Siemens S5-115U CPU 943B/944B: Resolving the RS 120.0 PG Lockout

The SIMATIC S5-115U with CPU modules 943B (6ES5 943-7UB21) and 944B (6ES5 944-7UB21) carries a documented firmware behavior in which the system bit RS 120.0 is intermittently latched when an Operator Panel (OP) is bound to the second serial port. The latch silently disables every Programming Device (PG) online function—Edit Block, Block Status, Program Check, Compare Block—with the diagnostic 0321: AS function blocked: running function. This article documents the root cause, the official Siemens remediation (engineering notice formerly tracked as ID 4204079), and a verified STEP 5 implementation sequence for restoring durable PG access on the installed base.

1. Affected Hardware and Catalog Numbers

The issue is bounded to two specific catalog numbers of the S5-115U high-performance CPU family:

Distinguishing features versus unaffected variants:

• Two serial interfaces (S0 for PG, S1 for OP). Single-port CPUs and the lower-memory -7UB11/-7UB12 revisions are not subject to the firmware race.
• Bit processing time of approximately 0.6 µs, word processing 1.2 µs, with up to 2,048 flags, 256 timers, 256 counters, and a 20-bit address range on the S5-115U I/O bus. These are the standard performance figures documented in the S5-115U system manual on the Siemens Industry Online Support portal.
• The mode selector on the front of the CPU carries three positions: RUN (program execution, PG functions restricted), RUN-P (program execution with full PG access), and STOP (program halted, outputs in configured stop state). The cyclic program must be permitted to execute for the RU RS 120.0 fix to fire, so the CPU must be in RUN or RUN-P for the procedure below.

2. S5-115U Communication Topology

The dual-port design partitions serial traffic between the PG and the OP. The lockout only occurs when an OP is bound to port S1; a CPU running with only a PG on S0 does not exhibit the fault.

The AS511 protocol running on each port is a Siemens-proprietary, character-oriented protocol at 9600 baud by default, with 8 data bits, even parity, and 1 stop bit. The protocol layer arbitrates ownership of the port; the firmware race in question lives in the arbitration code and the RS-bit handling, not in the physical line.

3. Root Cause: The RS 120.0 System Bit

RS 120.0 is a system bit inside the S5-115U flag area. It is set and cleared by the CPU firmware itself and is not freely writable by STEP 5 program code, but it can be read and explicitly cleared using the RU (Reset Unconditional) instruction. The bit acts as a guard for the PG interface: when set, the CPU rejects any PG request to edit or display status of a currently executing block. The PG is told, in the standardized error string, that the AS function is blocked because a function is running.

The intended behavior is that the firmware clears RS 120.0 at the end of each scan. On the affected catalog numbers, a specific timing race in the port-2 (OP) handler leaves the bit latched in isolated cases. The reported mean time between occurrences is on the order of weeks to months per CPU, which is consistent with a race that depends on the OP's exact polling cadence and the scan-time jitter of the user program.

4. Symptoms in the Field

The failure presents with a very specific fingerprint:

1. The PG establishes the physical AS511 link; the CPU's BASP or STOP LED state is normal.
2. STEP 5 attempts to display Block Status on any FB, PB, OB, or DB and returns 0321: AS function blocked: running function.
3. Edit Block, Program Check, and Compare Block all fail with the same error.
4. Re-loading the program from PG to CPU appears to recover the system because the load forces a brief CPU restart that clears the latched bit.
5. Days to weeks later, the same error returns. Reloading is therefore not a fix; it only masks the issue for a limited time.

If the OP is also dead or the PG cannot even open the AS511 channel, the problem is more likely a hardware failure (port, cable, OP power, COM port settings on the PG) and is not addressed by the RS 120.0 workaround.

5. Prerequisites for the Fix

• STEP 5 software, any release from S5-DOS through COM 115U or the current Windows-based STEP 5 V7.x. License for the FB/PB/OB editor is required.
• A functional AS511 cable. The reference cable is the Siemens 6ES5 734-2BD20 (15-pin Sub-D to 25-pin Sub-D). Modern USB-to-TTY adapters (e.g., INAT-TCP-CPU or the Siemens PC-Adapter USB) work after the COM port number is set in the AS511 driver.
• The current program in the PG. Perform Blocks → Transfer → To PG (or the equivalent File PLC in the older S5 menu) before any edit. A reload is a destructive operation that overwrites both RAM and Flash/EPROM depending on the configuration.
• A backup of the current program on disk and—if the program is in EPROM—on a duplicate EPROM module. The new FB and OB 1 must be burned to EPROM after the RAM download, otherwise the change is lost at the next cold start.
• The CPU in RUN-P so that online edits are accepted by STEP 5. If the process cannot tolerate a brief scan interruption during the online transfer, schedule the change for a maintenance window and bring the CPU to STOP explicitly.

6. Implementation: Create the Reset FB

The fix consists of a single STEP 5 function block that contains the unconditional reset of RS 120.0, called from OB 1 so the bit is cleared every scan.

