LOGO! 8 Parameter VM Mapping for KTP400 Counter Setpoints

This reference explains how to expose the On and Off threshold parameters of a LOGO! 8 counter block to a SIMATIC KTP400 Basic HMI through the variable memory (VM) area. It resolves a common field problem: the HMI's Network Analog Input (NAI) tag is 16-bit signed, while the counter reference value is a 32-bit unsigned integer — so the value must be routed through a Parameter VM Mapping entry and accessed as a VD (double word).

1. Problem Description

You have a LOGO! 12/24 RCE (order code 6ED1052-1MD08-0BA1) networked to a SIMATIC KTP400 Basic (for example, from starter kit 6AV2132-0KA00-0AA1) and want to:

• Enter an integer on the KTP400 (IO field).
• Push that integer into a counter block running inside the LOGO! (e.g. block C001).
• Use the entered value as the On threshold or Off threshold of the counter so it turns its output on/off at a user-defined count.

You create a Network Analog Input tag and point it at VW6. The HMI shows a value, but it never updates the counter, and the LOGO! does not respond to changes from the panel. This is a data-type mismatch, not a wiring problem.

2. Root Cause: 16-bit NAI vs. 32-bit Counter Reference

LOGO! counter blocks (special function blocks 001 Up/Down counter and 002 On/Off counter / hours counter) store their On and Off reference parameters as 32-bit unsigned integers (DWORD, range 0…2,147,483,647). The VM (variable memory) area in LOGO! 8 is byte-addressable as follows:

When you map a counter's On/Off reference into the VM, the LOGO! always places it in a VD address. The KTP400 Basic, however, only offers 16-bit signed NAI tags, so reading or writing VW6 alone can only see half of the double word that lives at VD6 (i.e. VW6 + VW8). The other half — and the sign bit interpretation — are lost, so the counter never receives a valid value.

3. How Parameter VM Mapping Works

LOGO! Soft Comfort (LSC) exposes a dialog at Tools > Parameter VM Mapping. Each entry in this table binds a specific block parameter (an On reference, Off reference, actual value, setpoint, etc.) of a special function block (SFB) to a VM address in the LOGO!. The mapping is stored inside the LOGO! program (.lsc project) and is downloaded with the program to the base module. Once enabled, the parameter is reachable from the HMI at the VM address you selected, in the correct data width.

Key behaviors:

• You define the mapping in LSC, not in TIA Portal. TIA Portal only consumes the resulting VM area.
• The mapped VM address must be free — i.e. not already used by another mapping or by a block that owns that range.
• Counter reference parameters (On/Off threshold) are always forced to VD entries (32 bits). Bit and word ranges are rejected for these parameters.
• Read-only parameters (e.g. the actual counter value) are still writable from the HMI if you map them — the LOGO! accepts the write and overrides the SFB value at the next scan.

4. Prerequisites

5. Step-by-Step: Build the Counter Setpoint Path

5.1 Add the Counter Block in LSC

1. Open your project in LOGO! Soft Comfort.
2. Drag a counter block (e.g. B001 = Up/Down counter, SFB type 001) onto the schematic.
3. Wire a digital input to Trg (count input) and a reset signal to R.
4. Wire the counter output Q to whatever you want to switch (lamp, contactor, flag).
5. Double-click the block and open the Block Properties dialog. Under Parameter you will see On and Off threshold fields, initially set to constants (e.g. 10).

5.2 Open Parameter VM Mapping

1. In LSC, select Tools > Parameter VM Mapping.
2. The dialog lists all mappable parameters of all SFBs in the program. Locate the rows for your counter (Block 001, parameter names: On reference, Off reference).
3. For the On reference row, click the Address cell and type a free VD address, for example VD20.
4. For the Off reference row, type a second free VD address, e.g. VD24. Keep at least 4 bytes between mappings to avoid overlap.
5. Confirm the dialog (OK). The mapping is now part of the program.

5.3 Download the Program to the LOGO!

1. Connect PC → LOGO! via Ethernet (or USB on newer LOGO! 8.3+ base modules).
2. In LSC, click Transfer > PC → LOGO! and select LOGO! program + Parameter VM mapping.
3. Wait for the green confirmation. The LOGO! will be in STOP briefly during the transfer.

