Connecting Sentron PAC3200 to S7-1200 via Modbus TCP or PROFINET

Integration Problem Overview

Engineers integrating a Siemens Sentron PAC3200 power-monitoring device with a SIMATIC S7-1200 CPU 1212C frequently encounter a recurring question: which Ethernet interface on the PAC should be used, and is a managed switch mandatory? The PAC3200 ships with a single on-board Ethernet port labeled "X3 FOR LAN ONLY", which carries Modbus TCP and SEABus TCP traffic. PROFINET IO, by contrast, is not provided by the on-board port and is only available when the optional 7KM9300-0AE01-0AA0 Switched Ethernet PROFINET expansion module is fitted. Misidentifying the port is the most common root cause when TIA Portal cannot find the device or when the CPU cannot establish a connection. This reference gives you both the direct Modbus TCP path (no switch required) and the PROFINET IO path (expansion module required) with the full configuration sequence for each.

The key decision points are:

• Do you need full PROFINET IO integration in the TIA Portal device tree (cyclic process data, device diagnostics, GSD-based configuration)? If yes, the 7KM9300-0AE01-0AA0 module is mandatory.
• Do you need only a few measured values (voltage, current, power, energy) and prefer a low-effort integration? The on-board X3 port with Modbus TCP and an MB_CLIENT instruction in the S7-1200 is sufficient.
• Does your cabinet already contain a PROFINET managed switch and you want a clean star topology? The expansion module is the cleaner choice and lets you use shared device and port statistics.

Sentron PAC3200 Communication Interfaces

The PAC3200 is a compact, panel-mount multifunction power meter with a graphical LCD and a transparent front cover. It samples voltage and current up to the 63rd harmonic, computes active, reactive and apparent power, power factor, frequency, energy (import/export) and provides four-quadrant metering. For the purposes of this article, the only relevant features are its communication interfaces, which determine how the S7-1200 exchanges data with the meter.

When the PROFINET module is fitted, the on-board X3 port can be retained for parallel access (e.g. a higher-level energy-management system reading the same meter over Modbus TCP at the same time as the S7-1200 communicates PROFINET). This is a common configuration in sub-distribution panels where the meter is shared between the machine PLC and a building automation system.

Refer to the Sentron PAC3200 Operating Instructions for the full register map and the slot/IO layout when the PROFINET module is installed. The catalog number for the manual is in the Siemens Industry Online Support entry "Sentron PAC3200".

Hardware Topology, Cabling and Auto-Crossover

The S7-1200 CPU 1212C ships with one or two PROFINET interfaces (X1, and on selected CPUs an X2). The interface marked on the CPU as the PROFINET port is auto-crossover (Auto-MDI/MDIX), which means the controller will automatically detect whether the connected cable is straight-through (T-568A on both ends) or crossed (T-568A on one end, T-568B on the other). This is documented in section 11.2.9 of the S7-1200 System Manual. The auto-crossover feature is what allows a direct point-to-point link to the PAC3200 X3 port without an additional switch.

For the PROFINET path the topology looks different because the expansion module has two RJ45 sockets forming an internal switch. The module can therefore be daisy-chained to the next PROFINET device without an external switch, but most cabinet layouts still place a managed PROFINET switch at the head of the line for diagnostics and network separation.

Cable length limits follow the PROFINET copper rules: 100 m end-to-end segment (90 m solid-core trunk + 10 m patch), Cat 5e minimum, Cat 6/6A recommended for industrial installations with EMC exposure. For Modbus TCP, the same 100 m copper rule applies, and there is no timing constraint specific to the PAC3200 beyond typical Ethernet switch propagation delay.

Selecting the Right Integration Path

Use the following decision table to lock in the right path before you start the configuration. Re-selecting after a partial TIA Portal configuration will require removing the device from the project tree and re-adding it, which costs time and risks lost wiring documentation.

Method A — Modbus TCP via the X3 LAN Port (No Switch Required)

Prerequisites

• Sentron PAC3200 with the on-board X3 Ethernet port.
• SIMATIC S7-1200 CPU 1212C with PROFINET interface X1.
• One Cat 5e/6 patch cord (straight or crossed, either is fine because of auto-crossover on the CPU).
• PC with TIA Portal V16 or later for the engineering. (Earlier V15.1 + HSP0110 also works.)
• Static IP addresses for both stations in the same subnet, e.g. CPU = 192.168.0.10 / 24, PAC = 192.168.0.20 / 24.

