Troubleshooting S5-95U Peripheral I/O: Module LEDs Active, PLC Reads Zero

The SIMATIC S5-95U compact PLC is a workhorse in legacy installations where 24 V DC digital I/O is distributed across the machine via Siemens IM316 expansion racks. One of the most reported field failures is the "green LED on, logic reads 0" symptom: the input module indicates the field signal is present, but the CPU never sees the point toggle in the cyclic I/O image. This article provides a structured diagnostic path, the underlying electrical and firmware causes, and the verification procedure that returns the rack to service.

1. Hardware Configuration in the Fault Loop

The reference installation consists of the following modules:

The IM316 is the data highway between the S5-95U's I/O bus and the remote rack. If the bus handshake fails, the CPU holds the peripheral I/O image at 0 even though each input module locally has power and a valid 24 V signal at its terminal.

2. Symptom Matrix

3. Root Cause Analysis

Three independent failure mechanisms can produce the exact symptom set above. Field experience shows that in most cases two of them are active at the same time after a battery event.

3.1 Insufficient 24 V at the module supply under load

The "LED on, PLC sees 0" condition is the classic signature of a digital input whose terminal voltage collapses below the Siemens "1" detection threshold once the opto-isolator input current is demanded. The status LED of the 6ES5 431-8MA11 is driven by a separate detector stage that switches at a slightly lower voltage than the input gate that feeds the I/O bus. A reading of, for example, 18 V at the terminal may light the LED but fail the 13 V minimum required by the bus-bound input stage once the ribbon cable and connector losses are included.

Typical operating thresholds for the S5-95U and the 6ES5 431 family:

3.2 IM316 bus fault or address conflict

The IM316 must be terminated correctly on both ends and must not see address overlap with the CPU's onboard I/O. The S5-95U reserves input byte 0 and 1 (E0–E1) and output byte 0 and 1 (A0–A1) for its integrated channels. Expansion starts at byte 2 by default. If the IM316 was previously re-addressed to a different byte, or if a module was replaced with one of a different type, the I/O update will silently fail.

3.3 Battery-induced cold start with a foreign or empty program

The S5-95U retains its RAM-backed flags, timers, counters, and process image only while the lithium battery holds the on-board RAM above its data-retention voltage. After a battery exhaustion event, the CPU powers up and—depending on the position of the mode switch—performs a cold restart that does not load OB21/OB22. If the user program lives in an EPROM submodule but the data blocks used by the I/O update logic were held in RAM, the CPU may run a default OB1 that does not exercise the peripheral image correctly, or it may output SF errors that are dismissed because the green RUN LED is dominant.

4. Diagnostic Procedure

Follow the sequence below. Do not skip a step; each one rules in or rules out a specific layer of the stack.

1. Confirm the failure domain. In STEP5 online monitor, force a known bit on the onboard inputs (E0.x) and verify it toggles. If the onboard image is alive, the CPU is healthy. If the onboard image is also dead, stop here and address CPU-level fault (OB not loaded, SF LED hidden, mode selector at wrong position).
2. Measure the 24 V supply at the expansion rack under load. Use a true-RMS multimeter at the input module's supply terminal with the field sensor energized. The voltage must be ≥ 22 V at all times; the bus threshold is 13 V plus ripple, so 22 V gives 9 V of headroom for cable drop and noise.
3. Check the common ground return. Field devices, module supply, and CPU supply must share a low-impedance 0 V reference. A missing or broken ground strap on the IM316 shield clamp raises the effective input voltage at the module relative to the local 0 V and pushes the signal out of spec.
4. Inspect the ribbon cable between the CPU and the IM316. Folded pins, missing crimps, or a single reversed pin will fail the bus without raising any CPU fault. Swap the cable if a known-good spare is available.
5. Verify the IM316 addressing. Read the rotary switches on the IM316. The S5-95U expects the IM316 to start at the next free byte after the onboard I/O; with the 16-DI/16-DO CPU the default start is byte 2. If a previous technician changed the address to byte 4 to make room for a different peripheral, the I/O update will appear "dead" until the STEP5 program is updated to match.
6. Read the diagnostic buffer of the CPU. From STEP5, call PLC > Module Information > Diagnostic Buffer. Look for "IM316 not responding", "Parity error on peripheral bus", or "OB not loaded". Each one points to a distinct remedy.
7. Test with a single, hand-driven input. Disconnect the ribbon to all but one 6ES5 431 module. Apply 24 V from a bench supply through a 4.7 kΩ resistor directly to channel 0 of that module. If the CPU sees that one bit, the field wiring layer is the problem, not the bus.
8. Perform a full power cycle. Power OFF the system for at least 20 seconds, then re-energize. This is the S5-95U's recommended cycle to clear any stuck bus controller state after a power-quality event.
9. Reset the CPU if the buffer is clear but the symptom persists. Move the mode selector to STOP, hold the RESET button (or use the STEP5 PLC > Cold Restart function) for 3 seconds, then return to RUN.

