Troubleshooting S5 CPU 948 STOP After Interbus DO Module Removal

1. Problem Description

A Siemens S5-155U system built around the CPU 948 (order number 6ES5 948-3UA11) drops to STOP / OFFLINE immediately after a digital output (DO) module is physically or logically removed from a remote Interbus station. Reconnecting the module returns the CPU to RUN. The IStack (interrupt stack) of the CPU 948 records a QVZ (peripheral access timeout) or QVF (peripheral fault) entry, and the BStack (block stack) shows the block that was active at the moment of the fault.

Observed symptoms in the field incident:

• CPU 948 front-panel LEDs: STOP lit, STOPS (red) on, RUN off
• IStack entry: SB204 as the executing block (GRAPH 5/11 step block)
• Removed module was on Interbus Station 11 (associated with SB208)
• Pressing F2 Edit in STEP 5 shows only "Sequence block for GRAPH 5" in condensed form
• Re-inserting the module, even with the rack power cycled, returns the CPU to RUN

The PLC appears to "look for" the missing DO module, and the question for the field engineer is: where in the program is that lookup, and how can the program be modified to operate without the module?

2. Affected System Architecture

CPU 948 firmware revisions (typical range) include 6ES5 948-3UA11 (initial release), -3UA12, and -3UA21. Any firmware with GRAPH 5/11 and process-image support exhibits the same STOP behavior described in this article.

3. Root Cause Analysis

The S5-948 performs a process-image update at the start of OB1 (or the OB selected for the priority class) and again at the end of the cycle. During the update the CPU writes the output process image to every configured output word. If the Interbus master (IBS S5 DSC/I-T) reports that a configured output word is unreachable — because the module has been physically removed or logically omitted from the Interbus configuration — the CPU 948 raises a QVZ (peripherie-Zugriffsfehler, peripheral access error) and enters the stop routine.

For a GRAPH 5/11 program the call chain that triggers the fault is typically:

OB1 (cyclic)
 └── FX10 (or other FX wrapper)
      └── SB2xx (active step block)
           └── action referencing QW of removed DO module

The active step block at the moment of the fault is what the IStack records. In the field incident the IStack reports SB204 even though the removed module belongs to the station controlled by SB208. The explanation is straightforward: SB204 was executing a transition that included a condition referencing the Station 11 output. The IStack logs the active context, not the owner of the faulting peripheral access.

4. Reading the IStack and BStack on CPU 948

4.1 Interrupt Stack (IStack)

The IStack is a snapshot of the CPU state when the stop occurred. It contains:

• The block currently executing (FB / PB / OB / SB)
• Status word, accumulator contents, and instruction pointer
• The cause code (QVF / QVZ / ZYK / NINE / SUF — see Diagnostic Reference)
• Block type and number

On CPU 948 the IStack is accessed via Online → Diagnostic → IStack in STEP 5. If the condensed view shows only "Sequence block for GRAPH 5", switch the editor mode to GRAPH 5/11:

1. Open the menu Settings → Change
2. Select GRAPH 5/11 as the change mode
3. Re-open the IStack — the full transition chain and step context will be visible

4.2 Block Stack (BStack)

The BStack shows the call hierarchy. For a GRAPH 5/11 application the typical chain is:

OB1 → FX10 (or other FX) → SB2xx (step) → FB/PB (action block)

Use the BStack to confirm that the faulting SB is reached from OB1 and not from a higher-priority OB (e.g., OB21 / OB22 restart handlers, OB25 / OB26 / OB35 time-of-day or cyclic error OBs).

5. The DB1 Question

A long-standing STEP 5 convention is to store the I/O address map (and often the Interbus station definitions) in DB1. The conventional procedure when a module is removed is:

1. Remove the I/O address references from the cyclic and time-of-day OBs
2. Update DB1 to drop the module entry
3. Reconfigure the Interbus master via CMD Tool to omit the station
4. Perform a cold restart on the CPU

The field operator reported that DB1 does not exist in this program. This is a known variant for some S5-948 installations. When DB1 is absent, the configuration may live in:

• The Interbus master local configuration memory (loaded via CMD Tool)
• A project-specific data block (e.g., DB 100, DB 200, or a vendor-specific DB)
• The parameter list of an FX call that initialises the master at startup

Diagnostic path when DB1 is absent:

1. Use STEP 5 Cross-Reference (XREF) on the removed output bytes (e.g., QW12, QW13 if those were the addresses of the 2-channel DO module)
2. Trace every access back to its defining block
3. Open the CMD project for the IBS S5 DSC/I-T and verify whether the station still appears in the master configuration

6. Step-by-Step Recovery Procedure

6.1 Prerequisites

• STEP 5 programming software with online licence for the CPU 948
• Backup of the current S5 program on EPROM, floppy, or hard disk
• CMD Tool with the current IBS S5 DSC/I-T project file backed up
• Mode-selector key for the CPU 948
• Authority to perform a cold restart on the running process

