S5-135U EPROM Backup: Resolving CPU 928B Program Loss

Problem Statement: Program Loss on Siemens S5-135U

Program loss on a Siemens SIMATIC S5-135U PLC typically surfaces during or after a power-supply event. Operators report that after a mains interruption, brown-out, or uncontrolled rack-power cycling, the PLC either fails to restart cleanly or boots with a corrupted block stack. The CPU's lithium backup battery may have been replaced, yet RAM-resident blocks are still being erased or overwritten.

This symptom points to a non-volatile memory gap. The S5-135U loads its program from EPROM into battery-backed RAM at restart; if the EPROM image is missing or the restart path is misconfigured, the CPU cannot reconstruct a coherent program after a power disturbance. The result is OB20/OB21/OB22 restart errors, undefined stack pointers, and process downtime.

This article documents the field-proven procedure for creating a verified EPROM backup on the CPU 928B, configuring the restart organization blocks correctly, and adding power-quality hardening (UPS) to prevent recurrence.

Affected Hardware: CPU 928B Variants and MLFB Numbers

The CPU 928B is the standard central module for the S5-135U. Two firmware revisions are relevant when planning an EPROM backup, and they must be distinguished before any programming activity:

The official Siemens CPU 928B Programming Guide (PDF, order code PA928B-en) documents both variants and is the authoritative reference for block-type compatibility, restart behavior, and the system software differences between the -3UB11 and -3UB12 revisions. Confirm the MLFB number printed on the CPU front panel before generating any EPROM image; mixing firmware revisions between EPROM and CPU causes restart rejection with "PLC stop" indication.

Root Cause Analysis: Why RAM Programs Vanish

The S5-135U program lives in two places at once:

1. EPROM (memory submodule slot) – the non-volatile master image.
2. RAM on the CPU module – the execution copy, backed by a lithium battery.

If the EPROM is empty, absent, or contains a partial image, the CPU must build the runtime program solely from the battery-backed RAM. When battery voltage drops below the data-retention threshold, RAM contents decay within minutes to hours. Common field causes include:

• Battery exhausted – primary lithium cell past shelf life; nominal service life is 5 years but field temperatures above 40 °C accelerate drain.
• Battery holder corrosion – the spring contacts lose tension; cell voltage measures nominal but contact resistance spikes under load.
• Power supply ripple – a sluggish 5 V rail during mains sag causes the CPU to enter an indeterminate restart while battery is still healthy. Ripple can confuse the watchdog and corrupt the block stack (OB20/21/22 trigger rapidly).
• Missing or misconfigured EPROM – the slot is empty or the EPROM contains only system data (DX0/DX1), not the user program.
• Mask DB1 wrong restart mode – restart type is set to COLD RESTART when the process can only tolerate WARM or HOT RESTART, forcing the CPU to clear work DBs and re-initialize I/O, which the operator interprets as program loss.

EPROM Memory Architecture in the S5-135U

The S5-135U accepts plug-in EPROM memory submodules. Two EPROM families are encountered in service:

The EPROM image must contain, in the correct order:

1. System program (DX0) – operating-system extension parameters.
2. System program (DX1) – further OS extension parameters (presence depends on firmware).
3. User program blocks – OB, PB, FB, SB, FX in the order required by the restart OB.
4. Mask DB (DB1) – restart parameterization (cold/warm/hot restart).

A common field mistake is to write only the user blocks to EPROM without DB1. The CPU then has no restart mode configured and defaults to the safest mode (cold restart), which wipes all flag and data words — perceived as program loss.

Prerequisites for an EPROM Backup

Before scheduling the backup window, verify the following:

• Field PG (PG 685, PG 730, PG 750, PG 770, or newer) with the S5-DOS / STEP 5 programming package installed and a working EPROM programmer attachment.
• Blank EPROM submodule matching the CPU 928B type. Confirm with the CPU 928B Programming Guide for the correct memory capacity class for the firmware variant in use.
• Verified online connection – test PG-to-CPU link via the PG cable (current loop / MPI depending on PG generation).
• Current user program – perform a full program upload from CPU to PG immediately before backup; do not trust a file from a previous service.
• Process in safe state – output disable or maintenance mode on the controlled machine.

Step-by-Step EPROM Backup Procedure (CPU 928B)

Step 1 – Identify the CPU and Verify Memory

1. Read the MLFB number on the CPU front panel; confirm it matches either 6ES5 928-3UB11 or 6ES5 928-3UB12.
2. Connect the PG and run PLC > Display Module Status. Record the EPROM submodule size, the current firmware version, and the active restart mode reported in the system data.

Step 2 – Upload the Live Program from CPU to PG

1. In the STEP 5 editor select File > Upload to PG with block types OB, PB, FB, SB, FX, DB, DX enabled.
2. Allow the upload to complete fully; do not interrupt even if the PG reports blocks in the STOP state.
3. Save the resulting program as a dated, versioned project file. Note the save path on the maintenance log sheet.

Step 3 – Compile and Verify Block List

1. Open the Block List editor and confirm that all expected OB/PB/FB/SB/DB/DX are present.
2. Cross-check the count against the existing documentation; a missing DB typically indicates the upload was interrupted or the operator stopped the CPU mid-block-write.

