Simatic S5 Memory Architecture Overview
The Siemens SIMATIC S5 family stores the executable user program in three physically distinct media: volatile RAM backed by a buffer battery, UV-erasable EPROM memory submodules, and (on later CPU variants such as the S5-95U and S5-115U second-generation units) electrically erasable EEPROM. The CPU's onboard operating system (the Firmware AG and System Program) lives in a separate masked ROM and is not user-modifiable. Understanding which destination a STEP 5 download reaches is critical when commissioning, restoring after a soft-stop fault, or migrating programs between controllers.
When a STEP 5 Download command is issued from the programmer over the serial MPI/AS511 interface, the transfer target is determined by the active memory submodule physically present in the CPU's memory submodule slot, not by the STEP 5 software. Specifically:
- If a RAM submodule (e.g., 6ES5 375-0LA15, 6ES5 375-1LA15) is inserted, the program is written into volatile RAM and remains valid only while the buffer battery holds charge.
- If an EPROM submodule (e.g., 6ES5 372-1LA15, 6ES5 373-0LA15) is inserted, the CPU executes a copy operation that writes the program into the EPROM during the download. This requires that the EPROM be pre-erased and that no write-protection switch be engaged.
The SIMATIC S5 system manual STEP 5 / ST V7.1, Chapter 18.2 "Memory Submodules" documents this destination routing explicitly and is the canonical reference for any field engineer restoring an S5 system after a fault.
RAM, EPROM, and EEPROM Module Types
The three memory technologies are not interchangeable. Each has distinct electrical, mechanical, and operational characteristics that govern how the engineer must handle them.
| Technology | Typical S5 Catalog Number | Erasure Method | Write Cycles | Retention | Volatility |
|---|---|---|---|---|---|
| RAM (CMOS static) | 6ES5 375-0LA15 (32 KB) 6ES5 375-1LA15 (64 KB) |
N/A (overwritten) | Unlimited | While battery > 3.0 V | Volatile |
| EPROM (UV-erasable) | 6ES5 372-1LA15 (32 KB) 6ES5 373-0LA15 (64 KB) |
UV-C light (~253.7 nm), 20–30 min | < 100 (typical) | > 10 years (no power) | Non-volatile |
| EEPROM (serial) | 6ES5 374-0LA15 (various) | Electrical (in-circuit) | 10,000–100,000 | > 10 years | Non-volatile |
The ceramic-windowed DIP EPROM package is unmistakable: a quartz window roughly 8 mm × 16 mm sits above the silicon die. This window must be covered with an opaque label during normal operation to prevent accidental erasure from ambient UV sources (notably fluorescent lighting and direct sunlight).
STEP 5 Program Transfer Targets
The STEP 5 programming software (versions V6.x through V7.2, with V7.1 the most widely deployed) issues a download via the menu path File > Download > Block or Transfer > EPROM. Two fundamentally different operations are available:
- Standard Download (RAM) – The programmer writes the compiled blocks (OB, PB, FB, DB, SB, FX) directly to the CPU's RAM area via the AS511 serial protocol at 9600 bit/s. This is the default mode and is the operation the original poster performed after the overall reset.
- EPROM Programming – This operation is available only when the external EPROM programmer connected to the PG is used, OR when a Siemens Field PG with an integrated submodule programmer is fitted. The CPU itself cannot erase or program a UV-EPROM; only a dedicated programmer can drive the Vpp (typically +12.5 V or +21 V) programming pulses required by the EPROM cell.
Overall Reset and Cold Restart Procedure
The scenario described in the source – a CPU that comes up in soft stop with the STOP LED flashing after a mechanical disturbance (dust ingress, reseating) – is a textbook case for the standard S5 recovery sequence. The IStack (Interrupt Stack) fault entries after such an event typically report errors in the DB 0 / DX 0 system data block, pointer corruption, or battery-fail flags.
- Power down the central rack. Remove the CPU from the rack if the buffer battery shows any signs of leakage or low voltage.
- Disconnect the buffer battery connector from the CPU front panel. This forces a true cold start and clears any RAM-resident pointer corruption that survived a warm restart.
- Re-seat all memory submodules, I/O modules, and the CPU. Verify the slot coding keys match the hardware configuration.
- Reconnect the battery only after the CPU has been powered on and reached STOP.
- With the mode selector in STOP, perform an Overall Reset: hold the mode selector in the MRES position for 3 seconds, release, then rotate to MRES again within 3 seconds and hold for 3 seconds. The CR LED will flash twice to confirm.
