S5-115U EPROM 'Block List Does Not Exist' Error: Diagnose and Fix

Problem Description and Field Symptoms

On SIMATIC S5-115U controllers using CPU 942 (MLFB 6ES5 942-...) and on S5-100U controllers using CPU 102 (6ES5 102-...), an EPROM-resident user program can be copied into the CPU on cold restart, the self-test can pass, and the RUN LED can light — yet the CPU never processes any block. Inputs are not scanned, outputs are not updated, and on-line edit attempts from a PG (Programming Unit — typically a PG 685, PG 710, PG 730, or PG 750 running STEP 5 V6.x or V7.x) return the prompt:

Block list does not exist in PLC

The diagnostic signature is reproducible on every cold restart, which makes it a strong fingerprint for isolating the fault:

• With the EPROM submodule removed, the lithium backup battery removed, and an overall reset (MRES) executed, the CPU is in a clean state. Re-install the original EPROM and power up. The CPU briefly flickers the BASP/STOP/RUN LEDs while copying blocks from EPROM into the internal user RAM, then settles to steady RUN (green LED).
• The PG can browse OB1, OB21, OB22, OB31, OB34, FB, PB, SB, and DB blocks via the STEP 5 Block Status function (menu path File > Open > Block > Status in STEP 5 V7). Block headers and payloads appear intact to the casual browse.
• None of the blocks execute. OB1 is never called. Outputs remain at their last value or at the safety-default value, depending on whether OB21/OB22 was processed.
• Attempting to edit any block online, or attempting Block > Transfer > PLC via the PG, returns Block list does not exist in PLC.
• The same EPROM, transferred to a known-good sister CPU of the same order number, runs perfectly — no error message, full cyclic execution.
• A freshly programmed EPROM (a new or fully erased 6ES5 375-... submodule) loaded with the same STEP 5 project, when inserted in the suspect CPU, reproduces the same failure exactly.

Because the EPROM media works in another CPU, and because a freshly written EPROM fails the same way in the suspect CPU, the defect is isolated to the CPU itself, not to the EPROM module.

Affected Hardware

The same EPROM submodule types fit the CPU 942 family and (with the appropriate adapter) the S5-100U family. Both platforms use the same STEP 5 block-list internal data structure, so the same failure signature appears in both.

S5 Memory Architecture and the Block List

The SIMATIC S5 separates the user program into discrete blocks with fixed 5-word headers. The CPU keeps three logically distinct memory areas:

1. User memory (Anwenderspeicher) — RAM holding the current executable image of OB, FB, PB, SB, and DB blocks. Block contents are the user's STEP 5 code or data.
2. System memory (Systemdaten / Systembereich) — RAM holding process images (PAFE), bit-merkers (M 0.0–M 255.7), timers (T 0–T 255), counters (C 0–C 255), and the block list / block stack (German: Bausteingenerierung, Blockverzeichnis).
3. Load memory (Ladespeicher) — the EPROM submodule (read-only at runtime) or a battery-backed RAM submodule. The CPU copies blocks from load memory into user RAM on cold restart.

The block list is an internal pointer table in the system area. It records, for each block loaded into user RAM, the following fields:

The CPU uses this table to:

• Resolve calls like JU FB100 or C DB 50 to the actual user-RAM address.
• Maintain the BG/STACK (block stack) for nested calls — each JU pushes the return address onto the stack, indexed by the block-list entry.
• Enumerate blocks in response to PG Block Status requests, which traverse the list in ascending block-number order.

The block list itself is held in volatile SRAM. The backup battery preserves it across power failures, alongside the bit-merkers, timers, counters, and the PAFE (process image of inputs / outputs last values). On cold restart with an EPROM installed, the CPU copies the EPROM-resident block headers into user RAM and rebuilds the block list. If that rebuild fails — header CRC mismatch, address-pointer corruption, or system-RAM corruption — the user RAM appears to contain valid blocks to a casual Block Status browse (because the PG reads user RAM directly) but the internal index is missing. STEP 5 surfaces this as Block list does not exist in PLC.

