Overview of Third-Party HMI Integration with LOGO! 8
The Siemens LOGO! 8 is a compact logic module that doubles as a passive S7 server on Ethernet. The onboard RJ45 interface runs an ISO-on-TCP stack (RFC 1006) on TCP port 102 and exposes a fixed, S7-200-compatible data image. This allows any third-party HMI that supports the Siemens S7-200 ISO-on-TCP driver (Delta DOPSoft, Weintek EasyBuilder, Pro-face GP-Pro EX, Beijer iX Developer, and similar) to read and write LOGO! tag data without custom drivers or vendor gateways.
Unlike a full S7-1500 or S7-1200 CPU, the LOGO! 8 cannot be configured as an S7 client, cannot change its own TSAP, and does not host a project-side connection list. Every incoming connection is accepted at a single fixed TSAP 11.00 on rack 0 / slot 0. The third-party HMI is the only side that must be configured. This article documents the exact protocol parameters, the LOGO! 8 data-area mapping, a Delta DOPSoft walkthrough, firmware-compatibility caveats (especially across the LOGO! 8.2 FS revisions), and the fallback to Modbus TCP introduced in firmware 8.2 and later.
6ED1052-1MD00-0BA8, firmware 1.81.03, programmed with LOGO!Soft Comfort V8.2. The same procedure applies to every LOGO! 8 variant with the Ethernet suffix RCE, RCEo, or CE (6ED1052-1xx08-0BAx and 6ED1052-2xx08-0BAx series).Prerequisites — Hardware, Software, and Network
| Item | Specification / Version | Notes |
|---|---|---|
| LOGO! 8 base module | 6ED1052-1MD00-0BA8 (12/24 RCE) or any 6ED1052-1/2xx08-0BAx variant | Must include integrated Ethernet (CE/RCE/RCEo) |
| LOGO! firmware | ≥ 1.81.01 (LOGO! 8.2 FS04 or later recommended) | S7 server is available in all LOGO! 8.x; Modbus TCP requires ≥ 1.82.01 |
| LOGO!Soft Comfort | V8.0 or later (V8.2 used here) | Used to set the IP address and to download the program |
| Third-party HMI | Delta DOP-100 / DOP-W series with DOPSoft 4.0 (or later) | Any HMI supporting Siemens S7-200 ISO-on-TCP driver |
| Ethernet switch / cable | Cat-5e or better, 100 Mbit/s | LOGO! 8 only supports 10/100 Mbit/s half/full duplex |
| IP plan | LOGO! and HMI in the same /24 subnet, no router hop required | LOGO! cannot route; S7 connection is local-subnet only |
Before any handshake is attempted, both nodes must ping each other. The LOGO! responds to ICMP echo as soon as a valid IP is set, even with an empty circuit program.
LOGO! 8 S7 Server Architecture and ISO-on-TCP Stack
The LOGO! 8 implements the S7-200 communication model on top of the standard Siemens ISO-on-TCP stack. The stack is bound to TCP port 102 and accepts connections on a single local TSAP. The server accepts S7 0x04 read, 0x05 write, and the 0x1A/B/C PUT/GET user-data function groups, exactly the same set a real S7-200 CPU exposes.
- Role: S7 server only (no client, no routing)
- Transport: ISO-on-TCP / RFC 1006, TPKT on TCP 102
-
Default TSAP:
11.00(hex) — rack 0, slot 0 of an S7-200 - Max concurrent connections: 8 (4 S7 + 4 Modbus, shared pool)
- Max PDU length: 240 bytes user data per read/write
-
Available data areas:
I,Q,M,V/VM,AI,AQ,SM
Because the LOGO! 8 cannot act as a client, the HMI is the only side that initiates the connection, which is why the HMI's TSAP (the remote TSAP from the LOGO!'s point of view) is freely chosen by the HMI project. The HMI's own local TSAP must be set to 11.00 if you want to use the S7-200 PPI-over-Ethernet driver, but the more common S7-200 ISO-on-TCP driver used by Delta DOPSoft simply lets the HMI assign a unique local TSAP (e.g. 01.00) and a remote TSAP of 11.00.
S7 Protocol Primitives — TPKT, COTP, and S7 PDU
Engineers troubleshooting connection failures should recognise the three layered headers that the LOGO! 8 expects on port 102. Captures with Wireshark using the s7comm dissector make problems obvious.
