Siemens LOGO! 8 HMI Counter: Resolving VW Address Overlap

Siemens LOGO! 8 HMI Counter Threshold Setup: Resolving the VW0 / VW2 Memory Overlap

When commissioning a Siemens LOGO! 8 (LOGO8) base module against an operator panel (HMI) to drive an up/down counter, integrators frequently hit a confusing fault: the value entered on the HMI screen appears to upload successfully, yet the counter thresholds snap back to random values, the digital output Q1 toggles erratically, and downloaded programs wipe the operator's entry on every restart. The root cause is almost always a single byte/bit address overlap between the HMI tag word and the internal flag bits that LOGO! Soft Comfort (LSC) assigns automatically inside Variable Memory (VM). This reference documents the failing pattern — binding the HMI to VW0 — isolates the bit-vs-word collision, and provides a verified configuration that places the HMI tag on a clean, non-conflicting word (the canonical VW2) so the up-counter and its associated reset behavior operate reliably on a 24 V DC discrete I/O base module.

1. Problem Description and Field Symptoms

The application is the classic parts-counter on a packaging or assembly line: an operator enters the lot-count threshold (e.g., 10) into a numeric I/O field on the HMI, the LOGO! 8 totals pulses arriving on digital input I1 from a proximity sensor, and on the tenth pulse the output Q1 (a signal lamp, solenoid valve, or relay) should drop. Q1 typically remains OFF until the count is reset.

In the field-failed pattern the integrator wires both the HMI I/O field and the counter-block "On threshold" input to the same address — most often VW0 — because that is the first entry in the LOGO! tag picker dropdown. The result is a hard-to-diagnose behavior chain:

• The HMI value appears to upload correctly, but within a few seconds the counter threshold parameter shifts to 0, 255, or random noise.
• Q1 flickers or turns ON exactly once on the first pulse, regardless of the configured threshold.
• Setting a breakpoint in LOGO! Soft Comfort's online mode (Tools → Connect → LOGO! → RUN) shows the threshold word reading a moving value while the program is running.
• Downloading the program wipes the operator's value, even when "Retain" is enabled for the counter block.
• The counter cannot be reset because pressing the reset button writes a flag bit that lives inside the same word the HMI just overwrote.

2. Root Cause: Bit/Word Address Overlap in VM

The LOGO! 8 stores all program variables in a contiguous Variable Memory (VM). Internally, that memory is a flat byte array; the LSC environment exposes it via three accessors:

Because these accessors alias the same physical bytes, a 16-bit write to VW0 simultaneously overwrites V0.0 .. V0.7 and V1.0 .. V1.7. The LOGO! 8 uses some of these bit positions for block-level flag storage: by default, the Counter function block consumes V0.0 (Cnt input latch), V0.1 (direction flag), V0.2 (reset latch), and adjacent bits for hysteresis or pre-scaling. When the operator enters the value 10 from the HMI, the panel writes 0x000A to VW0; that single write sets bit pattern 0b00001010 in the low byte, which:

• Toggles V0.1 (the counter direction flag) to "count down" mid-run, scrambling the tally.
• Toggles V0.3 — a position LSC commonly allocates to the "threshold reached" internal flag — so Q1 glitches momentarily.
• Forces the next I1 pulse to fire against a corrupted threshold; the counter either fires prematurely or never reaches the operator's intent.

2.1 Memory Map of the Default LSC Project

2.2 Binary Math of the Failure

Writing the decimal value 10 to VW0 yields the 16-bit word 0x000A in little-endian memory order:

0000 0000 0000 1010
^^                  ^^_bit V0.1 (Counter Dir) flipped to 1
|______________________ High byte = V1.0..V1.7 = 0x00

The bit V0.1 was previously 0 (count up); after the write it becomes 1 (count down). The next pulse on I1 is interpreted as "decrement" so the counter descends from 0 → 99,999 (wrap-around on the up/down counter defaults), and Q1 never triggers as designed. This is exactly the field symptom users describe.

