Ba - CP 1243 7 Lte - 76
Ba - CP 1243 7 Lte - 76
Ba - CP 1243 7 Lte - 76
Preface
Program blocks 5
Operating Instructions
Technical specifications 7
Dimension drawings A
Approvals B
Accessories C
Documentation references D
CP 1243-7 LTE-EU
CP 1243-7 LTE-US
12/2019
C79000-G8976-C381-05
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.
Behind the top hinged cover of the module housing, next to the article number you will see
the hardware product version printed as a placeholder "X" (for example X 2 3 4). In this case,
"X" would be the placeholder for hardware product version 1.
You will find the firmware version of the CP as supplied behind the top hinged cover of the
housing to the left below the LED field.
You will find the IMEI under the lower hinged cover of the housing.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 3
Preface
Abbreviations/acronyms
● CP / module / device
Simplified designation of the CP 1243-7 LTE-EU / CP 1243-7 LTE-USCP 1243-7 LTE-EU
/ CP 1243-7 LTE-US
● TCSB
TeleControl Server Basic V3, OPC server for telecontrol communication
● Mobile wireless network
The mobile wireless network(s) that support or use the relevant CP.
The precise standards and frequency bands which the two CPs support can be found in
the sections Connecting the S7-1200 to a mobile wireless network (Page 13) and
Technical specifications (Page 105).
Configuration
The necessary configuration steps are described in the form of an overview.
● CP without telecontrol communication
The relevant configuration steps for these applications are described in this manual.
● CP with telecontrol communication
You will find the complete description of the configuration and diagnostics for these
applications in the Configuration Manual /3/ (Page 124).
Refer to the information below in the section "Structure of the documentation".
CP 1243-7 LTE
4 Operating Instructions, 12/2019, C79000-G8976-C381-05
Preface
Required experience
To install, commission and operate the CP, you require experience in the following areas:
● Automation engineering
● Setting up the SIMATIC S7-1200
● SIMATIC STEP 7 Basic / Professional
● Data transfer via mobile wireless networks and Internet
Cross references
In this manual there are often cross references to other sections.
To be able to return to the initial page after jumping to a cross reference, some PDF readers
support the command <Alt>+<left arrow>.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 5
Preface
License conditions
Note
Open source software
The product contains open source software. Read the license conditions for open source
software carefully before using the product.
You will find the license conditions on the supplied data medium:
● OSS_CP124x7_99.pdf
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be
connected to an enterprise network or the internet if and to the extent such a connection is
necessary and only when appropriate security measures (e.g. firewalls and/or network
segmentation) are in place.
For additional information on industrial security measures that may be implemented, please
visit
Link: (http://www.siemens.com/industrialsecurity)
Siemens’ products and solutions undergo continuous development to make them more
secure. Siemens strongly recommends that product updates are applied as soon as they are
available and that the latest product versions are used. Use of product versions that are no
longer supported, and failure to apply the latest updates may increase customers’ exposure
to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
Link: (http://www.siemens.com/industrialsecurity)
Firmware
The firmware is signed and encrypted. This ensures that only firmware created by Siemens
can be downloaded to the device.
CP 1243-7 LTE
6 Operating Instructions, 12/2019, C79000-G8976-C381-05
Preface
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 7
Preface
CP 1243-7 LTE
8 Operating Instructions, 12/2019, C79000-G8976-C381-05
Table of contents
Preface ................................................................................................................................................... 3
1 Application and functions ...................................................................................................................... 13
1.1 Connecting the S7-1200 to a mobile wireless network...........................................................13
1.2 Communications services .......................................................................................................15
1.3 Communication via SINEMA RC ............................................................................................17
1.4 Other services and properties .................................................................................................19
1.5 Security functions ....................................................................................................................20
1.6 Configuration limits and performance data .............................................................................22
1.7 Requirements for operation ....................................................................................................24
1.8 Configuration examples ..........................................................................................................26
2 LEDs and connectors ............................................................................................................................ 29
2.1 Opening the housing ...............................................................................................................29
2.2 LEDs .......................................................................................................................................30
2.3 Electrical connectors ...............................................................................................................33
2.3.1 Power supply ..........................................................................................................................33
2.3.2 Wireless interface ...................................................................................................................34
3 Installation, connecting up, commissioning ............................................................................................ 35
3.1 Important notes on using the device .......................................................................................35
3.1.1 Notices on use in hazardous areas ........................................................................................36
3.1.2 Notes on use in hazardous areas according to ATEX / IECEx ..............................................37
3.1.3 Notices regarding use in hazardous areas according to UL HazLoc .....................................37
3.2 Installing, wiring and commissioning ......................................................................................38
3.3 Notes on operation..................................................................................................................43
4 Configuration ........................................................................................................................................ 45
4.1 Security recommendations .....................................................................................................45
4.2 Configuration in STEP 7 .........................................................................................................48
4.3 Communication types .............................................................................................................50
4.4 Mobile wireless communications settings ...............................................................................51
4.5 Ethernet interface [X1] ............................................................................................................53
4.5.1 Ethernet addresses .................................................................................................................53
4.5.2 Advanced options ...................................................................................................................54
4.5.3 Access to the Web server .......................................................................................................54
4.6 Time-of-day synchronization ...................................................................................................55
4.7 - - Par.gruppe - siehe TC-HB - - (ehem. Partnerstat.) ............................................................58
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 9
Table of contents
CP 1243-7 LTE
10 Operating Instructions, 12/2019, C79000-G8976-C381-05
Table of contents
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 11
Table of contents
CP 1243-7 LTE
12 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions 1
1.1 Connecting the S7-1200 to a mobile wireless network
The CP is intended for use in industrial environments.
National approvals
In countries in which the CP is approved, you will find this on the Internet on the pages of
Siemens Industry Online Support. You will find the link in the section Approvals (Page 113).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 13
Application and functions
1.1 Connecting the S7-1200 to a mobile wireless network
Communication types
The CP allows the following types of WAN communication:
● Telecontrol communication
WAN communication between S7-1200 stations and the telecontrol server (TCSB) in the
master station
● Inter-station communication
Communication between stations and the master station (telecontrol communication)
● Direct communication
Direct inter-station communication between stations (Open User Communication) via
program blocks
Note
No CDMA
The CP is not suitable for GSM networks in which the code multiplex method "Code
Division Multiple Access" (CDMA) is used.
– UMTS / HSPA
(Universal Mobile Telecommunications System) / (High Speed Packet Access)
UMTS allows significantly higher transmission speeds than GSM.
HSPA is a further development of UMTS and once again allows higher transmission
speeds.
– LTE
(Long Term Evolution)
Mobile wireless specification with a higher transmission speed than UMTS.
CP 1243-7 LTE
14 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions
1.2 Communications services
● SMS
(Short Message Service)
The CP can send and receive SMS messages.
● E-mail
The CP can send e-mails via mobile wireless and the Internet.
E-mail
Independent of whether telecontrol communication is activated, the CP can send configured
e-mails to PCs with Internet connection, triggered by events. The use of program blocks is
not necessary for this. For information on configuration, see below.
Telecontrol communication
The following applications are possible if telecontrol communication is enabled in the
configuration of the CP.
● Communication with a control center
Remote S7-1200 stations communicate via the mobile wireless network and the Internet
with a telecontrol server in the master station. The telecontrol server communicates with a
higher-level control system using the integrated OPC server function.
● Event-driven sending of messages using SMS or e-mail
Via the mobile wireless network, the CP sends SMS messages to mobile phones or e-
mails to PCs with an Internet connection.
Both types of messages are configured in telecontrol communication in STEP 7. The use
of program blocks is not necessary.
For information on the configuration, refer to sections E-mail configuration (Page 64) and
Messages (Page 76).
● Inter-station communication between S7-1200 stations via the telecontrol server
In this application, the CP establishes a connection to the telecontrol server via the
mobile wireless network. The telecontrol server forwards the messages to the destination
station.
For this communications service, the CP and TCSB use their own protocol on OSI layer 7
that among other things supports certain security functions, see section Security functions
(Page 20).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 15
Application and functions
1.2 Communications services
S7 communication
Reading / writing data from / to a CPU via the mobile wireless network is possible if S7
communication is enabled in the configuration of the CP.
The CP supports the following functions:
● PUT / GET
The CP supports the function as client (program blocks) and server for data exchange
with remote stations (S7-300/400/1200/1500).
You will find details on the program blocks in the information system of STEP 7
● S7 routing
As of CP firmware V2.1 with CPU ≥ V4.2
For S7 communication, the CP requires a fixed IP address, see section Other services and
properties (Page 19).
CP 1243-7 LTE
16 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions
1.3 Communication via SINEMA RC
Parameter groups
You configure communication via SINEMA RC and telecontrol communication via SINEMA
RC in two parameter groups:
● Communication via SINEMA RC:
> "Security > VPN"
● Telecontrol communication via SINEMA RC:
> "Communication types"
For information on the configuration, refer to the telecontrol configuration manuals /3/
(Page 124).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 17
Application and functions
1.3 Communication via SINEMA RC
Applications
The following application options result from the combination of the parameters for
telecontrol communication and SINEMA RC.
Application example:
● (1) No telecontrol and no SINEMA RC (CP for network separation only)
● (2) CP only for remote maintenance via SINEMA RC
● (3) CP for telecontrol communication only
● (4) CP uses telecontrol communication, but SINEMA RC only for remote maintenance.
● (5) CP uses SINEMA RC for telecontrol communication and remote maintenance.
The table provides an overview of the applications with the respective parameter settings.
● "On" means that the parameter is activated.
● "Off" means that the parameter is deactivated.
Parameter settings
Use case (Parameters abbreviated) *
SRC TC TC-SRC
(1) Off Off Off
(2) On Off Off
(3) Off On Off
(4) On On Off
(5) On On On
CP 1243-7 LTE
18 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions
1.4 Other services and properties
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 19
Application and functions
1.5 Security functions
CP 1243-7 LTE
20 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions
1.5 Security functions
● NTP (secure)
For secure transfer during time-of-day synchronization with telecontrol communication
disabled
● HTTPS
For secure access to the Web server of the CPU
Note
Plants with security requirements - recommendation
Use the following option:
• If you have systems with high security requirements, use the secure protocols
NTP (secure) and HTTPS.
