When an application requires a temperature range that exceeds what a LOGO! 8 AM2 RTD expansion module can measure, the most practical solution is to read the RTD signal with an S7-1200 and expose the scaled value to the LOGO! over an S7 client/server connection. This article documents a working configuration using a 6ES7 215-1HG40-0XB0 CPU 1215C DC/DC/RLY (firmware 4.1) as the S7 server and a 6ED1 052-1MD00-0BA8 LOGO! 12/24 RCE acting as the S7 client, programmed in TIA Portal V14 SP1 and LOGO! Soft Comfort V8.2.1. The same procedure applies to the LOGO! 8.FS4 firmware (0BA8.FS4) where the client role is fully supported.
1. Architecture Overview
The network consists of three nodes on a common Ethernet subnet. The LOGO! is the S7 client and initiates GET requests against the S7-1200 server. The S7-1215C scales the RTD input and stores the engineering-unit temperature in a global data block. The TP700 Comfort HMI reads the same DB tag directly from the S7-1200.
The data flow is unidirectional for the temperature read: the LOGO! polls the S7-1200 on a configurable cycle (default 1 s) and stores the value in a VM (Variable Memory) word, which is then usable inside the LOGO! circuit program and on the LOGO! on-board display. The TP700 reads the same value directly from the S7-1200 for graphical display and archiving.
2. RTD Range Comparison: LOGO! AM2 vs S7-1200 RTD
The driving requirement in the original application was a measurement range of -80 °C to a positive value on a touch-screen HMI, exceeding the native LOGO! AM2 RTD range. The following table quantifies the difference.
| Module | Order Number | Sensor | Range | Resolution | Update |
|---|---|---|---|---|---|
| LOGO! AM2 RTD | 6ED1 055-1MD00-0BA2 | PT100 / PT1000 | -50 °C … +200 °C | 0.25 °C | ~50 ms |
| LOGO! AM2 RTD (FW 1.0.0+) | 6ED1 055-1MA00-0BA2 | PT100 / PT1000 / Ni100 / Ni1000 | -50 °C … +200 °C (PT) | 0.1 °C | ~50 ms |
| SB 1231 RTD (signal board) | 6ES7 231-5PA30-0XB0 | PT100 / PT200 / PT500 / PT1000 / Ni100 / Ni1000 / Cu10 | -200 °C … +850 °C (PT100 std) | 0.1 °C / 0.01 °C | ~100 ms |
| SM 1231 RTD (4 ch) | 6ES7 231-5PD30-0XB0 | Pt / Ni / Cu | -200 °C … +850 °C | 0.1 °C / 0.01 °C | ~100 ms |
| SM 1231 RTD (8 ch) | 6ES7 231-5PF30-0XB0 | Pt / Ni / Cu | -200 °C … +850 °C | 0.1 °C / 0.01 °C | ~100 ms |
Any of the S7-1200 RTD modules provides a range that fully covers the requirement, with the SB 1231 RTD being the lowest-cost option when only one channel is needed and the SB slot on the CPU 1215C is free (the DC/DC/RLY variant exposes one SB slot).
3. Prerequisites
| Item | Requirement | Notes |
|---|---|---|
| S7-1200 CPU | 6ES7 215-1HG40-0XB0 (CPU 1215C DC/DC/RLY) | Firmware ≥ 4.1; TIA V14 SP1 supports up to FW 4.4 |
| RTD input | SB 1231 RTD (6ES7 231-5PA30-0XB0) or SM 1231 RTD | Insert into SB slot or signal module slot |
| LOGO! | 6ED1 052-1MD00-0BA8 (12/24 RCE) 0BA8.Standard or 0BA8.FS4 | S7 client role requires firmware FS4 (≥ V1.16.0) or 0BA8.Standard ≥ V1.08.0 |
| Engineering – S7 | TIA Portal V14 SP1 Update 7 (or later) with S7-1200 HSP | WinCC Comfort V14 SP1 for the TP700 |
| Engineering – LOGO! | LOGO! Soft Comfort V8.2.1 (LSC V8.2.1) | Matches 0BA8.Standard / FS4 |
| HMI | TP700 Comfort (6AV2 124-1MC01-0AX0) | Optional but typical for the target application |
| Ethernet switch | 100 Mbit/s, unmanaged sufficient | All three nodes on 192.168.0.0/24 |
4. S7-1200 Hardware Configuration for RTD
- Insert the SB 1231 RTD into the signal-board slot at the top of the CPU 1215C. The SB is keyed and clicks into place; no tools required.
