Troubleshooting CPU 928B STOP: ISTACK Overflow and DB1-FE Errors

1. Problem Overview

After replacement of a SIMATIC S5 CPU 928B in an S5-150U or S5-155H rack, the new module remains in STOP. The STOP LED flashes slowly (about 0.5 Hz) and the BASF (BASP — command output disable) LED is lit steadily. The user program was downloaded from the programmer (PG) using STEP 5 and the CPU performed the initialization phase without reporting a syntax error, yet the user program is never released for cyclic execution.

The first reaction of most field engineers is to inspect the ISTACK and BSTACK in PLC → ISTACK / PLC → BSTACK and search for an obvious cause. With the CPU 928B, that first inspection is often inconclusive: every documented bit on the surface screen (NAU, PEU, BAU, STUEB, STUEU, DOPP) appears to be clear, and yet the CPU does not leave STOP. This is one of the classic "hidden STOP" failures of the S5 platform. It is almost always produced by one of three underlying conditions:

• Block stack overflow (STUEB) buried in a deeper BSTACK layer rather than at depth 01.
• A DB1-FE (DB 1 error) flagged in the BSTACK control bits with a depth-01 ISTACK entry of LEVEL: 0002 — i.e. the failure occurred during the cold restart sequence rather than during cyclic operation.
• An URGELOE (overall-reset performed) control bit set because the CPU executed a cold-restart request but the operator aborted it; a manual cold restart is then required before any OB can run.

This reference walks through the layered interpretation of the ISTACK/BSTACK, the meaning of every control bit, the role of the system status words RS3 and RS4, and the exact operator sequence to clear the CPU back to RUN.

2. LED Pattern Decoding

Before opening STEP 5, decode the front-panel LEDs of the CPU 928B. The combination of LED states narrows the failure class before any software tool is opened.

3. ISTACK Structure on the CPU 928B

The Interrupt Stack (ISTACK) is a 13-level ring buffer resident in the CPU's system memory. Each entry records the state of the CPU at the moment an event interrupted the cyclic program: which OB was active, the current accumulator contents, the conditional code bits, and the control-bit byte that names the interrupting cause.

Depth assignment:

• Depth 01 — last (most recent) cause of interruption. This is the screen STEP 5 opens by default.
• Depth 02 … 13 — progressively older causes. Scroll up with the PG arrow keys to read them.

If an ISTACK overflow occurs because more than 13 events were queued without being acknowledged, the CPU drops immediately into STOP. Once this has happened, the operator must perform a power-off / power-on and a cold restart — the ISTACK cannot be cleared by a simple mode-selector toggle.

Key fields shown on each ISTACK entry:

4. BSTACK Structure on the CPU 928B

The Block Stack (BSTACK) records the call nesting of FB/FC/SB/DB at the moment the CPU stopped. While the ISTACK tells you why the CPU stopped, the BSTACK tells you where in your program the CPU was executing when it stopped.

• Depth 01 — innermost call: the block currently being processed.
• Depth 02 … 7 — outer callers, in reverse chronological order.

If nesting exceeds 7, the CPU raises STUEB (block stack overflow) and goes to STOP. STUEB appears at the depth at which the overflow actually occurred — which is not necessarily depth 01. Always scroll the BSTACK upward in STEP 5 to look for the STUEB marker; do not assume depth 01 carries every fault flag.

5. Control-Bit Reference Table

The eight control bits displayed in the lower portion of the ISTACK screen are a one-byte bitmap. Use this reference rather than guessing from the abbreviation alone.

An additional bit — DOPP (double call) — appears in some firmware versions and indicates that the same OB was re-entered before it completed (e.g. a cyclic interrupt OB 13 re-triggering itself).

6. Root Cause — DB1-FE (DB 1 Error)

DB1-FE is the single most common hidden cause of CPU 928B STOP after a CPU swap. DB 1 is a system data block — not a user-created one — that defines the process-image update list and the assignment of interrupt/timeout OBs. The CPU 928B evaluates DB 1 only during a COLD RESTART (LEVEL 0002), which is exactly why an ISTACK entry with LEVEL: 0002 paired with an X-marked DB1-FE bit is a coherent, diagnosable signature.