PAC3200 Front-Panel IP Configuration

The PAC3200 does not have a web server enabled by default; the IP address, subnet mask and protocol are entered using the four-button keypad under the front cover. The exact menu structure depends on the firmware version of the meter, but the canonical sequence is:

1. Press the SET button until SETTINGS appears, then press the right arrow to enter.
2. Navigate to COMMUNICATION → ETHERNET → IP ADDRESS. Enter the octets with the up/down arrows and confirm each with OK.
3. Set SUBNET MASK to 255.255.255.0.
4. Set PROTOCOL to MODBUS TCP (SEABus TCP is also selectable but the S7-1200 implementation discussed here uses Modbus TCP).
5. Set MODBUS TCP PORT to 502 unless a corporate firewall requires a non-standard port.
6. Save with OK and exit. The PAC reboots the Ethernet interface; the link LED on the X3 socket should be solid green within a few seconds when the cable is connected.

TIA Portal Project Setup for the S7-1200

1. Open TIA Portal and create a new project. Add the CPU 1212C with the exact order number and firmware version present in the cabinet.
2. Open Device configuration and select the PROFINET interface X1. Set the IP address of the CPU to 192.168.0.10, subnet mask 255.255.255.0. Do not connect X1 to a PROFINET subnet in the TIA Portal sense — for Modbus TCP the connection is application-level and there is no PROFINET device relationship.
3. Make sure the Protection settings allow PUT/GET access if you also want to talk to the CPU from external tools.

Adding the Modbus TCP Library

The S7-1200 ships with the Modbus TCP library in TIA Portal. If you do not see MB_CLIENT and MB_SERVER in the instructions palette:

1. Open the Libraries task card on the right side of TIA Portal.
2. Browse to Global libraries → Documentation → Modbus and import the "Modbus TCP" library that ships with the TIA Portal installation, or download the latest version from Siemens Industry Online Support (search "S7-1200 Modbus TCP library").
3. Drag the MB_CLIENT FB into your program and the corresponding instance DB will be created automatically.

Sample SCL Implementation with MB_CLIENT

The following SCL block is a working skeleton that reads four 32-bit measured values from the PAC3200. Replace the placeholder MB_DATA_ADDR values with the actual register addresses from the Sentron PAC3200 Operating Instructions (the manual is the only authoritative source for the register map; the addresses below are intentionally left as comments for the engineer to populate).

FUNCTION_BLOCK "FB_PAC3200_ModbusPoll"
// Polls four 32-bit measured values from a Sentron PAC3200 over Modbus TCP
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
VAR
    // MB_CLIENT instance and connection parameters
    mb_client : "MB_CLIENT";
    ConnectID : BYTE := 1;
    IP1 : BYTE := 192; IP2 : BYTE := 168; IP3 : BYTE := 0; IP4 : BYTE := 20;
    Port : UINT := 502;
    UnitID : BYTE := 1;        // Modbus unit identifier; 1 is typical for a stand-alone PAC
    Busy : BOOL;
    Done : BOOL;
    Error : BOOL;
    Status : WORD;
    // Trigger and step
    Step : INT := 0;
    Req : BOOL;
END_VAR

VAR_TEMP
    tMode   : BYTE;
    tAddr   : WORD;
    tLen    : UINT;
END_VAR

BEGIN
    // Cycle through four read requests
    // Each step sets a different register range; replace the addresses with
    // the values from the Sentron PAC3200 Operating Instructions register map.
    CASE #Step OF
        0:
            #tMode := 0;            // 0 = read holding registers (function code 03)
            #tAddr := 16#0000;      // <-- Replace with PAC register for first value
            #tLen  := 2;            // 32-bit floating point occupies two 16-bit words
        1:
            #tMode := 0;
            #tAddr := 16#0000;      // <-- Replace with PAC register for second value
            #tLen  := 2;
        2:
            #tMode := 0;
            #tAddr := 16#0000;      // <-- Replace with PAC register for third value
            #tLen  := 2;
        3:
            #tMode := 0;
            #tAddr := 16#0000;      // <-- Replace with PAC register for fourth value
            #tLen  := 2;
        ELSE
            #tMode := 0;
            #tAddr := 16#0000;
            #tLen  := 0;
    END_CASE;

    // Issue the request when the previous transaction has finished
    IF NOT #Busy AND NOT #Req THEN
        #Req := TRUE;
    END_IF;