Boot Sequence with EPROM Installed

1. Power on (or transition from warm restart 2 to cold restart via the operating-mode selector).
2. CPU self-test: RAM pattern test, battery monitor, watchdog timer reset, address-line test.
3. If the EPROM submodule is detected (presence pin pulled low by the submodule), the CPU enters the copy phase. LEDs alternate BASP (yellow), STOP (red), and RUN (green) while blocks stream from EPROM into user RAM. Duration scales with EPROM size; a 32 KB EPROM takes ~2–4 seconds.
4. CPU rebuilds the block list in system RAM from the headers it just copied.
5. If OB21 is present, CPU runs OB21 (manual warm-restart routine). If OB22 is present, CPU runs OB22 (cold-restart routine).
6. CPU enters cyclic execution: scan inputs → OB1 → scan outputs → repeat.

In the failed case, step 4 fails silently. OB21/OB22 do not run (or run with corrupted pointers that trap), and OB1 is never invoked. The PG Block Status function reads user RAM directly and so still displays the blocks; STEP 5's Block List command, however, queries the system-area index that was never built. This is the root asymmetry that produces the diagnostic string.

STEP 5, the PG, and the AS511 Protocol

The PG communicates with the CPU over the Siemens AS511 protocol, a serial point-to-point protocol at 9600 baud over a current-loop or RS-232 interface depending on the PG model. The protocol distinguishes several request types:

• Block read — fetches a single block from user RAM by block number.
• Block status — returns metadata (length, type, last-modified timestamp) for a single block.
• Block list — returns the entire block-list pointer table from system memory.
• Block write — transfers a block from PG to user RAM, also re-indexes the block list.

STEP 5's Block Status menu uses single-block reads (which succeed against user RAM), but the Block List dialog and the Edit function require a valid system-memory index. When that index is missing, STEP 5 reports the failure as Block list does not exist in PLC. Note that STEP 5 V7 has slightly different wording than V6 ("Bausteinliste existiert nicht in AG" vs. "Block list does not exist in PLC"); both refer to the same condition. The AG-S5 programming cable variants (6ES5 734-..., 6ES5 744-...) all carry the AS511 protocol transparently.

ISTACK Interpretation

The Interrupt Stack (ISTACK, German: Ustackspeicher) is the most useful online diagnostic for this fault. Read it from STEP 5 via PLC > Display > Interrupt Stack. Relevant fields in the failed case:

The PC stuck at the start of OB1 is the smoking gun. In a healthy CPU, the block-list call resolver immediately jumps to the address stored in the block-list entry for OB1; in the failed case, the resolver cannot find OB1 in the (empty) block list and the PC never advances past the entry-point instruction. Outputs remain at their last value because the cyclic scan-output phase never executes.

Root Cause Analysis

Three independent CPU-resident root causes explain the symptom. In offshore environments, all three can co-exist on a single board.

1. Backup Battery Failure or Removal-Induced Index Corruption

The most common cause in field service. The lithium battery (6ES5 971-0AA00 or equivalent) holds up the system-RAM block list, the bit-merkers (M), timers (T), counters (C), and the PAFE while power is off. When the battery is dead, removed, or has drifted below ~2.5 V open-circuit under load, the CPU cold-restarts with:

• No block list (must be rebuilt from EPROM — usually succeeds).
• No preserved merkers/timers/counters (expected; user code must re-initialize in OB21/OB22).

But if the battery is partly degraded, voltage can droop mid-startup while the CPU is mid-way through rebuilding the block list, causing a partial list with bad pointers. A subsequent EPROM load then overwrites user RAM with valid blocks, but the system-RAM list is now corrupt and inconsistent. The user-visible symptom is exactly the one in the field report.

2. CPU System-RAM Hardware Fault

The static RAM (SRAM) that backs the system area is soldered to the CPU PCB. Age, vibration, thermal cycling, and corrosion — especially in offshore / marine atmospheres with salt-laden air and H₂S — cause:

• Bit-line leakage that flips individual bits in the block-list pointer table.
• Address-line faults where one SRAM device returns the wrong word on read.
• Stuck-at-low or stuck-at-high data lines that misroute all block-list writes.
• Solder-joint fatigue on the SRAM ICs after ~15–20 years of thermal cycling.
• Dendritic growth between SRAM pins in high-humidity environments.

Both PLCs in the source report are described as "offshore" — a classic salt-fog / vibration environment. Both units likely suffer the same corrosion-driven system-RAM degradation, which is why a single EPROM works in a different CPU but no EPROM works in the suspect CPU.

3. EPROM Interface Driver Fault on the CPU

A second variant: Vpp stuck enabled on the EPROM socket. This over-programs the EPROM over time and shifts threshold voltages; reads return mostly-correct data with intermittent errors that pass the copy-loop checksum but fail on cyclic execution.

