Siemens S5-135U CPU 928B EPROM DB Write: OB181/OB255 RAM Transfer

Siemens S5-135U CPU 928B EPROM DB Write: OB181/OB255 RAM Transfer Solution

A SIMATIC S5-135U PLC station with CPU 928B stores the user program and data blocks (DBs) in plug-in memory submodules. When a data block resides on an EPROM (Erasable Programmable Read-Only Memory), runtime write attempts fail silently because EPROM cannot be modified electrically. This article explains the root cause and provides a complete STEP 5 solution using system OBs OB181 (DBDX_EXIST) and OB255 (DBDX_TO_RAM) to transfer the DB from EPROM into battery-backed RAM during the startup phase, so the cyclic program can write into the runtime copy normally.

1. Problem Statement

A SIMATIC S5-135U station with CPU 928B (typical order number 6ES5 928-3UB21) is loaded with the user program on an EPROM submodule. The program includes PB10, which transfers digital I/O states into data words of DB100. OB1 calls PB10 each scan. The project is loaded to the EPROM via a USB EPROM programmer. After CPU restart, online monitoring of DB100 shows all data words remain at 0, even though PB10 should be writing live values. When DB100 is loaded into RAM instead of EPROM, the program functions correctly and writes succeed.

Observed symptoms in the field case:

• DB100 data words remain at 0 after CPU restart
• No OB error is reported in the CPU diagnostic buffer
• No PLC stop condition occurs (CPU stays in RUN)
• Loading DB100 to RAM via PG restores correct operation
• PB10 executes normally; STEP 5 reports no programming error
• PB10 execution visibly completes; data simply does not persist

The PLC behaves as if the writes are "no-ops" because the EPROM hardware does not latch the data. The CPU never reports this condition as an error; bus cycles complete normally and the data evaporates at the end of the cycle.

2. Root Cause Analysis

The root cause is the physical nature of the EPROM module. EPROM is a non-volatile memory technology in which stored bits are represented by trapped charge on the floating gate of each memory cell. Once programmed, the only legal way to change the contents is to expose the die to ultraviolet light through the quartz window on the package (typically 15-30 minutes), erasing all cells simultaneously, and then re-burn the module using a PROM programmer.

The CPU 928B cannot perform this erase cycle at runtime. The data bus and address bus connect to the EPROM module, but the write-enable signal and program voltage generator are not activated for EPROM submodules in normal operation. Any attempt to write through STEP 5 instructions such as T DB100, L DW 5, T DBW 10, or a load/transfer pair on the data block results in data being placed on the bus but not latched into memory. The CPU does not raise an error flag because the bus cycle completes normally; the data simply disappears at the end of the cycle.

2.1 Memory Architecture of CPU 928B

The CPU 928B supports three classes of memory submodule, installed in its two user-memory slots. The CPU auto-detects the memory class on each slot at restart and configures the bus write control accordingly. For EPROM modules, write cycles are blocked in hardware.

The CPU 928B's memory controller maps the EPROM module to a fixed address range and disables the write strobe. STEP 5 block-handling instructions reference DB/DX blocks by number; the actual physical location is determined at program load time and confirmed in the PG module-information display.

2.2 Data Block Lifecycle in STEP 5

A data block (DB) is loaded into the memory module assigned to its number range at programming time. STEP 5 treats the DB as a passive data container; the program operates on the data via block instructions such as C DB / CX DX, L DW, and T DW. The actual physical location is determined at program load time and confirmed by the PG module-information display. If the DB is loaded into EPROM, the CPU creates an internal descriptor for the DB (length, structure), but the data area itself is non-writable at runtime.

2.3 Why No Error Is Reported

Modern CPUs often raise a write-protection fault when an attempt is made to write to read-only memory. The CPU 928B does not raise such a fault for EPROM access because the bus cycle completes cleanly. The CPU writes the data word onto the data bus and asserts the write strobe, but the EPROM module's write-enable input is not connected to the active write signal at the motherboard level. The EPROM ignores the write, but the CPU considers the cycle complete. The diagnostic buffer records only OB calls and explicit CPU errors, not silent write misses.

