Diagnosing S5-135U CPU 928B Intermittent STOP and IStack Faults

Problem Summary

An S5-135U programmable controller fitted with a CPU 928B was experiencing intermittent STOP transitions with non-deterministic IStack entries. The fault could not be cleared through reset or restart, although the user program was stored on EPROM. Removing and refitting the fan tray temporarily restored RUN operation. Root cause was traced to a loose battery holder inside the fan tray subassembly, which had broken away from the chassis. Once the holder was mechanically refixed, the fault did not reappear over an extended monitoring period. The fix illustrates a class of CPU 928B faults where electrical contact or earthing integrity, rather than active component failure, drives the spurious STOP.

This article covers the hardware context, the meaning of the IStack/BSTACK pattern, the diagnostic path that leads to a fan tray/battery holder root cause, the field repair, and verification steps. It also documents adjacent failure modes on the 928B that produce similar symptom patterns.

S5-135U CPU 928B Hardware Context

The S5-135U is a mid- to high-range member of the Siemens SIMATIC S5 family, designed for complex discrete and process control tasks. Within the rack, the controller is composed of a central processing unit, one or more power supply modules, an optional fan subassembly (Lüftereinschub), I/O modules, and communication processors. The CPU 928B sits in the upper performance band of the 135U family and supports the full STEP 5 instruction set, extended function blocks, and a larger addressable I/O range than the non-B CPU 928 variant.

The official Siemens CPU 928B Programming Guide covers both the 928B-3UB11 and 928B-3UB12 versions and the system software specific to each. It is available on the Siemens Industry Online Support portal: S5-135U CPU 928B Programming Guide (PDF).

Backplane variants such as the CR 700-2LB and CR 700-3LB define which slots are reserved for power supplies and the CPU. The fan tray mounts above the backplane slots and connects via a dedicated power and signal connector. On 135U racks fitted with the temperature-monitoring variant of the power supply, a small NTC temperature sensor sits adjacent to one of the fans; this device also shares the same physical chassis region as the battery holder.

Power Supply Considerations

The power supply module is the most frequent source of intermittent STOP faults on legacy S5 hardware. Common S5-135U power supply order numbers fall in the 6ES5 95x family. Symptoms attributable to a marginal power supply include:

• Spontaneous STOP with different IStack causes on each occurrence.
• STOP that correlates with mains transients or with adjacent cabinet temperature changes.
• Recovery after power cycling or after reseating the power supply module.

If the supply voltages (typically +5 V logic and the +15 V/-15 V analog rails where fitted) remain within tolerance at the backplane and the supply's OK relay remains closed, the power supply can usually be excluded. In the documented case the supply voltages and OK relay were confirmed intact, which is consistent with a fault elsewhere in the rack. Field experience also notes that the front power-insertion contact on the supply can produce the same symptom pattern if its wiring or contact pressure is marginal; verify the front connector seating before withdrawing the module.

CPU 928B IStack and BSTACK Interpretation

On the CPU 928B, two stack structures describe the state of the controller at the moment of a STOP transition:

• IStack (Interrupt Stack): the deep stack saved on every interrupt or error event. Its first page records operation status, accumulator contents, status word, and the immediate cause of the fault. Its second page records the block stack pointer (the BSTACK).
• BSTACK (Block Stack): the call hierarchy at the moment of the fault, listing the FB/FC/PB/OB blocks currently active with their associated DBs.

To read these stacks on a programming device (PG) connected to the CPU, use the STEP 5 online functions:

1. Connect the PG and place the CPU in STOP.
2. From the STEP 5 menu, select Test > Stack I / Stack II (or the equivalent function on the PG firmware version in use).
3. Record the IStack page 1 status, the operation status field, and the BSTACK block list.
4. Repeat across several fault occurrences.

The diagnostic value of the stack pair lies in pattern recognition:

The symptom reported in the field case - "IStack info spurious, falls over at different points in program" - is the canonical signature of a non-deterministic, electrical fault. Whenever the BSTACK points to a different block on every recurrence, the source is almost always outside the program itself. Specifically, IStack page 2 should be checked first: power-supply-related disturbances are surfaced there, often before they become severe enough to force a hard STOP.

