Siemens LOGO! Network Input / Network Output Same-Address Oscillation: Root Cause and Pulse-Conversion Fix

The Siemens LOGO! 8 family (6ED1052-xxx08-0BA1/0BA2 modules and the 0BA8 starters kit) exposes a virtual memory area known as the V area (V0.0 … V850.7 in current firmware). The V area is the on-board scratchpad that the LOGO! Soft Comfort programming tool uses to back Network Inputs (NI) and Network Outputs (NO) when the device is in client/MODBUS/UDP/S7 mode. A very common field mistake is to bind a Network Input (e.g. NI V0.0) and a Network Output (e.g. NQ V0.0) to the same byte/bit, then attempt to clear the input by writing to the output. The program behaves correctly in LOGO! Soft Comfort simulation but produces a 0-1-0-1-0-1 cycle (contact-bounce style oscillation) on the real device. This article explains the cause, the architectural reason for the simulator/real difference, and the correct pulse-conversion pattern using a LOW/edge block.

1. Problem Description

A standard use case is a SCADA/HMI/OpenHAB command path into a LOGO!:

1. OpenHAB writes a 1 to a holding register that LOGO! has been configured to read as a Network Input (NI V0.0 = "GO UP", NI V0.1 = "GO DOWN").
2. LOGO! executes program logic and drives the roller-shutter relays.
3. OpenHAB expects to read back an updated command bit (e.g. so the HMI button can show the actual state), therefore the SCADA polls another register that LOGO! has been configured to write as a Network Output (NQ V0.0, NQ V0.1).

The developer's intent is straightforward: write a feedback bit to NQ V0.0 to clear NI V0.0. The expected behavior in the Soft Comfort simulator is exactly that — the network input value is overwritten by the network output in the next scan and everything stays stable. On the physical LOGO!, however, the bit starts toggling 0-1-0-1 with a period of two program cycles. The relays chatter, the HMI button flickers, and the PLC appears to behave like a bouncy mechanical switch.

2. Root Cause: One Memory Cell, Two Owners

The V area is a single shared memory. Network Input V0.0 and Network Output V0.0 are not two distinct cells; they are the same byte/bit. In real hardware the V memory is read by the MODBUS/S7/UDP client after the program cycle has finished, and written before the next cycle begins. The following sequence therefore happens every cycle:

The simulator in LOGO! Soft Comfort evaluates the FBD against an ideal scan model where the network output "immediately" overwrites the same memory and the program is re-evaluated before the input is sampled again. The firmware on the real CPU does not re-evaluate; it uses the pre-cached NI value for the whole cycle. Result: the moment the program sets NQ V0.0 = 0, the very next read of NI V0.0 returns 0, the program decides the user has not requested UP, sets NQ V0.0 = 1 to keep the relays active, the next read returns 1, the relays turn off again, the program sets NQ V0.0 = 0, and so on. The bit oscillates at the program-cycle frequency (typically 10–20 ms), which is exactly what is observed in the field.

3. Why the Soft Comfort Simulator Hides the Bug

LOGO! Soft Comfort's offline simulator runs the FBD in an event-driven interpreter that re-samples inputs whenever an output of the same block changes. The simulator has no concept of a separate "write-back" phase at the end of a cycle. The result is a best-case idealization in which the user's intent — "write 0 to clear the input" — is honored. The bug is not a simulator defect; it is a discrepancy between the simulator's optimistic memory model and the firmware's real scan model. As Siemens support notes in the LOGO! 8 system manual (entry ID 109741041), simulation results are reference values only and must be validated on the target hardware.

4. The Pulse-Conversion Fix (LOW / Falling-Edge Block)

The recommended pattern is to treat the Network Input as a level (pushbutton held) and convert it to an edge (single-cycle pulse) so that the Network Output only writes a 0 for exactly one cycle. After the cycle the firmware re-samples the input, sees the value the SCADA actually sent, and the system reaches a stable state.

4.1 FBD implementation

1. Use a LOW (negated contact) or a Falling-edge / trailing-edge block driven by the Network Input. When NI V0.0 = 1, the block output goes to 1 only for the duration of one program cycle, then returns to 0.
2. Feed that edge pulse into a Set/Reset (SR) latch or into the LOGO! "Wiping relay (pulse output)" function block B05.
3. Reset the latch through the opposing command (GO DOWN clears GO UP) and through the end-position sensor logic.
4. Drive the relay outputs and the Network Output feedback flag from the latched bit, not from the raw NI bit.

4.2 Ladder-style equivalent

|  NI V0.0  |  NI V0.1  |  M_END_UP  |  M_END_DN  |
|   |--| |--+   |--|/|--+    |--|/|---+   |       |
|   |       |   |       |    |          |   |       |
|   +-------+   +-------+    +----------+   +-------+--
|                                          ( ) SR_FF
|                                                R    +-- NQ V0.0
|
|  NI V0.1  |  NI V0.0  |  M_END_DN  |  M_END_UP  |
|   |--| |--+   |--|/|--+    |--|/|---+   |       |
|   |       |   |       |    |          |   |       |
|   +-------+   +-------+    +----------+   +-------+--
|                                                R    +-- NQ V0.1

4.3 Parameter table for the two interlocking command bits

5. Memory Map of the LOGO! V Area

The V area used by the S7/Modbus/UDP protocol layers is documented in the LOGO! 8 communication manual (entry ID 109741041). The relevant excerpts:

When a Network Input and a Network Output are both configured to byte 0, they alias the same physical RAM cell. The behavior described in this article will appear regardless of which protocol (S7 PUT/GET, MODBUS TCP, MODBUS RTU over RS-485, UDP, or the LOGO! Access Tool) you use to drive them.

