Siemens S5 CPU 928A 6ES5928-3UA12 Program Load Error 3042 Fix

Siemens SIMATIC S5 CPU 928A (6ES5928-3UA12) — S5W Warning 3042 "GetComm Error" Program Load Failure

Field Reference: S5W software build S5W-290395-1738 (BWCC v2.0 / Version 2.14), CPU module 6ES5928-3UA12, TTY/V.24 converter 6ES5 734-1BD20. Target: SIMATIC S5-135U / S5-155U rack.

1. Problem Statement and Symptom Envelope

A user attempting to download (write/load) a STEP 5 program into a Siemens SIMATIC S5 CPU 928A (full order number 6ES5928-3UA12) receives an S5W dialog banner reading "Warning No.: 3042" with the body text "GetComm Error" and a non-deterministic secondary error code that changes with every attempt. Documented secondary codes from the source incident include:

• 4399
• 7519
• 6695
• 6957
• 4313
• 10223

The randomness of the secondary code (each retry produces a different value) is the most important diagnostic clue: the lower-layer serial driver is reporting timeout / overrun / framing class errors rather than a deterministic protocol rejection. Concurrently:

• The PG cable and the 6ES5 734-1BD20 converter are known-good (verified against other S5 CPUs in both read and write modes).
• The Block Status Display function on the same CPU reports all inputs and outputs correctly (live process image visible).
• Pin 14 of the CPU front TTY port measures +5.2 V DC with respect to ground.
• There is no active TTY loopback header/jumper installed at the CPU.

The combination of "read works / status works / write fails with random timeout" points to a port-role mismatch, TTY current-loop termination, or converter hand-shake polarity issue — not a hard cable fault.

2. Hardware Identification

2.1 CPU 928A — 6ES5928-3UA12

2.2 TTY/V.24 Converter — 6ES5 734-1BD20

The 6ES5 734-1BD20 is a passive optical isolator; it relies on the CPU to source the loop current. If the CPU does not provide +5.2 V on pin 14, the TTY loop cannot close and the converter cannot transmit toward the PG. The user has already confirmed +5.2 V is present, so the converter is electrically powered — the failure is therefore downstream of the power path.

3. Prerequisites

1. STEP 5 programming license and S5W (or STEP 5 / PG 2000) installed on the engineering station.
2. PG cable 6ES5 734-1BD20 (or equivalent 6ES5 734-1xxx) verified against a known-good CPU.
3. Multi-meter for TTY pin voltage and loop current measurement.
4. 15-pin sub-D male TTY loopback plug (or jumper between pins 9↔11 and 8↔13 for send/receive verification).
5. Access to the CPU front panel — the rack must be de-energised before any jumper change but may remain powered for voltage measurement.
6. The target STEP 5 program file (.S5D) ready to load.

4. Root Cause Analysis — Why Error 3042 Occurs

S5W Warning 3042 belongs to the S5 communication layer (the AG-Send/AG-Receive handshake over the PG port). It is raised when the Windows COMM driver reports a serial exception that is not classifiable as a clean protocol reject. The most common root causes for the 6ES5928-3UA12 in this exact symptom pattern are:

4.1 Front-Panel PG Port Role Confusion

The CPU 928A exposes a single 15-pin TTY port, but on some firmware versions the same physical connector carries two logical roles selected by the DB 1 (system data) parameter FB 2 / FX 2 — "PG port assignment". If the CPU has been configured to use the port for OP / status display only (a common default for shipped units), the Block Status Display will work but write operations will be rejected with a timeout. The PG tool is not refused a connection — the CPU is simply not listening to the S5 download protocol on that socket.

4.2 Missing TTY Active Loop Terminator

20 mA current loop signalling requires both ends to participate. The CPU provides the source on pin 14 (+5.2 V) and the receive / send pairs on pins 9/11 and 8/13. The 6ES5 734-1BD20 closes the loop optically. If the CPU has been previously modified to disable the internal active terminator (a feature offered by some firmware for use with passive external current loops), the loop current will collapse to a few mA and the S5 handshake will fail intermittently — exactly the random-error symptom observed.

