Resolving Siemens LOGO! Counter VM Mapping Errors on KTP400 HMI

Problem Overview

When a Siemens LOGO! 8 logic module exchanges counter (CNT) and timer (TON / TOF / TP / Interval / ON-delay) parameter values with a SIMATIC KTP400 HMI over an Ethernet S7 connection, engineers frequently observe a corrupted display on the panel. A typical symptom is that the HMI shows a nonsensical integer such as 238798 when the operator enters a small target value such as 4 for the ON threshold, or that an ON-delay value of 60 min appears on the KTP400 as 36:00 while a 1:00 reading reports back to the controller as 1 h 40 min.

These errors are not panel defects and not LOGO! firmware defects. They are the predictable result of three configuration mistakes commonly made in TIA Portal V18 (or earlier):

1. Writing to a Word (VWx) variable in TIA where the LOGO! parameter VM mapping exposes a DWord (VDx) tag.
2. Misunderstanding the LOGO! 8 timer time-base transfer format (seconds / minutes / hours) and the way it is displayed by WinCC Comfort on a Basic panel.
3. Using two non-adjacent VM words for the same parameter, where a write to one word silently overwrites part of an unrelated double word.

This reference details the root causes for each symptom, the correct VM-mapping procedure for the relevant blocks, and the verification steps required to confirm a clean round-trip HMI -> LOGO! -> HMI exchange.

Affected Platforms and Versions

Root Cause 1 - Word vs DWord Misalignment in the VM Mapping

The most common cause of the 238798 reading is a half-write. In LOGO! Soft Comfort, the parameter list of each block (counter, timer, analog threshold, etc.) is exposed in the VM (Variable Memory) mapping. Counter threshold values, ON-delay times, and interval times in the counters block family are typically mapped as a 32-bit DWord (DInt) occupying two adjacent 16-bit VW registers. For example, a counter threshold may be mapped at VM address VD14, which physically occupies VW14 (low word) and VW16 (high word).

If the TIA Portal HMI tag table uses VW14 with format Int instead of VD14 with format DInt, the panel pushes its 16-bit write into the high word of the double word that LOGO! expects. The remaining (lower) word still contains whatever was last written by LOGO!Soft Comfort or by runtime. When the LOGO! re-reads the 32-bit value, the assembled DInt equals (HMI_word << 16) | old_low_word, which is far from the intended setpoint. The exact junk value 238798 is the decimal result of 0x0003_0000 | 0xA0CE plus whatever the previous low-word content was - this is one of the most commonly reported variants because it coincides with the default low-word remnant after a fresh download.

Resolution

1. In LOGO! Soft Comfort, open the project and navigate to Tools -> Parameter VM Mapping (or the right-hand pane Parameter VM mapping tab).
2. Locate the block whose threshold or time you need to expose (for example, Block 001 - Counter).
3. Confirm the block parameter you need. For a standard counter this is usually On threshold, with data type DInt and length 4 bytes. The address column shows the start VM word, for example VD14.
4. Write down the start address (VDx) and the byte length. Do not use the trailing offset word for unrelated tags.
5. In TIA Portal, open the HMI tag table (for example, HMI_Tags -> Default tag table).
6. Add a new tag named with a meaningful identifier such as Counter_OnThreshold.
7. Set the connection to the LOGO! (for example, LOGO_8_Connection_1).
8. Set the address to the full DWord, e.g. %DB...- or directly the VM area wording used by TIA%DB14.DBD0 depending on how the LOGO! is integrated as a partner. The decisive requirement is that the address points to a DWord and the data type is DInt.
9. Save and recompile the HMI project, then download to the KTP400.

Root Cause 2 - Timer Time Base vs HMI Time Format

The second family of complaints is specific to time values, not thresholds. In LOGO! 8, the ON-delay (TON), OFF-delay (TOF), pulse (TP), and interval / pulse-pause functions all have two configuration dimensions in the LOGO! editor:

• Time base - selectable in the LOGO! function block dialog as either s (seconds), min (minutes), or h (hours).
• HMI time format - how the value is rendered on a panel: h: m, m: s, or s.

What the LOGO! transfers to the HMI is a raw integer in the selected time base. The HMI renders it as mm:ss only because the HMI tag is configured with time format m: s. There is no internal conversion inside the LOGO! between the time base you selected for the block and the time format you selected on the panel.

Two common incorrect assumptions produce the symptoms reported:

When the user enters 60 min and the HMI returns 36:00, the value the LOGO! actually stored is most often 2160 or 60 - the 36:00 on screen is a unit conversion error: 2160 s rendered as m: s is exactly 36:00. This is not a bug; it is the LOGO! obeying the configured time base you chose in the on-device block configuration.

Resolution for the time-base issue

1. Open the LOGO! program in LOGO!Soft Comfort.
2. Double-click the relevant timer block (for example B002 - ON-delay).
3. Confirm the setpoint time unit selector. If you intend minutes, set the time base to min. If you intend seconds, set it to s.
4. On the HMI, set the IO field that displays the timer value to the same unit concept. There is no automatic conversion between the LOGO! time base and the HMI time format.
5. If you need a value of "60 minutes" on the HMI, either set the LOGO! block to time base min and enter 60 on the HMI, or set the LOGO! block to time base s and enter 3600 on the HMI. Pick one and stick with it.
6. For interval / pulse-pause timers, the same rule applies. The threshold is a raw integer in the chosen time base. The pulse duration and pause duration are independent fields and each has its own VM word.