Two conditions trigger DB1-FE:

1. DB 1 does not exist in multiprocessor operation. In an S5-155H, S5-135U, or S5-155U configured with multiple CPUs, every CPU expects DB 1 to be present in the common memory. If the user program was transferred without DB 1 — or with a project that was edited for single-processor operation — every CPU will report DB1-FE.
2. Incorrect DB 1 address list during COLD RESTART. The address list inside DB 1 contains PI/PQ byte addresses that the CPU scans to refresh the process image. Any byte that does not physically correspond to an inserted input/output module will produce a PEU or DB1-FE flag at cold restart.

Note that in multiprocessor operation the system checks DB 1 across all restart types, but DB 1 parameters are evaluated only during COLD RESTART — which is why a manual warm restart from STEP 5 will not clear the error.

7. System Status Words RS3 and RS4

When the ISTACK and BSTACK do not give a clean cause, the next layer of diagnostic information lives in the system status words RS3 and RS4. These are 16-bit words maintained by the CPU operating system and are documented in the CPU 928B programming manual (Chapter 5.5.2 for interpretation, Chapter 8.3.4 for memory addresses).

EA04h

To read them in STEP 5:

1. Open PLC → PLC Memory.
2. Enter address EA03 for RS3 and EA04 for RS4.
3. The two-byte content is displayed in hexadecimal. Decode it against the bit assignments in Chapter 5.5.2 of the CPU 928B manual.

An alternative — and often faster — path is to open PLC → PLC System Parameters from the STEP 5 menu. The dialog exposes the relevant restart type, the active OB, and the most recent fault class without requiring a memory dump.

8. Reading the ISTACK Diagnostic Data — Memory Map

The diagnostic data the CPU exposes is laid out in a small reserved region of system memory. The addresses below are valid for the CPU 928B in the S5-150U / S5-155U / S5-135U / S5-155H platforms:

9. State-Machine Reference for CPU 928B Operating Modes

The CPU 928B has six valid operating-mode transitions. Knowing which transitions are legal avoids operator actions that corrupt the ISTACK or DB1 evaluation.

10. Operator Procedure — Overall Reset

Use the overall-reset sequence when the CPU's internal memory needs to be re-initialized — for example, after a code download that has overwritten the runtime system, after a new CPU replacement, or whenever the STOP LED is fast-flashing because the system program has detected a RAM or memory-card inconsistency.

1. Switch the mode selector from RUN to STOP. The CPU enters STOP and the STOP LED is lit steadily.
2. Hold the momentary-contact position OVERALL RESET on the selector. While held, rotate the selector through STOP → RUN → STOP in one continuous motion.
3. Release the selector. If the request was accepted, the STOP LED begins fast-flashing (~2 Hz). This is the visible acknowledgement.
4. To cancel an overall-reset request that you no longer want to execute, perform a cold restart or manual warm restart instead — the system program will discard the pending reset.

11. Cold Restart vs Warm Restart

Pick the restart that matches the state of the system — choosing the wrong one is a common cause of an immediate re-entry into STOP.

When the control bits show URGELOE or DB1-FE, the cold restart is mandatory — a warm restart will not re-evaluate DB 1 and will not release the CPU from STOP.

12. Step-by-Step Diagnostic Procedure

Follow this sequence on-site. It is the order in which information becomes available with the least disruption to the running process.

