Unlocking Siemens S5 FB Code Blocks for S5-to-S7 Conversion

Migrating an installed base of SIMATIC S5 controllers to S7 / TIA Portal frequently surfaces STEP 5 programs that look empty in the editor: an FB opens with a header line such as NAME: ORGANI, a single jump (SPA =M001) and a lone BE, after which no further networks are visible. In reality, the body is still present in the EPROM/PLC binary – it is hidden by a deliberate, machine-coded lock pattern inserted by the original programmer. This article documents how those locks are constructed, how to neutralise them with a targeted hex patch, and how to drive the resulting block through the official S5→S7 converter so it becomes valid STEP 7 (S7-300 / S7-400) code.

1. Overview of the S5 Block-Lock Family

STEP 5 STL (statement list) and CSF (control system flowchart) blocks are stored on the PG, on floppy or in the PLC as a sequence of 16-bit words. Three lock patterns are encountered most often when bringing old S5 projects forward:

All three techniques rely on the same principle: a programmer writes the real logic, then runs a self-modifying utility (or patches with a hex editor) so that the block body is invisible to STEP 5's online/offline editor while still executing correctly on the S5 CPU.

2. Anatomy of a "Locked" FB Header

A STEP 5 FB binary contains, in order:

1. Block header (block ID, author, name, version, block length in words, body start offset).
2. Variable declaration (formal operands DKF/DF/DH/DT/DO etc.).
3. The body – a chain of segments separated by segment indicators, terminated by a BE word.

The body is where the lock is inserted. A common STEP 5 "Fingerprint" of a locked block as printed by the editor is:

NAME: ORGANI
BEZ:  ODAT  DKF
SPA   =M001
BE

The SPA =M001 plus BE pattern is the visible residue. Everything that should follow – the actual control algorithm – has been replaced or hidden. The original author typically inserts a NOP (NOP 0 = 0x0000 or NOP 1 = 0x0100) where the code is supposed to be, lets the program run once on the CPU, and a small startup FB uses absolute write instructions to overwrite the NOPs with the real code and to overwrite the BE so the editor can no longer see it.

3. The Hex Patches That Restore Visibility

To recover the body you have to rewrite the lock words inside the block. The two byte patterns that have to be neutralised at the body level are summarised in the table below; the exact word values must be confirmed against your STEP 5 / CPU type before patching.

The two patches are applied together:

Top of body:    2D 02 65 00   →   2D 02 00 00
End of body:    30 40 65 00   →   00 00 65 00

After the patch, opening the FB in STEP 5 reveals the full network chain. The lock is now a no-op, and the body is suitable for the S5→S7 converter.

4. STEP 5 Editor Tools Required

Use the following toolchain to apply the patches safely:

1. STEP 5 V7.x (or whatever version generated the project) installed on a PG with a 3.5" floppy drive or a working S5-to-PG file transfer. See the official Siemens S5 programming environment documentation for installation details.
2. S5 file viewer / hex editor – the bundled STEP 5 block editor lets you export a block to a binary file, or you can use any standard hex editor (HIEW, 010 Editor, WinHex) on the exported file.
3. S5D file format knowledge – a .S5D container is a sequence of block records prefixed with the block identifier and length. FB69 lives inside this file with the exact bytes that you patch.
4. Backup media – copy the entire S5 project folder before doing anything destructive.

5. Procedure – Hex-Patch and Reload a Locked FB

1. Open the S5 project on the PG. If you only have a .S5D file from a third party, rename it to a recognised extension (e.g. .zip with the appropriate extension removed) and open it with the STEP 5 file manager.
2. Locate the locked FB (in the example: FB69 ORGANI). Note that the block list will show the FB as present, but opening it shows the empty body.
3. Export the FB to a binary file using File → Block → Export → Binary. The resulting file contains the FB header, the variable list, and the body words in machine code.
4. Open the exported binary in a hex editor. Search for the marker pattern that matches the lock:

Pattern at top of body:    2D 02 65 00
Pattern at end of body:    30 40 65 00

5. Apply the two patches (see Section 3). Save the patched file.
6. Import the patched binary back into the S5 project (File → Block → Import).
7. Re-open FB69. The full network chain is now visible. Save the project under a new name so the patched file is preserved alongside the original archive.

6. Identifying CPU-Specific Opcode Variants

The pattern 2D 02 in the lock is the S5 STL opcode that turns into "jump to a hidden label" in the source view, and 30 40 is an L-instruction (load constant) that the original author used to make the binary look ordinary. Different S5 CPUs encode these instructions differently:

For CPU 928B-class systems you must expect to rewrite at least the high-level blocks (PID, communication, integrated DBs) from scratch. The lock patch only recovers FBs that are stored as normal blocks in the user EPROM.