- Wire the PT100 (or PT1000) probe. For a 2-wire connection, jump terminals 1A/1B and 2A/2B on the SB; for 3- or 4-wire, follow the silk-screened diagram on the front flap.
- Power the CPU 24 V DC. Verify the SB status LED is solid green.
- Set the IP address from the CPU display: Settings → Addresses → IP Address (192.168.0.20, mask 255.255.255.0, no router).
In TIA Portal, after adding the S7-1215C to the project, the device view shows the SB 1231 RTD under the CPU. Configure the following parameters in the SB properties:
| Parameter | Setting | Comment |
|---|---|---|
| Channel 0 — Enable | Checked | Disable unused channels to reduce scan time |
| Channel 0 — Measurement type | Resistance (RTD-2/3/4L) | Selection depends on wiring mode |
| Channel 0 — Sensor | PT100 (standard) / PT100 (climatic) / PT1000 | Select to match the probe |
| Channel 0 — Temperature unit | °C | Module scales raw counts to 0…27648 |
| Channel 0 — Wire break | Diagnostic interrupt enabled | Wires to CPU diagnostic buffer |
| Channel 0 — Smoothing | None / Weak / Medium / Strong | Select "Weak" for ≤ 100 ms response |
| Channel 0 — Temperature coefficient | 0.00385 (Pt) / 0.00618 (Ni) / 0.00427 (Cu) | Must match probe datasheet |
With these settings, the module returns an integer in the range 0…27648 that represents 0 °C at 0 counts and the sensor's full-scale temperature at 27648 counts. For a PT100 standard probe the full-scale is +850 °C, so the raw-to-temperature formula is:
T_engineering °C = (IWxx / 27648.0) × 850.0
For negative readings on PT100 climatic (-120 °C … +130 °C), the module reports the value in two's-complement form inside the lower 16 bits, which the SCL conversion below handles automatically as long as the input word is declared as INT, not WORD.
5. TIA Portal V14 Project Structure
Two coordinated projects are typically required when mixing LOGO! and S7-1200 in the same application. Some newer TIA Portal versions (V15.1+) support a single combined project with both controllers under a common PROFINET/ Ethernet subnet; with TIA V14 SP1 the two-project method is the most reliable. Both projects must be downloaded independently.
- Project A – S7-1200 + HMI: contains the CPU 1215C, the SB 1231 RTD, the TP700 Comfort, and the S7 program with the RTD scaling block.
- Project B – LOGO!: contains the 0BA8 (or FS4) station and the S7 client connection definition. The LSC V8.2.1 project is stand-alone and is downloaded to the LOGO! over Ethernet.
6. S7-1200 Server-Side Configuration
- Add a new Data Block DB10 – "RTD_Data" with the structure shown below. Disable "Optimized block access" so that absolute byte offsets are visible to the LOGO! GET request.
DB10 "RTD_Data" — Standard access (non-optimized)
| Name | Type | Offset (byte) | Initial | Comment |
|---|---|---|---|---|
| RawCount | INT | 0.0 | 0 | Cyclic read of IW96 (SB slot) |
| TempC | REAL | 2.0 | 0.0 | Scaled engineering value in °C |
| Status | WORD | 6.0 | 16#0000 | Module status word |
| SensorFault | BOOL | 8.0 | FALSE | TRUE = wire break / overflow |
- Create an OB1 cycle and a small SCL block (FC1 "Scale_Raw_To_Temp") that performs the conversion. The conversion is intentionally kept simple to avoid legacy TI-S7 scale block assumptions about 0…10 V:
// FC1 — Scale_Raw_To_Temp
// Input : "RawCount" INT, "SensorFault" BOOL
// Output : "TempC" REAL
"TempC" := INT_TO_REAL("RawCount") / 27648.0 * 850.0;
IF "SensorFault" OR ("RawCount" = 0) THEN
"TempC" := -999.0; // sentinel for HMI / LOGO!
