LOGO! 8 to S7-1200 S7 Client Setup for Extended RTD Range

David Krause17 min read
S7-1200SiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

When an application requires a temperature range that exceeds what a LOGO! 8 AM2 RTD expansion module can measure, the most practical solution is to read the RTD signal with an S7-1200 and expose the scaled value to the LOGO! over an S7 client/server connection. This article documents a working configuration using a 6ES7 215-1HG40-0XB0 CPU 1215C DC/DC/RLY (firmware 4.1) as the S7 server and a 6ED1 052-1MD00-0BA8 LOGO! 12/24 RCE acting as the S7 client, programmed in TIA Portal V14 SP1 and LOGO! Soft Comfort V8.2.1. The same procedure applies to the LOGO! 8.FS4 firmware (0BA8.FS4) where the client role is fully supported.

Terminology clarification. The original application question used the term "slave" to mean "the device that provides data". In an S7 communication context this role is called the server. The LOGO! is the client that actively polls the S7-1200 server. This is conceptually different from the LOGO! master/slave mode, in which a slave LOGO! acts as a passive expansion module of a master LOGO!. The S7 client/server relationship described in this article uses Ethernet ISO-on-TCP and is configured entirely in TIA Portal / LSC, not through the LOGO! expansion bus.

1. Architecture Overview

The network consists of three nodes on a common Ethernet subnet. The LOGO! is the S7 client and initiates GET requests against the S7-1200 server. The S7-1215C scales the RTD input and stores the engineering-unit temperature in a global data block. The TP700 Comfort HMI reads the same DB tag directly from the S7-1200.

LOGO! 12/24 RCE 6ED1 052-1MD00-0BA8 FW 8.2 / FS4 IP 192.168.0.10 S7 CLIENT (GET) VW0 = -80..+650 °C S7-1215C DC/DC/RLY 6ES7 215-1HG40-0XB0 FW 4.1 / TIA V14 SP1 IP 192.168.0.20 S7 SERVER (PUT/GET) DB10.RTD_Data.TempC TP700 Comfort 6AV2 124-1MC01-0AX0 WinCC Comfort V14 SP1 IP 192.168.0.30 HMI CLIENT Tag from S7-1200 DB10 SB 1231 RTD Signal Board 6ES7 231-5PA30-0XB0 — 1x RTD, PT100/PT1000/Ni100/Ni1000 Wiring: 2/3/4-wire PT100, channel 0 → IW96 S7 conn. ISO-on-TCP TSAP 01.00 → 01.01 S7 conn. Ethernet 192.168.0.0/24

The data flow is unidirectional for the temperature read: the LOGO! polls the S7-1200 on a configurable cycle (default 1 s) and stores the value in a VM (Variable Memory) word, which is then usable inside the LOGO! circuit program and on the LOGO! on-board display. The TP700 reads the same value directly from the S7-1200 for graphical display and archiving.

2. RTD Range Comparison: LOGO! AM2 vs S7-1200 RTD

The driving requirement in the original application was a measurement range of -80 °C to a positive value on a touch-screen HMI, exceeding the native LOGO! AM2 RTD range. The following table quantifies the difference.

Module Order Number Sensor Range Resolution Update
LOGO! AM2 RTD 6ED1 055-1MD00-0BA2 PT100 / PT1000 -50 °C … +200 °C 0.25 °C ~50 ms
LOGO! AM2 RTD (FW 1.0.0+) 6ED1 055-1MA00-0BA2 PT100 / PT1000 / Ni100 / Ni1000 -50 °C … +200 °C (PT) 0.1 °C ~50 ms
SB 1231 RTD (signal board) 6ES7 231-5PA30-0XB0 PT100 / PT200 / PT500 / PT1000 / Ni100 / Ni1000 / Cu10 -200 °C … +850 °C (PT100 std) 0.1 °C / 0.01 °C ~100 ms
SM 1231 RTD (4 ch) 6ES7 231-5PD30-0XB0 Pt / Ni / Cu -200 °C … +850 °C 0.1 °C / 0.01 °C ~100 ms
SM 1231 RTD (8 ch) 6ES7 231-5PF30-0XB0 Pt / Ni / Cu -200 °C … +850 °C 0.1 °C / 0.01 °C ~100 ms

