Siemens LOGO! 8 Micro SD Cybersecurity: Internal Memory Options

Overview of LOGO! 8 Storage Architecture

The Siemens LOGO! 6ED1052-1MD08-0BA1 is a compact logic module (BM) belonging to the LOGO! 8.3 generation. The module integrates an HMI display, 8 digital inputs (24 V DC sourcing), 4 relay outputs (10 A resistive / 3 A inductive), and a 115/230 V AC power supply. Order code suffix 0BA1 places the device in the LOGO! 8.3 release tier with firmware 1.83.x. The basic module also integrates an Ethernet 10/100 port (RJ45), a real-time clock (RTC), an SD card slot, and a non-volatile internal Flash program memory.

Internal Flash memory holds the circuit program, parameter values, the operating-hours counter, the retentive markers, and a copy of the last-loaded LSC (LOGO! Soft Comfort) project. The internal program area retains its content without a battery. The Micro SD card is a separate, removable repository used for archives, datalogs, recipes, and user-defined web pages. The BM will boot and execute logic from internal memory with no SD card inserted.

Forced removal of the SD card during operation does not interrupt logic execution. The BM stores pending datalog records into a 200-entry ring buffer in internal memory and flushes them to the SD card on re-insertion (where configured).

Micro SD Card Functional Requirements in LOGO! 8

The Micro SD card is required only for a specific subset of features. The LOGO! 8 System Manual (entry ID 109751604) lists the card as mandatory for:

1. User-defined web server: a custom HTML/CSS/JS interface stored in /home on the SD card root. Without the SD card, only the standard LOGO! web UI is reachable.
2. Datalogging beyond 200 records: a single datalog file with more than 200 entries, or more than one datalog target file.
3. Recipe storage: parameter sets used by analog threshold blocks, PI controllers, UDFs, and arithmetic blocks that switch setpoints on demand.
4. Firmware update: a *.upd image placed on the SD triggers an autoupdate sequence on power-up.
5. Project archive: large LSC projects that exceed the BM's internal slot are archived on the SD.
6. Backup of the current parameter set: the parameter set is one of the few values the user can copy between BMs via SD.

All standard logic functions execute from internal memory: counters (I1-I7, retentive/non-retentive), timers, on/off delays, weekly timers, yearly timers, pulse generators, edge detectors, analog comparators, threshold triggers, PI controllers, math blocks, shift registers, multiplexer blocks, latching relays, soft keys, message texts, and the real-time clock.

Cybersecurity Risk Analysis of Removable Storage

A removable SD card expands the attack surface of a deployed BM in four ways:

• Program extraction: physical removal and insertion into a PC with a USB card reader reveals the LSC project file, IP addresses, network parameters, and any passwords stored inside the LSC archive.
• Program modification: writing a tampered LSC backup to the card and reinserting it triggers an automatic reload on next power-up if the BM detects a valid project in /home. The reload overwrites the internal program.
• Datalog exfiltration: CSV files on the SD can be lifted to leak process telemetry, batch numbers, and alarm histories.
• Indirect propagation: a malicious payload placed on the SD card, when the SD is later inserted into a Windows workstation for backup, can execute a DLL-hijack or autorun attack. While modern Windows does not autostart SD content, manual execution of setup.exe or install.cmd by the engineer remains a viable vector.

Internal Flash is not a removable medium and is not readable outside the BM. No physical header on the BM exposes the internal Flash for direct read; access requires the LOGO! Soft Comfort engineering link over Ethernet or the BM keypad.

Operating LOGO! 8 Without Micro SD Card

The 6ED1052-1MD08-0BA1 operates as a standalone logic relay with the SD card removed. The following capability matrix summarizes what is and is not available:

Function	Without SD Card	With SD Card
Standard circuit execution	Yes	Yes
Real-time clock and calendar	Yes (24 h retention after power-off, super-cap)	Yes
Parameter set storage (1 profile)	Yes	Yes
Datalogging (single file)	Up to 200 records (FIFO)	Up to 50,000 records per file
Multiple datalog files	No	Yes
User-defined web server	No	Yes
Standard web server	Yes	Yes
Recipe storage	No	Yes (max 64 recipes)
Firmware update	Via LSC Ethernet only	Via SD or LSC
Program archive (multi-slot)	1 internal slot only	Multiple archives on SD
Display messages, soft keys	Yes	Yes

Password Protection and Program Access Control

LOGO! 8.3 supports three independent protection layers configured in LOGO! Soft Comfort V8.3 or newer.

1. Project password (circuit program) — set under Tools > Options > Protection with four privilege levels:

• Administrator: full read/write/download access
• Operator: limited parameter change
• Monitor: read-only
• None: no remote access

The project password is embedded in the LSC binary and is enforced on every BM that downloads the program. The BM refuses any LSC download attempt that supplies a wrong password.

