Configuring Siemens LOGO! Modbus Client for Holding Register Writes
Writing to Modbus register 40600 (often rendered as 406000 in legacy SCADA notation) from a Siemens LOGO! 8 controller is a common source of confusion because the leading digit "4" is misread as "Input Register." In reality, register 4xxxx indicates a Holding Register, which is fully read/write per the Modbus specification. This reference clears up the register-type confusion and walks through the complete configuration of a LOGO! Modbus client capable of writing single and multi-register float values to a third-party gas analyzer or similar Modbus server.
1. The Modbus Register Model
Modbus defines four reference types, each tied to specific function codes and access semantics. Confusing them is the single most common cause of failed writes.
| Prefix | Reference Type | Access | Read FC | Write FC | Typical Use |
|---|---|---|---|---|---|
| 0xxxxx | Output Coils | Read/Write | 01 | 05, 15 | Discrete Boolean outputs |
| 1xxxxx | Input Contacts | Read-Only | 02 | — | Discrete Boolean inputs |
| 3xxxxx | Input Registers | Read-Only | 04 | — | 16-bit measured values from field |
| 4xxxxx | Holding Registers | Read/Write | 03 | 06, 16 | Configuration, setpoints, control words |
The "406000" address from the original report is best interpreted as SCADA notation "4 / 0600" meaning Holding Register at address 600 (0x0258). Some SCADA packages encode node address and register number into the five-digit suffix, but the leading digit unambiguously selects the reference table.
2. Function Code Selection for Writes
Three function codes are relevant when a Modbus client (the LOGO!) must write to a server (the gas analyzer):
| FC (decimal) | FC (hex) | Name | Quantity | Data Size |
|---|---|---|---|---|
| 06 | 0x06 | Write Single Register | 1 register | 16-bit value |
| 16 | 0x10 | Write Multiple Registers | 1–123 registers | 16-bit values, contiguous |
| 23 | 0x17 | Read/Write Multiple Registers | Combined | Used for atomic R-M-W |
For a single 16-bit setpoint, FC 06 is the smallest payload and the safest choice. For a 32-bit IEEE-754 float such as the gas analyzer stream setpoint, FC 16 with a quantity of 2 registers must be used because the value spans two contiguous 16-bit registers. See the TOP Server Modbus function code reference and the FC 04 message structure example at Simply Modbus FC04 for the byte-level request and response framing.
3. Prerequisites
- Hardware: LOGO! 8 series with Ethernet — minimum 6ED1052-xxx08-0BA0 (LOGO! 8) or 6ED1052-xxx08-0BA1 (LOGO! 8.1). Full Modbus TCP client capability requires firmware FS04 (0BA8.FS04) or later, which corresponds to LOGO!Soft Comfort V8.2 or newer.
- Engineering software: LOGO!Soft Comfort V8.2 / V8.3 / V9.0 (current at time of writing). The Modbus client configuration tool is integrated into the network project editor.
- Network: Ethernet connection between LOGO! and the Modbus server (gas analyzer). Static IP addresses recommended; DHCP works but increases commissioning risk.
- Server documentation: Confirmed register map from the analyzer manufacturer, including which registers are read/write and the float byte order. Treat any register that the SCADA could write to as confirmed writable.
- Physical access: Ability to put the analyzer in remote/Modbus-control mode if the device has a local/remote lockout.
4. Register Address Mapping for the Gas Analyzer
From the source report, the SCADA writes a value (1–3 for stream selection) to S40600 as a float and reads status back from S403144. The notation decodes as follows:
| SCADA Tag | Modbus Address | Type | Access | Function Codes |
|---|---|---|---|---|
| S40600 | Holding Reg 600 (occupies 600–601) | 32-bit float | R/W | 03 read / 16 write (2 regs) |
| S403144 | Holding Reg 3144 (occupies 3144–3145) | 32-bit float | R | 03 read (2 regs) |
To write the value "2" (stream 2) to S40600, the LOGO! must convert the integer 2 to its IEEE-754 float representation (0x40000000), place it big-endian into two 16-bit registers (0x4000, 0x0000), and transmit FC 16 with starting address 599 (zero-based) and quantity 2. Because LOGO!Soft Comfort does not include a native float-from-int conversion block on the network side, the simplest approach is to write a fixed value via a numerical constant table or to use the VM (variable memory) area with a precomputed float image.