A third variant: address latch transparent during copy, where the upper address bits are not latched and float, causing the wrong EPROM word to be copied for some blocks. Result: a partial block list pointing to invalid user-RAM regions.

Diagnostic Procedure

1. Confirm the symptom is CPU-resident. Move the suspect EPROM to a known-good CPU of the same order number. If it runs, the EPROM is healthy.
2. Confirm the symptom persists with new media. Program a fresh, fully-erased EPROM (UV-erase ≥ 30 minutes, see procedure below) with the same STEP 5 project on the same PG. Insert in the suspect CPU. If the same error reproduces, the CPU is at fault.
3. Check the backup battery. Power down. Measure the battery voltage at the battery holder with a high-impedance DMM (≥ 10 MΩ input impedance). A healthy battery reads 3.4–3.7 V open-circuit. Replace if < 3.0 V. Use only Siemens 6ES5 971-0AA00 or a manufacturer-approved equivalent; do not substitute alkaline or non-lithium chemistries — the battery holder is wired for 3.6 V lithium and the charge circuit assumes that chemistry.
4. Inspect for environmental damage. Open the CPU front panel. Inspect the PCB for green-white corrosion around the SRAM ICs and the EPROM socket. Inspect the lithium battery holder for salt deposits (offshore indicator). Use a stereo microscope at 10× minimum; look for dendritic growth between SRAM IC pins.
5. Check the EPROM socket. Power off. Remove and reseat the EPROM submodule several times to clean contacts. Verify all 32 pins (S5-115U EPROM submodule) are intact with no oxidation or bent pins. If the spring tension is weak on the socket, replace the socket — do not reuse.
6. Run ISTACK from the PG. With the PG online, read the Interrupt Stack (menu PLC > Display > Interrupt Stack). Compare PC and BG/STACK against the table above. Stuck PC at OB1 entry plus BG/STACK depth 0 confirms the block-list call resolver cannot dispatch.
7. Measure system-RAM address and data lines. With the CPU powered and an oscilloscope (or logic analyzer with ≥ 32 channels), probe the SRAM data bus during the copy phase (first 2–4 s after power-up). Look for stuck lines, ringing, or noise. Address latch lines on the CPU 942 PCB should toggle cleanly during the copy phase.
8. Check for cold-solder joints. Reflow the SRAM ICs and the EPROM socket pins with a hot-air rework station at 280 °C, no-clean flux. Re-test.

Step-by-Step Recovery Procedure

Use this sequence to attempt a field repair before resorting to RMA. Time budget: 30–60 minutes.

Step 1 — Full Overall Reset (MRES)

1. Power down the PLC rack.
2. Remove the EPROM submodule from the CPU.
3. Remove the lithium backup battery. Wait 60 seconds for any capacitors in the system area to bleed down.
4. Re-insert the EPROM submodule.
5. Re-insert the backup battery (or a known-good 3.6 V lithium).
6. Apply power. The CPU should flicker through its copy phase and reach RUN.
7. If the error persists, continue to Step 2.

Step 2 — Reload via PG (Bypasses the EPROM Copy Loop)

1. Connect the PG to the CPU via the S5 programming cable (6ES5 734-... or 6ES5 744-..., depending on PG model; the cable is also referred to as the AG-S5 cable).
2. In STEP 5, select File > Open > Project and load the user program from the EPROM into the PG. This reads EPROM-resident blocks via the PG's block-browse path, which uses a different socket-access path than the CPU's copy routine.
3. Select File > Transfer > Block > PLC (in STEP 5 V7) or PLC > Transfer > Block > AG (in STEP 5 V6). This pushes the program down via the AS511 serial PG link — not via the EPROM copy loop — and rebuilds the block list through the standard PG path.
4. If the program now runs, the CPU's EPROM copy loop is faulty but the rest of the CPU is functional. Continue to Step 3 for a permanent fix. If the program still does not run, the CPU's system RAM is at fault; skip to the RMA section.

