Simatic S5 Program Transfer: RAM vs EPROM Memory Guide

David Krause11 min read
PLC HardwareSiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Simatic S5 Memory Architecture Overview

The Siemens SIMATIC S5 family stores the executable user program in three physically distinct media: volatile RAM backed by a buffer battery, UV-erasable EPROM memory submodules, and (on later CPU variants such as the S5-95U and S5-115U second-generation units) electrically erasable EEPROM. The CPU's onboard operating system (the Firmware AG and System Program) lives in a separate masked ROM and is not user-modifiable. Understanding which destination a STEP 5 download reaches is critical when commissioning, restoring after a soft-stop fault, or migrating programs between controllers.

When a STEP 5 Download command is issued from the programmer over the serial MPI/AS511 interface, the transfer target is determined by the active memory submodule physically present in the CPU's memory submodule slot, not by the STEP 5 software. Specifically:

  • If a RAM submodule (e.g., 6ES5 375-0LA15, 6ES5 375-1LA15) is inserted, the program is written into volatile RAM and remains valid only while the buffer battery holds charge.
  • If an EPROM submodule (e.g., 6ES5 372-1LA15, 6ES5 373-0LA15) is inserted, the CPU executes a copy operation that writes the program into the EPROM during the download. This requires that the EPROM be pre-erased and that no write-protection switch be engaged.

The SIMATIC S5 system manual STEP 5 / ST V7.1, Chapter 18.2 "Memory Submodules" documents this destination routing explicitly and is the canonical reference for any field engineer restoring an S5 system after a fault.

RAM, EPROM, and EEPROM Module Types

The three memory technologies are not interchangeable. Each has distinct electrical, mechanical, and operational characteristics that govern how the engineer must handle them.

Technology Typical S5 Catalog Number Erasure Method Write Cycles Retention Volatility
RAM (CMOS static) 6ES5 375-0LA15 (32 KB)
6ES5 375-1LA15 (64 KB)
N/A (overwritten) Unlimited While battery > 3.0 V Volatile
EPROM (UV-erasable) 6ES5 372-1LA15 (32 KB)
6ES5 373-0LA15 (64 KB)
UV-C light (~253.7 nm), 20–30 min < 100 (typical) > 10 years (no power) Non-volatile
EEPROM (serial) 6ES5 374-0LA15 (various) Electrical (in-circuit) 10,000–100,000 > 10 years Non-volatile

The ceramic-windowed DIP EPROM package is unmistakable: a quartz window roughly 8 mm × 16 mm sits above the silicon die. This window must be covered with an opaque label during normal operation to prevent accidental erasure from ambient UV sources (notably fluorescent lighting and direct sunlight).

STEP 5 Program Transfer Targets

The STEP 5 programming software (versions V6.x through V7.2, with V7.1 the most widely deployed) issues a download via the menu path File > Download > Block or Transfer > EPROM. Two fundamentally different operations are available:

  1. Standard Download (RAM) – The programmer writes the compiled blocks (OB, PB, FB, DB, SB, FX) directly to the CPU's RAM area via the AS511 serial protocol at 9600 bit/s. This is the default mode and is the operation the original poster performed after the overall reset.
  2. EPROM Programming – This operation is available only when the external EPROM programmer connected to the PG is used, OR when a Siemens Field PG with an integrated submodule programmer is fitted. The CPU itself cannot erase or program a UV-EPROM; only a dedicated programmer can drive the Vpp (typically +12.5 V or +21 V) programming pulses required by the EPROM cell.
Critical fact: Once the user has transferred a program back into the CPU after an overall reset, the program resides in RAM, not in the EPROM. The EPROM is only modified when an external/PG programmer writes to it directly. This is the source of the most common confusion in the field: the EPROM socket remains empty (or contains the original factory archive) until an explicit "Program EPROM" operation is performed from a PG.

Overall Reset and Cold Restart Procedure

The scenario described in the source – a CPU that comes up in soft stop with the STOP LED flashing after a mechanical disturbance (dust ingress, reseating) – is a textbook case for the standard S5 recovery sequence. The IStack (Interrupt Stack) fault entries after such an event typically report errors in the DB 0 / DX 0 system data block, pointer corruption, or battery-fail flags.

  1. Power down the central rack. Remove the CPU from the rack if the buffer battery shows any signs of leakage or low voltage.
  2. Disconnect the buffer battery connector from the CPU front panel. This forces a true cold start and clears any RAM-resident pointer corruption that survived a warm restart.
  3. Re-seat all memory submodules, I/O modules, and the CPU. Verify the slot coding keys match the hardware configuration.
  4. Reconnect the battery only after the CPU has been powered on and reached STOP.
  5. With the mode selector in STOP, perform an Overall Reset: hold the mode selector in the MRES position for 3 seconds, release, then rotate to MRES again within 3 seconds and hold for 3 seconds. The CR LED will flash twice to confirm.
  6. Switch to RUN. The CPU will report an IStack fault if the program is missing or contains a syntax error – this is expected behavior.
  7. Reconnect STEP 5, perform Transfer > Download to load the user program back into RAM.