5. Power Supply Verification Procedure

The power supply must be measured with the entire system running, not at idle:

1. Connect a digital multimeter in parallel at the 24 V terminal of the first DI module in the chain.
2. Energize every field sensor on the rack simultaneously. If the supply sags below 22 V during this transient, the supply is undersized or the wiring gauge is too small.
3. Calculate the worst-case load:
   I_total = N_modules × 8_channels × 8.5_mA + I_sensors + I_outputs
   With six 8-channel modules and a typical sensor load, plan for at least 500 mA of headroom on a 24 V/5 A supply.
4. Verify the ripple voltage with an oscilloscope. Peak-to-peak ripple above 2 V at the module terminal can pull the bus threshold low enough to drop bits intermittently. Add a 100 µF/35 V electrolytic at the rack supply terminal to filter the rail if the source is shared with switching solenoids.

6. Battery, Memory, and OB Implications

The S5-95U accepts three program memory types in the front submodule slot:

When the user reports "the program is in EPROM" and "the machine will not start after the battery was replaced", the typical chain of events is:

1. Battery voltage drops below the data-retention threshold during a power-off window.
2. RAM is zeroed; all data blocks lose their initial values.
3. On power-up the CPU performs a cold restart. Because OB21 and OB22 are not loaded, the cold restart runs the default OB1 only.
4. The default OB1 typically does not contain the FB calls required to drive the I/O image update for the expansion rack; it may be a placeholder generated by the original commissioning engineer.
5. The CPU enters RUN and shows a green LED, but the peripheral image for the IM316 never gets written.

The fix is to reload the full project from the STEP5 archive to the EPROM submodule, including the OB1, FB, DB, and PB blocks. After reload, cold restart, and return to RUN, the IM316 bus is exercised and the peripheral inputs appear in monitor mode.

7. CPU Reset Procedure (S5-95U)

8. Input Threshold Verification

For a definitive test, apply a calibrated voltage to the input terminal and measure the exact point at which the CPU image bit toggles:

1. Disconnect the field sensor from the suspect channel.
2. Connect a bench 24 V supply through a 4.7 kΩ resistor and a 10-turn potentiometer in series.
3. Slowly increase the voltage from 0 V to 30 V while monitoring the input bit in STEP5 online.
4. Record the voltage at which the bit flips from 0 to 1. A healthy module switches between 11 V and 14 V. If the switch point is below 10 V or above 16 V, the module is out of specification and must be replaced.

Repeat the test on a known-good channel of the same module for comparison. The two switch points should be within 1 V of each other.

9. Wiring and Cable Checklist

• Inspect the flat cable between the CPU and the IM316 for kinks, oxidation on the insulation-displacement contacts, and missing crimps on pins 1, 2, 31, 32 (the bus terminator and supply pins).
• Confirm the cable length does not exceed 0.6 m for an unshielded ribbon or 1.0 m for a shielded variant.
• Check the shield termination at the IM316 shield clamp; a floating shield is a common source of bus CRC errors on legacy S5 installations.
• Verify that the module addresses on the rack are unique; duplicate addresses silently disable the second module.

10. Verification

After the corrective action, perform the following to confirm the repair:

1. In STEP5 online, set the watch table to include the suspect input bits and one onboard reference bit.
2. Toggle each field input device manually and confirm the corresponding bit flips from 0 to 1 within one OB1 cycle.
3. With all field devices energized, measure the 24 V rail at every DI module terminal. All readings must be ≥ 22 V.
4. Cycle power three times. The peripheral image must initialize correctly on every cold start without operator intervention.
5. Check the diagnostic buffer for any I/O fault entries over a 10-minute soak test with the machine running through its normal sequence.

11. Preventive Maintenance

• Replace the S5-95U lithium battery (for example 6ES5 980-0MA11) on a fixed 4-year interval regardless of measured voltage.
• Log the diagnostic buffer to a PG during every scheduled PM; a slowly rising IM316 retry count is an early indicator of a failing bus.
• Label every module slot with its address; use the address sticker on the rack rail to prevent address drift after module swaps.
• Keep one bench-tested spare of the 6ES5 431-8MA11 and one IM316 ribbon cable on the maintenance shelf.
• Periodically re-archive the STEP5 project to EPROM after every program change; never rely on the RAM backup beyond one cycle.

12. Diagnostic Flow Diagram

13. Error Code Reference

FAQ