- Switch to RUN. The CPU will report an IStack fault if the program is missing or contains a syntax error – this is expected behavior.
- Reconnect STEP 5, perform
Transfer > Downloadto load the user program back into RAM.
Programming EPROM with Field PG M
The Siemens Field PG M (catalog number 6ES7 712-0AA00-0AA0 and successor part numbers 6ES7 712-1AA00-0AA0, 6ES7 713-1AA00-0AA0) integrates a submodule programmer directly into the PG chassis. The programming socket is located behind the front-panel cover and accepts 24-pin and 40-pin S5 memory submodules. The Field PG P (professional variant) and later Field PG M4 / M5 / M6 share the same programming electronics but use updated driver software (PROM programmers for STEP 5).
- Insert the erased EPROM submodule into the programmer socket with pin 1 oriented toward the marking on the socket.
- From STEP 5, select
File > Transfer > EPROM(or use the integratedS5-EPROM Programmerutility underStart > SIMATIC > STEP 5 > Tools). - Choose the target file containing the compiled S5 program (
.S5Dproject file or pre-compiled.BINimage). - Set the device selection to match the EPROM catalog number (e.g., 6ES5 372-1LA15 for 32 KB, 27C256-compatible).
- Initiate programming. The programmer applies the Vpp voltage (12.5 V for standard EPROMs, 21 V for some 27C-series devices) and verifies each byte. Programming time for a full 32 KB EPROM is typically 60–90 seconds.
- Remove the EPROM, cover the quartz window with the supplied opaque label, and install it in the CPU's memory submodule slot.
UV Erasure Procedure for EPROM Modules
UV-erasable EPROMs require exposure to short-wave ultraviolet light at a wavelength of approximately 253.7 nm for a cumulative dose of approximately 15 W·s/cm². Commercial EPROM erasers expose the device at 1 inch (≈ 25 mm) from a 12 mW/cm² lamp for 20 to 30 minutes.
- Remove the EPROM from the CPU. Do not erase while installed – the UV will damage adjacent components and the quartz window will not be flush with the eraser lamp.
- Place the EPROM in the eraser with the quartz window facing the UV lamp.
- Set the timer for 25 minutes as a baseline; some EPROMs require 30+ minutes for full erasure of cells that have been programmed thousands of times.
- After the cycle, read the EPROM back on the programmer and verify all bytes read
0xFF. Any non-FF byte indicates incomplete erasure. - Replace the opaque label on the window before storage or reinstallation.
UV erasure is a destructive, all-or-nothing operation. There is no way to erase a single block or byte; the entire device is cleared.
ISTACK Fault Interpretation After Dust-Ingress Events
The IStack (Interrupt Stack) is the CPU's internal diagnostic buffer that records the last fault condition before the CPU transitioned to STOP. Reading the IStack from STEP 5 via PLC > IStack is the first diagnostic step after any unexplained STOP. Common IStack entries following a mechanical disturbance such as the dust blow-out described in the source include:
| IStack Code | Meaning | Typical Cause | Recovery |
|---|---|---|---|
| "DB not loaded" | Referenced data block missing | Overall reset cleared DB area | Re-download program; re-load DBs |
| "Pointer error" | Invalid address in DX 0 | RAM corruption from battery fail | Disconnect battery, overall reset, cold start |
| "Substitution error" | I/O module missing/faulty | Module not fully seated after cleaning | Re-seat module; check backplane pins |
| "Timeout" | Cycle time exceeded | EMC transient, blown dust into contact | Clear fault, cold restart |
| "Battery fault" | Buffer battery low/dead | Old battery, leakage | Replace battery, overall reset |
A "STOP LED flashing" condition with the original poster's error pattern most commonly indicates a combination of pointer corruption and missing DBs – both of which are cleared by the overall reset + RAM re-download sequence they performed.
Memory Module Specifications and Part Numbers
The following are the most commonly encountered S5 memory submodules in legacy installations:
| Catalog Number | Capacity | Type | Compatible CPUs |
|---|---|---|---|
| 6ES5 372-1LA15 | 32 KB | EPROM 27C256-compatible | S5-115U, S5-135U, S5-155U |
| 6ES5 373-0LA15 | 64 KB | EPROM 27C512-compatible | S5-115U, S5-135U, S5-155U |
| 6ES5 375-0LA15 | 32 KB | RAM (battery-backed) | S5-115U, S5-135U, S5-155U |
| 6ES5 375-1LA15 | 64 KB | RAM (battery-backed) | S5-115U, S5-135U, S5-155U |
| 6ES5 374-0LA15 | 8–32 KB | EEPROM | S5-95U, S5-100U (selected CPUs) |
| 6ES5 385-2LA15 | 2 KB | EPROM (small) | S5-90U, S5-95U |
Compatibility between submodules and CPUs is strictly defined in the Siemens Industry Online Support portal under each CPU's product page. Substituting an EPROM for a RAM module (or vice versa) without an overall reset will result in a CPU that refuses to start, since the bootloader looks for different signatures.