Programming EPROM with Field PG M

The Siemens Field PG M (catalog number 6ES7 712-0AA00-0AA0 and successor part numbers 6ES7 712-1AA00-0AA0, 6ES7 713-1AA00-0AA0) integrates a submodule programmer directly into the PG chassis. The programming socket is located behind the front-panel cover and accepts 24-pin and 40-pin S5 memory submodules. The Field PG P (professional variant) and later Field PG M4 / M5 / M6 share the same programming electronics but use updated driver software (PROM programmers for STEP 5).

  1. Insert the erased EPROM submodule into the programmer socket with pin 1 oriented toward the marking on the socket.
  2. From STEP 5, select File > Transfer > EPROM (or use the integrated S5-EPROM Programmer utility under Start > SIMATIC > STEP 5 > Tools).
  3. Choose the target file containing the compiled S5 program (.S5D project file or pre-compiled .BIN image).
  4. Set the device selection to match the EPROM catalog number (e.g., 6ES5 372-1LA15 for 32 KB, 27C256-compatible).
  5. Initiate programming. The programmer applies the Vpp voltage (12.5 V for standard EPROMs, 21 V for some 27C-series devices) and verifies each byte. Programming time for a full 32 KB EPROM is typically 60–90 seconds.
  6. Remove the EPROM, cover the quartz window with the supplied opaque label, and install it in the CPU's memory submodule slot.
Field-proven caveat: A programmed EPROM must be read back and verified against the source file at least once before insertion into the CPU. The most common EPROM programming error is a single stuck bit at the high-address boundary due to address-line bounce; a byte-by-byte compare catches this before the EPROM is installed and the CPU faults again.

UV Erasure Procedure for EPROM Modules

UV-erasable EPROMs require exposure to short-wave ultraviolet light at a wavelength of approximately 253.7 nm for a cumulative dose of approximately 15 W·s/cm². Commercial EPROM erasers expose the device at 1 inch (≈ 25 mm) from a 12 mW/cm² lamp for 20 to 30 minutes.

  1. Remove the EPROM from the CPU. Do not erase while installed – the UV will damage adjacent components and the quartz window will not be flush with the eraser lamp.
  2. Place the EPROM in the eraser with the quartz window facing the UV lamp.
  3. Set the timer for 25 minutes as a baseline; some EPROMs require 30+ minutes for full erasure of cells that have been programmed thousands of times.
  4. After the cycle, read the EPROM back on the programmer and verify all bytes read 0xFF. Any non-FF byte indicates incomplete erasure.
  5. Replace the opaque label on the window before storage or reinstallation.

UV erasure is a destructive, all-or-nothing operation. There is no way to erase a single block or byte; the entire device is cleared.

ISTACK Fault Interpretation After Dust-Ingress Events

The IStack (Interrupt Stack) is the CPU's internal diagnostic buffer that records the last fault condition before the CPU transitioned to STOP. Reading the IStack from STEP 5 via PLC > IStack is the first diagnostic step after any unexplained STOP. Common IStack entries following a mechanical disturbance such as the dust blow-out described in the source include:

IStack Code Meaning Typical Cause Recovery
"DB not loaded" Referenced data block missing Overall reset cleared DB area Re-download program; re-load DBs
"Pointer error" Invalid address in DX 0 RAM corruption from battery fail Disconnect battery, overall reset, cold start
"Substitution error" I/O module missing/faulty Module not fully seated after cleaning Re-seat module; check backplane pins
"Timeout" Cycle time exceeded EMC transient, blown dust into contact Clear fault, cold restart
"Battery fault" Buffer battery low/dead Old battery, leakage Replace battery, overall reset

A "STOP LED flashing" condition with the original poster's error pattern most commonly indicates a combination of pointer corruption and missing DBs – both of which are cleared by the overall reset + RAM re-download sequence they performed.

Memory Module Specifications and Part Numbers

The following are the most commonly encountered S5 memory submodules in legacy installations:

Catalog Number Capacity Type Compatible CPUs
6ES5 372-1LA15 32 KB EPROM 27C256-compatible S5-115U, S5-135U, S5-155U
6ES5 373-0LA15 64 KB EPROM 27C512-compatible S5-115U, S5-135U, S5-155U
6ES5 375-0LA15 32 KB RAM (battery-backed) S5-115U, S5-135U, S5-155U
6ES5 375-1LA15 64 KB RAM (battery-backed) S5-115U, S5-135U, S5-155U
6ES5 374-0LA15 8–32 KB EEPROM S5-95U, S5-100U (selected CPUs)
6ES5 385-2LA15 2 KB EPROM (small) S5-90U, S5-95U

Compatibility between submodules and CPUs is strictly defined in the Siemens Industry Online Support portal under each CPU's product page. Substituting an EPROM for a RAM module (or vice versa) without an overall reset will result in a CPU that refuses to start, since the bootloader looks for different signatures.

