Problem: LOGO! 8 Reports Negative Values but KTP 700 Basic Shows Wrong Numbers
When a Siemens LOGO! 8 base module is networked with a SIMATIC KTP 700 Basic panel over Ethernet, the panel may fail to display negative integer values even though the same value is shown correctly on the LOGO! onboard display. The fault is typically observed on a temperature channel scaled in the range −20 °C to +30 °C, where the panel either stops updating, shows 0, or shows a large positive number such as 65516 as soon as the process value crosses into negative territory.
Symptom summary:
- Positive process values (for example +25 °C) display correctly on the KTP 700 Basic.
- Negative process values (for example −5 °C) display as 0, as 65535 minus the actual value, or as
######/***. - The LOGO! 8 onboard display and the Web-based LOGO! Access Tool still show the correct signed value.
- The panel does not generate a diagnostic buffer entry and the value continues to update. The sign bit is interpreted incorrectly while the magnitude and update behavior remain intact.
Affected Hardware and Software
| Component | Article Number | Role |
|---|---|---|
| LOGO! 12/24 RCE (LOGO! 8 generation) | 6ED1052-1MD08-0BA1 | Base module with Ethernet, 8 DI / 4 DO / 4 AI, display |
| LOGO! 230 RCE (LOGO! 8 generation) | 6ED1052-1FB08-0BA1 | Relay output base module, 230 V variant |
| LOGO! 24 RCE (LOGO! 8 generation) | 6ED1052-1HB08-0BA1 | Transistor output base module, 24 V supply |
| LOGO! 24 CE (LOGO! 8 generation) | 6ED1052-1CC08-0BA1 | Base module without display, 24 V supply |
| SIMATIC HMI KTP700 Basic | 6AV2123-2GB03-0AX0 | 7 inch touch panel, 800 x 480, PROFINET interface, configurable with WinCC in TIA Portal |
| LOGO! Power 24 V / 1.3 A | 6EP3331-6SB00-0AY0 | Power supply bundled in starter kit |
| Starter Kit LOGO! 8 12/24 V + KTP700 Basic | 6AV2132-3GB00-0AA1 | Bundle: LOGO! 12/24 RCE + 24 V power supply + KTP 700 Basic panel |
| TIA Portal | V13 SP1 minimum; V15.1, V16, V17, V18 recommended for current support | Single engineering tool for LOGO! 8 program and KTP 700 Basic configuration |
| LOGO! Soft Comfort | V8.0 minimum for LOGO! 8; V8.4 / V8.5 / V9.0 for current generation | LOGO! 8 ladder / FBD program editor; integrates with TIA Portal |
LOGO! 8 base modules appear as S7-compatible Ethernet devices in TIA Portal. The KTP 700 Basic panel uses the same S7 connection mechanism. Both are programmed in a single TIA Portal project, with the LOGO! 8 program compiled to a LOGO! Soft Comfort project and downloaded separately to the base module via Ethernet or micro SD card.
Root Cause: Unsigned vs Signed Tag Data Type
The root cause is a data type mismatch between the LOGO! variable memory and the WinCC HMI tag. The value stored in the LOGO! 8 VM area is a 16-bit signed integer. WinCC reads the raw 16 bits correctly, but if the HMI tag is configured as Word the runtime interprets the bits as an unsigned value with a range of 0 to 65535. Two's-complement negative numbers are then rendered as large positive numbers.
Worked example: a measured value of −20 °C is stored in VM as the 16-bit pattern 0xFFEC (binary 1111 1111 1110 1100). Reading this back as Word yields decimal 65516. Reading the same 16 bits as Int yields decimal −20. The difference between these two interpretations is exactly the sign bit (bit 15) plus the two's-complement weighting of the remaining 15 bits.
Why the LOGO! onboard display works: the LOGO! 8 base module knows the symbolic context of the variable (analog amplifier output, threshold, comparator, or counter) and applies the correct signed or unsigned format automatically. WinCC, in contrast, only knows the raw 16-bit data type declared in the HMI tag. The choice must be made at configuration time and it must match the LOGO! program context.
