Siemens LOGO! 8 Modbus TCP: Resolving Port 502 Connection Errors

The Siemens LOGO! 8 (6ED1052 series) frequently returns the .NET IOException "Unable to write data to the transport connection: An existing connection was forcibly closed by the remote host" or the QModMaster error "Read data failed. Error: no error / Port is closed" when a Modbus TCP master attempts to connect to the default Modbus TCP server port 502. The fault is almost always related to port binding and the LOGO! network project configuration rather than to the client code. This article maps the LOGO! 8 static connection port table (502-509), shows how port 510 becomes the first available endpoint, and provides a complete diagnostic and remediation procedure verified against LOGO! 8.FS4 (6ED1052-1MD08-0BA1) and LOGO! 8.FS5 (6ED1052-2MD08-0BA1) firmware with LOGO! Soft Comfort V8.4 and V9.0.

1. Problem Symptoms

Four distinct but related symptoms appear when the LOGO! 8 Modbus TCP server is contacted on the wrong port or with a malformed Modbus request:

The error is independent of the master being QModMaster, a custom C# application, an HMI, or a SCADA package. Switching tools does not resolve the fault because the binding is on the LOGO! side.

2. Root Cause: LOGO! 8 Static Connection Port Table

The LOGO! 8 family enforces a fixed mapping between static connection points declared in the network project of LOGO! Soft Comfort and the TCP port numbers the firmware binds. The mapping applies whenever the LOGO! is configured as a Modbus TCP server (slave):

Three rules govern this table:

1. Master vs Slave role: If the LOGO! is the Modbus master (client) it connects out to any TCP port of the slave. The 502-509 numbers do not constrain the client side.
2. Static binding: The eight ports 502-509 are bound to the static connection points declared in the network project. If the project has fewer than eight server connections declared, the unused ports are not bound and return RST (connection refused) to any incoming master.
3. Default gateway and remote port: For the client side (LOGO! as master) the remote (slave) port can be selected freely in the network project; the convention is 502, but the LOGO! firmware does not enforce it.

Refer to the official LOGO! 8 System Manual, edition 06/2021, section "Modbus TCP/IP connection configuration", and the LOGO! 8.FS4 System Manual, section 4.5 "Network project", for the definitive port assignment per connection point.

3. Why the Connection "Works Once" Then Fails

The reported pattern (QModMaster works, then a C# EasyModbus program is run, then QModMaster stops working) is caused by the LOGO! firmware treating Modbus connection bindings as stateful across the master connection lifecycle:

1. Initial state: The network project has zero or one static server connection declared. The firmware binds port 502 to that connection point.
2. First successful session: QModMaster opens a TCP connection to port 502, exchanges several Modbus PDUs, and closes the socket cleanly. The LOGO! releases the binding.
3. C# program with EasyModbus: The EasyModbus library opens a TCP connection and either does not close the socket on exception, or attempts to open multiple concurrent connections. The firmware accepts only one connection per static connection point. The second connection triggers a RST.
4. Subsequent QModMaster attempts: If the network project was changed during the C# session (for example by uploading a new project) or the LOGO! cycled power, the static connection table can shift. Port 502 may no longer be bound, and port 510 (the first unallocated endpoint) becomes the only listening socket.
5. Symptoms return: QModMaster now shows "Port is closed" on port 502 because the firmware binds the next free port (510) for incoming masters when the network project is empty of static server connections.

4. Pre-Diagnostic Checklist

Capture the following before changing any code or project settings:

1. LOGO! base module order number: 6ED1052-1MD08-0BA1 (LOGO! 8.FS4) or 6ED1052-2MD08-0BA1 (LOGO! 8.FS5). The static connection feature requires 6ED1052-1xx08-0BA1 or later.
2. LOGO! firmware version: visible on the LOGO! display under Setup → Card → Firmware or via LOGO! Soft Comfort Tools → Diagnostics → Device Information. Current production firmware is V1.82.x (FS4) and V1.82.x (FS5).
3. LOGO! Soft Comfort version: V8.4 (FS4) or V9.0 (FS5) recommended. Earlier versions do not expose the network project editor for static Modbus connections.
4. Network project: Open the .lsc file used to program the LOGO! and inspect Tools → Ethernet Connections (or the network project tree on the right of the editor).
5. LOGO! IP address and subnet: Note the IP from Setup → Network on the LOGO! display, or from LOGO! → Diagnostics → Ethernet in Soft Comfort.
6. PC IP and subnet mask: Both devices must be on the same subnet (no router between them for a direct cable connection).
7. Existing TCP sessions: From the PC, run netstat -an | findstr :502 and netstat -an | findstr :510 to see which ports are already bound locally by the client.

