Resolving LOGO! 8 FS4 (0BA8) HMI Simulation Communication Failure

1. Problem Overview

Engineers integrating a Siemens LOGO! 8 (order suffix 0BA8, firmware feature set 04) with a SIMATIC KTP400 Basic Panel frequently encounter a scenario in which the physical HMI is unavailable during early commissioning, yet project validation must proceed. The standard fallback is to use the WinCC Runtime Advanced / WinCC Basic integrated simulation (RT Simulator) on the engineering PC. With a LOGO! 8 FS04 device, this path fails: HMI tags read back as #### placeholders, and no S7 connection establishes between the simulation runtime and the LOGO! base module.

The LOGO! base module remains responsive on the LAN (Modbus TCP/IP polls from WinCC 7.4 still succeed against memory registers VW, MW, and DB-style areas exposed via the LOGO! Modbus map). The failure is specific to the S7-200 SMART-compatible S7ONLINE transport used by the WinCC simulator when talking to a LOGO! 8 FS04 target. This is a documented Siemens firmware defect, not a project wiring or IP configuration error.

2. Affected Systems and Firmware Versions

3. Root Cause Analysis

The LOGO! 8 (0BA8) base module exposes two distinct communication endpoints on its Ethernet port (default IP 192.168.0.3/24, configurable up to 16 connections):

1. S7-compatible connection (port 102, ISO-on-TCP / S7ONLINE) — used by TIA Portal, WinCC Basic, WinCC Comfort, WinCC Advanced, LOGO! Soft Comfort (online mode), and the S7-PCT / SINAMICS tools.
2. Modbus TCP server (port 502) — used by WinCC 7.x, third-party SCADA, and most non-Siemens HMI platforms.

On firmware feature sets FS04 and FS05, the S7 endpoint incorrectly negotiates the S7 communication parameters when the client is a WinCC Runtime Simulator. The simulator establishes a connection handshake but never receives the response PDU required to populate tag values, so the HMI renders the #### status placeholder (WinCC tag status = "Connection failure / no value").

The same simulation client talking to a S7-1200 / S7-1500 / ET200S CPU works without modification. The fault is therefore isolated to LOGO! 8 (0BA8) firmware revisions prior to FS06. Siemens documented the fix in the LOGO! 8 firmware release notes; the upgrade is delivered as a binary firmware update package (LWE file) and is deployed via LOGO! Soft Comfort or an SD card.

An independent, secondary failure mode also observed in the field is a wrong network adapter selection in the PG/PC interface (Windows Control Panel → "Set PG/PC Interface"). When multiple NICs are present (Wi-Fi + LAN + Hyper-V virtual switch + VPN TAP), the S7ONLINE access point may bind to the wrong interface, producing the same #### symptom. Always resolve the firmware first; if the symptom persists, then inspect the PG/PC assignment.

4. Prerequisites for the Fix

5. Updating LOGO! 8 from FS04 / FS05 to FS06

Two methods are supported: online update via LOGO! Soft Comfort (recommended, preserves program memory) and offline update via micro SD card (used when the LOGO! is in a remote cabinet with no PC attached).

5.1 Online Update (preferred)

1. Close all TIA Portal / WinCC / LOGO! Soft Comfort instances that hold an online connection.
2. Download the firmware package (entry ID 109750845) and extract the ZIP to a local folder.
3. Launch LOGO! Soft Comfort and open the existing project (or "File → New" for an empty test project).
4. From the menu bar, choose Tools → Transfer → Firmware Update (path may vary slightly by Soft Comfort version: Tools → Update Firmware).
5. In the "Firmware Update" dialog, browse to the extracted .lwe firmware file and select the target LOGO! base module from the "Accessible Nodes" list.
6. Confirm the dialog. The transfer takes approximately 90–180 seconds; do not power-cycle the LOGO! during this window.
7. When the progress dialog reports success, the LOGO! reboots automatically. Re-establish the connection from LOGO! Soft Comfort (Tools → Transfer → PC → LOGO!) and verify the firmware revision in the device information banner (should read FS:06 / V1.82.x or later).
8. Transfer the project circuit back to the LOGO! (the firmware update erases program memory on most revisions; the project must be re-sent after the firmware upgrade).