The HMI driver handles TPKT, COTP-CR/CC, and S7 header formation internally. From the HMI engineer perspective you only set the IP, port, rack, slot, and TSAPs — the rest is automatic.
TSAP Addressing Matrix and Default Port
| Parameter | LOGO! 8 default | HMI side (Delta DOPSoft example) | Notes |
|---|---|---|---|
| IP address | Set in Tools → Ethernet in LOGO!Soft Comfort | Same subnet, static recommended | No DHCP server discovery — assign a fixed address |
| Subnet mask | 255.255.255.0 | 255.255.255.0 | /24 only is supported in the LOGO! web UI |
| Default gateway | 0.0.0.0 (off-subnet comm not supported) | Optional | LOGO! does not route; cross-subnet traffic is impossible |
| TCP port | 102 |
102 |
Fixed; cannot be changed on either side |
| Local TSAP (LOGO! side) | 11.00 |
Enter as Remote TSAP = 11.00
|
Rack 0, slot 0 — read-only on LOGO! |
| Remote TSAP (HMI side) | N/A (server) | Enter as Local TSAP = any unused TSAP, e.g. 01.00 or 02.00
|
Must be unique per HMI if multiple HMIs share the LOGO! |
| Max simultaneous partners | 4 S7 + 4 Modbus | Up to 4 S7 partners | LOGO! firmware rejects connection 9+ |
11.00. The HMI will work, but if you later add a second HMI you will see duplicate TSAP errors. Give every HMI its own local TSAP (e.g. 01.00 for HMI 1, 02.00 for HMI 2).LOGO! 8 Data Area Mapping (I, Q, M, V/VM, AI, AQ)
The LOGO! 8 exposes an S7-200-compatible data image. VM (Variable Memory) is the “bulk” area and is what HMI tag lists should target for most read/write work. The addresses below are byte offsets in the V area unless noted.
| Area | S7 range | Width | LOGO! source | Comment |
|---|---|---|---|---|
| Digital inputs |
I0.0 … I7.7 / IB0…IB7
|
8 bytes | LOGO! I1…I8 + extension modules | Mirrored at VB0…VB1 as well |
| Digital outputs |
Q0.0 … Q3.7 / QB0…QB3
|
4 bytes | LOGO! Q1…Q4 | Q4…Q7 reserved on 12/24 RCE; ignored by firmware |
| Analog inputs | AIW0…AIW14 |
8 words | LOGO! AI1…AI8 | 12-bit values, scaled 0…1000 in LOGO! and 0…27648 in S7 view |
| Analog outputs | AQW0…AQW2 |
2 words | LOGO! AQ1…AQ2 | Available only on 0BA8 “AQ” variants |
| Internal flags |
M0.0 … M7.7 / MB0…MB7
|
8 bytes | LOGO! M1…M27 (27 flag bytes) | Read/write without program download |
| Variable Memory |
V0.0 … V849.7 / VB0…VB849 / VW0…VW848
|
850 bytes | LOGO! VM mapping table | Primary HMI tag area; covers inputs, outputs, and function-block state |
| Special markers |
SM0.0…SM0.7 (first byte only) |
1 byte | LOGO! status word | Read-only; bit 0 = always-ON, bit 1 = first-scan |
The first 26 bytes of V memory are the “image” area used by LOGO!Soft Comfort when a tag is dragged from the editor onto the network. For most projects you only need to address VM offsets at or above byte 26 for user-level function-block parameters. The actual offset for each function block is published in the LOGO! 8 system manual and printed in the Block properties → VM mapping dialog of LOGO!Soft Comfort.
Example VM assignments for a typical project:
| Block | VM offset (byte) | Meaning | S7 view (word) |
|---|---|---|---|
| B001 — Threshold trigger | 26 | Input value (AI1) | VW26 |
| B002 — Threshold trigger | 32 | Output of hysteresis | V32.0 |
| B003 — PI controller | 40 | Setpoint / process value |
VW40, VW42
|
| B006 — Up/Down counter | 56 | Counter value (CV) | VW56 |
| B011 — Hour counter | 78 | Actual time value |
VW78 (seconds) |
Word-aligned access (VW) is required for any value above 8 bits; the LOGO! firmware rejects misaligned reads with an S7 error code 0x0A (“object does not exist”).
Configuring a Third-Party HMI — Delta DOPSoft Step-by-Step
The following example uses Delta DOPSoft 4.0 with the Siemens S7-200 (ISO-on-TCP) driver, which is the same driver that works for any S7-200-compatible server including the LOGO! 8. The procedure is identical in EasyBuilder, GP-Pro EX, and iX Developer — only the menu names change.
