Overview
Siemens LOGO! logic modules are compact, low-cost controllers used for small automation tasks. Starting with the LOGO! 8 (0BA8) series, the LOGO! Soft Comfort engineering environment exposes an S7 communication option that allows a LOGO! to act as an S7 client toward a higher-level HMI or SCADA. This works for discrete inputs, outputs, digital flags (Merker / M), counters, and timers - but reading Analog Merker (AM) values from a LOGO! through the S7 protocol is not natively supported by the area scan that most third-party S7 drivers (notably Inductive Automation Ignition) implement. This reference documents the documented workarounds, the Variable Block (VB) mechanism on the LOGO! side, the TSAP configuration, the resulting DB1 addressing pattern used by Ignition and Kepware, and the Modbus fallback path.
LOGO! Memory Architecture
The LOGO! programming environment exposes the following memory areas to user programs and to the S7 communication driver:
| Area | Prefix | Data Width | Typical Use | Direct S7 Read Support |
|---|---|---|---|---|
| Digital Inputs (I1 - I24) | I | Bit | Physical digital inputs | Yes (IX0.0 - IXx.y) |
| Digital Outputs (Q1 - Q20) | Q | Bit | Physical digital outputs | Yes (QX0.0 - QXx.y) |
| Digital Flags (M1 - M64) | M | Bit | Internal digital flags | Yes (MX0.0 - MXx.y) |
| Analog Inputs (AI1 - AI8) | AI | Word | Physical analog inputs | Partial / driver-dependent |
| Analog Outputs (AQ1 - AQ2) | AQ | Word | Physical analog outputs | Partial / driver-dependent |
| Analog Flags (AM1 - AM64) | AM | Word | Internal analog values, results of arithmetic blocks | Not natively scanned by Ignition S7 driver |
| Variable Memory (VW) | VW | Word | Volatile numeric scratch | Not exposed via S7 |
| Variable Block (VB1 - VB64) | VB | Byte / Word | Staging area for S7 read/write | Yes - only via the VB mechanism |
The asymmetry is important: the S7 protocol driver in Ignition (and the standard Siemens S7 driver that ships with most SCADA stacks) can browse the Inputs, Outputs, Flags, Data Blocks, Counters, and Timers areas. The Analog Merker (AM) range is not enumerated by the driver, which is why a tag request such as [LOGO]AM3 or [LOGO]MW0 mapped to AM3 returns an address-not-found error rather than a value.
S7 Protocol Limitations with LOGO!
LOGO! 8 / 9 devices ship with a subset of the S7-200 / S7-300 communication stack. The exposed areas are limited to what is documented in the LOGO! manual and the LOGO! Soft Comfort online help. The driver's item-path parser must match one of the supported address templates:
-
IX<byte>.<bit>for digital inputs -
QX<byte>.<bit>for digital outputs -
MX<byte>.<bit>for digital flags (Merker) -
DB<dbnr>,<area><offset>for Data Block access (DB1 is the only DB the LOGO! exposes for VB staging) -
C<n>/T<n>for counters / timers (driver-dependent)
No driver-side address syntax reads AM directly. The Ignition documentation states that the supported address areas are Inputs, Outputs, Flags, Data Blocks, Counters, Timers. The AM range is intentionally excluded because the LOGO! does not publish it through the S7 communication interface as a standalone accessible area.
Workaround: Variable Block (VB) Configuration on the LOGO!
LOGO! Soft Comfort provides a staging area called the Variable Block (VB). Each VB is a 16-bit word that the LOGO! can read or write from a program block (for example, an Analog Flag (AM) value) and that the S7 client can read or write through DB1. The mechanism is:
- In the LOGO! Soft Comfort program, add a numeric function block that computes or holds the value you want to expose (e.g. the AM3 output of an analog multiplexer or arithmetic block).
- Assign that block's reference to a Variable Block number (VB1 - VB64) using the block's Variable Name field. The reference stores the latest value of the AM into the VB on every scan.
- Enable S7 access on the LOGO! Tools → Ethernet Connections dialog. Right-click the LOGO! device, choose Allow S7 access as client from your server, then double-click the connection entry to open its properties.
