Learning STEP 5: Program Structure, OBs, Memory, and Instruction Set

STEP 5 is the Siemens programming environment for the SIMATIC S5 family of programmable logic controllers. The S5 line entered service in 1979 and remained in volume production through the mid-1990s, and tens of thousands of machines in the field still depend on it. This reference consolidates the architecture, block model, memory map, and instruction set you need to read, write, and troubleshoot STEP 5 programs. Every section ends with a verification step you can run on a physical PG (programmer) or in the S5-DOS/Windows simulator.

1. STEP 5 and SIMATIC S5 Architecture

STEP 5 is the engineering software; SIMATIC S5 is the PLC family. The CPU you target determines memory size, block count, and instruction support. Memorize the CPU class because every block, address, and timing parameter is qualified by it.

STEP 5 itself was shipped in many versions; the last DOS-based release is STEP 5 V7.2 (file set 6ES5 894-7MA02, 6ES5 894-7MA03), with a Windows port under DOS/Win. Programming devices supported range from the PG 685 (CP/M-86) through the PG 720, PG 740, PG 760, and Field PG with the AS 511 serial interface or the SINEC L2 interface module (CP 521, CP 524, CP 5431).

2. Prerequisites: Hardware, PG, and Cable Setup

1. Programming device (PG). Any PG running STEP 5 V6.x or V7.x, or a modern PC with a USB-to-RS232 adapter plus the AS 511 protocol stack from S5Tools/SIMATIC S5 for Windows.
2. AS 511 cable (TTY or RS232). The 6ES5 734-1BD20 TTY cable is the original; 6ES5 734-1BD60 and 6ES5 734-1BF20 cover RS232. Modern equivalents use the IBH Link S5 / S5-LAN gateway (not Siemens, used as a field bridge) but the protocol payload is the documented Siemens AS 511.
3. STEP 5 media kit. 3.5" floppy or downloaded archive. Mount the “Basic” disk and the “Optional” disk with the ‘F’ drives mounted for source files.
4. Online connection to the PLC. Confirm the S5 CPU is in STOP before connecting. The PG can cold-start the PLC after link setup.

3. Installing STEP 5 and Project Setup

1. Insert the STEP 5 installation floppy set. Run INSTALL.EXE from Disk 1.
2. Accept the default install path C:\STEP5 and choose your target S5 family (90U/95U/100U/115U/135U/155U). The installer writes different runtime DLLs per family.
3. After install, launch S5.EXE. The Project Manager shows available EXE files, S5D containers, and ST.S5D source files.
4. Create a new project: File → New → Program file. STEP 5 stores the active program in a binary EXE file plus source ST.S5D in the S5D container.
5. Set the target CPU under Settings → CPU type so the editor enforces the correct block and address range.

Verify: open File → Project info and confirm CPU family, total code memory, free memory, and revision number of the loaded S5.EXE matches the in-PLC CPU (PIQ/SFZ output via PLC → Operating state → Module information).

4. Program Block Architecture (OB, PB, FB, DB, SB, FX)

STEP 5 uses a strict block model. The CPU scans OB1 cyclically and that block (or its child calls) drives the rest of the program. Knowing what each block is for is half the battle.

Block numbers are 0–255 by default, expanded to 0–4095 on 155U. A block is uniquely identified by number and type: PB 17 differs from FB 17.

5. Memory Model and Address Allocation

The S5 memory is split into the same eight areas used by every Siemens PLC since the S3 era. The PG presents them as operands in STL, LAD, and CSF.

Address overlap rules: bit, byte, word, and double-word views share the same physical memory. MW 4 = MB 4 (high byte) + MB 5 (low byte). Always step word addresses by 2 to avoid straddling. There is no endian setting; Siemens S5 is little-endian with the low byte at the higher address.

6. Programming Languages: STL, LAD, and CSF

STEP 5 supports three source representations that share the same executable code.

• STL — Statement List (AWL). Mnemonic, machine-close. Used by service engineers for diagnostics, force workarounds, and patches. This is the canonical learning path because the STL-to-MC5 mapping is one-to-one.
• LAD — Ladder Diagram (KOP). Graphical, contact/coil. Best for digital logic and discrete I/O mapping.
• CSF — Control System Flowchart (FUP). Function-chart style, ideal for boolean and arithmetic block networks.

You toggle languages on a per-block basis: Editor → Presentation → STL/LAD/CSF. The internal representation is MC5 (machine code 5), a 16-bit 24-byte instruction. STEP 5 stores MC5 plus symbol and source comments in the ST.S5D file; the EXE file holds pure MC5 plus block headers.

7. Basic Bit Logic and Standard Instructions

The STL instruction set is compact. The table below lists the operations you will use in 90 % of service work.

Example: a latched motor starter with overload trip.

FB 12
NAME : MOTOR_START
   U   I 1.0        // Start pushbutton
   UN  I 1.1        // Stop pushbutton (closed contact)
   UN  I 1.2        // Overload relay
   O   M 12.0       // Seal-in contact
   S   Q 2.0        // Contactor
   UN  I 1.0
   UN  I 1.1
   R   Q 2.0
   U   I 1.2
   =   M 12.1       // Fault flag

Verify: load to the PLC (PLC → Download), switch to RUN, monitor block in Status (F8). All operand states should change in real time as you toggle inputs.