6.2 Procedure

1. Switch CPU 948 to STOP with the mode selector. Confirm the LED pattern (STOP on, RUN off).
2. Document the current state. Print the IStack, BStack, and the active STEP 5 program. Save the project to a known, dated location. This is the rollback anchor.
3. Edit the CMD project. Open the Interbus master configuration in CMD Tool. Remove the station that holds the DO module. Save the project and download to the IBS S5 DSC/I-T. Read back the configuration to confirm.
4. Edit the STEP 5 program. Use the XREF to find every access to the removed output bytes. Remove or comment out:
   • Direct peripheral writes (e.g., L QW12 / T QW12) in OB1, OB21, OB22, and the action blocks
   • GRAPH 5/11 transition conditions that read the removed output
   • Interbus diagnostic blocks that reference the station
5. Recompile GRAPH 5/11. Open the GS or GR source, modify the transition, and recompile. STEP 5 will regenerate the SBs and FBs.
6. Download the new program via the online interface. Allow the PLC to remain in STOP.
7. Perform a cold restart. On the CPU 948 this is invoked by Online → PLC → Reset → Cold Restart. The PLC will prompt "Cold restart — data will be lost — continue?" Confirm with YES.
8. Switch to RUN. Monitor the CPU 948 for at least 5 minutes. Watch the IStack and BStack for new fault entries.

7. Why a Cold Restart Is Mandatory

The CPU 948 retains a snapshot of the peripheral configuration in the IStack reference data. A warm restart re-initialises user-program pointers but does not re-poll the I/O. If the IStack already carries a QVZ or QVF entry from the previous STOP event, the CPU halts again before executing the first OB1 cycle.

A cold restart performs all of the following:

• Full process-image rescan
• Interbus master re-initialisation
• Reset of all stack areas (IStack, BStack, F-Stack)
• Re-initialisation of the GRAPH 5/11 sequencer state

8. Graph 5/11 Specific Considerations

GRAPH 5/11 is a Siemens S5 sequential function chart (SFC) language. Each step can have an associated action block (SB) and each transition can have a condition block. The active step's SB executes every cycle and may access peripheral I/O.

The IStack in the field incident shows SB204 but the removed module is on the station controlled by SB208. To resolve this, the engineer must:

1. Open the GRAPH 5/11 source in the STEP 5 editor
2. Locate the transition that includes the removed output as a condition (use the XREF on the output byte to find the step that contains it)
3. Replace the condition with one that does not depend on the removed output
4. Recompile the GRAPH 5/11 project — STEP 5 regenerates the SBs and FBs

After recompile, the affected SBs are rewritten. The PLC can then run without the DO module.

9. Process Image and Cyclic Update Mechanics

For the S5-948, the cyclic OB (typically OB1) executes in a fixed pattern:

1. Update process-image outputs (PII → PIQ transfer for outputs)
2. Read process-image inputs (peripheral → PII)
3. Execute user program (FBs, PBs, SBs, FX calls)
4. Write process-image outputs (PIQ → peripheral)
5. Cycle-time check, OB end processing

Any QVZ during step 1 or step 4 raises the peripheral fault and forces a STOP. The QVZ bit is latched in the status word (STW) and the offending peripheral address is captured in the IStack Peripherie-Bereich (peripheral area) field.

The IBS S5 DSC/I-T also keeps a local fault register that the CPU can read via the diagnostic interface. A QVZ from the master means the master did not receive an acknowledgement from the polled station within the configured timeout. Causes include:

• Station physically removed
• Station present but module missing
• Station present and module present but module type changed (e.g., DO replaced with DI)
• Cable break or power loss to the remote segment

10. Verification Checklist

11. Troubleshooting Matrix

12. Common Pitfalls

Pitfall 1 — Reconnecting the module to "test" the fix. The PLC will run only because the peripheral access succeeds. The moment the module is removed again, the CPU will STOP. Test with the module out.

Pitfall 2 — Program edit without cold restart. The CPU 948 caches peripheral configuration. A simple OB1 reload after editing the program will not clear the fault.

Pitfall 3 — Removing the DO from the Interbus master but not from the program. The PLC will STOP because the program still attempts to access the output.

Pitfall 4 — Removing the DO from the program but not from the Interbus master. The Interbus master continues to poll the station, generating diagnostic errors that will eventually cause a STOP.

Pitfall 5 — Skipping the GRAPH 5/11 recompile. Hand-editing a single SB without regenerating the source will be overwritten on the next GRAPH 5/11 compile.

Pitfall 6 — Editing the wrong SB. The IStack reports the active step block, not the owner of the faulting peripheral access. Cross-reference the output byte to find the correct SB.

13. Diagnostic Reference

13.1 IStack fault codes on CPU 948

13.2 Interbus LED patterns on IBS S5 DSC/I-T

14. Related Documentation

The CPU 948 belongs to the S5-155U family. STEP 5 programming conventions for the S5 family are documented in the S5-90U/S5-95U manual, which provides relevant background on the programming environment, block types, and process image even though the CPU 948 has additional GRAPH 5/11 and multi-processor features:

• Siemens S5-90U/S5-95U Programmable Controller Manual (PDF)

For firmware and documentation specific to the CPU 948 (6ES5 948-3UA11), consult the Siemens Industry Online Support portal using the order number as the search key.

15. FAQ