5. Diagnostic Procedure

5.1 Confirm TCP Reachability

From a Windows PowerShell on the master PC, replace 192.168.0.10 with the actual LOGO! IP:

powershell -NoProfile -Command "Test-NetConnection -ComputerName 192.168.0.10 -Port 502"
powershell -NoProfile -Command "Test-NetConnection -ComputerName 192.168.0.10 -Port 503"
powershell -NoProfile -Command "Test-NetConnection -ComputerName 192.168.0.10 -Port 510"

Each command should report TcpTestSucceeded : True for the port the LOGO! is actually listening on. Ports that are not bound return False with a 10061 (connection refused) error from the LOGO!.

5.2 Scan the Full Static Range

LOGO! 8 supports up to 8 static server connections, so the listening port may be anywhere in 502-510:

for ($p=502; $p -le 510; $p++) {
  $r = Test-NetConnection -ComputerName 192.168.0.10 -Port $p -WarningAction SilentlyContinue
  "{0} : {1}" -f $p, $r.TcpTestSucceeded
}

Output example when the network project has no explicit static server connection:

502 : False
503 : False
504 : False
505 : False
506 : False
507 : False
508 : False
509 : False
510 : True

The single True port is the one your master must use. In most cases the result is 510 when the network project has no explicit static Modbus server connection configured.

5.3 Capture with Wireshark

Run Wireshark on the master PC with filter tcp.port == 502 or tcp.port == 510. Attempt one read on port 502 with QModMaster. The expected traffic when the port is wrong:

192.168.0.20  192.168.0.10  TCP   74   54234 → 502 [SYN]
192.168.0.10  192.168.0.20  TCP   74   502 → 54234 [SYN, ACK]
192.168.0.20  192.168.0.10  TCP   66   54234 → 502 [ACK]
192.168.0.20  192.168.0.10  MODBUS 66   Tx: FC 3, Read Holding Registers, addr 0, qty 10
192.168.0.10  192.168.0.20  TCP   54   502 → 54234 [RST, ACK]

The RST after the Modbus request is the firmware rejecting the frame because the connection point bound to port 502 is not in server mode, or the port is not bound at all. Repeat the test on port 510 and confirm a normal Modbus TCP response (FC 3 reply with register values).

6. Solution A: Use the Correct Port (Fastest Fix)

The fastest path to recovery is to point the master at the port the LOGO! is actually listening on. The change below restores QModMaster connectivity when the LOGO! is bound to 510:

1. Open QModMaster.
2. Click Connection → Connect.
3. Set IP Address to the LOGO! address (e.g. 192.168.0.10).
4. Change Port from 502 to 510.
5. Set Slave ID to 1 (LOGO! Modbus server unit ID).
6. Click OK and run Read Coils at address 8256. The result should be 0/1 values for the LOGO! outputs Q1..Q16 mapped at addresses 8256-8271.

7. Solution B: Make Port 502 the Active Server Port (Permanent Fix)

If your application must use port 502 (e.g. it is hard-coded into a SCADA driver), configure the LOGO! network project so that static connection #1 binds to 502. This is the documented and supported path.

1. Open the LOGO! circuit program in LOGO! Soft Comfort V8.4 or later.
2. Open the Network Project (right pane in the editor, or Tools → Network Project).
3. Right-click the LOGO! device and select Properties.
4. On the Ethernet Connections tab click Add Server Connection.
5. Set Connection Type to S7 + Modbus TCP (or Modbus TCP only if S7 access is not needed).
6. Set Connection Point to 1 (this binds port 502).
7. Enable Active and confirm Port displays 502.
8. Add additional server connections (2 through 8) for ports 503-509 if your application requires multiple masters.
9. Click OK and download the project to the LOGO! via Ethernet or microSD card.
10. Cycle power to the LOGO! to force the firmware to re-bind the new ports.
11. Re-run the diagnostic from Section 5.1. Port 502 should now return True.

