Troubleshooting LOGO! 8.FS6 S7 Communication VM Memory Failure

1. Problem Summary

On a Siemens LOGO! 8.FS6 (order code suffix 0BA8.1) running firmware V1.81.03, S7 communication with a partner CPU returns unreadable or unwritable values for the Variable Memory (VM) address range VM 275 through VM 485. All other VM areas (VM 0..274 and VM 486..1023) respond normally, and Inputs/Outputs/Markers remain reachable. The same S7 project transferred to a 0BA8.0 LOGO! 8 with identical configuration, IP address, and LSC program behaves correctly, isolating the failure to the 0BA8.1 hardware revision combined with firmware V1.81.03.

2. Affected Hardware and Firmware Identification

Confirm the exact platform before applying the diagnostic or firmware update procedure. The two hardware revisions of the LOGO! 8 family are physically and functionally similar but expose different internal firmware paths.

To identify the active revision from the LOGO! display or Web server:

1. Open the LOGO! onboard display menu and navigate to Diagnostics > Device Information or scroll to the right on the home screen.
2. Read the FW version line: it shows something like V1.81.03 and the Module type shows 0BA8 Standard or 0BA8.FS6.
3. Confirm with the Web server at http://<logo-ip> → LOGO! Information page: the Device field encodes the hardware revision in the article number suffix.

The observed symptom is consistent only with 0BA8.1 + V1.81.03. If the same VM range fails on 0BA8.0, the issue is project-related (memory overlap with function blocks, retention conflict, or block parameter "hide" flags) and is not the firmware defect discussed here.

3. LOGO! VM Memory Architecture and S7 Communication

The LOGO! 8 internal data area is divided into several regions. S7 communication exposes a subset through a fixed TSAP / connection topology. Understanding the mapping is essential to confirm whether a "dead" block is a real bug or a configuration artifact.

3.1 VM, V, and M Areas

The full VM byte range is VM 0..VM 1023 (1024 bytes), accessed by partner S7 CPUs through standard PUT/GET on the LOGO! TSAP. The exact TSAP for a LOGO! 8 is computed from the configured IP address per the Siemens convention TSAP = 01.00 + (last IP octet encoded as 2 bytes); the S7 partner must match the resulting TSAP or use the broadcast 00.00 form for direct connection.

3.2 Why VM 275..485 Specifically

On 0BA8.1 with firmware V1.81.03 the address range VM 275..VM 485 (211 bytes) maps, in the LSC project, to internal scratch / buffer space consumed by the safety runtime added in the FS6 platform. Field observations indicate that the PUT/GET server returns the "no valid data" or a static zero fill for this range, while the on-board VM mapping tool in LOGO!Soft Comfort shows the same addresses as live and writable. This is a mismatch between the application view of VM and the S7 server view, which is the root signature of the firmware defect.

4. Root Cause Analysis: 0BA8.0 vs 0BA8.1 Hardware Revision

The user reproduced the failure by swapping the suspect 0BA8.1 module for a 0BA8.0 with the same LSC program, the same IP address, and the same configuration. This is a controlled A/B test that isolates the failure to the 0BA8.1 hardware/firmware combination.

4.1 Hardware-software binding

The 0BA8.1 FS6 platform added a safety runtime that reserves an internal buffer in the VM address space. In V1.81.03 the S7 server's address translator was not updated to skip the reserved buffer, so it returns "dead" values for the protected range. The internal LSC view does not have this bug because the LSC client uses a different access path (direct, in-process) than the S7 server (network, TCP, ISO-on-TCP).

4.2 What is not the cause

• Network/rack misconfiguration: ruled out because adjacent VM blocks work and the same project works on 0BA8.0.
• TSAP mismatch: ruled out because the rest of the VM range is read correctly under the same TSAP.
• Function block memory collision: ruled out because the user already verified the LSC mapping is correct and identical on both revisions.
• Firewall/PLC security setting: a 0BA8.0 with the same security configuration works.

4.3 Available fix path

Siemens has published a follow-up firmware V1.81.04 for the 0BA8.1 platform. V1.81.04 is a security update to V1.81.03 and bundles the S7 server address translation fix for the FS6 VM buffer. The version is reachable from V1.81.03 with no project migration; the LSC program, IP, and TSAP are preserved across the upgrade.