Any of the S7-1200 RTD modules provides a range that fully covers the requirement, with the SB 1231 RTD being the lowest-cost option when only one channel is needed and the SB slot on the CPU 1215C is free (the DC/DC/RLY variant exposes one SB slot).

3. Prerequisites

Item Requirement Notes
S7-1200 CPU 6ES7 215-1HG40-0XB0 (CPU 1215C DC/DC/RLY) Firmware ≥ 4.1; TIA V14 SP1 supports up to FW 4.4
RTD input SB 1231 RTD (6ES7 231-5PA30-0XB0) or SM 1231 RTD Insert into SB slot or signal module slot
LOGO! 6ED1 052-1MD00-0BA8 (12/24 RCE) 0BA8.Standard or 0BA8.FS4 S7 client role requires firmware FS4 (≥ V1.16.0) or 0BA8.Standard ≥ V1.08.0
Engineering – S7 TIA Portal V14 SP1 Update 7 (or later) with S7-1200 HSP WinCC Comfort V14 SP1 for the TP700
Engineering – LOGO! LOGO! Soft Comfort V8.2.1 (LSC V8.2.1) Matches 0BA8.Standard / FS4
HMI TP700 Comfort (6AV2 124-1MC01-0AX0) Optional but typical for the target application
Ethernet switch 100 Mbit/s, unmanaged sufficient All three nodes on 192.168.0.0/24
Critical firmware check. S7 client functionality on the LOGO! is only available starting with 0BA8.Standard firmware V1.08.0. Confirm the device version under LOGO! menu Diagnostics → Product Information or in LSC Tools → Diagnostics. A 0BA8.FS4 device is the safe choice for all client/server configurations.

4. S7-1200 Hardware Configuration for RTD

  1. Insert the SB 1231 RTD into the signal-board slot at the top of the CPU 1215C. The SB is keyed and clicks into place; no tools required.
  2. Wire the PT100 (or PT1000) probe. For a 2-wire connection, jump terminals 1A/1B and 2A/2B on the SB; for 3- or 4-wire, follow the silk-screened diagram on the front flap.
  3. Power the CPU 24 V DC. Verify the SB status LED is solid green.
  4. Set the IP address from the CPU display: Settings → Addresses → IP Address (192.168.0.20, mask 255.255.255.0, no router).

In TIA Portal, after adding the S7-1215C to the project, the device view shows the SB 1231 RTD under the CPU. Configure the following parameters in the SB properties:

Parameter Setting Comment
Channel 0 — Enable Checked Disable unused channels to reduce scan time
Channel 0 — Measurement type Resistance (RTD-2/3/4L) Selection depends on wiring mode
Channel 0 — Sensor PT100 (standard) / PT100 (climatic) / PT1000 Select to match the probe
Channel 0 — Temperature unit °C Module scales raw counts to 0…27648
Channel 0 — Wire break Diagnostic interrupt enabled Wires to CPU diagnostic buffer
Channel 0 — Smoothing None / Weak / Medium / Strong Select "Weak" for ≤ 100 ms response
Channel 0 — Temperature coefficient 0.00385 (Pt) / 0.00618 (Ni) / 0.00427 (Cu) Must match probe datasheet

With these settings, the module returns an integer in the range 0…27648 that represents 0 °C at 0 counts and the sensor's full-scale temperature at 27648 counts. For a PT100 standard probe the full-scale is +850 °C, so the raw-to-temperature formula is:

T_engineering °C = (IWxx / 27648.0) × 850.0

For negative readings on PT100 climatic (-120 °C … +130 °C), the module reports the value in two's-complement form inside the lower 16 bits, which the SCL conversion below handles automatically as long as the input word is declared as INT, not WORD.