Battery Backup and Volatile Memory Handling

RAM submodules retain their contents only while the buffer battery maintains a terminal voltage above approximately 3.0 V. The standard backup battery is the Siemens 6ES5 980-0AE11 (lithium) or equivalent third-party 3.6 V / 1.2 Ah primary cell. Battery life is typically 3–5 years at 25 °C; high ambient temperature dramatically reduces life.

When loading a program from EPROM to RAM, the procedure is:

  1. Power down the CPU.
  2. Insert the programmed EPROM submodule.
  3. Hold the mode selector in MRES while powering up to force the bootloader to read from EPROM.
  4. Power up. The bootloader copies EPROM contents into RAM.
  5. The RAM backup battery retains the copy from this point onward.
Critical fact: In most S5 systems, the buffer battery must be disconnected before the CPU is allowed to read the EPROM at power-up. A connected, healthy battery can occasionally mask a failed EPROM-to-RAM copy by retaining stale data, leading to confusing fault conditions on the next restart. Always disconnect the battery, perform the EPROM cold-start sequence, then reconnect the battery once the CPU is in STOP.

Verification and Commissioning Checks

After any memory operation – download, EPROM programming, or overall reset – verify the system is healthy before returning it to service:

  1. From STEP 5, perform PLC > Status and confirm the CPU reports RUN, no IStack faults, and the expected cycle time.
  2. Use PLC > Force or PLC > Monitor to verify each block type is loaded: OBs, PBs, FBs, DBs, SBs, FXs.
  3. Cross-check the program checksum against the source STEP 5 project file if an EPROM was used.
  4. Perform a controlled I/O checkout, walking through each input and output in sequence.
  5. Document the memory submodule catalog number, programmed date, and software revision in the maintenance log.

Troubleshooting Matrix

Symptom Likely Cause Action
STOP LED flashing after mechanical work IStack pointer corruption, missing DBs Overall reset + RAM re-download
CPU reports "No EPROM" at startup EPROM signature invalid or windowed EPROM exposed to UV Re-program EPROM on PG; verify contents
Program lost on power cycle Buffer battery dead or disconnected Replace battery; verify > 3.2 V loaded
Download fails with "Write error" RAM submodule write-protect switch engaged Disable write-protect on submodule
IStack reports "Timeout" on RUN Cycle time exceeded after program change Optimize OB1; check for runaway loops

Frequently Asked Questions

Does a STEP 5 download write to EPROM or RAM by default?

By default a STEP 5 download writes to the memory submodule physically present in the CPU's memory slot. If a RAM submodule is installed (most common for active development), the program is written to volatile RAM. If an EPROM submodule is installed and the PG has an integrated programmer, the EPROM is written directly. The CPU itself cannot program a UV-EPROM – an external programmer or a Siemens Field PG M with built-in programmer is required.

How do I force the CPU to load the program from EPROM into RAM at startup?

Power down the CPU, disconnect the buffer battery, insert the programmed EPROM submodule, then hold the mode selector in MRES while powering up. The bootloader will copy the EPROM contents into RAM. Reconnect the battery only after the CPU reaches STOP. This sequence ensures a clean EPROM-to-RAM transfer without retaining stale RAM data from a previous program.

How long does it take to erase an EPROM with UV light?

A typical 27C256 or 27C512 EPROM is fully erased in 20 to 30 minutes at a UV-C intensity of 12 mW/cm² at a distance of 1 inch (≈ 25 mm). Verify erasure by reading the device back on the programmer – all bytes must read 0xFF. EPROMs that have been programmed many times may require longer exposure.

Why did my CPU fault after I cleaned dust from the rack and re-assembled it?

Mechanical disturbance (reseating modules, vibration from air-blowing) can cause intermittent contact at the backplane connectors and can discharge static into CMOS RAM, corrupting pointer data in DB 0 / DX 0. The standard recovery is overall reset followed by a fresh program download into RAM, exactly as performed in the scenario described.

What is the difference between EPROM and EEPROM in S5 systems?

EPROM (erasable programmable read-only memory) is erased by exposure to UV-C light through a quartz window on the chip package; the entire device is cleared in one operation. EEPROM (electrically erasable PROM) can be erased in-circuit by an electrical signal, byte-by-byte or block-by-block, with no UV exposure required. Later S5 CPU families (S5-95U, second-generation S5-115U) support EEPROM submodules for in-system reprogramming without removing the chip from the rack.

Back to blog