5.2 Offline Update via Micro SD Card

1. Format a micro SD card as FAT32 (32 GB max; cards larger than 32 GB require third-party partitioning tools).
2. Copy the extracted firmware files (typically logo_fs06.lwe and an associated logo_fs06.bin) to the SD card root directory.
3. Power down the LOGO! base module.
4. Insert the SD card into the slot behind the removable display / on the side of the module.
5. Power the LOGO!. The display first shows UPDATE FW; press OK to acknowledge, then YES to confirm.
6. Wait for the progress bar to complete and the LOGO! to reboot (typically 2–4 minutes).
7. Remove the SD card. The LOGO! defaults to factory IP 192.168.0.3; reapply any custom network configuration from LOGO! Soft Comfort before reconnecting.

6. PG/PC Interface Verification

If the firmware upgrade completes successfully but the WinCC simulator still shows ####, the next item to inspect is the S7ONLINE access point binding.

1. Open the Windows Control Panel → Set PG/PC Interface applet (search for "Set PG/PC" in the Start menu on Windows 10 / 11).
2. In the "Access Point of the Application" table, locate the entry S7ONLINE (used by TIA Portal) and S7ONLINE_STEP7 (used by legacy STEP 7 / WinCC flexible). Both should point to the same physical Ethernet adapter.
3. If the system lists multiple network adapters (e.g., Intel I219-V for the LAN, Intel Wi-Fi 6 AX201 for wireless, Hyper-V Virtual Ethernet Adapter for VM traffic), select the wired LAN adapter that is physically connected to the LOGO! subnet.
4. Avoid selecting virtual adapters (Hyper-V, VirtualBox host-only, VPN TAP, VMware VMnet) unless the LOGO! is intentionally inside a virtualized segment.
5. Click OK and restart TIA Portal / WinCC so the access point change is re-read.

To confirm the binding took effect, in TIA Portal open Online → Accessible Nodes after the change. The LOGO! must appear at its IP address (e.g., 192.168.0.3). If it is still not visible, the issue is at the IP / subnet / firewall layer, not the access-point layer.

7. Configuring the WinCC Runtime Simulator

1. Open the TIA Portal project containing the KTP400 configuration.
2. In the project tree, right-click the HMI device (KTP400) and choose Start Runtime. This launches the WinCC Runtime Simulator with the compiled project.
3. Verify that the project was compiled for the correct HMI type (KTP400 Basic mono or KTP400 Basic color, depending on the physical panel). A mismatch is the most common reason for "tags unavailable" status.
4. In the simulator, observe the connection status indicator (bottom right). A green "connected" indicator means the S7 path is healthy. Yellow / red indicates a fault.
5. If the connection fails, open Project → HMI Device Configuration → Connections and confirm:
   • Connection name is unambiguous (avoid spaces and special characters).
   • Partner (PLC) IP = LOGO! IP (192.168.0.3 by default).
   • Access point resolves to S7ONLINE.
   • The connection is "Active" in the runtime settings.
6. Re-compile the project (Project tree → HMI device → right-click → Compile → Software (rebuild all)).
7. Re-launch the simulator. Tags should now resolve and the #### placeholders disappear.

8. LOGO! Soft Comfort Multi-Connection Configuration

The LOGO! 8 supports up to 16 simultaneous S7/Modbus connections. When the same LOGO! base module is targeted by the WinCC simulator, the LOGO! Soft Comfort online view, and a Modbus master at the same time, the connections must be enumerated explicitly so the LOGO! accepts each on its own slot. The procedure is described in the Siemens LOGO! Ethernet PLC Connection Guide.