Root Cause 3 - Adjacent VM Word Collision

Once the Word-vs-DWord fix above is applied, operators sometimes report a regression where the value they write to the counter threshold changes another timer that uses the adjacent high word. This is the symmetric problem: writing to VW24 while the LOGO! uses VD26 for a different block leaves the low word of that second block intact but mutates its high word on the next write. The reported symptom is that changing the counter threshold unexpectedly shifts the timer setpoint, or vice versa.

The fix is to use the same start DWord address in both places:

1. In LOGO!Soft Comfort, search the parameter VM mapping for any block whose start address is between the start of the timer and the start of the counter, plus one DWord.
2. If a collision exists, reorder the VM mapping by re-positioning blocks, or pick two addresses that are at least 4 bytes apart (two VW words) and bind the HMI tag exactly to the start DWord of the block you want to control.

Correct VM-Mapping Procedure for Counters and Timers

The recommended commissioning sequence ensures the HMI tag points at the right DWord and uses the right format.

Prerequisites

• LOGO!Soft Comfort V8.x with the project file (LSC) open.
• TIA Portal V18 or later installed, with the LOGO! station project added under Devices & Networks.
• KTP400 Basic panel project integrated into the same TIA Portal project.
• An established S7 connection between the LOGO! station and the HMI station.
• The LOGO! program compiled to the device at least once so the parameter VM addresses are final.

Step-by-Step

1. Compile and download the LOGO! program so the device has a final parameter VM table.
2. Open Tools -> Parameter VM Mapping in LOGO!Soft Comfort and identify each block's VM start word and length. Record at minimum: block number, name, VM start word (VDx), data type, byte length.
3. In TIA Portal, open the HMI tag table and add a tag for each VM value the HMI needs to read or write.
4. For every counter threshold and timer setpoint, set the HMI tag address to a DWord (DBx.DBDy) and the tag data type to DInt.
5. Configure the HMI I/O field process value to use the new tag. On a KTP400 Basic, the I/O field supports display in decimal and in m: s / h: m formats only when the tag has a numeric data type.
6. Download the HMI project to the KTP400.
7. From the LOGO! device display, navigate to the target block and confirm that adjusting the setpoint on the HMI also changes the live LOGO! value, and that the LOGO! -> HMI round-trip preserves the value.

Specifications and Limits of the LOGO! VM Interface

The supported time bases in the LOGO! function block dialog are s, min, and h. The HMI display formats on a SIMATIC Basic panel are s, m: s, and h: m. There is no scaling between them; the LOGO! transfers a raw integer in time base units and the HMI renders it according to the chosen display format.

Verification Procedure

1. From the HMI, write the value 4 to the counter ON threshold via the I/O field.
2. Read the LOGO! device display and confirm TH = 4 on the counter block faceplate.
3. Force the counter input to toggle the count high enough to exceed 4 and confirm the counter output switches as expected.
4. From the LOGO! device display (or LOGO!Soft Comfort online view), change the threshold to a different value such as 7 and verify the HMI I/O field updates to 7 within one polling cycle.
5. Trigger an adjacent timer to confirm there is no cross-talk between adjacent VM DWords.
6. Check the LOGO! diagnostic buffer for any S7 communication errors during the test (LOGO! -> menu: OK -> Diagnostics). No errors should be present.

Troubleshooting Matrix

Best Practices for LOGO! 8 + KTP400 Projects

• Always bind HMI tags to the start DWord shown in the LOGO!Soft Comfort parameter VM mapping, never to the trailing half-word.
• Use DInt as the HMI tag format for every counter threshold and timer setpoint. Avoid mixing Int and DInt on adjacent VM words.
• Lock the LOGO! time base (s, min, or h) in the LOGO! program and document which unit the HMI is expected to use.
• If end users think in minutes, set the LOGO! time base to min. If end users think in seconds, set the LOGO! time base to s. Do not mix them.
• When using WinCC I/O fields on KTP Basic panels, prefer the format selector dropdown over the data type selector, because Basic panels do not expose the IEC Time data type for these tags.
• Maintain a single source-of-truth table (Excel or as PLC data block comments) that lists each block, its VM start DWord, the HMI tag name, and the expected unit. This eliminates the "I changed VW24 and the counter moved" type of fault.
• After any re-ordering of blocks in LOGO!Soft Comfort, re-check the VM mapping. Adding, removing, or re-ordering blocks invalidates the existing DWord addresses.

Alternative Platform Notes

The same DWord-alignment principle applies when a LOGO! 8 is connected to other HMI brands such as a Weintek cMT or a Red Lion CR1000, or to a third-party OPC UA gateway. In all of these cases the driver or tag configuration must request the LOGO! parameter as a 32-bit signed integer (DInt) starting at the VM DWord address, not as a 16-bit integer at one of the half-word addresses. Conditional counters that compare against a numeric threshold - including third-party home-automation triggers - require the same care: the comparison value must be expressed in the same unit and same integer width that the controller exposes.¹

FAQ