SENTRON PAC3200 Modbus: Writing Register 60006 with Function Code 6

Field-procedure for resolving a persistent "failed to write address 60006" condition when communicating with a SENTRON PAC3200 power monitor from a SIMATIC S7-1200/1500 over Modbus TCP or Modbus RTU. Covers function code 06 selection, the TIA Portal wizard data type mapping, the SINGLE_WRITE parameter block setting, and the mandatory CPU STOP→RUN transition that clears status A006.

1. Problem Description and Field Symptoms

Engineers integrating a SENTRON PAC3200 power monitor with a SIMATIC S7 CPU frequently encounter a "failed to write address 60006" condition even though reads of nearby registers succeed without issue. The same user often can write to register 213 (a different function group) without incident, but the entire 6xxxx holding register range remains locked. The error persists regardless of data type selection (INT, WORD, REAL), byte order, or number of registers in the request.

Three independent conditions must be satisfied simultaneously to clear the error. Missing any one of them produces a different observable symptom:

The most common failure mode reported in the field is a successful MODBUS_PN connection (status A001) followed by status A006 on the first write attempt after a parameter DB modification. Engineers frequently interpret A006 as a generic error and waste hours tracing the network path before recognising the configuration-cache flag.

2. Root Cause Analysis

The SENTRON PAC3200 power monitor implements Modbus holding registers with a strict function-code policy: any single-register write to a 6xxxx address must use Modbus function code 6 (Write Single Register, FC06). A multiple-register write attempt using function code 16 (Write Multiple Registers, FC16) is rejected with an exception frame because the device interprets the FC16 payload as a multi-word burst that does not align with the underlying 16-bit register boundary or the device's transactional model.

The TIA Portal MODBUS_PN / MODBUS_RTU instruction exposes a SINGLE_WRITE boolean in its instance DB. The library honours this flag as follows:

This is the first of three required conditions. The second is a parameter-block mapping that must include the EA60–EA7F range (which contains 0xEA66 = 60006 decimal) under a configured data type. The third is a CPU STOP→RUN transition that flushes the instance-DB parameter cache into the active Modbus state machine.

3. SENTRON PAC3200 Modbus Addressing Scheme

The SENTRON PAC3200 maps its measurement and configuration parameters into a flat holding-register space addressed in hexadecimal. The "6xxxx" prefix used in the device manual is a Siemens documentation convention: the leading digit 6 is not a separate register bank but identifies the write-accessible side of the device's Modbus map. Reads use the same addresses with the standard 4xxxx function-code interpretation, while writes are referenced with the 6xxxx prefix in the manual.

Address 60006 in decimal corresponds to hexadecimal EA66. Verifying the conversion:

0xEA66 = 14×4096 + 10×256 + 6×16 + 6 = 57344 + 2560 + 96 + 6 = 60006

The full low-order 6xxxx range used by the PAC3200 is organised as follows (non-exhaustive extract; the full map is in the device operating instructions):

4. TIA Portal Modbus Library: Function Code Selection

The SIMATIC S7-1200/1500 Modbus library exposes two distinct instructions depending on the physical layer:

• MODBUS_PN — Modbus TCP access via the PROFINET interface of the CPU. The CPU acts as a Modbus client and reads/writes a third-party server (the PAC3200 with the optional Modbus TCP module fitted in the expansion slot).
• MODBUS_RTU (S7-1200) or MB_MASTER + MB_COMM_LOAD (S7-1500) — Modbus RTU access via a CM 1241 RS-485 module (e.g. 6ES7241-1CH30-1XB0) or a CM PtP module.

Both instructions share a common instance-DB structure for the parameter block. The most relevant fields for a single-register write to the PAC3200 are:

The SINGLE_WRITE tag is found inside the static section of the instruction's instance DB. In TIA Portal V15 and later, the tag can be exposed in the project tree under Program blocks > System blocks > [instance DB] > Static. The default value is FALSE, which causes the library to use FC16 even for a single-register write request. This is the most common cause of the initial "failed to write" error.