3. Solution Overview

The standard S5 approach is to keep the original DB100 (or DB100 template) on EPROM as the "golden image" and create a runtime-writable copy in battery-backed RAM during the startup phase. The CPU 928B provides two system organization blocks (OBs) that perform this operation:

• OB181 (DBDX_EXIST): tests whether a specified DB or DX already exists in the addressable memory. Returns RL (result list) state based on existence.
• OB255 (DBDX_TO_RAM): copies a DB or DX from EPROM (or EEPROM) into RAM, allocating a new DB/DX if one does not yet exist in RAM.

The pattern is to call these OBs from the startup organization blocks (OB20 manual restart, OB21 automatic restart, OB22 cold restart). After the startup OBs finish, the program has a fresh RAM copy of DB100 that PB10 can write into normally during cyclic execution.

The complete pattern looks like:

1. Keep the EPROM template of DB100 on the EPROM module.
2. Ensure a battery-backed RAM submodule is installed in the second memory slot with sufficient free space for the DB.
3. Implement a reusable FB204 that calls OB181 and OB255 with a KY-formatted input parameter.
4. Call FB204 from OB20, OB21, and OB22 for each DB that must be RAM-resident.
5. OB1 runs as before; PB10 writes to the now-RAM-resident DB100 without modification.

4. STEP 5 Implementation: FB204

A dedicated function block, FB204, encapsulates the transfer logic. The FB has a single input parameter KEDB of type KY (two bytes: high byte = DB/DX type flag, low byte = block number) and performs the existence check, the transfer, and returns to the caller.

FB 204
NAME    : DB-RAM TRANSFER
DESCR   : Copy DB/DX from EPROM to RAM using OB181/OB255
LEN     : 23 words

DECL    : KEDB    I/Q/D/B/T/C: D    TYPE: KY
          (high byte = DB/DX selector; low byte = block number)

NETWORK 1   TRANSFER DB/DX TO RAM

  : L   =KEDB              Load DB/DX identifier (KY format)
  : SPA OB 181              Test if DB/DX already exists
  : SPP =M001               If positive (exists), skip transfer
  : L   =KEDB              Reload DB/DX identifier
  : T   FW 200              Store to flag word for OB255 interface
  : L   FY 201              Load DB number (low byte) for OB255
  : SPA OB 255              Transfer DB/DX from EPROM to RAM
M001 : BE                    Block end

Older STEP 5 versions use JU in place of SPA and JP in place of SPP. Both forms compile to equivalent machine code; SPA/SPP are preferred in modern STEP 5 documentation.

Parameter breakdown for KEDB:

Common KEDB encodings:

4.1 Network-by-Network Explanation

Network 1 - Transfer Logic:

The first L =KEDB loads the input word (the formal parameter KEDB) into ACCU1. The SPA OB 181 call invokes system function OB181 with the DB/DX identifier in ACCU1. OB181 sets the RL (result list) bit to indicate whether the block already exists in any writable memory area. SPP =M001 branches to the block-end label M001 when the result is positive (block exists), avoiding an unnecessary transfer.

If the block does not exist in RAM (RL ≤ 0), execution continues. The DB/DX identifier is reloaded and stored into flag word FW 200. OB255 expects the block number in the low byte of the corresponding interface area; L FY 201 places this value in ACCU1-L. SPA OB 255 triggers the transfer. After the transfer, OB255 sets the RLO and ACCU contents to indicate success or failure.