1. In STEP 5, open the project for the CPU and select Insert → Function Block.
2. Choose a free FB number, for example FB 115. Do not reuse a number already occupied by the application. The conventional range is 0–255; many installations reserve FB 0–FB 99 for the application and FB 100+ for service functions, so 115 is a safe pick.
3. When STEP 5 prompts for Decl:, press Enter to accept an empty declaration. The block has no parameters, so no local I/Q/D/B/T/C variables are required.
4. Enter the body:

FB115
NAME  : RESET
DECL  :
: RU   RS 120.0
: BE

Save the FB to the project file on the PG's hard disk before transmitting it to the CPU.

7. Implementation: Call the FB from OB 1

1. Open OB 1 in STEP 5.
2. Insert the unconditional call to FB 115 in the first network (or any deterministic location executed every scan). The STEP 5 source syntax:

OB 1
: JU   FB 115
NAME  : RESET
: BE

Save OB 1. The label :RESET on the call line must match the name you assigned to FB 115. STEP 5 is case-insensitive on most installations, but a typo is rejected at compile time.

8. Online Transfer Procedure

The transfer path depends on where the program currently lives.

For RAM-resident programs, the online transfer executes a coordinated sequence: STEP 5 commands the CPU to STOP, writes the new FB and the modified OB 1, then commands a restart. The brief stop drops outputs to their configured stop-state values. For most discrete-control applications this is a single-scan event; for continuous processes with safety interlocks, perform the transfer in a maintenance window.

9. Verification

1. Go online with the PG. The AS511 handshake should complete without retry.
2. Open any FB in Block Status. The status view should populate within one scan.
3. Trigger Edit Block on FB 115 and on OB 1. The editor must accept the change.
4. Optional forced test: in the PG online command line, issue S RS 120.0 repeatedly while the cyclic program runs. The CPU's cyclic RU will clear the bit on every scan, so the PG should never be locked out for more than a single scan period. This is the only deterministic way to prove the fix is live.
5. Leave the system running through at least one full month of normal operation. PG access must remain available at all times.

10. Edge Cases and Field Caveats

10.1 EPROM-Resident Programs

If the program runs from a UV-erasable EPROM module, the online RAM transfer is not durable. The change lives in the RAM shadow until the next power-down, at which point the EPROM image is reloaded and the fix disappears. Burn the new FB and OB 1 to a freshly erased EPROM with the PG's EPROM programmer unit (e.g., 6ES5 998-0UB3x series), mark the module with the program version, and reinsert. Until the EPROM is updated, the fix is provisional.

10.2 OP Communication Behavior

The fix does not change OP communication. The OP continues to use port S1 with the same protocol and the same data set. The RU instruction operates on a single system bit and does not touch the receive or transmit buffers, the port configuration, or the OP protocol state machine.

10.3 Scan Time Impact

One RU on a system bit is on the order of 2–5 µs on a CPU 943B/944B. The contribution to the overall scan time is unmeasurable. There is no engineering reason to gate the instruction on a timer or an event—execute it every scan.

10.4 What the Fix Does Not Do

• It does not modify the firmware race that sets RS 120.0. The bit may still be latched by the firmware; the user program now undoes the latch every cycle.
• It does not address PG failures caused by bad cables, wrong COM port, wrong baud rate, or a PG connected to the OP port (S1) instead of the PG port (S0).
• It does not address the process not active error in the unrelated case where a block is genuinely not called by the scan (e.g., a PB never referenced from OB 1 or any other active FB). For that case, trace the call chain in OB 1 and ensure every block you want to monitor is reached.

11. Diagnostic Differentiation Matrix

Before applying the workaround, rule out the more common causes of the same error string. The matrix below is the field-proven triage:

12. Diagnostic Flowchart

13. Long-Term Stability and S5 Lifecycle

The SIMATIC S5 family, introduced in 1958, was officially discontinued by Siemens on October 1, 2020, with spare-parts supply continuing on a phase-out schedule. The CPU 943B and 944B are in the legacy phase, with the following consequences for the RS 120.0 issue:

• No further firmware updates. The RU RS 120.0 instruction is the only sanctioned remediation and will remain so for the life of the catalog number.
• Spare-part supply. Replacement modules are available while inventory lasts. Migrate the application to a current SIMATIC controller when stock is exhausted.
• Fleet-wide rollout. For multi-CPU sites, apply the FB 115 / OB 1 change to every affected 6ES5 943-7UB21 and 6ES5 944-7UB21 in the plant to avoid repeat service calls.

Siemens' current automation portfolio spans from the LOGO! 8/9 logic modules through the S7-1200 G2, S7-1500, and ET 200SP, as detailed on the SIMATIC industrial automation systems page. The general SIMATIC lineage is documented at the SIMATIC overview reference for engineering teams planning a migration. New installations should not start on S5; the workaround in this article is exclusively for maintaining the installed base.

14. Complete Reference Implementation

For convenience, the entire program change in STEP 5 source form:

// -----------------------------------------------------------
// FB 115 - Reset RS 120.0 (workaround for 6ES5 943/944-7UB21)
// -----------------------------------------------------------
FB115
NAME  : RESET
DECL  :
: RU   RS 120.0
: BE

// -----------------------------------------------------------
// OB 1 - Cyclic program (place call in first network)
// -----------------------------------------------------------
OB 1
: JU   FB 115
NAME  : RESET
: BE

Transfer both blocks to the CPU with Blocks → Transfer → To PLC while the CPU is in RUN-P. If the program lives in EPROM, burn the new FB and OB 1 to a fresh EPROM and swap the module.