Resolving LOGO! to WinCC Alarm Bit Byte-Swap Issue

Overview: LOGO! Alarm Bit Communication to HMI

When a Siemens LOGO! 8 (for example 6ED1052-1MD08-0BA1, 6ED1052-1CC08-0BA1, or the safety variant 6ED1052-1HF08-0BA1) is integrated with a SIMATIC HMI panel such as a KTP400 Basic, KTP700 Basic, KTP1200 Basic, TP700 Comfort, or TP1500 Comfort running WinCC in TIA Portal, individual digital alarm messages are signalled by setting single bits inside the LOGO! Variable Memory (V area). Each rising edge of a network output (V0.0 through V850.7 on a 0BA8 standard device, V0.0 through V2047.7 on a 0BA8 FS:05 device) is read by the HMI as the trigger condition for one discrete alarm. Internally, the panel reads the 16-bit WORD and inspects the bit pattern; the LOGO! side of the link, by contrast, treats the data as a stream of bytes. The mismatch between byte-oriented bit numbering on the PLC and word-oriented bit numbering on the HMI is the root cause of the well-known "alarm list starts at trigger bit 8" symptom that engineers encounter during first integration.

This reference explains the underlying addressing model, shows the exact mapping of VW10 into VB10 / VB11 in the LOGO! data block, walks through two engineering solutions (HMI-side byte swap versus LOGO! bit offset), documents which TIA Portal communication driver to select from V12 onward, and provides a verification procedure and a troubleshooting matrix for the most common field faults.

The Variable Memory (V) Addressing Model

The LOGO! 8 maintains a volatile variable memory area that is exposed to remote partners as digital network outputs (V) and digital network inputs (I). The area is byte-addressed; the smallest symbolic unit is a bit within a byte. The standard symbolic references are:

• V<byte>.<bit> — a single bit in the data area, for example V10.3
• VB<byte> — the full byte (8 bits), for example VB10
• VW<word> — two consecutive bytes forming a 16-bit word, for example VW10 = VB10 (low byte) + VB11 (high byte)
• VD<dword> — four consecutive bytes forming a 32-bit double word, for example VD10 = VB10…VB13

For a typical alarm-word design the engineer allocates one WORD per group of 16 alarm bits. The most common choice is VW10, which expands to two addressable bytes:

The byte layout above is fixed and is the same in LOGO! Soft Comfort, in the LOGO! web server, and in any remote partner that uses the S7-200-compatible protocol. The byte order is little-endian on the wire: the byte at the lower address (VB10) is transmitted first and is the low byte of the 16-bit integer. When WinCC reads the data as a Word, it therefore places VB10 into bits 0…7 of the trigger word and VB11 into bits 8…15.

In the LOGO! program, digital network outputs are written either directly from a function block coil (Q or Network output) or through an assignment block that maps a binary flag to a specific V address. A typical LOGO! Soft Comfort ladder snippet that drives 16 alarms from discrete flags looks like this:

; LOGO! Soft Comfort - default (non-swapped) layout for VW10
; 16 digital network outputs
B001 -> V11.0   ; Alarm 1  "Pump 1 overload"
B002 -> V11.1   ; Alarm 2  "Pump 2 overload"
B003 -> V11.2   ; Alarm 3  "Tank level high"
B004 -> V11.3   ; Alarm 4  "Tank level low"
B005 -> V11.4   ; Alarm 5  "Pressure high"
B006 -> V11.5   ; Alarm 6  "Pressure low"
B007 -> V11.6   ; Alarm 7  "Door open"
B008 -> V11.7   ; Alarm 8  "E-Stop pressed"
B009 -> V10.0   ; Alarm 9  "Filter dirty"
B010 -> V10.1   ; Alarm 10 "Service due"
B011 -> V10.2   ; Alarm 11 "Phase loss"
B012 -> V10.3   ; Alarm 12 "Vibration high"
B013 -> V10.4   ; Alarm 13 "Lubrication low"
B014 -> V10.5   ; Alarm 14 "Aux fan running"
B015 -> V10.6   ; Alarm 15 "Cooling fault"
B016 -> V10.7   ; Alarm 16 "Comms fault"

The engineer’s natural first impulse is to assign alarm 1 to bit 0 of the WORD. With this layout the HMI sees alarm 1 at trigger bit 8, alarm 8 at trigger bit 15, alarm 9 at trigger bit 0, and alarm 16 at trigger bit 7. The result is the familiar “bits in reverse order” complaint.