• If you connect to public networks, you should use the firewall. Think about the services
you want to allow access to the station via public networks. By using the "bandwidth
limitation" of the firewall, you can restrict the possibility of flooding and DoS attacks.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 21
Application and functions
1.6 Configuration limits and performance data
● VPN
The following alternatives can be used:
– Secured communication via IPsec tunnels
VPN communication allows the establishment of secure IPsec tunnels for
communication with one or more security modules. The CP can be grouped together
with other modules to form VPN groups during configuration. IPsec tunnels are
created between all security modules of a VPN group.
– Remote maintenance via SINEMA Remote Connect
It is not necessary and not possible to create a VPN group for communication via a
SINEMA RC server. The SINEMA RC Server manages the communication between
the devices and the security mechanisms (OpenVPN).
● Logging
To allow monitoring, events can be stored in log files that can be read out using the
configuration tool or can be sent automatically to a Syslog server.
For information on configuring the security functions, refer to the section Security (Page 61).
You will find additional information on the functionality and configuration of the security
functions in the STEP 7 information system.
CP 1243-7 LTE
22 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions
1.6 Configuration limits and performance data
User data
With the connection types listed below, the user data of a frame represent a consistent data
area in terms of the time of transfer.
User data per frame with the various connection types:
● For TCP connections: Max. 8192 bytes
● For ISO-on-TCP connections: Max. 1452 bytes
● For UDP connections: Max. 1472 bytes
With frames of telecontrol communication, the individual values of the data points are time
stamped.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 23
Application and functions
1.7 Requirements for operation
Firewall rules
The maximum number of firewall rules in advanced firewall mode is limited to 256.
The firewall rules are divided up as follows:
● Maximum 226 rules with individual addresses
● Maximum 30 rules with address ranges or network addresses
(e.g. 140.90.120.1 - 140.90.120.20 or 140.90.120.0/16)
● Maximum 128 rules with limitation of the transmission speed ("Bandwidth limitation")
Hardware requirements
Apart from the CP. the following hardware is required in the S7-1200:
● CP
The requirement for a firmware version V3.x is a CP with hardware product version 2.
● A CPU with firmware version as of V3
The full functionality of the CP is only available with a CPU as of V4.4
● An external antenna for the CP
Use only the antenna from the accessories program for the CP, refer to the appendix
Antennas (Page 121).
● For telecontrol communication, a PC with an Internet connection is required for the
telecontrol server in the master station.
Configuration software
To use the full range of functions, the following configuration tool is required to configure the
module:
STEP 7 Basic V16
CP 1243-7 LTE
24 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions
1.7 Requirements for operation
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 25
Application and functions
1.8 Configuration examples
CP 1243-7 LTE
26 Operating Instructions, 12/2019, C79000-G8976-C381-05
Application and functions
1.8 Configuration examples
SMS
A mobile wireless CP can send SMS messages to a mobile phone or a configured S7
station. The mechanisms for this are as follows:
● SMS messages generated and sent as the result of an event. They are configured in the
messages editor.
● SMS messages that are sent or received by calling the corresponding program blocks of
the Open User Communication.
See also the section "Direct communication between stations".
● Using a mobile phone, a diagnostics SMS can be requested, see section Diagnostics
options (Page 97).
For all mobile phones that send SMS messages to the CP, the authorize phone number
must be specified in the STEP 7 configuration of the CP (parameter group "Security >
Authorized phone number").
E-mails
The CP can send e-mails to a PC with an Internet connection or a mobile phone. The
mechanisms for this are as follows:
● E-mails generated and sent as the result of an event. They are configured in the
messages editor.
● E-mails sent as a result of calling the program block TMAIL_C.
For secure transmission of e-mails, the CP must have the current time.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 27
Application and functions
1.8 Configuration examples
CP 1243-7 LTE
28 Operating Instructions, 12/2019, C79000-G8976-C381-05
LEDs and connectors 2
2.1 Opening the housing
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 29
LEDs and connectors
2.2 LEDs
2.2 LEDs
red/green
red/green
CONNECT Status of the connection to the master station
green
SIGNAL QUALITY Signal quality of the mobile wireless network
yellow / green
VPN Status of the VPN or SINEMA Remote Connect configuration
green
Note
LED colors when the module starts up
When the module starts up, all its LEDs are lit for a short time. Multicolored LEDs display a
color mixture. At this point in time, the color of the LEDs is not clear.
CP 1243-7 LTE
30 Operating Instructions, 12/2019, C79000-G8976-C381-05
LEDs and connectors
2.2 LEDs
Symbol -
The LEDs indicate the operating and communications status of the module according to the
following scheme:
Startup
red
- - - Errors:
• Invalid CP configuration
flashing red
or
• CP type does not match the configuration
data on the CPU.
- - - - Running (RUN) without error
green
- - - Backplane bus error
flashing red
- - - Missing SIM card
flashing red
- - - Missing or incorrect PIN
flashing red
Connection to the mobile wireless network
- - - - Existing connection to the service in the
mobile wireless network
- - - - No connection to the service in the mobile
wireless network
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 31
LEDs and connectors
2.2 LEDs
flashing
green
- - No partner reachable, CPU in STOP
flashing
green
- - Telecontrol configuration exists, partner not
reachable, CPU in RUN mode
flashing
green
- - Telecontrol configuration exists, partner not
reachable, CPU in STOP mode
flashing
green
Quality of the mobile wireless connection
- - - - Good network (-73 ... ≥ -51 dBm)
flashing red
VPN/SINEMA Remote Connect connection
- - - VPN/SINEMA Remote Connect connection
established
- - - Attempting to establish a configured
VPN/SINEMA Remote Connect connection
- - - - VPN/SINEMA Remote Connect connection
not configured or currently not established on
the CP
CP 1243-7 LTE
32 Operating Instructions, 12/2019, C79000-G8976-C381-05
LEDs and connectors
2.3 Electrical connectors
flashing
green
• Error loading firmware
or
flashing red
• Internal error of the CP; remedy: Power
OFF → ON
Power supply
The 3-pin socket for the external 24 V DC power supply is located on the top of the module.
The matching plug ships with the product.
You will find the pin assignment of the socket in section Pin assignment of the socket for the
external power supply (Page 109).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 33
LEDs and connectors
2.3 Electrical connectors
CP 1243-7 LTE
34 Operating Instructions, 12/2019, C79000-G8976-C381-05
Installation, connecting up, commissioning 3
3.1 Important notes on using the device
Overvoltage protection
NOTICE
Protection of the external power supply
If power is supplied to the module or station over longer power cables or networks, the
coupling in of strong electromagnetic pulses onto the power supply cables is possible. This
can be caused, for example by lightning strikes or switching of higher loads.
The connector of the external power supply is not protected from strong electromagnetic
pulses. To protect it, an external overvoltage protection module is necessary. The
requirements of EN61000-4-5, surge immunity tests on power supply lines, are met only
when a suitable protective element is used. A suitable device is, for example, the Dehn
Blitzductor BVT AVD 24, article number 918 422 or a comparable protective element.
Manufacturer:
DEHN+SOEHNE GmbH+Co.KG Hans Dehn Str.1 Postfach 1640 D-92306 Neumarkt,
Germany
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 35
Installation, connecting up, commissioning
3.1 Important notes on using the device
WARNING
EXPLOSION HAZARD
DO NOT OPEN WHEN ENERGIZED.
WARNING
The device may only be operated in an environment with pollution degree 1 or 2 (see IEC
60664-1).
WARNING
The equipment is designed for operation with Safety Extra-Low Voltage (SELV) by a
Limited Power Source (LPS).
This means that only SELV / LPS complying with IEC 60950-1 / EN 60950-1 / VDE 0805-1
must be connected to the power supply terminals. The power supply unit for the equipment
power supply must comply with NEC Class 2, as described by the National Electrical Code
(r) (ANSI / NFPA 70).
If the equipment is connected to a redundant power supply (two separate power supplies),
both must meet these requirements.
WARNING
EXPLOSION HAZARD
DO NOT CONNECT OR DISCONNECT EQUIPMENT WHEN A FLAMMABLE OR
COMBUSTIBLE ATMOSPHERE IS PRESENT.
WARNING
EXPLOSION HAZARD
SUBSTITUTION OF COMPONENTS MAY IMPAIR SUITABILITY FOR CLASS I, DIVISION
2 OR ZONE 2.
WARNING
CP 1243-7 LTE
36 Operating Instructions, 12/2019, C79000-G8976-C381-05
Installation, connecting up, commissioning
3.1 Important notes on using the device
WARNING
Requirements for the cabinet/enclosure
To comply with EC Directive 2014/34 EU (ATEX 114) or the conditions of IECEx, this
enclosure or cabinet must meet the requirements of at least IP54 (in compliance with
EN 60529) according to EN 60079-7.
WARNING
Cable
If the cable or conduit entry point exceeds 70 °C or the branching point of conductors
exceeds 80 °C, special precautions must be taken. If the equipment is operated in an air
ambient in excess of 50 °C, only use cables with admitted maximum operating temperature
of at least 80 °C.
WARNING
Take measures to prevent transient voltage surges of more than 40% of the rated voltage.
This is the case if you only operate devices with SELV (safety extra-low voltage).
WARNING
EXPLOSION HAZARD
DO NOT DISCONNECT WHILE CIRCUIT IS LIVE UNLESS AREA IS KNOWN TO BE
NON-HAZARDOUS.
This equipment is suitable for use in Class I, Division 2, Groups A, B, C and D or non-
hazardous locations only.
This equipment is suitable for use in Class I, Zone 2, Group IIC or non-hazardous locations
only.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 37
Installation, connecting up, commissioning
3.2 Installing, wiring and commissioning
WARNING
Read the system manual "S7-1200 Programmable Controller"
Prior to installation, connecting up and commissioning, read the relevant sections in the
system manual "S7-1200 Programmable Controller", refer to the documentation in the
Appendix.
When installing and connecting up, keep to the procedures described in the system manual
"S7-1200 Programmable Controller".
Configuration
One requirement for the commissioning of the CP is the completeness of the STEP 7 project
data (see below). You should also read the section "Configuration (Page 45)".
Note
Inserting and removing the SIM card
Do not insert or remove the SIM card while the CP is operating.