Symptom Pattern: Why a Mechanical Reseat Restores RUN

Two symptom attributes in the field report carry diagnostic weight:

1. Reset/restart cannot clear the fault. A non-clearable STOP on a CPU 928B holding the program in EPROM strongly suggests that a retentive fault flag has been latched, or that the CPU is rejecting restart because of an internal consistency check. On 928B hardware, the system status bytes retain across warm restart unless a URLÖSCHEN (cold restart, full memory erase) is performed.
2. Refitting the fan tray temporarily clears the fault. This is the strongest single clue. Reseating the fan tray disturbs every conductor that passes through the fan subassembly connector: the +5 V supply to the fans, the NTC temperature sense line (where fitted), and the battery holder ground reference. A reseat can momentarily restore a marginal contact, which suggests one of those conductors is the source.

Root Cause: Fan Tray Battery Holder Integrity

The S5-135U fan subassembly integrates the rack cooling fans and, on many configurations, the lithium backup battery that holds retentive data on the CPU's RAM. The battery holder is mechanically fixed to the fan tray chassis and is therefore handled every time the fan tray is removed. Over decades of thermal cycling, vibration, and battery replacement, the holder's mounting can loosen or fracture at the weld points.

When the battery holder becomes mechanically loose:

• The battery ground reference may float relative to chassis ground.
• The battery spring contact may intermittently lose pressure on the cell.
• The chassis return path for the fan supply and the NTC sense line may be disturbed.

The CPU 928B monitors the backup voltage and the integrity of the RAM under battery hold. A floating or intermittently open battery path produces noise on the supply rail that the CPU interprets as RAM corruption. The 928B responds by entering STOP and latching a fault that warm restart cannot clear. Because the underlying electrical condition is still present, the fault reappears - sometimes minutes, sometimes hours later.

The morning-failure bias reported in the original incident is consistent with this mechanism: thermal contraction overnight can relieve contact pressure on a marginal spring contact, and the first sustained write activity after warmup surfaces the noise as a RAM-integrity error.

Diagnostic Procedure

The following procedure isolates the fault to the fan tray battery holder path. Adapt to site safety rules; rack down before reseating any module.

1. Capture the current fault. Place the CPU in STOP via the mode selector if it has not already done so. Connect a PG and read IStack page 1, IStack page 2, and BSTACK. Photograph or print the screens.
2. Check power supply health. Measure +5 V at the backplane logic test points (typical tolerance ±5%). Verify the power supply OK LED and the OK relay contacts. Examine the power supply front-edge connector for discoloration and verify its seating.
3. Inspect the battery. Measure battery voltage at the battery holder terminals with the rack powered down. Replace the battery if voltage is below the threshold specified for the 928B variant in use; refer to the CPU 928B Programming Guide for the exact value.
4. Remove the fan tray. With power removed and ESD precautions observed, release the fan tray latch and withdraw the subassembly. Inspect the connector at the rear of the fan tray and the mating connector on the rack for oxidation, bent pins, or contamination.
5. Inspect the battery holder mechanically. Examine the holder's weld points, mounting screws, and the spring contact. Wiggle the holder with light hand pressure to check for looseness against the chassis. This is the inspection that surfaced the root cause in the documented field case.
6. Refit and restart. Reseat the fan tray, re-apply power, and perform a warm restart. Record whether the CPU enters RUN.
7. Fault correlation. Compare the IStack cause on this event against the IStack from step 1. If the cause and BSTACK differ across events, the fault is non-deterministic and consistent with the electrical integrity hypothesis.
8. Long-duration test. Leave the system running for a minimum of 72 hours, including at least one overnight thermal transition. A clean 72-hour run is the field standard for declaring a 135U/928B STOP fault resolved.

Diagnostic Flow

Step-by-Step Repair Procedure

Once the battery holder is identified as the fault source, repair is straightforward. The order of operations matters because the 928B can hold a latched fault that survives warm restart.