UINT, WORD, or DWORD while the source value is signed. The fix is always to switch the WinCC tag to Int (or DInt for 32-bit signed values, or Real for floating-point values). Selecting the larger or unsigned type never recovers the sign information once the bits have been read.Data Type Mapping Between LOGO! 8 and WinCC
The following table maps LOGO! 8 VM element sizes to the correct WinCC HMI tag data type. The LOGO! stores scaled analog values as signed 16-bit integers internally; floating-point math in LOGO! 8 is handled differently and is covered in the next section.
| LOGO! 8 VM Element | Size (bits) | WinCC Data Type | Numeric Range | Typical Use Case |
|---|---|---|---|---|
| VB (byte) | 8 | Byte / USINT | 0 to 255 | Digital status byte, low byte of a 16-bit counter |
| VW (word) | 16 | Int (signed) | −32 768 to 32 767 | Scaled analog values, temperatures, counters up to 32 767 |
| VW (word) | 16 | Word / UInt (unsigned) | 0 to 65 535 | Bit masks, status words, unsigned counters above 32 767 |
| VD (double word) | 32 | DInt (signed) | −2 147 483 648 to 2 147 483 647 | 32-bit counters, scaled values with gain > 1 that overflow Int |
| VD (double word) | 32 | Real / Float | ±3.4e38 (approx., IEEE 754 single precision) | Floating-point math outputs from LOGO! 8 math / analog math blocks |
Selection rule: if the LOGO! 8 program path is analog input → analog amplifier → VM address with a gain in the 0.01 to 100 range, the value at the amplifier output is stored as a 16-bit signed integer at the configured VM address. Int is almost always the correct WinCC data type. If the path is analog input → math instruction → VM address, the output is a 32-bit float and the tag must be Real.
Solution: Reconfigure the HMI Tag Data Type to Int
The corrective action is purely a TIA Portal configuration change. No firmware update, hardware swap, or rewiring is required.
Prerequisites
- TIA Portal V13 SP1 or later installed. V16 or later is recommended for current Siemens support.
- The TIA Portal project containing both the LOGO! 8 device and the KTP 700 Basic device.
- Read/write access to the project. The change can be done offline and downloaded to the panel.
- Ethernet connectivity between the engineering PC and the KTP 700 Basic (or transfer via USB or TIA Portal HMI SP).
Step-by-Step Procedure
- In the TIA Portal project tree, open Devices & Networks and confirm that the LOGO! 8 base module and the KTP 700 Basic panel are configured in the same project and connected by an S7 connection (PROFINET or Ethernet). The connection is visible as a solid line between the two device icons.
- Select the KTP 700 Basic device in the project tree.
- Open HMI tags → Default tag table (or the user-defined tag table that contains the temperature tag).
- Locate the tag that points to the LOGO! 8 VM address (for example
VW10). The address is shown in the Address column of the tag editor; the connection is shown in the Connection column. Confirm the address matches the value configured in LOGO! Soft Comfort for the relevant analog output. - Open the tag and change the Data type from
WordtoInt. - Confirm the PLC tag name and address remain unchanged. Only the data type should be modified.
- If the tag is used in a screen object (IO field, bar, gauge, text field), open the screen and verify that the Process value or Tag property still references the renamed tag. WinCC updates the reference automatically when the data type changes, but a visual check is good practice.
- For an IO field: open Properties → General and set the Display format to a signed decimal pattern, for example
999;-999ors999. The default999pattern does not show a leading minus sign even when the value is correctly typed as Int. - Compile the HMI project: right-click the KTP 700 Basic device → Compile → Software (rebuild all). Address any warnings about cross-references.
- Download the project to the panel: right-click the KTP 700 Basic device → Download to device → Software. Use a direct Ethernet connection or route through the LOGO! 8 subnet. After the download, the panel restarts and the new tag types take effect.
Verification Procedure
After downloading, force a negative value to verify correct display:
- On the LOGO! 8, use the Set function on the analog input to override the sensor reading. Set the input to a known negative value, for example −15.0 °C.
- On the LOGO! 8 onboard display, confirm the value shows as −15.0. If the onboard display does not show the correct value, fix the LOGO! program first; the HMI cannot compensate for a bad source.
