the internal port for first-time IP assignment (default 192.168.1.1, login admin / admin — change at first login).
5. Open the SCALANCE S WebUI (HTTPS, port 443). Navigate to IPsec VPN > Phase 1 / Phase 2 and configure the IKEv1 or IKEv2 proposal to match the central endpoint (AES-128/SHA1 minimum; AES-256/SHA-256 recommended for new deployments).
6. Define a tunnel with remote endpoint = public IP or FQDN of the central SCALANCE S, local subnet = 192.168.1.0/24, remote subnet = 10.0.0.0/24 (engineering LAN).
7. Configure firewall rules: only the PG's IP may initiate TCP port 102 (ISO-on-TCP / S7Comm) to the S7-300; drop everything else inbound on the external port.
8. Bring the tunnel up. From the central PG, ping the S7-300's PROFINET IP. A successful ping confirms Phase 1, Phase 2, and routing are correct.
9. In STEP 7 / TIA Portal, set the PG/PC interface to TCP/IP (Auto), set the S7-300 IP via Accessible Nodes or ARP, then open the project. Program upload/download, diagnostic buffer, and watch tables all run natively over TCP — no TeleService add-in required.

9. Verification Checklist

10. Troubleshooting Matrix

11. Migration Decision Matrix — Pick the Right Path

12. Frequently Asked Questions