7. S5 → S7 Converter Workflow

Once the FB body is visible, drive the block through the official converter that ships with STEP 7 classic. The standard sequence is:

1. Open the S5 project in STEP 5 and convert each block to a STEP 5 ASCII file (File → Block → Convert → S5 → S5 ASCII). This produces a .S5T (text) representation per block that the S7 converter can ingest.
2. In STEP 7, open the SIMATIC Manager and create a new S7 project for an S7-300 or S7-400 station.
3. Launch Options → S5 / S7 Converter (the executable is S5CONV.EXE in the STEP 7 install folder).
4. Select the source .S5T files. The converter produces a conversion report that lists every block, the conversion status, and any warnings.
5. For FBs that the converter cannot migrate (e.g. unsupported standard FBs), the report flags them with a warning – the user must substitute a standard S7 block. See Section 8 for the typical mappings.

Useful Siemens reference pages for the converter toolchain:

• s5 to s7 conversion – Siemens SiePortal – covers known FB210/FB221/FB222 problems during conversion.
• Siemens S5 → S7 – Eng-Tips technical note – independent engineering reference for the same family of conversion problems.

8. Locked S5 Standard FBs and Their S7 Replacements

The S5 base library contains standard function blocks that vendors frequently locked to hide their tuning. The table below lists the FBs you will most often see in the wild, what the block actually did, and the recommended S7 replacement:

9. Self-Modifying Code Patterns to Look Out For

Siemens engineers used several related techniques to hide S5 code beyond the two-byte fake-BE patch. Recognising them is essential when the basic patch does not reveal a body:

• Leading spaces in the source. The original author pads the start of the body with literal spaces (0x20) so the editor's source window is empty. A startup FB rewrites the block header (body-start offset) so the CPU starts executing well past the spaces. The fix: edit the block header so the body-start points to the first real instruction word.
• Hidden segment indicators. The segment delimiter (a 0x0F 0x00 / 0x0D 0x00 chain) is replaced with a fake load instruction. STEP 5 then issues a "segment too long" diagnostic. Patch the load instruction back to NOP 0 (0x00 0x00) or to a real segment indicator.
• Jump-relative (JR) chains. Used inside heavily-optimised blocks such as FB176 IPD-REG. The converter does not always resolve the relative targets correctly. Manually explode the JR chain into absolute SPA jumps before running the converter, or use the S7-1500 symbolic JUMP / label instructions.
• Checksum / block-ID writeback. After the CPU has run the loader FB once and self-modified the body, the loader writes a new block-ID checksum so that the editor refuses to reload the block. The hex patch must be applied to the binary inside the PG, not to the on-line image – otherwise the loader will overwrite your patch on the next cold start.

10. Verification After Migration

Once the FB is patched and converted, verify the migration with the following checks before going on-line:

1. Symbolic consistency. In STEP 7, open the converted FB and confirm that all formal operands (DKF, DKH, DH, DT, DO) are present and that the operand comments migrated. The converter emits warnings for any operand that could not be resolved.
2. Block length check. The converted block must be at least as long as the original S5 body. If the STEP 7 FB is significantly shorter, the converter truncated part of the body – usually because a fake BE was missed.
3. Cross-reference build. Run Options → Reference Data → Display and confirm that every call site of the FB (CALL FB69, JU FB69) is present and that all symbols are wired through.
4. On-line functional test. Run the converted S7 program in PLCSIM or on a real S7-300/400 CPU in single-step, comparing I/O behaviour against the original S5 PLC where possible. Pay particular attention to OB1 / OB100 first-scan and to any interrupt OBs that the original used to call FB38/FB39.
5. Cycle time check. S5 and S7 cycle the OB1 differently; the S7 conversion can introduce longer or shorter cycle times. Capture OB1 execution time on PLCSIM and on the real CPU; tune OB1 priority if the time has grown by more than 25%.

11. When Manual Rewriting Is the Only Option

For S5-135U / S5-155U systems with CPU 928B and for vendor-protected integrated blocks, the hex-patch route is not viable. The Siemens support answer explicitly states that those blocks cannot be converted and must be replaced. The practical workflow in that case is:

1. Document the I/O footprint of the locked block (what it reads, what it writes, what it commands).
2. From the PLC's on-line status display, capture the data flow at every scan to reconstruct the algorithm.
3. Rewrite the function in STEP 7 STL / SCL or in TIA Portal SCL, using the modern equivalents (PID_Compact, TSEND_C, MOVE_BLK, etc.).
4. Run the new block in parallel with the S5 for a qualification period before cutting over.

12. Common Conversion Errors and Remedies

13. Final Checklist Before Going On-Line

• Original S5 archive stored offline as a read-only backup.
• Patched S5 project stored alongside the original (do not overwrite the original).
• S5→S7 conversion report saved in the STEP 7 project folder.
• All non-convertible FBs (FB6, FB38, FB39, FB44, FB120, FB176, FB210, FB221, FB222, plus any vendor-specific blocks) substituted with S7 equivalents and unit-tested.
• Reference data generated; cross-references complete; symbols resolved.
• PLCSIM functional test executed and signed off.

FAQ