- On the KTP 700 Basic, switch to the screen containing the IO field. The value should now show −15.
- Repeat with +25 °C to confirm the positive range is unaffected.
- Check the Web-based LOGO! Access Tool by entering
http://<LOGO! IP>in a browser. Navigate to Variables and confirm the raw VM value matches the value displayed on the panel. - Cycle power on the panel and on the LOGO! 8 to confirm the fix is persistent and survives a restart.
Expected result: the IO field shows the same signed decimal value as the LOGO! 8 display. No diagnostic buffer entries are written; no alarm is raised; the bar or gauge renders the correct fraction of its configured range.
LOGO! 8 Variable Memory Reference
LOGO! 8 base modules expose a variable memory (VM) area to the S7 connection. The following table summarizes the address ranges available on the standard LOGO! 8 base modules without expansion modules.
| Address Range | Size | Notes | /thead>|
|---|---|---|---|
| Bit (V) | V0.0 to V850.7 | 851 bytes | Bit-level access, used for digital flags |
| Byte (VB) | VB0 to VB850 | 851 bytes | 8-bit unsigned |
| Word (VW) | VW0 to VW849 | 850 16-bit words | Byte offset must be even; offset 0, 2, 4 … 848 |
| Double word (VD) | VD0 to VD848 | 848 32-bit values | Byte offset must be divisible by 4; offset 0, 4, 8 … 848 |
Address syntax in TIA Portal HMI tags: enter the absolute VM address in the Address field. For a 16-bit word, the address is VW<n> where n is the even byte offset. For a 32-bit double word, the address is VD<n> where n is a multiple of 4. The address can be entered with or without the leading zero; both VW10 and VW010 are accepted.
Analog Signal Path Inside LOGO! 8
To make a confident decision about data type, it helps to understand the analog signal path in the LOGO! 8 program. The typical chain is:
- Analog input (AI1 to AI4 on a 12/24 RCE) returns a raw 12-bit value 0 to 4095, representing 0 V to 10 V (or 0 mA to 20 mA).
- Analog amplifier scales the raw value to engineering units, for example −20.0 to +30.0 °C, using the gain and offset parameters. The scaled value is stored as a 16-bit signed integer at a configured VM address.
- Analog threshold / comparator / math blocks read the scaled value and produce boolean or numeric outputs.
When the scaled value is written to a VM word by the analog amplifier, the storage format is always 16-bit signed (Int). If the integrator then creates the HMI tag as Word, the sign bit is misread. The fix is to make the HMI tag match the format used by the source block.
Edge Case: 32-Bit Floating Point Values
LOGO! 8 supports floating-point math in the analog math and math function blocks. When the output of such a block is written to a VM address, it is stored as a 32-bit IEEE 754 single-precision float. Configure the HMI tag as Real (WinCC V15 and later) or Float in older TIA Portal versions, not DInt or Int.
Wrong data type symptoms:
-
DInton aRealvalue: the panel shows a nonsensical integer that updates with the same dynamics as the floating-point value but renders as a raw bit pattern interpreted as DInt. -
Realon anIntvalue: the panel shows a small fractional number close to zero, or NaN if the integer is large, because the Int bit pattern is not a valid float exponent/mantissa combination. -
Inton aRealvalue: the panel shows the lower 16 bits of the float bit pattern interpreted as a signed integer.
Detection rule: if the LOGO! 8 program block is Analog Math (B4) with gain and offset parameters, the output is a 32-bit float and the VM address must be a VD rather than a VW. The HMI tag must be Real. If the program block is Analog Amplifier (B3) with a 0.01 to 100 gain, the output is a 16-bit Int and the tag must be Int.
Edge Case: Cycle Time and Update Rate
LOGO! 8 has a base program cycle of 50 ms to 200 ms depending on program size. The HMI polling rate is configurable in the S7 connection properties. Default WinCC polling is 1 s, which is appropriate for temperature values that change slowly. For faster loops, set the acquisition cycle to match the LOGO! 8 cycle to avoid stuttering on the bar or IO field.