END_IF;
- Open the CPU properties → Protection & Security and tick "Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, …)". Without this, the LOGO! S7 client cannot read the DB, even if all other parameters are correct.
- Compile and download the S7-1200 project. Verify the value of
DB10.TempCusing Monitor & Force; with a 100 Ω precision resistor on the SB input you should read 0 °C ± 0.3 °C. With the resistor removed (open input), the module reports +32767 (overflow) and the FC1 output goes to the -999.0 °C sentinel.
7. LOGO! 8 Client Configuration in LSC V8.2.1
- Open LSC V8.2.1 and create a new project. Drag a LOGO! 8.FS4 (or 0BA8.Standard) from the catalog onto the network view.
- Set the LOGO! IP to 192.168.0.10 / 24 under Properties → Ethernet. The subnet mask must match the S7-1200 (255.255.255.0).
- Open the LOGO! properties → Ethernet Connections and add a new connection of type S7 Connection with the LOGO! as the active (client) end. The connection resource ID is assigned automatically; typically it starts at 1.
- Configure the partner (S7-1200) parameters:
| Field | Value |
|---|---|
| Partner IP | 192.168.0.20 |
| Partner TSAP | 01.01 (rack 0, slot 1 — S7-1200 CPU) |
| Local TSAP | 01.00 (LOGO! client default) |
| Connection type | ISO-on-TCP (default for S7) |
| Function | Read (GET) only |
| Source DB / byte offset | DB10, byte 2 (TempC REAL, low word) |
| Length | 4 bytes (one REAL) |
| Target VM address | VW0 (Variable Memory word 0) |
| Poll cycle | 1000 ms (configurable 100 ms … 60 s) |
| Connection name | "RTD_to_LOGO" (free text) |
- Download the LSC project to the LOGO! over Ethernet (Tools → Transfer → PC → LOGO!). The LOGO! will start polling the S7-1200 immediately and update VW0 at the configured cycle time (default 1 s).
01.01. The LOGO! client TSAP can be any local TSAP not already in use; 01.00 is the conventional default. Both ends must agree, otherwise the connection stays in "no partner" state and the LOGO! reports a communication error in its diagnostic buffer.8. S7 Connection Parameters and Diagnostics
| Parameter | LOGO! Side | S7-1200 Side |
|---|---|---|
| Active/passive | Active (client) | Passive (server) |
| Transport protocol | ISO-on-TCP (RFC 1006) | ISO-on-TCP |
| TCP port | 102 | 102 |
| Local TSAP | 01.00 | 01.01 |
| Partner TSAP | 01.01 | 01.00 |
| Cycle time | 1000 ms (configurable) | n/a (server) |
| Read length max | 32 bytes per GET block | Per CPU spec (≥ 128 bytes total) |
| Connection resource | 1 (default) | auto |
| Connection setup timeout | ~5 s | ~10 s |
| Keep-alive | Internal (~30 s) | TCP default (~2 h) |
On the S7-1200 side, the active connection is visible in Online & Diagnostics → Connections. The connection state should report ESTABLISHED with a "S7 Communication" entry once the LOGO! powers up. The S7-1200 CPU also logs a single "Communication initiated" entry in the diagnostic buffer at first contact. On the LOGO! side, navigate to Diagnostics → Ethernet → Connections to see the same connection from the client perspective, including the last successful poll timestamp.
9. RTD Value Scaling: From Raw Counts to Engineering Units
The complete scaling chain has three steps:
- Module scaling – SB 1231 RTD converts the probe resistance to integer counts in 0…27648 across the configured temperature range.
- CPU scaling – FC1 multiplies the raw count by the full-scale value to obtain a REAL in °C, applies sign extension for negative values, and replaces out-of-range values with the sentinel -999.0.
