Resolving Siemens LOGO! Analog Jumps from VM Address Overlap

Problem Overview

A Siemens LOGO! 8 base module (catalog 6ED1052-1MD08-0BA1 for the 12/24 VDC variant, or 6ED1052-1FB08-0BA1 for the 230 VAC variant, firmware 0BA8 ES 09 or newer) is reading a duct temperature sensor wired for 4-20 mA through a LOGO! AM2 analog expansion (6ED1055-1MA00-0BA2). The scaled value enters an Analog Amplifier / Threshold block (B006) configured to a range of -25 to +50 °C. The output of the amplifier is published to a SIMATIC KTP700 Basic panel (6AV2 123-2GB03-0AX0) over PROFINET for operator visibility. The program documentation follows the conventions in the LOGO! 8 System Manual.

For the first hour of operation, the temperature displayed on the HMI sits steady at approximately 20 °C, and the run output is healthy. After roughly 60 minutes the HMI field abruptly renders "####" and the program stops driving the fan as if the operator had pressed the hard-wired stop pushbutton. The behavior is fully repeatable from a cold start.

The "jump" is not caused by the sensor, the transmitter loop, or the AM2 expansion. The fault is a classic case of variable-memory (VM) address aliasing: a 16-bit Word tag used to publish the temperature to the HMI shares its 16 bits with two discrete Bit tags that drive the start and stop logic. Each refresh of the temperature word silently clears or sets those bits.

Affected Hardware, Modules, and Firmware

Root Cause – VM Address Aliasing in the LOGO! 8

The LOGO! 8 exposes a single byte-addressed Variable Memory (VM) area. LOGO! Soft Comfort allows the same physical bytes to be referenced as Bit (Vb.s), Byte (VBn), Word (VWn), or Double Word (VDn) depending on how the tag is declared at the block I/O. The mapping is fixed at the silicon level:

• Bit tag Vb.s occupies bit s of byte b
• Byte tag VBn occupies byte n
• Word tag VWn occupies bytes n and n+1 (low byte at n, high byte at n+1, little-endian)
• DWord tag VDn occupies bytes n through n+3 (least significant byte at n)

LOGO! Soft Comfort does not enforce protection against overlapping these references. A bit at V1.2 and a Word at VW1 reference exactly the same physical byte (byte 1) in two different ways. The same aliasing hazard is called out in the Siemens LOGO! 8 System Manual memory-layout chapter.

Siemens publishes a recommended address map for the LOGO! 8 that places the variable types in non-overlapping regions:

The failing program placed the scaled temperature on VW1, an address inside the bit region. VW1 occupies byte 1 (which holds V1.0 through V1.7) and byte 2 (which holds V2.0 through V2.7). The operator start input was declared as V1.2 and the stop input as V1.4. On every scan the LOGO! re-evaluated the amplifier B006 and wrote the new scaled integer back to VW1. A value of 20 (0x0014) places 0x14 in byte 1 – a bit pattern of 0001 0100 – leaving V1.2 clear and V1.4 set. Once the temperature integer crossed certain thresholds, the high or low byte of the new value cleared the run-enable bit, latched the run output off, and the fan stopped.

Why the HMI Shows "####"

The KTP700 Basic uses a 16-bit signed integer tag to display the scaled temperature. The configured display format reserves four digits with one decimal place. When the underlying integer exceeds the format range (or underflows the negative bound) the panel renders the field as "####" to indicate "value present, but cannot be displayed". The actual integer can still be inside the 16-bit range – the panel is rejecting it because of the operator-defined display mask, not because of overflow in the controller.

Common format mistakes that produce "####" on the KTP700 (per the KTP700 Basic manual):

• Display format set to 999 or 9999 with a value that exceeds the format ceiling (e.g. 0x7FFF = 32767 in a 4-digit field).
• Decimal places set to 2 when the controller produces a 16-bit integer (the integer 2014 with two decimals is rendered as "20.14" but the format reserves only one decimal place; the field shows "####" until the format is corrected).
• Signed/unsigned mismatch: a negative value displayed in an unsigned field, or vice versa.
• Tag length mismatch: a 32-bit tag is being read as 16-bit and the upper 16 bits are non-zero.
• Acquisition cycle too slow: the HMI is reading the tag faster than the LOGO! updates it, and the panel substitutes "####" for "value not yet refreshed".

In this program, the format ceiling was the proximate trigger for the "####" display, but the actual machine stop was driven by the run-enable bit being cleared, not by the HMI display itself. Once the VM overlap is fixed, the format mask should be rechecked: a four-digit signed format with one decimal place, for example, accepts -999.9 to +9999.9, which is sufficient for the -25 to +50 °C working range.

