Wireless PLC Commissioning Remote: Siemens S7-1200/1500 Setup

1. Overview: The Pretesting Bottleneck

OEM machine builders routinely need to home every actuator and then jog each one between its mechanical min/max limits during pretesting at the factory floor. With machines that contain dozens of motors and pneumatic cylinders, the traditional workflow requires the technician to walk back to a PC or fixed HMI, change a manual-movement index in the PLC, walk back to the actuator to visually verify motion, and repeat. With 4–5 m vertical reaches and technicians climbing into machine frames, the round-trip cost dominates the commissioning time.

The requirement is unambiguous: a hand-held transmitter must let the operator (a) type a three-digit identifier such as 322 for actuator M32.2, (b) trigger the preprogrammed move, and (c) stop the move instantly. The PLC fleet in scope is mixed Siemens SIMATIC S7-1200/S7-1500 and Allen-Bradley CompactLogix/ControlLogix, so the chosen protocol must traverse both. The objective of this guide is to present four engineer-proven architectures, their hardware catalog numbers, the TIA Portal configuration steps, the safety gating logic, and the verification procedure.

Before any radio or webserver is ordered, a documented risk assessment per ISO 13849-1:2023 and IEC 60204-1:2016 is mandatory. Several architectures below assume caged or perimeter-guarded machines; for un-caged machines, a separate safe-motion strategy is required.

2. Safety Requirements — Non-Negotiable Up Front

Wireless remote control of hazardous motion is a category 3 or 4 safety function in nearly every machine-tool and packaging application. The following elements must be present regardless of which wireless architecture is selected:

3. Solution Architecture Comparison

Four architectures are documented below. Selection depends on the existing PLC/HMI inventory, budget, and whether numeric keypad entry is required.

4. Option A — Siemens Webserver + Mobile Browser

The S7-1500 (firmware V2.0 and later) and S7-1200 (firmware V4.0 and later) include a built-in Webserver that exposes user-defined web pages and watch tables over HTTP/HTTPS. With a WiFi access point bridged into the machine network, any smartphone browser becomes a wireless HMI without third-party software.

4.1 Prerequisites

• S7-1500 CPU 1511-1 PN (6ES7511-1AK02) or higher, or S7-1200 CPU 1215C DC/DC/DC (6ES7215-1AG40) firmware V4.4+.
• TIA Portal V17 or later for HTML5 user-defined pages (older V14/V15 only supports classic watch tables).
• Industrial WiFi AP, e.g. Siemens SCALANCE W1788-1EA (6GK5788-1EA00) or Cisco IW6300H.
• Webserver activated: PLC properties → Webserver → Activate webserver on this module, Permit access via HTTPS.
• User management with role Commissioning defined, password ≥ 12 chars.

4.2 TIA Portal — Creating the Commissioning Page

1. Project tree → PLC → Webserver → User-defined pages.
2. Add new HTML fragment named page_commissioning.html.
3. Insert an input element bound to a tag in the commissioning DB:
   <input type="number" min="0" max="999" name="MoveIndex" value=":="MoveIndex":">
4. Insert a write button that triggers a single-bit MoveTrigger tag:
   <button onclick="WriteTag('MoveTrigger', true)">EXECUTE</button>
5. Add a status panel that reads CurrentActuatorName, LastError, and bEnableOK from the safety FB.
6. Configure SSL certificate under Webserver → Security → Server certificate (use the self-signed TIA Portal cert for lab, CA-signed for production).
7. Download hardware configuration to PLC and browse to https://<PLC-IP>/page_commissioning.html.

5. Option B — Industrial Radio Remote with Numeric Keypad

Industrial crane-style transmitters from vendors such as Tele Radio (Tiger, Tucan, Puma series), Cattron, and HBC Radiomatic ship with detachable numeric keypads and Modbus RTU/TCP, CANopen, or Profibus receivers. This is the only architecture that delivers sub-100 ms latency without depending on the customer's IT infrastructure.