Step 4 – Insert a Blank EPROM and Program It

1. Switch the CPU to STOP and remove the existing EPROM submodule from its socket. Place it in an ESD-safe tray immediately; do not mix old and new EPROMs on the bench.
2. Insert the blank EPROM into the programming adapter on the Field PG.
3. From STEP 5 select File > Transfer to EPROM; the dialog will prompt for block order. Use the order suggested by the CPU 928B Programming Guide (system data first, then user blocks, then mask DB).
4. During programming, the PG will verify each byte against source. Do not interrupt.

Step 5 – Insert the New EPROM into the CPU

1. Power down the rack, install the newly programmed EPROM into the CPU submodule socket paying attention to the polarization notch.
2. Restore rack power, switch CPU from STOP to RUN.
3. Observe the LED sequence: STOP → BASP → RUN. Any re-trigger of OB20/21/22 during this transition indicates a restart mode mismatch.

Step 6 – Burn-In Test (Recommended)

1. Cycle rack power three times consecutively. Each restart should re-create the user program identically from EPROM.
2. After each restart, verify a sentinel flag (e.g., F0.0) is set and a sentinel data word (e.g., DW10 in a designated DB) holds a known constant.

Restart Organization Blocks: OB20, OB21, OB22

The CPU 928B invokes a specific restart OB depending on how the CPU came back online:

Field practice: review the actual content of OB20, OB21, and OB22 in the program before relying on a restart. An OB that calls STP (STOP) or that does not contain the proper initialization sequence will lock the PLC on the first power event even though EPROM backup is perfect.

Mask DB1 and System Data Words DX0 / DX1

The mask DB (DB1) defines the restart behavior the CPU must follow. DX0 and DX1 contain the OS extension parameters (timer base, process image size, interrupt configuration). The interplay is:

• DB1 – restart mode bits (COLD / WARM / HOT), process image partitioning, error handling.
• DX0 – first OS extension block.
• DX1 – second OS extension block (present only if the firmware expects it).

Example mask DB1 layout (representative; refer to the CPU 928B Programming Guide for the exact word/bit assignments of your firmware):

DW0  : Restart mode       = WARM RESTART
DW1  : Process image size = 128 bytes input / 128 bytes output
DW2  : Error reaction     = continue program on OB error
DW3  : Reserved
DW4  : Cyclic OB base     = OB1 only

If DB1 specifies COLD RESTART but the process cannot tolerate cleared work DBs, operators will see flag bits, counters, and timers reset after each power event and report it as "program loss." Set the restart mode to the most permissive type the process allows — typically WARM or HOT RESTART.

Power-Quality Hardening: UPS Integration

An EPROM backup solves the data-retention problem. A UPS solves the power-quality problem. Both are required if the symptom repeats after a clean EPROM restore:

1. Online / double-conversion UPS sized for the full S5-135U rack plus I/O. The CPU and IM modules need clean sinusoidal 230 V AC (or 120 V AC) regardless of mains condition.
2. Hold-up time minimum 5 minutes at full load — enough to ride through typical brown-outs and brief outages while signalling a controlled shutdown if needed.
3. Suppress ripple at the rack PSU input. Even with a UPS, common-mode noise from VFDs or welding equipment on the same plant bus can couple into the 24 V DC rail and induce the same watchdog-confusion symptom.
4. Monitor mains with a data-logging AC analyser for at least one week if the fault is intermittent; look for sags below 0.9 pu lasting longer than 50 ms.

Verification After Backup Installation

After installing the EPROM and (if applicable) the UPS, perform the following verification:

1. Cold-start test – rack power OFF for 60 s, then ON; CPU must reach RUN within the normal cycle time and OB22 must execute exactly once.
2. Brown-out test – simulate a 100 ms mains sag (use a variable transformer) and confirm the CPU does not STOP.
3. Block integrity test – after each restart, transfer the runtime program back to the PG and compare against the master file. Any CRC mismatch indicates EPROM image drift.
4. Flag retention test – set a sentinel flag F100.0 to TRUE and a counter C0 to 137. After a power cycle, both values must be intact (WARM or HOT restart).

Troubleshooting Matrix

Migration Considerations: From S5-135U to a Modern Controller

While the EPROM + UPS combination stabilises an existing S5-135U, the platform has been discontinued for many years. Spare CPU modules, EPROM submodules, and battery holders are increasingly difficult to source. For long-term reliability, plan a migration to a current-generation SIMATIC controller (S7-1500 or successor). During migration planning:

• Use the verified STEP 5 program as the source of truth for I/O lists, sequence logic, and fault handling.
• Preserve the EPROM image and STEP 5 project as the documented functional specification.
• Re-implement restart logic using the modern equivalent (OB100 warm restart, OB101 hot restart, OB102 cold restart) on the new platform.
• Validate the new program with the same verification matrix used above (cold start, brown-out, block integrity, flag retention).

Safety and Handling Notes

• EPROMS are sensitive to static discharge; handle only at an ESD-safe workstation.
• Never insert or remove an EPROM with rack power ON; the CPU may interpret the half-inserted state as a memory fault and trigger an unintended restart.
• Verify battery polarity and orientation before insertion; reversed polarity on some battery holders has caused immediate CPU damage.
• When replacing the lithium backup cell, observe the proper polarity and dispose of the spent cell per local regulations.