CP 1243-7 LTE
38 Operating Instructions, 12/2019, C79000-G8976-C381-05
Installation, connecting up, commissioning
3.2 Installing, wiring and commissioning
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 39
Installation, connecting up, commissioning
3.2 Installing, wiring and commissioning
* Width B: The distance between the edge of the housing and the center of the hole in the DIN rail mounting clip
CP 1243-7 LTE
40 Operating Instructions, 12/2019, C79000-G8976-C381-05
Installation, connecting up, commissioning
3.2 Installing, wiring and commissioning
NOTICE
Installation location
The module must be installed so that its upper and lower ventilation slits are not covered,
allowing adequate ventilation. Above and below the device, there must be a clearance of 25
mm to allow air to circulate and prevent overheating.
Remember that the permitted temperature ranges depend on the position of the installed
device. You will find the permitted temperature ranges in the section General technical
specifications (Page 105).
Note
Connection with power off
Only wire up the S7-1200 with the power turned off.
Note
Power supply from the power outputs of the CPU
The external power supply of the CP must be supplied via the power outputs of the CPU.
Keep within the maximum load of the power outputs of the CPU.
You will find data relating to the current consumption and power loss of the CP in the section
General technical specifications (Page 105).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 41
Installation, connecting up, commissioning
3.2 Installing, wiring and commissioning
Note
Turning off the station when plugging/pulling the CP
Do not only turn off the power supply to the CP. Always turn off the power supply for the
entire station.
CP 1243-7 LTE
42 Operating Instructions, 12/2019, C79000-G8976-C381-05
Installation, connecting up, commissioning
3.3 Notes on operation
Note
Time-of-day synchronization when using Security / SINEMA RC
When using security functions, such as SINEMA Remote Connect, the CP needs the current
time for authentication on the partner or on the SINEMA RC Server.
The CP receives the time from the CPU or from an NTP server before the connection is
established for the first time.
Recommendation:
During commissioning, set the time of the CPU manually at least once using the STEP 7
online functions. This is necessary especially if you have configured the "Time from partner"
option for the time synchronization. In this way, you ensure that the CPU has a valid time of
day when the station starts up and that the CP can exchange the required certificates with
the partner or the SINEMA RC Server.
CAUTION
Minimum clearance to the device
The device may only be operated when the distance between the device (or antenna) and
user is at least 20 cm.
NOTICE
Closing the front panels
To ensure interference-free operation, keep the front panels of the module closed during
operation.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 43
Installation, connecting up, commissioning
3.3 Notes on operation
CP 1243-7 LTE
44 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration 4
4.1 Security recommendations
Observe the following security recommendations to prevent unauthorized access to the
system.
With enabled telecontrol communication, you should also refer to the information in the
configuration manual.
General
● You should make regular checks to make sure that the device meets these
recommendations and other internal security guidelines if applicable.
● Evaluate your plant as a whole in terms of security. Use a cell protection concept with
suitable products.
● Do not connect the device directly to the Internet. Operate the device within a protected
network area.
● Check regularly for new features on the Siemens Internet pages.
– Here you can find information on Industrial Security:
Link: (http://www.siemens.com/industrialsecurity)
– You can find a selection of documentation on the topic of network security here:
Link: (https://support.industry.siemens.com/cs/ww/en/view/92651441)
● Keep the firmware up to date. Check regularly for security updates of the firmware and
use them.
Information regarding product news and new firmware versions is available at the
following address:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15924/dl)
Physical access
Restrict physical access to the device to qualified personnel.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 45
Configuration
4.1 Security recommendations
Passwords
● Define rules for the use of devices and assignment of passwords.
● Regularly update the passwords to increase security.
● Only use passwords with a high password strength. Avoid weak passwords for example
"password1", "123456789" or similar.
● Make sure that all passwords are protected and inaccessible to unauthorized personnel.
See also the preceding section for information on this.
● Do not use one password for different users and systems.
Protocols
CP 1243-7 LTE
46 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.1 Security recommendations
Protocol / function Port number (pro- Default of the port Port status Authentication
tocol)
S7 and online 102 (TCP) Closed Open after configuration * No
connections
Communication 443 (TCP) Closed Open after configuration Yes
via SINEMA RC
HTTP 80 (TCP) Closed Open after configuration Yes (Telecontrol
Basic) **
HTTPS 443 (TCP) Closed Open after configuration Yes
* Some service providers consider the opening of port 102 a security vulnerability.
To avoid opening port 102 during online diagnostics, see section Online security diagnostics
via port 8448 (Page 100).
** Authentication using the telecontrol password.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 47
Configuration
4.2 Configuration in STEP 7
Configuration in STEP 7
You configure the modules, networks and connections in an engineering station in SIMATIC
STEP 7. You will find the required version in the section Requirements for operation
(Page 24).
You can configure a maximum of three CMs/CPs per station. If you insert several CPs in an
S7-1200, you can, for example, establish redundant communications paths.
The following description applies to applications without telecontrol communication.
CP 1243-7 LTE
48 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.2 Configuration in STEP 7
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 49
Configuration
4.3 Communication types
Note
Configured PIN and PIN on the SIM card must match.
If you enter the PIN of the SIM card of the CP incorrectly during STEP 7 configuration and
download the station, the CP stores the wrong PIN. An incorrectly entered PIN is transferred
by the CP only once so that the SIM card is not locked.
If you change the PIN of the SIM card externally to the incorrectly configured PIN (new PIN
of the SIM card = incorrectly entered PIN in STEP 7), the CP rejects this PIN again without
checking it.
Note
Solution after entering an incorrect PIN:
To avoid the PIN being rejected by the CP again, use a PIN that is different from the
incorrectly entered PIN. Procedure:
• If the PIN of the SIM card was not changed:
– Configure the PIN in STEP 7 with the PIN of the SIM card.
– Reload the station.
• If the original PIN of the SIM card was changed externally to the PIN that was previously
incorrectly entered in STEP 7:
– Change the PIN of the SIM card externally to a new PIN that has not yet been
incorrectly configured in STEP 7.
– Change the configured PIN in STEP 7 to the newly assigned PIN of the SIM card.
– Reload the station.
CP 1243-7 LTE
50 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.4 Mobile wireless communications settings
Note
Subsequent disabling
If you have already used data services in operation and then disable them later, you need
to reload the configuration data and change the CPU to STOP and then RUN.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 51
Configuration
4.4 Mobile wireless communications settings
Note
Permanent storage of the SMSC number
If you configure an SMSC number, the CP no longer accesses the SMSC data of the
SIM card. This is also the case if you delete the SMSC number from the configuration
again.
Recommendation:
When you configure an SMSC number, first note down the SMSC number of your
service provider located on the SIM card. If you want to use it again later, you can
then use the SMSC of your provider again by configuring the SMSC number.
"APN settings"
In this parameter group, you configure the data of the access point. You require the APN to
send e-mails.
Note the information on security in the section Security recommendations (Page 45).
By entering your country in the "Country" box, you can select one of the preset APNs from
the drop-down list.
Alternatively configure the APN manually.
The CP supports APNs with IPv4 and IPv6 addresses.
User names and passwords can contain up to 64 characters. You will find the characters
permitted in the section Character set for passwords and messages (Page 82).
CP 1243-7 LTE
52 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.5 Ethernet interface [X1]
"TeleService settings"
TeleService can only be used when telecontrol communication is enabled. For a description
of the TeleService functions, refer to the configuration manual, see /3/ (Page 124).
Ethernet addresses
Here you configure the IP address of the CP and the network connection.
If you enable security functions, for example when using telecontrol communication, for
reasons of consistency you need to network the CP. To do this create any Ethernet network.
IP protocol
● Dynamic IP address
Enable this option if the CP is assigned the IP address dynamically by the network
provider.
● Fixed IP address from the mobile wireless network provider
Enable this option if you have a mobile wireless contract with which the network provider
assigns the CP a fixed IP address.
This is necessary when using S7 communication and receiving data via Open User
Communication.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 53
Configuration
4.5 Ethernet interface [X1]
CP 1243-7 LTE
54 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.6 Time-of-day synchronization
Note
Time-of-day synchronization of the CP
With applications that require time-of-day synchronization, you need to synchronize the time
of day of the CP regularly. If you do not synchronize the time of day of the CP regularly,
there may be deviations of several seconds per day in the time information of the CP.
With security functions enabled, you need to enable time-of-day synchronization.
Note
Recommendation for setting the time
Synchronization with a external clock at intervals of approximately 10 seconds is
recommended. This achieves as small a deviation as possible between the internal time and
the UTC time.
Note
Recommendation: Time-of-day synchronization only by 1 module
Only have the time of day of the station from an external time source synchronized by a
single module so that a consistent time of day is maintained within the station.
When the CPU takes the time from the CP, disable time-of-day synchronization of the CPU.
With the S7-1200 there is no forwarding of the time of day from the station to the subnet.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 55
Configuration
4.6 Time-of-day synchronization
CP 1243-7 LTE
56 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.6 Time-of-day synchronization
Note
Forwarding the time to the CPU
Depending on the firmware version of the modules involved, the time-of-day of the CP is
forwarded to the CPU in different ways:
• Forwarding of the CP time to the CPU using a PLC tag
• Forwarding of the CP time to the CPU via the backplane bus
The forwarding of the CP time to the CPU depends on the firmware version of the CP and
the CPU. Note the following behavior.
● CP firmware < V3
With this firmware version the CP can make the time-of-day available to the CPU as an
option via a PLC tag. When this PLC tag is read cyclically by the CPU, the CPU adopts
the CP time.
In the parameter group "Communication with the CPU", you can set whether or not the
current time of day of the CP will be made available to the CPU via a PLC tag. For TLC
tags, see parameter group "Communication with the CPU" of the CP.
● CP firmware ≥ V3.0 and CPU firmware ≥ V4.2
If both modules in a station have one of the mentioned firmware versions, the time of the
CP can be forwarded automatically to the CPU.
A condition for this is: The "CPU synchronizes the modules of the device" option is
selected for the CPU under "PROFINET Interface > Time-of-day synchronization".
Then all intelligent modules of the station are synchronized with the CPU time.
Since the CPU automatically adopts the CP time, you no longer require the forwarding
option using the PLC tag.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 57
Configuration
4.7 - - Par.gruppe - siehe TC-HB - - (ehem. Partnerstat.)
