Configuring S7-200 Modbus Master for PAC3200 via SINAUT MICRO

System Overview and Use Case

The application requires a low-cost, GSM/GPRS-based energy monitoring node that reads a three-phase Sentron PAC3200 or PAC4200 power monitoring device and forwards the measured values (voltage, current, active/reactive/apparent power, power factor, frequency, energy) to a remote control station. The controller side is a Siemens SIMATIC S7-200 CPU (S7-22x family) which polls the PAC meter over Modbus RTU on RS-485 and exchanges time-stamped data with a SINAUT MD-720-3 GPRS modem on a second RS-485 port. The MD-720-3 forwards the data through a GSM/GPRS link to the SINAUT MICRO SC server software running on a host PC, which exposes the values to a SCADA via an OPC DA interface. Because the S7-22x CPU cannot act as a Profibus-DP master, the PAC meter must be equipped with the Modbus RTU expansion module; the Profibus-DP module is electrically and logically incompatible with this topology.

Required Components and Order Numbers

Order numbers reflect catalog entries at the time of writing; confirm current part numbers against Siemens Industry Online Support at support.industry.siemens.com.

Hardware Architecture

The physical layout has two RS-485 segments and one wireless segment. The first segment is the S7-200 CPU Port 0 (Freeport mode) connected to the PAC3200/4200 Modbus expansion module through a shielded twisted-pair cable terminated at both ends. The second segment is the S7-200 CPU Port 1 connected to the SINAUT MD-720-3 modem; the modem supplies its own RS-485 transceiver and isolates the segment from the PAC bus. The third segment is the wireless link: GSM/GPRS from the MD-720-3 antenna to the cellular APN, terminating at the SINAUT MICRO SC server. The control station SCADA connects to the OPC DA interface published by the SINAUT MICRO SC server.

PAC3200 and PAC4200 Communication Interface Selection

Both the PAC3200 and PAC4200 are supplied with a base unit and a slot for one plug-in communication/expansion module. The slot accepts one of three families: a Profibus-DP slave module, a Modbus RTU module, or an Ethernet module. The slot position, DIP switches for the RS-485 bus address, and the termination switch are described in the device manual on Siemens Industry Online Support.

For this topology the PAC must be fitted with the Modbus RTU module (7KM9300-0AB00-0AA0 or current equivalent). The Profibus-DP module must not be used because the S7-200 is a Profibus-DP slave and cannot poll a Profibus-DP slave. The Modbus module exposes the following physical interface:

When the PAC module is the last device on the segment, switch the internal termination ON. Otherwise leave it OFF and provide external 120 ohm terminators at the two physical ends of the bus.

RS-485 Cable Specification and Topology

Use a shielded twisted-pair cable designed for RS-485 or Profibus-DP, for example Siemens Profibus cable 6XV1830-0EH10 (violet sheath) or a Belden 3106A equivalent. The cable must satisfy:

• characteristic impedance 135 to 165 ohm at 3 to 20 MHz
• loop resistance below 110 ohm/km
• shield coverage greater than 60 percent
• route spaced at least 200 mm from VFD output cables; metallic conduit preferred

Connect the cable shield to ground at one point only (typically the S7-200 cabinet ground bus) to prevent ground loops. Use 9-pin sub-D connectors with integral 120-ohm termination for the segment ends. The S7-200 Port 0 pinout is pin 3 = B (Data-), pin 8 = A (Data+), pin 5 = shield/DGND; the PAC Modbus module follows the same convention.

