Siemens S5 Missing DB64: Diagnosing Hidden EPROM Data Blocks

When a SIMATIC S5 program references a data block that does not appear anywhere in the offline STEP 5 project tree, the cause is almost always a runtime-generated or EPROM-supplied DB. This guide explains the address-decoding mechanics of addresses such as W h40EB, the EPROM/RAM model that hides a DB from the cross-reference, and the exact diagnostic path for recovering a "missing" DB 64 whose variables are still being read by an HMI such as TsWin (Telenorma / Krause / Progea visualization driver).

1. The "Hidden DB" Phenomenon Explained

A SIMATIC S5 CPU can address up to 255 data blocks (DB 0 through DB 255) and 255 extended data blocks (DX 0 through DX 255). STEP 5 stores only the DBs that are explicitly created in the editor and that contain user-defined data. If a visualization layer — for example TsWin — polls an operand such as W h40EB, the panel is reading data word 235 from DB 64. If DB 64 is not present in the offline project but the value updates on the HMI, the DB was provisioned at runtime by one of the following mechanisms:

1. Initialization code executed on cold restart (OB 20/21/22) or warm restart (OB 30) using A DB 64 + L DW 235 patterns.
2. An EPROM-resident subroutine that auto-generates DBs from a binary image.
3. An external tool (e.g. a third-party block transfer utility) that downloaded a binary block without a matching source listing.
4. A function module in the S5 rack that writes the DB directly through the backplane.

The symptom is identical in every case: the offline project shows no DB 64, the cross-reference does not flag it, and yet the HMI displays live values that change with process state. The HMI is correct — the data is real — but the S5 programmer cannot find its definition in the offline S5D file.

2. Siemens S5 Data Block Architecture

Every DB / DX in STEP 5 has three fundamental attributes that determine its visibility in the editor and its behavior at runtime:

A DB is created offline with File → New Block → Data Block in STEP 5, or by the special function FB 0 (Generate DB) used inside an S5 program. If the offline source was never written but the runtime DB exists, the block must have been loaded directly into the CPU by one of these paths:

• Through the serial PG interface using PG → AG → Block Transfer with no source file.
• From an EPROM module (6ES5 371-0LA11 or 6ES5 375-0LA11 EEPROM) inserted in the CPU.
• By an FB / OB that calls SU 24 (DB generate) or SU 25 (DX generate) — CPU-specific system utilities available on S5-115U/135U/155U.

3. Decoding the Hex Address W h40EB

The visualization address W h40EB is a packed hexadecimal address. TsWin and most S5 HMI drivers use the following convention:

The full operand is therefore DB 64, data word 235, bit 0 — written in STEP 5 AWL as DBX 235.0 for a bit, or DW 235 for a full 16-bit word. Note the inconsistent offset: an EB hex field encodes a word offset even though the prefix resembles the German "Eingangs-Byte" mnemonic. This is purely a TsWin convention, not an S5 standard.

Many S5 programmers make the mistake of interpreting EB as an input byte (Eingangs-Byte). The TsWin convention is unrelated to the standard S5 operand area; it is a tag-list address that the panel driver translates into a STEP 5 L DW 235 / T DW 235 cycle over the AS511 serial protocol.

4. STEP 5 Program Storage: EPROM vs RAM

S5 CPUs distinguish between three storage locations, and understanding the difference is the key to understanding the hidden DB:

If a program is stored on EPROM and the offline source file has been lost or never transferred, the EPROM image is the only authoritative copy. The DB structure exists in the EPROM; the STEP 5 PC sees only the S5D file, which can be incomplete. In the field, this is the single most common cause of the "missing DB" mystery.

To check, perform a PG → AG → Block Status on the CPU while connected. If DB 64 appears with a length and content but is absent from the offline project, you are looking at an EPROM-loaded block. On an S5-115U, you can use the ISTACK and BSTACK displays to confirm; on an S5-95U / 100U the LED "BAU" (Baugruppen-Anzeige) and the operator panel provide the same information.

