Troubleshooting Siemens LOGO! Modbus Coil Writes from SCADA

Troubleshooting Siemens LOGO! Modbus Coil Writes from SCADA

Siemens LOGO! logic modules expose their I/O, marker memory (M), and network inputs (NI) over Modbus TCP. When a SCADA package such as Rapid SCADA 6 is paired with a LOGO! 8 (BAF/BAC/8.A variants) acting as a Modbus server, reading discrete inputs and coils typically works on the first connection attempt. Writing to those coils is where field engineers most often hit a wall: the device acknowledges the request, the SCADA reports success, and the physical output never toggles.

This reference covers the underlying Modbus map of LOGO!, the two distinct reasons a write command appears accepted but produces no actuator response, and the recommended coil substitutions (M-marker mapping) that bypass the limitation. It is written for commissioning engineers integrating LOGO! into distributed SCADA architectures over Modbus TCP on the built-in Ethernet port (port 502).

1. Problem Overview

Symptom signature from a typical deployment:

The communication line log shows the device acknowledges the write (no Modbus exception 02/03/04). The failure is therefore not transport-layer, but application-layer and is tied to how LOGO! resolves the target of an external Modbus coil write.

2. Siemens LOGO! Modbus Addressing Reference

LOGO! 8 firmware (device series 8.A1 / 8.A2 / 8.A3 / 8.FS4) implements Modbus TCP server functionality. The address map exposed to clients is documented in the LOGO! Communication Manual and the LOGO! Soft Comfort online help. The relevant segments are:

3. Root Cause: Why a Write Appears Successful but the Output Never Changes

3.1 Q1 is being overwritten by the program logic

On every PLC scan, LOGO! executes the user program compiled in LOGO! Soft Comfort. The block connected to Q1 evaluates new inputs and writes the result to the physical output register. Even if the Modbus server temporarily sets Q1 to 1 in response to function code 05/15, the next program scan overwrites that value because the LOGO! program is the authoritative owner of Q1.

This explains the asymmetric behavior in the symptom table:

• Q2 toggles correctly only because no program block drives Q2. The PLC never overwrites it, so the Modbus-forced value persists.
• Q1 does not toggle because Q1 has an active assignment in the program (for example, an S/R block, AND/OR gate, or self-holding circuit) that resets it on every scan.

This behavior is by design: physical outputs (Q) are intended as program-controlled targets. They are not arbitrary coils.

3.2 Network inputs (NI) are not writable from a Modbus TCP master

Network inputs (NI1 - NI64) and network outputs (NQ1 - NQ64) participate in LOGO!-to-LOGO! communication. NI represents an input value sourced from another LOGO! on the same network project, not a local writable coil. The Modbus server accepts the write to the NI address range only when the firmware recognizes the object as a writable coil in the current configuration. On most firmware revisions, NI addresses are mapped as input-type registers (Modbus function 02 / 04) and a function 05 write is silently treated as a no-op at the program level.

The right interpretation: network inputs are not user-controlled outputs. They are inbound remote signals. To have a SCADA-driven signal reach program logic, you must use either a marker (M) or a virtual output element exposed as a writable coil.

4. Recommended Path: Use Marker Memory (M) for SCADA-Issued Commands

Marker memory (M1 - M40) is the only Modbus-mapped space that satisfies both requirements:

1. It is fully read/write from a Modbus client.
2. The program can read it without immediately overwriting it.

Once the SCADA writes to a marker coil, the program can reference it as an input in any logic block. A marker-driven path also makes the SCADA command visible in the LOGO! program flow without racing the scan.

4.1 Mapping table for typical applications

4.2 Program-side wiring example (LOGO! Soft Comfort)

Inside LOGO! Soft Comfort, place a contact block referencing the marker and connect it to the output that needs SCADA control. For a remote enable of Q1:

Program fragment (LOGO! Soft Comfort, FBD notation):

   M1 (Coil input) --[ ]-- (AND) -- (S) Q1
                            |
                            +-- feedback from Q1 (self-hold)

This topology lets the SCADA-set marker pulse, set Q1, and have Q1 self-hold via its own contact. Releasing the marker no longer tears down Q1 because the holding contact takes over after the first set. To release Q1 from SCADA, use a second marker (M2) wired to the reset input of the same RS block.

5. Rapid SCADA Configuration for a LOGO! Channel

Rapid SCADA 6 (open source, repository github.com/RapidScada/scada-v6) uses an XML-defined communication line plus an address map. The following fields must match what the LOGO! exposes.

