Recovering S5-135U CPU 928 HMI Password Codes from DB10

Overview

The Siemens SIMATIC S5-135U with CPU 928/928B is a legacy multiprocessor PLC still found on packaging machines, textile lines, and metal-forming presses installed between the mid-1980s and late 1990s. A recurring field failure on these systems is loss of the 4-digit numeric HMI access codes after the lithium backup battery discharges, causing the user program to wash out. When the program is reloaded from a serial S5 backup file (for example 260397ST.S5D or [email protected]), the data blocks are restored, but the integrator often discovers that the HMI password for Machine Data / Motor Parameters no longer matches the default 0000 and is unknown.

The access codes are not stored as binary integers. They are stored as two ASCII characters per data word (DW) in DB10 and are initialised by FB251 during PLC startup. This article documents the exact storage location, the ASCII/KS decoding procedure, and a step-by-step recovery workflow that has been validated on production S5-135U / CPU 928 systems.

Problem Details

Symptom signature observed on the affected line:

• Operator HMI (typically a Pro-face GP series or Siemens OP series terminal communicating over the S5 ASCII driver) prompts for a 4-digit access code before allowing Machine Data edits such as motor ramp, current limit, or PID setpoint.
• After reloading 260397ST.S5D the access code prompt accepts 0000, indicating the password data block is empty.
• After reloading [email protected] the prompt rejects 0000, confirming the password has been restored to a non-default value that the maintenance team no longer has recorded.
• PLC restart is not possible without losing the commissioning values, so a hard reset is unacceptable.

Root Cause: Where the Password Is Stored

The HMI access codes for the S5-135U CPU 928 are not stored in the HMI terminal itself. They live in PLC data block DB10, written during the startup pass by function block FB251. FB251 is invoked from the warm restart organisation blocks OB20 / OB21 / OB22, the standard SIMATIC S5 restart entry points.

The data layout in DB10 for the four access levels is:

A control word sits in DW 7 of DB10: when it is loaded with 0 at startup, FB251 overwrites DW 42-49 with the default code 0000. Any non-zero value in DW 7 preserves whatever codes are present in the data block.

Technical Background: KS Format and the CPU 928 Memory Model

The CPU 928B uses 16-bit data words. The KS data type (Konstant-String, character constant) packs two ASCII characters into one 16-bit word: the high byte holds the first character, the low byte holds the second. This is why a 4-digit numeric code occupies two consecutive data words rather than one.

The relevant excerpt of the FB251 program (recovered from the S5 backup file STER02ST.S5D) is:

L  KS 00      ; CODE 0000 = DEFAULT EINSTELLUNG
T  DW 42      ; CODE 1
T  DW 43
T  DW 44      ; CODE 2
T  DW 45
T  DW 46      ; CODE 3
T  DW 47
T  DW 48      ; CODE 4
T  DW 49

The CPU 928B architecture and the full instruction set are documented in the official Siemens programming guide, available from Siemens Industry Online Support:

• S5-135U CPU 928B Programming Guide (PDF) — areas of application, device structure, address assignment, and instruction list.

For HMI integration, the Pro-face GP-Pro EX device driver reference for SIMATIC S5 CPU serial connections is the authoritative document:

• SIMATIC S5 CPU Direct Driver Manual (PDF) — covers protocol selection, cable wiring, and the memory areas exposed to the HMI for password polling.

Decoding the Stored ASCII Value

A STEP5 Variable Table (VAT) opened in KS format shows each DW as two ASCII characters. When the same table is opened in KH (hexadecimal) format, the same DW appears as a 4-digit hex value. The hex-to-ASCII conversion is direct:

Concatenating each pair of words yields:

The code that unlocks the Motor Parameter screen on the affected machine is therefore 2503, confirming the four-level scheme.

Step-by-Step Recovery Procedure

Use this procedure on a live S5-135U with CPU 928 when the HMI access code is unknown but the program and data blocks are intact.