5. Parameter Block Mapping with the Wizard

Beyond function-code selection, the TIA Portal Modbus library requires the engineer to declare which address ranges are valid for the project. This is done either in the static section of the instance DB (manual configuration) or by running the Modbus configuration wizard in TIA Portal (recommended). The wizard generates up to eight mapping blocks, each of which describes a contiguous range of Modbus addresses and assigns them a data type.

The static block structure of the instance DB is approximately as follows (offsets vary slightly between TIA Portal versions and CPU firmware):

For the PAC3200 register 60006 (0xEA66), the recommended mapping is to cover the entire EA60–EA7F range (32 registers = 64 bytes) under a single data type block. The wizard will populate the following values:

• DATA_TYPE_8 = 3 (WORD)
• START_8 = W#16#EA60 (decimal 60000)
• END_8 = W#16#EA7F (decimal 60031)

This single mapping block covers 60006 and 32 other adjacent registers, so any later expansion of the project that needs to read or write registers in that neighbourhood will not require a parameter-DB edit (and therefore will not require a STOP→RUN transition). If the project only ever touches 60006, a tighter mapping of START_8 = EA66, END_8 = EA66 is acceptable, but the wider range is preferred for future-proofing.

6. Status Code A006 and the STOP→RUN Transition

The CPU-side status code A006 has a single, unambiguous meaning in the MODBUS_PN / MODBUS_RTU status vocabulary: "Configuration data has been modified; a STOP→RUN transition is required before the new connection parameters take effect." The status remains sticky until the transition occurs, even if the engineer has already saved, compiled, and downloaded the modified instance DB to the CPU.

The full status-code vocabulary for the Modbus TCP client covers the following relevant codes:

After any change to the instance DB — including toggling SINGLE_WRITE, adding or moving a DATA_TYPE_x block, or modifying START_x / END_x — the engineer must:

1. Compile the project.
2. Download the project to the CPU (full download, not just delta).
3. Switch the CPU mode selector to STOP and back to RUN (or use the online > "Restart" command in TIA Portal).
4. Verify that the STATUS word transitions from A006 to A001 on the first REQ pulse.

A STOP→RUN transition is not the same as a "warm restart" (OB100) in this context. The instruction's internal state machine reads its parameter block only on the STOP→RUN edge. A power-cycle is also acceptable but causes additional restart delay on the S7-1500 (up to 30 s for the display to come back).

7. Step-by-Step Configuration Procedure

Use the following procedure to commission a write path from a SIMATIC S7-1200 (firmware V4.4 or later) or S7-1500 (firmware V2.6 or later) to a SENTRON PAC3200 register 60006 over Modbus TCP. The same procedure, with the substitution of MODBUS_RTU / MB_MASTER for MODBUS_PN, applies to RS-485 networks.

7.1 Prerequisites

• SENTRON PAC3200 with the Modbus TCP expansion module fitted, powered and accessible on the plant network. Default IP: 192.168.1.10 (verify with the front-panel menu under Settings > Communication).
• SIMATIC S7-1200 (CPU 1215C DC/DC/DC, 6ES7215-1AG40-0XB0) or S7-1500 (CPU 1515-2 PN, 6ES7515-2AM02-0AB0) with PROFINET interface connected to the same subnet.
• TIA Portal V16 or later with the S7-1200 / S7-1500 support package installed.
• The "MODBUS_PN" library is shipped as part of the SIMATIC S7-1200 base library; no separate installation is required.

7.2 Configure the Connection Data Block

1. Create a new global DB named "PAC3200_Connection" based on the connection structure supplied with the Modbus library.
2. Enter the PAC3200 IP address in the RemoteAddress field and 502 in the RemotePort field.
3. Set ActiveEstablished = TRUE (the S7 CPU is the client).
4. Assign a unique connection ID (e.g. 1) and make a note of it; the same ID must not be used by any other MODBUS_PN instance.

