LOGO! Soft Comfort Password Prompt: Ethernet Timeout Fix

Problem Overview

Engineers commissioning a Siemens LOGO! 6ED1052-1CC08-0BA0 (LOGO! 24CE, 24 V DC, with Ethernet) sometimes encounter a password dialog the moment LOGO!Soft Comfort initiates a download or upload. The prompt is raised even when:

• The device is brand new and has never contained a user program.
• The project in LOGO!Soft Comfort has no password protection enabled.
• The password in the LOGO! device has been explicitly cleared from the on-board menu.

The dialog accepts no password that the user can supply, and no program transfer is possible. Removing the WiFi adapter on the engineering PC restores the link immediately, confirming that the prompt is not a security feature but a communication timeout symptom.

This article documents the exact root cause, the firmware/software envelope where the symptom appears, and a field-proven diagnostic and remediation procedure.

Affected Hardware and Software Versions

Root Cause: Ethernet Timeout Masquerades as a Password Prompt

LOGO!Soft Comfort uses a proprietary Ethernet handshake over TCP port 1352 (S7 communication) to identify the target LOGO! and exchange program/project data. The handshake has a short timeout window (typically a few seconds). If the response from the LOGO! is not received inside that window, the client raises a generic authentication challenge instead of a low-level transport error.

The TCP timeout is almost always caused by one of the following on the engineering PC:

1. Dual-stack adapter contention. The PC has both a WiFi and a wired Ethernet interface enabled. Both adapters belong to the same IP subnet (or the wired interface has an automatic-metric route the OS prefers), and the LOGO!Soft Comfort socket opens against an interface that cannot actually reach the LOGO!.
2. IP address conflict. A second device on the wired segment already owns the IP address that the LOGO! was assigned (e.g., 192.168.0.10). The duplicate-address detection (DAD) inside the LOGO! suspends its S7 server for several seconds while it arbitrates the address, missing the client's timeout.
3. Firewall / security suite drop. Third-party security software (Kaspersky, Norton, Windows Defender Network Protection) intercepts the very first SYN to TCP/1352, queuing the packet while it queries a cloud reputation service. The reply never arrives in time.
4. Switched port / duplex mismatch. A legacy 10 Mb/s hub or a forced-100/half port silently drops the LOGO!'s auto-negotiation response. The PC retransmits, and the timeout is reached before the second attempt completes.

In the failure path most often reported, the PC connects to the wired network on 192.168.0.1/24 and the LOGO! sits on 192.168.0.10. The WiFi adapter is connected to a home or guest network on 192.168.1.0/24. The Windows TCP/IP stack binds the S7 socket to the interface with the lowest route metric, which is not always the wired one. As a result, every SYN goes to the wrong network, the LOGO! never responds, and LOGO!Soft Comfort falls through to the password dialog.

Why the Dialog Says "Password"

The Siemens S7 protocol family reserves the initial PDU exchange for a connection-establishment frame that includes the optional password / access-protection object. When the client implementation does not receive any response, it cannot distinguish between:

• A LOGO! that requires a password it does not have, and
• A LOGO! that never received the request at all.

The client therefore surfaces the password entry dialog as the lowest common denominator. Re-entering the password (or leaving it blank) does not help because the underlying socket has already been closed. The behavior is the same across LOGO!Soft Comfort 8.2.0 and 8.2.1, and across firmware V1.82.02 and the older V1.82.01 line.

Diagnostic Procedure

1. Confirm the link is up. From an elevated command prompt on the PC, run arp -a and look for the LOGO!'s MAC address (printed on the front of the module, e.g., 00-0E-8C-xx-xx-xx). If the entry is present and the IP is correct, Layer 2 is good.
2. Latency probe. Run ping -n 20 192.168.0.10 and confirm round-trip times under 5 ms with 0 % loss. A 30 %+ loss or > 200 ms RTT will exceed the LOGO!Soft Comfort timeout.
3. Port reachability test. Use Test-NetConnection -ComputerName 192.168.0.10 -Port 1352 in PowerShell. TcpTestSucceeded : True is required for a successful upload/download.
4. Identify the binding interface. From PowerShell, run Get-NetRoute | Sort-Object RouteMetric. The route to 192.168.0.0/24 with the lowest metric identifies which adapter Windows will use. If the metric is on the WiFi adapter, the S7 socket will follow the wrong path.
5. Check for IP conflicts. Run arp -d * followed by arp -a after a fresh ping. If the MAC address bound to 192.168.0.10 is not the LOGO!'s MAC, an IP collision is in progress.
6. Audit firewall behavior. Temporarily disable any third-party security suite and re-attempt the upload. If the password prompt disappears, add a permanent inbound/outbound allow rule for %ProgramFiles%\Siemens\LOGOComfort_V8\LOGOComfort.exe on TCP/1352.