Set the acquisition cycle in the TIA Portal HMI tag editor by changing the Acquisition cycle field. For temperature: 1 s is sufficient. For a flow rate: 500 ms or 250 ms is recommended. For a high-speed counter above 100 Hz: 100 ms is the lower limit. Faster polling does not improve update rate beyond the LOGO! program cycle; the HMI will simply read the same value multiple times.
Edge Case: TIA Portal V13 vs V16+ Tag Editor Differences
In TIA Portal V13, the HMI tag data type dropdown lists both Word (unsigned) and Int (signed). In V16 and later, the same data types are listed but the default for a new tag pointing to a LOGO! 8 VM word may be Int. If a V13 project is migrated to V16 or later, double-check the data type on every tag that points to a LOGO! 8 VM word; the migration does not change the user-selected type.
Word for unsigned VM addresses. For older 6ED1052-x x x x-0BA0 and 0BA1 modules, the data type must be inferred by the integrator based on the program context.Network and S7 Connection Setup
The LOGO! 8 and KTP 700 Basic communicate as S7 devices over TCP/IP. The S7 connection is established on port 102 (ISO-on-TCP / RFC 1006). The panel acts as the S7 client, polling the LOGO! 8 at the configured acquisition cycle.
IP addressing rules:
- LOGO! 8 default IP: 192.168.0.10 (after factory reset). Change to a static address outside the DHCP range of the network.
- KTP 700 Basic default IP: 0.0.0.0 (DHCP). After the first download, the panel receives the IP configured in TIA Portal.
- Both devices must be on the same subnet. Submask 255.255.255.0 is the default.
- Disable DHCP on the LOGO! 8 to prevent IP changes after power cycling.
Diagnostic Procedure via Web Server
LOGO! 8 base modules include a built-in web server that exposes the current VM values without requiring TIA Portal. This is the fastest way to confirm the source value before modifying the HMI tag.
- Connect a PC or tablet to the same Ethernet subnet as the LOGO! 8.
- Open a browser and navigate to
http://<LOGO! IP>. The default page shows device information. - Click Variables in the navigation pane. The current VM values are listed by name and address.
- Compare the VM value to the value displayed on the LOGO! 8 onboard display. If both match but the KTP 700 Basic still shows a different value, the fault is in the HMI tag configuration, not the LOGO! program.
- To enable the web server, open LOGO! Soft Comfort, navigate to Tools → Web Server, and set the web server access to Enabled. Default is enabled for the standard LOGO! 8 BM; password protection is optional.
Common Pitfalls
| Pitfall | Symptom | Fix |
|---|---|---|
HMI tag created as Word on a signed LOGO! value |
Negative values show as large positive numbers (e.g. −20 → 65516) | Change data type to Int
|
IO field display format set to 999
|
Minus sign is suppressed on display even with correct Int type | Change format to 999;-999 or s999
|
| HMI tag address points to wrong VM byte | Value is off by 256 or by 1; mirrors unrelated internal variable | Verify address in LOGO! Soft Comfort variable table |
| Analog amplifier gain not set to 1.0 | Panel shows value ×10 or ÷10 of expected | Set gain to 1.0 or adjust bar / IO field scaling |
| Bar minimum set to 0 | Bar shows empty at all negative values | Set bar minimum to the process range minimum (e.g. −20) |
| LOGO! 8 in STOP / no program loaded | Value freezes or shows 0; RUN LED is red or off | Download LOGO! 8 program; verify RUN LED is green |
| IP address conflict on the panel | Connection drops randomly | Assign static IP, disable DHCP, ping from TIA Portal |
| Submask mismatch between panel and LOGO! | No connection at all | Both devices on 255.255.255.0 submask, same subnet |
| Multiple analog blocks writing to the same VM address | Value alternates between two sources | Allocate distinct VM addresses per block |
| LOGO! 8.3 used with V13 project | Some data types not recognized | Upgrade TIA Portal to V16 or later |
Commissioning Checklist
Use this checklist when commissioning a new LOGO! 8 ↔ KTP 700 Basic pair:
- LOGO! 8 IP address: static, in same subnet as the panel, outside the DHCP range.
- LOGO! 8 subnet mask: 255.255.255.0 typical for a /24 subnet.
- LOGO! 8 program downloaded and RUN LED green.