4.3 Converter Hand-Shake Polarity (RTS/CTS vs. S5 Protocol)

The 6ES5 734-1BD20 is wired so that hardware hand-shaking on the V.24 side is looped back. If the host PC has been configured (in Windows COM properties or in S5W) to enforce RTS/CTS flow control, the PC will drop RTS when its driver buffer is full. The 6ES5 734-1BD20 echoes that into the TTY loop as a "transmit inhibit" — the CPU sees a non-standard signal and aborts the block write, surfacing as 3042 with a random secondary code.

4.4 S5W COM-Port Speed / Parity Mismatch

Although S5W auto-bauds, the very first frame is sent at a fixed probe rate (normally 9600 8N1). If the PC's UART clock is non-standard (some USB-to-serial adapters do not honour 9600 exactly), the CPU re-syncs the Block Status Display (which is more tolerant) but the longer download frames of a full program transfer fall out of frame. Random secondary codes are the classic fingerprint.

5. Step-by-Step Diagnostic Procedure

Follow the steps in order. Each step ends with a go/no-go decision; do not skip the loopback test — it is the single most useful check in the field.

Step 1 — Confirm the active PG port is enabled

1. Put the CPU in STOP using the mode switch on the front panel.
2. Press the RESET button for ~2 s until all LEDs flash.
3. Power-cycle the rack.
4. Connect the PC and start S5W. In the File → Online → Set Connection… dialog, ensure the interface is set to TTY / AS511 (not V.24 direct, not Ethernet).
5. If the dialog offers a "Port A / Port B" choice, the CPU 928A exposes only one port — select the only entry that matches the connected COM number.
6. Try Status Block on OB 1. If this works, the physical layer is healthy. If it does not, proceed to Step 2 before continuing.

Step 2 — Verify TTY loopback at the converter

1. Disconnect the 6ES5 734-1BD20 from the CPU.
2. Insert a 15-pin TTY loopback plug: short 9 ↔ 11 and short 8 ↔ 13; leave pin 14 floating (no power source on the bench).
3. Connect the converter's V.24 side to the PC.
4. Open a terminal emulator (PuTTY / Tera Term) at 9600 8N1, no flow control, and type characters. They must echo back.
5. If no echo: replace the converter (the optical isolator inside the 6ES5 734-1BD20 is known to age-fail after 15+ years).

Step 3 — Measure TTY supply and loop current at the CPU

1. Re-connect the 6ES5 734-1BD20 to the CPU front port while the rack is powered.
2. Measure pin 14 to pin 1 (GND): expect +5.2 V ± 0.3 V. The user already confirmed this.
3. Insert a milli-amp meter in series with the receive pair (break pin 9, meter between CPU pin 9 and converter pin 9). Expect 18 – 22 mA.
4. If loop current is < 10 mA, the internal active terminator inside the CPU has been disabled in DB 1. Restore it via STEP 5 → Edit → System Data → word SS-DB1.DBW2 bit 0 = 1, or re-flash the system data block from a known-good archive.

Step 4 — Configure S5W communication parameters

1. In S5W: File → Online → Set Connection…
2. Select the COM port the 6ES5 734-1BD20 is connected to.
3. Set the protocol to AS511 (this is the only protocol the CPU 928A accepts on the PG port).
4. Set the interface type to TTY. Do not select V.24 / RS-232-C — the converter handles the conversion.
5. Set baud rate to 9600 (the default CPU 928A boot baud).
6. Disable hardware hand-shaking in the underlying Windows COM port: Control Panel → Device Manager → Ports (COM & LPT) → Properties → Port Settings → Advanced → uncheck "Use FIFO buffers" if a USB-to-serial adapter is in use.