5. TIA Portal V14 Project Structure

Two coordinated projects are typically required when mixing LOGO! and S7-1200 in the same application. Some newer TIA Portal versions (V15.1+) support a single combined project with both controllers under a common PROFINET/ Ethernet subnet; with TIA V14 SP1 the two-project method is the most reliable. Both projects must be downloaded independently.

  • Project A – S7-1200 + HMI: contains the CPU 1215C, the SB 1231 RTD, the TP700 Comfort, and the S7 program with the RTD scaling block.
  • Project B – LOGO!: contains the 0BA8 (or FS4) station and the S7 client connection definition. The LSC V8.2.1 project is stand-alone and is downloaded to the LOGO! over Ethernet.
When the LOGO! is treated as a "remote partner" in TIA Portal (Devices & Networks → add LOGO! from catalog), the integration creates a virtual S7-1200-to-LOGO! link that is used for routing only. The actual TCP connection still runs between the two physical CPUs, and the connection parameters are set in the LOGO! configuration, not in the S7-1200 project.

6. S7-1200 Server-Side Configuration

  1. Add a new Data Block DB10 – "RTD_Data" with the structure shown below. Disable "Optimized block access" so that absolute byte offsets are visible to the LOGO! GET request.
DB10 "RTD_Data" — Standard access (non-optimized)
Name Type Offset (byte) Initial Comment
RawCount INT 0.0 0 Cyclic read of IW96 (SB slot)
TempC REAL 2.0 0.0 Scaled engineering value in °C
Status WORD 6.0 16#0000 Module status word
SensorFault BOOL 8.0 FALSE TRUE = wire break / overflow
  1. Create an OB1 cycle and a small SCL block (FC1 "Scale_Raw_To_Temp") that performs the conversion. The conversion is intentionally kept simple to avoid legacy TI-S7 scale block assumptions about 0…10 V:

// FC1 — Scale_Raw_To_Temp
// Input  : "RawCount" INT, "SensorFault" BOOL
// Output : "TempC"    REAL

"TempC" := INT_TO_REAL("RawCount") / 27648.0 * 850.0;

IF "SensorFault" OR ("RawCount" = 0) THEN
    "TempC" := -999.0;   // sentinel for HMI / LOGO!
END_IF;
  1. Open the CPU properties → Protection & Security and tick "Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, …)". Without this, the LOGO! S7 client cannot read the DB, even if all other parameters are correct.
PUT/GET default state. On S7-1200 firmware ≥ 4.0 the option is enabled per default, but it is re-disabled when the protection level is set to "Full access (no protection)" or when the CPU is reset to factory settings. Always re-verify after firmware updates or full-project downloads.
  1. Compile and download the S7-1200 project. Verify the value of DB10.TempC using Monitor & Force; with a 100 Ω precision resistor on the SB input you should read 0 °C ± 0.3 °C. With the resistor removed (open input), the module reports +32767 (overflow) and the FC1 output goes to the -999.0 °C sentinel.