- Create the project in DOPSoft and open Options → Communication Settings.
- Click New and set:
- Type:
Ethernet - PLC series:
Siemens - Driver:
S7-200 ISO-on-TCP
- Type:
- Set the network parameters:
Field Value HMI IP 192.168.0.50 (same subnet as LOGO!) LOGO! IP 192.168.0.10 (set in LOGO!Soft Comfort → Tools → Ethernet) Port 102 Local TSAP (HMI) 01.00 Remote TSAP (LOGO!) 11.00 Rack / Slot 0 / 0 - Click Test. A green status with Connected means TPKT, COTP-CR/CC, and S7 setup PDU all succeeded.
- Add tags. For a digital output on LOGO! Q1 use
Q0.0(read-only) or write through the VM mirror atV2.0. For a counter value at VM offset 56 useVW56. - Build the screen and download to the HMI. Watch the LOGO! ETH LED — it blinks on every successful PDU exchange.
11.00. The S7-200 driver accepts it, but if a second HMI uses the same value the connection from HMI 2 will be rejected by the LOGO! 8 with no diagnostic — the failure looks like a timeout.Firmware Compatibility Matrix — LOGO! 8.0 through 8.3
| LOGO! version | MLFB suffix | FS state | Firmware range | S7 server | Modbus TCP (port 502) | S7 > 4 partners | Notes |
|---|---|---|---|---|---|---|---|
| LOGO! 8.0 | ...-0BA0 | FS01 | 0.x … 1.80.xx | Yes | No | No | Initial release; S7 only |
| LOGO! 8.1 | ...-0BA1 | FS02 | 1.80.xx | Yes | No | No | Web server added |
| LOGO! 8.2 | ...-0BA2 | FS03 | 1.81.01 … 1.81.03 | Yes | Yes | No | Modbus TCP introduced; the MLFB in this article is in this FS |
| LOGO! 8.2 (refresh) | ...-0BA2 | FS04 | 1.81.03 … 1.81.05 | Yes | Yes | No | Bug fixes to S7 handshake; recommended for third-party HMI |
| LOGO! 8.3 | ...-0BA3 | FS05+ | 1.82.xx and later | Yes | Yes | No | Same protocol surface; new analog scaling |
The most common compatibility complaint — that “the connection worked on LOGO! 7 but not on LOGO! 8.2 FS04” — is almost always a stale S7 setup PDU field that the new firmware validates strictly. Upgrading to LOGO!Soft Comfort V8.2 SP1 or later forces the driver to send the new header, which clears the issue.
Modbus TCP Fallback Path
For HMIs that cannot speak S7 at all, the LOGO! 8 from firmware 1.81.x onward exposes a Modbus TCP server on TCP port 502. The server is a Modbus “slave” (server) with the following fixed register map:
| Modbus address | Type | LOGO! source | Read / Write |
|---|---|---|---|
| 00001…00008 | Coil (0x) | Digital inputs I1…I8 | Read-only |
| 00009…00016 | Coil (0x) | Digital outputs Q1…Q8 | Read |
| 00017…00044 | Coil (0x) | Flags M1…M28 | Read/write |
| 40001…40008 | Holding Reg. (4x) | Analog inputs AI1…AI8 | Read-only |
| 40009…40010 | Holding Reg. (4x) | Analog outputs AQ1…AQ2 | Read/write |
| 40011…40435 | Holding Reg. (4x) | VM words VW0…VW848 | Read/write |
Select Modbus TCP/IP in the HMI driver list, enter the LOGO! IP and port 502, set the unit ID to 1 (LOGO! always uses unit 1), and the same VM offsets that you would have used via S7 are now available as 4x holding registers — e.g. 40011 is the same data as VW0 in the S7 view.
Verification, LED Diagnostics, and Connection Tests
After configuration, walk through this checklist:
- LINK LED on LOGO! — solid green. Confirms physical Ethernet.
- ETH LED — blinking green on every S7 request. If steady OFF, the LOGO! never saw a connection request — check IP/port/TSAP on the HMI.
-
Web UI — open
http://<LOGO_IP>and log in. The Connections tab shows the HMI IP and TSAP for every active S7 partner. - HMI status bar — DOPSoft shows “PLC COM: OK” in the bottom-right corner. Weintek shows a green plug icon in the system bar.
