Resolving CPU928B I/O Addressing Error on S5-135U: ISTACK ADF

Resolving CPU928B I/O Addressing Error on the SIMATIC S5-135U

The SIMATIC S5-135U programmable controller remains in service in many legacy plants, and the CPU 928B (order numbers 6ES5 928-3UB11 and 6ES5 928-3UB12) is one of the most widely deployed high-end CPUs in this family. One of the most common commissioning failures on this platform is a stop condition triggered as soon as an absolute input reference such as I 4.0 is downloaded into OB 1. The fault manifests as the red ADS (Adress-Decoder-Stop) LED illuminating, the STOP LED activating, and the interrupt stack (ISTACK) reporting an Adressierungsfehler (addressing error / stack identifier ADF). This reference walks through the underlying addressing model, the role of the special data block, and the exact procedure to clear the fault.

1. Problem Description

The reported symptom pattern is consistent and reproducible:

• A program consisting only of flag operations (F 30.0, F 4.5, etc.) downloads successfully and the CPU stays in RUN.
• As soon as an absolute process-input reference such as A I 4.0 is added to OB 1 and the block is reloaded, the CPU transitions to STOP.
• The ADS LED on the CPU 928B front panel is lit (steady red).
• The ISTACK read on the programmer displays the stop cause as "Adressierungsfehler" / stack ID ADF.
• The physical hardware: a single 6ES5 digital input module in the S5-135U rack with the address-selection jumper set to byte 4.

The single physical input module is correctly jumpered, but the CPU still rejects the I/O reference. This is the classic signature of a missing or incorrect special data block configuration (DB 1 or DX 0) that tells the CPU 928B which byte address is bound to which slot.

2. Hardware Architecture: S5-135U and CPU 928B

2.1 The 135U Rack Topology

The S5-135U uses a 21-slot rack (CR 700-0L, CR 700-0LB, or the 9-slot EG 185/EG 186 expansion units). Slot numbering is fixed, and the backplane assigns a default byte address to every slot. The standard mapping for a 135U central rack is summarized below.

The slot-to-address relationship is the foundation of S5 I/O access. When a STEP 5 statement references I 4.0, the CPU reads byte 4 of the process image of inputs (PII). The PII is refreshed from the backplane at the start of OB 1 cycle. If no physical module responds to byte 4 on the backplane at refresh time, the address decoder flags an Adressierungsfehler.

2.2 CPU 928B Variants and Firmware

Two hardware variants are relevant for the error class described in this article:

The full programming reference is published by Siemens as document CPU 928B Programming Guide, available from the Siemens Industry Online Support portal (file pa928ben.pdf, entry ID 19397726). Section 2.4.3 "Special Data Blocks" and Section 10.1 "Stop Causes and ISTACK Analysis" are the two chapters that govern the resolution described here.

Reference: CPU 928B Programming Guide (PDF) and Siemens support entry 19397726.

3. Root Cause: The Special Data Block Is Missing

The CPU 928B, like every S5-135U/155U CPU, uses a special data block (in German: Sonder-DB) to describe the I/O configuration. The CPU does not auto-discover modules; it relies on a static description loaded into DB 1 (or, when DX 0 is used as the system DB, into DX 0). The CPU cross-checks the configured byte map against the backplane reply at every PII/PIQ refresh. The moment a referenced byte is not in the configured list, the address decoder halts the cycle and sets the ADS LED.

The stack identifiers in the ISTACK for the relevant error class are:

The reported symptom — "ADS alarm led ON, ISTACK shows adressing error" — maps directly to the ADF cause. QVZ and PEF are not the same; a QVZ stop would indicate that the module is configured but the physical handshake timed out (wiring, addressing-jumper mismatch, or a dead channel), while ADF means the CPU does not know about the address at all. Because the program loads with F-flags, the CPU never exercises the address decoder, which is why flag-only programs do not trigger the fault.

4. CPU 928B Addressing Models

The CPU 928B supports two addressing modes, selectable by content of the special data block:

1. Fixed slot addressing (default). No DB 1 / DX 0 is required. The address is purely a function of the slot position. This is the simpler mode and is appropriate when the rack population is fixed and matches the default mapping.
2. Variable addressing via the special data block. The CPU reads the byte-list contained in DB 1 (or DX 0) and uses that list for both PII/PIQ refresh and address-decoder checks. This is the only mode that allows you to assign a non-default address (such as IB 4 to a module that physically sits in a slot whose default address is something else) or to mask out empty slots.

Because the user wants to reference I 4.0 but the module is jumpered to byte 4, the program assumes byte 4 is a valid PII input. The CPU must be told that byte 4 is in fact present. With a single 135U central rack and one DI module, either mode can be used:

• If the DI module is physically in the slot whose default address is byte 4 (slot 6 in the table above, or the appropriate slot for the rack variant), fixed slot addressing works without any DB 1 at all — but only when the default address of that slot is byte 4 and no other modules occupy adjacent slots with conflicting byte ranges.
• If the DI module sits in any other slot, or if the rack is non-standard, the special data block must list byte 4 as an input byte.