Maximum Cable Length vs. Baud Rate

For RS-485 / Profibus-DP cables, the maximum segment length L in metres as a function of baud rate B (bit/s) is approximated by:

L = 1200 / sqrt(1 + (B / 250)^2)

Sample values for typical baud rates:

STEP 7-Micro/WIN Project Configuration

1. Create a new project for the target CPU in STEP 7-Micro/WIN. Confirm that the CPU type matches the order number of the physical PLC and that the CPU firmware is 2.0 or higher.
2. Open System Block and configure Port 0 for Freeport / Modbus master: baud 9600, parity Even, 8 data bits, 1 stop bit. Port 1 stays in PPI for STEP 7-Micro/WIN online access.
3. Allocate a data block (DB) for the polled PAC values; reserve at least 32 words per PAC (16-bit Modbus holding registers).
4. Add the Modbus master library 6ES7830-2BC00-0YX0 to the instruction tree. The library adds the subroutines MBUS_CTRL and MBUS_MSG to the project.
5. Reserve a second DB for SINAUT MICRO ST7 frames: time-stamped events are typically 32 words long, with up to 32 frames per CPU.

Modbus Master Library Installation and Block Calls

The Modbus master library contains two subroutines that the S7-200 calls cyclically:

• MBUS_CTRL - initialises the port (or re-initialises it) and sets timeout, mode, and parity. Call it once on first scan with Mode = 1 to enable Modbus master; the CPU is then in Modbus master mode and the PPI programming connection is suspended on that port until the CPU is reset to PPI.
• MBUS_MSG - sends a single Modbus request to a slave and waits for the response. Use a state machine to sequence multiple registers because MBUS_MSG is single-shot per call.

The example below polls the PAC3200 holding register that returns line-to-neutral voltage L1 and stores the result in VW200:

Network 1 - first scan, init
SM0.1  --| |-- MBUS_CTRL
         Mode    := 1        // 1 = Modbus master
         Baud    := 9600     // match PAC DIP switch
         Parity  := 0        // 0 = Even
         Timeout := 1000     // ms
         Done    -> V10.0
         Error   -> VB11

Network 2 - cyclic poll every 200 ms
SM0.5  --| |-- MBUS_MSG
         Slave   := 1        // PAC address
         RW      := 0        // 0 = read holding register
         Addr    := 1        // register 0x0001 (L1-N V)
         Count   := 1
         DataPtr := &VW200
         Done    -> V20.0
         Error   -> VB21

Network 3 - state machine, advance to next register
// sequence 1, 3, 5, 13, 15, 17, 25, 27, 29, 31, 57, 65
// done bit V20.0 latches success and triggers
// a pointer increment to fetch the next register

Each MBUS_MSG transaction takes 30 to 80 ms at 9600 baud including turnaround. With 12 registers, one full poll cycle completes in roughly 0.5 to 1.0 s, which is adequate for energy monitoring. If the SCADA requires a faster refresh, raise the baud to 19200 or 38400 and reduce the polled set to only the values required by the application.

PAC3200 and PAC4200 Modbus Register Map

The complete Modbus register map is published in the PAC3200 and PAC4200 device manuals. The S7-200 master polls the holding-register range (function code 0x03). A minimum engineering set is listed below; verify the latest register list from the manual before commissioning because address offsets differ between PAC3200 and PAC4200 firmware versions.

SINAUT MICRO and MD-720-3 GPRS Modem Configuration

The S7-200 transfers its data buffer to the MD-720-3 SINAUT GPRS modem over RS-485 (the modem's RS-485 port is independent from the PAC port). The MD-720-3 opens a GPRS link to the cellular APN and tunnels the data to the SINAUT MICRO SC server, which in turn serves the data to the SCADA via an OPC DA interface.

Configuration steps for the S7-200 + MD-720-3 link:

1. Insert a SIM with a public or private APN configured for transparent access. Store the APN name, optional user name, and password in the S7-200 data block that the MD-720-3 reads at startup.
2. Configure the MD-720-3 with the SINAUT ST7 configuration tool. Set the destination IP address or DNS hostname of the SINAUT MICRO SC server, the GPRS keep-alive interval (default 60 s), and the TCP port (default 26862).
3. Enable the SINAUT ST7 protocol on the S7-200 port wired to the MD-720-3. Use the SINAUT MICRO ST7 library (delivered with SINAUT MICRO SC) for the S7-22x CPU. The library adds put, get, and time-sync subroutines.
4. Declare the time-stamped frames the S7-200 will push. For energy monitoring, one frame per minute containing voltage, current, power, and energy is sufficient. The frame buffer must be a contiguous data block of DWORDs or REALs.
5. Configure the time synchronisation source. The SINAUT MICRO SC server can act as the time master and push the system time to the S7-200 once per hour; otherwise the CPU time will drift and the SCADA timestamps will be wrong.