Watchdog bit
● CP monitoring
The CP checks the connection with the CPU via the watchdog bit.
The CP transfers the bit to the CPU every 5 seconds and resets it in the next CPU
sampling cycle. The bit is not transferred in the event of connection faults. This signals
the connection fault to the CPU.
The PLC tag of the watchdog bit must be evaluated by the user program.
CP 1243-7 LTE
58 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.9 Communication with the CPU
CP time
● CP time to CPU
The function allows the CPU to read the time of day of the CP. Using this approach, the
CP can synchronize the CPU time.
Procedure:
– The CPU sets the input "Time trigger variable" (BOOL) to 1 with the user program.
– The CP then writes its time to the "CP time variable" (DTL) and resets the "Time
trigger variable" value to 0.
– The user program reads the "CP time variable" to set the CPU time.
Recommendation:
Set the "Time trigger variable" no more frequently than once per second to avoid placing
an unnecessary communication load on the backplane bus.
Note
Refer to the information in the section Time-of-day synchronization (Page 55).
CP diagnostics
In the parameter group "CP diagnostics", you have the option of providing the CPU with
advanced diagnostics data of the CP using PLC tags.
You can display the states of the PLC tags via the Web server of the CPU.
● Enable advanced CP diagnostics
Enable the option to use advanced CP diagnostics.
If the option is enabled, at least the "Diagnostics trigger tag" must be configured.
The following PLC tags for the individual items of diagnostics data can be enabled
selectively.
● Diagnostics trigger tag
If the PLC tag (BOOL) from the user program of the CPU is set to 1, the CP updates the
values of the following PLC tags for the advanced diagnostics.
After writing the current values to the following PLC tags, the CP sets the "Diagnostics
trigger tag" to 0, signaling to the CPU that the updated values can be read from the PLC
tags.
Note
Fast setting of the diagnostics trigger tag
Trigger should not be set more often than once per second.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 59
Configuration
4.9 Communication with the CPU
Depending on the CP type and the supported functions, PLC tags can be configured for the
following diagnostics data:
● Frame memory overflow warning
- Only relevant for telecontrol communication -
● Frame memory occupation
- Only relevant for telecontrol communication -
● Current IP address
PLC tag (data type String) for the current IP address of the CP.
● Mobile wireless signal quality (LED)
PLC tag (data type UInt) for the signal quality of the local mobile wireless network as this
is displayed by the "SIGNAL QUALITY" LED.
● Mobile wireless signal quality (dBm)
PLC tag (data type INT) for the signal quality of the local mobile wireless network as a
dBm value.
● 'NETWORK' LED
PLC tag (data type UInt) for the status of the connection for the data service in the mobile
wireless network.
Meaning of the values (decimal)
– 0 = Booked out of the network
– 1 = Wrong PIN
– 2 = Wrong, defective SIM card or not plugged in.
– 3 = Waiting for PIN / no PIN configured
– 4 = Booked into the network
● Date of last successful logon to network
PLC tag (data type DTL) for the date on which the CP last logged in to the mobile
wireless network.
● Date of last unsuccessful logon to network
PLC tag (data type DTL) for the date on which the CP was last unable to log in to the
mobile wireless network.
● Date of last successful logon to TCSB
- Only relevant for telecontrol communication -
● Date of last unsuccessful logon to TCSB
- Only relevant for telecontrol communication -
● TeleService status
- Only relevant for telecontrol communication -
CP 1243-7 LTE
60 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.10 Security
4.10 Security
For a description of the telecontrol-specific parameters, refer to the configuration manual /3/
(Page 124).
4.10.2 Firewall
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 61
Configuration
4.10 Security
4.10.2.3 Firewall settings for configured connection connections via a VPN tunnel
4.10.2.4 Settings for online security diagnostics and downloading to station with the firewall
activated
CP 1243-7 LTE
62 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.10 Security
3. In the table, insert a new IP rule for the previously created global services as follows:
– Action: Accept; From:: External; To: Station; Service > ICMPv4/6 service > Echo
Request (the previously globally created service)
– Action: Accept; From:: Station; To: External; Service > ICMPv4/6 service > Echo
Reply (the previously globally created service)
4. For the IP rule for the "Echo Request" service, enter the IP address of the engineering
station under "Source IP address".
With these rules, the CP can only be reached from the engineering station with ICMP
packets (ping) via the firewall.
Note
Additional services for online security diagnostics and download
If you wish to use the "Online security diagnostics" or "Download to device" functions, you
need to create additional rules or disable the "Echo Request" / "Echo Reply" services.
SMS messages received only from subscribers with an authorized phone number
The CP only accepts an SMS if the sending communication partner is authorized based on
its phone number. You configure these phone numbers in the "Authorized phone numbers"
list.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 63
Configuration
4.10 Security
Configuring e-mails
In the "E-mail configuration" entry, you configure the protocol to be used and the data for
access to the e-mail server.
In the message editor ("Messages" entry), you configure the individual e-mails, see section
Messages (Page 76).
E-mail configuration
If you want to use the secure transfer of e-mails, the module must have the current date and
the current time of day.
With the default setting of the SMTP port 25, the module transfers unencrypted e-mails.
If your e-mail service provider only supports encrypted transfer, use one of the following
options:
● Port no. 587
By using STARTTLS, the module sends encrypted e-mails to the SMTP server of your e-
mail service provider.
Recommendation: If your e-mail provider offers both options (STARTTLS / SSL/TLS), you
should use STARTTLS with port 587.
● Port no. 465
By using SSL/TLS (SMTPS), the module sends encrypted e-mails to the SMTP server of
your e-mail service provider.
Ask your e.mail service provider which option is supported.
On configuration of the passwords, see Character set for passwords and messages
(Page 82).
CP 1243-7 LTE
64 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.10 Security
4.10.6 VPN
VPN tunnel
Virtual Private Network (VPN) is a technology for secure transportation of confidential data in
public IP networks, for example the Internet. With VPN, a secure connection (tunnel) is set
up and operated between two secure IT systems or networks via a non-secure network.
One of the main features of the VPN tunnel is that it forwards all frames even from protocols
of higher layers (HTTP, FTP telecontrol protocols of the application layer etc.).
The data traffic between two network components is handled unrestricted through a physical
network. This allows networks to be connected together via an intermediate network.
VPN tunnels ensure integrity and confidentiality during data transmission.
Properties
● VPN forms a logical network that is embedded in a physical network. VPN uses the usual
addressing mechanisms of the physical network, however it transports only the frames of
the VPN subscribers and therefore operates independent of the rest of the physical
network.
● VPN allows communication of the subscribers in the VPN network with the physical
network.
● VPN is based on tunnel technology and can be configured for individual subscribers.
● Communication between the VPN partners is protected from eavesdropping or
manipulation by using passwords, public keys or a digital certificate (authentication).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 65
Configuration
4.10 Security
Areas of application
● Local area networks can be connected together securely via the Internet ("site-to-site"
connection).
● Secure access to a company network ("end-to-site" connection)
● Secure access to a server ("end-to-end" connection)
● Communication between two servers without being accessible to third parties (end-to-end
or host-to-host connection)
● Protection of computers and their communication within and automation network
● Secure remote access from a PC/PG to automation devices or networks protected by
security modules via public networks.
Requirements
To allow a VPN tunnel to be created for S7 communication between two S7 stations or
between an S7 station and an engineering station with a security CP (for example CP 1628),
the following requirements must be met:
● The two stations have been configured.
● The CPs in both stations must support the security functions.
● The Ethernet interfaces of the two stations are located in the same subnet.
● All receiving stations require a fixed IP address to be reachable via the public networks.
For this, a special mobile wireless contract is normally necessary for the mobile wireless
CP.
Note
Communication also possible via an IP router
Communication between the two stations is also possible via an IP router. To use this
communications path, however, you need to make further settings.
CP 1243-7 LTE
66 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.10 Security
Procedure
To create a VPN tunnel, you need to work through the following steps:
1. Creating a security user
If the security user has already been created: Log on as this user.
2. Enable the "Activate security features" option
3. Creating the VPN group and assigning security modules
4. Configure the properties of the VPN group
5. Configure local VPN properties of the two CPs
You will find a detailed description of the individual steps in the following paragraphs of this
section.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 67
Configuration
4.10 Security
Note
Current date and current time on the CP for VPN connections
Normally, to establish a VPN connection and the associated recognition of the certificates to
be exchanged, the current date and the current time are required on both stations.
The establishment of a VPN connection to an engineering station that is also the telecontrol
server at the same time (TCSB installed), runs as follows along with the time of day
synchronization of the CP:
On the engineering station (with TCSB), you want the CP to establish a VPN connection.
The VPN connection is established even if the CP does not yet have the current time.
Otherwise the certificates used are evaluated as valid and the secure communication will
work.
Following connection establishment, the CP synchronizes its time of day with the PC
because the telecontrol server is the time master if telecontrol communication is enabled.
Note
Specifying the VPN properties of the CPs
You specify the VPN properties of the CPs in the "Security" > "Firewall" > "VPN" parameter
group of the relevant module.
Result
You have created a VPN tunnel. The firewalls of the CPs are activated automatically: The
"Activate firewall" check box is selected as default when you create a VPN group. You
cannot deselect the check box.
Download the configuration to all modules that belong to the VPN group.
CP 1243-7 LTE
68 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.10 Security
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 69
Configuration
4.10 Security
Preparatory steps
Execute the following steps before start configuring the SINEMA RC connection of the
module in STEP 7. They are the prerequisite for a consistent STEP 7 project.
● Configuration of SINEMA Remote Connect Server
Configure SINEMA RC Server as necessary (not in STEP 7). The communications
module and its communications partners must be configured in the SINEMA RC Server.
● Exporting the CA certificate (optional)
If you want to use the server certificate as authentication method of the communications
module during connection establishment, export the CA certificate from SINEMA RC
Server.
Then import the CA certificate from SINEMA RC Server to the engineering station.
Alternatively, you can use the fingerprint of the server certificate as authentication method
of the communications module. The fingerprint's duration of validity may be shorter than
that of the certificate.
Please note that you need to repeat the import of a certificate in the event of a module
replacement.
CP 1243-7 LTE
70 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.10 Security
Server Verification
Here you select the authentication method of the communications module during connection
establishment.