5. Anatomy of the Special Data Block (DB 1 / DX 0)

The special data block is a normal STEP 5 DB with a strict fixed record layout. The CPU 928B does not interpret every word; it expects the configuration records in a defined order. The relevant record types for I/O are:

The user's reported DB 1 contains exactly that skeleton (KH=4D41, KH=534B, KH=3031, KH=DE00, KF=+00004, KH=EEEE). This is the header only; no I/O entries follow because the count word is set to +00004 but no records of type I/O have been added before the EEEE terminator. The CPU reads the empty I/O list, concludes that no I/O is configured, and triggers the ADF stop the moment OB 1 references I 4.0.

The skeleton is correct in form but incomplete in content. The mandatory step is to insert the actual I/O configuration records between the count word and the EEEE terminator.

5.1 Record formats for inputs and outputs

Each I/O entry is one data word. The high byte is the function code, the low byte is the byte address. The function codes are:

For the reported case, the DI module is in the central rack and jumpered to byte 4. The DB 1 must contain at least one record of the form KH = 1004 (input byte 4). The complete corrected DB 1 is shown in section 7 below.

6. I/O Module Jumper Verification

Before writing the DB 1, the physical address-selection jumper on the 6ES5 DI module must be inspected. Siemens 6ES5 digital input modules (e.g. 6ES5 430-4UA12, 6ES5 432-4UA12, 6ES5 434-4UA12, 6ES5 436-4UA12) carry a DIL-switch or solder-jumper block that selects the byte address on the backplane.

1. Power off the rack before opening any module. The 135U backplane carries 5 V/15 V/24 V and several signal lines that are not hot-swappable.
2. Remove the DI module and locate the address-selection jumper block (referenced in the module's front-face label as "Adresswahl" or "S1").
3. Set the block to byte address 4. For a 4-bit binary-coded jumper, the pattern is 0 1 0 0 (LSB on the right); for a 3-bit block, 1 0 0 (LSB right).
4. Re-insert the module in the chosen slot, ensuring the backplane connector is fully seated.

7. Step-by-Step Resolution

The following procedure assumes a STEP 5 programmer (PG 685, PG 710, PG 720, PG 730, PG 740, PG 750, or a modern PC running STEP 5 V7.x with the COM 155 / CP 5511 / CP 5611 / USB-to-S5 adapter). All changes are made online with the CPU in STOP until the ISTACK is clean.

7.1 Prerequisites

• STEP 5 programming software (DOS-based or Windows-based) with online connection to the CPU 928B via the S5 programming port (15-pin D-sub, TTY / 20 mA current loop, or the V.24 adapter).
• CPU 928B Programming Guide open to section 2.4.3.
• Known slot position of every I/O module in the rack.
• Known jumper setting of every I/O module.
• Backup of the current program (do FILE > SAVE ALL BLOCKS > to PC before editing).

7.2 Procedure

1. Connect the PG, switch the CPU to STOP, and call the ISTACK display (function key F4 on a PG 685, or menu Debug > ISTACK on STEP 5 V7). Confirm the stop cause is ADF and note the failing address shown in the right-hand column.
2. Open DB 1 in the editor. The existing skeleton (KH=4D41, KH=534B, KH=3031, KH=DE00, KF=+00004, KH=EEEE) is kept; the EEEE terminator is moved down to make room for the I/O records.
3. Insert the I/O record(s). For the reported case (one DI module at byte 4, central rack, no outputs) insert:
   DW 5: KH = 1004 (input byte 4 in central rack)
   DW 6: KH = EEEE (end-of-list terminator, moved down)
4. Update the count word if necessary. With a single I/O record the value KF=+00004 should be reviewed against the manual; for a single-byte configuration the count is number of records × words-per-record + header overhead. The exact interpretation per Siemens section 2.4.3 is "number of data words in the configuration body excluding the terminator". For one record, the value is therefore +00001. Adjust DW 4 accordingly.
5. If outputs are also present, add additional records. Example: one output module at byte 0:
   KH = 2000
6. Save DB 1 to the CPU. The CPU remains in STOP.
7. Trigger a DB 1 reload by issuing a manual cold-restart sequence: switch the CPU to STOP, then turn the mode selector from STOP to RUN via the spring-loaded reset position, or use the PG command CPU > COLD RESTART. The CPU reads DB 1 fresh and re-initializes the address decoder.
8. Reload OB 1, OB 25, and any other program blocks.
9. Switch the CPU to RUN. The ADS LED should extinguish and the green RUN LED should illuminate within one cycle.

