Siemens LOGO! SCADA Output Control via VM Mapping to DB1

Engineers integrating a Siemens LOGO! 8 series logic module with a SCADA package (for example myScada myDesigner) frequently hit a wall: writing a physical digital output that is already driven by the on-board ladder program produces no visible effect, and physical digital inputs cannot be written from the supervisory layer at all. The fix is to use the LOGO! Variable Memory (VM) area, expose it over the S7 protocol as data block 1 (DB1), and inject SCADA commands into the program through network inputs rather than writing the output directly. This reference walks through the memory map, the program pattern, and the SCADA-side binding required to make bidirectional control work end-to-end.

1. Overview of the Control Problem

LOGO! stores the state of every physical output in the I/O image. The ladder program is the sole owner of that image: when the program evaluates a coil assigned to Q1, the firmware overwrites whatever value the network or SCADA layer tried to deposit into the same image register. Two corollaries follow directly from the firmware design:

• Physical digital inputs (I1, I2, …) can be read by the SCADA but never written. The image is fed exclusively by the on-board hardware scanners.
• Physical digital outputs (Q1, Q2, …) are read/write from the network only when the corresponding coil does not exist in the ladder program. As soon as a coil =Q1 is placed anywhere in the program, the program regains exclusive write authority over the output bit.

The result is that the SCADA can toggle an unused output freely, but cannot override an output that the program is already driving. The correct architectural answer is to keep the program as the only writer of Q bits and instead route SCADA commands into the program through soft inputs called network inputs (NI), which the program ORs into its existing logic.

2. Prerequisites

1. LOGO! 8 base module (6ED1052-1CC08-0BA1, 1MD08-0BA1, 2MD08-0BA1, 2DT08-0BA1, or BM with Ethernet). Earlier 0BA6 / 0BA7 hardware does not expose the VM area or the S7 server used here.
2. LOGO!Soft Comfort V8.0 or later installed on the engineering PC. The program pattern and NI symbols are configured in this tool and downloaded to the LOGO! over Ethernet.
3. Active Ethernet link between LOGO! and SCADA PC. Configure a static IPv4 address on the LOGO! (Tools → Ethernet Connections in LOGO!Soft Comfort, or directly on the device with the cursor keys).
4. S7-200 driver on the SCADA side. myScada myDesigner ships the "Siemens S7 200/300/400 Ethernet" driver for exactly this use case; equivalent drivers exist in WinCC, Ignition, InduSoft, and Citect.
5. Network reachability: open TCP port 102 (ISO-on-TCP) between the SCADA node and the LOGO! base module IP. Confirm with telnet <logo_ip> 102 from the SCADA host before commissioning the driver.

3. LOGO! VM Memory Architecture

The Variable Memory (VM) is a scratch area that the LOGO! exposes to remote partners specifically for supervisory data exchange. According to the LOGO! system manual, the VM area spans 851 bytes, from VB0 through VB850. Every byte, word, and double-word in that range can be read and written by an authorised S7 client; the LOGO! ladder program can read it freely and can write to it through dedicated VM blocks (digital VM markers, analog VM thresholds, shift registers, etc.).

Bit addresses are byte-indexed: V0.0 is the least-significant bit of byte 0, V0.7 the most-significant. Word and double-word addresses increment by two and four bytes respectively because they share the same flat byte array. Concretely:

• Bit V3.5 lives in byte 3, mask 0x20.
• Word VW4 occupies bytes 4 and 5 (little-endian: VB4 is the low byte, VB5 is the high byte).
• Double word VD8 occupies bytes 8, 9, 10, and 11.

4. S7-200 Protocol Mapping: DB1

LOGO! 8 advertises itself as an S7-200-compatible device. From the perspective of a PUT/GET client (or an S7 driver on a SCADA node), the entire VM range is reachable as DB1. The mapping is identity-preserving: the byte offset inside DB1 equals the VB index inside the LOGO!.

This is the key fact that makes bidirectional SCADA control possible: anything the program deposits in the VM range (markers, threshold values, shift-register contents) becomes visible to the SCADA as a DB1.DBB<n> or DB1.DBX<b>.<bit>, and anything the SCADA writes into DB1 at the matching offset is read by the program as the same VM location.

4.1 S7 Connection Parameters

When configuring the SCADA driver for the LOGO! 8, use these parameters:

• IP address: the LOGO! IPv4 address (default 192.168.0.10 — change before connecting to a live network).
• Port: 102 (ISO-on-TCP, RFC 1006).
• TSAP local: typically 10.00 for the SCADA partner; LOGO! side is fixed at 02.00.
• Rack / Slot: 0 / 1 (LOGO! 8 behaves like an S7-200 CPU 224XP for addressing purposes).
• CPU type: S7-200 (S7-300 / S7-1200 read syntax will usually work because the same DB1 region is exposed, but the S7-200 profile is the documented match).