1. Isolate the rack. Apply site lockout/tagout to the cabinet mains. Open the rack cabinet and verify zero energy on the power supply input.
2. Document program state. Read the BSTACK and IStack one final time for the maintenance record.
3. Remove the fan tray. Withdraw the subassembly and place it on a clean, ESD-safe surface.
4. Mechanically refix the battery holder. If the holder has lifted from the chassis, clean the contact surfaces with isopropyl alcohol, then re-seat and secure. Suitable fasteners depend on the rack revision: M3 self-tapping screws into the original bosses, or a small metal bracket bonded to the chassis. Avoid adhesive-only fixing where the battery is replaced periodically.
5. Inspect the spring contact. Verify that the contact exerts visible pressure on the cell. If the spring is fatigued, replace the holder assembly. Refer to the rack documentation for the exact part designation.
6. Refit the fan tray. Ensure the rear connector is fully seated and the latch is closed.
7. Restore power. Re-energise the rack. Watch the CPU LEDs and the power supply OK relay.
8. Perform a URLÖSCHEN (cold restart) only if warm restart fails. A cold restart clears all RAM, including the latched fault flag. If a URLÖSCHEN is performed, allow the CPU to reload the program from EPROM and confirm that initial DB values match the design.
9. Enter RUN and verify cyclic operation. Watch the cycle time on the PG and confirm that I/O update is active.
10. Log the event. Record the IStack before repair, the IStack after repair, the physical fault found, and the corrective action.

Verification and Commissioning

A repair on legacy S5 hardware is not complete at "the CPU is in RUN." The fault was intermittent, and the verification must be longer than the worst observed fault interval.

• Cycle time check. Compare the current OB1 cycle time against the design maximum. An unexplained increase may indicate that the CPU is executing extra error handling.
• Battery status flag. Monitor the battery status bit in the system data. On a 928B, the battery flag is checked by OB1 and can be displayed on the PG.
• IStack log. Many sites keep a rolling log of IStack captures. Confirm that no further STOP events occur over the verification period.
• Thermal cycle. Allow at least one full day-night thermal cycle of the cabinet. Morning-failure bias is the most informative single test for marginal contact integrity.
• 72-hour unattended run. This is the field standard for declaring an S5-135U STOP fault resolved.

Related Failure Modes to Investigate

If the fan tray battery holder is intact and well-fixed, the following failure modes produce similar symptom patterns and should be excluded:

Two of these modes deserve specific mention. First, the temperature-sensor NTC on the fan tray (where fitted) shares the same physical region as the battery holder. If the NTC opens, the power supply may interpret the temperature as out-of-range and force a STOP. The S5-135U peripheral handbook describes the procedure to bypass the sensor for diagnostic purposes - this should be done only temporarily to confirm the diagnosis, never as a permanent fix.

Second, on an aged CPU 928B that has been in service for many years, the internal logic itself can begin to fail. The hallmark is a fault frequency that increases over months rather than appearing as a single recurring incident. Where the maintenance budget permits, a verified-good spare CPU is the fastest confirmation.

Preventive Maintenance Recommendations

For an S5-135U installation that must continue to operate reliably, the following PM practices reduce the probability of recurrence.

• Annual battery test. Measure battery voltage under load, not just open-circuit. A battery that reads correctly open-circuit can still sag under load when its internal resistance has increased.
• Mechanical inspection of the fan tray. During each annual outage, withdraw the fan tray and inspect the holder, spring contact, and connector for signs of fatigue.
• Keep a spare CPU module. A verified-good spare 928B on the shelf is the fastest way to distinguish a CPU fault from a system fault.
• Fan rotation check. Verify that all fans (typically three on the 135U) rotate freely; seized fans raise internal temperature and accelerate aging of adjacent components.
• Cabinet thermal management. The morning-failure bias reported in the field case is reduced if the cabinet temperature is held within a narrow band, for example by cabinet air conditioning or by filtering the cabinet inlet air.
• Document the IStack history. A rolling log of IStack captures, kept at the cabinet, accelerates the next diagnosis.