Siemens LOGO! Parameter Lock: Operator Access to Single Value

Overview: Why Lock LOGO! Parameters in Operator Mode

Siemens LOGO! 8 base modules (BM) and the LOGO! TDE external text display expose a dual-mode architecture that controls visibility of menus, parameters, and program-edit functions on the integrated 6-line LCD or on the LOGO! 6ED1055-4MH00-0BA1 text display. The two modes are Admin mode and Operator mode. In admin mode every menu, every parameter, and every program slot is reachable. In operator mode the menu tree is pruned: the controller cannot be transitioned to STOP from the display, the IP address on the Ethernet-equipped RCE variants (12/24 RCE, 230 RCE, 24 RCE) cannot be edited, the SD card cannot be ejected, and—most importantly for an oven, HVAC chiller, pumping skid, or packaging line—every editable parameter block is hidden unless the engineer explicitly promotes it through a message text with parameter assignment.

This article describes the engineering workflow to leave exactly one parameter (the operator-relevant setpoint; in most cases the temperature SP) editable on the front panel while every other block, threshold, hysteresis, on-delay, counter reset, and analog gain remains read-only. The workflow uses native LOGO! features only: no external HMI, no OPC UA server, no password-protected web page, no script. The procedure is verifiable from the operator panel in under five minutes per machine.

Prerequisites

• One LOGO! 8 base module from the 6ED1052-1xxxx-0xxx family (e.g., 6ED1052-1CC01-0BA8 LOGO! 12/24 RCE or 6ED1052-1MD00-0BA8 LOGO! 230 RCE).
• LOGO!Soft Comfort V8.2 or later. Older V8.0/V8.1 projects open but should be resaved as V8.2+ for FS4 base modules.
• Micro SD card (Siemens 6ED1056-1DA00-0BA0, 8 GB, optional but recommended for offline program transfer and firmware update).
• Ethernet (RJ45) cable or USB cable for online commissioning.
• The process variable block that you intend to expose as the operator setpoint (typically the SP parameter of an Analog Threshold Trigger B009, an Analog Comparator B013, or a PI controller output scaling).
• Operator panel access during commissioning to verify the lock from the front face.

Access Level Architecture

LOGO! 8 separates authentication into four distinct mechanisms that engineers frequently conflate. Understanding each is the key to building a correct lock strategy:

For the operator-only-one-parameter goal, the message-text parameter password is the correct lever. The admin password locks the engineer out, not the operator in. A common error is to set the admin password to something strong and assume that operators cannot change the setpoint; in fact the operator's path to editing any value is always through a message text, regardless of the admin password.

The Two-Tier Protection Strategy

Engineers commonly assume that switching the controller into operator mode hides everything. In fact operator mode hides the menu tree, but the message text on the operator screen is always visible and is the only legal path for the operator to write a value to a parameter. The strategy is therefore:

1. Keep the controller in operator mode so the program, IP address, mode change, and Stop menu items are hidden.
2. Insert one message text on the active screen that exposes one parameter—the desired operator setpoint—and optionally protects it with a 6-digit password that only the operator knows.
3. Leave every other block's parameter hard-coded in the program. A hard-coded parameter is not editable from the front panel even in admin mode without a program download.
4. Set the admin password to a non-default value so casual walk-up access to admin menus is blocked.
5. Set the program download password so a service laptop cannot silently overwrite the project.

Step-by-Step: Lock All Parameters Except One

Use the example of an industrial oven in which the operator must be able to adjust the setpoint between 50 °C and 300 °C, but no other parameter (hysteresis, on-delay, max heat-up ramp, alarm threshold) may be modified from the display.

Step 1 — Build the program in LOGO!Soft Comfort

Create the FBD or ladder program. At minimum, include the following blocks:

• An analog input block: B009 Analog Amplifier for a 0–10 V or 4–20 mA signal, or AM2 RTD (6ED1055-1MA00-0BA2) for a PT100/PT1000 sensor.
• An analog threshold trigger: B009 Analog Threshold Trigger for on/off control, or B015 Analog Comparator for window-based control.
• A digital output Q1 driving the heater contactor (use an interposing relay; do not switch a heating element directly with the LOGO! relay if the element draws >10 A or if any inductive load is present).
• At least one Message Text block (B001 in older firmware, B013 in V8.2+) on the main line.

