Siemens LOGO! HMI Analog Value Drops to Zero: VM Mapping Fix

1. Problem Overview

A KINCO HMI scrollbar writes an analog value over Ethernet to a Siemens LOGO! 8 controller. The target is a Network Analog Input (NAI) block intended to feed a 0–10 V Analog Output (AQ) for dimming a light or driving a pump. The expected behavior is that the HMI value holds on the LOGO!, the AQ tracks it, and the 0–10 V output is stable. The observed behavior is that the value appears on the TDE for roughly one second and then drops back to zero, with the HMI slider returning to the zero position at the same time.

The symptom is symmetrical on both ends: the LOGO! never retains the value, and the HMI register also reads zero. This rules out a one-sided display problem and points to a register-type / write-authority mismatch in the data path between the HMI and the LOGO!.

2. Affected Hardware and Firmware

LOGO! 8 firmware 8.x (current 8.3) provides the VM (Variable Memory) area used for cross-tag and Modbus mapping. The same VM area is exposed to the TDE, to LOGO! Soft Comfort, and to the S7/Modbus Ethernet interface.

3. Root Cause: NAI Is Read-Only

The Network Analog Input (NAI) and Network Digital Input (NI) blocks in LOGO! are read-only inputs. They are populated by the LOGO! communication layer from inbound telegrams and are not writable user memory. The TDE and Soft Comfort can show the value because they observe the same incoming frame, but the LOGO! program itself cannot latch a value through NAI; once the master stops writing, the value falls back to its power-on default (0).

The reason the value seems to "hold for a second" is that the HMI master typically issues a periodic write (poll / heartbeat). The instant the write window closes, the NAI reverts. If the HMI is configured as a read-only client or is writing to an Input Register (function code 0x04) instead of a Holding Register (function code 0x06 / 0x10), the LOGO! may echo the value briefly in its local status but never commit it to persistent memory.

4. Why the Original Communication Setup Fails

Three configuration issues typically combine to produce the symptom in this scenario:

1. Port assignment: the LOGO! Modbus TCP server listens on TCP/502 by default. The KINCO project in the source case used a non-standard port; the master therefore never reached the LOGO! server, or the LOGO! never received the write.
2. Register class: KINCO was writing to a LOGO! Input Register (IR) range. Input registers are read-only by Modbus definition; the LOGO! discards the write and reports no error back to the HMI, which then displays the most recent acknowledged value before falling back to 0.
3. Memory target: instead of pointing at a VW/VM address, the HMI widget was bound to the NAI block address. Because NAI is a network mirror, not a latch, the value never persists in the LOGO! program.

Switching to Holding Registers (HR) on TCP/502, and pointing the HMI at the VM area starting at VW700 / VW800, resolves all three at once.

5. The Fix: VM Mapping with Holding Registers

LOGO! 8 exposes the Variable Memory area to the Ethernet interface in three ways:

The VW700 / VW800 addresses mentioned in the source resolution are simply the upper portion of the VM word space, well above any address the LOGO! firmware itself uses for system data, which is why they are safe user targets.

6. Prerequisites

• LOGO! 8 with firmware ≥ 8.0 (1.80.01), recommend 8.3 for cleanest VM mapping
• LOGO! Soft Comfort ≥ 8.3 with the project file (.lsc) available
• KINCO HMI programming software (KincoBuilder / DTools) with the project file (.hmi or .kfp) available
• PC with Ethernet access to the LOGO! (default IP 192.168.0.222, port 502 TCP)
• Static IP on the HMI in the same subnet as the LOGO!

7. Step-by-Step Procedure

7.1 Configure the LOGO! side

1. Open the project in LOGO! Soft Comfort.
2. Insert an Analog Flag (A-Flag) or use an Analog Amplifier with its source bound to VM 700 (display: VW700 in the tag view). This is the user-space analog word the HMI will write to.
3. Wire the flag / amplifier output to the AQ block. Select the desired range (0–10 V). The amplifier performs the scaling from 0–1000 internal units to 0–10 V; if you need a different curve, add a second amplifier or an arithmetic block.
4. Open Extras → Ethernet Connections and add a S7 / Modbus Server connection on port 502 (default). Enable Allow access via VM mapping and declare the VM range 700–702 as accessible to the server.
5. Save and download the program to the LOGO! over Ethernet.

7.2 Configure the HMI side

1. In the KINCO editor, open the project and add the LOGO! as a Modbus TCP master device: IP 192.168.0.222, port 502, slave/unit ID 1, register type Holding Register, function code 0x06 (write single) or 0x10 (write multiple).
2. Bind the scrollbar / numeric input widget's write address to the LOGO! VM target (e.g., 4x00701 in Modbus 1-based notation, which corresponds to VM word 700 in Soft Comfort).
3. Bind a read-only numeric display widget to the same address to confirm the LOGO! is echoing the value.
4. Set the widget's data type to 16-bit signed (INT) and the engineering range to 0–1000 (which the LOGO! maps to 0–10 V through the amplifier).
5. Compile and download the HMI project to the panel.