5. Why a DB Appears Unused Yet Receives Writes

STEP 5 cross-reference (XR) marks a block as "used" only if it is referenced in the offline source by A DB n, AX DX n, or a transfer to DW m / DD m / DBX m.x. The cross-reference is a static analysis of the source — it does not see runtime data flow. There are five well-documented scenarios in which a DB is genuinely used at runtime yet invisible to the offline cross-reference:

1. Indirect DB opening. A DB 0 followed by L DBW 64 in a loop uses whatever number the operator entered into DBW 64. The cross-reference cannot resolve this statically.
2. OB-driven initialization. OB 20/21/22 (cold restart) and OB 30 (warm restart) often contain A DB 64; L KF +0; T DW 235 ... T DW 254 to zero a process data block. If the offline copy of OB 20 is missing or has been overwritten, the XR sees nothing.
3. System-generated DBs. On S5-115U with the COM package 5412 (COM 155U / 135U) the communication FBs automatically create and update DBs for handshake data. The cross-reference treats them as un-used.
4. FB instance DBs. An FB can be instantiated by a CALL that uses a previously generated instance DB; the FB body never names its instance explicitly, so the static analysis misses it.
5. External hand-shake via FMs. Function modules in the S5 rack (DP master, AS-i, IP 240 counter, IP 244 U-control) often use pre-loaded DBs that are never written by STEP 5 code — the FM itself writes them through the backplane.

For the TsWin address W h40EB, the most likely scenarios are (1) and (2). The HMI driver does not care which block the data lives in; it executes a L DW 235 on whatever DB is currently open in the CPU's BS area. If the HMI driver is configured for DB 64 and the CPU has DB 64 open, the read succeeds.

6. TsWin Visualization Address Mapping

TsWin (originally TSwin, also shipped as Progea Movicon.TS or as a third-party Wonderware InTouch driver) maintains an internal tag list. The tag W h40EB is just a string the runtime driver parses. The driver on the panel side sends an S5 read request to the CPU. By default the panel uses the S5 AS511 protocol (later drivers use S5-LAN or S5-TCP / RFC1006 with an IBH-Link S5++ / S7-LAN gateway).

The request for W h40EB is therefore an S5 AS511 read of "data word 235 from DB 64" — regardless of whether any STEP 5 program in the offline project opens DB 64. If the CPU has been programmed (by whatever means — EPROM, FB, OB, FM) to have a DB 64 in work memory, the read returns the current value.

7. Diagnostic Procedure

Follow this sequence when a referenced DB is not visible in the offline STEP 5 project.

1. Confirm online presence. Connect the PG, go online (PG → AG → Connect or ONLINE → OPEN), and list the CPU block directory. The directory shows the actual blocks in load memory. If DB 64 is listed with a non-zero length, the block is online even though it is not in your S5D source.
2. Read the block online. Use FILE → OPEN with block number 64, type DB. STEP 5 will read the live image and display it. Save it immediately with FILE → SAVE to your local S5D file. This recovers the source.
3. Check the EPROM. If the PG cannot read DB 64 online, power off the rack, remove any EPROM module, re-insert, and repeat. On S5-115U / 135U / 155U, the EPROM contains the load image; the RAM is loaded from the EPROM on power-up.
4. Inspect the ISTACK. PG → AG → ISTACK displays the interrupt stack including the currently open DBs and OBs. This tells you which block the CPU was running when the last interrupt occurred.
5. Inspect the BSTACK. PG → AG → BSTACK (block stack) lists the call hierarchy. If OB 1 → FB 100 → ... and DB 64 is open, the chain is visible.
6. Run cross-reference after the recovery. After saving DB 64 to the source file, the XR will pick it up. Use XR → REFRESH (or SHIFT-F5 in S5-DOS) to force a rebuild.
7. Verify the HMI tag list. In TsWin, re-import the S5 symbol table or manually confirm that W h40EB is mapped to DB 64 / DW 235. If the HMI driver uses AS511, dump the live data with Online → Tag Monitor.