● CA Certificate
Under "CA certificate", select the CA certificate from SINEMA RC Server that was
previously imported and assigned in the local certificate manager.
The module generally checks the CA certificate of the server and its validity period. The
two options cannot be changed.
● Fingerprint
When you select this authentication method, you enter the fingerprint of the server
certificate of SINEMA RC Server.
Authentication
● Device ID
Enter the device ID generated for the module in SINEMA RC.
● Device password
Enter the device password of the module configured in SINEMA RC.
Max. number of characters: 127
Optional settings
The connection establishment is configured in the "Security > VPN > Optional settings"
parameter group with the parameter "Connection type".
● Update interval
With this parameter you set the interval at which the CP queries the configuration on the
SINEMA RC Server.
Note that with the setting 0 (zero) changes to the configuration of the SINEMA RC Server
may result in the CP no longer being capable of establishing a connection to the
SINEMA RC Server.
● "Connection type"
The two options of the parameter have the following effect on the connection
establishment:
– Auto
The module establishes a connection to the SINEMA RCServer. The OpenVPN
connection is retained until the connection parameters are changed by the SINEMA
Remote Connect Server. If the connection is interrupted, the CP automatically re-
establishes the connection.
If the connection parameters are changed by the SINEMA Remote Connect Server,
the CP requests the new connection data after the update interval configured above
has elapsed.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 71
Configuration
4.10 Security
– PLC trigger
The option is intended for sporadic communication of the module via the SINEMA RC
Server.
You can use this option when you want to establish temporary connections between
the module and a PC. The temporary connections are established via a PLC tag and
can be used in servicing situations, for example.
Note
Connection abort
With a STOP of the CPU, for example due to a firmware update or "Download to device",
the OpenVPN connection is aborted.
These functions can only be used when the "Auto" option is enabled.
Assignment of certificates
If you use communication with authentication for the module, for example SSL/TLS for
secure transfer of e-mails, certificates are required. You need to import certificates of non-
Siemens communications partners into the STEP 7 project and download them to the
module with the configuration data:
1. Import the certificates of the communications partners using the certificate manager in the
global security settings.
2. Then assign the imported certificates to the module by either:
– Using the "Trusted certificates and root certification authorities" table in the global
security settings
– Using the "Certificates of the partner devices" table in the local certificate manager of
the module (security)
In this table, also include the certificates of communication partners whose certificates
were generated in the same STEP 7 project.
For a description of the procedure, refer to the section Handling certificates (Page 73).
You will find further information in the STEP 7 information system.
CP 1243-7 LTE
72 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.10 Security
Note
No certificate with security functions disabled.
If the security functions of the CP are disabled in the STEP 7 project, no certificate will be
generated for the CP.
For the secure transfer of e-mails via SSL/TLS and SSL certificate is created for the CP. It is
visible in STEP 7 in "Global security settings > Certificate manager > Device certificates".
The table "Device certificates" shows the issuer, validity, use of a certificate
(service/application) and the use of a key. You can call up further information about a
certificate by selecting the certificate in the table and selecting the shortcut menu "Show".
The table also shows all other certificates generated by STEP 7 and all imported certificates.
For the module to communicate with non-Siemens partners when the security functions are
enabled, the relevant certificates of the partners must be exchanged during communication.
To supply the module with third-party certificates, follow the steps below:
1. Importing third-party certificates from communications partners
⇒ Global security settings of the project (certificate manager)
2. Assigning certificates, either:
– Global security settings > Certificate manager > "Trusted certificates and root
certification authorities"
– Local security settings of the module > Certificate manager > "Certificates of the
partner devices"
The steps are described in the following sections.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 73
Configuration
4.10 Security
CP 1243-7 LTE
74 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.11 Data points
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 75
Configuration
4.12 Messages
4.12 Messages
Configuring messages
If important events occur, the CP can send messages. The following are configurable:
● E-mails
The recipient can be a PC with an Internet connection or an S7 station.
● SMS (only mobile wireless CPs)
The recipient can be a mobile phone or an S7 station.
You configure the messages with the message editor of the CP. Alternatively, you will find it:
● Via the shortcut menu of the CP
● Via the project navigation: Directory of the station > Local modules > CP
You obtain the access data for the mobile wireless network and for an APN for transferring
e-mails from your network provider. You configure this in the parameter group "Mobile
wireless communication settings" see section Mobile wireless communications settings
(Page 51).
You will find the characters permitted for message texts and additional parameters in the
section Character set for passwords and messages (Page 82).
E-mails
Required information:
● Access data of the SMTP server: Address, port number, user name, password
● When using STARTTLS or SSL/TLS: Certificate of the e-mail service provider
● E-mail addresses of the recipients
CP 1243-7 LTE
76 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.12 Messages
SMS
Required information:
● Number of the SMSC
You create the configuration in the following parameter groups.
● Enabling the SMS function
"Communication types" > "Enable SMS"
● Configuration of the SMSC
"Mobile wireless communication settings" see above.
● Configuring the SMS
Message editor, see above.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 77
Configuration
4.12 Messages
Figure 4-1 Opening the message editor via the project navigation
After opening the editor using the two entries to the right above the table, you can switch
over between the data point and message editor.
The data point editor is only relevant for the telecontrol communication.
Creating objects
You create a new object (message) by double clicking "<Add object>" in the first table row
with the grayed-out entry.
You can change the default name to suit your purposes, but it must be unique within the
module.
CP 1243-7 LTE
78 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.12 Messages
When it does, double-click immediately on the column header. The column width
adapts itself to the broadest entry in this column.
● Showing/hiding columns
You call this function using the shortcut menu that opens when you right-click on a
column header.
Copy messages
You can copy and paste messages. If you right-click in the row of an object in the table, you
can access the functions listed below from the shortcut menu:
● Cut
● Copy
● Paste
You can paste cut or copied objects within the table or in the first free row below the
table.
You can also paste cut or copied objects into tables of other communications modules of
the same type and with the same telecontrol protocol.
● Delete
If you hold down the <Ctrl> key, you can select several rows that are not contiguous.
If you hold down the <Shift> key, you can select the beginning and the end of a contiguous
area.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 79
Configuration
4.12 Messages
"Message parameter"
Here you configure the phone number or the recipient, the subject (e-mail) and the text of the
message.
"Trigger"
In the "Trigger" parameter group you configure triggering for sending the message and other
parameters.
● E-mail trigger / SMS trigger
Specifies the event for which the sending of the message is triggered:
– Use PLC tag
For the trigger signal to send the e-mail, the edge change (0 → 1) of the trigger bit
"PLC tag for trigger" that is set by the user program is evaluated. When necessary, a
separate trigger bit can be configured for each message. For information on the trigger
bit, see below.
Resetting the trigger bit:
If the memory area of the trigger bit is in the memory area or in a data block, the
trigger bit is reset to zero when the message is sent.
In all other cases, you need to reset the trigger bit with the user program.
Note
Fast setting of the diagnostics trigger tag
Trigger should not be set more often than once per second.
CP 1243-7 LTE
80 Operating Instructions, 12/2019, C79000-G8976-C381-05
Configuration
4.12 Messages
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 81
Configuration
4.13 Character set for passwords and messages
● Include value
If you enable the option, the CP sends a value for the placeholder $$ from the memory
area of the CPU in the message. To do this enter "$$" as a placeholder for the value to
be sent in the message text.
Select a PLC tag whose value will be integrated in the message. The value is entered in
the message text instead of the placeholder $$.
$$ as placeholder for the values of data points supports the following data types:
Bool, Byte, Char, Int, UInt, Word, DWord, UDInt, DInt, Real, String,
arrays of the specified data types
● PLC tag for value
PLC tag in which the value to be sent is written.
Character set for APNs, e-mail servers, message texts and the Telecontrol password
The following permitted characters apply to:
● APN:
User names and passwords
● SMTP server:
User names and passwords
● Messages in the message editor:
Message texts
● CP identification
Telecontrol password
Entered as ASCII character sets (hexadecimal value and character name):
● 0x20
Space
● 0x21 ... 0x5F
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOP
QRSTUVWXYZ[\]^_
● 0x61 ... 0x7E
abcdefghijklmnopqrstuvwxyz{|}~
● 0x7C, 0x7E
|~
CP 1243-7 LTE
82 Operating Instructions, 12/2019, C79000-G8976-C381-05
Program blocks 5
5.1 Program blocks for OUC
Note
No different program block versions
Note that you cannot use different versions of a program block in a station.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 83
Program blocks
5.1 Program blocks for OUC
As an alternative, use:
● TCON V4.0 / TDISCON V2.1
Connection establishment / connection termination
● TUSEND V4.0 / TURCV V4.0
Sending and receiving data via UDP
● TSEND V4.0 / TRCV V4.0
– Sending and receiving data via TCP or ISOonTCP
– Sending and receiving SMS messages
● TMAIL_C V4.0
Sending e-mails
To transfer encrypted e-mails with this block, the precise time of day is required on the
CP. Configure the time-of-day synchronization.
For changing configuration data of the CP during runtime:
● T_CONFIG V1.0
Program-controlled configuration of the CP IP parameters
Refer to the information on T_CONFIG and on the SDTs "IF_CONF_..." in the section
TC_CONFIG for changing configuration data of the CP (Page 89).
The address parameters can only be configured with temporary validity. In the respective
"IF_CONF_..." SDT, the "Mode" = 2 parameter must be set.
Note
No feedback from the CP
"T_CONFIG" does not support feedback from the CP to the CPU. Errors in the block call
or in setting the address parameter are not reported. The block outputs "BUSY" or
"DONE" regardless of whether the address parameter was set.
You can find the program blocks in STEP 7 in the "Instructions > Communication > Open
User Communication" task card.
CP 1243-7 LTE
84 Operating Instructions, 12/2019, C79000-G8976-C381-05
Program blocks
5.1 Program blocks for OUC
Usable SDTs
● TCON_IP_V4
For transferring frames via TCP or UDP
● TCON_QDN
For TCP or UDP communication via the fully qualified domain name (FQDN) (IPv4)
● TCON_IP_RFC
For transferring frames via ISO-on-TCP (direct communication between two S7 stations)
● TADDR_Param
For transferring frames via UDP
● TMail_V4
For transferring e-mails addressing the e-mail server using an IPv4 address
Recommendation for mobile wireless applications:
Set the parameter "WatchdogTime" from "MAIL_ADDR_PARAM" to a value higher than 3
minutes.