1. In LOGO! Soft Comfort, open the project and select File → Properties → Communication.
2. Enable "Allow multiple connections" (sometimes labeled "LOGO! is accessible from PC"). This is mandatory when more than one client must coexist.
3. For each client, define a connection record with the remote IP, the slot index (0–15), and the access type (read-only or read-write).
4. Save the project and transfer to the LOGO!. The LOGO! stores the connection table in non-volatile memory.
5. Verify the active connections from the LOGO! display: navigate to Menu → Diagnostics → Connections. Each live client appears with its IP, slot, and connection age.

9. Modbus TCP/IP Readback with WinCC 7.4 (Parallel Validation Path)

While the firmware update is being applied, the existing Modbus TCP path to the LOGO! can be used to confirm network connectivity and I/O state. The LOGO! 8 Modbus map is documented in the LOGO! 8 system manual (Siemens entry ID 109751054). Key registers:

In WinCC 7.4, configure the "SIMATIC S7 / S5-PLC" driver as a "Modbus TCP/IP" connection pointing to 192.168.0.3:502. Poll the holding registers using a 1-second cycle. The values seen in WinCC 7.4 must match the values shown on the LOGO! display; if they do, the LAN is healthy and only the S7 layer is broken.

10. Physical KTP400 Integration (Reference)

If a physical KTP400 is available for parallel validation, the connection setup is straightforward:

1. Set the KTP400 to "Transfer" mode (Control Panel → Transfer → enable transfer).
2. Configure the HMI IP on the LOGO! subnet (e.g., 192.168.0.10), mask 255.255.255.0, gateway optional.
3. Configure the S7 connection on the HMI: Partner IP = LOGO! IP, Access Point = S7ONLINE, Rack = 0, Slot = 1 (LOGO! always reports as rack 0, slot 1 regardless of physical base / extension modules).
4. Compile and transfer the HMI project via Ethernet or USB.
5. Confirm the connection icon on the KTP400 status bar turns green within 5 seconds.

11. Verification Checklist

1. LOGO! display reports firmware feature set FS:06 (or later).
2. LOGO! Soft Comfort Online → Accessible Nodes shows the LOGO! IP.
3. PC LAN adapter has a static IP in the same subnet (e.g., 192.168.0.10/24).
4. Set PG/PC Interface assigns S7ONLINE to the LAN adapter.
5. WinCC simulator launches and shows green connection indicator.
6. All HMI tags resolve from #### to numeric values.
7. Bit-mapped alarm window, trend view, and recipe view all populate correctly.
8. Modbus TCP master (WinCC 7.4 or third-party) reads the same VM values as the S7 simulator.
9. Disabling the S7 connection in the HMI does not break the Modbus path (proving independence of the two transports).

12. Troubleshooting Matrix

13. Field-Proven Caveats

• VM address range: The LOGO! 8 supports VM0–VM958 (byte-level) but Modbus exposes only the first 96 words (VW0–VW94). TIA Portal HMI tag mappings beyond this range fail silently with quality "bad".
• Connection table persistence: Custom multi-connection entries written through LOGO! Soft Comfort survive power-cycle but are lost when an SD-card firmware update is performed without first exporting the project.
• Subnet routing: If the LOGO! is behind a Layer-3 device (router, firewall), the S7 connection requires the router to pass TCP port 102 with TSAP preservation. Many consumer routers drop ISO-on-TCP sessions within seconds.
• LOGO! BM (basic module) vs AM (add-on module): Only the BM exposes Ethernet. The AM variants are non-networked digital / analog extension modules and never appear in "Accessible Nodes".
• Power-on reset on FS06 update: Retentive flags and VM values are preserved across firmware updates (battery-backed RAM), but the LOGO! does not preserve active timers / counters in RUN-STOP-RUN transitions triggered by the update.
• Hot-swapping SD card: Do not remove the SD card while the LOGO! is reading or writing to it (data log active). Corruption of the data log and, in rare cases, of the firmware region has been reported.

14. Related Documentation

• LOGO! 8 (0BA8) Firmware Update V1.82.x — Siemens Support Entry 109750845
• Siemens LOGO! Ethernet PLC Connection Guide (Weintek official mirror)
• LOGO! 8 System Manual — Siemens Support Entry 109751054

Frequently Asked Questions