Step-by-Step Resolution

1. Open the LOGO! program in LOGO! Soft Comfort V8.4 or later and connect to the controller in online mode.
2. Press F2 (or use Tools > Address Overview) to open the VM address map. The map lists every Bit, Byte, Word, and DWord that is currently in use.
3. Sort the map by address. Confirm that VW1 is present and that V1.2 and V1.4 are also present – these are the colliding references.
4. Open the schematic and identify the block (typically an Analog Amplifier, Analog Threshold, Math, or Multiplexer) that writes the scaled temperature. Click the output parameter and change it from VW1 to an unused Word address inside the recommended Word region. The smallest free Word is VW40; if that is already in use, advance to VW42, VW44, etc.
5. Repeat step 4 for any other block that points at the bit region as a Word. Common offenders are Math blocks where the user typed a Word address in the bit region, and PI (Process Image) tags that have been re-typed as a Word.
6. Open the KTP700 project in WinCC Basic (TIA Portal V16 or later) or the legacy WinCC flexible 2008 SP5. Locate the HMI tag that is bound to VW1 on the LOGO! connection. Re-bind it to the new Word address (e.g. VW40). Save and compile the HMI project. TIA Portal download portal: TIA Portal V16.
7. Transfer the updated LOGO! program to the controller using Ethernet, micro SD, or the LOGO! Soft Comfort online connection.
8. Re-download the HMI project to the KTP700 over PROFINET (or USB if PROFINET is not yet configured).
9. Cycle power to the LOGO! base module to clear all VM bits to their power-on defaults and force the HMI to re-initialise the tag.
10. Verify that V1.2 and V1.4 still represent the start and stop inputs, and that the scaled temperature is now read from the new Word address.

Verification Procedure

After applying the fix, exercise the system in three regimes to confirm that the bit aliases are gone and the analog value no longer "jumps" into the digital region.

1. Cold-start test: Power down the LOGO!, wait 30 seconds, and re-apply power. Monitor the temperature on the KTP700 for at least four hours. The reading should remain stable within the resolution of the sensor (typically ±0.5 °C for a Pt1000 transmitter, ±0.2 °C for a high-grade 4-20 mA unit).
2. Setpoint step test: From the HMI, drive the setpoint from 20 °C to 5 °C and back to 20 °C. Confirm that the heating/cooling output toggles correctly and that the run output never drops out.
3. Bit integrity scan: In LOGO! Soft Comfort, open Tools > Online Test and observe V1.0, V1.2, V1.4, and the new temperature word simultaneously. The bits should be stable regardless of the temperature value, and the word should track the analog input.
4. Watchdog soak test: Run the system for a full 24 hours. Log the HMI value to a USB stick via the LOGO! data-log feature (Project > Data Log). Inspect the log; the temperature trace should be smooth and continuous with no discontinuities greater than the sensor's specified noise floor.
5. Boundary sweep: Force the analog input to its full-scale span by injecting 4 mA and 20 mA with a calibrated current source. Confirm that the word on the HMI reads the expected scaled value (e.g. -25 at 4 mA, +50 at 20 mA) and that the bits V1.x do not change.
6. Polarity reversal test: Reverse the polarity of the AM2 input leads; the controller should drive the value to the under-range limit (typically -32768) and the HMI field should render "####" without disturbing V1.x. This proves the loop is the only path by which the value can change.

Signal Integrity Checks for 4-20 mA Loops

Even after the VM fix, a properly engineered loop should be checked for noise, ground loops, and shielding problems. Symptoms of a marginal 4-20 mA loop are similar to the VM aliasing symptom (value appears to "jump"), so the loop must be validated independently of the controller fix.

Behaviour identical to the VM aliasing symptom can also be produced by an intermittent open circuit on the analog input. A 4-20 mA transmitter with a broken wire drives the input to its over-range value; the LOGO! then scales that to the maximum of the amplifier range, which lands in the "####" region of the HMI and may also disturb downstream logic. The diagnostic test is to inject a stable 12.00 mA from a calibrator and observe the HMI – if the HMI is stable at the scaled value, the loop is healthy. If the HMI still jumps, the loop is the problem, not the VM map.