- Read/write test — force a known output from the HMI. LOGO! Q1 should energise within 100–300 ms. Latency above 500 ms usually means heavy broadcast traffic on the switch; segregate the LOGO! into a VLAN.
Troubleshooting Matrix — Common Faults and Remedies
| Symptom | Most likely cause | Verify | Remedy |
|---|---|---|---|
| HMI shows “PLC no response” | Wrong IP, port blocked, or VLAN mismatch | Ping LOGO! from HMI subnet; check switch port | Set fixed IP; open TCP 102; remove ACL |
| TPKT connect, COTP aborts | Wrong TSAP combination | Wireshark capture: COTP-CR → DR | Set HMI local TSAP to a unique value, remote to 11.00
|
| Connected but reads return 0 | Tag uses V-bit address, value lives in V-word | Check VW vs V0.0; check offset in LOGO!Soft Comfort VM map | Use the VM word offset that the function block actually occupies |
S7 error 0x0A on a VW access |
Misaligned read or out-of-range VM offset | Calculate byte offset ÷ 2 = word offset | Round to even byte address; cap at VW848 |
| Connected for ~30 s, then drops | Connection limit reached; or HMI polling too fast | Web UI → Connections count | Reduce HMI poll rate to 500 ms; remove zombie clients |
| Only one HMI can connect at a time | Both HMIs use the same local TSAP | Driver settings → Local TSAP | Give HMI 2 a different local TSAP (e.g. 02.00) |
| Read works, write appears ignored | Writing to a read-only mirror (I, AI) | Cross-check with LOGO!Soft Comfort VM map | Write to the user VM range (VW26+) instead of the input mirror |
| LOGO! ETH LED never blinks after link up | HMI configured for S7-300/400 (rack 0 / slot 2) | Driver settings → Slot | Change slot to 0 (S7-200 emulation) |
| Modbus works, S7 fails | HMI firewall on port 102 only | Test with mbpoll -m tcp -t0 and s7comm wireshark |
Allow port 102 outbound from the HMI |
Frequently Asked Questions
What TSAP does a Siemens LOGO! 8 use for S7 communication?
The LOGO! 8 always presents a single fixed S7 server TSAP of 11.00 (hex) on rack 0, slot 0, on TCP port 102. The third-party HMI uses that value as its remote TSAP and may assign any free TSAP (typically 01.00) as its local TSAP.
Which LOGO! 8 firmware versions support Modbus TCP?
Modbus TCP on port 502 was introduced in LOGO! 8.2 firmware 1.81.01 (FS03) and is present in every later release including 1.81.03 and all 1.82.x versions. The S7-200 ISO-on-TCP server is available on every LOGO! 8.x release from 0BA0 onward.
How do I read a function-block parameter (for example, a counter value) from a third-party HMI?
Open the block in LOGO!Soft Comfort and read the VM mapping field. Use that byte offset as a VW word in the S7 view (e.g. counter value at VM offset 56 → VW56) or as Modbus holding register 40011 + (offset/2).
Why can my Delta HMI connect to a S7-1200 but not to a LOGO! 8 with the same settings?
The S7-1200 uses an S7-300/400-style slot (rack 0 / slot 1) and a different TSAP scheme. Switch the HMI driver to Siemens S7-200 ISO-on-TCP, change slot to 0, and set the remote TSAP to 11.00; the LOGO! 8 will then accept the connection with no changes on the LOGO! side.
Can I connect more than one HMI to the same LOGO! 8?
Yes, up to four S7 partners and four Modbus partners concurrently. Each HMI must use a unique local TSAP (e.g. 01.00, 02.00); the LOGO! remote TSAP remains 11.00 for all of them. The LOGO! web UI (Connections tab) shows the live partner list and any rejected duplicates.
Does the LOGO! 8 need any project-side configuration to accept a third-party S7 connection?
No. The S7 server is enabled out of the box on every LOGO! 8 with an Ethernet interface. The only project-side setting is the LOGO! IP address, configured under Tools → Ethernet in LOGO!Soft Comfort. No connection list, no PUT/GET enable, and no security password is required for the standard S7-200 driver.
What is the maximum PDU size I can read or write in a single request?
The LOGO! 8 S7 server accepts user-data PDUs up to 240 bytes. A single VW read of 1 word uses 2 bytes; a block read of 64 words uses 128 bytes and is well within the limit. Polling 850 bytes of VM in one shot is not recommended — split it into two 240-byte reads to keep the LOGO! cycle responsive.