1. Connect an MPI / serial programming cable to the CPU 928's PG port and bring up STEP5 (or the S5-DOS / PG2000 compatible tool you have licensed).
2. From the project, force the CPU into STOP and open DB10 in the Data View.
3. Set the format selector to KH (hexadecimal). Read DW 42 through DW 49 and write the values down.
4. Convert each 16-bit hex value to its two ASCII characters using the table above (high byte = first digit, low byte = second digit). The result is the 4-digit code for that level.
5. If the HMI still rejects the code, verify that DW 7 of DB10 was not zero at the last startup. If it was zero, FB251 has already overwritten DW 42-49 with 0000 and the original codes are gone.
6. To force a code change without losing machine data, edit DW 7 to a non-zero value (for example KH 0001), then set DW 42-49 to the new ASCII-encoded codes, and perform a warm restart. FB251 will not overwrite non-default values once DW 7 <> 0.
7. Confirm the new code is accepted on the HMI before placing the line back in production.

Verification

After applying the decoded code, validate the recovery with the following checks:

1. On the HMI, navigate to the Machine Data / Motor Parameter screen and enter the decoded 4-digit code. The screen must accept the entry and display the editable fields.
2. Read back DW 42-49 in KS format from the online VAT and confirm the value matches the code you entered.
3. Cycle power to the PLC and re-enter the code on the HMI. The password must persist; if it reverts to 0000, DW 7 is being cleared at startup and FB251 is re-defaulting the codes.
4. Trigger a controlled HMI logout / login cycle to confirm the level-to-permission mapping (Level 1 cannot reach motor data, Level 4 can).

Troubleshooting Matrix

Reading an Unfamiliar S5 Program

For engineers inheriting a battery-washed S5-135U project, the most efficient way to locate password and parameter storage is the same method that revealed the FB251 / DB10 relationship above:

1. Open the program listing (printing the FBs/DBs/OBs to a PDF for annotation) and start at the restart OBs — OB20 (manual warm restart), OB21 (automatic warm restart), OB22 (cold restart). The CPU 928 invokes exactly one of these on every startup.
2. For every block called from those OBs, follow the SPA FB / SPB FB / JU FB calls. Almost every password and parameter default is set in this chain.
3. Look for L KS loads. The KS format is the S5 idiom for a 2-character ASCII constant and is the strongest signal that the next T DW instructions are password- or identifier-related.
4. Keep a cross-reference of T DW targets. A data block that has exactly eight T DW writes to consecutive even-numbered DWs is almost always the password table.
5. Use the comment column in the original S5 backup. German keywords such as CODE, KENNUNG, EBENE (level), and MASCHINENDATEN (machine data) identify the right blocks even when the rest of the program is uncommented.

Edge Cases and Field Caveats

• Non-numeric codes. Although the affected line stores a 4-digit numeric code, the S5 schema supports any two printable ASCII characters per DW. If DW 42 = 4142 the level-1 code is AB. Always decode as ASCII, do not assume decimal.
• Byte swap on transfer. STEP5 displays the high byte on the left, but the CPU writes the low byte first. When you read DW 42 as KH 3330 the first character you must type on the HMI is the high byte (3), not the low byte (0).
• EPROMS / EEPROMs. If the project resides on a Flash EPROM submodule, the password is part of the firmware image and is restored automatically. The fault described in this article only manifests when DB10 lives in the RAM area protected by the lithium battery.
• Multi-CPU racks. The S5-135U can host more than one CPU. Confirm which CPU is the password owner (usually the one with the HMI port) before editing DB10 — the same DB number can exist on a second CPU with different content.
• FB251 variants. Some machine builders use FB250, FB252, or a renamed copy (for example FB200) for the same purpose. Search for the KS pattern rather than the exact block number.

Related Documentation

• S5-135U CPU 928B Programming Guide (Siemens Industry Online Support)
• SIMATIC S5 CPU Direct Driver Manual (Pro-face GP-Pro EX)