5. LOGO!Soft Comfort Project Configuration
5.1 Establish the Network Project
- Open LOGO!Soft Comfort and open the target
.lscproject (or create a new one for the LOGO! 8 module). - From the menu, select Tools → Ethernet Connections to open the network editor.
- Add the LOGO! as a Modbus client (master). The server (gas analyzer) is added as a Modbus server node. Confirm the LOGO! role — it must be client because it initiates writes.
- Assign static IP addresses: LOGO! (e.g., 192.168.0.10), Analyzer (e.g., 192.168.0.50). Subnet 255.255.255.0. Confirm both respond to ping from a laptop before continuing.
5.2 Configure the Modbus Client Block
In the FBD/LAD editor, place a Network Analog Input or Network Analog Output block from the network library, depending on whether you want to read or write:
- For a write of a setpoint to register 600, use a Network Analog Output block bound to the Modbus server node.
- For a read of status from register 3144, use a Network Analog Input block bound to the same node.
Configure each block's properties:
| Parameter | Write Block (Output) | Read Block (Input) |
|---|---|---|
| Server IP | 192.168.0.50 | 192.168.0.50 |
| Server Port | 502 | 502 |
| Unit ID | 1 (or as required by analyzer) | 1 |
| Data Mapping | ||
| Function Code | 16 (Write Multiple Regs) | 03 (Read Holding Regs) |
| Register Address | 600 (zero-based) or 601 (1-based, see note) | 3144 |
| Quantity | 2 (float occupies 2 regs) | 2 |
| Data Type | Float (32-bit) | Float (32-bit) |
5.3 Source the Float Value
Because stream selection only ever needs values 1, 2, or 3, the cleanest implementation is to precompute the IEEE-754 bit patterns and store them in a lookup table driven by an integer tag in the LOGO! program:
| Stream Index (Integer) | IEEE-754 Bits (Hex) | Word 0 (High) | Word 1 (Low) |
|---|---|---|---|
| 1 | 0x3F800000 | 0x3F80 | 0x0000 |
| 2 | 0x40000000 | 0x4000 | 0x0000 |
| 3 | 0x40400000 | 0x4040 | 0x0000 |
For a simpler approach with a single static setpoint, use an Analog Multiplexer block whose outputs are the three constant float values defined via the constant editor, then route the selected output to the Network Analog Output block.
5.4 Trigger the Write
LOGO! network write blocks operate in cyclic or change-triggered mode. For setpoint commands, configure the block as on change so the analyzer is not flooded with redundant writes. Trigger the change with a positive edge from a digital input or a flag set when the operator selects a new stream.
6. Verification Procedure
- Watch the LOGO! diagnostic LED. A solid or blinking pattern on the Ethernet LED confirms link; an error LED pattern indicates a configuration or connection fault.
- Enable online monitor in LOGO!Soft Comfort (Tools → Online → Start Online Test or F5). Observe the value at the output of the Network Analog Output block. A "---" or 0 reading indicates the write did not complete.
- Use an independent Modbus scanner. Run a laptop with Modbus Poll or QModMaster on the same subnet. Poll Holding Register 600. Confirm the value matches what LOGO! sent.
- Verify on the analyzer HMI. The local display on the gas analyzer should show stream 1, 2, or 3 selected after the LOGO! write completes.
- Check the LOGO! system log. If firmware logs are accessible via the LOGO! web server (FS05 and later), inspect for connection-drop entries.