5.1 Recommended Hardware

5.2 Modbus Mapping Example (Tiger T24-12)

The receiver exposes a holding-register map that is read by the S7-1500 via a Modbus TCP client instruction (MB_CLIENT or the newer MODBUSPN V3 block in TIA V17).

Sample TIA Portal ST code to convert register pair into a single integer and trigger a movement:

// FB "RemoteManualMove" — TIA Portal SCL
IF #Link_OK AND #Enable_OK AND #EStop_OK THEN
    #MoveIndex := DWORD_TO_INT( SHL( INT_TO_DWORD(#MoveIndex_MSB), 16 ) OR #MoveIndex_LSB );
    #bValid := (#MoveIndex >= 0) AND (#MoveIndex <= 999);
    IF #bValid AND #TriggerBit AND (NOT #TriggerPrev) THEN
        #bExecute := TRUE;  // one-shot rising edge
    END_IF;
ELSE
    #bExecute := FALSE;
END_IF;
#TriggerPrev := #TriggerBit;

The bExecute pulse is fed into the existing manual-movement sequencer in the application program.

6. Option C — Industrial Pi + Node-RED Gateway

A Raspberry Pi 4 (4 GB) or an industrial equivalent (e.g. Revolution Pi Connect S) running Node-RED provides a vendor-agnostic gateway that talks Modbus TCP, S7 native (via the node-red-contrib-s7 node), EtherNet/IP (via node-red-contrib-cip-ethernet-ip), and exposes a mobile-friendly dashboard. Cost is roughly one-tenth of an industrial radio and supports both Siemens and Rockwell without code duplication.

6.1 Bill of Materials

• Raspberry Pi 4B or RevPi Connect S (catalog 100359).
• Node-RED ≥ v3.1 with nodes: node-red-dashboard, node-red-contrib-s7, node-red-contrib-modbus.
• Read-only SD card (industrial SLC, ≥ 16 GB).
• Power: 24 V → 5 V via Meanwell DDR-15.
• WiFi: Pi onboard (lab only) or USB industrial dongle (e.g. EW-7811UAC).

6.2 Flow Sketch

1. S7 read node: address DB100.DBX0.0 for MoveIndex, DB100.DBX2.0 for Trigger; poll 100 ms.
2. Function node validates MoveIndex is in 0–999 and bLinkOK from the safety FB.
3. Dashboard group with a numeric input (slider 0–999), an EXECUTE button, and a status panel bound to CurrentActuatorName.
4. S7 write node mirrors the dashboard back into the PLC when Remote Source selector is set to PI in the HMI.

7. Option D — Mobile VNC to Comfort / Unified Panel

Siemens Comfort Panels (TP700–TP2200, 6AV2 1xx series) and Unified Comfort Panels include a built-in VNC server accessible from any smartphone VNC client. This is the fastest path to a mobile HMI on existing hardware.

7.1 Configuration Steps

1. Open the Panel project in TIA Portal.
2. Panel properties → Services → enable Sm@rtServer (Comfort) or Webserver + VNC (Unified).
3. Define a commissioning user with password; restrict to View + Operate only — no Administration rights.
4. Configure IP, subnet, gateway to match the machine's Profinet segment.
5. On the smartphone, install VNC Viewer (RealVNC) or the Siemens Sm@rtClient app (iOS / Android).
6. Connect to <Panel-IP>:5900 (Comfort) or https://<Panel-IP>/ (Unified).

8. Numeric Selection Logic — Parsing "322" into M32.2

The standard actuator naming convention encodes the machine axis and the sub-index in the three digits. The mapping is consistent across the OEM fleet, so a deterministic parser belongs in a reusable function block.