- Configure the TSAP (Transport Service Access Point) for the server side. For an S7-300 / S7-400 / SoftPLC server the TSAP pair is typically
30.01; for a LOGO!-to-LOGO! direct connection the default is20.00; for an S7-200 server the default is also20.00. - Confirm the IP address of the S7 server is set correctly on the LOGO! client connection.
TSAP Configuration Reference
The TSAP is a two-byte hex identifier encoded as XX.YY where the first byte is the device type and the second is the rack/slot or local resource. Common values for LOGO! integrations:
| Server Type | TSAP | Notes |
|---|---|---|
| LOGO! default (LOGO!-to-LOGO! or LOGO!-to-S7-200) | 20.00 | LOGO! Soft Comfort default |
| S7-300 / ET200S | 30.01 | Rack 0 / Slot 1 - the most common configuration for a SoftPLC or S7-300 CPU used as the S7 server |
| S7-400 | 30.02 | Default slot 2 |
| S7-1200 / S7-1500 | 01.01 | Slot 1, project-defined |
| Custom S7 server / SoftPLC | 30.XX | Match the value configured in the server project |
The TSAP is negotiated during connection setup. If the LOGO! and the SCADA / SoftPLC disagree on the TSAP, the connection is rejected with a TSAP-not-found error and no tag reads succeed.
Ignition Tag Addressing for LOGO!
After the LOGO! has been configured with a Variable Block and S7 access enabled, Ignition's Siemens S7 driver can browse DB1 on the server. The driver presents the Variable Blocks as offsets inside DB1, but the index-to-offset mapping requires a non-obvious conversion:
-
VB1maps toDB1,DBB0(orDB1,I0when used in older Ignition item paths). -
VB2maps toDB1,DBB2(orDB1,I2). -
VB3maps toDB1,DBB4(orDB1,I4).
The pattern is offset = (VBn - 1) * 2 bytes, because each Variable Block is a 16-bit word. The comma followed by the letter I is a legacy item-path convention that the Ignition Siemens driver still accepts; the modern form is DB1,DBB<offset> for byte access or DB1,DBW<offset> for word access. Reading AM3 that is bound to VB2 in the LOGO! program is therefore:
Item Path: [LOGO]DB1,DBW2
Alternative: [LOGO]DB1,I2
The data type in Ignition should be set to Short (Int16) or Integer (Int32) depending on whether the upstream analog block produces a signed 16-bit value. If the AM value is interpreted as a percentage or scaled engineering value, configure the scaling in the Ignition tag properties rather than in the LOGO!.
Worked Example: Exposing AM3 via VB2
The following example documents the binding observed in a deployed system: a Siemens LOGO! 8 (0BA8 Standard) running LOGO! Soft Comfort V8.4, with an analog multiplexer whose AM3 output drives a Variable Block reference.
- In the LOGO! program, place the analog block and set the Reference to
VB2. Verify that the LOGO! program download completes without error. - Open Tools → Ethernet Connections, right-click the LOGO!, and select Allow S7 access as client from your server.
- Double-click the S7 client connection. In the Partner IP address field enter the SCADA / SoftPLC IP. In the Partner TSAP field enter the server TSAP, e.g.
30.01for an S7-300 SoftPLC. - Download the connection configuration to the LOGO!.
- In Ignition, configure the Siemens S7 driver connection: enter the LOGO! IP, slot 1, rack 0, and TSAP
20.00(LOGO! default) on the Ignition side. - Browse the device. The driver will show DB1 with bytes 0 - 127.
- Create an Ignition tag with the path
[LOGO]DB1,DBW2. Set data type toShort. Set scaling if the AM3 value is in 0 - 1000 range (raw LOGO! analog value).
Verification: a Force on T1 S7 test on the LOGO! side should produce a corresponding integer at the Ignition tag. Field-observed results: forcing T1 to 44 caused AM3 = 44 to appear at the DB1,DBW2 tag, confirming the binding.