- Variable memory addresses of scaled analog values documented in the project (in a tag list table).
- Each HMI tag data type matches the LOGO! 8 value type:
Intfor signed 16-bit,Realfor 32-bit float,Boolfor digital flags,DIntonly for 32-bit counters. - IO field display format includes a minus sign for negative ranges.
- Bar / gauge range configured to cover the full process range including negative endpoints.
- Acquisition cycle set to 1 s or slower for temperature, 250 to 500 ms for fast analog values.
- Alarms configured for out-of-range conditions, for example temperature < −15 °C for cold-storage monitoring.
- Web server access verified from a separate PC on the same subnet.
- Final acceptance test: force a negative value via the LOGO! 8 SET function, verify correct display on the panel, capture a screenshot for the commissioning report. Force a positive value (e.g. +25 °C) and a zero value (0 °C) for full range coverage.
Migration Notes: From LOGO! 7 or Earlier
Projects that were originally built on LOGO! 6 or LOGO! 7 and migrated to LOGO! 8 sometimes retain the original Word tag declarations. This is the most common source of the negative-number display fault in retrofits. When migrating:
- Open the migrated TIA Portal project.
- For every HMI tag that points to a LOGO! VM address, set the data type explicitly to
IntorRealas appropriate. - Recompile and redownload to the panel.
- Run a full sign-range test (for example −20, −10, 0, +10, +20) before sign-off.
LOGO! 7 and earlier had a smaller VM area and a different addressing convention. Direct copy of tag tables from a LOGO! 7 project to a LOGO! 8 project is not supported; tags must be recreated.
Frequently Asked Questions
Why does the LOGO! 8 onboard display show −20 °C but the KTP 700 Basic shows 65516?
The LOGO! 8 knows the symbolic context of the analog amplifier output and renders it as a signed integer. The KTP 700 Basic reads the raw 16 bits from the VM area and, if the HMI tag is configured as Word, interprets the bits as an unsigned 16-bit value. −20 in two's complement is 0xFFEC = 65516 decimal. Change the HMI tag data type to Int to fix the display.
Does this fault affect LOGO! 8.3 and LOGO! 8.4 base modules as well?
Yes. The signed or unsigned interpretation in WinCC is independent of the LOGO! firmware generation. The same corrective action — changing the HMI tag from Word to Int — applies to LOGO! 8.0, 8.1, 8.2, 8.3, and 8.4 base modules. The fault is in the WinCC tag configuration, not in the LOGO! firmware.
Can the same fix be applied to LOGO! 8 communicating with a TP700 Comfort or a WinCC Runtime Advanced PC?
Yes. The data type mapping rule is universal: any S7 client (TP panel, Comfort panel, WinCC Runtime, OPC UA gateway) that reads a 16-bit signed value from a LOGO! 8 VM address must declare the tag as Int. The same applies to 32-bit floating-point values: declare the tag as Real, not DInt.
What is the maximum addressable VM area on a LOGO! 8 base module?
LOGO! 8 base modules (12/24 RCE, 230 RCE, 24 RCE, 24 CE) expose 851 bytes of variable memory: V0.0 to V850.7 bit-level, VB0 to VB850 byte-level, VW0 to VW849 word-level (even byte offsets only), and VD0 to VD848 double-word-level (byte offsets divisible by 4 only). Expansion modules do not extend the VM area; they add physical I/O but not additional S7-visible variables.
What is the article number of the LOGO! 8 + KTP700 Basic starter kit?
The starter kit LOGO! 8 12/24 V + KTP700 Basic is article number 6AV2132-3GB00-0AA1. The bundle includes a LOGO! 12/24 RCE base module, a LOGO! Power 24 V / 1.3 A power supply, and a SIMATIC KTP700 Basic panel, providing all components needed to evaluate and prototype a small LOGO! 8 / HMI system.
Do I also need to change the IO field display format to show the minus sign?
Yes. After switching the HMI tag data type to Int, the IO field display format must also include a sign pattern. Use 999;-999 or s999 in the IO field Properties → General → Display format. The default 999 pattern displays the magnitude only and will still suppress the minus sign even with a correctly typed Int tag.