7.3 Call the MODBUS_PN Instruction

1. Drag MODBUS_PN from the task card (Communication > Modbus) into OB1.
2. Assign a multi-instance DB or a dedicated instance DB (recommended name: "iDB_MODBUS_PN").
3. Wire the inputs:

   // MODBUS_PN call in OB1 (SCL)
   iDB_MODBUS_PN.REQ          := "gDB_Request".bWritePulse;   // BOOL rising edge
   iDB_MODBUS_PN.CONNECT      := "PAC3200_Connection";
   iDB_MODBUS_PN.MB_MODE      := 1;                            // write
   iDB_MODBUS_PN.MB_DATA_ADDR := 60006;                        // 0xEA66
   iDB_MODBUS_PN.MB_DATA_LEN  := 1;
   iDB_MODBUS_PN.MB_DATA_PTR  := P#"gDB_Data".wValue;          // WORD
   

7.4 Configure the Wizard Mapping

1. Open the instance DB "iDB_MODBUS_PN" in TIA Portal.
2. Navigate to the Static section and locate DATA_TYPE_1 through DATA_TYPE_8.
3. Set DATA_TYPE_8 = 3, START_8 = 16#EA60, END_8 = 16#EA7F. The other blocks can be left at zero or configured to cover the 4xxxx read-only register range used elsewhere in the project.
4. Compile the project.

7.5 Enable FC06 and Restart the CPU

1. In the same instance DB, set SINGLE_WRITE := TRUE in the static section.
2. Compile and download the project to the CPU.
3. Switch the CPU to STOP using the mode selector or the online > "Stop CPU" command.
4. Switch the CPU to RUN. The STATUS word should now transition from A006 to A001 within one OB1 cycle.

7.6 Execute a Test Write

1. Set "gDB_Data".wValue := 1 in a watch table or via the HMI.
2. Trigger "gDB_Request".bWritePulse for one cycle.
3. Monitor iDB_MODBUS_PN.STATUS:
   • W#16#0000 within 100 ms of a successful write — transaction complete.
   • W#16#A001 persistent — connection healthy but no active request; verify REQ pulse timing.
   • W#16#8381 — illegal data address; verify MB_DATA_ADDR against the PAC3200 manual.
4. Read back register 60006 (FC03) and confirm the value matches what was written.

8. Verification and Commissioning Tests

After the configuration is complete, execute the following test sequence from a watch table or HMI before declaring the write path operational:

Step 5 is the diagnostic that confirms the engineer's understanding of the SINGLE_WRITE flag. If toggling the flag from TRUE to FALSE does not produce a downstream error after the next write attempt, the instance DB was not properly re-compiled or the CPU has not yet picked up the static change.

For a Wireshark verification of the wire-level frame, filter on the PAC3200 IP and the Modbus TCP port (default 502). A correct FC06 write should contain a payload of the form 00 01 00 00 00 06 01 06 EA 66 00 01, where 06 is the function code and EA 66 is the register address in big-endian. An FC16 attempt will show function code 10 in the same position; the PAC3200 replies with exception frame 01 86 01 (function 0x86 = exception 0x06 with sub-code 0x01 in the Siemens reply convention).

9. Common Pitfalls and Field-Proven Caveats

9.1 The "0xEA" prefix is hexadecimal, not the same as decimal 60006 entered as raw

Engineers sometimes enter the address as W#16#0006 (decimal 6) instead of W#16#EA66 (decimal 60006) in the wizard's START_x field. The PAC3200 manual uses decimal addresses throughout, but the wizard's data type field expects a UINT that is compared against the address the library issues in the Modbus PDU. The library issues the value passed to MB_DATA_ADDR verbatim; if the engineer passes 60006 decimal, the Modbus TCP frame contains 0xEA66 as the starting address, and the PAC3200 expects to see this exact value. Always cross-check by enabling the diagnostic trace on the PROFINET interface and capturing the raw frame with Wireshark.

