LOGO! VM Memory Mapping and MODBUS TCP Data Exchange

Why LOGO! Has No Data Blocks

The Siemens LOGO! family (LOGO! 8 / 0BA8, part numbers 6ED1052-xxxxx-0BA8) is a compact logic module, not a full SIMATIC PLC. It deliberately omits the Datenbaustein (DB) concept used by S7-300/400/1200/1500. A LOGO! program is a single FBD/LAD diagram that executes cyclically, with no separable loadable data containers.

Anything you would normally place in a DB on an S7 PLC is, on a LOGO!, expressed as:

• Retentive flags (M, AM) that survive power-off
• Non-retentive flags (VB) cleared on cold restart
• The dedicated VM (Variable Memory) word area accessible over Ethernet
• Process-image words VW / bytes VB that mirror the VM area

VM is the closest analogue to a global data block in a LOGO!; it is the only memory area the rest of the network can read or write without program involvement. This is the area to use whenever the question is "where do I put a buffer the other controllers can poll?".

LOGO! 8 Hardware and Firmware Prerequisites

Data buffering over Ethernet and MODBUS TCP requires the LOGO! 8 platform. The minimum feature set is:

Confirm the firmware revision under LOGO! → Diagnostics → Device Information in LOGO!Soft Comfort. A device reporting FS02 or FS03 must be firmware-updated to FS04 or later before MODBUS TCP becomes selectable as a protocol.

VM Memory Map and Address Space

VM is the single namespace that bridges program variables and network exposure. The mapping is fixed and identical on every LOGO! 8 base module:

You access VM from the program as VW<offset> on an Analog Flag block, a Math block, or a UDT-style block. The same value is exposed to the outside world at the matching MODBUS holding-register address:

• VW0 ↔ Modbus Holding Register 0 (address 0)
• VW16 ↔ Modbus Holding Register 16
• VWn ↔ Modbus Holding Register n

The mapping is a 1:1 offset, zero-based, and word-sized (16 bits, big-endian on the wire per the Modbus specification). Bit-level read is via Modbus function 0x01 / 0x05 (coils) and uses byte addresses n*16 + bit derived from VW. Reference: Modbus Application Protocol V1.1b3.

Implementing a Buffer in VM Memory

A traditional data block with array indexing does not exist on LOGO!; there is no indirect-addressing instruction. The practical workarounds are:

Option A: Fixed-slot ring buffer (recommended)

Reserve N consecutive VM words, e.g. VW200 ... VW249 for a 50-sample buffer. Use an Up/Down counter (block Counter) running 0..49 as the slot index. The slot is decoded with a 1-of-N demux built from a Shift Register or with parallel comparator blocks:

AI1 (analog input) --> [Math: /10] --> [Mux sel=Counter_out] --> VW200..VW249
                         Counter triggers on each scan-of-acquisition
                         (e.g. 1 Hz from Timer B=1 s)

For 16 or 32 slots this remains compact; beyond ~50 slots the FBD becomes impractical.

Option B: Block Move with explicit copies

If the buffer never needs to be searched or re-ordered, write each new value to a dedicated VW and let the master (S7-1500 / WinCC) build the time series:

AI1 --> [Analog Threshold x N] --> VW300
                                   VW302
                                   VW304 ...

This is the cleanest pattern for a "remote I/O with local snapshot" topology, which is exactly the use case in the original question.

Option C: Use the on-board Shift Register block

The Shift Register (8 bits wide, up to 32 stages) provides first-in/first-out behaviour for digital flags. It cannot hold analog values and is not network-accessible; treat it as scratchpad only.

Inter-LOGO! Communication with Network I/O (NI / NQ)

For LOGO!-to-LOGO! traffic without an external master, LOGO! 8 supports peer-to-peer Network Inputs (NI) and Network Outputs (NQ):

Configuration: Tools → Ethernet Connections → Network I/O in LOGO!Soft Comfort. Up to 16 LOGO! 8 modules can be in a single network. Each remote must be on the same subnet and reachable on UDP port 50005 / 50006 by default. See the LOGO! 8 system manual, section on "Network communication" in SIOS entry 109741041.

For a "local remote I/O + central server LOGO!" topology this is the simplest data path:

1. Each client LOGO! assigns 4–8 analog values to its NQ1..NQ8 block outputs.
2. Server LOGO! declares matching NI1..NI32 / NAI1..NAI8 for each client IP.
3. Values appear at the server every cycle (typical latency 20–100 ms).

The server can then copy NAI1..NAI8 of every client into its own VM area (e.g. VW200 for client #1 AI1, VW208 for client #2 AI1, ...) to expose the aggregate buffer to MODBUS / WinCC / S7 master.

MODBUS TCP Server Mode (FS04 Firmware)

From FS04, the LOGO! 8 base module runs a MODBUS TCP server on TCP port 502 by default. The server is permanently active and cannot be disabled per device – there is no licence flag. Supported function codes are the standard subset:

To expose a buffer of 50 analog samples to an external master, allocate VW200..VW249, write to it from the program, and the master reads the same range with FC 0x03 starting at register address 200. No additional configuration is required on the LOGO! side – VM is the Modbus data model.