7.3 Corrected DB 1 Example (single DI module on byte 4)

0:  KH = 4D41;   (* 'MA' identification *)
1:  KH = 534B;   (* 'SK' special DB *)
2:  KH = 3031;   (* version '01' ASCII *)
3:  KH = DE00;   (* terminator of version string *)
4:  KF = +00001; (* one configuration word follows *)
5:  KH = 1004;   (* input byte 4 in central rack *)
6:  KH = EEEE;   (* end of list *)

7.4 Extended Example (DI byte 4 + DO byte 0 + DI byte 32 in expansion)

0:  KH = 4D41;
1:  KH = 534B;
2:  KH = 3031;
3:  KH = DE00;
4:  KF = +00003;
5:  KH = 1004;   (* input byte 4, central *)
6:  KH = 2000;   (* output byte 0, central *)
7:  KH = 3020;   (* input byte 32, expansion rack *)
8:  KH = EEEE;

For multi-CPU configurations, expansion racks, and S5-155U up-migrations, the same record format applies, but additional records (IM 304/IM 314 interface assignments, inter-CPU mailboxes) must precede the I/O list. Consult the CPU 928B Programming Guide section 2.4.3 for the full record set.

8. Verification

After the corrected DB 1 is loaded and the CPU is in RUN:

1. Read the ISTACK again. The stop cause should now be empty or "RUN - cyclic" with the address decoder content showing byte 4 as configured.
2. Force the physical input by applying 24 V DC to channel 0 of the DI module. Use a programmer status display (STATUS on the PG, or VAR > STATUS in STEP 5 V7) and observe I 4.0 transitioning to 1. The cycle time on the CPU 928B front-panel display should remain stable in the expected range (typically 5-30 ms for a small OB 1).
3. Execute the user's original logic: A I 4.0 = F 4.5;. Toggle the input and verify that flag F 4.5 follows.
4. Check the QVZ LED is off. If QVZ lights despite the address now being valid, suspect the jumper on the module, the backplane connector seating, or a failed input channel.

Reference: Siemens support entry 19397726 - CPU 928B Programming Guide.

9. ISTACK Analysis Reference

The CPU 928B ISTACK is divided into several layers. The most useful fields for I/O addressing faults are:

For the reported case, the ISTACK would show ADF as the stop cause, the ADRESSE field as byte 4, and the ANWEISUNG as the A I 4.0 line. This triple is the diagnostic fingerprint of a missing I/O record in DB 1.

10. Troubleshooting Matrix

11. Field-Commissioning Best Practices

• Always start every CPU 928B commissioning with a verified DB 1. A copy of the DB 1 should be stored in the project archive and burned to EPROM for cold-start survival. The CPU does not retain a DB 1 written only to RAM through a power cycle.
• Use ISTACK as the first diagnostic, not the LEDs. The ADS/QVZ/PEF LEDs tell you the family; the ISTACK tells you the address.
• Document the slot map. A single laminated table that lists every slot, its module order number, the jumpered byte address, and the corresponding DB 1 record eliminates hours of troubleshooting for the next engineer.
• Avoid mixing address ranges in expansion racks without first checking the IM 304 / IM 314 transfer limits (max 32 bytes per IM for the 135U, max 64 bytes for the 155U-compatible mode).
• Always back up the S5 program before any DB 1 change. A corrupt DB 1 can cause the CPU to refuse cold-restart; a backup allows field recovery by EPROM programmer.
• For 928B-3UB12 to 928B-3UB11 cross-replacement, verify that all new features in the -3UB12 firmware are not used in the existing program, or migrate the program first.

12. Quick Reference: CPU 928B Error Code Cross-Reference

13. When to Escalate

If the corrected DB 1 still produces ADF on the same address, the failure is downstream of the special data block:

• Bad EPROM on the CPU. A corrupted firmware EPROM can produce false ISTACK causes. Swap the EPROM with a known-good 928B image.
• Backplane failure. A bent pin or broken trace on the 135U backplane will prevent the address decoder handshake. Inspect the backplane with a magnifier and a continuity tester.
• Defective DI module. If the module's address-decoder logic is damaged, it will not acknowledge the refresh. Swap with a known-good spare.
• Wrong CPU variant. A 928B-3UB12 program using features not present in a -3UB11 will halt immediately. Verify the MLFB on the CPU front panel.

Official Siemens support for S5-135U systems is provided through the Siemens Industry Online Support portal. Replacement parts and engineering-grade spares are sourced through the Siemens S5 spare-parts program; the CPU 928B is documented as a serviceable platform with lifecycle support.

14. Related Documentation

• CPU 928B Programming Guide (PDF, pa928ben.pdf)
• Siemens support entry 19397726 - CPU 928B documentation hub
• S5-135U / S5-155U system manual (Siemens order number 6ES5 998-x)
• STEP 5 V7.x programming reference (Siemens, current PG release)