Configuring Siemens LOGO! S7 Tags for Analog Merkers

David Krause14 min read
HMI / SCADASiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

Siemens LOGO! logic modules are compact, low-cost controllers used for small automation tasks. Starting with the LOGO! 8 (0BA8) series, the LOGO! Soft Comfort engineering environment exposes an S7 communication option that allows a LOGO! to act as an S7 client toward a higher-level HMI or SCADA. This works for discrete inputs, outputs, digital flags (Merker / M), counters, and timers - but reading Analog Merker (AM) values from a LOGO! through the S7 protocol is not natively supported by the area scan that most third-party S7 drivers (notably Inductive Automation Ignition) implement. This reference documents the documented workarounds, the Variable Block (VB) mechanism on the LOGO! side, the TSAP configuration, the resulting DB1 addressing pattern used by Ignition and Kepware, and the Modbus fallback path.

Scope: This article covers LOGO! 0BA8 / LOGO! 8 and LOGO! 9 devices (0BA9) configured with LOGO! Soft Comfort V8.x and later. Earlier 0BA0 - 0BA7 hardware does not implement the S7 client / server stack described here.

LOGO! Memory Architecture

The LOGO! programming environment exposes the following memory areas to user programs and to the S7 communication driver:

Area Prefix Data Width Typical Use Direct S7 Read Support
Digital Inputs (I1 - I24) I Bit Physical digital inputs Yes (IX0.0 - IXx.y)
Digital Outputs (Q1 - Q20) Q Bit Physical digital outputs Yes (QX0.0 - QXx.y)
Digital Flags (M1 - M64) M Bit Internal digital flags Yes (MX0.0 - MXx.y)
Analog Inputs (AI1 - AI8) AI Word Physical analog inputs Partial / driver-dependent
Analog Outputs (AQ1 - AQ2) AQ Word Physical analog outputs Partial / driver-dependent
Analog Flags (AM1 - AM64) AM Word Internal analog values, results of arithmetic blocks Not natively scanned by Ignition S7 driver
Variable Memory (VW) VW Word Volatile numeric scratch Not exposed via S7
Variable Block (VB1 - VB64) VB Byte / Word Staging area for S7 read/write Yes - only via the VB mechanism

The asymmetry is important: the S7 protocol driver in Ignition (and the standard Siemens S7 driver that ships with most SCADA stacks) can browse the Inputs, Outputs, Flags, Data Blocks, Counters, and Timers areas. The Analog Merker (AM) range is not enumerated by the driver, which is why a tag request such as [LOGO]AM3 or [LOGO]MW0 mapped to AM3 returns an address-not-found error rather than a value.

S7 Protocol Limitations with LOGO!

LOGO! 8 / 9 devices ship with a subset of the S7-200 / S7-300 communication stack. The exposed areas are limited to what is documented in the LOGO! manual and the LOGO! Soft Comfort online help. The driver's item-path parser must match one of the supported address templates:

  • IX<byte>.<bit> for digital inputs
  • QX<byte>.<bit> for digital outputs
  • MX<byte>.<bit> for digital flags (Merker)
  • DB<dbnr>,<area><offset> for Data Block access (DB1 is the only DB the LOGO! exposes for VB staging)
  • C<n> / T<n> for counters / timers (driver-dependent)

No driver-side address syntax reads AM directly. The Ignition documentation states that the supported address areas are Inputs, Outputs, Flags, Data Blocks, Counters, Timers. The AM range is intentionally excluded because the LOGO! does not publish it through the S7 communication interface as a standalone accessible area.

Workaround: Variable Block (VB) Configuration on the LOGO!

LOGO! Soft Comfort provides a staging area called the Variable Block (VB). Each VB is a 16-bit word that the LOGO! can read or write from a program block (for example, an Analog Flag (AM) value) and that the S7 client can read or write through DB1. The mechanism is:

  1. In the LOGO! Soft Comfort program, add a numeric function block that computes or holds the value you want to expose (e.g. the AM3 output of an analog multiplexer or arithmetic block).
  2. Assign that block's reference to a Variable Block number (VB1 - VB64) using the block's Variable Name field. The reference stores the latest value of the AM into the VB on every scan.
  3. Enable S7 access on the LOGO! Tools → Ethernet Connections dialog. Right-click the LOGO! device, choose Allow S7 access as client from your server, then double-click the connection entry to open its properties.
  4. Configure the TSAP (Transport Service Access Point) for the server side. For an S7-300 / S7-400 / SoftPLC server the TSAP pair is typically 30.01; for a LOGO!-to-LOGO! direct connection the default is 20.00; for an S7-200 server the default is also 20.00.
  5. Confirm the IP address of the S7 server is set correctly on the LOGO! client connection.
Field note: Without enabling Allow S7 access as client and assigning a TSAP, the LOGO! will not respond to S7 read requests on the configured port (default ISO-on-TCP port 102), and the SCADA will time out trying to open a connection.