- LOGO! display – LOGO! receives the 4-byte REAL and stores it in a VM word pair (e.g., VW0). The VM word is then placed on the LOGO! display using the analog-threshold function block, or used as a direct variable inside the circuit program.
| Probe | Wires | Full-Scale | Scale Factor (°C / count) | Notes |
|---|---|---|---|---|
| PT100 std | 2 / 3 / 4 | +850 °C | 850 / 27648 = 0.03074 | Industrial standard, widest range |
| PT100 climatic | 2 / 3 / 4 | +130 °C | 130 / 27648 = 0.00470 | Higher resolution (± 0.05 °C) for HVAC |
| PT1000 std | 2 / 3 / 4 | +850 °C | 0.03074 | Use for long cables > 10 m |
| Ni100 / Ni1000 | 2 / 3 | -60 … +250 °C | 310 / 27648 = 0.01121 | Cold-side compensation |
For a -80 °C lower bound with PT100 climatic (-120 … +130 °C), the SB reports negative counts in two's complement. The SCL code INT_TO_REAL handles sign extension correctly because RawCount is declared as INT, not WORD. If the DB declaration is inadvertently WORD, negative readings wrap to 65000+ counts and the scaling breaks. Always declare RawCount as INT in DB10 and ensure DB10 has "Standard access" so the absolute byte offset 0 is exposed.
10. HMI Integration with TP700 Comfort
The TP700 reads DB10.TempC directly from the S7-1200 using a standard S7 HMI connection. Configure the connection in the HMI device configuration:
- Add the TP700 to the same project as the S7-1215C. WinCC Comfort assigns a default HMI connection of type S7 with TSAP 03.01 for the panel side.
- Drag a connection from the TP700 Connections node to the S7-1215C. The active connection setup is performed by the panel.
- Create an HMI tag
"ProcessTemp"of typeREALmapped to%DB10.DBX2.0 FLOATon the S7-1200 (or to a symbolic DB10.RTD_Data.TempC if symbolic addressing is enabled). - Place a numeric I/O field on the start screen, select
"ProcessTemp"as the tag, and set the format to999.9 °Cwith limits -120.0 … +850.0. The acquisition cycle default is 1 s; lower to 500 ms for snappier display. - Optionally add a second I/O field bound to
DB10.SensorFaultthat turns red on TRUE, plus a message class that latches the wire-break event in the HMI alarm log.
For the LOGO!-side data logging mentioned in the original requirement ("use the logo access excel spreadsheet to save data"), the LOGO! 8 records the VM area cyclically to its internal data log; LSC's Tools → Data Log exports the log to CSV that opens directly in Excel. This is independent of the S7-1200 connection and does not consume any communication bandwidth.
11. Commissioning and Verification
After both projects are downloaded, perform the following checks in order:
-
CPU status: On the S7-1215C display, navigate to Diagnostics → Connection → S7 Connections. The connection from TSAP 01.00 should show state
ESTABLISHED. The MAC address matches the LOGO! device. -
LOGO! status: On the LOGO! on-board display, navigate to Diagnostics → Ethernet → Connections. The S7 connection should report
OKwith the last successful poll timestamp. -
Tag values: Force a known temperature (e.g., simulate -80 °C with a precision decade box set to 68.33 Ω for PT100, equivalent to -80 °C) and confirm that the value at
LOGO! VW0matchesDB10.TempCon the S7-1200. - HMI display: On the TP700 start screen, the numeric I/O field should show the same value with a 1-second update (default LOGO! poll).
-
Wire-break test: Disconnect one probe wire at the SB terminal. The CPU should raise a diagnostic interrupt;
DB10.SensorFaultshould latch TRUE and the HMI field should display the sentinel value -999 °C (or whatever the project defines). - Endurance test: Leave the system running for ≥ 24 h with the values logged. The LOGO! data log should contain ≥ 86,400 entries at a 1-s poll (or the configured cycle).