Why Bit 8 in WinCC: The Endianness Conflict

WinCC Flexible, WinCC Comfort/Advanced, and the TIA Portal HMI editor all evaluate a 16-bit discrete alarm trigger WORD using a small-endian (little-endian) convention. Bit 0 of the WORD is the least-significant bit of the LOW byte, and trigger bits are numbered 0…15 sequentially from that anchor. The panel does not know that the LOGO! convention places the “first” alarm at V11.0; it simply maps the bytes it receives onto the bits of the trigger word.

When the LOGO! sends a network output value, the byte it puts on the wire corresponds directly to the V address of the bit the engineer wrote to. The first bit the engineer sets, by convention, is usually V11.0 because that is the high byte of VW10. The panel, however, places the low byte of VW10 in bits 0…7 of the displayed trigger word. The result is that the first physical alarm the engineer wired up appears at trigger bit 8 in the WinCC alarm editor — exactly the screenshot symptom reported in the field.

A second, subtler source of confusion is that LOGO! does not expose a formal byte-swap function block. The symbol table only carries VB, VW, and VD aliases — there is no SWAP helper in LOGO! Soft Comfort. Engineers must therefore implement the swap downstream of the data, which is normally done in the HMI tag mapping or, alternatively, in the LOGO! program by simply offsetting the write address by one byte.

Diagnosing Byte-Swap in the HMI Configuration

Before applying a fix, the engineer should confirm the byte-swap is the cause. The standard diagnostics are:

1. In TIA Portal, open the HMI tag that points at VW10 (acquisition mode: Cyclic continuous, acquisition cycle 1 s for commissioning).
2. Add an HMI text field bound to the same tag. Display the value in Hexadecimal (e.g. format string %04X in the I/O field configuration).
3. In the LOGO! program, force a single network output high (e.g. set V11.0 = 1) using the LOGO! Soft Comfort online monitor or the LOGO! display.
4. Observe the HMI value. If the HMI value reads 0x0100 (bit 8 set, no other bits), the panel is using the low byte (VB10) as bit 0 and your physical write to V11.0 appears at bit 8 of the WORD — classic byte swap.
5. Force a different bit, e.g. V10.5, and confirm the HMI value becomes 0x0020 (bit 5 set). If only the high-byte write shows at bit 8…15 and the low-byte write shows at bit 0…7, the byte swap is confirmed.
6. If the panel reads the word with the high byte mapped to bit 0 (i.e. the panel is treating the data as big-endian) the symptom is different: the first alarm appears at bit 0 but the order of subsequent alarms is reversed within each byte. This is rare with the LOGO! and S7-200 drivers, but can occur with custom Modbus TCP polls if the byte-order register is not configured correctly (see Edge Cases).

Solution A: Byte Swap in the HMI Project

The simplest field fix is to swap the two bytes of the alarm word in the HMI tag list. In TIA Portal this is achieved either with a small VBScript tag that rotates the bytes, or with a derived tag and a manual swap in the PLC. For a pure tag-side solution the recommended implementation is a script tag that performs the byte rotation:

' VBScript on the HMI - executed on tag change of "PLC_alarm_word"
Dim rawWord, hi, lo
rawWord = SmartTags("PLC_alarm_word")
hi = (rawWord And &H00FF) * 256   ' low byte of PLC word -> high byte of HMI word
lo = (rawWord And &HFF00) \ 256    ' high byte of PLC word -> low byte of HMI word
SmartTags("HMI_alarm_word") = hi Or lo

Then bind the discrete alarms to HMI_alarm_word instead of PLC_alarm_word. The trigger bits 0…15 in WinCC will now line up with V11.0…V10.7 as written by the LOGO! program. The disadvantage is the extra tag and the VBS dependency — on a Basic Panel with restricted scripting you may need to move the swap into the LOGO! instead (see Solution B).

For a Siemens S7-200 driver connection that supports the Coordination area pointer, an alternative is to write a small FC in the LOGO! program (using the analog/threshold blocks to compose the swapped value) and store the result in a second V word such as VW20. The HMI then reads VW20 directly with no script. This is heavier on the LOGO! cycle time and is recommended only when the project is locked to a non-scripting panel.

Solution B: Shift Trigger Bits by One Byte in LOGO!