3. Prerequisites

To reproduce the correct commissioning flow you need:

• LOGO! 8 Base Module (BM): 6ED1052-1MD08-0BA2 (LOGO! 8.FS4 with display) or 6ED1052-1CC08-0BA2 (LOGO! 8 pure BM). Firmware ≥ V8.1.5 is recommended; ≥ V8.2 for FS4-class features.
• LOGO! Soft Comfort (LSC): V8.2 minimum, V8.3 preferred for FS4. The download portal lives on the Siemens Industry Online Support site under "LOGO! Soft Comfort".
• Ethernet patch lead: CAT5e or better, used for LSC ↔ BM PC communication and for the HMI ↔ BM data connection.
• HMI: LOGO! TDE 6ED1055-4MH08-0BA1 (text display with Ethernet), a SIMATIC Basic Panel such as a KTP400 Basic mono PN (6AV2123-2DB03-0AA0) or KTP700 Basic, or any panel that speaks S7-300/400 ISO-on-TCP.
• Pulse source: 24 V DC inductive sensor wired to terminal I1, or a maintenance pushbutton (NC contact recommended) on a SIM socket.
• 24 V DC power supply: rated ≥ 200 mA above the BM consumption (the LOGO! 8 BM draws roughly 110 mA from the input).

Cross-check the firmware and hardware compatibility matrix in the LOGO! 8 product page, and consult the LOGO! 8 system manual published on the Siemens Industry Online Support portal under entry ID 109741041 (system manual LOGO! 8 / LOGO! 8.FS4).

4. Step-by-Step Configuration

4.1 Open or create the LSC program

Launch LOGO! Soft Comfort and open the project. Select File → Properties and confirm the target hardware is "LOGO! 8.FS4" with CPU FW ≥ V8.2. Make a backup by exporting the project to a .lma archive — this is the long-term maintenance format and survives LSC upgrades.

4.2 Add the Up/Down counter block

From the right-hand CoL (Chart of Logic) toolbar, select the Counter group and drag the Up/Down counter onto the diagram. Place its inputs as follows:

Set the Retain checkbox for both the threshold parameters and the counter's running value. This stores the running tally across power cycles.

4.3 Wire the block output

Connect the Q output of the counter block to digital output Q1 of the LOGO! BM. The block exposes a single Q output that is energized while the count lies between On and Off threshold. The base-module relay version can drive up to 10 A at 240 V AC.

4.4 Reserve the HMI tag word

Critical step: open the VM Memory Usage window (View → Memory usage or right-click the worksheet background → View memory) and confirm that VW2 is not already consumed by another block. The first 26 bytes of VM are reserved for LSC skeleton data plus any analog-input scaling; from VW2 onward you can generally claim space, but always confirm. If VW2 is already consumed, move to VW4, VW6, etc., skipping every word that overlaps an existing block parameter.

4.5 Create the HMI-side tag in LSC

In LSC, double-click on the On-threshold input line of the counter block and the tag picker opens. Click New; name the tag HMI_Cnt_Threshold; set the type to Word; pin the address to VW2. Save. (Alternatively, open Tools → Tag Editor and add a Word tag fixed at VW2.)

4.6 Configure the I/O field on the HMI

On a SIMATIC Basic Panel in TIA Portal:

1. Open the HMI project in TIA Portal.
2. Project tree → HMI → HMI tags; add a new tag with name CounterThreshold, data type Word, connection = the S7-300/400 connection to the LOGO! 8, address DB1, W2.
3. Place an "Output/Input field" on the operator screen.
4. Bind the field to the new tag.
5. Tick Input in the field properties; optionally tick Output on a second field to give the operator a live read-back.

4.7 Compile, transfer, run

Use LSC Tools → Compile to validate the project, then transfer with PC → LOGO! over Ethernet. The BM restarts into Run mode. Watch the BM display — when it shows VW2 = 10 for the counter threshold, the wiring is correct.

