Siemens LOGO! Modbus TCP Resolving MBE Powertool iFIX

1. Problem Overview

Engineers integrating a Siemens LOGO! 8 logic module as a Modbus TCP server into a Proficy iFIX SCADA node frequently encounter a connection failure that does not appear with conventional GE/Emerson PLCs. The typical symptom set is reproducible:

• The MBE Powertool I/O driver in iFIX reports OFFLINE or No Response on the channel, even though modscan or any third-party Modbus master can read holding/input registers from the LOGO! successfully.
• The MBE Powertool transmit/receive counters remain at zero while the LOGO! is plainly reachable on TCP port 502.
• Once the channel is brought up after enabling the missing Allow S7 Access checkbox, the link will run for several minutes and then stall; transmit/receive counters freeze even though the data-quality flag in iFIX continues to read GOOD.
• Cycling (disable → enable) the device on the iFIX side resumes communication for another short window before the stall recurs.

This behavior is not a defect of the MBE Powertool driver itself: it is the result of two overlapping issues specific to LOGO! 8 firmware (≥ V8.3) that must be configured in concert, plus a session-idle behavior on LOGO! that does not exist on RX3i / VersaMax / PACSystems controllers. The remainder of this article documents the root cause, the corrective procedure, and the workarounds for the transmit/receive stall.

2. Affected Hardware and Firmware

The fix documented here applies to the LOGO! 8 family that ships with the on-board Ethernet (the "LOGO! 8.4" generation). Verify the exact order number before applying any change:

The latest firmware package and release notes for LOGO! 8.4 are published in the Siemens Industry Online Support portal:

• LOGO! 8.4 firmware update entry (109975995)
• Application example: LOGO! Modbus/TCP with SENTRON PAC (109779762)

Update the base module to the latest firmware prior to commissioning; the S7/Modbus access flag was made more permissive in firmware V8.3.62 and is fully functional from V8.4.0 onward.

3. Root Cause Analysis

3.1 Why MBE Powertool Cannot Reach the LOGO! Initially

The MBE Powertool driver uses the GE/Emerson SRTP and Modbus TCP transport layer that, on LOGO! 8 hardware, is gated behind the same Ethernet access control list that governs S7 PUT/GET. When the LOGO! is configured as a Modbus server only (Modbus access enabled, S7 access disabled), the controller accepts arbitrary Modbus/TCP clients, but it terminates the TCP session after a single transaction if the requesting client does not present a session handshake compatible with the S7 framing layer that the MBE driver expects.

The MBE Powertool driver opens the TCP socket, issues a Modbus Read Holding Registers (function code 0x03) request, then keeps the socket open and polls. LOGO! 8 with only Allow Modbus Access = ON closes the keep-alive socket after the configured idle timer (default 60 s), causing the MBE driver to log the channel as OFFLINE on its next poll cycle. Enabling Allow S7 Access in addition to Allow Modbus Access opens the same S7 framing pathway that iFIX uses for SRTP, and the MBE driver no longer drops the channel.

3.2 Why the Connection Stalls After Several Minutes

Once both flags are set, the MBE driver establishes a healthy session. However, the LOGO! 8.4 firmware reuses the same internal TCP listener for Modbus server and S7 server. The listener holds a maximum of 8 concurrent connections per Siemens application note 109779762, with a per-connection idle timeout of 120 s. When the MBE Powertool driver does not issue a poll inside that window (typical iFIX poll interval for a slow block is 1000 ms; for the MBE_PWR device the default is 5000 ms), the LOGO! closes the socket silently. The MBE driver does not detect this FIN as a fault because the next poll request happens to fall inside a sequence where iFIX is still handing it cached GOOD data quality.

Disabling and re-enabling the device in the iFIX Power Tool works around the symptom because it forces the driver to re-establish the TCP socket, but it does not fix the underlying idle-timeout mismatch.

4. Configuration Procedure

The corrective configuration has two distinct stages: (a) on the LOGO! device, and (b) in LOGO! Soft Comfort project properties. Both must be performed; the runtime flag alone is not sufficient.

4.1 Prerequisites

• LOGO! Soft Comfort V8.4 or later (project editor).
• LOGO! base module with Ethernet (order number ending in -0BA2) at firmware V8.4.x.
• Ethernet connectivity between the iFIX node and the LOGO! on the same subnet; verify with ping <logo_ip> from the iFIX server.
• Proficy iFIX V6.5 or later with the MBE Powertool I/O driver licensed and visible under SCADA → Drivers.
• A valid static IP address for the LOGO! (DHCP is not recommended for SCADA polling).

4.2 Enable S7 and Modbus Access on the LOGO!

1. Connect to the LOGO! with LOGO! Soft Comfort V8.4 over Ethernet (Tools → Transfer → Ethernet).
2. Open File → Properties → Ethernet on the project.
3. In the Access Control area, set:
   1. Allow Modbus Access = ON
   2. Allow S7 Access = ON ← critical flag
   3. Allow HTTP Access = ON (optional, required if you intend to use the LOGO! web server for diagnostics)
4. Configure the static IP, subnet mask, and default gateway. The default port for Modbus/TCP is 502; do not change it unless your plant standard mandates otherwise.
5. Compile and download the project to the base module.
6. Power-cycle the LOGO! if the access flags were previously disabled — runtime flag changes do not always take effect without a restart.