Resolution

Step 1 – Isolate the engineering link

Disable every network adapter that is not connected to the LOGO!. The fastest, least destructive way is from the Windows UI:

1. Open Control Panel > Network and Sharing Center > Change adapter settings.
2. Right-click the WiFi adapter and choose Disable.
3. Re-launch LOGO!Soft Comfort and select Tools > Transfer > PC ↔ LOGO!.

When the upload completes successfully, the WiFi adapter can be re-enabled. The metric cache will not be reverted automatically; it is only cleared on adapter restart or route change.

Step 2 – Force the wired interface to win the route

For installations where WiFi cannot be disabled (laptops on a shared corporate network), force a lower metric on the wired NIC:

netsh interface ip set interface "Ethernet" metric=10
netsh interface ip set interface "Wi-Fi" metric=50

Verify with route print. The 192.168.0.0/24 entry should now point to the wired gateway with a 10/50 metric spread.

Step 3 – Eliminate any IP conflict

If arp -a shows a foreign MAC on the LOGO!'s IP, reserve the address in the DHCP server (or set a static address outside the DHCP pool). On the LOGO! itself, navigate to Network > IP Address and confirm the value; on the 0BA0 variant without display, this is configured through LOGO!Soft Comfort under Tools > Ethernet Connections.

Step 4 – Remove or replace the LOGO!Soft Comfort installation

If the timeout persists after Steps 1–3, the LOGO!Soft Comfort installation itself may be corrupted. Reinstall using the latest package from Siemens Industry Online Support. Use the Windows Programs and Features applet to uninstall LOGO!Soft Comfort V8.2 completely, including the LOGO!Soft Comfort V8.2 Device Library and any leftover LOGOComfort services. Then run a fresh install with administrator rights.

Step 5 – Use microSD as a fallback path

If the Ethernet path remains unusable, the program can always be pushed to the LOGO! by microSD card. Export the project from LOGO!Soft Comfort with File > Export to microSD and copy the resulting .bin onto a FAT32-formatted SD card. Insert the card into the LOGO!, power-cycle, and the program is loaded directly. The card can be write-protected before insertion to prevent the LOGO! from writing back to it.

Verification

After applying the resolution, perform the following checks in order:

1. LOGO!Soft Comfort: Tools > Transfer > PC ↔ LOGO! completes without raising the password dialog.
2. Status bar shows the LOGO! type, firmware, and operating mode (RUN/STOP).
3. Online test (Tools > Start Online Test) shows live I/O states updating at the configured poll interval.
4. Diagnostic buffer of the LOGO! contains no new "communication interrupted" entries.
5. Re-enable the previously disabled WiFi adapter. The route metric may shift, but the connection should remain stable. If it does not, make the metric change from Step 2 permanent via a scheduled task or a NIC advanced property.

Prevention and Best Practices

• Dedicated service interface. Configure a USB Ethernet dongle solely for LOGO! access. Its link-local metric is much lower than any built-in adapter, eliminating the dual-stack problem.
• Static IP on the LOGO!. Avoid DHCP for the LOGO! module. Set a fixed IP outside the DHCP pool, document it, and apply it consistently across the engineering fleet.
• Firewall exception. Pre-create an inbound rule for LOGOComfort.exe on TCP/1352 in any centralized Windows image or Group Policy.
• Version pinning. Keep one stable pair of (LOGO!Soft Comfort, firmware) per project. The V1.82.02 firmware and 8.2.1 software pairing is currently the recommended baseline for the 6ED1052-1CC08-0BA0.
• Cable discipline. Use Cat 5e or better, and avoid inline couplers. The LOGO!'s auto-MDI/MDIX port does not negotiate well with degraded cables longer than 50 m.

Related Issues and Cross-Reference

Spare-Part and Compatibility Matrix

Quick Reference: Default IP and Protocol

Field Notes and Caveats

• Siemens officially supports V1.82.02 as the latest firmware for the 0BA8 generation. Newer 0BA8.x variants (e.g., 6ED1052-1CC08-0BA1) ship with a different FS revision and are not interchangeable in this firmware line.
• When two LOGO! modules are on the same PC, each must be addressed individually by IP. The PC must disable any automatic "network discovery" feature that probes the segment before LOGO!Soft Comfort is launched.
• If a corporate VPN is active, split-tunnel routing may push the S7 traffic over the VPN adapter. Disconnect from the VPN before commissioning.
• The 0BA0 (no display) variant cannot show a password prompt on the device itself; the prompt is purely a client-side artifact.

FAQ