A LOGO!-side fix avoids any script, scales to Basic Panels, and is the cleanest pattern for production. The trick is to allocate alarm bit 1 in the LOGO! to V11.0 rather than to V10.0. The same WORD VW10 is used, so the HMI tag definition does not change, but the bit assignment is rotated by one byte:

; LOGO! Soft Comfort - swapped layout (recommended)
B001 -> V11.0   ; Alarm 1  (WinCC trigger bit 0)
B002 -> V11.1   ; Alarm 2  (WinCC trigger bit 1)
B003 -> V11.2   ; Alarm 3  (WinCC trigger bit 2)
B004 -> V11.3   ; Alarm 4  (WinCC trigger bit 3)
B005 -> V11.4   ; Alarm 5  (WinCC trigger bit 4)
B006 -> V11.5   ; Alarm 6  (WinCC trigger bit 5)
B007 -> V11.6   ; Alarm 7  (WinCC trigger bit 6)
B008 -> V11.7   ; Alarm 8  (WinCC trigger bit 7)
B009 -> V10.0   ; Alarm 9  (WinCC trigger bit 8)
B010 -> V10.1   ; Alarm 10 (WinCC trigger bit 9)
B011 -> V10.2   ; Alarm 11 (WinCC trigger bit 10)
B012 -> V10.3   ; Alarm 12 (WinCC trigger bit 11)
B013 -> V10.4   ; Alarm 13 (WinCC trigger bit 12)
B014 -> V10.5   ; Alarm 14 (WinCC trigger bit 13)
B015 -> V10.6   ; Alarm 15 (WinCC trigger bit 14)
B016 -> V10.7   ; Alarm 16 (WinCC trigger bit 15)

Now the panel can use the raw VW10 tag and the first alarm written by the LOGO! (V11.0) appears at HMI trigger bit 0 without any byte swap. This is the technique recommended in the LOGO! 8 system manual example projects, and is the configuration that survives a TIA Portal upgrade or a panel swap without modification.

Selecting the Correct WinCC Communication Driver

WinCC in TIA Portal V12 onward offers two relevant drivers for the LOGO! 8. The choice depends on whether you need area pointers and on the panel series in use.

The native LOGO! driver is the simpler choice. It auto-discovers the LOGO! 8 base module on Ethernet and exposes the VM area as a flat tag list. It does not, however, support area pointers; if you need a coordination area pointer (e.g. to read which screen is currently active, to synchronise the LOGO! clock, or to trigger a job on the HMI from the LOGO!), switch to the S7-200 driver.

For the S7-200 driver, configure the PG/PC interface for S7ONLINE → TCP/IP, set the LOGO! 8 IP address as the partner, and set the rack/slot to 0 / 1 (LOGO! 8 occupies slot 1 of virtual rack 0). Use the address syntax VW10, VB10, or V10.0 directly in the HMI tag list. The LOGO! listens on TCP port 102 (ISO-on-TCP) and accepts up to eight S7 connections in firmware V1.82.x and later.

Configuring Trigger Bits and Alarm Texts in WinCC

With the communication link established and the tag VW10 (or your swapped equivalent) present in the HMI tag list, configure the discrete alarms as follows:

1. Open HMI alarms → Discrete alarms in the TIA project tree.
2. For each of the 16 alarms, set:
   • Trigger tag = the alarm WORD (e.g. VW10)
   • Trigger bit = 0 … 15 (matching the LOGO! V address per the chosen layout)
   • Alarm text = operator-facing string, e.g. "Pump 1 overload — check motor starter Q1"
   • Class = Errors / Warnings / Information as per your alarm philosophy (HSE alarm management recommends classes that map to the operator response time required)
   • Acknowledge = configured per class; safety-class alarms must require acknowledge
   • Logging = enable for regulatory or post-event analysis
3. For trigger bit 0, enter the text for the alarm that the LOGO! program writes to V11.0 (Solution B) or to V10.0 (Solution A after byte swap).
4. Compile the HMI project. TIA Portal will warn if the trigger tag is not used by any IO field — that warning is benign when the tag is used only for alarms.

The WinCC alarm class library follows the ISA-18.2 / IEC 62682 alarm-management convention: Priority 1 (highest) for safety alarms, Priority 2 for operational alarms that require action within minutes, and so on. The default WinCC classes (Errors, Warnings, Information) can be remapped to these priorities. Operators should never be expected to distinguish more than three to five priority tiers at a glance; consolidating nuisance alarms into "Information" is a typical step in early commissioning.

Using Area Pointers with the S7-200 Driver

The S7-200 driver allows the LOGO! to exchange a small set of structured pointers with the HMI. The most useful pointers for alarm applications are listed below.

To activate an area pointer in the LOGO! configuration (TIA Portal → HMI → Connections), open the connection, switch to the Area pointers tab, and tick the pointers you need. The driver auto-allocates the V addresses; for the LOGO! 8 the default allocation is:

Coordination  : VB0       (bit 0 = "panel starting", bit 1 = "panel running",
                          bit 2 = "panel stopping", bit 3 = "panel stopped")
Date/Time     : VB1..VB8
Job           : VB9       (write 51 = change to screen 51, then write 0 to release)
Screen number : VW10      <-- COLLISION with the typical alarm word!
Project ID    : VB12

Note that VW10 is the default address of the Screen number pointer. If you also use VW10 for your alarm word, the two will collide and the panel will write its current screen number into the same word that the LOGO! uses for alarm bits, producing spurious alarms on every screen change. Move the alarm word to a free area such as VW20 or change the Screen number pointer address to VW200 in the connection configuration.