Step 3 — UV-Erase and Reprogram the EPROM

Even a working EPROM may have marginal bits from years of storage. Wipe and reprogram:

1. Remove the EPROM submodule from the CPU.
2. Place it in a UV eraser for ≥ 30 minutes. The windowed EPROM ICs used in S5 submodules (typically 27C256 or 27C512 equivalents on a Siemens carrier PCB) require 12–15 mW/cm² of 253.7 nm UV. A standard EPROM eraser at 12 mW/cm² takes ~25–35 minutes to guarantee a clean erase. Do not exceed 45 minutes — extended UV exposure degrades the quartz window and can cause bit drift.
3. Verify erase: place the EPROM in a programmer and read all bytes. After UV erase, every byte should be 0xFF.
4. Reprogram the EPROM on a PG-attached or standalone EPROM programmer with the verified STEP 5 project file (S5D file). Use Siemens-approved programming parameters; do not use 21 V Vpp adapters unless the module is explicitly designed for them (12.5 V is the standard for 27C256/27C512).
5. Verify after write: read back the EPROM and compare against the project checksum.
6. Re-insert the EPROM in the suspect CPU and cold-restart.

If the same error returns, the CPU's system RAM is the fault — proceed to RMA.

Hardware-Level Diagnostic Reference

EPROM Chip-Level Notes

The S5 EPROM submodule is a small PCB carrying one or two windowed EPROM ICs and a presence-detect jumper. Common IC types:

Notes:

• Always use a 12.5 V Vpp programmer for these modules. 21 V Vpp will over-program and shorten EPROM life dramatically.
• If you substitute a modern OTP (one-time programmable) EPROM for a windowed part, mask the windows with opaque tape to prevent inadvertent UV exposure.
• The Siemens submodule PCB has a polarity notch on one end; do not force insertion in the wrong orientation — the +5 V and GND pins are not symmetric.
• Verify each programmed EPROM by computing the Siemens-standard block checksum (header word 5) and comparing against the STEP 5 project file. A mismatch indicates incomplete programming or EPROM cell failure.

Cross-Reference: "Block List Does Not Exist" in Other Controllers

The same error string appears in unrelated systems with very different root causes. The Beckhoff Information System documents a TwinCAT 3 PLC control compiler error with the message 0xFF... Block list does not exist, raised when a pragma refers to a non-existent parameter list and the compiler cannot resolve it against the Parameter Manager. See the official Beckhoff Information System: Compiler Errors — Block List entry. Although the literal message is identical, the underlying cause (a missing parameter list at compile time) is unrelated to the S5 runtime block-list fault described above. Use the error string as a starting point for searching, but always diagnose against the platform's specific architecture.

Field Best Practices for Offshore / Coastal Installations

• Replace lithium backup batteries every 3 years regardless of measured voltage. Siemens specifies a typical service life of 5 years at 25 °C; in 40 °C cabinet environments that drops to ~3 years.
• Apply conformal coating to the CPU PCB during commissioning. Approved coatings include Humiseal 1B73, 1A33, and Dow Corning 1-2577. Mask the EPROM window, battery contacts, and connector gold fingers.
• Fit cabinet heaters to keep relative humidity below 60 % at all times. Use thermostats set to 15 °C minimum.
• Install cabinet air-filtered positive-pressure ventilation with a desiccant pre-filter.
• Maintain a documented "block hash" — the CRC of each EPROM-resident block — so that any subtle EPROM bit-rot is detected on periodic verification (read EPROM every 12 months, compare CRC).
• Use gold-plated EPROM sockets (Mill-Max 110-series or equivalent) when replacing worn sockets; tin-plated sockets corrode faster in salt environments.
• Document ISTACK and Block List snapshots at commissioning; keep them in the maintenance log so future fault comparison has a baseline.

RMA Procedure for the CPU

If all field recovery steps fail, send the CPU to a Siemens-approved repair center:

1. Note the full MLFB (e.g., 6ES5 942-1UA11), serial number, and firmware version (printed on the CPU label, format FW x.y).
2. Document the failure with the ISTACK screenshot and a STEP 5 Block List output for inclusion with the RMA.
3. Contact Siemens Industry Online Support (entry portal: support.industry.siemens.com) to open a service request and obtain an RMA number. For S5 legacy hardware, route through the "Product Support > SIMATIC S5" subtree and select "Repair".
4. Package the CPU in an ESD bag with the original anti-static foam if available. Do not ship with the battery installed (transport regulations for lithium cells, IATA DGR).
5. Track the RMA. Typical turnaround for S5-115U CPUs is 4–8 weeks; refurbished units are sometimes supplied as replacement rather than repair.

When to Replace vs. Repair

Preventive Maintenance Schedule

FAQ