Siemens SENTRON PAC3200 Modbus Register Map and Simulator

The Siemens SENTRON PAC3200 is a panel-mounted power monitoring device that shows up across low-voltage switchboards in commercial buildings, data centers, and industrial plants. It measures everything a power dashboard needs and exposes it over Ethernet, including a standard Modbus TCP mode. If your SCADA, energy management system, or logging script needs to read one, this is the register map.

The offsets below come from Siemens' official SENTRON PAC3200 equipment manual (A5E01168664B), and the second half of the post shows how to simulate the full map on a Mac before you get access to the panel.

Overview: SENTRON PAC3200

The PAC3200 is a 96 mm panel device for single-phase, two-phase, and three-phase measurement in low-voltage distribution. It covers voltage, current, apparent, active, and reactive power per phase and as totals, power factor, frequency, THD-R for voltage and current, unbalance, plus a set of ten energy counters (active, reactive, and apparent, each with two tariffs). Siemens rates its energy measurement accuracy at 0.5% of the measured value.

Connectivity is Ethernet only. There is no RS485 port, so every integration is Modbus TCP over the plant network, which makes the PAC3200 a natural fit for the monitoring patterns in our Modbus TCP device monitoring guide.

Communication Setup

One thing trips up nearly everyone integrating a PAC3200: the Ethernet port's default protocol is SEAbus TCP, not Modbus TCP. Before any register reads work, you have to switch the protocol on the device (display menu: PROTOCOL entry, change SEAbus TCP to MODBUS TCP with F2, confirm with F4, then accept the restart prompt). Both protocols use TCP port 502; only the payload differs.

After the switch:

• Transport: Modbus TCP, port 502, unit ID per device configuration.
• Function codes: 0x03 (Read Holding Registers) and 0x04 (Read Input Registers) both work on all measured variables listed below.
• Data size: every measured variable in the main table occupies 2 registers (32-bit float). Energy counters are Double values occupying 4 registers.

The manual also warns that reads must start on a value boundary: issuing a read in the middle of a two-register value, or a write that ends mid-value, returns an error code rather than partial data.

PAC3200 Register Map: Measured Variables

Siemens documents these as offsets rather than register addresses; the offset is the first register of the value. All formats are Float (32-bit IEEE 754) unless noted. The manual's Table 3-6 lists roughly 70 variables; these are the ones most integrations actually poll.

Note what the PAC3200 gives you that cheaper meters do not: THD-R per phase, min/max registers for almost every variable (offsets 75 through 143), and demand values. If you are building power-quality dashboards, the THD and max/min blocks are worth polling alongside the basic measurements.

The energy counters sit at offsets 801 to 840 as 4-register Double values in Wh, varh, and VAh, with tariff 1 and tariff 2 variants. They are writable (RW), which is how meter resets are performed from software.

Data Types: Floats and 4-Register Doubles

The measured variables table is uniform: two registers per value, 32-bit IEEE 754 float. A phase A voltage of 230.5 V is 0x43668000 as a raw float. Which half lands in which register is the one thing the manual leaves to experimentation: Siemens does not document word order in Table 3-6, so poll one known value (frequency is a good candidate, it should sit between 45 and 65) and check whether the high word comes first. If the decoded value is off by orders of magnitude rather than slightly, recombine the words the other way; our byte order guide covers how to identify and fix that in one poll cycle.

The energy counters are different: a Double value spans four registers at offsets 801, 805, 809, and so on. Two things follow from that:

1. Read energy counters in their own request (or at least aligned to 4-register boundaries) so you never straddle a counter.
2. The manual documents an overflow at 1.0e+12 (in the unit shown, Wh), so compute your dashboard's rollover behavior once, not after the first decade of metering.

Testing Without Hardware: Simulating the PAC3200

A PAC3200 integration is pure TCP: your software connects to an IP, unit ID, and port. That makes it the easiest power meter to simulate faithfully, because the slave side needs no serial hardware at all.

• Manual register entry: a generic Modbus TCP slave can answer on the offsets above, but hand-populating 60+ float offsets and keeping them moving is exactly the tedious part.
• Custom device template: MacTools Modbus Poll runs a Modbus TCP slave on your Mac where you build a template from the offset table: add each offset as Float32, the energy counters at 801+ as 64-bit doubles, and the simulator populates them with realistic auto-drifting values. Your SCADA or logger connects to localhost:502 and cannot tell the difference from a real PAC3200's traffic pattern.

The template also doubles as your documentation of the map: once the offsets are entered once, the whole team can develop against the same simulated device.

Quick Start: Reading a PAC3200

1. Switch the protocol. On the device display, change PROTOCOL from SEAbus TCP to MODBUS TCP and let it restart. Skip this and every read times out.
2. Set the IP. Configure IP address, subnet, and gateway on the device or via your network's DHCP reservation.
3. Build or load your template. In MacTools Modbus Poll, enter the offsets from the table above (Float32; energy at 801+ as 4-register doubles) and start the slave on port 502.
4. Poll. Connect your master to the device (or localhost for the simulator), and read holding registers starting at offset 1 for about 70 registers to capture all per-phase and total values in one request.
5. Decode. Interpret each 2-register pair as IEEE 754 float32; interpret offsets 801 to 840 as 4-register double-precision values in Wh/varh/VAh.

Everything above translates 1:1 between the simulator and the physical device; only the target IP changes.

Frequently Asked Questions

Why won't my PAC3200 answer Modbus requests?

Most often the Ethernet port is still on its default SEAbus TCP protocol. Switch the device protocol to MODBUS TCP in the display menu, confirm the restart prompt, and poll again. Both protocols share port 502, so a connection success does not mean the payload is Modbus.

Which Modbus function codes does the PAC3200 support for measurements?

Function codes 0x03 (Read Holding Registers) and 0x04 (Read Input Registers) both work on all measured variables. Status parameters use 0x02, and settings and commands use 0x03, 0x04, and 0x10 per the manual.

Where are the energy registers on a PAC3200?

Energy counters start at offset 801: active energy import and export per tariff (offsets 801-816, Double, Wh), reactive energy (817-832, varh), and apparent energy (833-840, VAh). Each value spans four registers and overflows at 1.0e+12 in its unit.

What data types does the PAC3200 use?

All measured variables are 32-bit IEEE 754 floats spanning two registers. Energy counters are double-precision values spanning four registers. Reads must start on value boundaries or the device returns an error code.

Can I simulate a PAC3200 without the physical device?

Yes. Since the PAC3200 is Modbus TCP only, a Modbus TCP slave on your Mac with a custom template built from the manual's offset table reproduces the device's register behavior. MacTools Modbus Poll fills the template with realistic drifting values so your integration sees live-looking data.

Further Reading

• SENTRON PAC3200 register map with addresses, types and a Modbus Poll file
• Schneider PM5560 Modbus Register Map and Simulator
• Modbus Floating Point Byte Order: Fixing Garbage Values
• Modbus 32-Bit Integer Data Types Explained
• Best Modbus Simulator for macOS (2026)