If you need write access from the master, FC 0x06 and FC 0x10 will overwrite the VW. Make sure no FBD output writes to the same VW in the same cycle; the program always wins the arbitration, so the master write is silently overridden. Use a guarded region (a flag that gates the FBD write) to avoid that race.

MODBUS TCP Client Mode (FS04 Firmware)

LOGO! 8 FS04 can also act as a client (master) and poll up to 8 MODBUS TCP servers. Configuration is via the MODBUS Master function block in LOGO!Soft Comfort. Each block instance defines:

• Target IP address (any IPv4 in the local subnet)
• Target port (default 502)
• Function code (0x03, 0x04, 0x06, 0x10)
• Starting register address and word count
• Local destination VWn..VWn+k

The block triggers on a Boolean input and stores the result in the destination VWs within one or two program cycles. With a 200 ms trigger this comfortably supports 8 polled servers at 25–50 samples per second aggregate.

Configuring a Data-Collector LOGO! Architecture

For the original application – multiple field LOGO!s acting as local remote I/O, one central "server" LOGO! – the proven configuration is:

1. Every field LOGO! publishes up to 8 analog values to its NQ block (digital flags limited to 32 per remote).
2. Server LOGO! declares a Network Input block for every field LOGO! IP, mapping the remote NQs into local NAIs (NAI1..NAI8 per client).
3. Server LOGO! copies each client NAI group into a contiguous block of its own VM (e.g. VW200 = client #1 AI1, VW208 = client #2 AI1, ...). Use 8-VW gaps so that future expansion to 8 AIs per client does not require moving the layout.
4. Optional: connect an S7-1200 / S7-1500 as MODBUS TCP master to the server LOGO! to bring the aggregate buffer into the SIMATIC world. Function block MB_CLIENT in TIA Portal (instruction manual SIOS 109751348) handles the request and writes the result into a global DB on the S7 side.

Programming in LOGO!Soft Comfort

The minimum project to publish a 4-sample buffer over MODBUS TCP is roughly 12 FBD blocks. Step-by-step:

1. Create a new project in LOGO!Soft Comfort V8.3 and select device LOGO! 8 (0BA8) Standard.
2. From the analog input list, drag AI1 onto the diagram. Wire it to an Analog Flag named BufferSlot0 with address VW200.
3. Add a 1-Hz timer (block On-Delay, parameter T = 1 s). Use its output to latch a Counter block (range 0..3, threshold 4). The counter's CV drives the select input of a four-way Analog Mux block whose four inputs are wired to four successive Analog Flags VW200, VW201, VW202, VW203. (Without the Mux, you must hard-code the slot from outside; the Mux gives a moving snapshot.)
4. For network exposure, no further work is required – the values in VW200..VW203 are automatically at MODBUS holding-register addresses 200..203.
5. On the S7-1500 side, instantiate MB_CLIENT with MB_MODE=1 (read), MB_DATA_ADDR=200, MB_DATA_LEN=4, target IP = LOGO! server address, port 502. The destination MB_DATA_PTR points to a tag in a global DB sized at least 4 words.

Verification, Diagnostics, and Common Faults

After download to the LOGO! and restart, validate in this order:

1. From a PC, ping the LOGO! IP. No reply means IP/DHCP or cable problem.
2. Run Modbus Poll or QModMaster against <LOGO IP>:502, FC 0x03, address 200, length 4. You should see live counts.
3. In LOGO!Soft Comfort open Online → Online Test, tab VM Area. The same values must show under VW200..VW203. If they don't, the FBD is not actually writing to those addresses (e.g. you wired to a local M flag instead of an Analog Flag with the VM address).
4. On the S7-1500, put a watch table on the destination DB. Values should update every MB_CLIENT cycle.

Performance Limits and Migration to S7-1200

LOGO! 8 is rated for 200 blocks / 400 I/O max per program, cycle time 8–20 ms, and a 1-second minimum retain interval. If a project outgrows these – typical signs are buffers > 50 entries, cycle time > 50 ms, or the need for indirect addressing – migrate to an S7-1200 with a real DB. The S7-1200 can act as MODBUS TCP master/peer and expose the buffer via OPC UA, S7 comm, or Profinet, none of which the LOGO! can do natively.

A staged migration is straightforward:

1. Keep the LOGO! field stations; their analog inputs are still useful as remote I/O.
2. Replace the server LOGO! with an S7-1200 CPU 1214C or 1215C. Use MB_CLIENT on the S7-1200 to poll the existing field LOGO!s (they continue to publish via NI/NQ if the new master supports it, or fall back to MODBUS TCP server on the field LOGO!s directly).
3. Move the buffer into a proper DB on the S7-1200; index with the standard POKE_BLK / PEEK_BLK instructions.

Frequently Asked Questions