Step 2 — Configure the Setpoint Block to Use a Variable Memory Address

Open the Analog Threshold Trigger (or PI controller, or Analog Comparator) and on its Parameters tab configure:

• On threshold (Threshold A): leave at the default engineering value (e.g., 150 °C). This is the design value and should not be editable by the operator.
• Operator setpoint reference: instead of hard-coding the threshold, click the threshold field, select Use VM (Variable Memory) address, and bind it to a VW location, e.g., VW0. The default range and unit follow the block configuration.

Step 3 — Insert and Configure a Message Text Block

From the toolbar select Message Text (B001 / B013 depending on firmware) and drop it on the program line. Configure it as follows:

• Display line 1: static text such as Oven Setpoint or T_sp =.
• Display line 2 (or 3): embed the VM address by clicking Insert Parameter → VW0. The block will show the live value and allow a click on OK to edit it if Parameter Protection is enabled.
• Enable parameter protection: check the box Password protection. Enter the desired 6-digit password (e.g., 123456) and confirm. If the operator should edit without a password, leave this unchecked.
• Set min/max limits: under the parameter configuration dialog, enter the engineering range: Min = 50, Max = 300. This is the range-limit feature referenced in the field report.

Step 4 — Mark the Message Text as the Active Display

On the Message Text block's Properties tab, set:

• Display priority: High (so it overrides any lower-priority status messages).
• Show when stop = yes: uncheck unless the operator must be able to view the setpoint while the heater is stopped.
• Tick to confirm: uncheck (no confirmation needed for a single-value edit).
• Acknowledge required: uncheck.

Step 5 — Set the Admin Password

Open Tools → Parameter VM Mapping → Protection in LOGO!Soft Comfort. Enter a non-default admin password, e.g., Svc2024 or a longer 16-character passphrase. The default "LOGO" password should always be changed before deployment to prevent trivial walk-up access to admin menus. Repeat the change on the LOGO! itself under Menu → Setup → Password so the on-device value matches the LOGO!Soft Comfort project.

Step 6 — Set the Program Download Password

Open File → Properties → Password. Enter a strong value, e.g., Logo!Pr0j-2024. This prevents a service laptop from silently uploading an alternate project that re-exposes hidden parameters.

Step 7 — Download the Project

Connect the LOGO! via USB or Ethernet. Use Transfer → PC → LOGO! in LOGO!Soft Comfort. Wait for the green confirmation bar. If the project contains a program download password, enter it when prompted. After download, the controller reboots into the project and defaults to operator mode if the project is set to operator startup (under Setup → Mode).

Password Configuration Reference

Range Limiting the Editable Parameter

The "limit the maximum input" question raised in the source is solved by the message-text block's Min/Max fields. The operator enters a value with the cursor keys; on OK the LOGO! rejects any value outside [Min, Max] and re-prompts. For an oven:

• Min: 50 (°C, or the engineering unit configured in the threshold block).
• Max: 300 (matches the design rating of the heating element; do not exceed the OEM-stated maximum).
• Step: 1 (one degree per cursor-key tick). FS4 supports configurable step; earlier firmware is fixed-step.

If the parameter is a 16-bit VM word (e.g., a counter, a threshold), the underlying range is -32768 to +32767, but the message-text Min/Max can clamp it to any narrower sub-range. For an analog value of 0–10 V scaled to 0–400 °C, the clamp should be 0–400 °C; anything wider would let the operator push the controller outside the calibrated linearization, which can produce nonsensical behavior at the edges.