5. Diagnostic Procedure

Follow the procedure in order. Stop at the first step that produces a clear result.

1. Confirm platform and firmware. On the LOGO! display: Menu > Diagnostics > Device Information. Note the Type (must contain 0BA8.1) and the FW (must be V1.81.03 or earlier in the 1.81.x line).
2. Verify the rest of the VM range is healthy. From the S7 partner CPU issue a single PUT / GET to read VM 0..274 and VM 486..1023. If these fail as well, the issue is not the FS6 VM buffer; investigate TSAP, network, or partner CPU configuration.
3. Test the suspect range directly. Read VM 275..485 byte-by-byte. On a healthy unit you should see the LSC-side live values. On a defective V1.81.03 unit the read returns a static value, a pattern such as 0x00 or 0xFF, or an S7 error code from the partner (e.g., W#16#80A1 application error, W#16#80B1 illegal address).
4. Cross-check with the on-board VM viewer. On the LOGO! display navigate to the VM list and confirm the same addresses (VM 275..485) show live values. If yes, the failure is on the S7 server path only, not the data itself.
5. A/B swap with a 0BA8.0. Transfer the LSC project, IP, and TSAP configuration to a 0BA8.0 of the same article family. If the S7 reads succeed, the root cause is confirmed: V1.81.03 on 0BA8.1.
6. Capture a Wireshark trace of the S7 communication (TCP port 102) between the partner CPU and the LOGO! while reading the suspect range. The LOGO! server either responds with the wrong length, a 0x0D data error, or returns PDU payload with the reserved buffer pattern. Attach the trace to a Siemens Support Request (SR).

5.1 S7 partner-side error codes

6. Workarounds (Before Firmware Update Is Available)

If a firmware update to V1.81.04 is not immediately available, the following workarounds unblock the application while keeping the 0BA8.1 hardware.

6.1 Move the user data out of VM 275..485

Reassign the S7 partner's PUT/GET addresses to VM 486..1023 (538 bytes) and re-engineer the LSC blocks to use the new VM offsets. This costs LSC redesign effort but eliminates the dead range from the S7 path. The first 275 bytes of VM remain usable.

6.2 Use Marker / Input / Output mirror blocks

For small amounts of data (a few bytes), reflect the needed variables into the Marker (M) area or into a free Input/Output slot. The S7 server path for M / I / Q is unaffected by the FS6 buffer defect. A small LSC block in LOGO!Soft Comfort such as:

// LSC: copy VM 275..284 to M 1..10 each cycle (FB "Analog Mux")
// Or use the "Math" function block to pack/unpack bytes
// The S7 partner then reads from M 1..10 instead of VM 275..284

6.3 Replace the 0BA8.1 with a 0BA8.0 (temporary)

If a spare 0BA8.0 module is available and the application does not need Fail-Safe blocks, swap the unit. The S7 read/write to the entire VM range will be healthy. Keep the original 0BA8.1 aside for re-installation after the firmware is updated.

6.4 Open a Siemens Support Request

Attach:

• Article number of the LOGO! 0BA8.1 module (read from the side label).
• Firmware version (from the device info page).
• Network topology: partner CPU type (S7-1200 / S7-1500 / third party), IP, TSAP.
• The LSC program as a .lsc / .lscx zip.
• Wireshark trace with the failed read of VM 275..485.
• A/B swap proof (same program on 0BA8.0 with the same IP/TSAP works).

7. Firmware Update Procedure (V1.81.03 → V1.81.04)

The update path is the standard LOGO! firmware update. For FS6 modules some article numbers require a Siemens-issued SD card; verify in the firmware readme that the Ethernet path is permitted for your article.

