Resolving STEP5 V7.23 Undefined Characters on S5-135U AS511

1. Problem Definition

When connecting a SIMATIC S5-135U CPU to STEP5 V7.2 / V7.23 over the AS511 protocol on a Windows XP workstation, the programming software receives corrupted payload data. STEP5 displays the message "Undefined characters from AS" (German: "undefinierte Zeichen vom AS") in the online dialog, and no block transfer, status, or variable table download is possible. The same workstation, the same AS511 driver (S5AS511.EXE), and the same STEP5 installation communicate with a SIMATIC S5-95U CPU without errors. Reinstalling STEP5, applying the V7.23 patch, and even building a clean DOS 7.1 host reproduce the problem on the 135U link.

2. Affected Hardware and Software

Use the catalog numbers only as format references. Confirm the exact MLFB of the installed CPU by reading the rating plate on the front panel — early 135U versions (CPU 921, CPU 922, CPU 928) use a 15-pin Sub-D TTY (20 mA current loop) PG socket, while S5-95U integrates the same physical layer but with different default parameters and pin-out on the 15-pin female connector.

3. AS511 Protocol and Interface Architecture

AS511 is Siemens' proprietary point-to-point programming protocol. It runs over an asynchronous serial line and is delivered by the S5-95U and S5-135U on their PG/AS port. The driver S5AS511.EXE is the DOS/Windows TSR that converts the PC COM port into the protocol expected by STEP5.

Standard AS511 line parameters (must be matched on both ends):

The PG port on an S5-135U is a passive TTY current loop; the S5-95U can be configured as an active or passive source depending on jumper position. The integrated adapter cable (Siemens 6ES5 734-1...) contains a TTY-to-RS232 converter plus a DB9 female for the PC. The converter must be powered — the PC provides the +5 V sense line on pin 6 of the DB9 to feed the converter, which is why a generic USB-to-serial adapter without the Siemens cable will not work.

4. Root Cause Analysis: Why the S5-95U Works and S5-135U Fails

Because the same PC, driver, and STEP5 binary successfully couple to the S5-95U, the failure cannot be a host configuration problem in the broad sense. The fault is in the chain of elements that differ between the two CPU types:

1. Cable topology. The 95U is normally programmed with a 6ES5 731 cable, while the 135U uses a 6ES5 734 series cable with a different current-loop direction and a different DB15 wiring. Substituting one for the other produces valid edge transitions but inverted mark/space polarity, which the S5AS511 driver interprets as an unreadable frame and surfaces as the "undefined characters" message.
2. TTY active/passive source. S5-135U PG ports are passive sinks. If the cable is also wired passively, no current flows, and the receiver floats. Noise on the floating line decodes as a stream of 0xFF bytes — the very bytes that STEP5 cannot map to printable characters.
3. COM port frame format override. Windows XP COM port properties (Device Manager → Ports → Properties → Port Settings) default to 9600 8N1, but USB-to-serial bridges or older PCs may persist as 9600 7E1. The 95U is tolerant of either (its onboard UART strips the parity bit); the 135U rejects the corrupted frame.
4. Code-page conversion. STEP5 V7.2x text display still calls the Windows ANSI code page. The 135U firmware returns German/English block names in a DOS-OEM-850 encoding when running in multilingual mode. Without the explicit code-page patch in V7.23, characters at codepoints 0x80–0xFF render as the Unicode replacement glyph (U+FFFD) or as the Unicode Specials block at U+FFF0–FFFF, which is what the operator sees as "undefined characters".
5. License integrity. The license is checked per-feature, not per-binary. If the AS511 feature is licensed for the 95U profile only (legacy license), some 135U symbol-table lookups fall back to uninitialized strings, again appearing as undefined characters in the variable view.

5. Pre-Diagnostic Checks

Run the following checks before touching the project, so that the fix can be applied with confidence:

1. Verify the AS511 driver load. At the command prompt type S5AS511 /? for the parameter list. The driver should report version 5.x or 6.x and a valid COM port in use. If no COM port is reported, install the driver from the official Siemens support entry S5-AS511 driver package (Entry ID 11870684).
2. Verify the COM port enumerates in Device Manager. Windows XP must show the COM port as Communications Port (COM1) with no yellow exclamation. If using a USB bridge, force a fixed COM number below 10 to keep the driver happy.
3. Loopback the cable. Short pin 2 to pin 3 of the PC DB9 connector with the cable disconnected from the CPU. Start S5AS511 /C1 and observe a stream of echoed characters in any terminal program. Failure indicates a broken cable, not a CPU fault.
4. Confirm CPU AG selector position. The 135U PG port must be in AG mode, not in PG mode (the small slide switch on the CPU front or on the IM 304 rack). Wrong selector: the CPU answers the initial handshake, then returns scrambled data.
5. Confirm the patch level. The patch STEP5 V7.23 (Entry ID 18177672) ships a code-page table for the 135U series. Without it, online texts are not interpretable.

6. Solution 1: COM Port and Frame Configuration

The most common cause of "undefined characters" on a 135U is a non-default COM port setting. Windows XP keeps the last user setting per port, and a previous test on a different device can leave a stale configuration.

1. Open Control Panel → System → Hardware → Device Manager.
2. Expand Ports (COM & LPT), right-click the COM port in use, select Properties.
3. On the Port Settings tab set:
   Bits per second: 9600
   Data bits: 8
   Parity: None
   Stop bits: 1
   Flow control: None
4. Click Advanced and disable Use FIFO buffers (the 16-byte FIFO on high-speed UARTs truncates AS511 frames).
5. Reboot. Launch STEP5 and re-test.