| Check | Pass Criterion | Tool |
|---|---|---|
| S7 connection state | ESTABLISHED | S7-1200 display / TIA Online |
| LOGO! VM value | Matches DB10.TempC ± 0.1 °C | LSC online monitor |
| HMI refresh | ≤ 2 s update rate | TP700 online view |
| Wire-break detection | SensorFault = TRUE within 5 s | Remove probe wire |
| Data log | CSV opens in Excel, no gaps | LSC Data Log export |
| CPU cycle impact | S7-1200 cycle < 150 ms | TIA Online → PLC → Cycle time |
12. Troubleshooting Matrix
| Symptom | Likely Cause | Remedy |
|---|---|---|
| S7 connection in "no partner" state | Wrong IP, wrong TSAP, or firewall on S7-1200 | Verify IP ping, set TSAP both ends to 01.00/01.01, disable firewall in CPU properties during test |
| Connection establishes but data is always 0 | PUT/GET access disabled on S7-1200 | CPU Properties → Protection & Security → tick "Permit access with PUT/GET communication" |
| VM value flickers / random | DB optimized, offset wrong, or DB10 not downloaded | Open DB10 with "Standard access" enabled, verify byte offsets in DB editor, re-download |
| Negative temperatures wrap to 65000+ | RawCount declared as WORD instead of INT | Change DB declaration to INT; recompile and re-download |
| Wire break not detected | Diagnostic interrupt disabled on SB | Enable "Diagnostic interrupt" on the channel; re-download hardware config |
| LOGO! client cannot be selected in TIA / LSC | Wrong LOGO! firmware version (pre-V1.08.0) | Update LOGO! to FS4 firmware via LSC online update |
| Connection drops after a few hours | LOGO! keep-alive timeout too short, or watch-dog on S7-1200 | Increase LOGO! cycle to 2 s; check S7-1200 CPU cycle time < 150 ms |
| CSV data log missing rows | LOGO! clock not set / battery low | Set NTP or manual clock; replace battery (CR2032) on the LOGO! base module |
| HMI shows "###" in numeric field | Value out of configured display range | Widen field limits in TP700 tag configuration |
| LOGO! reports 0x01 "Communication error" | TSAP mismatch or partner unreachable | Cross-check both TSAP values; confirm cable and switch port LED |
| Reading is stable but always half of expected | Two adjacent variables in DB, only low word read | Increase GET length to 4 bytes (one REAL), or split into two INT reads |
| CPU diagnostic buffer shows SF LED blinking | SB 1231 channel fault (open / short) | Check wiring; replace probe; clear diagnostic buffer |
Frequently Asked Questions
Can the S7-1215C act as an S7 "slave" to a LOGO! 8 master?
Yes, but the correct S7-communication term is server, not slave. Configure the LOGO! as the S7 client (active, initiating GET/PUT) and the S7-1215C as the S7 server. The S7-1200 must have PUT/GET access enabled in CPU properties under Protection & Security.
Which S7-1200 RTD module gives the largest temperature range?
The SB 1231 RTD (6ES7 231-5PA30-0XB0) and the SM 1231 RTD modules (4-ch 6ES7 231-5PD30-0XB0 and 8-ch 6ES7 231-5PF30-0XB0) all cover -200 °C to +850 °C with PT100 standard, fully exceeding the -80 °C lower bound required by the application.
How many S7 connections can a LOGO! 8 maintain at once?
A LOGO! 8.FS4 supports up to 16 network connections in total, of which several can be S7 client connections. A 0BA8.Standard (firmware ≥ V1.08.0) supports up to 8 S7 connections with at least one S7 client role active.
Does the S7 client communication work without TIA Portal for the LOGO!?
No. The S7 connection parameters (TSAP, partner IP, target VM address, poll cycle) must be configured in LOGO! Soft Comfort (LSC V8.2.1 or later) and downloaded to the LOGO!. There is no on-board display menu for S7 client setup on the LOGO! base module.
Can the same S7-1215C be polled by both the LOGO! and the TP700 at the same time?
Yes. The S7-1200 supports multiple concurrent S7 connections (up to the resource limit, typically 16 for CPU 1215C). Each client uses an independent connection resource and a different TSAP pair, so the LOGO! and TP700 do not interfere. The CPU distributes the requests across its OB1 cycle.
Why does the LOGO! VM show 0 even though TIA shows the correct value?
Three frequent causes: (1) the S7-1200 has PUT/GET access disabled; (2) DB10 was created with "Optimized block access" and the LOGO! cannot address the symbol; (3) the GET length is wrong (e.g., 2 bytes for a 4-byte REAL). Open DB10 properties and disable optimization, then verify the GET block specifies 4 bytes from byte offset 2.