Connecting Siemens LOGO! 8 (0BA8) to a Remote SCADA Over the Public Internet

This reference covers the engineering of a multi-site monitoring solution that aggregates 4 to 25 Siemens LOGO! 8 (0BA8) controllers, distributed across physically separate facilities, into a single central SCADA or HMI station. The reference design is built for slow-changing process variables (e.g. water salinity, level, temperature) where a polling interval of 1-10 s is acceptable and a small percentage of dropped samples is tolerable.

Three primary integration paths are documented: the LOGO! internal web server, the LOGO! Web Editor (LWE) extended web server, and direct S7 communication over a VPN tunnel. Each path is sized for cost, security, and engineering effort.

1. Network Architecture Overview

The base problem topology is N geographically separated sites, each containing one LOGO! 8, and one central site containing a SCADA server. The only path between the sites is the public internet (WAN). A direct LAN-to-LAN packet exchange is impossible because both endpoints sit behind NAT routers in private address space (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). To bridge two private networks across the public internet you must encapsulate the Ethernet/IP frames, which is exactly what a VPN or IP-tunnel does.

Key design rules:

1. Use a unique private subnet at every site (e.g. 192.168.1.0/24, 192.168.2.0/24 …). This avoids IP collisions when the VPN brings every site into one virtual address space.
2. The SCADA station needs a fixed, routable IP or a reliable DDNS hostname plus a port that the remote LOGO! can call back to (relevant for S7 keep-alive).
3. Every site must terminate its internet connection on a router that supports either IPsec, OpenVPN, or WireGuard. Consumer "VPN-passthrough" routers are not the same as full VPN clients.
4. Plan for the fact that WAN RTT typically ranges 30-300 ms; design your SCADA poll cycle for at least 3x the worst-case RTT before declaring a timeout.

2. LOGO! 8 Communication Capabilities (0BA8)

The 0BA8 generation (LOGO! 8) integrates an Ethernet interface and supports the protocols listed below. The firmware version of the LOGO! determines which options are available.

The VM (Variable Memory) area of the LOGO! is the data block that all protocols expose to the outside world. External tags are addressed through a fixed offset mapping:

3. Prerequisites & Hardware Bill of Materials

Software tooling (downloads from Siemens support):

• LOGO! Soft Comfort V8.x (engineering, simulation, web editor)
• LOGO! Web Editor (LWE) project module (add-in to LSC)
• Current firmware for the LOGO! base module (free, via Siemens Industry Online Support)
• SCALANCE S615 Web Based Management (WBM) configuration pages

4. Option A - Internal Web Server (Lowest Cost, No VPN)

The internal web server is enabled by default in every 0BA8 and is sufficient when the SCADA operator only needs a browser view of display messages plus up to 8 variables. It is the lowest-cost entry point because no add-in software and no extra hardware are required.

4.1 Enable the internal web server

1. In LOGO! Soft Comfort, open the project and go to Tools → Ethernet Connections → Web Server Access.
2. Tick "Enable Web Server" and set the Web Server Password (default = LOGO).
3. For each VM tag you want to expose, mark it as "accessible from web server" by right-clicking the block in the FBD editor and selecting the property.
4. Download the program to the LOGO! via Ethernet.

4.2 Reach the LOGO! across the internet

1. Configure the site router with a port-forwarding rule: external TCP 8080 → internal 192.168.1.10:80 (LOGO! HTTP port).
2. Browse to http://<public-ip>:8080 from the SCADA PC. The default LOGO! welcome page lists the current display messages.
3. Click Variables in the menu - the 8 exposed tags appear as live read-only values.

4.3 Data exchange limit

Only the 8 web-server-enabled variables are reachable through the internal web server. The HTTP request returns plain text and is easily parsed by a SCADA or by a Python script:

import requests
r = requests.get('http://<public-ip>:8080', auth=('admin','LOGO'))
# r.text contains a list of <td> rows with VM values

Polling at 1 Hz from a 25-site installation generates 25 TCP connections/sec - well within the LOGO! capability but be aware that the LOGO! supports a limited number of simultaneous TCP sessions (typically 8-16 on 0BA8), so reuse HTTP keep-alive in your polling client.