7. Solution 2: Cable Selection and TTY Interface

The S5-135U requires a cable that supplies an active 20 mA current source, because the 135U PG port is a passive sink. The cable must also convert TTY levels to RS-232 for the PC COM port.

Procedure:

1. Inspect the cable MLFB label. Confirm the cable is from the 6ES5 734 family, not the older 6ES5 731 family.
2. Power the converter by plugging it into the PC. The DB9 connector has a sense line on pin 6; if the PC is unpowered the converter does not energise the loop, and the 135U remains silent.
3. Verify the slide switch on the CPU PG port is in PG position, not AG. AG position enables the SINEC L1 or second protocol on the same port; the 135U replies with a non-AS511 frame that the driver discards as "undefined characters".
4. Cycle power on the 135U rack and re-test.

8. Solution 3: Code Page and Character Encoding

STEP5 V7.2 (the original CD release) was built for code page 850 (DOS-Latin-1). STEP5 V7.23 (the patch from Siemens Entry ID 18177672) extends the table to include code page 1252 (Windows ANSI). The 135U firmware in multilingual mode returns text in 850, and the 95U returns text in 1252. If the 135U is forced to display through the 1252 path, characters at 0x80–0xFF become the Unicode replacement glyph.

Procedure:

1. Apply the STEP5 V7.23 patch. Run SETUP.EXE from the patch archive and select Update existing installation.
2. Restart the PC. Verify the patch by reading the version reported in STEP5 → Help → About. It must read V7.23 + HFxx.
3. If the patch cannot be installed, configure Windows XP to use English (United States) as the system locale and CP 850 as the OEM codepage via Regional and Language Options → Advanced → Language for non-Unicode programs.
4. Launch STEP5 and re-test the 135U link. Block headers, symbol names, and STL mnemonics should now render correctly.

9. Solution 4: License File Verification (AX NF ZZ Folder)

STEP5 V7.2x stores the license as a non-encrypted file under C:\AX NF ZZ\. The Automation License Manager used by TIA Portal does not manage STEP5 V7.2x; the older AuthorsW tool does. If the file is missing or truncated, the 95U runs in a "grace" mode that hides the error, while the 135U surfaces it.

1. Open C:\AX NF ZZ in Windows Explorer. The folder must exist, and it must contain a file named S5_xxxxxx.LIC (where xxxxxx is the six-character license number supplied with the original CD).
2. If the folder is missing, the install did not register the license. Re-run the original CD Setup, select Repair, and enter the license key printed on the yellow paper sleeve of the original CD case (format 00?0?062?3 or similar).
3. Copy the license file from the original Siemens yellow floppy if you still have it. The floppy is a 3.5" disk with a single file in the root named after the license number.
4. Confirm the date stamp on the license file. A clock that runs backward (e.g., dead CMOS battery on the PC) invalidates the license and causes the driver to load only the 95U feature set.

10. Solution 5: Windows XP Service Pack and Driver Updates

Windows XP SP1 is not validated for STEP5 V7.23. The service pack changed the COM port driver stack in a way that adds a one-byte latency on the first receive interrupt, which the 135U interprets as a malformed frame. The behaviour is documented in the Siemens STEP5 V7.23 release notes.

1. Upgrade Windows XP to SP2 or SP3. SP2 is the highest common denominator certified by Siemens for STEP5 V7.23.
2. Re-apply the AS511 driver. Use the package from Entry ID 11870684; the package contains S5AS511.EXE, S5AS511.DOC, and a small register patch for the COM port driver.
3. Re-apply the STEP5 V7.23 patch from Entry ID 18177672.
4. Reboot. Run S5AS511 /C1 from Start → Run. The driver should log "Driver loaded, COM1, 9600 8N1, TTY active" or similar.

11. Verification Procedure

After each of the above solutions, perform the following verification before declaring the fix complete:

1. Launch STEP5 in Online → Open Project on AG.
2. Select the 135U target. The AG type must read S5-135U, not S5-95U.
3. Read the diagnostic buffer with PLC → Diagnostic Buffer. Entries should be readable German/English text, not a column of undefined characters.
4. Open any FB, PB, or DB and step through it with the cursor. Mnemonics should display correctly.
5. Open a VAT (variable table) and read the first five operands. If the values appear with correct engineering units (e.g., MW 100 = 0x1234), the data link is healthy.
6. Force a single bit (e.g., SET M 0.0) and confirm the indicator lamp on the 135U digital output module follows. The end-to-end chain is now functional.

12. Extended Troubleshooting Matrix

Field-Proven Caveats

• The "undefined characters" message is a data-link indicator, not an application error. Do not delete and re-create the project; the project on the AG is intact.
• Never substitute a 6ES5 731 cable for a 6ES5 734 cable on a 135U. The 731 cable lacks the current source; the 734 cable has it.
• If you must use a USB-to-serial adapter, prefer adapters based on the FTDI FT232R or WCH CH340 chipset, and force the COM number to 1–4. Prolific PL2303 adapters have known issues with the S5AS511 driver on XP SP2+.
• The 135U AG port and PG port are physically the same 15-pin Sub-D connector on the CPU, but they are multiplexed by the slide switch. The same hardware cannot simultaneously host a PG and an AG operator panel.
• The "undefined characters" issue can be masked by disabling symbol tables in the online view. That is a workaround, not a fix; the underlying data link is still corrupted.

FAQ