Mathematical Block Configuration (B006)

The Analog Amplifier block (B006 in the original program) is the typical offender because it takes a raw analog value from the AM2 input and rescales it to engineering units. The block is configured with four parameters:

The block's transfer function is a straight line: y = y1 + (x - x1) × (y2 - y1) / (x2 - x1). The output is a 16-bit integer in the LOGO! 0BA8; the fractional part is truncated, not rounded. If a temperature is required to one decimal place, the block's output must be scaled in tenths of a degree (e.g. -250 to +500) and the HMI configured to show one decimal place. This is the most common source of a "0.4" / "0.5" quantization error on the KTP700.

VM Address Mapping Best Practices

The VM aliasing problem is so common that Siemens publishes explicit guidance for the LOGO! 8 series in the LOGO! 8 System Manual. Apply the following rules to every new program.

1. Never assign a Word or DWord tag inside the bit region (bytes 0 to 9). Bits 0 to 9 are exclusively for digital flags.
2. Never assign a Word or DWord at an odd address. LOGO! 8 silently allows odd Word references, but the resulting address straddles two words of the underlying bus and is hard to reason about. Force every Word to an even address.
3. Never assign a DWord at an address that is not a multiple of 4. Same reasoning as above.
4. Maintain a written VM map on paper or in a spreadsheet. The columns are: tag, address, type (Bit/Byte/Word/DWord), used by block(s), and HMI binding.
5. If the program is networked to an HMI, give every HMI tag its own dedicated Word address; do not pack HMI tags into bytes or bits.
6. When refactoring, use Tools > Address Overview (F2) to find any tags that violate the rules above before the program is transferred to the controller.
7. For larger programs, request the LOGO! Soft Comfort Address Overview as a CSV (LOGOSoft V8.4 supports it via File > Export > Address Overview) and store it in the project documentation. This gives the maintenance engineer an at-a-glance map of every tag in the controller.
8. When adding a new Word or DWord, choose the next free address in the recommended region by scanning the Address Overview – never pick an address in the bit region because the upper bytes of the range are "unused".

HMI Tag Binding in WinCC Basic / TIA Portal

The KTP700 Basic is configured in WinCC Basic (part of the TIA Portal V16 installation) or the legacy WinCC flexible 2008 SP5. Tag binding is where the analog value crosses from the controller into the panel.

1. Open the HMI project in TIA Portal and navigate to HMI Tags > Default Tag Table.
2. Locate the temperature tag (default name VW1 from the original program). The connection should point to the LOGO! connection (default: LOGO!_1 with a PROFINET address matching the base module).
3. Change the address from VW1 to the new Word address (e.g. VW40). Ensure the data type remains Int (16-bit signed).
4. Open the screen that contains the I/O field, select the field, and confirm the tag binding in the Properties pane. The format mask should be a 4-digit signed integer (e.g. 9999) and the number of decimal places should match the engineering units (typically 1 for °C).
5. Compile the HMI project. Resolve any warnings about address mismatches before downloading.
6. Download to the KTP700 over PROFINET; restart the panel if prompted.

A common secondary issue is that the HMI is reading the tag at the wrong polling rate. The default LOGO! polling rate is 500 ms. If the application requires sub-second display updates, the polling rate on the connection can be reduced to 100 ms in the HMI connection properties. Be aware that this increases the load on the LOGO! communication processor; do not drop below 100 ms on a base module without an AM2 communication module.

Diagnostic Workflow Summary

Related Field Observations

The "value jumps from a steady number to a different number" symptom is also produced by:

• An intermittently open input on the analog channel. The LOGO! AM2 inputs default to "over-range" (32767 counts) when the input is open; this is indistinguishable from a "value above 50" condition unless the loop is tested with a calibrator.
• Cross-talk between two analog inputs on the same AM2 module when the cable shield is missing or grounded at both ends.
• Noise coupling from a VFD output cable that runs in parallel with the analog cable for more than 3 m. The Siemens installation guide recommends 200 mm minimum separation between analog and power cables, with metallic conduit or a screened divider for runs longer than 10 m.
• A 24 V supply that is sagging under load (large inrush on a contactor coil) and dragging the loop voltage below the transmitter's compliance range.
• A pinched or chafed cable where the shield is intermittently shorted to the conductor, dragging the input to a near-zero reading.
• Two transmitters connected in parallel by mistake on the same input (the higher transmitter wins, but only when both are above 4 mA; the value "jumps" as the other transmitter takes over).

Each of these can be ruled out with a 5-minute loop test using a calibrator and a multimeter. The VM aliasing symptom is unique in that the value "jumps" only when the controller writes a new Word into the bit region, not when the analog input itself changes. If the value holds steady while the calibrator is connected and only moves with the calibrator, the VM map is the problem; if the value moves while the calibrator is held steady, the loop is the problem.

FAQ