2. BM menu password (local PIN) — a four-digit PIN entered on the BM keypad and display to enable local parameter editing. The PIN is set in LSC under Tools > BM Access Protection. Without the PIN, the keypad shows only I/O status; SET/ESC navigation is locked.

3. LOGO! Soft Comfort connection password — a separate password for remote Ethernet engineering access. Without it, a client cannot upload, download, or stop the program. Combined with the BM's IP allow-list, this prevents IP-spoofed modifications from outside the engineering network.

Critical limitation: passwords protect program content from logical tampering but do not prevent physical removal of the SD card and the file itself. A removed SD card can be read on any PC, including offline. The password is enforced only when the SD card is plugged back into the BM and the BM attempts to load from it.

Physical Locking Solutions for Cabinets and SD Slots

To mitigate the physical-removal attack vector, apply layered physical controls.

• Cabinet lock: install a key-locked or combination-locked enclosure. Common industrial enclosures: Rittal AE series, nVent HOFFMAN A-SDP, Eaton HSK, and Hammond Eclipse Junior. The cabinet should be rated to the same IP class as the installation environment (IP54 minimum for dry indoor, IP65/IP66 for washdown).
• Tamper-evident seals: apply a serialized security label over the SD slot and over each cabinet seam. Brady B-746 series, 3M Tamper Indicator 7613, and Panduit S100X150YAJ self-destruct on removal and leave a visible pattern.
• Cover plate with breakaway screws: a custom metal bracket that covers the SD slot, fastened with shear-head screws that can only be tightened, not loosened. This prevents casual removal and signals tamper if force is applied.
• Locking card holder: replace the standard SD push-push socket with a captive holder (Delock 54096, Eby 460-300) that uses a screw lock.
• Network segmentation: place the LOGO! on a private VLAN with a managed switch ACL. Deny all East-West traffic to the BM except from a dedicated engineering workstation. The LOGO! 8 manual recommends isolating the BM from the corporate network.
• Disable unused services: turn off the LOGO! web server in LSC under Tools > Options > Web Server Access when the web UI is not required. Disable Modbus TCP if it is not in use.

Siemens S7-1200 as Equivalent with Integrated Memory

When integrated non-volatile memory is a hard requirement, the S7-1200 is a credible alternative. The 6ES7214-1AG40-0XB0 (CPU 1214C DC/DC/DC) integrates the following resources:

• 100 KB work memory for code (load+work)
• 4 MB load memory (internal, non-volatile Flash)
• 8 KB bit memory (M area)
• 10 KB retentive memory
• 14 digital inputs (24 V DC, sourcing)
• 10 digital outputs (24 V DC, 0.5 A transistor)
• 2 analog inputs (0–10 V)
• PROFINET interface with 2-port switch
• Optional SIMATIC Memory Card (SMC), 4 MB or larger

The program is stored in the internal Flash. The SMC is used only for backup, transfer between CPUs, and firmware update. The CPU does not auto-load from the SMC unless TIA Portal configures the SMC as a program card (under Project > Properties > Protection > SIMATIC Memory Card). Without that flag, removing the SMC has no effect on operation.

The S7-1200 supports the following protection mechanisms in TIA Portal V15+:

• Know-how protection: bind program blocks (FB, FC, OB, DB) to a password. The block content cannot be read in TIA Portal without the password; the CPU also refuses online read of unknown blocks.
• Copy protection: bind blocks to a specific serial number of the CPU or SMC. The block will not run on a different hardware platform.
• CPU access levels: four privilege levels (full access, read-only, HMI access, no access) with separate passwords.
• Online access protection: a password is required for any TIA Portal online connection, with configurable read/write lockout.
• Security logging: audit trail of online operations, accessible via the CPU's diagnostic buffer.

For deployment that requires OPC UA server, structured text programming, and TLS-encrypted PROFINET, the S7-1200 (firmware V4.4 and newer) is the recommended platform. See the S7-1200 System Manual (entry ID 109744940) for full specifications.

LOGO! 8 vs S7-1200: Functional Comparison

Parameter	LOGO! 6ED1052-1MD08-0BA1	S7-1200 6ES7214-1AG40-0XB0
Program memory	Internal Flash, ~850 blocks	100 KB work + 4 MB load
External storage	Micro SD required for some features	SMC optional
Digital inputs	8 (24 V DC)	14 (24 V DC)
Digital outputs	4 relay (10 A)	10 transistor (0.5 A)
Analog inputs	0 (expandable to 8 via SB)	2 (0–10 V)
Communication	Ethernet 10/100, Modbus TCP	PROFINET, Modbus TCP, OPC UA
User-defined web server	Yes (with SD)	Yes (built-in)
Programming	LOGO! Soft Comfort V8.3+	TIA Portal V15+
Cybersecurity (built-in)	Project password + BM PIN	Know-how + access levels + copy protection
Program retention	Yes (internal Flash)	Yes (internal Flash)
Typical price band	Entry-level logic	Mid-range compact

The S7-1200 carries a higher unit cost (factor 3–5) but provides stronger protection, OPC UA server support, and integrated memory that does not require removable media for any feature.

