S7 Area Length Fail

Hi Guys,

I am having a major problem trying to find the root of the above error. (Siemens S7) OB121 is called when there is some kind of program error and the code is always an area length read/write fail. The HMI we are using (Micro Innovation Galileo)has tags set as e.g. F(loating point) pointed at a DB Real address or W(ord) pointed at a DB Integer. Comparing some of these tags with older ones I can't see the problem. I just wondered if anyone had come across some similar error. I'm still undecided as to whether the problem is in the PLC or HMI but I'm tending towards S7 for now, that's why I've posted this. I haven't had any luck finding anyone expert at Galileo.
Cheers
TIA

I had a similar problem recently where I was getting a short burst of area length faults on start up and I couldn't fathom out where they were coming from.

I eventually discovered by accident that they were being caused by a new I/O card which got added to the project at a very late stage. I'd included it in HW-Config, but because I hadn't programmed anything for it, I forgot about it. I spent weeks looking for the source of the problem on and off! Evidently Step7 tries to access all the H/W it finds in HW-Config whether it's actually being used or not - fair enough really.

Well, you could dig into OB121 to find out the exact details, but if you have the luxury of allowing the PLC to go into stop mode, you can try this:

1. Go online with the PLC and delete OB121 (from the PLC, not the project).
2. Create the condition that causes area error, and let the PLC go into stop mode.
3. Look at the Module Diagnostics I-Stack, and it will give you the exact details about the error.

Although technically this is an S7 problem, it sounds to me as though the HMI is handing off bad addresses.

Kenny

Area-length errors are most commonly associated with trying to read or write a piece of data which extends beyond the end of a data block.
For example, let's say you have a DB configured as 1000 bytes long. The address DBx.DBB1000 is valid (i.e. byte 1000) but DBx.DBW1000 and DBxDBD1000 will cause this error since they try to access bytes 1000 & 1001, and 1000, 1001, 1002 & 1003 respectively.

Any chance you can try to cross-reference your HMI tag addresses with the upper limits of your DBs and see if that might be the cause of the problem?

regards

Ken

Thanks guys, those answers may explain some of it. A few weeks ago I added an ET200 with analogue IO and it went crazy. I've since taken that back out as the HMI prog wasn't quite ready. As for bad addresses there is currently only one OB121 error and this is where I am getting stuck. It is a new field on the HMI for a speed setting, points to a tiny DB I put in and I can't see what's wrong with it? I can try and let the PLC go into stop but god knows when I'll get another window of opportunity. BTW this is the project which is WinLC running on a PC, all hard IO is on a DP bus as is the HMI. As for the incidence, it happens whenever a product recipe is loaded (i.e when changed or on startup) so I know there is some disparity there but compared to all other tags there is nothing to see. I'll try the diagnostic stuff when I get a chance.
Cheers
Kenny

Hi Kenny,
I remember some time ago on an S5 system & a problem simular to yours.
The problem turned out to be that the comms server would only send or request packets with a minimum length so only requesting one or two words would request a minimum of 8, this ran over the DB length so by increasing the DB cured the problem, I noticed you stated a very small DB so this could be the cause.

Parky, I think you may have cracked it! I still haven't been back to this as production NEVER stop (in fact, I'll be leaving here soon so I don't know if I'll ever get to the bottom of this!). I think the packet length might explain the current error (which isn't a giant problem). However, if I had to reinsert my new code to go along with the analog IO I was intending to add to the project I think it will be a bit trickier to fix.I was addressing the parameters for 18 vac regulators with pointers in a loop. Need to do some reorganizing of the DB and look at the loop again.
Cheers
Kenny