SENTRON PAC3200 to WinCC Flexible via WiFi: Configuration Guide

System Overview

This reference documents the wireless integration of a Siemens SENTRON PAC3200 power meter, a Fatek FBs series PLC with built-in Ethernet, and SIMATIC WinCC Flexible Runtime running on an engineering laptop. Communication between the three devices is bridged by two TP-Link WiFi routers, and the host PC connects to the wireless network through its built-in WiFi adapter. The configuration pattern is generic and applies to any combination of Modbus TCP meters, Ethernet-capable PLCs, and PC-based HMI software that uses the Windows TCP/IP stack.

The end goal is to read three-phase voltage, current, active power, power factor, and energy values from the PAC3200, combine them with discrete and register data from the Fatek PLC, and surface the result on a WinCC Flexible screen that can be opened on a wireless laptop anywhere in the plant. WiFi is treated as a transparent Layer-2 bridge: the engineering PC, the PAC3200, and the Fatek PLC all share a single IP subnet, the WiFi adapters behave like Ethernet NICs from the perspective of WinCC Flexible, and the radio link is invisible to the application layer.

Network Architecture

The reference architecture places the PAC3200 and the Fatek PLC on a wired Ethernet segment that terminates at TP-Link Router A configured as a wireless access point. Router A bridges the wired segment onto the 2.4 GHz radio. A second router, TP-Link Router B, can be deployed as a wireless repeater or as a downstream access point on the same SSID to extend coverage. The engineering PC associates with the SSID using its built-in WiFi adapter, and WinCC Flexible Runtime opens TCP connections to the meter and the PLC exactly as it would on a wired LAN.

Prerequisites

Confirm each of the following before touching the radio link:

• SENTRON PAC3200 firmware 2.4.x or later with the Ethernet MODBUS TCP option installed. The integrated Ethernet port is the only one on the base unit; the PAC3200 does not have an RS-485 Modbus port on the same hardware revision used here. Reference the SENTRON PAC3200 manual on the Siemens Industry Online Support portal.
• Fatek FBs series PLC with the FBs-ECAT or FBs-TCP communications daughterboard. Verify that the slot is populated and that the LINK LED is on when the cable is plugged in. Use Fatek's official product page to confirm the exact daughterboard model number for your CPU.
• SIMATIC WinCC Flexible 2008 SP5 (or the latest available service pack). SP5 is the recommended baseline because earlier service packs have known issues with Windows 10/11 WiFi adapter binding.
• Fatek WinProladder V3.91 or later for offline Ethernet parameter configuration.
• Two TP-Link routers (TL-WR840N, TL-WR841N, TL-WR902AC or equivalent) that support Access Point mode and Repeater/Bridge mode on 2.4 GHz. Enterprise-class routers are not required for the testbed but are recommended for production.
• Static IP allocation capability — the PAC3200 and the Fatek PLC do not support DHCP for the meter channel used here, and the engineering PC must be assigned a fixed address to avoid WinCC Flexible losing its peer on lease renewal.
• Ping and Wireshark for the verification phase. WinCC Flexible's built-in channel diagnostics are useful but not sufficient to localize a TCP retransmit storm caused by a weak WiFi link.

IP Address Planning

Pick a private subnet that is not in use elsewhere in the plant. The reference design uses 192.168.10.0/24, which gives 254 usable addresses — more than enough for the meter, the PLC, two routers, and the engineering PC. The mask is 255.255.255.0.

TP-Link Router Configuration

Configure Router A in Access Point mode rather than router mode. In AP mode the device's WAN port is repurposed as a second LAN port, the DHCP server is disabled, and the radio is bridged onto the wired LAN. This produces a single Layer-2 domain, which is what the application layer expects.

1. Reset the router to factory defaults by holding the recessed RESET button for 8 seconds with the unit powered on.
2. Connect a configuration laptop to a LAN port on Router A and browse to 192.168.0.1 (the factory default). Log in with the printed admin password.
3. Switch the operating mode to Access Point from Operation Mode on the dashboard. The router will reboot with a new management address; consult the quick-start card for the exact value (commonly 192.168.10.1 on TL-WR902AC).
4. Disable the DHCP server. Static allocation is mandatory for the meter and the PLC, and the engineering PC is also static, so no DHCP service is required.
5. Set the SSID to PLANT_WIFI, the channel to 6 (or 11, depending on site survey), the channel width to 20 MHz, and the security mode to WPA2-PSK AES. Use a pre-shared key of at least 16 characters.
6. Connect the PAC3200 and the Fatek PLC Ethernet cables to the LAN ports of Router A. Verify that the LINK LEDs are solid on all three devices.

