Resolving LOGO! OBA8 RTC Time Read via VM Mapping and OPC

Problem: LOGO! OBA8 RTC Time Not Readable Through Standard VM Mapping

A field engineer integrates a Siemens LOGO! 8 OBA8 (article numbers 6ED1052-1MD08-0BA1, 6ED1052-2MD08-0BA1, etc.) with SIMATIC WinCC 7.2 through a third-party OPC server (IBH, Kepware, or Softing). The engineer wants to monitor the LOGO!'s internal real-time clock (RTC) — date and time — inside a WinCC tag database so that the SCADA mimics show "PLC time" and a centralized time stamp can be archived.

The LOGO! Soft Comfort VM (Variable Memory) mapping table in the project editor only exposes user-programmable addresses VM0 through VM850. The RTC values physically live in VM986 and above — outside the editable user range. The engineer cannot enter VM986 as an OPC tag address because the LOGO! Soft Comfort address selector caps at 850 and the LOGO! runtime refuses read/write requests from the user program to those high addresses.

The symptom is straightforward:

• OPC server enumerates user variables in the 0–850 window correctly.
• OPC server cannot resolve tags such as VM986 (RTC year), VM987 (RTC month), or any system clock cell.
• WinCC tag is created with status "Address not found" or returns quality "BAD" (0xC0).
• The LOGO! program itself cannot read or write that VM range — only the operating system and external clients can.

Root Cause: VM 851–1023 Is System-Reserved, Not User-Editable

According to the LOGO! 8 System Manual (0BA8 Standard / 0BA8 FS4), the LOGO! 8 basic module partitions its variable memory into three regions:

The RTC registers occupy the upper sub-region. Documented cell layout for firmware 0BA8 (FS4, ES FIRMWARE 1.16.x and later) is:

The discrepancy at the user's site is therefore not a bug: the LOGO! operating system simply will not let any program-driven block read VM990–VM997. Only the OS uses them. External clients must ride on top of one of the LOGO!'s published communication protocols.

LOGO! OBA8 Communication Channels That Expose VM 851–1023

The LOGO! 8 base module (any 0BA8 variant) provides four client-reachable communication paths. The user only needs one of them.

1. S7 PUT/GET (TCP port 102) — Passive server on the LAN. The LOGO! publishes the entire VM space (0–1023) including RTC. Any S7-1200, S7-1500, WinAC, PC station with SIMATIC NET OPC, or third-party OPC server (IBH Link, Kepware Siemens TCP/IP Ethernet, Softing S7/S5 OPC, LibNoDave-based tools) can poll VM990+ directly.
2. Modbus TCP (TCP port 502) — The LOGO! 0BA8 firmware exposes a Modbus TCP server. Holding registers map 1:1 to VM addresses (400001 + offset).
3. LOGO! Web Server (HTTP port 80) — Read-only HTML pages; not suitable for SCADA tags but useful for manual verification.
4. LOGO! HMI Synchronization (HTTP-based JSON) — The Siemens sample described in the engineering notes forwards VM990+ to a Siemens HMI or any HTTP client. Detailed below.

Solution Path A — OPC DA Bridge via S7 PUT/GET

This is the canonical solution when WinCC 7.2 is the SCADA and a third-party OPC server is already in use for the LOGO! integration.

Step 1: Verify LOGO! Network Configuration

1. Open LOGO! Soft Comfort > Tools > Ethernet Connections.
2. Assign a static IP inside the SCADA subnet, e.g. 192.168.10.20 / 255.255.255.0.
3. Set Allow S7 PUT/GET Communication = Enabled (default on 0BA8 firmware ≥ 1.16, but verify in Web Server > Security).
4. Save and download to the base module.

Step 2: Confirm OPC Server Reaches VM990+

The OPC server's tag database must be addressed in S7 absolute syntax, not LOGO! VM syntax. Convert as follows:

OPC tag configuration example (Kepware Siemens TCP/IP Ethernet driver):

Channel1.Device1.RTC_Second    = DB1,BYTE,992   (scaling 0-59)
Channel1.Device1.RTC_Minute    = DB1,BYTE,993   (scaling 0-59)
Channel1.Device1.RTC_Hour      = DB1,BYTE,994   (scaling 0-23)
Channel1.Device1.RTC_Day       = DB1,BYTE,995   (scaling 1-31)
Channel1.Device1.RTC_Month     = DB1,BYTE,996   (scaling 1-12)
Channel1.Device1.RTC_Year      = DB1,BYTE,997   (offset +2000)
Channel1.Device1.RTC_DoW       = DB1,BYTE,991   (scaling 1-7)
Channel1.Device1.RTC_Status    = DB1,BYTE,990   (bit0=valid, bit1=DST)

Step 3: Connect OPC DA to WinCC 7.2

1. In WinCC Explorer, right-click Tag Management > Add New Driver > OPC > OPC DA.
2. Browse the local/remote OPC server you created in Step 2 (e.g. Kepware.KEPServerEX.V6).
3. Import the RTC tags listed above into the WinCC tag database.
4. Set the update cycle to 1000 ms (1 s) — the RTC changes only once per second.
5. Format the tags as 16-bit unsigned integer and create computed WinCC tags for human-readable text output.

