Siemens LOGO! 8: Reading Counter and Block Values via VM Mapping

David Krause17 min read
Data AcquisitionSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Siemens LOGO! 8: Reading Counter and Block Values via VM Mapping, Web Server, and CSV Logging

Engineers deploying Siemens LOGO! 8 basic modules (BM) such as the 6ED1052-1MD08-0BA2 (LOGO! 8.3) or 6ED1052-1CC08-0BA2 need to expose runtime values of function blocks—counter, up/down counter, hour counter, timer, weekly timer, yearly timer, analog threshold trigger, PI controller, and arithmetic blocks—to a supervisory layer. The default Transfer > I/O Status dialog in LOGO! Soft Comfort (V8.x) only mirrors digital inputs (I1–I24), digital markers (M1–M27), shift register bits (S1–S8), analog inputs (AI1–AI8), analog markers (AM1–AM24), and a subset of network I/O. It does not display the live numeric value of a counter or timer block.

This reference documents four field-proven paths for retrieving block values: (1) VM mapping into analog network inputs, (2) the internal web server of LOGO! 8, (3) the on-board Data Log block writing CSV to a micro SD card, and (4) a third-party HTTP/JSON middleware for remote polling. Each method carries constraints on value width, polling rate, and hardware generation. Where counter values are 32-bit but analog markers are only 16-bit (signed), the workarounds are preserved with concrete implementations.

Audience: commissioning engineers, system integrators, and plant electricians running LOGO!Soft Comfort V8.0 or newer against LOGO! 8 (6ED1052 series) basic modules with Ethernet (FS04 and later). LOGO! 7 and earlier hardware does not support the web server method described in §5.

1. Why I/O Status Cannot Show Counter Values

The I/O Status screen in LOGO!Soft Comfort is a snapshot of the process image. Its symbol set is fixed and limited to:

Symbol Range Width Writable from HMI?
Digital input I I1–I24 1 bit No
Digital output Q Q1–Q20 1 bit Yes (force)
Digital marker M M1–M27 1 bit Yes (force)
Shift register S S1–S8 (chained) 1 bit No
Analog input AI AI1–AI8 16-bit signed No
Analog marker AM AM1–AM24 16-bit signed Yes (force)
Network input NI NI1–NI64 configurable From peer
Network output NQ NQ1–NQ64 configurable To peer

Counter (CNT), Up/Down Counter, Hour Counter, On/Off Delay timers, and PI Controller blocks expose their current value only through the Variable Memory (VM) area, which is a separate address space starting at byte offset 0 in the LOGO! internal memory map. The I/O Status dialog does not decode VM addresses, hence the apparent invisibility. The same restriction applies to LOGO! TD (text display) function block (FB) parameters unless they are explicitly mapped.

2. Prerequisites

  • LOGO!Soft Comfort V8.0 or later installed on a Windows PC. Download via the Siemens LOGO!Soft Comfort V8.x support entry.
  • LOGO! 8 BM (6ED1052-1…08-0BA2 or newer) with Ethernet port. Earlier LOGO! 0BA6 (6ED1052-1MD00-0BA6) units have no TCP/IP stack.
  • Ethernet crossover or switch cable, IP address assigned (default 192.168.0.1, mask 255.255.255.0).
  • Optional: micro SD card (max 32 GB, FAT32) for Data Log CSV output.
  • Optional: a remote HMI/SCADA or PC running Python, Node-RED, or any HTTP client for the middleware approach (§7).
  • Firmware of the LOGO! BM at FS04 or higher for full web server variable support; the DWORD VM display was introduced in FS04 firmware (released 2015).
LOGO!Soft Comfort V8.3 and later supports the LOGO! Web Editor (LWE) for designing custom dashboards served from the BM. Earlier 8.x versions ship a fixed web UI that exposes only the eight pre-defined variable slots described in §5.

3. Method 1 — VM Parameter Mapping (Offline + Online Read)

The Parameter VM Mapping is the canonical engineering tool inside LOGO!Soft Comfort for reading non-I/O block values. It works by binding a block's parameter or actual value register into the VM byte stream, which can then be picked up by an analog network input and finally surface in I/O Status.