The LOGO! firmware accepts up to eight simultaneous S7 connections. Each SCADA client consumes one connection slot. A typical myScada install uses one connection for polling and a second for the alarm/event channel if the project is large; budget the remaining six for additional HMIs, programming tools, or peer LOGO! partners.

5. Why Direct Output Control Fails

The output image PA (process image of outputs) is updated once per LOGO! cycle. The update is performed by the runtime in this fixed order:

1. Resolve the program: evaluate every coil in topological order, computing the desired state of every Q bit.
2. Apply the computed state to the physical output drivers.

If a SCADA client writes DB1.DBX0.0 (which is the only thing it can write — DB1.DBW0:0 is not a real output register), that write is routed to VM byte 0, not to the PA. The output itself remains bound to the coil. Even a write to Q1 through a separate S7-200 output area (PQ) is silently overwritten on the next cycle because the firmware re-resolves the program first.

For inputs, the situation is similar: the I-input area PE is refreshed from the hardware scanners, and any S7 write to a PE bit is dropped. The LOGO! does not implement input forcing from the network; it only implements input forcing from LOGO!Soft Comfort in online mode, and that path is disabled when the engineering cable is detached.

6. The Correct Pattern: Network Inputs and Program-Side Coalescing

Rather than fight the firmware, route the SCADA command through a network input. Network inputs (NI1 … NIn) are bits that the LOGO! ladder program reads as ordinary inputs, but whose state is written by a remote partner over the S7/Modbus connection. By ORing a network input with the local condition that drives the output coil, the program can be told to turn the output on or off from the SCADA without losing the local automation behaviour.

6.1 Symbol Layout

Pick a small convention and apply it consistently across the project. A common layout uses VM bytes 0 … 3 as the SCADA command interface:

The "ON" and "OFF" bits are intentionally separate. This avoids the classic race condition where the SCADA writes the bit low to turn the output off but the program latches the output high until the next cycle, which would cause a one-cycle pulse every poll. Set/reset pairs are decoded by the program into a single flip-flop that drives the coil.

6.2 Ladder-Logic Pattern in LOGO!Soft Comfort

Below is the canonical network for one output. The function blocks are available in the LOGO! toolbox under Special → Network Input, Basic → AND / OR, and Basic → SR (Set/Reset flip-flop).

Block 1: NI_F1 (Network Input) ──┐
                                 │
Block 2: <local_run_condition> ─┤── AND ──┐
                                 │          │
Block 3: (free) ─────────────────┘          │
                                            ├── OR ──┐
Block 4: NI_F1 (delayed 200 ms) ─────────────┘       │
                                                        │   ┌──── SR (set-dominant) ──── (= Q1)
Block 5: NI_R1 (Network Input) ───────────────────────┘─── │
                                                            │
Block 6: <local_stop_condition> ───────────────────────────┴── R

Notes on the pattern:

• Network input NI_F1 must be configured in the connection table (Tools → Ethernet Connections → Network Inputs) and bound to a specific VM bit, for example V0.0. Once bound, the LOGO! treats that VM bit as a regular input on every cycle.
• The 200 ms delay on the second branch (Block 4) is a debounce: it suppresses noise on the network bit while still allowing fast operator response.
• Use a set-dominant SR flip-flop so that simultaneous ON and OFF commands resolve to ON. Otherwise an OFF arriving one cycle after an ON will leave the output in an undefined reset state.
• The local stop condition (Block 6) is wired directly to the reset of the SR so that an emergency stop or interlock always wins, regardless of the SCADA.

For the SCADA-side mirror, add a single line that copies the open-collector output back into VM:

Block 7: Q1 ── (read-only feedback) ──> writes to V1.0

This is normally done with a "VM mapping" block, or simply by using the Q1 state in another small logic equation that sets a marker bit, which is then written into VB1 by the LOGO! runtime.

7. Step-by-Step Implementation

Step 1 — Configure the LOGO! Network Inputs

1. In LOGO!Soft Comfort open the project, then Tools → Ethernet Connections.
2. Add a new connection of type S7 Connection pointing at the SCADA partner's IP, rack 0, slot 1.
3. In the Network Inputs tab, declare NI1 bound to VB0.0 (bit 0 of byte 0) and NI2 bound to VB0.1, and so on, one per bit you intend to use.
4. Click Transfer → to LOGO!. The base module stores the connection table in non-volatile memory.