5. Integration into Startup OBs

FB204 must be called from the startup organization blocks so the DB copy is created before OB1 begins cyclic execution. The three relevant startup OBs on CPU 928B are:

Sample call in OB20 (representative for all three):

OB 20
NAME    : MANUAL RESTART

NETWORK 1   CALL FB204 FOR DB100

  : SPA FB 204              Call FB204
  KEDB    : KY 0,100         Pass DB100 identifier

  : BE

In STEP 5 STL/AWL notation, parameter passing is by preceding the formal parameter name with the actual value or variable in the call block. The KY 0,100 constant corresponds to DB 100 (type = DB, number = 100). For DX 10 use KY 255,10 or its KH FF0A equivalent.

For multiple DBs, repeat the call in each startup OB:

OB 22
NAME    : COLD RESTART

NETWORK 1   TRANSFER DB100 TO RAM
  : SPA FB 204
  KEDB    : KY 0,100

NETWORK 2   TRANSFER DB200 TO RAM
  : SPA FB 204
  KEDB    : KY 0,200

NETWORK 3   TRANSFER DX50 TO RAM
  : SPA FB 204
  KEDB    : KY 255,50

  : BE

5.1 Startup Order Considerations

The CPU 928B executes OB20, OB21, or OB22 in full before OB1 begins. This guarantees that any RAM-resident DB created by FB204 is available to cyclic code. If FB204 fails (e.g., insufficient RAM space), OB255 returns with RLO = 0 and execution continues, but the subsequent writes to that DB will fail. Capture OB255's result with an explicit RLO check or a follow-up OB181 call if strict verification is required.

6. Programming and Commissioning Procedure

The following procedure is the field-proven workflow for converting an EPROM-resident DB into a runtime-writable RAM copy on CPU 928B.

1. Identify the DBs to migrate. List all DBs that need runtime modification. Confirm their numbers, length, and current location using PG > Block Status or PLC > Module Information.
2. Reserve RAM space. The CPU 928B must have a free RAM submodule or sufficient RAM area in the user memory. Use PG > Memory Configuration to verify. Each DB occupies its declared length (header + data words).
3. Keep the EPROM-resident DB as the template. Do not erase or overwrite the EPROM. The EPROM image acts as the source for the runtime transfer.
4. Create FB204. Insert the FB as shown in section 4. Compile with STEP 5 > FB Editor > Accept.
5. Add startup OB calls. Modify OB20, OB21, and OB22 to call FB204 with the appropriate KEDB for each DB that must be RAM-resident.
6. Do not load the target DB to RAM via PG at startup. The startup OBs perform the transfer. Loading from PG causes a duplicate or conflict.
7. Document the DB list. Maintain a project note listing each DB, its source (EPROM/RAM), and its runtime copy location.

6.1 EPROM Programming Procedure

1. Compile all blocks (PB10, OB1, FB204, OB20/21/22, source DBs).
2. Load blocks to PG using PG > Block Transfer > PG -> File.
3. Open the EPROM programmer software and select the target EPROM type (e.g., 27C256, 27C512).
4. Burn the EPROM with all blocks except the runtime copies of the migrated DBs. The migrated DBs may be present on EPROM as templates (OB255 will overwrite them in RAM at startup).
5. Insert EPROM and a battery-backed RAM submodule into the CPU 928B memory slots. Verify the battery is fresh and the buffer capacitor is rated.
6. Power up the CPU. Observe the run LED and the startup OB diagnostic message in PG > PLC > Diagnostic Buffer.
7. Once the CPU enters RUN, online monitor the migrated DB to confirm the values match the EPROM template and that PB10 is writing them.

6.2 Memory Module Selection

Select the RAM submodule size based on the cumulative DB lengths that need runtime residency. Add 20-30% headroom for instance DBs of FBs that allocate work data. Typical S5-135U RAM modules range from 16 KB to 256 KB. Verify the slot pinout matches the CPU 928B memory-interface specification; not all S5 memory modules are interchangeable across CPU revisions.

7. Verification and Monitoring

Verification confirms three things: (a) the EPROM template transferred correctly to RAM, (b) FB204 completed without error, and (c) the runtime program writes succeed.