    // MB_CLIENT call
    #mb_client(
        REQ            := #Req,
        DISCONNECT     := FALSE,
        MB_MODE        := #tMode,
        MB_DATA_ADDR   := #tAddr,
        MB_DATA_LEN    := #tLen,
        CONNECT_ID     := #ConnectID,
        IP_OCTET_1     := #IP1,
        IP_OCTET_2     := #IP2,
        IP_OCTET_3     := #IP3,
        IP_OCTET_4     := #IP4,
        IP_PORT        := #Port,
        UnitID         := #UnitID,
        DONE           => #Done,
        BUSY           => #Busy,
        ERROR          => #Error,
        STATUS         => #Status
    );

    // Advance the step on successful completion
    IF #Done AND #Req THEN
        #Req := FALSE;
        #Step := (#Step + 1) MOD 4;
    ELSIF #Error AND #Req THEN
        #Req := FALSE;
        // Optionally raise a diagnostic bit or write #Status to a log tag
    END_IF;
END_FUNCTION_BLOCK

The MB_DATA_ADDR parameter is the zero-based Modbus address of the first holding register. The PAC3200 manual uses one-based register numbers, so subtract 1 when entering the address in TIA Portal. For floating-point values (IEEE 754 single precision) the byte order is "big-endian word swap" — i.e. word 0 holds the high 16 bits, word 1 holds the low 16 bits, and within each word the byte order is the standard Modbus big-endian. The S7-1200 will store the result in the configured target data block, and the engineer may need to swap bytes/words depending on the byte order documented in the meter manual.

Cyclic Polling Architecture

The MB_CLIENT instruction is a level-triggered command, not edge-triggered. The recommended pattern is to issue a one-shot REQ pulse, monitor BUSY rising, and advance the step on the DONE rising edge.

Engineers should observe that the response time of a Modbus TCP request on a direct link is dominated by the PAC3200 measurement update interval, which is typically 200 ms to 1 s depending on the harmonic bandwidth setting. Polling faster than the meter can update is wasteful; 500 ms to 1 s per transaction is a sensible default. For four values polled sequentially at 500 ms, the controller sees a value-refresh latency of about 2 s, which is acceptable for energy monitoring but too slow for closed-loop power control.

Method B — PROFINET IO via 7KM9300-0AE01-0AA0

Prerequisites

• Sentron PAC3200 with the 7KM9300-0AE01-0AA0 plug-in module fitted to the option slot on the back of the meter.
• SIMATIC S7-1200 CPU 1212C with PROFINET interface X1.
• TIA Portal V16 or later (HSP must match the TIA Portal version).
• Siemens Hardware Support Package (HSP) for the PAC3200 + 7KM9300 module, downloaded from Siemens Industry Online Support (search "Sentron PAC3200 HSP").
• A PROFINET managed switch (recommended but not strictly required for a single device).

Installing the PROFINET Module on the PAC3200

1. Power off the PAC3200 and remove the front cover.
2. Insert the 7KM9300-0AE01-0AA0 module into the option slot on the rear of the device. The module is keyed and only fits one way; do not force it.
3. Torque the two retaining screws per the manual. Re-apply power.
4. From the front panel, navigate to COMMUNICATION → PROFINET and verify the module is recognised. The PROFINET MAC address is printed on the module and is also visible in the meter display.

Installing the TIA Portal Hardware Support Package (HSP)

1. Open TIA Portal and select Options → Support Packages → Install. The dialog accepts HSP files in the Siemens .zip or .hsp format.
2. Browse to the HSP file you downloaded. After installation, TIA Portal lists the PAC3200 in the device catalog under Other field devices → Power monitoring → Sentron.
3. Restart TIA Portal if prompted. Do not skip this — the device catalog is built at startup.

Adding the PAC3200 to the TIA Portal Project

1. Open the Devices & Networks editor and switch to the network view.
2. Drag the PAC3200 from the catalog into the network. TIA Portal assigns a default PROFINET device name and IP address; you can keep these as placeholders and change them later.
3. Connect the PAC3200 to the S7-1200 PROFINET interface. TIA Portal establishes the controller — device relationship automatically.
4. Assign the PAC3200 to the same PROFINET subnet as the CPU. If you use a switch, both controller and device are connected to the switch port; the topology editor in TIA Portal mirrors the physical layout.