1. Download the firmware V1.81.04 image from Siemens Industry Online Support (search for "LOGO! 8.FS6 firmware update 1.81.04"). Verify that the article prefix of the firmware package matches your module.
2. Place the firmware image at the root of a micro-SD card formatted as FAT32. The file name follows the Siemens convention <ArticleNumber>_V1.81.04.upd.
3. Power off the LOGO!. Insert the SD card.
4. Power on. The LOGO! detects the firmware image and asks for confirmation on the display: Update firmware? Yes / No. Select Yes.
5. Wait for the progress bar to complete and the unit to auto-reboot. Do not remove power or the SD card during the update.
6. After reboot, navigate to Menu > Diagnostics > Device Information and confirm the new FW line reads V1.81.04.
7. Retest the S7 read of VM 275..485.

8. Verification Tests After the Update

Run the following checks in order. Each step has a pass criterion; do not move on if a step fails.

1. Read VM 0..1023 in one PUT/GET cycle from the partner CPU. Pass: all 1024 bytes return their expected values.
2. Write-then-read back a known pattern (0xA5A5A5A5...) into VM 275..485. Pass: read-back matches the pattern exactly.
3. Cycle test: run the LSC program for 10 minutes while the S7 partner reads VM 275..485 at 100 ms intervals. Pass: no S7 error codes, no PDU 0x0D data errors in Wireshark.
4. Power-cycle test: remove power for 30 seconds, restore. Pass: VM 275..485 retains its values (retentive behavior preserved) and the S7 reads remain correct.
5. Safety validation (FS6 only): re-run the safety acceptance test in LOGO!Soft Comfort and re-sign the project.

9. Long-Term Mitigation and Best Practices

• Reserve the "red zone". In all LOGO! 8.FS6 projects, keep application data out of VM 275..485 on any firmware < V1.81.04. This avoids the defect even on legacy units that have not been updated.
• Use the canonical TSAP. Configure the partner CPU with the LOGO!'s IP-derived TSAP (01.00 + 2 bytes from last IP octet). Mis-typed TSAPs can mask other address-conversion bugs and make diagnosis harder.
• Enable access protection explicitly. In LOGO!Soft Comfort, set the "Allow S7 communication" / "Allow Web access" flags per the project security policy. A 0x80C3 error on the partner side is usually a missing access-protection grant, not a firmware bug.
• Standardize on a single LOGO! hardware revision per project. Mixing 0BA8.0 and 0BA8.1 in the same S7 network is technically supported but creates two VM behavior baselines; keep the network homogeneous to reduce the diagnostic surface.
• Subscribe to Siemens Product Safety and Security Advisories. The V1.81.04 release bundles a security fix; track the SSA (Siemens Security Advisory) database to know which firmware to lock down to.

10. Related Architecture: S7 Communication Path

For engineers new to LOGO! 8 S7 communication, the following minimal architecture is useful. LOGO! acts as an S7 server; the partner (S7-1200, S7-1500, S7-300, S7-400, or a third-party S7 client) acts as the S7 client. Communication is ISO-on-TCP (port 102). The data exchange is the standard PUT / GET pair: PUT writes LOGO! data from the partner, GET reads LOGO! data into the partner.

For the S7 communication protocol specification and the standard PUT/GET behavior on ISO-on-TCP, see the Siemens TIA Portal function manual on S7 communication in the official documentation portal: S7 Communication Function Manual.

11. Field-Commissioning Checklist for Multi-LOGO! S7 Networks

When a network has 6–10 LOGO! 8 modules as S7 servers, run this checklist at commissioning to catch the VM 275..485 failure early:

1. List every LOGO! article number and firmware version. Reject any 0BA8.1 unit below V1.81.04 unless a workaround is in place.
2. Build a memory map spreadsheet: for each LOGO! list every VM byte used, and the LSC block that owns it.
3. Reserve VM 275..485 as a no-go zone on every 0BA8.1 below V1.81.04.
4. From the partner CPU, perform a one-time GET of the full VM 0..1023 of every LOGO! at commissioning. Save the snapshot for trend analysis.
5. Program a periodic background test in the partner PLC: every hour, read VM 275 of each 0BA8.1 LOGO! and compare to a sentinel value. A static read for > 1 hour flags the dead-range condition without waiting for a user-reported symptom.
6. Schedule the firmware upgrade to V1.81.04 during the next planned outage. The LSC project survives the upgrade.

12. FAQ