4.3 Define Modbus Server Address Space in the LOGO! Program

LOGO! 8 maps its internal variables onto the Modbus address space as follows:

Within LOGO! Soft Comfort, drag the desired Variable Memory blocks into your program; the Soft Comfort compiler automatically allocates the corresponding Modbus holding-register addresses starting at 40401. Keep your polling set within 64 contiguous registers to minimize fragmentation.

4.4 MBE Powertool Driver Configuration in Proficy iFIX

1. Open the Proficy iFIX SCADA configuration.
2. Launch the Power Tool for the MBE driver.
3. Add a new device. Use the same procedure you would use for a GE 90-30 / RX3i Modbus server — the MBE Powertool driver is GE-protocol aware but is also a general Modbus TCP client.
4. Configure the channel:
   1. IP Address = LOGO! IP address (e.g., 192.168.0.50).
   2. Port = 502.
   3. Protocol = Modbus TCP.
   4. Poll Interval = 1000 ms (or shorter). The poll must be inside the LOGO! idle timeout of 120 s; recommended setting keeps it under 60 s.
   5. Timeout = 3000 ms.
   6. Retry Count = 3.
5. Add a register block:
   1. Starting Address = 40401 (first VW block) or 40001 (first AI block).
   2. Register Count = number of contiguous registers to read.
   3. Scan Group = MAIN (or as required by your polling architecture).
6. Save and let the driver establish the channel.

The complete driver-side settings should match the GE PLC reference configuration you already have working; the only LOGO!-specific change is the runtime flag combination documented in §4.2.

5. Resolving the Transmit/Receive Stall

After enabling both access flags, you will observe that transmit/receive counters increment for several minutes, then freeze. The data remains tagged as GOOD in iFIX because the MBE driver caches the last successful poll response. The fix has three layers:

5.1 Tighten the MBE Polling Interval

Reduce the Poll Interval on the MBE Powertool channel to 1000 ms or less. With a 1000 ms poll and a single 64-register block, the worst-case idle window between consecutive successful transactions is well under the LOGO!'s 120 s TCP idle timer, eliminating the silent socket FIN. Validate with:

Counters must increment continuously; if they freeze for more than two poll cycles, the polling interval is still too long.

5.2 Use the LOGO! Web Server as a Keep-Alive Witness

Open http://<logo_ip> in a browser while polling is in progress. The page shows active session count. If the active-session count drops from 1 to 0 in step with the iFIX transmit/receive stall, the issue is the LOGO! closing the idle socket. This confirms the polling interval is the root cause.

5.3 Permanent Fix: Firmware Patch or External Keep-Alive

If your plant mandates a polling interval greater than 60 s (for example, to reduce network load on a large fleet), implement an external Modbus TCP keep-alive. Two field-proven approaches:

1. Use a second SCADA-side Modbus client (a lightweight Python pymodbus script on the iFIX server, or a dedicated MBE channel with a 30 s poll) to hold the socket open continuously. The MBE Powertool driver session remains valid because the LOGO!'s listener sees continuous traffic on the IP.
2. Upgrade LOGO! firmware to the latest V8.4.x release. Siemens support note 109975995 documents incremental improvements to the TCP idle timer behavior. Refer to the latest firmware notes before assuming the timer has changed.

6. Verification Procedure

After applying the changes, perform the following verification checklist before handing the system over to operations:

1. From the iFIX server, ping <logo_ip> — must succeed with < 5 ms latency on a switched network.
2. From the iFIX server, run modscan or mbpoll -m tcp -t4 -a 1 -r 1 -c 64 <logo_ip> and confirm the expected register values.
3. In iFIX Power Tool, confirm the MBE channel status is ACTIVE and the Tx Count / Rx Count counters both increment every poll cycle for at least 30 minutes without operator intervention.
4. In the iFIX database, confirm the polled blocks show GOOD data quality throughout the test window.
5. Force the LOGO! into STOP mode and back to RUN, and confirm the iFIX channel re-establishes automatically within the configured retry window (no manual re-enable required).
6. Power-cycle the LOGO! and confirm automatic recovery.

7. Comparison: LOGO! Modbus Server vs. GE RX3i

The "identical configuration" assumption that works for GE PLCs therefore does not transfer cleanly to LOGO!; two flag changes plus a polling-interval adjustment are required.

8. Field Notes and Best Practices

• Document the order number, not just the marketing label. A "LOGO! 8" without the trailing -0BA2 MLFB suffix may be a LOGO! 7 (no Ethernet) or a LOGO! 8.0/8.1 that lacks the dual Modbus/S7 access flag.
• Reserve IP addresses via DHCP reservations or static configuration. A LOGO! whose IP changes after a router reboot will silently drop out of the MBE driver.
• Keep the polled register block contiguous. Non-contiguous reads force the MBE driver to issue multiple Modbus transactions per scan, multiplying the risk of crossing the 120 s idle threshold.
• Use a dedicated VLAN for SCADA traffic. LOGO! 8 has a single Ethernet port; isolating the SCADA traffic protects polling integrity.
• Log the LOGO! firmware version in your project as-built documentation. When a future Siemens firmware release changes the TCP idle behavior, you can correlate field reports to firmware versions in minutes.

9. Related Siemens Documentation

The following official Siemens documents were referenced in this troubleshooting procedure. Use them to cross-validate the configuration against the latest Siemens guidance:

• LOGO! Modbus/TCP Communication — Application Document (PDF, 109779762)
• LOGO! 8 + SENTRON PAC3200 — Modbus TCP measurement data acquisition (109746315)