7. Troubleshooting Matrix
| Symptom | Likely Root Cause | Remedy |
|---|---|---|
| Write returns no response (timeout) | Wrong IP, wrong port, firewall | Ping server, verify port 502 open, check switch VLAN |
| Write returns exception code 02 (Illegal Data Address) | Address out of range or wrong table | Confirm register exists in analyzer map; ensure 4xxxx not 3xxxx |
| Write returns exception code 03 (Illegal Data Value) | Quantity or byte count mismatch | For floats, set quantity = 2 and byte count = 4 |
| Write returns exception code 04 (Slave Device Failure) | Analyzer rejected command (lockout, bad value) | Put analyzer in remote mode; verify stream 1–3 valid |
| Write "succeeds" but value does not change | Byte-swapped float | Swap Word 0/Word 1 in the constant block |
| Write succeeds first time, then fails | Connection not closed by LOGO! | Verify FS04+ firmware; older FS03 has known TCP leak |
| Read works but write does not | Write FC disabled by server firmware | Confirm register is R/W in vendor docs; some "setpoints" are read-only after calibration lock |
8. Safety and Operational Caveats
- Process safety: Stream selection on a gas analyzer may be safety-significant. Implement a confirmation step (operator HMI button + second press) before the LOGO! writes the value.
- Fallback: Always preserve the SCADA manual path as a fallback during commissioning. Disabling the SCADA write while LOGO! is being tested prevents two masters from fighting for the same register.
- Firmware updates: Verify the exact LOGO! firmware before commissioning. Siemens has shipped multiple Modbus behavior fixes across FS01–FS06. Check the Siemens Industry Online Support portal for the latest firmware and release notes for your specific 6ED1052 order number.
- Network isolation: Place the LOGO! and analyzer on a dedicated VLAN or subnet. Modbus TCP has no authentication; any device on the broadcast domain can write to Holding Registers.
- Endianness documentation: Some analyzers call byte-swapped floats "Motorola" vs "Intel" order. Always verify against the vendor's specific register map PDF, not a generic Modbus reference.
9. Alternative Master Choices
If the LOGO!'s network block proves too limited (e.g., a project needs many different floats to be written under program logic), consider these alternatives:
- S7-1200 with MB_CLIENT: Native Modbus TCP instructions in TIA Portal with explicit byte-order control.
- LOGO! 8.3 (0BA8.FS5) with custom VM scripting: The newer firmware exposes UDFs that can construct FC 16 payloads byte-by-byte.
- External protocol converter: A gateway such as the HMS Anybus or Phoenix Contact FL WLAN EPA writes the Holding Registers on behalf of the LOGO!.
10. FAQ
Can a LOGO! write to a Modbus Input Register (3xxxxx)?
No. Per the Modbus specification, Input Registers are read-only by definition and no standard function code exists to write them. The leading digit of a Modbus address selects the table — "3" means read-only, "4" means Holding Register and is the correct address for any setpoint you intend to change from the LOGO!.
Which function code should I use to write a single 16-bit value?
Use Function Code 06 (Write Single Register). It carries exactly one 16-bit value and is the smallest, most efficient payload. Use FC 16 only when writing two or more contiguous registers — for example, a 32-bit float that occupies a register pair.
How does the LOGO! write a 32-bit float when each register is only 16 bits?
Modbus registers are always 16-bit words. A 32-bit IEEE-754 float spans two consecutive registers (e.g., 600 and 601 for tag S40600). The LOGO! network analog block configured as Float with quantity 2 will issue FC 16 writing both words in big-endian order. Confirm with the analyzer vendor whether byte-swapping is required.
What firmware does the LOGO! need for Modbus TCP client writes?
LOGO! 8 (6ED1052-xxx08-0BA0) and later support Modbus TCP. Reliable client operation, including write commands, is documented from FS04 firmware onward. Use LOGO!Soft Comfort V8.2 or newer to configure the network project, and consult the Siemens Industry Online Support site for the latest firmware release notes for your exact module.
The SCADA writes fine but the LOGO! write returns exception 04 — what now?
Exception code 04 (Slave Device Failure) means the analyzer rejected the command at an application level, not at the protocol level. Common causes are: the analyzer is in local mode (not remote), the requested stream number is invalid, or a calibration lock is preventing setpoint changes. Put the device in remote/Modbus mode and verify the value range against the vendor's register map.