Computed WinCC tag for full timestamp string:

'20' + RIGHT('00'+ TEXT(RTC_Year),2) + '-' +
RIGHT('00' + TEXT(RTC_Month),2) + '-' +
RIGHT('00' + TEXT(RTC_Day),2) + ' ' +
RIGHT('00' + TEXT(RTC_Hour),2) + ':' +
RIGHT('00' + TEXT(RTC_Minute),2) + ':' +
RIGHT('00' + TEXT(RTC_Second),2)

Solution Path B — LOGO! HMI/JSON Synchronization Sample

Siemens publishes a downloadable sample that scripts an external application (HMI runtime or a small PC utility) to read VM990+ via the LOGO!'s HTTP/JSON interface. The archive is referenced in the LOGO! 8 application examples library:

LOGO! 8 System Manual — Section 4.6 "Communication via Ethernet"

Key steps from the sample (clock_synchronization_logo_hmi.zip):

1. Open the LOGO! Web Server (HTTP port 80). Authenticate with the Web Server password configured in LSC > Tools > Ethernet Connections.
2. Issue GET /logo.cgi?VM990&VM991&VM992&VM993&VM994&VM995&VM996&VM997.
3. Parse the JSON response. Sample payload (truncated):

   {
     "VM990": 1,
     "VM991": 3,
     "VM992": 47,
     "VM993": 12,
     "VM994": 9,
     "VM995": 18,
     "VM996": 6,
     "VM997": 25
   }

4. Forward the parsed values to a Siemens HMI Comfort/ Unified tag database through a SIMATIC S7-1200 gateway, or to WinCC via OPC after republishing them on a S7-1200 DB.

Solution Path C — Direct Modbus TCP Poll from WinCC

If the user's third-party OPC server does not support S7 PUT/GET, fall back to Modbus TCP:

1. Enable Modbus TCP server on LOGO! 0BA8 (LSC > Tools > Ethernet Connections > Modbus TCP = Enabled).
2. Add the Modbus TCP driver in the OPC server; target IP = LOGO!, port = 502.
3. Create tags with offset 990 (holding register 400991 maps to VM990). Function code 0x03 (Read Holding Registers).
4. For the entire 8-byte RTC block, request holding registers 400991–400998 in a single transaction to avoid inter-second skew.

Polling rate should not exceed 1 Hz — the RTC changes once per second and excessive polling wastes the LOGO!'s single-threaded Ethernet stack.

Verification Procedure

1. Loopback test: In LSC online mode, navigate to View > VM Mapping. Confirm VM990 changes from 0 to 1 after a power cycle (validity bit), and VM992 increments every second.
2. OPC client quick-check: Install Matrikon OPC Explorer or OPC Quick Client. Connect to the OPC server and add the seven RTC tags. They must return Good quality with values incrementing each second.
3. WinCC tag diagnosis: Open WinCC Tag Management > RTC_Second > Properties > Diagnostics. Quality code must be "Good (0xC0)". If it shows "Bad (0x00)", the OPC subscription failed — check DCOM permissions on the OPC server host (Windows component services).
4. Power-cycle stress test: Disconnect LOGO! main power for 5 minutes, restore. RTC must resume within ±60 s (LOGO! internal capacitor backup is rated for ~80 h; coin cell if fitted extends to ~2 years). If values reset to default (00:00:00 01-01-2000), replace the CR2032 backup cell — part number for OBA8 battery holder: 6ED1057-1BA00-0AA0.
5. Visualization test: Add a WinCC I/O field bound to the computed timestamp tag. Force a WinCC picture change. The displayed string must update in real time.

Troubleshooting Matrix

Field-Proven Caveats

• The LOGO! 0BA8 firmware before v1.16.00 does not allow external clients to read system VM (851+). Update firmware via the LOGO! Soft Comfort update tool before commissioning the OPC RTC link.
• Do not attempt to write VM990–VM997 from the OPC client. The OS owns these cells; an OPC write returns quality GOOD momentarily but the OS overwrites the value within one scan. Use the LOGO!'s dedicated clock-setting path (LSC menu or Web Server > Set Clock) instead.
• The LOGO! does not support SNTP/NTP time synchronization out of the box on 0BA8 firmware. Use the LOGO! as the master clock, or implement NTP on an upstream S7-1200 and write the corrected time to VM990–VM997 via S7 PUT/GET (the OS accepts the writes).
• The user's third-party OPC server (mentioned as "ibh software") is a valid S7/LOGO! driver but only exposes user VM by default. Toggle the address-range setting in its INI configuration to enable access to VM851+.

FAQ