8. Timers, Counters, and Edge Detection

STEP 5 has 256 timer/counter words in 115U, fewer in 95U/100U. The time/count value is BCD 0–999 in the upper 12 bits of the word; the lower 4 bits are the binary time-base or ×0.01, ×0.1, ×1, ×10 seconds.

Example: 5-second on-delay to start a pump.

  U   I 5.0           // Start request
  L   KT 050.1        // 5.0 s (KT = constant time, KT 050.1)
  SD  T 17            // On-delay, timer 17
  U   T 17            // Timer done
  =   Q 4.0           // Pump contactor

Edge detection uses FP (rising edge) and FN (falling edge) flag patterns:

  U   I 6.0
  FP  M 20.0          // M 20.0 is the edge memory bit
  =   M 20.1          // One-scan pulse on rising edge

Verify: open Status in the timer/counter word view (View → Current values) and watch the value decrement in real time. For edge flags, use Status with RLO to confirm the pulse width is exactly one OB1 scan.

9. Organization Block (OB) Reference and Use Cases

OBs are the OS-to-application interface. The CPU calls them based on the listed trigger; you supply the program.

The S5 does not scan OBs the way a S7 scans OB1+OB35+OB82. Each OB is only entered if it exists in the EXE file; otherwise the OS executes the system default (typically a no-op or a STOP). Loading an OB121 with an empty body allows the PLC to continue on substitution errors instead of stopping.

Verify: insert BE (block end) only in OB1; never call OB1 from itself. Use Reference data → Cross-reference → Block call structure to see which OBs the program uses.

10. Data Blocks, Word Operations, and Indirect Addressing

DBs hold 16-bit words. Open a DB with A DB n (or C DB n in 115U) and read with L DW k, write with T DW k. The bit access D x.y works only when a DB is open.

  C   DB 50
  L   DW 10           // Load recipe word 10 into ACCU 1
  L   KH 03E8         // Load constant 1000 (hex)
  <F>                // Compare < in the editor
  JC  FB 200          // If recipe < 1000, call alarm FB

Indirect addressing on a DB word:

  L   KB 17           // Constant byte 17
  T   MW 100          // Use as index
  L   DW [MW 100]     // Indirect read of DW 17 in current DB

Verify: launch Test → Data block display, set Format to KH (hex), KF (fixed-point), or KT (time), and step through DW 0 to DW 255. Save the displayed DB to disk and diff against the previous commissioning baseline.

11. Online Functions: Status, Control, Force, and Commissioning

When the PG is online (AS 511 or SINEC L2), the following operations are available from PLC → ...:

• Status (F8). Live operand view; Status with RLO highlights which path of the STL is active.
• Control (F9). Modify outputs, flags, timers, and counters one shot at a time. Range-checked; illegal writes are rejected.
• Force. Pin a bit to a value; CPU ignores program writes to that bit until force is released. Use with extreme caution on safety circuits.
• Compress. Reclaims deleted-block space in EXE. Run after major block deletion.
• Memory reset (MRES). Cold image reload; clears all flags/timers/counters and non-retentive data.
• Block comparison. PG ↔ PLC diff for verification after upload.
• Documentation. Save ST.S5D, symbol table, and reference data with Project → Document → Save all.

Verify: after upload, run PLC → Compare → PG ↔ PLC for every block type and confirm the “identical” status for OB/PB/FB/DB.

12. Migration Path to STEP 7 / TIA Portal

While the focus here is learning STEP 5, every green-field S5 migration uses the S5 → S7 converter that ships with STEP 7 V5.x (Start → SIMATIC → STEP 7 → S5 → S7 Converter). The converter:

1. Reads the S5 EXE and ST.S5D,
2. Maps I, Q, M, T, C, DW to S7 I, Q, M, T, C, DB operands,
3. Translates STL to S7 STL with extension comments,
4. Flags unsupported FB calls (e.g. analog FB 250 on 155U) for manual rework.

For TIA Portal (V14+), S5 programs are not natively imported. The accepted workflow is: STEP 5 → STEP 7 V5.x → STEP 7 V5.5 (final S7-classic) → TIA Portal via “Migrate project”. Hardware conversion goes S5-115U → S7-300, S5-135U/155U → S7-400 or ET 200SP with PROFINET.

13. Verification and Common Errors

After writing any STEP 5 program, walk this checklist:

1. Block list shows every PB/FB/DB/OB you expected. No stray “???” placeholders.
2. Cross-reference shows each operand used and the blocks that touch it. Look for uninitialized flags (M 100.0 written but never read, or read before write).
3. Compare PG ↔ PLC after every download.
4. Status with RLO for OB1 confirms the cyclic scan is reaching the last statement in < 50 ms (S5-115U) or < 200 ms (S5-135U for a heavy program).
5. Diagnostic buffer (Status word / ISTACK) on the CPU shows no OB121/OB122 trips during a full 24-hour soak.

14. Field-Proven Tips

• Comment every block header and every network. STEP 5 comments live in ST.S5D; they are stripped from EXE on download, so always save the source.
• Use a symbol table (Symbols → Edit) for every I/O, and let the editor substitute I 1.0 ↔ MOTOR_START_PB. The symbol table is portable and survives project moves.
• Use FB parameter names (FB 12: MOTOR_START) so the same FB can be called with different DBs (instance DBs) on 115U/135U. This is the closest S5 equivalent to an FB instance in STEP 7.
• Back up the entire project (EXE + S5D + symbol table + reference data) weekly. S5 file sets are small (a few MB even for large projects); loss of ST.S5D is irrecoverable once the original PG is gone.

FAQ