● TMail_FQDN
For transferring e-mails addressing the e-mail server using its name (FQDN)
● TCON_IP_V4_SEC
For the secure transfer of data via TCP
● TMail_V4_SEC
For secure transfer of e-mails addressing the e-mail server using an IPv4 address
● TMail_QDN_SEC
For secure transfer of e-mails addressing the e-mail server using the host name
Note on TMail_Vx_SEC / TMail_QDN_SEC:
With these SDTs, the mail server certificate is checked, but not the ID of the
"TLSServerCertRef" (STEP 7 internal reference) certificate.
You will find the description of the SDTs with their parameters in the STEP 7 information
system under the relevant name.
You will find notes on sending SMS messages in the section SMS messages via OUC
(Page 86).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 85
Program blocks
5.2 SMS messages via OUC
Note
Connection abort
If an existing connection is aborted by the communications partner or due to disturbances on
the network, the connection must also be terminated by calling TDISCON. Make sure that
you take this into account in your programming.
CP 1243-7 LTE
86 Operating Instructions, 12/2019, C79000-G8976-C381-05
Program blocks
5.2 SMS messages via OUC
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 87
Program blocks
5.2 SMS messages via OUC
The received data of every SMS message gas the following structure:
● DTL
12 bytes for the time stamp of the received SMS message (time stamp from the network)
● String[22]
String of 22 bytes for the phone number of the sender (+ 2 byte string header)
● String[160]
String of 160 bytes for the message text (+ 2 byte string header)
● Byte
Status of the SMS message
If more than one SMS message is received the status of every SMS is stored in this
status byte:
– 0 = Invalid
1 = Unread
2 = Read
When receiving multiple SMS messages, per SMS message the structure requires memory
space of 200 bytes.
Length information at "LEN" and "DATA" for the blocks "TRCV" / "TRCV_C"
When receiving SMS messages via the blocks TRCV or "TRCV_C" if you enter length
information in the "LEN" parameter, this can lead to incorrect information in the data storage
of the received information.
Recommendation: Set LEN = 0 and enter the length information in the "DATA" parameter.
CP 1243-7 LTE
88 Operating Instructions, 12/2019, C79000-G8976-C381-05
Program blocks
5.3 TC_CONFIG for changing configuration data of the CP
Meaning
With the program block TC_CONFIG , you can modify parameters of a the CP configured in
STEP 7. The configured values are not overwritten retentively. The overwritten values
remain valid until TC_CONFIG is called again or until the station starts up again (cold restart
after cycling power).
If the STEP 7 configuration data of the CP needs to be changed permanently, the block
needs to be called again each time the station restarts (cold restart) or a modified project
must be downloaded to the station.
The CONFIG parameter points to the memory area with the configuration data. The
configuration data is stored in a data block (DB). The DB cannot be created with optimized
block access. The structure of the DB is specified by the system data type (SDT) IF_CONF.
The configuration data to be modified on the CP is put together as necessary in blocks in
IF_CONF "IF_CONF_..." for the individual parameters.
Parameters that are not intended to change as a result of the block are not entered in
IF_CONF. They retain the value configured in STEP 7.
For detailed information on programming IF_CONF, refer to the section IF_CONF: SDT for
the configuration data of the CP (Page 91).
The INTERFACE parameter references the name of the interface of the mobile wireless CP.
You will find the name of the interface in the STEP 7 project in the standard tag table of the
station in the "System constants" tab under the entry with the value of the "Hardware
identifier" of the CP.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 89
Program blocks
5.3 TC_CONFIG for changing configuration data of the CP
You will find all other code combinations of DONE and ERROR in the following table.
CP 1243-7 LTE
90 Operating Instructions, 12/2019, C79000-G8976-C381-05
Program blocks
5.4 IF_CONF: SDT for the configuration data of the CP
Structure of the system data type IF_CONF for the TC_CONFIG program block
The CONFIG parameter of the TC_CONFIG program block references the memory area
containing the configuration data of the CP to be modified. The configuration data stored in a
data block is described as a structure of the IF_CONF system data type (SDT).
To be able to use the (SDT IF_CONF there must already be configured values present in the
STEP 7 basic configuration of the CP.
IF_CONF is made up of a header followed by fields that correspond to the parameters or
parameter areas of the CP in the device properties of the STEP 7 project.
The CP configuration data to be modified is collected together as IF_CONF fields.
Parameters that will not be modified are ignored in the IF_CONF structure and remain as
they were configured in the STEP 7 project.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 91
Program blocks
5.4 IF_CONF: SDT for the configuration data of the CP
Header of IF_CONF
Table 5- 1 IF_CONF_Header
CP 1243-7 LTE
92 Operating Instructions, 12/2019, C79000-G8976-C381-05
Program blocks
5.4 IF_CONF: SDT for the configuration data of the CP
Value Meaning
1 Permanent validity of the configuration data
Not relevant for the CP
2 Temporary validity of the configuration data, including deleting of existing permanent
configuration data
The permanent configuration data is replaced by the parameter fields of IF_CONF.
"APN settings"
In STEP 7, the corresponding data is located in the "Mobile wireless communications
settings" parameter area.
Table 5- 3 IF_CONF_APN
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 93
Program blocks
5.4 IF_CONF: SDT for the configuration data of the CP
"CP identification"
In STEP 7, the corresponding data is located in the "Security" parameter area.
Table 5- 4 IF_CONF_Login
"Telecontrol server"
In STEP 7, the corresponding data is located in the "Partner stations" parameter area.".
This field is only used when the telecontrol server is addressed with a name that can be
resolved by DNS or when the IP address is to stored as a string.
Table 5- 5 IF_CONF_TCS_Name
"SMSC"
In STEP 7, the corresponding data can be found in the parameter area "Mobile wireless
communications settings" > "Services and settings".
Table 5- 6 IF_CONF_SMS_Provider
CP 1243-7 LTE
94 Operating Instructions, 12/2019, C79000-G8976-C381-05
Program blocks
5.4 IF_CONF: SDT for the configuration data of the CP
"PIN"
In STEP 7, the PIN can be found in the parameter area "Mobile wireless communications
settings" > "Services and settings".
Table 5- 7 IF_CONF_PIN
Table 5- 8 IF_CONF_WakeupList
Table 5- 9 IF_CONF_PrefProvider
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 95
Program blocks
5.4 IF_CONF: SDT for the configuration data of the CP
Table 5- 10 IF_CONF_TS_Name
CP 1243-7 LTE
96 Operating Instructions, 12/2019, C79000-G8976-C381-05
Diagnostics and upkeep 6
6.1 Diagnostics options
The following diagnostics options are available:
STEP 7: Diagnostics functions in the "Online > Online and diagnostics" menu
Using the online functions, you can read diagnostics information from the CP from an
engineering station on which the project with the CP is stored.
If you want to operate online diagnostics with the station via the CP, you need to activate the
online functions in the parameter group "Communication types".
"Diagnostics" group
Here, you can obtain the following static information on the selected module:
● General information on the module
General information on the module
● Diagnostics status
Information on the diagnostics status
● Ethernet port
Address and statistical information
● Industrial Remote Communication
Here, you obtain specific information on the WAN interface and other parameters of the
CP. The entry job has the following subentries:
– Partner
Information about the address settings of the partner, connection statistics,
configuration data of the partner and other diagnostics information.
– Mobile wireless interface
Diagnostics information on the network, statistical connection information, information
on received/sent messages
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 97
Diagnostics and upkeep
6.1 Diagnostics options
"Functions" group
● Saving service data
The function serves for logging of internal processes is situations in which you cannot
eliminate unexpected or unwanted behavior of the module yourself.
The log file is created with the "Save service data" button. The data is saved in a file with
the format "*.dmp" that can be evaluated by the Siemens hotline.
The diagnostics SMS message that is then sent contains the following data of the S7 station:
● Firmware version of the CP
● Mode of the CPU (RUN / STOP)
● Status of the mobile wireless network connection
Range of values and meaning:
– 0 = Booked out of the network
– 1 = Wrong PIN
– 2 = Wrong SIM card
CP 1243-7 LTE
98 Operating Instructions, 12/2019, C79000-G8976-C381-05
Diagnostics and upkeep
6.1 Diagnostics options
TeleService
TeleService can only be used when telecontrol communication is enabled. For a description
of the TeleService functions, refer to the configuration manual, see /3/ (Page 124).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 99
Diagnostics and upkeep
6.2 Online security diagnostics via port 8448
Processing status
If the option "Enable identifier for processing status" is enabled in the message editor for a
message, a status is output on the CP that provides information about the processing status
of the sent message. The status is written to a PLC tag of the type DWORD. Select this tag
via the "PLC tag for processing status" box.
The processing status is returned by the module itself or the servers of the service after
transfer of a message to be sent.
E-mails sent via program blocks of Open User Communication return a different status via
the block (see block help).
The returned statuses of the Messages configured in the message editor have the following
meaning:
Status Meaning
0000 Transfer completed free of errors
0001 Error in the transfer, possible causes:
• SIM card invalid
• No network
• Wrong destination phone number (number not reachable)
CP 1243-7 LTE
100 Operating Instructions, 12/2019, C79000-G8976-C381-05
Diagnostics and upkeep
6.3 Processing status of messages
Status Meaning
0000 Transfer completed free of errors
82xx Other error message from the e-mail server
Apart from the leading "8", the status corresponds to the three-digit error number of the
SMTP protocol.
8401 No channel available
Possible cause: There is already an e-mail connection via the CP. A second connection
cannot be set up at the same time.
8403 No TCP/IP connection could be established to the SMTP server.
8405 The SMTP server has denied the login request.
8406 An internal SSL error or a problem with the structure of the certificate was detected by the
SMTP client.
8407 Request to use SSL was denied.
8408 The client could not obtain a socket for creating a TCP/IP connection to the mail server.
8409 It is not possible to write via the connection. Possible cause: The communications partner
reset the connection or the connection aborted.
8410 It is not possible to read via the connection. Possible cause: The communications partner
terminated the connection or the connection was aborted.