5. Verification Procedure

1. With the BM in Run, enter the value "10" in the HMI counter-threshold screen.
2. Pulse I1 ten times (each press should be ≥ 20 ms to clear the LOGO! input debounce period of 5 ms; the practical machine cycle is 50 ms).
3. Read back the count: the BM should display Cnt = 10.
4. Inspect output Q1: it must be OFF because the count is at the configured threshold (Off=0 means Q is ON only while count is in [1..10] and back OFF when 10 is reached).
5. Drop the threshold to "3" from the HMI; pulse I1 three more times; Q1 must change state.
6. Press I2 to reset; the counter parameter reads 0 and Q1 returns to ON (per the hysteresis). If Q1 stays OFF after the reset, the Off threshold is misconfigured (see Pitfall 3).

If step 4 fails, open LOGO! Soft Comfort in online mode and inspect the threshold input via the status panel. If the live read shows anything other than the HMI-entered number, the panel tag is not bound to VW2 — re-tag and re-deploy.

6. Counter Block Parameter Reference

The Up/Down counter is one of the standard LOGO! 8 blocks. The parameter table below is summarized from the LOGO! 8 system manual; always cross-check against the official system manual for your specific firmware.

The Up/Down counter's Q output is level-based, not a one-shot. With On=10 and Off=0, Q is energized while the count is in [Off+1 .. On] = [1 .. 10]. Crossing On going upward does not, by itself, turn Q OFF — Q remains ON. To make Q1 drop on the 10th pulse use On=10 and Off=11, or follow the counter with a comparison block and a flip-flop.

7. Memory-Map Best Practices

Before opening LOGO! Soft Comfort to start a non-trivial program, draft an address map in a spreadsheet. The default LSC allocation is opaque: LSC silently consumes VM space when you drag new blocks. The recommended skeleton is:

8. Detailed HMI Tag Configuration

The following two recipes are robust against the most common integration mistakes.

8.1 TIA Portal / WinCC Comfort (S7 ISO-on-TCP)

1. In Devices & Networks → Networks, create an S7 connection between the panel and the LOGO! BM using the BM's IP (default 192.168.0.1).
2. Under the panel → HMI variables, add a row: name CounterThreshold, data type Word, connection = the new S7 connection, address DB1, W2.
3. Drag the variable onto the screen I/O field. Tick Input on the field's properties.
4. In the field's events, optionally add a change-value script that writes the value into a discrete confirmation bit (e.g., V2.0) for an external acknowledgement LED.
5. Test the screen in simulation mode (Start → Run) before deploying to the panel.

8.2 LOGO! TDE (Ethernet text display)

1. Open the LSC project; double-click the TDE node to open the editor.
2. Place a "Numeric Field". Set tag → CounterThreshold at address VW2.
3. Mark the field "Input" and "Output".
4. Save and program both the BM and the TDE.

For pure web-based access on a LOGO! 8.BAE (Ethernet-only BM), enable the integrated LOGO! Web Editor (LWE) page and configure the same numeric field. The VM binding remains VW2; only the front-end technology changes.

9. Network and Protocol Reference

Subnet the IP addresses to a /24 block reserved for automation: e.g., 192.168.0.1 for the LOGO! BM, 192.168.0.10 for the HMI, 192.168.0.100 for the engineering PC. The default LOGO! 8 subnet mask is 255.255.255.0.

10. Common Pitfalls and Variations

10.1 Pitfall: writing to VW0 instead of VW2

The single highest-frequency root cause. Always start at VW2 (or any unused even word) for HMI input. Reserve VW0 for internal LSC flags and never expose it to an operator field.

10.2 Pitfall: binding to a bit tag instead of a word

If the HMI binds to a bit tag (e.g., V2.0) instead of VW2, the operator entry only writes one bit. A 10th-pulse threshold requires a value up to 0x000A; writing only the LSB caps the count at 1. Always verify the tag's data type is Word or INT, not Bool.