Configure Router B as a Repeater on the same SSID. On the TL-WR840N family this is Operation Mode → Range Extender. The repeater should be placed where the RSSI from Router A is at least −65 dBm — measured with a WiFi analyzer app — to avoid retransmit storms. Some TP-Link models require the repeater to use a different management IP on the same subnet; assign 192.168.10.2 and confirm that the repeater's built-in DHCP server is off.

Siemens SENTRON PAC3200 Configuration

The PAC3200 is configured through its on-device HMI: a four-button keypad on the front panel. Press the Menu button until Settings is highlighted, then enter the password (default 0000 on the field-installable firmware; production units ship with a customer-defined password — see the PAC3200 device manual).

1. Navigate to Communication → Ethernet → IP Address and set the value to 192.168.10.20.
2. Set Subnet Mask to 255.255.255.0 and Gateway to 192.168.10.1.
3. Confirm Modbus TCP Port is 502. The PAC3200 ships with this port enabled.
4. Set Modbus Unit ID to 1. WinCC Flexible's Modbus TCP driver defaults to unit ID 1; do not change it unless the wider plant assigns a different ID for the meter.
5. Save and reboot the meter. After reboot, verify the IP from the front panel by stepping into Information → Communication.

The PAC3200 exposes process data as 16-bit input and holding registers. The default register map — provided in the PAC3200/PAC4200 Modbus TCP communication manual — is the only one that WinCC Flexible's generic Modbus driver can address without a custom import file. The subset that engineers usually surface on the HMI is shown below.

Register addresses are zero-based in the PAC3200 manual. Modbus protocol itself is zero-based for the address field. WinCC Flexible's Modbus TCP driver can be configured to use either 0-based or 1-based addressing — leave it on the default 1-based (Modicon convention) and add 1 to each value shown above. The PAC3200 manual uses 0-based values; the WinCC Flexible tag should reference 2, 4, 6, 8, 10, 12, 26, 54, and 802 respectively.

Fatek PLC Ethernet Configuration

The Fatek FBs series uses its Ethernet daughterboard to expose the full register map (R, D, M, X, Y, S, T, C) over Modbus TCP on port 502. The default slave ID is 1. Configure the IP address in WinProladder → Project → PLC Ethernet Parameter Setting. The relevant fields are:

• IP Address: 192.168.10.30
• Subnet Mask: 255.255.255.0
• Gateway: 192.168.10.1
• TCP Port: 502 (the Fatek port is configurable; do not change it from 502 unless the wider Modbus network requires it)
• Communication Timeout: 3000 ms (a longer value is more forgiving of WiFi retransmits but slows down fault detection)

Write the new parameters to the PLC. The Ethernet port reboots in roughly 5 seconds; the LINK LED will blink twice to confirm the new address. The full register map and Modbus mapping rules are documented in the Fatek FBs series programming manual.

WinCC Flexible Runtime Configuration

WinCC Flexible supports the meter and the PLC through the Connections editor in the project tree. Two separate connections are defined, one per device, because the Modbus TCP driver instance is bound to a single remote endpoint. Open the project, double-click Connections, and add the entries below.

Tag addressing is then driven by the Modbus function code. For each process value define a tag with the parameters shown below; the tag's Acquisition mode must be Cyclical on the chosen polling cycle.

For the PAC3200 the function code column above corresponds to the Area dropdown in the tag properties: select Input Register (3x) for function code 0x04 and Holding Register (4x) for function code 0x03. The Modicon 1-based convention is preserved by the driver.

WiFi Adapter Configuration on the Engineering Station

The Windows WiFi adapter must be bound to the 192.168.10.0/24 subnet with a static address. WiFi is a Windows network adapter like any other — the application layer (WinCC Flexible Runtime) does not know or care that the link is wireless.

1. Open Control Panel → Network and Sharing Center → Change adapter settings. Right-click the WiFi adapter and select Properties → Internet Protocol Version 4 → Properties.
2. Select Use the following IP address and enter 192.168.10.100, mask 255.255.255.0, gateway 192.168.10.1.
3. Click Use the following DNS server addresses and leave the fields blank. DNS is not used by Modbus TCP and a misconfigured DNS server can slow the connection establishment.
4. Disable the Windows firewall or add a rule to allow inbound and outbound TCP/502 to 192.168.10.0/24. The Windows firewall, on a default install, blocks unsolicited inbound traffic but allows outbound — Modbus TCP is therefore usually not blocked outbound, but inbound WinCC Flexible diagnostic replies occasionally are. Be explicit.
5. Connect to the SSID PLANT_WIFI with the pre-shared key. Confirm a link speed of at least 65 Mbps and an RSSI of at least −65 dBm with netsh wlan show interfaces from a command prompt.