7. LOGO! 8 Client Configuration in LSC V8.2.1

  1. Open LSC V8.2.1 and create a new project. Drag a LOGO! 8.FS4 (or 0BA8.Standard) from the catalog onto the network view.
  2. Set the LOGO! IP to 192.168.0.10 / 24 under Properties → Ethernet. The subnet mask must match the S7-1200 (255.255.255.0).
  3. Open the LOGO! properties → Ethernet Connections and add a new connection of type S7 Connection with the LOGO! as the active (client) end. The connection resource ID is assigned automatically; typically it starts at 1.
  4. Configure the partner (S7-1200) parameters:
Field Value
Partner IP 192.168.0.20
Partner TSAP 01.01 (rack 0, slot 1 — S7-1200 CPU)
Local TSAP 01.00 (LOGO! client default)
Connection type ISO-on-TCP (default for S7)
Function Read (GET) only
Source DB / byte offset DB10, byte 2 (TempC REAL, low word)
Length 4 bytes (one REAL)
Target VM address VW0 (Variable Memory word 0)
Poll cycle 1000 ms (configurable 100 ms … 60 s)
Connection name "RTD_to_LOGO" (free text)
  1. Download the LSC project to the LOGO! over Ethernet (Tools → Transfer → PC → LOGO!). The LOGO! will start polling the S7-1200 immediately and update VW0 at the configured cycle time (default 1 s).
TSAP rules. The S7-1200 server TSAP for an S7 CPU on rack 0, slot 1 is always 01.01. The LOGO! client TSAP can be any local TSAP not already in use; 01.00 is the conventional default. Both ends must agree, otherwise the connection stays in "no partner" state and the LOGO! reports a communication error in its diagnostic buffer.

8. S7 Connection Parameters and Diagnostics

Parameter LOGO! Side S7-1200 Side
Active/passive Active (client) Passive (server)
Transport protocol ISO-on-TCP (RFC 1006) ISO-on-TCP
TCP port 102 102
Local TSAP 01.00 01.01
Partner TSAP 01.01 01.00
Cycle time 1000 ms (configurable) n/a (server)
Read length max 32 bytes per GET block Per CPU spec (≥ 128 bytes total)
Connection resource 1 (default) auto
Connection setup timeout ~5 s ~10 s
Keep-alive Internal (~30 s) TCP default (~2 h)

On the S7-1200 side, the active connection is visible in Online & Diagnostics → Connections. The connection state should report ESTABLISHED with a "S7 Communication" entry once the LOGO! powers up. The S7-1200 CPU also logs a single "Communication initiated" entry in the diagnostic buffer at first contact. On the LOGO! side, navigate to Diagnostics → Ethernet → Connections to see the same connection from the client perspective, including the last successful poll timestamp.

9. RTD Value Scaling: From Raw Counts to Engineering Units

The complete scaling chain has three steps:

  1. Module scaling – SB 1231 RTD converts the probe resistance to integer counts in 0…27648 across the configured temperature range.
  2. CPU scaling – FC1 multiplies the raw count by the full-scale value to obtain a REAL in °C, applies sign extension for negative values, and replaces out-of-range values with the sentinel -999.0.
  3. LOGO! display – LOGO! receives the 4-byte REAL and stores it in a VM word pair (e.g., VW0). The VM word is then placed on the LOGO! display using the analog-threshold function block, or used as a direct variable inside the circuit program.
Probe Wires Full-Scale Scale Factor (°C / count) Notes
PT100 std 2 / 3 / 4 +850 °C 850 / 27648 = 0.03074 Industrial standard, widest range
PT100 climatic 2 / 3 / 4 +130 °C 130 / 27648 = 0.00470 Higher resolution (± 0.05 °C) for HVAC
PT1000 std 2 / 3 / 4 +850 °C 0.03074 Use for long cables > 10 m
Ni100 / Ni1000 2 / 3 -60 … +250 °C 310 / 27648 = 0.01121 Cold-side compensation

For a -80 °C lower bound with PT100 climatic (-120 … +130 °C), the SB reports negative counts in two's complement. The SCL code INT_TO_REAL handles sign extension correctly because RawCount is declared as INT, not WORD. If the DB declaration is inadvertently WORD, negative readings wrap to 65000+ counts and the scaling breaks. Always declare RawCount as INT in DB10 and ensure DB10 has "Standard access" so the absolute byte offset 0 is exposed.