Address Mapping Table
| LOGO! Symbol | Ignition Path (modern) | Ignition Path (legacy) | Width | Notes |
|---|---|---|---|---|
| I1 - I24 | IX0.0 - IXx.y | IX0.0 - IXx.y | Bit | Discrete inputs |
| Q1 - Q20 | QX0.0 - QXx.y | QX0.0 - QXx.y | Bit | Discrete outputs |
| M1 - M64 | MX0.0 - MXx.y | MX0.0 - MXx.y | Bit | Digital flags / Merker |
| AM1 | Not native | Not native | Word | Use VB1 workaround |
| AM2 | Not native | Not native | Word | Use VB2 workaround |
| AM3 | DB1,DBW2 | DB1,I2 | Word | Bound via VB2 |
| AM4 | DB1,DBW4 | DB1,I4 | Word | Bound via VB3 |
| VBn | DB1,DBW((n-1)*2) | DB1,I((n-1)*2) | Word | Direct S7 access path |
Modbus Fallback Path
If the S7 driver does not enumerate the AM area in your SCADA, or if the LOGO! is on a firmware that does not implement S7 access for the VB area, Modbus TCP is the documented fallback. LOGO! 8 / 9 supports Modbus TCP server on port 502 (configurable) and exposes the memory areas as Holding Registers. The relevant mapping for Analog Merker is:
| LOGO! Area | Modbus Address | Function Code | Notes |
|---|---|---|---|
| AM1 - AM64 | HR529 - HR592 (typical mapping) | FC03 (Read Holding Registers) | Address may vary by firmware; verify against the Modbus map in the LOGO! manual |
| AM3 (single tag) | HR531 (reported field example) | FC03 | Integer value, 16-bit signed |
| VW0 - VWn | HRxxxx | FC03 / FC06 / FC16 | Read/Write of variable words |
Step-by-Step: Ignition Configuration
- Open the Ignition Gateway Web UI and navigate to Config → Devices → Siemens.
- Create a new Siemens TCP device. Enter the LOGO! IP address, leave port at 102 (ISO-on-TCP), and set rack 0 / slot 1.
- In the device connection settings, set the local TSAP to
01.00and the remote (LOGO!) TSAP to20.00unless you have changed the LOGO! default. - Click Browse. The driver should return the standard areas (Inputs, Outputs, Flags, Data Blocks, Counters, Timers).
- Open the Data Blocks branch. DB1 should appear with byte offsets 0 - 127.
- Add a tag: Tag Path =
[LOGO]DB1,DBW2, Data Type =Short, Scale Mode = Linear if the value is in 0 - 1000 raw counts. - Add an OPC subscription on the tag and bind it to a display in the Ignition Vision / Perspective client.
Step-by-Step: LOGO! Soft Comfort Configuration
- Open the project in LOGO! Soft Comfort V8.x or later.
- Add the analog block whose AM3 output you want to expose. Wire its output to the input of a comparison or scaling block if needed.
- Click on the analog block, then in the Block Properties dialog, set the Variable field to a free VB (e.g.
VB2). The block's value is mirrored into VB2 on every scan. - Open Tools → Ethernet Connections. The LOGO! should appear with its IP address.
- Right-click the LOGO! and choose Enable S7 client access.
- Double-click the S7 client entry. Configure the partner IP and the partner TSAP (server). Click OK.
- Transfer the project to the LOGO! with PC → LOGO!.
- From the LOGO! front panel, navigate to Diagnostics → Ethernet Connections and confirm the S7 client connection is Established.
Verification
After the configuration is deployed, verify end-to-end communication with the following checks:
- LOGO! side: On the LOGO! display, enter Diagnostics → Ethernet Connections. The S7 client connection should report Established. If it shows Error, the TSAP is mismatched or the partner IP is unreachable.
- Ignition side: The tag quality indicator should show Good. If it shows Bad, the connection is open but the read is failing - typically an address-offset error.
- Live value test: In LOGO! Soft Comfort, use Online Test or a force on the analog block. The value should change at the Ignition tag within one scan cycle (typical 100 ms - 1 s depending on LOGO! scan time).
-
Kepware cross-check: If a Kepware server is available, add a Siemens TCP client channel and configure a tag at
DB1,DBW2. The value should match the Ignition read.