5. Option B - Extended Web Server with LOGO! Web Editor (LWE)

The LOGO! Web Editor (LWE) is an add-in shipped with LOGO! Soft Comfort V8.2 and later. It lets you design custom HTML pages that read live values from the LOGO! VM area, display them as gauges or tables, and (optionally) write back to digital outputs. The generated project is pushed to the LOGO! SD card; the LOGO! then serves the pages on the same TCP 80 (or a custom port).

5.1 Requirements

• LOGO! 0BA8 with firmware V8.2 (FS:04) or later.
• A Siemens SD card inserted in the LOGO! card slot (the project lives on the card, not in internal flash).
• LOGO! Soft Comfort V8.2+ installed on the engineering PC.

5.2 Build a LWE project

1. Open the LOGO! program in LSC and select Tools → Web Editor.
2. Add a new web page, drag a "Variable" widget onto the canvas, and bind it to a VM tag from the LOGO! program.
3. Add an "Input field" widget bound to a digital output VM tag if write-back is required.
4. Save the project, then click LOGO! → Web Project → Transfer to SD card. The SD card must be plugged into the PC's card reader.
5. Insert the SD card into the LOGO! and power-cycle the controller. The LOGO! boots, reads /webproject/webproject.xml from the card, and serves it on TCP 80.

5.3 Reach the LWE server across the internet

Same approach as Option A: port-forward external 8080 → internal 192.168.1.10:80. For a 25-site cluster, the SCADA PC opens 25 browser tabs or uses a small web-crawler script. If write-back is enabled, also rotate the web server password and limit source IPs on the router's firewall.

6. Option C - S7 Protocol over a VPN Tunnel (Recommended for SCADA)

The Siemens S7 protocol is the native PUT/GET mechanism that any S7-1200, S7-1500, or LOGO! 0BA8 speaks. It runs on top of ISO-on-TCP (port 102) and supports reading and writing the entire VM area, which is the only practical way to expose more than 8 tags to a SCADA. Because S7 is a binary protocol with no authentication, it must be wrapped in a VPN tunnel.

6.1 VPN topology

Two viable topologies exist:

6.2 S7 connection from SCADA

Once the VPN is up, the remote LOGO! 8 appears on the SCADA network as a local device. In WinCC Professional, the configuration is:

Connection name : LOGO_Site_03
Driver          : SIMATIC S7 Protocol Suite
IP address      : 192.168.3.10   (remote LOGO!, via VPN)
Slot / Rack     : 0 / 0          (LOGO! 0BA8)
Partner (TSAP)  : 03.01          (LOGO! default for server connection 1)

The VM area is read/written with the following function-code mapping:

6.3 Polling cycle and timeout design

Over a public internet VPN, a single S7 read of one DB1 of 32 bytes typically takes 80-250 ms. The recommended SCADA poll cycle for 25 sites is:

Poll interval = max(RTT_round_trip) x 3 + 50 ms safety
              = 300 ms x 3 + 50 ms = 950 ms
Round up to  1.0 s / 1.5 s for production

Watch the LOGO! S7 connection count - a 0BA8 accepts up to 8 simultaneous S7 connections. A SCADA with 25 sites must therefore poll sequentially, not in parallel, or use a connection-pool pattern that re-uses one connection per site.

7. WAN & VPN Configuration Reference

7.1 SCALANCE S615 IPsec site-to-site (Siemens-native)

1. Open the S615 WBM at https://192.168.1.1, log in as admin with the default password.
2. Navigate to Layer 3 → VPN → IPsec and create a new connection. Set Mode = Tunnel, Authentication = PSK or Certificate.
3. Enter the central S615 WAN IP as Remote Gateway, the central subnet as Remote Subnet (e.g. 192.168.100.0/24), and the local LOGO! subnet (192.168.1.0/24) as Local Subnet.
4. Configure IKEv1 with AES-256 / SHA-2 / DH-14, lifetime 28800 s. Repeat on the central S615 with mirrored settings.
5. Test: from the central SCADA PC, ping the remote LOGO! 8 (192.168.1.10) over the VPN.