Step 2 — Build the Ladder Program

1. Insert the SR flip-flop and the OR/AND combination described in section 6.2 for every output that the SCADA must control.
2. For each output, place a small "echo" branch that writes the post-SR Q1 state into the corresponding VM bit, e.g. V1.0 = Q1.
3. Compile and download the program. Confirm there are no address conflicts (LOGO!Soft Comfort will warn if a coil is driven by two blocks).

Step 3 — Wire myScada to DB1

1. Open the myDesigner project, then Communication → Drivers → Siemens S7 200/300/400 Ethernet. (See the myDesigner Write/Set Command manual section for the latest driver path.)
2. Create a new channel. Enter the LOGO! IPv4 address, port 102, rack 0, slot 1, CPU type S7-200.
3. Add tags. The mapping is direct: the address string DB1.DBX0.0 reads/writes the bit bound to NI1, and so on. Use DB1.DBB0 for byte access if the project needs to read/write eight commands in a single poll.
4. Bind the tags to HMI widgets: a push button that calls the Set Bit action on DB1.DBX0.0 to turn the output on, and a second that calls Reset Bit on DB1.DBX0.1 to turn it off.
5. Add a read tag on DB1.DBX1.0 and bind it to an indicator lamp to display the actual output state.

Step 4 — Polling and Update Rate

A reasonable starting point is a 250 ms poll on the command block (DB1.DBB0) and a 500 ms poll on the status block (DB1.DBB1). The LOGO! cycle time on a fully loaded program with eight S7 connections is typically 8 … 15 ms; polling faster than 100 ms wastes bandwidth without improving the user experience. For the heartbeat bit, set a slow scan of 1 s so the SCADA can detect a stalled connection.

8. Reading Physical Inputs from the SCADA

Inputs (I1, I2, …) are read-only across the network. They are not part of the VM area, but they are accessible through the standard S7 input region. With the S7-200 driver, the I region is addressed as I0.0 … I0.n (and analog inputs as AIW0, AIW2, …). Configure a read-only tag for each input and bind it to a status widget. There is no equivalent write path — if the engineer needs a "virtual push button" from the SCADA, the correct path is a network input as described above, never a write to an I address.

9. Verification

1. Link check. From the SCADA PC run ping <logo_ip>; expect < 5 ms RTT on a switched network.
2. Read test. Configure a read-only tag on DB1.DBB1 and confirm the value changes when a physical output toggles. If the read fails, the connection is not established — check the LOGO! online diagnostics for the S7 connection status (slot 0x10 on the LOGO! display will show the connection state).
3. Write test. Use the myDesigner Write/Set Command tool to write a single byte value 0x01 to DB1.DBB0. The output bound to NI1 should turn on within one cycle.
4. Round-trip test. Pulse DB1.DBX0.0 and observe DB1.DBX1.0 mirror the result. If the mirror bit does not follow, the program echo branch is missing or the SR flip-flop is dominated by the local stop condition.
5. Watchdog test. Disconnect the Ethernet cable. The LOGO! should continue running the program unaffected (it always does — the SCADA commands simply freeze in their last state). Reconnect and confirm the SCADA recovers without a manual restart.

10. Troubleshooting Matrix

11. Extending the Pattern

Once the basic set/reset skeleton is in place, several refinements become straightforward:

• Mode selection. Reserve a full byte (e.g. VB4) for an integer "mode" tag. The program decodes it with a comparator block; values 0 = local only, 1 = SCADA override, 2 = SCADA on top of local, 3 = maintenance lockout. This converts the ON/OFF pair into a one-byte selector, freeing VM space.
• Analog setpoints. Analog values from the SCADA land in VW4, VW6, … and feed an analog threshold block on the LOGO! side. The block compares the threshold to an analog input (AI1) and drives a flag that the program uses as a soft limit.
• Heartbeat watchdog. The SCADA toggles a bit at 1 Hz; the LOGO! runs a 2 s on-delay. If the bit ever stops toggling, the watchdog trips and the program forces outputs to a safe state.
• Alarm acknowledge. A single bit (V0.5) acts as the ACK line for all latched alarms. The program uses a rising-edge detector to clear the alarm latches and to write a 1-s pulse into a status byte the SCADA can read back as confirmation.

12. Documentation and Reference Targets

• LOGO! 8 system manual (entry ID 109741654 in the Siemens Industry Online Support) — sections on Variable Memory and S7 communication.
• LOGO!Soft Comfort online help — Network Inputs / Network Outputs configuration.
• myDesigner manual — Write/Set Command for the Siemens S7-200/300/400 driver.
• Siemens Industry Online Support for the LOGO! 8 product family for the matching 6ED1 part numbers and firmware release notes.