TSAP Configuration Reference

The TSAP is a two-byte hex identifier encoded as XX.YY where the first byte is the device type and the second is the rack/slot or local resource. Common values for LOGO! integrations:

Server Type TSAP Notes
LOGO! default (LOGO!-to-LOGO! or LOGO!-to-S7-200) 20.00 LOGO! Soft Comfort default
S7-300 / ET200S 30.01 Rack 0 / Slot 1 - the most common configuration for a SoftPLC or S7-300 CPU used as the S7 server
S7-400 30.02 Default slot 2
S7-1200 / S7-1500 01.01 Slot 1, project-defined
Custom S7 server / SoftPLC 30.XX Match the value configured in the server project

The TSAP is negotiated during connection setup. If the LOGO! and the SCADA / SoftPLC disagree on the TSAP, the connection is rejected with a TSAP-not-found error and no tag reads succeed.

Ignition Tag Addressing for LOGO!

After the LOGO! has been configured with a Variable Block and S7 access enabled, Ignition's Siemens S7 driver can browse DB1 on the server. The driver presents the Variable Blocks as offsets inside DB1, but the index-to-offset mapping requires a non-obvious conversion:

  • VB1 maps to DB1,DBB0 (or DB1,I0 when used in older Ignition item paths).
  • VB2 maps to DB1,DBB2 (or DB1,I2).
  • VB3 maps to DB1,DBB4 (or DB1,I4).

The pattern is offset = (VBn - 1) * 2 bytes, because each Variable Block is a 16-bit word. The comma followed by the letter I is a legacy item-path convention that the Ignition Siemens driver still accepts; the modern form is DB1,DBB<offset> for byte access or DB1,DBW<offset> for word access. Reading AM3 that is bound to VB2 in the LOGO! program is therefore:

Item Path:  [LOGO]DB1,DBW2
Alternative: [LOGO]DB1,I2

The data type in Ignition should be set to Short (Int16) or Integer (Int32) depending on whether the upstream analog block produces a signed 16-bit value. If the AM value is interpreted as a percentage or scaled engineering value, configure the scaling in the Ignition tag properties rather than in the LOGO!.

Worked Example: Exposing AM3 via VB2

The following example documents the binding observed in a deployed system: a Siemens LOGO! 8 (0BA8 Standard) running LOGO! Soft Comfort V8.4, with an analog multiplexer whose AM3 output drives a Variable Block reference.

  1. In the LOGO! program, place the analog block and set the Reference to VB2. Verify that the LOGO! program download completes without error.
  2. Open Tools → Ethernet Connections, right-click the LOGO!, and select Allow S7 access as client from your server.
  3. Double-click the S7 client connection. In the Partner IP address field enter the SCADA / SoftPLC IP. In the Partner TSAP field enter the server TSAP, e.g. 30.01 for an S7-300 SoftPLC.
  4. Download the connection configuration to the LOGO!.
  5. In Ignition, configure the Siemens S7 driver connection: enter the LOGO! IP, slot 1, rack 0, and TSAP 20.00 (LOGO! default) on the Ignition side.
  6. Browse the device. The driver will show DB1 with bytes 0 - 127.
  7. Create an Ignition tag with the path [LOGO]DB1,DBW2. Set data type to Short. Set scaling if the AM3 value is in 0 - 1000 range (raw LOGO! analog value).

Verification: a Force on T1 S7 test on the LOGO! side should produce a corresponding integer at the Ignition tag. Field-observed results: forcing T1 to 44 caused AM3 = 44 to appear at the DB1,DBW2 tag, confirming the binding.