Troubleshooting Matrix
| Symptom | Likely Cause | Resolution |
|---|---|---|
| Ignition device browse returns no Data Blocks | S7 access not enabled on LOGO! | Enable Allow S7 access as client in Tools → Ethernet Connections |
| Connection shows Error in LOGO! diagnostics | TSAP mismatch | Verify partner TSAP on LOGO! matches server TSAP; default LOGO! TSAP is 20.00, S7-300 server TSAP is typically 30.01 |
Tag quality Bad on DB1,DBW2
|
Wrong offset - VB number off by one | Recompute offset = (VBn - 1) * 2; verify that the LOGO! program has the analog block bound to VB2 |
| AM value does not update in Ignition | Analog block not bound to a Variable Block in the LOGO! program | Edit the block properties and set the Variable field to a VB; transfer project |
Ignition returns Address not found for AM3
|
Direct AM addressing is not supported by the driver | Use the VB workaround and DB1,DBW offset; AM3 must be bound to VB2 first |
| Intermittent communication drops | LOGO! scan time too long; TCP keepalive misconfigured | Reduce the number of analog blocks per scan; enable TCP keepalive on the SCADA side |
| Modbus reads return wrong register | Register base off by one (1-based vs 0-based) | Subtract 1 from the manual's register number; verify with a known force value |
| Kepware reads correctly, Ignition does not | Ignition driver does not scan AM or VB area | Use the documented DB1 offset path on Ignition; do not rely on area browsing for AM |
Field-Proven Caveats
- The comma-I syntax (
DB1,I2) is a legacy item path. New Ignition OPC paths use theDB1,DBW<offset>form. Both resolve to the same physical word, but mixing them in the same project produces inconsistent browse results. - TSAP
20.00is the LOGO! default but is also the default for the S7-200. If your shop has a mix of LOGO! and S7-200 devices on the same SCADA, you may need to change the LOGO! TSAP to avoid collisions on the server. - The Ignition Siemens driver does not enumerate the AM area. Do not expect to see AM1 - AM64 in the address browser; they will not appear. Plan the VB bindings before commissioning to avoid runtime address-resolution failures.
- Each Variable Block binding consumes one VB slot (out of 64). Plan the binding carefully if you have more than 32 analog flags - the LOGO! is not designed for high-density analog exposure over S7.
- Modbus TCP can read AM directly without the VB workaround, but write support is limited. Use Modbus for read-only SCADA / HMI integrations and reserve S7 for read/write projects that need DB1 staging.
References to Official Documentation
The following Siemens resources describe the LOGO! memory model, the S7 client access option, and the Variable Block feature used in the workarounds above:
- LOGO! - Logic Modules for Everyday Automation (Siemens product family overview, including LOGO! 9 with built-in color touch display)
- LOGO! Manual (PDF, 0BA3 generation reference) (legacy device manual showing the original memory model)
- SIMATIC LOGO! Manual (PDF) (current LOGO! 8 / 9 manual with S7 access and Modbus mapping)
FAQ
Can the Ignition S7 driver read Analog Merker (AM) tags from a LOGO! directly?
No. The Ignition Siemens S7 driver enumerates Inputs, Outputs, Flags, Data Blocks, Counters, and Timers only. The AM range is not exposed by the LOGO! S7 stack and is not scanned by the driver. You must bind the AM value to a Variable Block (VB) in the LOGO! program and read it via DB1,DBW<offset>.
What is the correct item path in Ignition to read AM3 if AM3 is bound to VB2?
Use [device]DB1,DBW2 for the modern Ignition OPC path, or [device]DB1,I2 for the legacy comma-I form. The offset is (VBn - 1) * 2, so VB2 = byte offset 2. Set the tag data type to Short (Int16).
What TSAP do I configure on the LOGO! to talk to an S7-300 server?
Set the partner (server) TSAP to 30.01 for an S7-300 CPU or SoftPLC at rack 0, slot 1. The local LOGO! TSAP stays at the LOGO! default 20.00 unless you have multiple LOGO! / S7-200 devices on the same server - in that case change the LOGO! local TSAP to avoid collisions.
Can I use Modbus TCP instead of S7 to read AM values from a LOGO!?
Yes. LOGO! 8 and 9 support Modbus TCP server on port 502. AM1 - AM64 are mapped to holding registers in the FW-dependent Modbus map. A field-observed value is HR531 for AM3 on one firmware build - verify the exact register against the SIMATIC LOGO! Manual (PDF) for the firmware you have installed.
Why does Kepware read the analog value but Ignition shows the address as not found?
Kepware's Siemens TCP driver supports the AM and VB areas on the LOGO! in addition to the standard S7 areas. The Ignition driver does not. The fix is to use the documented VB / DB1 workaround rather than relying on direct AM addressing. If the project is read-only and Modbus is acceptable, switching to the Modbus fallback avoids the workaround entirely.