Assigning the PROFINET Device Name

PROFINET IO uses the device name (not the IP address) as the primary identifier. The CPU looks up the name in its configuration and matches it against the name programmed into the device. This is why the standard X3 port cannot be used for PROFINET IO — the port cannot store a PROFINET device name and is not visible in the Accessible nodes window as a PROFINET device. To assign the name:

1. In TIA Portal, right-click the PAC3200 in the project tree and select Assign device name.
2. Select the PROFINET interface that is physically connected to the PG/PC. Use the "Accessible nodes" button to flash the device LEDs; this is the only reliable way to identify the right device when several PACs sit on the same line.
3. Type the device name (e.g. pac3200-cabinet-1) and click Assign name. The PAC stores the name in non-volatile memory and uses it on every subsequent boot.

Configuring the IO Data Slots

The PROFINET module exposes measured values as input slots. The exact slot list is defined in the GSDML of the module; a representative PAC3200 slot layout (subject to the version of the GSDML you have installed) is shown below. Always verify the slot length and unit against the GSDML file shipped with the installed HSP.

Engineers can omit unneeded slots in the device configuration to reduce the IO cycle time. With all 14 slots enabled, the typical update time is 32 ms (default send clock 1 ms, reduction ratio 32). Disabling the energy slots (12 and 13) drops the cycle to about 16 ms, which is plenty for a soft-starter or a basic power-quality dashboard.

Verifying the Communication Link

Modbus TCP Verification

1. From the engineering PG/PC, ping the PAC3200 IP address. A reply confirms L1/L2 Ethernet and IP routing.
2. In TIA Portal, set a watchpoint on the Status output of MB_CLIENT. A value of 16#0000 indicates a clean transaction.
3. Read four holding registers with a Modbus test tool (e.g. modpoll on the PG/PC, or the in-built Modbus client in the PAC3200 web interface if enabled) and confirm the same values appear in the S7-1200 data block.
4. Power-cycle the PAC3200. The MB_CLIENT status should go to a transient error (e.g. 16#80C8 connection lost) and recover within a few seconds when the meter comes back online.

PROFINET Verification

1. Open Online & Diagnostics on the PAC3200 in TIA Portal. The device should report "PROFINET IO: no fault" and the link LEDs on the module should be solid green.
2. In the device view, expand the slots and add a watch table. Verify that the input values track the actual measured values on the PAC display.
3. Trigger a diagnostic interrupt by, for example, removing the voltage sensing fuse. The CPU should report a channel diagnostics alarm with a precise reason ("Overvoltage", "Phase sequence error", etc.).
4. Force a controller stop and start. The PROFINET connection should re-establish automatically with no manual re-assignment of the device name.

Diagnostic Tools and Error Codes

When the integration is silent, the engineer should be able to read the diagnostic code off the device and the S7-1200 simultaneously. The most common MB_CLIENT status codes and their meaning are:

For PROFINET, the diagnostics live in the I&M (Identification & Maintenance) data of the device and in the TIA Portal Online & Diagnostics view. PROFINET alarms come in three flavours: process alarms (rare on a power meter), diagnostic alarms (overvoltage, phase loss, CT reversed), and port-statistics alarms (link down, excessive CRC errors). The CPU can latch these alarms in the diagnostic buffer; the engineer should check the buffer when the IO unexpectedly drops out.

Troubleshooting Matrix

Wiring, Grounding and EMC Field Notes

Power meters sit at the boundary between the power circuit (potentially 400 V L-L) and the low-voltage signal network. The PAC3200 voltage inputs are designed for direct connection to 690 V L-L systems through internal voltage dividers; the current inputs require external CTs (1 A or 5 A secondary, depending on the model). The engineer should respect the following points at commissioning:

• Short the secondary of every current transformer before disconnecting the meter; an open CT secondary can develop lethal voltages.
• Use shielded twisted pair for the Ethernet run, grounded at the cabinet entry only, to avoid ground loops. Industrial Cat 6A S/FTP is recommended.
• Keep the Ethernet cable at least 200 mm away from VFD power cables and at least 100 mm from standard power wiring. Cross at 90° if intersection is unavoidable.
• Verify the PE connection of the PAC3200 is bonded to the cabinet PE bar. The meter's CE compliance assumes a low-impedance PE.
• If the meter is in a high-EMI environment (welding, large VFDs), add a ferrite on the Ethernet cable at the cabinet exit.

For PROFINET, the diagnostic buffer of the S7-1200 will record link-up/link-down events with timestamps. This is invaluable for proving to the customer that a transient drop was caused by a maintenance event and not by the meter or the PLC. Always enable the diagnostic buffer and export it as part of the commissioning report.

Frequently Asked Questions