3.1 Workflow

  1. Open the project in LOGO!Soft Comfort.
  2. Select Tools > Parameter VM Mapping (or Extras > Parameter VM Mapping in older localization).
  3. The dialog lists every block in the program with its computed VM offset. A typical counter block displays its current value at an offset such as VW x, where x depends on block order.
  4. Assign an analog network input (NI) to that VM offset. Drag the NI symbol onto the schematic and configure its address to point at the counter's VM word.
  5. Wire the NI to an analog marker (AM).
  6. Open Transfer > I/O Status. The AM now displays the live counter value, refreshed once per cycle.

3.2 The 32-bit / 16-bit Width Mismatch

A counter that has counted above 32 767 cannot fit into an AM, because AMs are 16-bit signed integers in the range -32 768 … +32 767. A counter value of, say, 50 000 would wrap to a negative number on the AM. Hour counters and up/down counters face the same issue once their value exceeds the 16-bit signed range.

Workarounds, in order of preference:

Approach Effect Cost
Use two AMs (low word / high word) bound to adjacent VM words Reconstruct 32-bit value in the host Two VM slots, two AMs, manual concatenation
Use the LOGO! internal web server (§5) which natively supports DWORD VM display Native 32-bit unsigned value, no manual reconstruction Web server must be enabled
Reset the counter at a threshold below 32 767 with a divide-by-N pre-scaler Stays inside 16-bit signed range Loses absolute count; rebuild externally
Use a custom LWE dashboard (§5.1) reading the DWORD directly Native 32-bit display Requires LWE license/key

3.3 Verification

In I/O Status, the AM cell should update within one LOGO! scan cycle (~10 ms typical, configurable down to 0.5 ms with Cycle Time parameter in the BM properties). Set a known pulse source into the counter and confirm the AM increments by exactly the pulse count. If the value jumps backward after passing 32 767, you have a width overflow and need to apply one of the workarounds above.

4. Method 2 — Mapping Counter Values to a Text Display (LOGO! TD)

The LOGO! TD (Text Display, e.g., 6ED1055-4MH00-0BA2) and the integrated LOGO! TDE on the BM itself can render any value through the Message Text function block. The Message Text block accepts up to four variables which can be wired from AMs that have been populated via VM mapping. This is the field-proven way to display a running counter without a PC.

  1. Add a Message Text block to the schematic.
  2. Wire the counter's VM-bound AM (or the manually mapped 32-bit reconstruction) into the message's value parameter.
  3. Build the project and download to the BM.
  4. On the TDE, navigate to the message; the counter value appears as part of the message string.
Message Text blocks also support direct reference to block parameters in LOGO!Soft Comfort V8.2+. Check the block's Value dropdown; if the parameter list shows Counter value, no AM staging is required.

5. Method 3 — Internal Web Server (LOGO! 8 FS04 and later)

From firmware FS04 onward, every LOGO! 8 BM ships a built-in web server. Activating it removes the 16-bit limitation entirely because the server can expose up to eight variables selected from a list that explicitly includes VM with type DWORD—the 32-bit unsigned container used internally by counter blocks.

5.1 Enable the Web Server

  1. Connect LOGO!Soft Comfort online to the BM via Ethernet.
  2. Open Tools > Transfer > Options > Ethernet and tick Access Web Server.
  3. Assign a username and password. LOGO!Soft Comfort writes the credentials into the BM; without them the web UI is read-only.
  4. Restart the BM (power cycle) to commit the change.
  5. From any browser, navigate to http://<logo-ip>. The default page shows BM identity and the eight variable slots.

5.2 Configuring the Eight Variable Slots

The web UI lists all available LOGO! variables, grouped by type. The relevant types for counter readout are:

Type Width Use case
AI (analog input) 16-bit signed Live process signal, -32768..32767
AM (analog marker) 16-bit signed Internal staging of values
NI (network input, analog) 16-bit signed Peer values over S7-style connection
VM with type WORD 16-bit unsigned Block parameters of integer FB
VM with type DWORD 32-bit unsigned Counter, hour counter, up/down counter actual value
VM with type INT 16-bit signed Signed block parameters
VM with type DINT 32-bit signed PI controller output, arithmetic block

Map the counter's DWORD VM offset to slot 1, the up/down counter to slot 2, and so on. Each slot has a configurable update interval between 1 s and 60 s.