Address Mapping Table

LOGO! Symbol Ignition Path (modern) Ignition Path (legacy) Width Notes
I1 - I24 IX0.0 - IXx.y IX0.0 - IXx.y Bit Discrete inputs
Q1 - Q20 QX0.0 - QXx.y QX0.0 - QXx.y Bit Discrete outputs
M1 - M64 MX0.0 - MXx.y MX0.0 - MXx.y Bit Digital flags / Merker
AM1 Not native Not native Word Use VB1 workaround
AM2 Not native Not native Word Use VB2 workaround
AM3 DB1,DBW2 DB1,I2 Word Bound via VB2
AM4 DB1,DBW4 DB1,I4 Word Bound via VB3
VBn DB1,DBW((n-1)*2) DB1,I((n-1)*2) Word Direct S7 access path

Modbus Fallback Path

If the S7 driver does not enumerate the AM area in your SCADA, or if the LOGO! is on a firmware that does not implement S7 access for the VB area, Modbus TCP is the documented fallback. LOGO! 8 / 9 supports Modbus TCP server on port 502 (configurable) and exposes the memory areas as Holding Registers. The relevant mapping for Analog Merker is:

LOGO! Area Modbus Address Function Code Notes
AM1 - AM64 HR529 - HR592 (typical mapping) FC03 (Read Holding Registers) Address may vary by firmware; verify against the Modbus map in the LOGO! manual
AM3 (single tag) HR531 (reported field example) FC03 Integer value, 16-bit signed
VW0 - VWn HRxxxx FC03 / FC06 / FC16 Read/Write of variable words
Verify the register base: The exact starting register of the AM area in the LOGO! Modbus map depends on the firmware version. The LOGO! Manual (PDF) and the SIMATIC LOGO! Manual (PDF) list the Modbus register map. The example value HR531 for AM3 is a field-observed value and must be re-validated against the manual that ships with the firmware on the device.

Step-by-Step: Ignition Configuration

  1. Open the Ignition Gateway Web UI and navigate to Config → Devices → Siemens.
  2. Create a new Siemens TCP device. Enter the LOGO! IP address, leave port at 102 (ISO-on-TCP), and set rack 0 / slot 1.
  3. In the device connection settings, set the local TSAP to 01.00 and the remote (LOGO!) TSAP to 20.00 unless you have changed the LOGO! default.
  4. Click Browse. The driver should return the standard areas (Inputs, Outputs, Flags, Data Blocks, Counters, Timers).
  5. Open the Data Blocks branch. DB1 should appear with byte offsets 0 - 127.
  6. Add a tag: Tag Path = [LOGO]DB1,DBW2, Data Type = Short, Scale Mode = Linear if the value is in 0 - 1000 raw counts.
  7. Add an OPC subscription on the tag and bind it to a display in the Ignition Vision / Perspective client.

Step-by-Step: LOGO! Soft Comfort Configuration

  1. Open the project in LOGO! Soft Comfort V8.x or later.
  2. Add the analog block whose AM3 output you want to expose. Wire its output to the input of a comparison or scaling block if needed.
  3. Click on the analog block, then in the Block Properties dialog, set the Variable field to a free VB (e.g. VB2). The block's value is mirrored into VB2 on every scan.
  4. Open Tools → Ethernet Connections. The LOGO! should appear with its IP address.
  5. Right-click the LOGO! and choose Enable S7 client access.
  6. Double-click the S7 client entry. Configure the partner IP and the partner TSAP (server). Click OK.
  7. Transfer the project to the LOGO! with PC → LOGO!.
  8. From the LOGO! front panel, navigate to Diagnostics → Ethernet Connections and confirm the S7 client connection is Established.

Verification

After the configuration is deployed, verify end-to-end communication with the following checks:

  1. LOGO! side: On the LOGO! display, enter Diagnostics → Ethernet Connections. The S7 client connection should report Established. If it shows Error, the TSAP is mismatched or the partner IP is unreachable.
  2. Ignition side: The tag quality indicator should show Good. If it shows Bad, the connection is open but the read is failing - typically an address-offset error.
  3. Live value test: In LOGO! Soft Comfort, use Online Test or a force on the analog block. The value should change at the Ignition tag within one scan cycle (typical 100 ms - 1 s depending on LOGO! scan time).
  4. Kepware cross-check: If a Kepware server is available, add a Siemens TCP client channel and configure a tag at DB1,DBW2. The value should match the Ignition read.