7.1 Block Status Verification

In STEP 5, open the PG function PLC > Block Status for DB100. The status display shows the memory location (RAM or EPROM) and the current values. All data words should now contain non-zero values when PB10 is active.

7.2 Diagnostic Buffer Inspection

CPU 928B records OB181 and OB255 calls in the diagnostic buffer when configured for detailed logging. Inspect with:

PG > PLC > Diagnostic Buffer > [Filter: OB181, OB255]

A successful transfer appears as an "OB255 executed, DB100 created in RAM" entry. OB181 returning RL = 0 before the transfer indicates the DB was correctly absent from RAM, triggering the transfer. Filter by stop and restart events to isolate startup-phase activity.

7.3 Runtime Monitoring

Use the STEP 5 online monitor on PB10 and on the data words of DB100. With a test input forcing one or more I/O channels high, confirm that the corresponding DB100 data word updates within one OB1 cycle.

7.4 Test Plan Checklist

8. Error Codes and Diagnostic Reference

The CPU 928B reports the following error conditions related to OB181, OB255, and FB204 execution:

For standard CPU 928B error codes (QVZ, ZYK, etc.), refer to the CPU 928B diagnostics manual on the Siemens Industry Online Support portal. Cross-reference stop-cause codes with the diagnostics-buffer entries captured during commissioning.

9. Alternative Approaches

Several alternatives exist for handling runtime-mutable data on the S5-135U platform, each with trade-offs:

9.1 EEPROM Instead of EPROM

EEPROM modules allow byte-wise electrical erasure and can be written from user program. However, EEPROM has limited write endurance (typically 10,000 to 100,000 cycles per cell) and slower write time (1-10 ms per byte). For high-frequency writes (every OB1 cycle, for example, an I/O mirror update at 10 ms intervals), EEPROM life is consumed rapidly: 100,000 cycles / 10 ms = 1,000 seconds ≈ 17 minutes. EEPROM is suitable for low-frequency parameter storage (recipe change once per shift) but not for cyclic data.

9.2 Pure RAM Configuration

Using battery-backed RAM for all blocks eliminates the read-only problem entirely. The trade-off is reliance on the backup battery; if the battery fails and mains power is lost, all RAM contents (including the program) are erased. Best practice is to maintain an EPROM image as backup, stored in a safe location, ready to be re-burned if the RAM is lost. CPU 928B has a battery-failure detection that flags BSTSUCH (battery fault) in the diagnostic buffer.

9.3 S7 Migration

Modern S7-300/S7-400 systems handle this differently. Load memory (MMC) is non-volatile, work memory is RAM, and the CPU automatically manages loading based on the block's location in load memory. The S5 EPROM-to-RAM pattern is not required in S7 because the load memory is not directly accessible by user instructions. For new installations, migrating to S7-1500 eliminates the issue entirely but requires hardware replacement and program conversion via the S5 to S7 converter tool.

9.4 Indirect Addressing Through a Shadow DB

An alternative to runtime DB transfer is to keep all runtime data in a fixed "shadow" DB located in RAM from project start, and use pointer math in PB10 to index into the shadow DB rather than writing to the original EPROM DB. This decouples the data location from the program logic and avoids the need for OB255 transfers, but requires re-architecting the program.

10. CPU 928B Technical Specifications Reference

The following specifications are relevant to memory configuration and the EPROM-to-RAM transfer pattern. Consult the official SIMATIC S5 product page and the CPU 928B device manual on the Siemens Industry Online Support portal for the authoritative version.

10.1 STEP 5 Memory Model Summary

STEP 5 distinguishes between program blocks (OB, PB, FB, SB) and data blocks (DB, DX). Program blocks contain executable STEP 5 statements; data blocks contain data words and data double words. The CPU 928B maintains a block directory in a fixed memory area; the directory itself is in RAM (mirrored from EPROM at startup if EPROM is present). Block existence checks via OB181 consult this directory plus the actual memory module mapping.

11. Frequently Asked Questions