7.3 Wire the analog output

1. Connect the LOGO! AQ terminal (e.g., AQ1: pin 1 = signal, pin 2 = ground) to the receiving device. Respect the AQ load limits of the LOGO! (max 10 mA on the onboard AQ; use an AM2 AQ module for higher loads).
2. For a 0–10 V dimmer or pump input, share the same 24 V reference and ground.
3. Power-cycle the LOGO! and the HMI so the new connection tables take effect.

8. Verification

1. On the HMI, drag the scrollbar from 0 to 1000. The numeric display should follow in real time and stay at the value when released.
2. On the TDE, navigate to the AQ status page. The displayed analog value should match the HMI and remain stable.
3. Measure the AQ terminal with a multimeter: 0.000 V at slider 0, ~10.00 V at slider 1000, linear in between.
4. Disconnect the HMI Ethernet cable. The LOGO! should retain the last-written VM value indefinitely (VM is non-volatile in the LOGO! 8; analog flag / amplifier will continue to drive the AQ).
5. Reconnect the HMI; the value should resume tracking from the HMI widget without any 1-second drop.

9. Alternative Path: Control Loop via TDE Only

If the HMI cannot be reconfigured (firmware locked, vendor-locked project), the same dimming behavior can be implemented with the LOGO! TDE alone. The TDE supports arrow-key value entry, which the program can route to a VM word through the Cursor and Display configuration tools. Functionally identical to the HMI scrollbar, but with a 6-character text interface. The KINCO panel is unnecessary in that case, and the entire 0–10 V path becomes a pure LOGO!-internal mapping.

10. The Corrected Data Path

After the fix, the data flow is:

KINCO HMI scrollbar
   │  Modbus TCP write (FC 0x06 / 0x10)
   ▼
LOGO! Modbus TCP server (port 502)
   │  decode into VM area
   ▼
VM 700 (Analog Flag, retentive)
   │  used as amplifier input
   ▼
Analog Amplifier (scaling 0–1000 → 0–10 V)
   │
   ▼
AQ1 (0–10 V output to dimmer / pump)

The NAI / NAQ blocks are no longer in the path. The HMI talks directly to user memory; the LOGO! program reads user memory and drives the hardware. This is the standard pattern for any PLC where a panel writes setpoints.

11. Common Pitfalls and Field-Engineering Notes

12. Reference: LOGO! 8 Analog Output Scaling

The onboard AQ of a LOGO! 8 BM is a 0–10 V output with 10-bit resolution. Internally the LOGO! uses the value range 0–1000 to represent 0–10 V. The scaling is therefore:

V_out (V) = (AQ_internal / 1000) × 10

For a 4–20 mA output on an AM2 AQ module, the LOGO! internally uses 0–1000 to represent 4–20 mA:

I_out (mA) = 4 + (AQ_internal / 1000) × 16

Because the HMI is writing a 16-bit INT (0–65535), the HMI engineer must scale the widget range to 0–1000 in the KINCO project. Attempting to write the raw 0–10 V as 0–10, or as 0–4095, results in the AQ pegging at 0 or at full scale.

13. Diagnostics: A 30-Second Field Test

If a similar issue is reported in the future, the following minimal check sequence localizes the fault in under a minute:

1. Bind a KINCO numeric display to the same address being written. If the display shows the value, the HMI is sending; if it shows 0, the HMI is not sending (port, FC, or wiring).
2. In Soft Comfort, place a watch on the VM target word. If the VM word never changes while the HMI writes, the LOGO! is not accepting the write (port, server enable, or register class).
3. If the VM word updates but the AQ does not, the amplifier / scaling path in the LOGO! program is wrong.
4. If the VM word updates and the AQ updates but the receiving device does not, the analog wiring (signal, ground, range) is wrong.

Each layer is independently observable. Pin down the failing layer first; do not reconfigure all four.

14. Standards and Background

The Modbus TCP portion of this integration is governed by the Modbus Organization's Modbus Application Protocol Specification, currently at v1.1b3, with Modbus TCP per the Modbus Messaging on TCP/IP Implementation Guide v1.0b. The 0–10 V analog signaling is a de-facto industrial standard; refer to the Siemens TIA Portal documentation for general principles on processing of analog values. For the LOGO! 8 specifically, the LOGO! 8 system manual defines the VM area, the Modbus TCP server behavior, and the AQ block scaling. The LOGO! 8 application examples collection includes a "LOGO! as Modbus server" sample that demonstrates the exact VM-to-Holding-Register mapping used in this article.

15. FAQ