Battery Backup and Volatile Memory Handling
RAM submodules retain their contents only while the buffer battery maintains a terminal voltage above approximately 3.0 V. The standard backup battery is the Siemens 6ES5 980-0AE11 (lithium) or equivalent third-party 3.6 V / 1.2 Ah primary cell. Battery life is typically 3–5 years at 25 °C; high ambient temperature dramatically reduces life.
When loading a program from EPROM to RAM, the procedure is:
- Power down the CPU.
- Insert the programmed EPROM submodule.
- Hold the mode selector in MRES while powering up to force the bootloader to read from EPROM.
- Power up. The bootloader copies EPROM contents into RAM.
- The RAM backup battery retains the copy from this point onward.
Verification and Commissioning Checks
After any memory operation – download, EPROM programming, or overall reset – verify the system is healthy before returning it to service:
- From STEP 5, perform
PLC > Statusand confirm the CPU reports RUN, no IStack faults, and the expected cycle time. - Use
PLC > ForceorPLC > Monitorto verify each block type is loaded: OBs, PBs, FBs, DBs, SBs, FXs. - Cross-check the program checksum against the source STEP 5 project file if an EPROM was used.
- Perform a controlled I/O checkout, walking through each input and output in sequence.
- Document the memory submodule catalog number, programmed date, and software revision in the maintenance log.
Troubleshooting Matrix
| Symptom | Likely Cause | Action |
|---|---|---|
| STOP LED flashing after mechanical work | IStack pointer corruption, missing DBs | Overall reset + RAM re-download |
| CPU reports "No EPROM" at startup | EPROM signature invalid or windowed EPROM exposed to UV | Re-program EPROM on PG; verify contents |
| Program lost on power cycle | Buffer battery dead or disconnected | Replace battery; verify > 3.2 V loaded |
| Download fails with "Write error" | RAM submodule write-protect switch engaged | Disable write-protect on submodule |
| IStack reports "Timeout" on RUN | Cycle time exceeded after program change | Optimize OB1; check for runaway loops |
Frequently Asked Questions
Does a STEP 5 download write to EPROM or RAM by default?
By default a STEP 5 download writes to the memory submodule physically present in the CPU's memory slot. If a RAM submodule is installed (most common for active development), the program is written to volatile RAM. If an EPROM submodule is installed and the PG has an integrated programmer, the EPROM is written directly. The CPU itself cannot program a UV-EPROM – an external programmer or a Siemens Field PG M with built-in programmer is required.
How do I force the CPU to load the program from EPROM into RAM at startup?
Power down the CPU, disconnect the buffer battery, insert the programmed EPROM submodule, then hold the mode selector in MRES while powering up. The bootloader will copy the EPROM contents into RAM. Reconnect the battery only after the CPU reaches STOP. This sequence ensures a clean EPROM-to-RAM transfer without retaining stale RAM data from a previous program.
How long does it take to erase an EPROM with UV light?
A typical 27C256 or 27C512 EPROM is fully erased in 20 to 30 minutes at a UV-C intensity of 12 mW/cm² at a distance of 1 inch (≈ 25 mm). Verify erasure by reading the device back on the programmer – all bytes must read 0xFF. EPROMs that have been programmed many times may require longer exposure.
Why did my CPU fault after I cleaned dust from the rack and re-assembled it?
Mechanical disturbance (reseating modules, vibration from air-blowing) can cause intermittent contact at the backplane connectors and can discharge static into CMOS RAM, corrupting pointer data in DB 0 / DX 0. The standard recovery is overall reset followed by a fresh program download into RAM, exactly as performed in the scenario described.
What is the difference between EPROM and EEPROM in S5 systems?
EPROM (erasable programmable read-only memory) is erased by exposure to UV-C light through a quartz window on the chip package; the entire device is cleared in one operation. EEPROM (electrically erasable PROM) can be erased in-circuit by an electrical signal, byte-by-byte or block-by-block, with no UV exposure required. Later S5 CPU families (S5-95U, second-generation S5-115U) support EEPROM submodules for in-system reprogramming without removing the chip from the rack.