5.3 Message Configuration Without VM Mapping

LOGO!Soft Comfort V8.2 introduced the ability to embed a counter's value directly into a web-served Message Text—without first mapping it to an AM. The procedure:

  1. Edit the Message Text block.
  2. In the message body, insert a placeholder by pressing the value-insertion key.
  3. From the dropdown, select the counter block whose value you want to display.
  4. Download. The variable appears in the message on the BM/TDE and on the web UI automatically.

This bypasses the entire 16-bit AM staging chain and is the recommended approach for new deployments where the engineer controls the program from scratch.

5.4 Pulling Variables Programmatically

The web server does not expose a documented REST or JSON API. The only public read path is the HTML UI. For machine-to-machine access, the engineering community commonly reverse-engineers the page's hidden AJAX refresh and parses the rendered table. The official Siemens approach for SCADA integration is to use S7 communication instead (LOGO! 8 supports the S7 protocol with up to 64 bytes of process data), which is documented in the LOGO! 8 system manual.

6. Method 4 — Data Log Block to micro SD Card (CSV)

The Data Log function block, introduced in LOGO!Soft Comfort V8.0, writes a configurable CSV record to a micro SD card inserted in the BM. The card is formatted FAT32 and the file lives in /logo/ with names like DAT00001.csv. Each line is timestamped by the BM's RTC and contains up to eight process values, including counter values.

6.1 Procedure

  1. Place a Data Log block on the schematic.
  2. Configure the Sampling Interval parameter (10 ms minimum, but for counter logging 1 s is typical).
  3. In the value list, choose Counter value as the source for any column. Other columns may hold AI, AM, NI, or block parameters.
  4. Set the Stop when SD full behavior; LOGO! overwrites the oldest file by default if Stop when SD full is unchecked.
  5. Download the program and insert a micro SD card (max 32 GB) into the BM slot.
  6. The BM writes a new CSV file whenever the existing one crosses a size threshold (~512 KB). Files can be retrieved by removing the SD card and reading on a PC, or by accessing the SD card remotely via FTP if Access via FTP is enabled.

6.2 CSV Format

Timestamp;Counter1;AI1;AM1
2024-05-12 08:15:02;0000004352;00537;+00018
2024-05-12 08:15:03;0000004352;00538;+00019
2024-05-12 08:15:04;0000004352;00538;+00019

The counter column is rendered as a zero-padded decimal integer; no overflow is applied because the BM writes the raw DWORD value. A 32-bit counter therefore correctly logs up to 4 294 967 295.

6.3 Verification

After a few cycles, remove the SD card and confirm the CSV opens cleanly in Excel or Notepad++. Confirm the timestamp column advances at the configured interval and the counter column changes by exactly the pulse count fed in.

7. Method 5 — Third-Party HTTP/JSON Middleware

Where the LOGO! is reachable over an intranet or VPN, an HTTP/JSON middleware can act as a polling aggregator, allowing a remote SCADA, Python script, or web dashboard to read variables by simple GET requests. The middleware typically sits between the LOGO! (S7-200-compatible peer protocol on TCP port 102) and an HTTP client.

One commercial middleware in this space is offered by AmberSys. It exposes:

  • Read of I1–I4, M1–M4, AI1–AI4, AM1–AM4 over the public internet using a static IP on the LOGO! side.
  • Trigger of function keys F1–F4 by HTTP call, enabling remote start/stop of program sequences.
  • Authentication via a project-unique logokey passed as a URL parameter, e.g., https://www.ambersys.net/api?logokey=<your-key>.
Security: exposing a LOGO! directly to the public internet carries industrial control risk. Place the BM behind a VPN concentrator or at minimum a stateful firewall that whitelists only the middleware source IP. The legacy web server of LOGO! 8 transmits credentials and data in plain HTTP; for any production deployment, terminate it at an HTTPS reverse proxy.

