Replacing the Siemens SIMATIC S5 CPU 928/928B with a CPU 948: Engineering Migration, Fault Recovery, and OP17 HMI Integration

1. Overview

The Siemens SIMATIC S5-135U and S5-155U families accept a range of plug-in central processing units across the same backplane. Operators frequently upgrade an aging CPU 928 or CPU 928B to a CPU 948 to extend the useful life of the rack, gain additional bit/word/double-word throughput, and reuse the existing I/O, IM, and CP inventory. Although the CPU 948 is pin-compatible in the same S5-135U/155U mounting slot, the migration is not transparent: the CPU 948 carries a narrower BR (bit/byte result) memory, drops several operations supported only on the 928/928B, and is sensitive to stack-related runtime errors that the older CPU tolerated. A typical first-power-up fault is a steady "BASP" LED with a flashing "STOP" indicator, and operators following the swap with an OP17 operator panel can additionally see HMI errors $040 NOT PLC and $115 PLC RESTARTING on Profibus.

This reference consolidates the official Siemens support content (knowledge base ID 40191 on the 928B → 948 replacement, the 6ES5 997-3UA22 List of Operations, and the CPU 928B Programming Guide) with the field procedure required to recover from the most common failure modes after the swap.

2. Affected Hardware and Reference Documentation

Cross-reference these documents before initiating a swap:

• Replacing the CPU 928B with a CPU948 - Siemens Support ID 40191
• List of Operations S5-135U/155U CPU 928/CPU 928B/CPU 948 (PDF)
• SIMATIC S5 CPU 928B Programming Guide (PDF)

3. Hardware Migration Prerequisites

Before removing the CPU 928/928B, capture a complete archive of the active project so that any incompatibility can be reproduced offline:

1. Read the project from the active CPU using STEP 5 (PG 685/720/730/740/750/760 or PC with S5 driver) and store the *ST, *SB, *PB, *FB, *FX, *DB, *OB, *DX0, and *AB files in a project directory.
2. Read the IStack (interrupt stack) and BStack (block stack) of the running CPU and save them to a text file. These are the only diagnostic artefacts the 928/928B exposes when the user program crashes, and the same technique is required for the 948.
3. Print or PDF the cross-reference list (XR) and the assignment list (IA) for comparison after the swap.
4. Verify that all IM (interface) modules and CPs in the central and expansion racks are supported by the CPU 948 firmware revision actually installed. The 948 firmware is hardware-coded into the EPROM submodule; mismatched firmware is a common cause of a non-starting CPU.
5. Note the position of the EPROM/RAM submodule (e.g. 6ES5 375-0LD21) and the battery (e.g. 6ES5 980-0AE11) so the new CPU is populated identically before commissioning.

4. BR Memory Architecture: 32-bit vs 20-bit (the Source of Many Stop Conditions)

Per Siemens Support entry 40191, the CPU 928/928B implements a 32-bit BR (bit-result) memory, while the CPU 948 implements only a 20-bit BR memory. The CPU 928B does not use the BT (byte/double-word result) range internally, but it does permit operations that deposit results in BR and BT. When the same user program is executed on a CPU 948, any result accumulator wider than 20 bits is truncated. Truncation of accumulator contents in arithmetic blocks (typically FB blocks using ADD, SUB, MLD, SLD, DED, DEF, DUD, DUF) produces wrong values rather than a CPU stop, so the migration can pass initial testing while corrupting production data.

The migration is therefore an opportunity to:

• Audit every FB in the project that uses LW/LD/RW/RD operands with a width wider than 20 bits.
• Replace the implicit BR/BT usage in custom blocks with explicit TB/TNW/TW/TD transfers, or break the calculation into 16-bit segments that the 948 handles natively.

5. DX0 Configuration: Selecting the New CPU Type

The CPU 928/928B and CPU 948 share the same DX0 (system data) layout for rack/IM assignment, OB masking, and process interrupt settings. The *DX0 binary contains a CPU-type field that STEP 5 evaluates when downloading. After the physical swap, follow this procedure before the first RUN attempt:

1. Insert the new CPU 948 with the EPROM submodule removed; apply power. The CPU should remain in STOP with no program present.
2. Connect the programmer and read the current *DX0 (it will be the default for the 948 firmware revision on board).
3. Open the DX0 editor in STEP 5; the CPU-type selector prompts you to confirm whether the new CPU is a 922, 928, 928B, or 948. Choose 948 and save the *DX0 back to the CPU.
4. Place the EPROM submodule back in the slot and perform a complete COLD RESTART (selector switch from STOP → RUN with the reset button held) so the CPU 948 reinitialises the PA and PI image tables against the configured rack layout.
5. Verify that the RUN/STOP switch transitions cleanly to RUN. If the CPU re-enters STOP within 1–2 seconds, read the IStack immediately and proceed to Section 6.

6. Diagnosing BASP/STOP with IStack and BStack

The classic post-swap condition — a steady "BASP" LED combined with a flashing "STOP" indicator — means the CPU 948 has executed an OB-19/OB-23/OB-24 stack-failure path or detected a programming error. Unlike the 928/928B, the 948 does not re-execute the previous cycle; it goes hard to STOP and remains there until the IStack is read. The fastest diagnostic path is:

1. From STEP 5, place the CPU in STOP, choose PLC → IStack, and read the interrupt stack. The IStack reports the level (register nesting depth), the SAC (step address counter) at the failure, the DB/DX number active, and the OB that was executing.
2. From STEP 5, choose PLC → BStack and read the block stack. The BStack lists every FB/PB/OB/SB that the CPU was traversing at the moment of the stop. The deepest block at the top of the BStack is the candidate for the failure.
3. Map the SAC against the STEP 5 program printout. The exact statement, the block number, and the operation are now known. A typical finding after a 928B → 948 swap is a TNW or TAW using operands that the 948 supports but at a different width.
4. If the BStack contains a TNB at the failure point, proceed directly to Section 7. The presence of a TNB (test bit, no operation on byte) is the single most common root cause of a 948 immediate STOP after a 928B swap.