8411 Sending the e-mail failed. Cause: There was not enough memory space for sending.
8412 The configured DNS server could not resolve specified domain name.
8413 Due to an internal error in the DNS subsystem, the domain name could not be resolved.
8414 An empty character string was specified as the domain name.
8415 An internal error occurred in the cURL module. Execution was aborted.
8416 An internal error occurred in the SMTP module. Execution was aborted.
8417 Requests to SMTP on a channel already being used or invalid channel ID. Execution was
aborted.
8418 Sending the e-mail was aborted. Possible cause: Execution time exceeded.
8419 The channel was interrupted and cannot be used before the connection is terminated.
8420 Certificate chain from the server could not be verified with the root certificate of the CP.
8421 Internal error occurred. Execution was stopped.
8450 Action not executed: Mailbox not available / unreachable. Try again later.
84xx Other error message from the e-mail server
Apart from the leading "8", the status corresponds to the three-digit error number of the
SMTP protocol.
8500 Syntax error: Command unknown.
This also includes the error of having a command chain that is too long. The cause may be
that the e-mail server does not support the LOGIN authentication method.
Try sending e-mails without authentication (no user name).
8501 Syntax error. Check the following configuration data:
Message configuration > Message parameters:
• Recipient address ("To" or "Cc").
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 101
Diagnostics and upkeep
6.4 Loading firmware
Status Meaning
8502 Syntax error. Check the following configuration data:
Message configuration > Message parameters:
• Email address (sender)
8535 SMTP authentication incomplete. Check the "User name" and "Password" parameters in
the CP configuration.
8550 SMTP server cannot be reached. You have no access rights. Check the following configu-
ration data:
• CP configuration > E-mail configuration:
– User name
– Password
– Email address (sender)
• Message configuration > Message parameters:
– Recipient address ("To" or "Cc").
8554 Transfer failed
85xx Other error message from the e-mail server
Apart from the leading "8", the status corresponds to the three-digit error number of the
SMTP protocol.
Note
CPU STOP
Always set the CPU to STOP mode before you download a new firmware file to the CP:
CP 1243-7 LTE
102 Operating Instructions, 12/2019, C79000-G8976-C381-05
Diagnostics and upkeep
6.4 Loading firmware
Note
Effects on the retentive memory of the CPU
• If you use a SIMATIC memory card to install the firmware file, the retentive memory is
retained.
• If you use the online functions to install the firmware file, retentive memory is lost.
You can recognize that firmware is being loaded by the flashing LEDs of the CP, see LEDs
(Page 30).
Loading the firmware with the online functions of STEP 7 via a WAN
Requirements:
● The CP can be reached using its IP address.
● The engineering station and the CP are located in the same subnet.
● The new firmware file is stored on your engineering station.
Procedure:
1. Connect the engineering station to the network.
2. Open the relevant STEP 7 project on the engineering station.
3. Select the CP or the CPU of the station whose CP you want to update with new firmware.
4. Enable the online functions using the "Connect online" icon.
5. In the "Connect online" dialog, select the Ethernet interface "PN/IE" in the "Type of
PG/PC interface" list box.
6. Select the slot of the CP or the CPU.
Both methods are possible.
7. Connect using the "Connect" button.
The "Connect online" wizard guides you through the remaining steps in installation.
You will find further information on the online functions in the STEP 7 information system.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 103
Diagnostics and upkeep
6.5 Module replacement
Module replacement
WARNING
Read the system manual "S7-1200 Programmable Controller"
Prior to installation, connecting up and commissioning, read the relevant sections in the
system manual "S7-1200 Programmable Controller" (refer to the documentation in the
Appendix).
When installing and connecting up, keep to the procedures described in the system manual
"S7-1200 Programmable Controller".
Make sure that the power supply is turned off when installing/uninstalling the devices.
The STEP 7 project data of the CP is stored on the local CPU. If there is a fault on the
device, this allows simple replacement of this communications module without needing to
load the project data to the station again.
When the station starts up again, the new CP reads the project data from the CPU.
Exception: The data of the SINEMA RC configuration and the certificate of the SINEMA RC
server are saved in the CP. They cannot be read from the CPU.
If you replace a module, remember to take the SIM card from the old module and insert it in
the new CP.
CP 1243-7 LTE
104 Operating Instructions, 12/2019, C79000-G8976-C381-05
Technical specifications 7
7.1 General technical specifications
Technical specifications
Module name Article numbers
• CP 1243-7 LTE-EU • 6GK7 243-7KX30-0XE0
• CP 1243-7 LTE-US • 6GK7 243-7SX30-0XE0
Antenna connector
Antenna connector Quantity 1
Design SMA socket
Nominal impedance 50 Ω
Antenna cable, maximum per- ≤ 30 m
mitted length
Electrical data
External power supply Power supply 24 VDC
Permitted range 19.2 ... 28.8 V
Design Terminal block with plug, 3 terminals
Cable cross-section
• Minimum • 0.14 mm2 (AWG 25)
• Maximum • 1.5 mm2 (AWG 15)
Max- tightening torque of the 0.45 Nm (4 lb-in)
screw terminals
Electrical isolation:
Power supply unit to internal 710 VDC for 1 minute
circuit
Current consumption (typical) From 24 VDC (external) 120 mA
From the S7-1200 backplane 150 mA
bus
Effective power loss (typical) From 24 VDC (external) 1.8 W
From the S7-1200 backplane 0.5 W
bus
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 105
Technical specifications
7.1 General technical specifications
Technical specifications
Permitted ambient conditions
Ambient temperature During operation with the rack -20 °C ... +70 °C
installed horizontally (DIN rail
horizontal)
During operation with the rack -20 °C ... +60 °C
installed vertically (DIN rail ver-
tical)
During storage -40 °C ... +70 °C
During transportation -40 °C ... +70 °C
Relative humidity During operation ≤ 95 % at 25 °C, no condensation
Design, dimensions and weight
Module format Compact module for S7-1200, single width
Degree of protection IP20
Weight
• Net weight • 133 g
• Weight including packaging • 170 g
Dimensions (W x H x D) 30 x 100 x 75 mm
Installation options • 35 mm DIN rail
• Switch panel
You will find additional functions and performance data in the section Application and
functions (Page 13).
CP 1243-7 LTE
106 Operating Instructions, 12/2019, C79000-G8976-C381-05
Technical specifications
7.2 Technical specifications - wireless interface (CP 1243-7 LTE-EU)
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 107
Technical specifications
7.3 Technical specifications - wireless interface (CP 1243-7 LTE-US)
CP 1243-7 LTE
108 Operating Instructions, 12/2019, C79000-G8976-C381-05
Technical specifications
7.4 Pin assignment of the socket for the external power supply
7.4 Pin assignment of the socket for the external power supply
Figure 7-1 Socket for the external 24 VDC power supply (view from above)
Table 7- 4 Pin assignment of the socket for the external power supply
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 109
Technical specifications
7.4 Pin assignment of the socket for the external power supply
CP 1243-7 LTE
110 Operating Instructions, 12/2019, C79000-G8976-C381-05
Dimension drawings A
Note
All dimensions in the drawings of the CP are in millimeters.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 111
Dimension drawings
CP 1243-7 LTE
112 Operating Instructions, 12/2019, C79000-G8976-C381-05
Approvals B
Approvals issued
Note
Issued approvals on the type plate of the device
The specified approvals apply only when the corresponding mark is printed on the product.
You can check which of the following approvals have been granted for your product by the
markings on the type plate.
EC declaration of conformity
Valid only for the CP 1243-7 LTE-EU (6GK7 243-7KX30-0XE0)
The CP meets the requirements and safety objectives of the following EU directives and it
complies with the harmonized European standards (EN) for programmable logic controllers
which are published in the official documentation of the European Union.
● 2014/34/EU (ATEX explosion protection directive)
Directive of the European Parliament and the Council of February 26 2014 on the
approximation of the laws of the Member States concerning equipment and protective
systems intended for use in potentially explosive atmospheres
● 2014/53/EU (Radio equipment / telecommunications directive)
Directive of the European Parliament and of the Council of April 16, 2014 on the
harmonization of the laws of the member states relating to placing radio equipment on the
market and to cancel the directive 1999/5/EU
● 2011/65/EU (RoHS)
Directive of the European Parliament and of the Council of 8 June 2011 on the restriction
of the use of certain hazardous substances in electrical and electronic equipment
The EC Declaration of Conformity is available for all responsible authorities at:
Siemens Aktiengesellschaft
Digital Industries
P.O. Box 48 48
90026 Nuremberg
Germany
You will find the EC Declaration of Conformity for this product on the Internet at the following
address:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15924/cert)
Filter settings: Certificate type: "EC declaration of conformity"
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 113
Approvals
IECEx
The product meets the requirements of explosion protection according to IECEx.
IECEx classification:
● Ex ec IIC T4 Gc
Certificate: IECEx DEK 18.0018X
Applied standards:
– EN 60079-0 - Explosive atmospheres - Part 0: Equipment - General requirements
– EN 60079-7 - Explosive Atmospheres - Part 7: Equipment protection by increased
safety 'e'
You can see the current versions of the standards in the IECEx certificate that you can find
on the Internet at the following address:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15924/cert)
The conditions must be met for safe usage of the product according to the section Notes on
use in hazardous areas according to ATEX / IECEx (Page 37).
You should also note the information in the document "Use of subassemblies/modules in a
Zone 2 Hazardous Area" that you can find on the Internet at the following address:
Link: (https://support.industry.siemens.com/cs/ww/en/view/78381013)
ATEX
The product meets the requirements of the EU directive 2014/34/EU "Equipment and
protective systems intended for use in potentially explosive atmospheres".
ATEX approval:
● II 3 G Ex ec IIC T4 Gc
Type Examination Certificate: DEKRA 18 ATEX 0026X
Applied standards:
– EN 60079-0 - Explosive atmospheres - Part 0: Equipment - General requirements
– EN 60079-7 - Explosive Atmospheres - Part 7: Equipment protection by increased
safety 'e'
The current versions of the standards can be seen in the EU Declaration of Conformity, see
above.
The conditions must be met for safe usage of the product according to the section Notes on
use in hazardous areas according to ATEX / IECEx (Page 37).