Verification and Commissioning Procedure

After the link is configured and the trigger bits are mapped, walk through the following verification sequence before handing the panel to operations.

1. Watchdog test. Force each of the 16 LOGO! network outputs high one at a time from the LOGO! Soft Comfort online monitor. Confirm that the matching discrete alarm appears on the HMI with the expected text and class. Cycle once more with all bits low; confirm that all alarms clear.
2. Endianness test. Force a bit in the high byte of the alarm WORD only (e.g. V11.0). Confirm it appears at HMI trigger bit 0 (Solution B) or bit 8 (Solution A, no swap). If the HMI shows a different bit, your Solution selection does not match the LOGO! layout — re-check the V addresses.
3. Spam test. Briefly pulse all 16 bits at 2 Hz for 10 s. Confirm that the panel logs the events, that the alarm list does not overflow (default buffer 256 entries, configurable up to 1024 on Comfort Panels), and that the event-log archive is being written if configured.
4. Class test. Trigger an alarm of each class. Verify that the panel horn, banner, and pop-up behaviour match the class configuration. Cross-check with the operator that priority is obvious without reading the text.
5. Area-pointer test. If the S7-200 driver is used, write a value to the Job byte from the LOGO! (e.g. 51 = "select screen 51"). Confirm that the HMI changes to the configured screen. Reset the job byte to 0 to release the trigger.
6. Date/time test. Force a known alarm and verify that the time stamp matches the LOGO! real-time clock within ±1 s. If the stamps drift, check the date/time area pointer and the LOGO! time zone setting (Tools → Time in LOGO! Soft Comfort).
7. Power-cycle test. Power down the LOGO! and the panel for 30 s. Power up. Verify that the link re-establishes (green status icon in the WinCC system diagnostics) and that no spurious alarms appear during the boot handshake. Typical re-connection time is 5…15 s on a 100 Mbit link.
8. Network test. Disconnect the Ethernet cable for 10 s. Reconnect. Confirm the panel raises a "connection failure" diagnostic alarm (class Errors) and clears it automatically when the link is restored.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

• LOGO! 8.2 and earlier firmware does not expose the LOGO! V memory as a contiguous ≥1 KB area; the address space is 0…127 bytes. Plan your alarm words inside that range, or upgrade to firmware V1.82.x for 850 bytes of network I/O.
• LOGO! 0BA7 (LOGO! 7) uses the same V-memory convention but a different Ethernet connector and protocol. The byte-swap discussion still applies, but the driver name in WinCC is still LOGO! and the maximum address space is smaller (V0.0…V127.7).
• LOGO! 8.4 (current at the time of writing, FS:05 firmware) introduces a larger VM area (V0.0…V2047.7) which is useful when the alarm-word list grows beyond 16 messages. Plan for V-word boundaries aligned to the new VM area layout.
• Modbus TCP polls bypass the LOGO!/S7-200 driver entirely. Holding register 0…127 (Modbus PDU 40001…40128) maps onto the same VM area. Mind the Modbus word order: register 1 contains VB0 low byte and VB1 high byte, identical to the S7-200 convention. If you write alarm bits from a third-party Modbus master, the same byte-swap caveat applies.
• BM (Basic) panel scripting limits. Solution A requires a VBScript tag, which is not available on the BM (Basic) panel series. Use Solution B for BM panels.
• Comfort Panel redundancy. If two panels are configured to read the same LOGO! V word, each panel sees the bit pattern independently. They are not synchronised — a “raise” event on panel A will not appear in the alarm log of panel B unless the LOGO! program replays it. Use the Coordination pointer to arbitrate.
• Operator screens with one alarm per line. If the alarm list scrolls, the trigger-bit index will look wrong if the user fixes Solution A but the LOGO! was wired per Solution B. Audit the LOGO! program before changing the HMI side.
• LOGO! Soft Comfort upload protection. The LOGO! 8 program is uploaded in encrypted form by default. Without the original .lsc file, you cannot determine the V address map from the panel side. Always archive the .lsc source alongside the HMI project.
• Firmware drift. A LOGO! 8.0 base module (FS:01) does not support the LOGO! driver in TIA Portal V14+; use the S7-200 driver or upgrade the base module to FS:03 / FS:05.

Frequently Asked Questions