7. TNB / TNG Instruction Compatibility

Per the 6ES5 997-3UA22 List of Operations, the TNB (Transfer/No Operation Byte) and TNG (Transfer/No-operation Group) instructions are not part of the CPU 948 operation set. They exist in the CPU 928/928B and in the CPU 922, but the 948 rejects them at runtime. If the user program loaded from the 928/928B contains even one TNB or TNG, the CPU 948 will not execute that block and will go to STOP with the BStack pointing at the offending statement.

Detection methods when the program is large and the engineer did not write it:

1. Open the STEP 5 program in the cross-reference / operation-set view and filter on the operations list. STEP 5 highlights TNB/TNG in red when the configured CPU is a 948, even before download.
2. Use the DOC function in STEP 5 to dump the full list of operations used in every block, then search for TNB and TNG.
3. For each occurrence, replace the TNB with the equivalent TNW (transfer/no operation word) or a literal L + T pair, depending on what the original author intended.
4. Save the corrected block back into the EPROM submodule, repeat the cold restart, and re-read the IStack.

8. OP17 HMI Reconfiguration with ProTool

After the CPU swap, the OP17 operator panel continues to expect a CPU 928 on Profibus unless the ProTool project is reconfigured and re-downloaded. The OP17 stores the target CPU type in its project file, and the panel will not accept a 948 handshake on the wire. Symptoms include $040 NOT PLC (panel cannot establish a Profibus connection to the PLC) and $115 PLC RESTARTING (PLC is cycling STOP/RUN faster than the panel can complete its startup handshake).

1. Open the OP17 project in ProTool (version matched to the OP17 firmware — ProTool/Lite V5.2 or ProTool V6.0 for the FK20/FK30 panels).
2. In PLC → Parameters, change the PLC type from "SIMATIC S5 928B" to "SIMATIC S5 948". The default Profibus address, slot, and rack parameters are identical between the two CPUs, so no further parameter changes are required.
3. Recompile the project and download it to the OP17 via serial (RS-232, ProTool) or Profibus. The OP17 will restart and clear any pending error buffer.
4. Re-establish the Profibus connection and confirm the green "PLC OK" symbol on the OP17 status bar.

9. HMI Error Code Reference

10. Profibus Integration and Cable Verification

For an S5-135U/155U with a CP 5431 (6ES5 543-1AA11 / 6ES5 543-1AB11) acting as the Profibus master, the Profibus database (*DB configured for the CP) is independent of the CPU type. The same configuration works for both the 928/928B and the 948. Verify the following before commissioning:

• Profibus connector on the OP17 is wired straight-through (pins 1 and 2 on both ends, shield bonded at one end only).
• Terminating resistors are ON at the two physical ends of the Profibus segment only.
• OP17 Profibus address matches the value configured in the CP 5431 FMS/DP database (default 3 for the OP17, default 2 for the CP 5431).
• Baud rate of the segment is consistent across all nodes (1.5 Mbit/s is the common S5 Profibus rate; 12 Mbit/s is supported only on CPU 948 with CP 5431 firmware V2.0 or later).

11. Step-by-Step Commissioning Procedure

1. Insert CPU 948 (no EPROM), read and save DX0 with the CPU-type field set to 948.
2. Insert EPROM submodule and perform a cold restart.
3. Read IStack and BStack. If STOP, apply the fix from Section 7 (TNB/TNG) and re-archive the EPROM.
4. Once RUN is held for at least 60 seconds, observe outputs against the assignment list.
5. Reconfigure the OP17 ProTool project for the 948, recompile, and download.
6. Clear the OP17 error buffer (System → Diagnostics) and confirm $040 and $115 are gone.
7. Run a full I/O walk-down and a fault-injection test on the safety-relevant outputs.

12. Troubleshooting Matrix

13. Verification

After the swap, confirm migration success with the following checks:

1. CPU remains in RUN continuously for at least 1 hour under load.
2. OP17 displays PLC OK and shows no error codes on a power-cycle.
3. All FB blocks with previously 32-bit results produce the same numerical output as the 928/928B archive (delta ≤ 1 LSB on the new 16-bit calculation).
4. The IStack and BStack are clean on the next planned maintenance stop — no unhandled OB19/OB23/OB24 entries.
5. ProTool diagnostic log on the OP17 is empty.

14. Field Notes and Caveats

• Always keep the original 928/928B on the shelf after a successful migration; some custom FB blocks written against the 32-bit BR are difficult to convert, and rolling back may be the only practical solution for a short-notice shutdown.
• If the line is mission-critical and the next shutdown is weeks away, restoring the 928/928B to keep production running while the conversion is finalised offline is a defensible engineering decision. Document the temporary configuration in the maintenance log.
• Do not assume a CPU 948 firmware revision will accept an EPROM written for a different firmware revision. Use the same revision on both sides of the swap, or plan a complete re-archive of the project.
• The CP 5431 Profibus parameters are CPU-type-agnostic, but the CP firmware should be V2.0 or later for 12 Mbit/s segments with a CPU 948.