9.2 Data type 3 (WORD) versus data type 2 (INT) affects sign extension

If DATA_TYPE_8 = 2 (INT), the value 0x8000 is interpreted as -32768 on the S7 side, and the Modbus PDU carries 0x8000 as a 16-bit signed value. The PAC3200 typically interprets the same register as unsigned (0 to 65535). To avoid sign-related confusion, use DATA_TYPE_8 = 3 (WORD) for any register that the device documents as unsigned. The display range in TIA Portal is then -32768 to +32767 in the INT view or 0000 to FFFF in the HEX view, which matches the PAC3200 register documentation.

9.3 Avoid overlapping address blocks

Each Modbus address may be declared in only one DATA_TYPE_x block. If block 1 covers EA60–EA7F and block 8 also covers EA60–EA7F, the library will not raise a compile error but the runtime behaviour is undefined — the request may succeed, fail, or stomp on the previous value. Keep the mappings disjoint and document them in a separate Excel register sheet before the code is generated.

9.4 STOP→RUN is not the same as "Online > Download"

A runtime download in RUN mode (program modifications, PLC firmware updates via the SIMATIC Automation Tool) does not re-initialise the static section of the instance DB. The only operation that triggers a fresh read of the instance-DB parameter block by the Modbus state machine is a STOP→RUN transition. After any change to the SINGLE_WRITE tag, the engineer must use the mode selector or the online "Restart" command (not just "Download to device").

9.5 Port 502 may be blocked by plant firewalls

Modbus TCP defaults to TCP port 502, which is frequently blocked on segmented plant networks. If the connection refuses with STATUS = A007 (or W#16#80C4 on the S7-1500), capture the SYN packet with Wireshark to confirm the firewall is the source. Plant IT typically opens port 502 only on a dedicated VLAN; a common workaround is to map the PAC3200's Modbus TCP to a non-standard port via the device's front panel (Settings > Communication > Modbus TCP Port) and update the S7 connection block accordingly.

9.6 Multiple PAC3200 units require distinct connection IDs

The CONNECT data block's ID field must be unique per connection. Using the same ID for two MODBUS_PN instances causes the second one to return STATUS = A007 immediately. Allocate connection IDs 1, 2, 3, ... sequentially in the project.

9.7 Modbus RTU timing on RS-485

On RS-485 networks the Modbus RTU framing imposes a 3.5 character silent interval between frames. The CM 1241 RS-485 module (6ES7241-1CH30-1XB0) handles this automatically when the MB_DB block is configured for "Modbus Master" with a baud rate of 9600 or 19200 and 8E1 parity. If the PAC3200 is on a multi-drop bus, verify the bus termination is enabled on both ends and that no other master is contending for the line.

9.8 Diagnostic OB and OB100 fallback

If the application must keep running through the parameter-DB restart, configure an OB100 startup OB that re-applies the SINGLE_WRITE = TRUE and re-runs the wizard mapping on every cold restart. This does not eliminate the need for the STOP→RUN transition but it ensures the project survives a power-cycle cleanly. For applications that cannot tolerate even a one-cycle outage, deploy a redundant S7-1500R/H pair and toggle the primary CPU while the secondary continues to process the bus.

10. Cross-Platform Implementation Map

The TIA Portal workflow described above is specific to the SIMATIC S7-1200/1500. The same logical problem — register 60006 requires FC06, the address must be mapped in the instance DB, and a parameter change requires a controller restart — recurs on alternative platforms with their own equivalent constructs:

For the SENTRON PAC3200 specifically, the device's Modbus register map is documented in the SENTRON PAC3200 operating instructions on the Siemens Industry Online Support portal. The TIA Portal Modbus TCP block description is in the SIMATIC S7-1200 programmable controller system manual. The SENTRON PAC3200 product page and firmware notes are at the Siemens product catalogue.

For deeper commissioning notes, refer to the TIA Portal MODBUS_PN application example in the Siemens Industry Online Support entry for the S7-1200 Modbus TCP block. Engineers migrating from legacy STEP 7 V5.5 to TIA Portal should be aware that the legacy "Modbus Master" library (FB10 / FB11 / FB12) is functionally equivalent to MODBUS_PN in TCP mode, but the parameter block structure differs and cannot be copy-pasted between the two environments.

FAQ