5.1 Communication line parameters

5.2 Channel (device) entries

For each logical signal, declare an input channel (read) or output channel (command/write). Sample rows:

Device: LOGO_01
  Channel 100  (Input  / Read)   - Modbus coil 8193 (Q1)        - Function 02
  Channel 101  (Input  / Read)   - Modbus coil 8194 (Q2)        - Function 02
  Channel 110  (Output / Command) - Modbus coil 8257 (M1)        - Function 05
  Channel 111  (Output / Command) - Modbus coil 8258 (M2)        - Function 05
  Channel 200  (Input  / Read)   - Modbus reg  1 (AIW2)         - Function 04
  Channel 201  (Output / Command) - Modbus reg  1 (AQW2)         - Function 06

Function code selection rules in Rapid SCADA 6:

• Function 01 (Read Coils) and 05 (Write Single Coil) for M markers.
• Function 02 (Read Discrete Inputs) for NI addresses.
• Function 04 (Read Input Registers) for analog inputs.
• Function 06 (Write Single Register) for analog outputs.

6. Diagnostics: Reading the Communication Line Log

When a write is reported as successful but no actuator change is observed, run the Rapid SCADA line diagnostic. Three log entries are diagnostic:

1. Request frame: confirms the SCADA assembled the correct transaction ID, protocol ID 0, length, Unit ID, function code, address, and value.
2. Response frame: shows the LOGO! echo (function code 05 = echoed; function 15 = echoed bitfield; function 06 = echoed register value).
3. Exception frame: a non-zero exception code indicates a true Modbus error. Codes commonly seen: 02 (Illegal Data Address), 03 (Illegal Data Value), 04 (Slave Device Failure).

If the log shows a normal response without exception, the LOGO! has accepted the write at the Modbus server level. The application-layer override is the reason the program output does not change. This is the diagnostic that separates "wrong address" from "correct address, wrong target".

A useful sanity check is to write the same coil via a free Modbus master utility and compare bytes. The manufacturer does not ship a generic Modbus master but LOGO! Soft Comfort's online test functions and any third-party Modbus poll tool will produce the same frame.

7. Byte Order, Word Swap, and Analog Encoding

When writing to analog registers (for example, an analog output AQW2), be careful about byte order. LOGO! 8 firmware stores 16-bit values in big-endian register order (high byte first). Modbus TCP is intrinsically big-endian, so the payload matches natively. The "byte swap" problem only appears when a SCADA bridge or gateway translates to a non-Modbus fieldbus.

For multi-word transfers, register order is sequential without internal byte swap. Example payload for writing the decimal value 1500 (0x05DC) to AQW2:

Modbus TCP frame excerpt (Write Single Register, function 06):
  Address : 0001   (AQW2)
  Value   : 05DC   (1500 decimal)
  Result  : AQW2 scaled output updates per analog block range

If your analog block is scaled 0 - 1000 mV, the SCADA must convert the engineering value to its scaled Modbus integer before the write. The conversion factor is configured in the LOGO! Soft Comfort block properties (Gain and Offset).

8. Workarounds and Engineering Choices

8.1 Use RS-latch blocks with marker inputs

This is the standard pattern in field deployments. The SCADA sets a marker; the program latches an output. To release the output, the SCADA pulses a second marker wired to the reset pin of the latch.

8.2 Use a network output (NQ) instead of NI for cross-LOGO! commands

Within a network project (multiple LOGO! units), a network output (NQ) sent from LOGO! A becomes a network input (NI) on LOGO! B. That NI is still not writable by the SCADA, but it IS writeable by the program on LOGO! A from one of its own M markers. The two-stage pattern (SCADA writes M on LOGO! A → program sets NQ → NI appears on LOGO! B) is a reliable way to bridge SCADA commands into network input slots when needed.

8.3 Avoid writing to Q directly except for hand-off debugging

Direct Modbus writes to Q1 - Q24 should be reserved for commissioning tests where the engineer needs to confirm that the physical output is wired correctly. In production, route everything through markers and program logic. This avoids surprise behavior when the program is reloaded.

8.4 Verify the firmware version

LOGO! 8 firmware behavior has been clarified in several ES (Engineering Service) updates. When the project is critical, record the exact firmware string from the LOGO! display (for example, "8.A3 / FS:04") and cross-reference with the current Siemens LOGO! product support pages. Newer firmware may slightly extend the writable marker range and the analog register map.

9. Step-by-Step Resolution Procedure

1. Export the address table. In LOGO! Soft Comfort, open Tools > Modbus Address Table and confirm the writable ranges for Q, M, NI, and AM.
2. Replace the NI channel with an M channel in the Rapid SCADA configuration. Change the function code to 05 (write single coil) and the address to 8257 + (n - 1) where n is the desired marker.
3. Insert a contact referencing M1 in the LOGO! program between an RS-latch input and the physical output.
4. Reload the program to LOGO! via Ethernet and observe the new block on the LOGO! display or in the online view of Soft Comfort.
5. Send a test write from the Rapid SCADA command interface (or any Modbus master) to the M coil. Verify the holding contact closes and the output latches.
6. Send a reset via M2 and verify the output releases.
7. Re-read Q1 from the SCADA to confirm the expected state.
8. Capture a communication line log during one cycle and file it with the project documentation.

10. Verification Matrix

11. Frequently Asked Questions