10.3 Pitfall: Q1 = ON when the user expects Q1 = OFF

The functional spec often reads "turn the output OFF on the tenth pulse," but the Up/Down counter's Q is a hysteresis output, not a one-shot. With On=10, Off=0, Q is ON during the count and stays ON when 10 is reached. Use On=10, Off=11 for a clean drop on overflow, OR follow the counter with an "analog threshold trigger" comparator and a flip-flop that toggles Q1 at the threshold crossing.

10.4 Pitfall: counter resets on every power cycle

Open the counter block properties → tick Retain for both the running count and the threshold parameters. Without Retain, the VM is initialized to 0 on power-up and the operator's threshold is forgotten.

10.5 Pitfall: HMI does not see variable updates

Some panels cache the variable list at boot. After a fresh LSC download to the BM, cycle the panel power to force a re-import of the variable table.

10.6 Pitfall: TD in FBD mode with the wrong COM port

The legacy LOGO! TD (RS-232, part numbers ending in -0LB0) has its own address space. TD variables are NOT the same as VM. The LOGO! TDE (Ethernet, -0BA1) shares VM with the BM and is the recommended variant for parameter editing.

10.7 Pitfall: pulse-output requirement

Standard Q is level. For a single pulse when the threshold is crossed, follow the counter with a "Pulse relay" (one-shot with Pt = 1.0 s) and edge-trigger it from the threshold-comparison block.

10.8 Pitfall: HMI I/O field above 255

If the HMI caps the input at 255, the field is bound to a Byte tag. Change the tag's data type to Word (or INT) in the panel's variable table and re-deploy. The LOGO! counter accepts up to 999,999.

11. Advanced: Web-based HMI via LOGO! Web Editor

For a maintenance dashboard on a tablet or phone, the LOGO! 8 with firmware ≥ V8.0 can serve an HTML5 view directly. Enable the web server under Setup → Web Server Access on the BM, set a password, and enable variable VW2 in the editor. Drag a numeric edit widget onto a canvas and bind it to VW2. Open the page at http://<LOGO-IP> from any browser.

The same VM region is shared with the engineering program, so no protocol translation is required. This is the fastest path when a dedicated panel is not in the budget and the application has fewer than ~200 tags.

12. Calculation: Single-Phase Failsafe Wiring Math

For machines that drive the Q1 relay directly (no external contactor), size the BM's digital output:

• Maximum continuous current: 10 A (relay variant) or 0.3 A (transistor variant).
• Inrush derating: derate lamp loads to ≤ 2 A continuous; inductive loads to ≤ 6 A continuous at 240 V AC.
• Single-phase apparent power at the relay: kVA = V · I / 1000.
• If a 24 V DC solenoid at 1.2 A is wired to Q1: kVA = 24 · 1.2 / 1000 = 28.8 W — well within the transistor variant rating.

If you instead command a 240 V AC coil via the relay output, the apparent power is kVA = 240 · I / 1000; the relay's snubber network must be kept free, and any external contactor coil should be fitted with an RC suppressor to extend contact life.

13. Quick Diagnostic Flowchart

Use this sequence when Q1 does not behave on the 10th pulse:

1. Is HMI tag = VW2? If VW0: STOP — change to VW2 and recompile.
2. Is the HMI tag data type Word? If Byte: STOP — change to Word.
3. Is Retain ON for both threshold and count? If no: enable Retain.
4. Is the LSC online monitor showing VW2 equal to the HMI value? If no: re-tag the panel and re-deploy.
5. Is On-threshold = Off-threshold? If yes: change to On=10, Off=0 or On=10, Off=11.
6. Is sensor wiring correct (24 V DC at I1)? Verify with a multimeter or LSC online status.

14. Glossary of LOGO! 8 Memoric Terms

15. Frequently Asked Questions