Verifying the Lock Setup

1. Power-cycle the LOGO! to confirm that the project boots in operator mode by default (Menu → Setup → Mode → Operator).
2. From the operator display, navigate the menu. Verify that Program, Stop, Setup → Network (IP), and Card items are absent or greyed out.
3. Confirm that the message text "Oven Setpoint" appears on the idle screen and that pressing OK allows editing of the value within 50–300.
4. Attempt to enter 350. The LOGO! must reject the value and return to the previous screen with the unchanged setpoint.
5. Attempt to enter the admin mode by selecting Menu → Setup → Admin (if visible) and entering the wrong password five times. On FS4 the controller must lock the admin menu for the configured cool-down period (default 1 minute).
6. From a PC, attempt an online program read with the wrong program password. The download must fail with the standard Siemens error "Incorrect password".
7. From the web browser (RCE only), attempt to log in with the default "LOGO" password. After the change in Step 5 this must fail.
8. Observe the controller for one production cycle and confirm that the edited setpoint persists through a power-cycle if retention was enabled, or that it returns to the program default if retention was disabled (verify the design intent).

Troubleshooting Matrix

Hardware and Firmware Compatibility

Migration from LOGO! 6 / LOGO! 7 to LOGO! 8.FS4

Projects from 0BA6 and 0BA7 modules import cleanly into LOGO!Soft Comfort V8.2, but three parameter-protection behaviors changed and require explicit re-validation:

1. The admin password maximum length grew from 8 to 16 characters and now accepts the full printable ASCII set, not just the default "LOGO".
2. The message-text parameter protection no longer permits unauthenticated edits of a parameter that has Min/Max constraints. If you had an old project where the operator could freely edit a VM-bound threshold on the 0BA6 display, you must explicitly enable parameter protection (with or without a password) on the migrated 0BA8 message text.
3. The web server password is now independent from the admin-mode password; on 0BA6 the same value served both functions, which is no longer the case.

Best Practices for Field Deployment

• Always change the admin password from "LOGO" before deployment. Walk-up access with the default password is the single most common cause of unauthorized parameter edits in service calls.
• Document the message-text parameter password on the operator-panel label. If the password is lost, operators cannot edit the setpoint; the oven becomes effectively unconfigurable until an engineer visits with LOGO!Soft Comfort.
• Store the LOGO!Soft Comfort project source file (.lsc) in a versioned backup alongside the admin, program, and web-server passwords in the plant password vault.
• Use the program download password. It is independent of the admin password and prevents a contractor's laptop from silently uploading a modified project that re-exposes hidden parameters.
• Test the lock setup from the operator panel, not from LOGO!Soft Comfort. Engineers frequently verify in the engineering view and forget that the operator sees only the message text.
• For multi-language deployments, configure the TDE with two languages (Setup → Language) so the same message text serves both workforces without losing the parameter-promotion behavior.
• For audit trails on RCE variants, enable the web server with a strong password and use the LOGO!'s built-in trend display rather than a separate SCADA. This keeps the parameter surface minimal.
• If the process is safety-relevant (SIL or PL rated), do not rely on the LOGO! parameter lock as the safety function. Add an external safety relay (e.g., Sirius 3SK1) for the over-temperature cut-out.

Edge Cases and Field-Proven Caveats

Three behaviors catch first-time users:

1. VM address width mismatch. An Analog Threshold Trigger using a 12-bit internal representation but bound to a 16-bit VM (VW) will exhibit a 4× scale error if the Min/Max is set without rescaling. Always verify the engineering unit end-to-end after binding a VM.
2. Retention vs power-cycle behavior. By default LOGO! does not retain VM values across power-cycle unless the Retain option is set under Setup → Retain. For an oven setpoint that must persist across weekend power-offs, enable retention for the specific VM address.
3. Message text priority overflow. LOGO! supports up to 32 message texts on FS4. If more than one has high priority, the highest-numbered one wins. Engineers sometimes create a "hidden" diagnostic message text at high priority that preempts the operator's setpoint message; demote diagnostics to low priority.

Networked Variant Considerations (RCE)

For Ethernet-equipped variants the parameter lock must be combined with web-server and S7-communication hardening:

• Change the web-server password from the default "LOGO".
• Disable the web server if remote access is not required (Tools → Webserver → Enable, uncheck).
• Restrict the LOGO!'s IP to a management VLAN via the switch configuration; LOGO! has no built-in firewall.
• Block the LOGO!'s S7 communication port (ISO-on-TCP, port 102) at the perimeter if no S7 client is required.
• Disable the LOGO!'s NTP client if you do not need time synchronization, to remove an external dependency on the parameter-lock story.

FAQ