8. Locating and Regenerating DB64

If the offline S5D file truly does not contain DB 64, the only way to recover the data structure is from the running CPU. Connect the PG, go online, and perform the following:

1. FILE → OPEN → DB → 64. STEP 5 prompts to read from AG.
2. The editor opens the DB in hex / text mode. The first word is the DB length; subsequent words are data in the order they were written.
3. Save the DB locally. STEP 5 writes a new DB64.S5D in the current project folder.
4. Re-open the cross-reference. DB 64 now appears in the list of used blocks.

If the online read fails with "Block not found in AG", the block is in EPROM only and the CPU firmware has not loaded it into work memory. In that case the read is impossible — you must obtain the EPROM image directly, for instance by reading the EPROM with a standard EPROM programmer (Data I/O, Hi-Lo, or modern Xeltek) and disassembling the S5 image with a third-party converter. Useful Siemens documentation for the AG 115U / 135U / 155U backplane and EPROM handling is the SIMATIC S5-115U Programmable Controller Manual (Order No. 6ES5 998-0UB25).

If recovery from the live CPU is not possible (CPU replaced, EPROM unreadable), you must reconstruct DB 64 manually. The minimum information you need is:

• The block length in words.
• The offset of every data word the HMI polls (or the offsets the FBs read / write).
• The data type of each word (KW, KF, KH, KT, KC, KG, KY, KS — see the STEP 5 data-format table below).

A practical approach is to read the TsWin tag list: every W h40EB, W h40EC, ... entry in the HMI corresponds to a word in DB 64. Build a template DB by exporting the HMI tag list to CSV and converting each line to a STEP 5 declaration.

For each W h40xx entry the HMI reads, declare the corresponding DW xx in the new DB. Typical sections in a process-data DB are:

• DW 0–9: Header / status / hand-shake.
• DW 10–99: Process inputs (sensor values, scaled).
• DW 100–199: Process outputs (setpoints, commands).
• DW 200–255: Internal flags, alarms, recipes.

DW 235 therefore falls in the "alarms" or "internal flags" area in a typical 256-word DB. The HMI may be reading alarm status, recipe step counters, or last-error codes.

9. STEP 5 Editor Operations

Below are the exact keyboard sequences for the most common STEP 5 editors (S5-DOS, S5/MT, S5/PC) when working with a missing DB.

If you have a STEP 5 license with the S5-Package, the cross-reference list (XRF) can be regenerated from the consolidated project. The output is a flat file with the line number, block, operand, and reference. The key step is to make sure the file XR.PRN is updated after every change — older S5-DOS versions require a manual XR-Generate before re-loading the project.

10. Cross-Reference Analysis

The cross-reference (XR) is the most important diagnostic tool for this type of fault. STEP 5's XR has three modes:

1. Local XR: Within a single block. Useful for tracing operand use in one FB.
2. Project XR: Across the entire S5D project. Shows all references to a given operand or symbol.
3. Online XR: Built from the live CPU. Provides the most accurate picture of what is actually running.

To diagnose the hidden DB, build a project XR for operand DB 64. If the project XR shows no references but the online XR does, you have confirmed an EPROM-resident block. To find the EPROM:

1. Power off the S5 rack.
2. Locate the EPROM module (typically on the CPU or on a memory card slot). The Siemens part numbers are:
   • 6ES5 371-0LA11 (16 KB EPROM, 2 x 8-bit sockets)
   • 6ES5 371-0LA21 (32 KB EPROM)
   • 6ES5 371-1LA11 (64 KB EPROM)
   • 6ES5 375-0LA11 (EEPROM, field-erasable)
3. Read the EPROM with a programmer and save the binary image.
4. Use a STEP 5 image converter to extract individual blocks. The image format is well documented: a 4-byte header, then concatenated blocks with a 6-byte sub-header (block type, number, length, library flag).

Once the block is recovered, paste it back into the offline project and refresh the XR.

11. Verification and Commissioning

After recovering or regenerating DB 64, perform these checks before signing off the change order.