5.4 Connect the LOGO! in TIA Portal

1. Open your TIA Portal project (V16 or newer) that already contains the KTP400 Basic device.
2. In the project tree: Devices & Networks > Add new device > SIMATIC LOGO! 8. Select the correct order number so that the HSP matches the physical module.
3. On the LOGO! device, open Properties > System IP and assign a static IP (e.g. 192.168.0.10, mask 255.255.255.0).
4. Drag a network connection from the LOGO! Ethernet port to the KTP400 Ethernet port. TIA will suggest a S7 connection; for VM access from the HMI you need a Modbus TCP connection instead — see §5.5.

5.5 Configure Modbus TCP on the LOGO! Side

1. On the LOGO! device object, open Properties > Modbus TCP and enable the Modbus TCP server.
2. Default port is 502. The server is read-write, so VM data is bidirectionally accessible from the HMI.
3. Verify from the PC with a Modbus client (e.g. mbpoll or QModMaster): read holding registers starting at the address that corresponds to VD20. For LOGO! 8, the Modbus base address for VM is typically 40001; VD20 therefore lines up with holding register offset 20 (function code 0x03 for read, 0x06 / 0x10 for write).

5.6 Define the HMI Tags

1. On the KTP400, open HMI tags and create a new connection of type Modbus TCP, pointing to the LOGO! IP 192.168.0.10:502.
2. Add an IO field tag named Counter_OnRef:
   • Connection: the Modbus TCP connection above
   • Address: offset corresponding to VD20
   • Data type: UInt or DWord (32-bit) — do not pick Int here
   • Length: 2 words
   • Acquisition: Cyclical continuous, 1 s
3. Repeat for Counter_OffRef at the VD24 offset.
4. Place two IO fields on the screen, both configured as Input/Output with the format pattern 9999, min 0, max 9999.

5.7 Compile and Download

1. Compile the HMI project, then download to the KTP400.
2. Restart the LOGO! to RUN. Enter a value, e.g. 5, in the On-ref IO field. Touch the field to write.
3. Count the input past 5 — the counter output Q should switch on. Change the IO field to 20 — the threshold is now live and the counter will only switch at the new value.

6. Verification Procedure

1. From the LOGO! onboard display (or LOGO! Web Server), navigate to Diagnostics > VM and confirm that VD20 shows the value you typed in the HMI.
2. In LSC online mode, open the counter block properties. The On reference should display the new value, indicating that the SFB is reading the mapped VM address.
3. Watch the actual count value while the input toggles. The output should switch exactly at the threshold you set on the HMI.
4. Power-cycle the LOGO!. After restart, the threshold should still be the last value the HMI wrote — VM is retentive for mapped parameters only when the LOGO! backup battery / SD card is present; otherwise the parameter returns to its compile-time default.

7. Parameter VM Mapping Reference Table

8. Troubleshooting Matrix

9. Common Engineering Pitfalls

• Editing the VM address in TIA only. The mapping must live in LSC; TIA only reads the VM image. TIA-side address changes are cosmetic and disappear at the next download.
• Sharing a VD with a VW the program already uses. LOGO! will silently corrupt the data. Document every mapped address in the schematic comment.
• Forgetting to enable Modbus TCP. The default TIA connection wizard prefers S7; switch the connection type on the HMI side to Modbus TCP for VM access.
• Using I/O field limits that exceed 16-bit. With Int tags the panel will clamp at 32767 silently. Switch to UInt/DWord on the HMI tag definition.
• Mixing LOGO! 0BA7 and 0BA8 programs. VM mapping format changed between firmware generations; rebuilding the program in the matching LSC version is required.

10. Field-Proven Patterns

For a single-counter machine (e.g. a parts counter with operator-adjustable batch size), the minimum useful setup is two IO fields, two mapped VD addresses, and a counter block. For multi-counter panels, allocate one VD block per counter starting at VD20, increment by 8 bytes per block (4 bytes for On, 4 bytes for Off, optional 4 bytes for Start), and document the layout in the schematic header.

When a HMI is later replaced with a Comfort Panel (KTP1200 / TP1500) using S7 routing instead of Modbus TCP, the VM mapping stays the same — the new panel reads the same VM range via S7 PUT/GET or symbolic DB. The LSC side does not change, which protects the field investment when the HMI is upgraded.

11. Verification Checklist Before Handover

1. All mapped VD addresses are listed in the schematic comment block.
2. LSC download report shows "Parameter VM mapping transferred successfully".
3. HMI online diagnostics shows the Modbus TCP connection in Connected state.
4. Writing each threshold from the HMI is reflected in the LOGO! online view within one scan.
5. Power-cycle test: thresholds survive at least 10 s of power loss with battery fitted.
6. Counter output toggles at exactly the entered threshold; no +1/-1 offsets.

FAQ