From the engineering PC, ping each device to verify the IP layer:

C:\> ping 192.168.10.20 -n 4
Pinging 192.168.10.20 with 32 bytes of data:
Reply from 192.168.10.20: bytes=32 time=8ms TTL=64
Reply from 192.168.10.20: bytes=32 time=11ms TTL=64
Reply from 192.168.10.20: bytes=32 time=9ms TTL=64
Reply from 192.168.10.20: bytes=32 time=10ms TTL=64

C:\> ping 192.168.10.30 -n 4
Pinging 192.168.10.30 with 32 bytes of data:
Reply from 192.168.10.30: bytes=32 time=6ms TTL=64
Reply from 192.168.10.30: bytes=32 time=7ms TTL=64
Reply from 192.168.10.30: bytes=32 time=5ms TTL=64
Reply from 192.168.10.30: bytes=32 time=8ms TTL=64

Typical round-trip time on a healthy 2.4 GHz link with 65 Mbps signal is 5-15 ms. A round-trip time above 50 ms or a packet loss above 1% is a WiFi problem, not a Modbus problem — fix the radio before changing any WinCC Flexible parameter.

Verification and Commissioning

Commission the system in this order. Each step has a deterministic pass/fail criterion, and the next step must not be attempted until the previous one is green.

1. Wired Ethernet test: connect the engineering PC directly to Router A's LAN port with a patch cable, disable the WiFi adapter, and run WinCC Flexible Runtime. Every tag in the project should update within the configured polling cycle. Leave the system running for 30 minutes and verify zero communication errors in the WinCC Flexible alarm log.
2. WiFi connectivity test: disconnect the patch cable, enable the WiFi adapter, associate with PLANT_WIFI, and verify the IP layer with ping as shown above. The ping must succeed with at least 95% packet success before any Modbus test is attempted.
3. Modbus TCP smoke test with a third-party client: install a free Modbus TCP client such as Modbus Poll (trial) or diagslave on the engineering PC. Connect to 192.168.10.20:502 and read registers 2, 8, 26-27, 54, and 802-803. Verify that the integer values match the values displayed on the PAC3200's own HMI. Repeat for 192.168.10.30:502 and a holding register such as D100 (Modbus address 4100).
4. WinCC Flexible Runtime test: start WinCC Flexible Runtime. The first screen should populate every tag within two polling cycles. Trigger a deliberate change (toggle a discrete input on the Fatek PLC, apply a known load on the meter) and verify the value updates.
5. Long-duration test: leave Runtime running for at least 24 hours. Capture Wireshark on the WiFi adapter to record TCP retransmit and connection-reset counters. A healthy link shows less than 0.1% retransmits and zero connection resets.

If any step fails, do not proceed to the next. Refer to the troubleshooting matrix in the next section.

Troubleshooting Matrix

Field-Commissioning Notes

• Channel selection on the 2.4 GHz band matters more than transmit power. In a plant with several WiFi networks, channels 1, 6, and 11 are the only non-overlapping options. Use a WiFi analyzer app to pick the quietest one.
• Static IPs are mandatory for the meter and the PLC. Both devices ignore DHCP offers, and a transient DHCP failure on the router can knock the engineering PC off the subnet for the duration of the lease negotiation.
• Modbus TCP is connectionless on the meter side. The meter accepts and closes TCP connections at will. WinCC Flexible reopens the connection after a configurable timeout; do not set the timeout below 5 s on a WiFi network.
• WinCC Flexible's diagnostic view is on the Tools → Status menu of Runtime. It shows connection state, last error, and tag freshness, but it does not show the underlying Modbus exception code. For exception codes 0x01 (illegal function), 0x02 (illegal data address), and 0x03 (illegal data value), use a third-party client.
• The Fatek FBs series uses 1-based Modbus addressing for the 0xxxx (Coil), 1xxxx (Input), 3xxxx (Input Register), and 4xxxx (Holding Register) areas. This matches WinCC Flexible's default Modicon convention and is the reason no address translation is needed beyond the 1-based offset.
• TP-Link repeaters halve the available bandwidth on the radio side. If a repeater is required to reach the engineering PC, expect roughly half the throughput and a corresponding doubling of round-trip time. If the long-duration test shows more than 1% retransmits, deploy a wired drop to the second AP rather than relying on a wireless backhaul.

FAQ