Open-source alternatives include node-red-contrib-s7 for Node-RED, python-snap7 for Python, and the libnodave library for C. Each speaks the S7 ISO-on-TCP protocol that LOGO! 8 implements, allowing direct read of VM area by absolute address.

8. Multi-LOGO! Polling Architecture Over VPN

When several LOGO! 8 controllers are deployed at remote sites and connected back to a central engineering workstation via site-to-site VPN with static IP addressing, three practical architectures emerge.

Architecture Central PC software Polling pattern CSV export
Multiple LOGO!Soft Comfort instances One instance per remote BM, each online to its own IP Sequential, manual Go Online per controller Manual copy of I/O Status screen or per-instance export
Master LOGO! aggregating peer BMs via Ethernet LOGO!Soft Comfort online to master only; master reads 64-byte peer data via S7 connection Native LOGO!-to-LOGO! at 100 ms cycle Data Log on master writes consolidated CSV
Central SCADA using S7 driver WinCC, Ignition, or Node-RED with snap7 Cyclic polling every 250–1000 ms per BM Database historian + report generator

8.1 Multiple LOGO!Soft Comfort Instances

LOGO!Soft Comfort allows several instances to run concurrently on the same Windows host, each maintaining its own online session. This is the simplest pattern when the engineer only needs occasional visibility per site.

  1. Configure the VPN tunnel to the remote site.
  2. Ping the remote LOGO! IP to confirm reachability.
  3. Launch one LOGO!Soft Comfort instance per site; in Tools > Options > Ethernet, set the target IP.
  4. Open Transfer > I/O Status on each instance. The values shown reflect the current process image of that remote BM.

8.2 Master LOGO! Aggregator

A LOGO! 8 BM can act as an S7 client to up to eight peer LOGO! devices, using the Network Input (Analog) and Network Output blocks. Counter values exposed by peers can be mapped into the master's VM area via VM mapping (per §3) and then written to a single consolidated Data Log CSV. The master effectively becomes a low-cost gateway.

8.3 Central SCADA

For higher polling rates and historical archiving, deploy a SCADA or historian at the central site. Configure the S7 driver with one connection per remote BM, set the read area to VM starting at offset 0, and define eight DWORD tags per BM covering the counters and hour counters of interest. Polling at 1 s is comfortable for any LOGO! 8 generation.

9. Sample Python Poller Using snap7

The following Python snippet reads the first 32 bytes of VM from a LOGO! 8 reachable at 192.168.0.1, then prints the counter at VM offset 0 as a 32-bit unsigned integer. Requires python-snap7.

import snap7
from snap7.util import get_dword

client = snap7.client.Client()
client.connect('192.168.0.1', 0, 1, 102)  # rack=0, slot=1, tcp=102

# LOGO! exposes VM as DB 1 in the S7 address space.
# Adjust DB number per your LOGO! project configuration.
vm_raw = client.db_read(1, 0, 32)
counter = get_dword(vm_raw, 0)  # first 4 bytes
print(f'Counter actual value: {counter}')

client.disconnect()
The S7 DB number for the VM area is project-dependent. In LOGO!Soft Comfort, open Tools > Parameter VM Mapping; the DB and offset shown there are the authoritative values. Do not assume DB 1.