Web Server Functionality and SD Card Dependency

LOGO! 8 supports two web server modes. The Siemens LOGO! product page documents both modes in the LOGO! 8.3 release notes.

1. Standard web server — built into the BM, accessible via the IP address on port 80. The UI shows current I/O state, statistics, and supports remote parameter changes. Does not require an SD card.

2. User-defined web server — a custom HTML/CSS/JS interface uploaded to /home on the SD card. The BM serves the custom pages instead of the standard interface. Requires an SD card. The user-defined web server supports up to 4 MB of HTML/CSS/JS files and a fixed set of BM tags exposed via JSON. The SD card must remain inserted for the BM to serve the custom UI.

If user-defined web pages are not a hard requirement, run the standard web server without an SD card. To disable the web server entirely, set Tools > Options > Web Server Access to Disabled in LSC. This removes the HTTP service from the BM, eliminating one attack surface.

Datalogging Capacity and SD Card Requirements

LOGO! 8 stores datalogs in the internal memory if no SD card is installed. The internal datalog buffer holds a single file with up to 200 records. Records beyond 200 overwrite the oldest entries (FIFO ring). The internal buffer is non-volatile and survives power cycles.

With an SD card installed, the BM creates a separate file per datalog target, each holding up to 50,000 records (subject to SD card free space). Files are written in CSV format with timestamp, trigger source, and value columns. File rotation follows the configured pattern (daily, weekly, on size).

For process data retention, configure the project to log to the internal buffer and periodically read the buffer via Modbus TCP (function code 0x03) or HTTP GET (/datalog endpoint). The internal buffer survives power cycles and is the recommended retention path when SD is removed.

Commissioning Without SD Card

Follow this procedure to commission the LOGO! 6ED1052-1MD08-0BA1 without an SD card:

1. Connect the BM to a PC running LOGO! Soft Comfort V8.3 (or newer matching the BM firmware). Match LSC version to BM firmware; mismatches cause a download refusal.
2. Open or create the circuit program.
3. Go to Tools > Options > Protection and set the project password (Administrator level recommended). Choose a 16-character password including mixed case, digits, and symbols.
4. Set Tools > Options > BM Access Protection with a four-digit PIN. Document the PIN in a secured password vault.
5. Disable the user-defined web server: Tools > Options > Web Server → Off.
6. Set Tools > Options > Web Server Access to LAN only (no WAN access).
7. Verify SD card usage: Tools > Options > SD Card → Do not use SD card, or simply do not install one.
8. Connect PC and BM via Ethernet (direct or through a switch). Configure the BM IP address via the BM keypad under Network or via LSC online mode.
9. Download the program with PC > LOGO! > Download. Wait for the green "Transfer complete" message.
10. Cycle power on the BM. Verify the program executes (RUN LED solid green) and the SD card slot is empty.
11. Apply a tamper-evident label over the SD slot to detect later insertion. Record the label serial number in the maintenance log.
12. Lock the cabinet. Document the key custody chain.

Field-Proven Implementation Recommendations

Layered defense is the only effective control against removable-media threats.

• Use cabinet lock + tamper-evident label on the SD slot as the baseline physical security. The label number is logged in the maintenance record so any later swap is detectable.
• Enable the project password (Administrator level) and BM access PIN. Document both in a secured password vault, not on the cabinet door.
• Disable the web server if not required. The HTTP service is the most common external probe target.
• If the application requires user-defined web pages, mount the SD card with a locking card holder (Delock 54096, Eby 460-300) that uses a screw lock.
• If integrated memory is mandatory, specify the S7-1200 6ES7214-1AG40-0XB0 (firmware V4.4+) or the newer 6ES7214-1AH50-0XB0 (CPU 1214C DC/DC/DC with firmware V5) instead of LOGO!. The S7-1200 has integrated Flash, know-how protection, and copy protection.
• Segment the LOGO! on a private VLAN with no route to the corporate network. The LOGO! 8 manual explicitly recommends isolating the BM.
• Apply Siemens security patches to LOGO! Soft Comfort and BM firmware. Check Siemens Industry Online Support for the latest firmware updates and security advisories.
• Document the deployed IP address, subnet mask, gateway, and engineering PC MAC in the network register for traceability.

The cybersecurity risk of a removable SD card is real but bounded. For most installations, the combination of physical cabinet lock, tamper-evident label, project password, and network segmentation is sufficient. For higher-assurance installations, the S7-1200's integrated memory and stronger access controls deliver a measurable security uplift at higher unit cost.

FAQ