8. Solution C: Fix the C# EasyModbus Client

Once the port is correct, harden the C# client so it cannot leave dangling sockets. The original IOException is often the result of a connect attempt that times out, an unhandled exception, or a half-open socket. The template below is a minimal but production-quality Modbus TCP client that works against any LOGO! 8 server connection (502 through 510):

using System;
using System.Net.Sockets;
using System.IO;
using EasyModbus;

class LogoModbusClient
{
    private const string LOGO_IP    = "192.168.0.10";
    private const int    LOGO_PORT  = 510;          // change to 502..509 as required
    private const byte   LOGO_UNIT  = 1;

    static void Main()
    {
        ModbusClient client = null;
        try
        {
            client = new ModbusClient(LOGO_IP, LOGO_PORT)
            {
                ConnectionTimeout   = 2000,           // 2 s connect timeout
                ReceiveTimeout      = 1000,           // 1 s read timeout
                SendTimeout         = 1000,           // 1 s write timeout
                UnitIdentifier      = LOGO_UNIT
            };
            client.Connect();

            // Read 16 discrete outputs Q1..Q16 (addresses 8256..8271)
            bool[] outputs = client.ReadCoils(8256, 16);

            // Read 16 process-image words VW0..VW15 (addresses 0..15)
            int[]  vw      = client.ReadHoldingRegisters(0, 16);

            Console.WriteLine("Q1..Q16 = " + string.Join(",", outputs));
            Console.WriteLine("VW0..VW15 = " + string.Join(",", vw));
        }
        catch (EasyModbus.Exceptions.ModbusException mex)
        {
            Console.Error.WriteLine("Modbus error: " + mex.Message);
        }
        catch (SocketException sex)
        {
            Console.Error.WriteLine("Socket error " + sex.SocketErrorCode + ": " + sex.Message);
        }
        catch (IOException ioex)
        {
            Console.Error.WriteLine("I/O error: " + ioex.Message);
        }
        finally
        {
            if (client != null && client.Connected)
            {
                client.Disconnect();   // releases the LOGO! binding cleanly
            }
        }
    }
}

Three rules to keep the .NET socket state healthy:

1. Always call Disconnect() in a finally block. The LOGO! firmware only releases the port binding when the master closes the socket cleanly (FIN). A half-open socket leaves the binding allocated for up to 60 s.
2. Set the receive timeout to 1000 ms. A request the LOGO! rejects produces no reply, and a missing ReceiveTimeout makes the master block forever.
3. Set the unit identifier to 1. The LOGO! Modbus server discards any request with a unit identifier other than 1 and resets the connection, which is the most common cause of the IOException on a "correct" port.

9. LOGO! 8 Modbus Address Map

Use the address map below to verify reads and writes. The map is taken from the LOGO! 8 system manual and is identical for FS4 and FS5 firmware. Coil and register base addresses are 0-based in the Modbus PDU; some HMI drivers use 1-based addressing (verify your client's offset convention before commissioning).

10. Verification Procedure

After applying Solution A, B, or C, run this checklist to confirm the system is healthy:

1. TCP open: Test-NetConnection -ComputerName <LOGO_IP> -Port 510 returns True.
2. Read test (coils): QModMaster Read Coils at address 8256, quantity 16, returns the current Q1..Q16 state.
3. Read test (registers): QModMaster Read Holding Registers at address 0, quantity 4, returns VW0..VW3 as 16-bit signed integers.
4. Write test: QModMaster Write Single Register at address 100, value 12345. The LOGO! program should observe VW100 = 12345 on the next scan. If the program does not show the change, verify that the project uses a network input/output (NI/NQ) for the value (a plain VW tag is read-only from Modbus; use NI for inbound values).
5. Disconnect test: Close QModMaster. From PowerShell, run netstat -an | findstr :510. After 30 s there should be no ESTABLISHED entries.
6. Concurrent test: Open two instances of QModMaster against port 510. Both should connect. The LOGO! supports one master per static connection point. For a second master, declare a second static server connection (port 503) in the network project.
7. Cycle power: Power-cycle the LOGO! and confirm the binding survives. If the binding reverts to a different port, the network project was not downloaded; re-flash via microSD or Ethernet.