Troubleshooting Matrix

Symptom Likely Cause Resolution
Ignition device browse returns no Data Blocks S7 access not enabled on LOGO! Enable Allow S7 access as client in Tools → Ethernet Connections
Connection shows Error in LOGO! diagnostics TSAP mismatch Verify partner TSAP on LOGO! matches server TSAP; default LOGO! TSAP is 20.00, S7-300 server TSAP is typically 30.01
Tag quality Bad on DB1,DBW2 Wrong offset - VB number off by one Recompute offset = (VBn - 1) * 2; verify that the LOGO! program has the analog block bound to VB2
AM value does not update in Ignition Analog block not bound to a Variable Block in the LOGO! program Edit the block properties and set the Variable field to a VB; transfer project
Ignition returns Address not found for AM3 Direct AM addressing is not supported by the driver Use the VB workaround and DB1,DBW offset; AM3 must be bound to VB2 first
Intermittent communication drops LOGO! scan time too long; TCP keepalive misconfigured Reduce the number of analog blocks per scan; enable TCP keepalive on the SCADA side
Modbus reads return wrong register Register base off by one (1-based vs 0-based) Subtract 1 from the manual's register number; verify with a known force value
Kepware reads correctly, Ignition does not Ignition driver does not scan AM or VB area Use the documented DB1 offset path on Ignition; do not rely on area browsing for AM

Field-Proven Caveats

  • The comma-I syntax (DB1,I2) is a legacy item path. New Ignition OPC paths use the DB1,DBW<offset> form. Both resolve to the same physical word, but mixing them in the same project produces inconsistent browse results.
  • TSAP 20.00 is the LOGO! default but is also the default for the S7-200. If your shop has a mix of LOGO! and S7-200 devices on the same SCADA, you may need to change the LOGO! TSAP to avoid collisions on the server.
  • The Ignition Siemens driver does not enumerate the AM area. Do not expect to see AM1 - AM64 in the address browser; they will not appear. Plan the VB bindings before commissioning to avoid runtime address-resolution failures.
  • Each Variable Block binding consumes one VB slot (out of 64). Plan the binding carefully if you have more than 32 analog flags - the LOGO! is not designed for high-density analog exposure over S7.
  • Modbus TCP can read AM directly without the VB workaround, but write support is limited. Use Modbus for read-only SCADA / HMI integrations and reserve S7 for read/write projects that need DB1 staging.

References to Official Documentation

The following Siemens resources describe the LOGO! memory model, the S7 client access option, and the Variable Block feature used in the workarounds above:

FAQ

Can the Ignition S7 driver read Analog Merker (AM) tags from a LOGO! directly?

No. The Ignition Siemens S7 driver enumerates Inputs, Outputs, Flags, Data Blocks, Counters, and Timers only. The AM range is not exposed by the LOGO! S7 stack and is not scanned by the driver. You must bind the AM value to a Variable Block (VB) in the LOGO! program and read it via DB1,DBW<offset>.

What is the correct item path in Ignition to read AM3 if AM3 is bound to VB2?

Use [device]DB1,DBW2 for the modern Ignition OPC path, or [device]DB1,I2 for the legacy comma-I form. The offset is (VBn - 1) * 2, so VB2 = byte offset 2. Set the tag data type to Short (Int16).

What TSAP do I configure on the LOGO! to talk to an S7-300 server?

Set the partner (server) TSAP to 30.01 for an S7-300 CPU or SoftPLC at rack 0, slot 1. The local LOGO! TSAP stays at the LOGO! default 20.00 unless you have multiple LOGO! / S7-200 devices on the same server - in that case change the LOGO! local TSAP to avoid collisions.

Can I use Modbus TCP instead of S7 to read AM values from a LOGO!?

Yes. LOGO! 8 and 9 support Modbus TCP server on port 502. AM1 - AM64 are mapped to holding registers in the FW-dependent Modbus map. A field-observed value is HR531 for AM3 on one firmware build - verify the exact register against the SIMATIC LOGO! Manual (PDF) for the firmware you have installed.

Why does Kepware read the analog value but Ignition shows the address as not found?

Kepware's Siemens TCP driver supports the AM and VB areas on the LOGO! in addition to the standard S7 areas. The Ignition driver does not. The fix is to use the documented VB / DB1 workaround rather than relying on direct AM addressing. If the project is read-only and Modbus is acceptable, switching to the Modbus fallback avoids the workaround entirely.

Back to blog