Why optimized DB access breaks GET. Optimized block access (the default for new DBs in TIA Portal V14+) hides the absolute byte offsets of tags and stores them in a non-deterministic order. The LOGO! GET request specifies an exact byte offset, so it cannot read optimized DBs. Either disable optimization on DB10, or expose the values via a non-optimized copy DB that the LOGO! can read.

10. HMI Integration with TP700 Comfort

The TP700 reads DB10.TempC directly from the S7-1200 using a standard S7 HMI connection. Configure the connection in the HMI device configuration:

  1. Add the TP700 to the same project as the S7-1215C. WinCC Comfort assigns a default HMI connection of type S7 with TSAP 03.01 for the panel side.
  2. Drag a connection from the TP700 Connections node to the S7-1215C. The active connection setup is performed by the panel.
  3. Create an HMI tag "ProcessTemp" of type REAL mapped to %DB10.DBX2.0 FLOAT on the S7-1200 (or to a symbolic DB10.RTD_Data.TempC if symbolic addressing is enabled).
  4. Place a numeric I/O field on the start screen, select "ProcessTemp" as the tag, and set the format to 999.9 °C with limits -120.0 … +850.0. The acquisition cycle default is 1 s; lower to 500 ms for snappier display.
  5. Optionally add a second I/O field bound to DB10.SensorFault that turns red on TRUE, plus a message class that latches the wire-break event in the HMI alarm log.

For the LOGO!-side data logging mentioned in the original requirement ("use the logo access excel spreadsheet to save data"), the LOGO! 8 records the VM area cyclically to its internal data log; LSC's Tools → Data Log exports the log to CSV that opens directly in Excel. This is independent of the S7-1200 connection and does not consume any communication bandwidth.

Data-log path. On a LOGO! 8.FS4 the data log is stored in internal flash. The CSV export is performed from LSC: Tools → Transfer → Data Log. The file includes a timestamp column derived from the LOGO! real-time clock, so the LOGO! must have its clock set (NTP via the S7 connection, or manually from the device menu). The internal flash endurance on the LOGO! is rated for ~1 million write cycles per sector, so for a 1-Hz poll a single VM word can be logged continuously for many years without sector wear-out.

11. Commissioning and Verification

After both projects are downloaded, perform the following checks in order:

  1. CPU status: On the S7-1215C display, navigate to Diagnostics → Connection → S7 Connections. The connection from TSAP 01.00 should show state ESTABLISHED. The MAC address matches the LOGO! device.
  2. LOGO! status: On the LOGO! on-board display, navigate to Diagnostics → Ethernet → Connections. The S7 connection should report OK with the last successful poll timestamp.
  3. Tag values: Force a known temperature (e.g., simulate -80 °C with a precision decade box set to 68.33 Ω for PT100, equivalent to -80 °C) and confirm that the value at LOGO! VW0 matches DB10.TempC on the S7-1200.
  4. HMI display: On the TP700 start screen, the numeric I/O field should show the same value with a 1-second update (default LOGO! poll).
  5. Wire-break test: Disconnect one probe wire at the SB terminal. The CPU should raise a diagnostic interrupt; DB10.SensorFault should latch TRUE and the HMI field should display the sentinel value -999 °C (or whatever the project defines).
  6. Endurance test: Leave the system running for ≥ 24 h with the values logged. The LOGO! data log should contain ≥ 86,400 entries at a 1-s poll (or the configured cycle).
Check Pass Criterion Tool
S7 connection state ESTABLISHED S7-1200 display / TIA Online
LOGO! VM value Matches DB10.TempC ± 0.1 °C LSC online monitor
HMI refresh ≤ 2 s update rate TP700 online view
Wire-break detection SensorFault = TRUE within 5 s Remove probe wire
Data log CSV opens in Excel, no gaps LSC Data Log export
CPU cycle impact S7-1200 cycle < 150 ms TIA Online → PLC → Cycle time