Sample SCL parser used to populate a UDT ActuatorSelect from a single integer:

// Convert raw index 0–999 into UDT fields
#ActuatorSelect.iSubsystem   := #MoveIndex / 100;          // 3
#ActuatorSelect.iAxisGroup   := (#MoveIndex MOD 100) / 10; // 2
#ActuatorSelect.iSubIndex    := #MoveIndex MOD 10;          // 2
#ActuatorSelect.sName        := CONCAT('M', INT_TO_STRING(#MoveIndex));

Edge-trigger the execute to prevent double-firing:

IF #MoveIndex <> #MoveIndexPrev THEN
    #bIndexChanged := TRUE;
END_IF;
IF #bIndexChanged AND #bTrigger THEN
    #bExecute := TRUE;
    #bIndexChanged := FALSE;
END_IF;
#MoveIndexPrev := #MoveIndex;

9. Wireless Network Infrastructure

Industrial WiFi is not optional. A domestic router in a steel-framed hall will not deliver the 250 ms latency budget. Recommended topology:

• One Siemens SCALANCE W1788-1EA (6GK5788-1EA00) AP per 30 m of machine length, mounted ≥ 3 m above floor, with external antenna (e.g. ANT795-4MR).
• Power over Ethernet (PoE+) via SCALANCE PSR9230 (6GK5923-0PS00) or a managed PoE switch.
• Commissioning SSID isolated in a separate VLAN (e.g. VLAN 99) with no route to the corporate LAN.
• For machines where radio coverage is impractical, fall back to Option B (industrial radio remote with bus output) — these radios operate at 433/868/915 MHz and propagate well around metal structures.

10. Remote I/O and PLC Architecture Context

PLCs and remote I/Os are real-time deterministic controllers; a wireless link in the loop must respect this. According to NXP's PLC and Remote I/O application brief, deterministic latency is the primary design constraint. When adding a wireless remote you are inserting a non-deterministic element, which is why the safety relay + dead-man chain must remain outside the wireless path. If the wireless link is for command-and-status only (no safety function) and the safety chain is a parallel hardwired circuit, the deterministic constraint is preserved.

For distributed architectures where the radio receiver is not co-located with the main PLC, remote I/O modules such as the AutomationDirect BRX series can be installed at the receiver and tunneled back over Ethernet to the central S7-1500. See the BRX Remote I/O Controllers product page for module selection. This is useful when the wireless receiver must sit near a hazardous area and the main PLC is in a control cabinet 30 m away.

11. Commissioning Procedure

1. Document risk assessment with all stakeholders; record PL target and residual risk.
2. Power up the receiver/AP, verify LED status on SCALANCE W (Power, Link, Activity).
3. Check E-Stop chain with PLC in Stop: pressing the physical E-Stop must drop out the safety relay within 50 ms.
4. Verify dead-man: with PLC in commissioning mode, hold enable switch — drives must energize. Release — drives must de-energize within 250 ms.
5. Verify link-loss drop-out: power off the radio transmitter while the enable is held — safety relay must drop out within 500 ms.
6. End-to-end latency: with the PLC logging timestamped MoveTrigger and the handheld logging key-press, take 50 samples; mean < 250 ms, max < 400 ms.
7. Functional test: type index 322, press EXECUTE, observe M32.2 move to home position; press EXECUTE again, observe move to mechanical max.
8. Watchdog: verify PLC fault is raised (OB82 / OB86) if the radio connection is missing for > 1 s; the application must fall back to local HMI only.
9. Sign-off: attach the test record to the machine's CE technical file.

12. Troubleshooting Matrix

13. Engineering Field Notes

• Never route E-Stop through the wireless transmitter's outputs. E-Stop must be a series-wired loop into the safety relay regardless of mode selection.
• If the actuator count grows past 999, the parsing FB must be extended to 4 digits and the webserver input max raised to 9999; do not repurpose spare bits for sequencing.
• Document the actuator index table in the machine's electrical drawing set (typically drawing index "COMM-001"); technicians must be able to read 322 and find M32.2 on the schematic.
• When commissioning multiple identical machines, export the webserver HTML fragments as part of the TIA Portal master project — this prevents drift.
• For machines with safety-rated motion (presses, robots), the wireless remote is for ergonomic jog only; the production cycle is hard-gated by light curtain or area scanner.