Step 5 — Try the write operation

1. Open the target STEP 5 file in S5W.
2. From the menu select Target System → Download (Block → PLC), or the keyboard shortcut Ctrl+F7.
3. Watch the S5W progress dialog. The download is healthy if the bar advances in steady increments and S5W reports "Transfer OK".
4. If Warning 3042 returns, capture the new secondary code and look it up in the matrix in Section 7.

Step 6 — Address-conflict sanity check

If the S5-135U / S5-155U rack has an expansion unit (EG), the CPU 928A must be the master. Verify in DB 1 that no IM 308 / IM 314 interface module is claiming the same logical rack. Mismatched rack addresses cause the S5 downloader to mis-target the write, again surfacing as a 3042 timeout.

6. Hardware Topology Diagram

7. S5W Error Code Matrix

All of the secondary codes seen in the source incident (4399, 4313, 7519, 6695, 6957, 10223) fall into the "physical-layer instability" family, not the "deterministic protocol rejection" family. The error never repeats the same value, which is the tell-tale sign of a framing / buffer / loop-current problem rather than a CPU firmware bug.

8. S5W Parameter Reference

9. Verification & Functional Test

After the corrective action, perform the following end-to-end check:

1. Re-read the entire program from the CPU (PLC → PC). The resulting file must be byte-identical to the just-loaded file.
2. Cycle power on the rack and verify the CPU comes up in RUN with the expected OB 1 scan time on the diagnostic LEDs / S5W status page.
3. Force a single output on the live process image and confirm the field device responds. This proves the downloaded logic is executable, not merely stored.
4. Re-archive the project to a separate folder. The 6ES5928-3UA12 has a non-replaceable lithium battery that backs up RAM; an unverified download can survive a power cycle and silently corrupt the project archive.

10. Related STEP 5 / S7 Memory Model Reference

Although the CPU 928A predates the S7-1200 family, the underlying concept of load memory ↔ work memory ↔ retentive memory still applies. In modern SIMATIC S7 controllers the program download is implemented by the READ_DBL / WRIT_DBL instructions, which move data blocks between load memory (memory card) and work memory (CPU RAM). On the S5-135U / S5-155U with the CPU 928A, the same idea is implemented at a lower level by EPROM / EEPROM sub-modules that act as load memory, with the on-board RAM acting as work memory. Understanding this split explains why a status read can succeed (work memory) while a download fails (load-memory write path) — the load-memory write path is the one that exercises the full PG-port protocol and is the first to fail when the TTY loop is marginal.

For an overview of the read/write memory model in the modern SIMATIC S7-1200 (functionally analogous), see the Siemens SIMATIC S7-1200 manual collection on TIA Portal documentation: Read / Write Memory Instructions (READ_DBL / WRIT_DBL).

11. Field-Engineer Notes

• Always measure the +5.2 V on pin 14 with the converter mated, not with the cable unplugged. The CPU only sources the loop voltage when the load is present.
• On the S5-135U, the CPU 928A is in slot 1 of the central rack. On the S5-155U it can be in slot 1 or 2 (dual-CPU configuration). A dual-CPU rack will have only one of the two CPUs accepting PG commands at a time — the other CPU must be in STOP with PG port function disabled.
• The 6ES5 734-1BD20 is a known weak part. If the optical isolator is failing intermittently, the symptom is exactly what is described in the source incident: the Block Status Display (which re-tries internally) keeps working, but the multi-frame block download (which requires sustained integrity) fails with a 3042 class error.
• USB-to-serial adapters based on the FTDI FT232R are strongly preferred for STEP 5 work. CH340 / CP2102 chips will sometimes pass loopback at 9600 but introduce a 0.5 % baud error that the CPU 928A rejects on long transfers.
• Document the CPU 928A's system data block (DB 1) before any firmware / parameter change. The default S5-135U DB 1 image is rarely available in modern archives and rebuilding it from scratch requires a second known-good CPU on the bench.

12. FAQ