11. Troubleshooting Matrix

12. Master / Slave Mode and Performance Considerations

The port table in Section 2 only applies when the LOGO! is the Modbus server (slave). If the LOGO! is configured as a Modbus master (client) the firmware consumes outbound ports 502+ in the same numeric range for its own connections, and the listening ports shift accordingly. The two roles are mutually exclusive per connection point: a static connection point is either server (incoming) or client (outgoing), not both. To confirm the role of a connection point, open the LOGO! display on Setup → Network → Connections: a connection in client mode lists a remote IP and port, a server connection lists a local port.

When the LOGO! is the master and your C# application is the slave, bind the C# application to port 502 (or any port you have configured the LOGO! to connect to) and listen for incoming connections. The EasyModbus library provides a ModbusServer class for this purpose:

ModbusServer server = new ModbusServer(502);
server.Listen();
while (true)
{
    int[] regs = server.Storage.HoldingRegisters;
    regs[0] = 1234;
    Thread.Sleep(100);
}

Measured on a LOGO! 8.FS4 (6ED1052-1MD08-0BA1) at firmware V1.82.01 with a single static server connection:

For deterministic polling, set the master cycle time to at least 50 ms. Faster cycles queue up in the LOGO! TCP stack and can trigger the IOException on the next request.

13. Security, Hardening, and Edge Cases

LOGO! 8 Modbus TCP has no authentication. Any host on the network can read or write process data. Three mitigations are recommended for production deployments:

1. Network segmentation: Place the LOGO! on a dedicated VLAN or a private Ethernet segment shared only with authorized HMI/SCADA masters. Use a managed switch with port-based ACLs to block 502-510 from unauthorized hosts.
2. Firewall on the master PC: Restrict outbound Modbus TCP to the LOGO! IP only with New-NetFirewallRule -DisplayName "Modbus TCP LOGO" -Direction Outbound -RemoteAddress 192.168.0.10 -RemotePort 502-510 -Protocol TCP -Action Allow. Block all other outbound Modbus traffic.
3. Disable unused connection points: The network project can declare up to 8 static server connections. Declare only the number you need and leave the rest unconfigured. This frees ports 503-509 (or higher) from binding and reduces the attack surface.

The Modbus TCP protocol on the LOGO! does not support TLS or IPsec. If a higher level of security is required, place a Modbus security gateway between the master and the LOGO!.

If the diagnostic in Section 5.2 returns False for all of 502-510, the LOGO! is not in Modbus server mode at all. Verify the following:

1. Modbus enable flag: In LOGO! Soft Comfort, open LOGO! → Properties → Communication and confirm Modbus TCP is checked. The default for new projects is unchecked on firmware V1.82.x.
2. Project download: The network project must be downloaded to the LOGO! after any change. Use Tools → Transfer → PC → LOGO! or copy the .lsc file to the microSD card and power-cycle.
3. LOGO! operating mode: The LOGO! must be in RUN, not STOP. In STOP, the firmware does not bind the Modbus ports. Check the LOGO! display: a red "STOP" indicator means the program is halted.
4. IP address and subnet: The PC must be able to ARP the LOGO!. ping 192.168.0.10 must succeed before any Modbus attempt.
5. Firmware mismatch: A network project created in LOGO! Soft Comfort V9.0 (FS5) cannot be downloaded to a LOGO! 8.FS4. Use the matching Soft Comfort version.

If all of the above are correct and the listener scan still returns nothing, contact Siemens Industrial Online Support and provide the project file (.lsc) and the LOGO! firmware version. Include the diagnostic output of Section 5.1 to speed triage.

FAQ