1. Capture the LED pattern before opening any software. Note STOP flash rate, BASF, and RUN.
2. Connect PG via COM1 (TTY 20 mA) or the PG connector on the CPU front panel. If using an MPI/PC adapter, verify the baud rate matches the CPU (default 9600 on CPU 928B).
3. Open STEP 5, online, and select the project that was active on the failed CPU.
4. Open PLC → ISTACK. Note the depth of every entry — write down LEVEL, OB, DB, and the control-bit byte for each depth from 01 upward.
5. Open PLC → BSTACK. Walk the call nesting from depth 01 upward. Look for STUEB or any DB1-FE marker. STUEB rarely appears at depth 01.
6. Read RS3 and RS4 from memory addresses EA03 and EA04. Use PLC → PLC Memory. Decode the bits per the CPU 928B manual Chapter 5.5.2.
7. Cross-check with PLC → PLC System Parameters. This dialog presents the restart type and active OB without manual memory decoding.
8. Resolve the cause — see the decision matrix in Section 13.
9. Perform the operator procedure (Section 10) and confirm RUN LED stays lit, BASF is off, and OB 1 is being cyclically processed.

13. Decision Matrix — ISTACK/BSTACK Signature → Action

14. Diagnostic Flowchart

15. Verification Checklist

Once the CPU transitions out of STOP, confirm the following before handing the system back to operations.

• STOP LED — off (or steady on if the operator deliberately held STOP).
• BASF LED — off. Outputs released.
• RUN LED — on.
• ISTACK depth 01 — no X on any control bit.
• BSTACK — depth 01 shows OB 1, depth 02 shows OB 100/101 (or expected startup OB), deeper depths show the expected FB nesting.
• RS3 at EA03 — value 0000h (or the expected warm-restart completion code for your firmware).
• Process image — first scan of OB 1 has completed (verify by setting a marker at the end of OB 1 and observing it via PG).
• Outputs — pull a test output and verify physical response within one OB 1 cycle.

16. Field-Engineered Caveats

Reading the screen correctly. STEP 5 highlights the row under the mouse cursor in reverse color. A field engineer unfamiliar with the tool will mistake the highlight for an active X. Confirm every suspected bit with a screenshot rather than from memory.

CPU replacement and user-program retention. The CPU 928B holds the user program in battery-backed RAM. When the replacement module was powered up, it ran the previously loaded program if any — or stayed empty. After transferring the user program from the PG, the CPU must be COLD-RESTARTED before OB 1 is allowed to run, even if the syntax check passed during download. This single step catches many "STOP after CPU swap" calls.

Multiprocessor DB1. In an S5-155H with two CPUs, DB 1 must be present in both. If only one CPU was replaced and DB 1 was loaded only into the new one, the second CPU will report DB1-FE on every cold restart until DB 1 is loaded into it as well. Load the project into every CPU in the rack before issuing the restart.

Memory-card vs RAM. The CPU 928B supports both RAM and memory-card (EPROM/EEPROM) operation. After an overall reset on a RAM-only configuration, the CPU is empty and must be re-loaded. After an overall reset on a memory-card configuration, the CPU reloads from the card automatically. Confirm which mode the replacement CPU is in before assuming the user program is preserved.

Hidden I/O faults. When ISTACK/BSTACK show no obvious cause, a faulty digital or analog I/O module is a recurring hidden source. Power the rack down, reseat one module at a time, and power up between each reseat. When the CPU reaches RUN, the module that was last reseated is the suspect.

Firmware revision. The CPU 928B exists in several firmware versions (e.g. -3, -8, -8A). Some control-bit assignments and some restart behaviours differ slightly between firmware revisions. Always check the firmware sticker on the side of the module against the manual chapters referenced before applying a procedure written for a different revision.

17. Documentation References

The Siemens S5 documentation set is published on the Siemens Industry Online Support portal. The two chapters most often needed for this fault are:

• CPU 928B programming manual — Chapter 5.3 (ISTACK/BSTACK structure) and Chapter 5.5.2 (system status words RS3/RS4).
• CPU 928B reference manual — Chapter 8.3.4 (system memory addresses, including EA03/EA04).

Both are available via the Siemens Industry Online Support portal. Use the legacy S5 product tree (SIMATIC S5 → Central processing units → CPU 928B) to navigate to the documentation. The SIMATIC S5-135U/155U system manual is the recommended companion document for rack-level diagnostic procedures.