7.2 OpenVPN (budget path)

Install OpenVPN on a small Linux box at the central site. Generate one client certificate per remote site, push the route route 192.168.1.0 255.255.255.0 to the central config, and configure each remote Mikrotik/OpenWrt router as an OpenVPN client. Authentication is by TLS certificates - one cert per site.

7.3 DDNS for dynamic public IPs

If the central SCADA site does not have a fixed public IP, register a hostname with a DDNS provider (e.g. DynDNS, No-IP, freedns.afraid.org). Most SCALANCE routers have a built-in DDNS client under System → DDNS that updates the record every 60 s. The remote site then dials the DDNS hostname instead of a numeric IP, but the underlying connection still requires a VPN to traverse the NAT.

8. SCADA Software Integration Paths

For an engineer who already owns TIA Portal, the native path is WinCC Professional + S7 driver over VPN. For a budget project, the lowest cost is the internal web server polled by a Python script and exposed to any SCADA through an OPC UA bridge.

9. Cost & Engineering Effort Comparison

For the original use case (water-salinity monitoring, slow analog signals, 4-25 sites) the best engineering trade-off is Option A (internal web server) inside a SCALANCE S615 IPsec VPN. This gives encryption, requires no extra software, and exposes enough variables for typical 2-4 analog inputs and 2-4 digital flags per site.

10. Verification & Commissioning Checklist

After deployment, verify each link with the following steps:

1. Layer-1 / 2: Link LED on the LOGO! Ethernet port is solid green; site-router LAN port shows 100/1000 link.
2. Local IP: From a laptop on the LOGO! subnet, browse to http://192.168.1.10 - welcome page appears.
3. VPN tunnel: From the central SCADA PC, ping the remote LOGO! 8. RTT < 300 ms on a healthy internet link; packet loss < 0.1 %.
4. Web server over VPN: Browse to http://192.168.1.10 via the tunnel. The LOGO! welcome page and the 8 monitored variables appear.
5. Write-back (if enabled): Force a digital output from the SCADA; confirm the LOGO! output LED changes state within 1 s.
6. S7 driver diagnostics: In WinCC, the connection state shows "OK" and the tag status is "Good". A red status on any tag after 3 s indicates either a wrong TSAP or a saturated S7 connection counter.
7. Long-term: Log the SCADA data for 24 h; check for gaps > 30 s. A few seconds of gap is expected during WAN re-keying; long gaps indicate VPN instability.

11. Troubleshooting Matrix

12. Field-Proven Caveats

• Real-time is not real-time over the internet. Even with a healthy VPN, WAN RTT is in tens of milliseconds. A SCADA polling at 1 Hz is fine for water salinity; it is not fine for high-speed interlocking. Add a local HMI at each site for any operator-level control that must be deterministic.
• Data loss during WAN re-keying. IPsec SA renegotiation typically drops packets for 0.5-3 s. For a forensic log, this is acceptable; for a control loop, it is not. Use a VPN with DPD and fast-reconnect (IKEv2) if reconnect matters.
• LOGO! 0BA8 connection limit. The 0BA8 supports a finite number of TCP connections (8 to 16 depending on firmware). A SCADA connecting in parallel from 25 sites can saturate this. Always poll sequentially, not in parallel, and reuse HTTP keep-alive.
• VM offset drift between firmware versions. The exact byte offset of AM/AQ blocks can change between firmware versions. Build the SCADA tag list from the actual firmware running on the controller, not from a generic table.
• Time stamping. Enable NTP on every LOGO! 8 and on the SCADA server. Without a synchronised clock, the historical log of a salinity excursion is not forensically usable.
• Cellular fallback. For remote sites without fixed-line internet, a SCALANCE M874/M876 with cellular SIM provides an IPsec client out of the box. Budget the cellular data plan: 1 Hz polling of 50 bytes per site = ~14 MB/day, well under most M2M plans.

FAQ