SIM Card and Cellular Data Service Requirements

Two services may be required from the GSM provider depending on the project scope:

• GPRS data - a standard M2M APN with public or private IP routing to the SINAUT MICRO SC server. A static IP on the S7-200 side is not required because the S7-200 always initiates the connection outbound.
• CSD (Circuit Switched Data) - legacy dial-up data service used for remote programming of the S7-200 over the same MD-720-3 modem. Confirm with the provider that the SIM and the rate plan still allow CSD; some providers have retired CSD on 3G and 4G networks.

Data Transfer to the Control Station

The SINAUT MICRO SC server runs on a Windows host with a static public IP or a fixed DNS name. The server accepts incoming GPRS connections from MD-720-3 modems, logs the time-stamped values to an internal database, and publishes them through the OPC DA 2.0/3.0 interface. The control station SCADA connects to the OPC server using any OPC client (WinCC, iFIX, Citect, or a custom HMI). Tag names are mapped 1:1 to the S7-200 data block addresses defined in the SINAUT ST7 configuration.

Throughput is governed by the GPRS link. A typical GPRS connection sustains 30 to 50 kbit/s; each SINAUT ST7 frame (32 words plus overhead) is roughly 100 bytes, so the practical update rate is 5 to 10 frames per second per modem, which is well above the 1 frame per minute that energy monitoring requires.

Optional PCS 7 PAC Library Integration (PAC_DIA Block)

For projects that integrate the PAC data into a SIMATIC PCS 7 control system, Siemens provides the Advanced Process Library PAC3200 & PAC4200 for SIMATIC PCS 7 (see P7PAC12B Advanced Process Library for PAC3200/PAC4200). The library supplies the PAC_DIA block that performs diagnosis of the PAC3200 and PAC4200 from the PCS 7 maintenance station, exposing the same values via the PCS 7 OS faceplates. The PAC_DIA block monitors the Modbus connection and the diagnostic registers of the PAC meter and raises PCS 7 maintenance messages on loss of communication. The block can be connected to a WinCC faceplate that mimics the PAC front-panel display, giving operators voltage, current, power factor, and energy at a glance.

Note that the P7PAC12B library is intended for PCS 7 AS stations, not for the S7-200 / SINAUT MICRO path. The two integration routes are independent.

Verification and Acceptance Test Procedure

1. Apply 24 V DC to the S7-200 CPU and to the MD-720-3. Confirm the green power LED on the CPU and the green link LED on the MD-720-3.
2. Connect STEP 7-Micro/WIN to Port 1 of the CPU and download the project. Open the status chart and force MBUS_CTRL Mode = 1.
3. Verify with the Modbus master that the Done bit cycles and the Error code is zero. The PAC values appear in VW200 to VW230 within 1 s.
4. Connect a Modbus service tool (for example SST MODBUS or the PAC configuration software) to the PAC meter and confirm that the meter is replying on the configured address and baud rate.
5. Power up the SINAUT MICRO SC server and check that the MD-720-3 establishes a GPRS link. The link LED turns solid and the server shows the S7-200 in the connected devices list.
6. Force a value in the S7-200 data block and confirm the change is visible in the OPC client within the configured refresh interval (typically 30 s to 1 min).
7. Record the RSSI (signal strength) reported by the MD-720-3. Plan the antenna location so that RSSI is greater than -85 dBm; below -95 dBm the GPRS link will be unreliable.
8. Disconnect the RS-485 cable to the PAC meter and confirm that the SCADA receives a "loss of communication" alarm within 60 s, validating the diagnostic path.

Troubleshooting Matrix

FAQ