You should also note the information in the document "Use of subassemblies/modules in a
Zone 2 Hazardous Area" that you can find here:
● In the SIMATIC NET Manual Collection under
"All documents" >"Use of subassemblies/modules in a Zone 2 Hazardous Area"
● On the Internet at the following address:
Link: (https://support.industry.siemens.com/cs/ww/en/view/78381013)
CP 1243-7 LTE
114 Operating Instructions, 12/2019, C79000-G8976-C381-05
Approvals
R&TTE
The CP meets the requirements of the EC directive 1999/5/EC "Radio equipment and
telecommunications terminal equipment" according to the requirements of article 3 (1) a,
3 (1) b and 3 (2).
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 115
Approvals
● EN 61000-6-4+A1
Electromagnetic compatibility (EMC) - Part 6-4: Generic standards - Emission standard
for industrial environments
● EN 55022+AC Class A / B
Information technology equipment - Radio disturbance characteristics - Limits and
methods of measurement
● EN 55024
Information technology equipment - Immunity characteristics -Limits and characteristics -
Limits and methods of measurement
CP 1243-7 LTE
116 Operating Instructions, 12/2019, C79000-G8976-C381-05
Approvals
RoHS
The CP meets the requirements of the EC directive 2011/65/EU on the restriction of the use
of certain hazardous substances in electrical and electronic equipment.
Applied standard:
● EN 50581:2012
cULus
Underwriters Laboratories Inc. meets
● Underwriters Laboratories, Inc.: UL 61010-1 (Safety Requirements for Electrical
Equipment for Measurement, Control, and Laboratory Use - Part 1: General
Requirements)
● IEC/UL 61010-2-201 (Safety requirements for electrical equipment for measurement,
control and laboratory use. Particular requirements for control equipment)
● Canadian Standards Association: CSA C22.2 No. 61010-1-12 / CSA-IEC 61010-2-201
cULus HAZ.LOC.
Underwriters Laboratories Inc. meets
● ANSI ISA 12.12.01
Nonincendive Electrical Equipment for Use in Class I and II, Division 2 and Class III,
Divisions 1 and 2 Hazardous (Classified) Locations
● CAN CSA C22.2 No. 213-M1987, 1st Ed. (R2013)
● Non-Incendive Electrical Equipment for Use in Class I, Division 2 Hazardous Locations
APPROVED for Use in:
● Cl. 1, Div. 2, GP. A, B, C, D T4A; Ta = -20 °C...70 °C
● Cl. 1, Zone 2, GP. IIC T4; Ta = -20 °C...70 °C
FM
Factory Mutual Research (FM)
Approval Standard Class number 3600 and 3611
Approved for use in:
Class I, Division 2, Group A, B, C, D, Temperature Class T4A, Ta = 70 °C
Class I, Zone 2, Group IIC, Temperature Class T4, Ta = 70 °C
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 117
Approvals
USA
Valid only for the CP 1243-7 LTE-US (6GK7 243-7SX30-0XE0)
● FCC
7layers Report Reference: MDE_SIEM_1308_FCCb
Test Specification:
– PART 2 - GENERAL RULES AND REGULATIONS
– PART 15 - RADIO FREQUENCY DEVICES
FCC statement:
"This device complies with part 15 of the FCC Rules. Operation is subject to the following
two conditions:
(1) This device may not cause harmful interference, and
(2) this device must accept any interference received, including interference that may
cause undesired operation.
Changes or modifications not expressly approved by the party responsible for compliance
could void the user's authority to operate the equipment."
Additional statement for Digital Devices / Computer Peripheral Devices
FCC §15.105 statement:
"This equipment has been tested and found to comply with the limits for a Class B digital
device, pursuant to part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference in a residential installation. This
equipment generates, uses and can radiate radio frequency energy and, if not installed
and used in accordance with the instructions, may cause harmful interference to radio
communications. However, there is no guarantee that interference will not occur in a
particular installation. If this equipment does cause harmful interference to radio or
television reception, which can be determined by turning the equipment off and on, the
user is encouraged to try to correct the interference by one or more of the following
measures:
- Reorient or relocate the receiving antenna.
- Increase the separation between the equipment and receiver.
- Connect the equipment into an outlet on a circuit different from that to which the receiver
is connected.
- Consult the dealer or an experienced radio/TV technician for help."
● Network Compatibility
AT&T approval
CP 1243-7 LTE
118 Operating Instructions, 12/2019, C79000-G8976-C381-05
Approvals
Canada
Valid only for the CP 1243-7 LTE-US (6GK7 243-7SX30-0XE0)
Approval IDs:
● ICTA: 5131-LE910NA
● FCC: RI7LE910NA
IC statement:
This device complies with part 15 of the FCC Rules and Industry Canada license-exempt
RSS standard(s). Operation is subject to the following two conditions:
(1) This device may not cause harmful interference, and
(2) this device must accept any interference received,
including interference that may cause undesired operation.
Le présent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils
radio exempts de licence. L'exploitation est autorisée aux deux conditions suivantes :
(1) l'appareil ne doit pas produire de brouillage, et
(2) l'utilisateur de l'appareil doit accepter tout brouillage radioélectrique subi,
même si le brouillage est susceptible d'en compromettre le fonctionnement.
South Africa
Valid only for theCP 1243-7 LTE-EU (6GK7 243-7KX30-0XE0)
Approval Number TA-2015/1864
Mexico
Valid only for the CP 1243-7 LTE-US (6GK7 243-7SX30-0XE0)
La operación de este equipo está sujeta a las siguientes dos condiciones:
(1) es posible que este equipo o dispositivo no cause interferencia perjudicial y
(2) este equipo o dispositivo debe aceptar cualquier interferencia, incluyendo la que pueda
causar su operación no deseada.
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 119
Approvals
Current approvals
SIMATIC NET products are regularly submitted to the relevant authorities and approval
centers for approvals relating to specific markets and applications.
If you require a list of the current approvals for individual devices, consult your Siemens
contact or check the Internet pages of Siemens Industry Online Support:
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15924/cert)
CP 1243-7 LTE
120 Operating Instructions, 12/2019, C79000-G8976-C381-05
Accessories C
C.1 Antennas
The following antennas are available for use in mobile wireless networks and can be
installed both indoors and outdoors. The antennas must be ordered separately.
Antenna ANT794-4MR
You will find detailed information in the documentation of the device. You will find this on the
Internet on the pages of Siemens Industrial Automation Customer Support under the
following entry ID:
Link: (https://support.industry.siemens.com/cs/ww/en/view/23119005)
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 121
Accessories
C.1 Antennas
You will find detailed information in the documentation of the device. You will find this on the
Internet on the pages of Siemens Industrial Automation Customer Support under the
following entry ID:
Link: (https://support.industry.siemens.com/cs/ww/en/view/48729835)
CP 1243-7 LTE
122 Operating Instructions, 12/2019, C79000-G8976-C381-05
Documentation references D
Where to find Siemens documentation
● Article numbers
You will find the article numbers for the Siemens products of relevance here in the
following catalogs:
– SIMATIC NET - Industrial Communication / Industrial Identification, catalog IK PI
– SIMATIC - Products for Totally Integrated Automation and Micro Automation, catalog
ST 70
You can request the catalogs and additional information from your Siemens
representative. You will also find the product information in the Siemens Industry Mall at
the following address:
Link: (https://mall.industry.siemens.com)
● Manuals on the Internet
You will find SIMATIC NET manuals on the Internet pages of Siemens Industry Online
Support:
Link: (https://support.industry.siemens.com/cs/ww/es/ps/15247/man)
Go to the required product in the product tree and make the following settings:
Entry type “Manuals”
● Manuals on the data medium
You will find manuals of SIMATIC NET products on the data medium that ships with many
of the SIMATIC NET products.
/1/
SIMATIC
S7-1200 Automation System
system manual
Siemens AG
Link: (https://support.industry.siemens.com/cs/ww/en/ps/13683/man)
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 123
Documentation references
/2/
/2/
SIMATIC NET
CP 1243-7 LTE
Operating Instructions
Siemens AG
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15924/man)
/3/
SIMATIC NET - TeleControl
Siemens AG
Configuration manuals of the protocols:
- TeleControl Basic
- SINAUT ST7
- DNP3
- IEC 60870-5
Link: (https://support.industry.siemens.com/cs/ww/en/ps/21764/man)
/4/
SIMATIC NET
TeleControl Server Basic (Version V3)
Operating Instructions
Siemens AG
Link: (https://support.industry.siemens.com/cs/ww/en/ps/15918/man)
CP 1243-7 LTE
124 Operating Instructions, 12/2019, C79000-G8976-C381-05
Index
Inserting/removing a SIM card, 38
Instructions (OUC), 83
A Inter-station communication, 15
IP address - fixed, 66
Article number, 3
IP configuration, 19
AT&T, 13
Authorized phone numbers, 63
L
C Logging server, 75
CDMA, 14
Consistent data area, 23
N
Cross references (PDF), 5
NTP, 56
NTP (secure), 56
D IPsec tunnel,
Data buffering, 23
Direct communication, 16, 27
O
Disposal, 7
Online diagnostics, 97
Online functions, 51, 97
E OUC (Open User Communication), 83
E-mail
Configuration, 76
P
Number of messages, 24
Programming (OUC), 83 Passive VPN connection establishment, 69
PIN
Configuration, 49
F Incorrect entry, 49
Port 8448, 100
Firmware - version, 3
Program blocks, 16
Frame memory, 23
PUT/GET, 23
G R
Gateway (VPN), 69
Recycling, 7
Glossary, 7
Replacing a module, 104
H S
Hardware product version, 3
S7 connections, 23
Enable, 50
S7 routing, 16, 50
I
Safety notices, 35
IMEI, 3 Security, 21
Importing a certificate - e-mail, 65 Security diagnostics, 100
CP 1243-7 LTE
Operating Instructions, 12/2019, C79000-G8976-C381-05 125
Index
Send buffer, 23
Service & Support, 7
SIMATIC NET glossary, 7
SMS
Configuration, 77
Number of messages, 24
Programming (OUC), 83
Reception, 63
SMTPS, 64
SSL/TLS, 64
STARTTLS, 64
STEP 7 - version, 24
T
TCSB, 4
TeleService gateway, 24
Time stamp, 23
Time-of-day synchronization, 19
Training, 7
TS Gateway, 24
U
User data, 23
V
VPN, 24, 65
W
Web server
Access, 54
Diagnostics data, 98
Wireless approvals, 117
CP 1243-7 LTE
126 Operating Instructions, 12/2019, C79000-G8976-C381-05