12. Troubleshooting Matrix

Symptom Likely Cause Remedy
S7 connection in "no partner" state Wrong IP, wrong TSAP, or firewall on S7-1200 Verify IP ping, set TSAP both ends to 01.00/01.01, disable firewall in CPU properties during test
Connection establishes but data is always 0 PUT/GET access disabled on S7-1200 CPU Properties → Protection & Security → tick "Permit access with PUT/GET communication"
VM value flickers / random DB optimized, offset wrong, or DB10 not downloaded Open DB10 with "Standard access" enabled, verify byte offsets in DB editor, re-download
Negative temperatures wrap to 65000+ RawCount declared as WORD instead of INT Change DB declaration to INT; recompile and re-download
Wire break not detected Diagnostic interrupt disabled on SB Enable "Diagnostic interrupt" on the channel; re-download hardware config
LOGO! client cannot be selected in TIA / LSC Wrong LOGO! firmware version (pre-V1.08.0) Update LOGO! to FS4 firmware via LSC online update
Connection drops after a few hours LOGO! keep-alive timeout too short, or watch-dog on S7-1200 Increase LOGO! cycle to 2 s; check S7-1200 CPU cycle time < 150 ms
CSV data log missing rows LOGO! clock not set / battery low Set NTP or manual clock; replace battery (CR2032) on the LOGO! base module
HMI shows "###" in numeric field Value out of configured display range Widen field limits in TP700 tag configuration
LOGO! reports 0x01 "Communication error" TSAP mismatch or partner unreachable Cross-check both TSAP values; confirm cable and switch port LED
Reading is stable but always half of expected Two adjacent variables in DB, only low word read Increase GET length to 4 bytes (one REAL), or split into two INT reads
CPU diagnostic buffer shows SF LED blinking SB 1231 channel fault (open / short) Check wiring; replace probe; clear diagnostic buffer

Frequently Asked Questions

Can the S7-1215C act as an S7 "slave" to a LOGO! 8 master?

Yes, but the correct S7-communication term is server, not slave. Configure the LOGO! as the S7 client (active, initiating GET/PUT) and the S7-1215C as the S7 server. The S7-1200 must have PUT/GET access enabled in CPU properties under Protection & Security.

Which S7-1200 RTD module gives the largest temperature range?

The SB 1231 RTD (6ES7 231-5PA30-0XB0) and the SM 1231 RTD modules (4-ch 6ES7 231-5PD30-0XB0 and 8-ch 6ES7 231-5PF30-0XB0) all cover -200 °C to +850 °C with PT100 standard, fully exceeding the -80 °C lower bound required by the application.

How many S7 connections can a LOGO! 8 maintain at once?

A LOGO! 8.FS4 supports up to 16 network connections in total, of which several can be S7 client connections. A 0BA8.Standard (firmware ≥ V1.08.0) supports up to 8 S7 connections with at least one S7 client role active.

Does the S7 client communication work without TIA Portal for the LOGO!?

No. The S7 connection parameters (TSAP, partner IP, target VM address, poll cycle) must be configured in LOGO! Soft Comfort (LSC V8.2.1 or later) and downloaded to the LOGO!. There is no on-board display menu for S7 client setup on the LOGO! base module.

Can the same S7-1215C be polled by both the LOGO! and the TP700 at the same time?

Yes. The S7-1200 supports multiple concurrent S7 connections (up to the resource limit, typically 16 for CPU 1215C). Each client uses an independent connection resource and a different TSAP pair, so the LOGO! and TP700 do not interfere. The CPU distributes the requests across its OB1 cycle.

Why does the LOGO! VM show 0 even though TIA shows the correct value?

Three frequent causes: (1) the S7-1200 has PUT/GET access disabled; (2) DB10 was created with "Optimized block access" and the LOGO! cannot address the symbol; (3) the GET length is wrong (e.g., 2 bytes for a 4-byte REAL). Open DB10 properties and disable optimization, then verify the GET block specifies 4 bytes from byte offset 2.

Back to blog