1. Online block directory. Read the directory from the CPU and confirm DB 64 is listed with the expected length.
2. Symbol match. The HMI tag W h40EB must read the same value as a STEP 5 monitor: open DB 64 in ONLINE MONITOR (F11 in S5-DOS) and check DW 235.
3. Live change test. Force a value into DW 235 with FORCE VAR (or write via AWL: L KF +1234; T DW 235) and confirm the HMI shows +1234 within one polling cycle (typically 250 ms to 1 s for AS511).
4. Retentivity check. Cycle power to the rack. Confirm DB 64 retains values. If it does not, the DB is in RAM only and the battery is healthy; if it does, the DB is remanent and you can lose the values only if the battery is dead.
5. Cross-reference integrity. Re-run the project XR; it should now list DB 64 with at least one reference.
6. Backup. Save the S5D project to EPROM (or to the PG hard disk with PROJECT → ARCHIVE) so the next programmer does not have to repeat this exercise.

12. Field-Proven Caveats and Related Topics

• DB 0 is reserved. Some HMI drivers use DB 0 as a status block. Do not overwrite DB 0 with a process-data DB. TsWin never uses DB 0 for tags, but some S5 OPC servers do.
• DX vs DB. DX blocks are extended data blocks with a 16-bit index per data word, used by FBs that require a "private" memory area. If the HMI tag uses DX, the hex field 4X is replaced by 5X in the TsWin convention. Check the documentation of the panel driver if you see W h50EB.
• Overlapping DBs. The S5 does not protect against two blocks sharing the same number; if you have both a DB 64 and a DX 64, the DX takes precedence. Be aware when naming a new DB.
• Address arithmetic error. Some older TsWin drivers add 1 to the data-word offset because the S5 internal DB header takes the first word. If the HMI reads W h40EB but your DB has DW 234 as the first data word, the panel is offset. The fix is to set the DB to begin with DW 0 = first data word, or to set the HMI driver to "header length = 0".
• Indirected DB number. If the S5 program does A DB 0; L DBW 64; the program is using whatever DB the user has typed into DBW 64 of DB 0. In this case the "DB 64" is just a name, not a block.
• Watchdog DB. Some S5 FBs create a watchdog DB that is updated by OB 1 (heartbeat). If the FB is missing from the project, the watchdog DB will not be initialized on restart and the CPU may go to STOP.
• AS511 polling. The S5 AS511 driver used by TsWin performs one read per scan per tag. If you have 200 tags, the CPU scan time may grow by 20 to 40 ms. When you "see" the missing DB after adding many new tags, the slowdown is the cause, not the recovery.
• Migration to S7-1500. During migration, the missing-DB problem recurs in a new form: the migration tool generates a DB with the correct number and length, but the S7 cross-reference still shows the data as "unused" because the tool cannot infer the indirect access pattern. The fix is the same: add an ACCESS('DB 64 / DW 235') pragma to the DB and re-build the cross-reference in TIA Portal. For the full migration workflow, see the Siemens S5 to S7 Migration Guide on Siemens Industry Online Support.
• Modern connectivity. If the HMI must be reached over Ethernet, an IBH-Link S5++ or Helmholz NETLink PRO gateway translates AS511 to RFC1006 / TCP. The gateway configuration must be told which DB numbers are reachable — DB 64 must be in the gateway's accessible-DB list, otherwise the read returns an error even when the block is alive in the CPU.
• Battery replacement. When the S5 backup battery is replaced after a long downtime, all RAM-resident DBs are lost. EPROM-resident DBs survive. A "missing DB" fault that appears immediately after battery replacement is almost always a RAM-only block that was not backed up to EPROM.

Official references available from Siemens Industry Online Support:

• STEP 5 Programming Manual (Order No. 6ES5 998-0PR05)
• SIMATIC S5-115U Programmable Controller Manual (Order No. 6ES5 998-0UB25)
• S5-155U CPU 948 / 928B Reference Manual (Order No. 6ES5 998-0UB15)