10. Troubleshooting Matrix

Symptom Likely cause Diagnostic step Fix
Counter value does not appear in I/O Status No AM staging; block value lives in VM only Open Tools > Parameter VM Mapping and confirm an NI is bound to the counter's offset Add NI → AM staging (§3)
Counter wraps to negative after 32 767 AM is 16-bit signed Verify counter value against AM reading Use web server DWORD or two-AM reconstruction (§3.2)
Web server variable slot shows --- Slot bound to a non-existent VM offset Re-check VM offset against the Parameter VM Mapping table Rebind to correct offset
Web server prompts for credentials repeatedly Browser cache or cookie disabled Enable cookies for the LOGO! IP Allow site cookies or use a private window
Data Log CSV has stale timestamps BM RTC battery discharged or not set Open BM menu and check date/time Replace CR2032 cell and resync via LOGO!Soft Comfort
Middleware returns 401 unauthorized Wrong or missing logokey query parameter Inspect HTTP request with browser dev tools Regenerate the key in the middleware console
Python snap7 raises ISO: Invalid PDU Wrong rack/slot combination for LOGO! Confirm LOGO! S7 rack/slot in project properties Use rack=0, slot=1 (default) or project-specified values
Multiple LOGO!Soft Comfort instances conflict Same project file opened twice Open separate project files, one per BM Each instance points to its own .lsc
Counter reading jumps by 1 each polling cycle regardless of input Polling faster than LOGO! scan cycle Lower poll rate to ≥ scan time + 50 ms Cap poller at 100 ms or slower
CSV file not visible on SD card SD card not formatted FAT32 or too large Re-format as FAT32, max 32 GB Replace card

11. Commissioning Checklist

  1. Confirm BM firmware version supports the chosen method (FS04+ for web server DWORD).
  2. Validate that every counter to be exposed has its VM offset noted in the Parameter VM Mapping table.
  3. For 32-bit counters, decide between (a) web server with DWORD slot or (b) two-AM reconstruction. Document the choice in the project functional specification.
  4. If the BM is exposed remotely, place it behind a VPN or firewall; disable plaintext HTTP if compliance requires.
  5. Establish polling cadence: not faster than 100 ms for S7, not faster than 1 s for the web UI.
  6. Generate at least 1 hour of CSV via Data Log; open in Excel and verify column ordering matches the schematic.
  7. Document the SD card swap procedure (rotation, archival, replacement) in the maintenance plan.
  8. For multi-site deployments, label each remote BM with its static IP and store the .lsc project under version control keyed to that IP.

12. References Within the Siemens Documentation Set

The following official Siemens documents cover the topics in this reference and should be kept on hand during commissioning:

Why does my counter show as 0 or a negative number in the I/O Status window?

The counter's actual value lives in the VM (Variable Memory) area, not in the AM space that I/O Status decodes. Map an analog network input (NI) to the counter's VM offset, wire the NI to an analog marker (AM), and the AM will display the counter value. Negative readings above 32 767 indicate the AM is wrapping its 16-bit signed range; use the LOGO! 8 web server with a DWORD VM slot, or reconstruct the value from two AMs, to recover the full 32-bit unsigned count.

What is the difference between the LOGO! I/O Status and the Parameter VM Mapping?

I/O Status shows the live process image of digital I/O, digital markers, and 16-bit analog values. Parameter VM Mapping exposes the VM byte stream that holds block parameters and actual values for counters, timers, hour counters, PI controllers, and arithmetic blocks. Use Parameter VM Mapping to assign an analog network input to a block's VM offset, then read the staging AM in I/O Status.

How do I read a counter value over the network without writing CSV files?

Three options on LOGO! 8 with FS04 firmware: (1) enable the internal web server and bind the counter's DWORD VM offset to one of the eight variable slots, then poll the page; (2) connect via S7 on TCP port 102 using snap7, libnodave, or a SCADA driver and read the VM DB area; (3) deploy a third-party HTTP middleware (e.g., the AmberSys LOGO! API) that exposes a GET endpoint returning JSON with I, M, AI, AM values and supports F1–F4 triggers.

How many LOGO! controllers can I monitor simultaneously from one PC?

With multiple LOGO!Soft Comfort instances on the same Windows host, you can have one online session per instance—practically 4–6 before the operator workflow becomes cumbersome. For larger fleets, deploy a SCADA or historian with one S7 connection per remote BM (each BM is a separate IP), or appoint one BM as a master aggregator that pulls up to eight peers and writes a consolidated Data Log CSV.

Can I trigger a function key remotely on the LOGO!?

Yes. The LOGO! 8 BM exposes four function keys (F1–F4) on its front panel. To trigger them remotely, the program must include Message Text blocks configured to react to F-key input. With the LOGO! API middleware, an HTTP GET call containing the project logokey and an fkey parameter will simulate the corresponding key press over S7, allowing remote start/stop of program branches.

Back to blog