6. Step-by-Step Resolution Procedure

1. Open the project in LOGO! Soft Comfort >= V8.3 (entry ID 109741041 lists compatible versions). Identify the offending NI/NQ pair. A quick check is to open Tools > Parameter VM Mapping and sort by address.
2. Dissociate the feedback: stop writing back to the same V address. Move the HMI feedback to a free bit, e.g. NQ V2.0.
3. Insert a trailing-edge block (function block B04 "Falling edge" / "Retriggerable single-pulse, trailing edge") in series with the command path that drives the latch. The pulse must be one LOGO! cycle long; Soft Comfort's default 0.1 s preset can stay because the LOGO! cycle is normally < 50 ms and the B04 block is edge-triggered, not timed.
4. Insert the SR latch so the user request persists until the opposing command, the end-position sensor, or the rotation-timeout resets it.
5. Add the interlock: the Q output of the UP latch feeds the R input of the DN latch and vice versa. This guarantees that even if both network inputs arrive in the same scan, only one wins.
6. Drive the relay outputs from the latches through a Q-on/off delay block (B06/B07) so motor direction is held for a minimum run time, protecting the contactor and capacitor of the roller-shutter motor.
7. Mirror the latch to NQ for the HMI; this NQ is now strictly read-only and the oscillation is gone.
8. Compile and download to the physical module. Use the LOGO! display menu Card > Card Password only if you also need to lock the program; for this fix the default transfer is sufficient.

7. Verification Checklist

Use the following on-line observations to confirm the fix is correct:

• From Soft Comfort online mode, monitor NI V0.0, NI V0.1, the SR-latch flags (M10, M11) and NQ V0.0, NQ V0.1. The latches must stay stable across many cycles.
• From OpenHAB, send a 1 to the holding register that maps to NI V0.0. The motor contactor must energize. Send a 1 to the holding register that maps to NI V0.1 while the motor is running; the UP latch must reset and the DOWN latch must set within two cycles, and the relays must not overlap.
• Force NI V0.0 = 1 with no user action and watch the cycle time stamp in the LOGO! data log (Tools > Online Test). It must not toggle.
• Trigger the upper limit switch (I3) and verify that NI V0.0 is cleared, the motor stops, and the HMI button state is updated via NQ V0.0.
• Trigger the rotation-timeout for the lower limit (5 s without impulses on the rotation sensor input) and verify the same for the down path.

8. Practical Application: Roller-Shutter Automation with OpenHAB

The discussion thread originated from a roller-shutter control where:

• Two digital inputs (upper position sensor, rotation sensor) are wired to the LOGO! base module.
• OpenHAB sends "pull up" and "pull down" commands via MODBUS TCP to a LOGO! 8 12/24 RCE acting as a Modbus server.
• A "teach mode" must move the shutter to the upper end, then to the lower end, count rotation pulses, and finally switch itself off.

The fix described in §4 makes the teach mode and the interlock possible because every command becomes a latched edge that can be cleared deterministically by an internal event. The teach mode is implemented as a third SR latch (M12) that is set by a network input, drives both UP and DOWN commands in sequence, and is reset when the timeout counter reaches 5 s without pulses on the rotation sensor.

8.1 Teach-mode flow chart

9. Related LOGO! Functions Worth Knowing

10. Edge Cases and Field-Proven Caveats

• Communication loss: a stuck NI bit (e.g. the SCADA crashes with the bit at 1) will keep the motor in its last commanded state. Always add a watchdog: a B15 staircase-light block with a 30-minute timeout, or a B23 threshold that compares the elapsed "no-rotation" timer to a maximum run time. This is mandatory for roller-shutter safety per the relevant machinery directives.
• Endian / bit ordering: V0.0 is the least significant bit of byte 0. In MODBUS holding-register view (big-endian word, little-endian byte) it appears as the high bit of the high byte of the first word. Mis-mapping is a common cause of "the bit never goes high" complaints that look identical to the oscillation issue described here.
• S7 PUT/GET vs MODBUS: in S7 mode, NI/NQ are configured with Network Input/Output blocks in the program. In MODBUS mode they are mapped automatically to holding registers 0..63 of the LOGO! server. The fix is identical in both cases; only the configuration screen differs.
• Firmware V1.08.01 and later added support for larger V area on 0BA3 modules (up to V850.7). The behavior of the first 64 bytes, and therefore the NI/NQ pair at V0.0, is unchanged.
• LOGO! TDE: the on-board text display can also toggle the same V memory through its function keys (F1..F4 → V0.0..V0.3 by default). If your HMI driver and the TDE both write the same bit, you will see the same oscillation. Disable TDE keys that are not used.
• LOGO! Access Tool: a single PC tool can read and write V memory via USB or Ethernet. Useful for bench tests, but treat it as an additional writer to the same bit — it will trigger the same oscillation if the program logic is wrong.

11. Why Not Use a "Set/Reset Bit" Instruction?

The LOGO! does not expose explicit bit-set/bit-reset instructions on the V area. The workarounds are: (a) write to an NQ block whose address matches the bit you want to clear (the unsafe approach discussed in this article), or (b) move the HMI command onto a momentary internal pattern (the recommended fix). Variant (b) has the additional benefit of surviving communication packet loss: even if the SCADA's "1" arrives twice, the LOGO! sees only one edge.

12. Frequently Asked Questions