Interpret S7 Diagnostic Buffer

JayD · Aug 8, 2011

Hi,

I am trying to support someone remotely with a "Area length error when reading" on a WinAC RTX Controller. I suggested to delete OB121 online to force it to stop and then go to the diagnostic buffer to open the block that is causing the error.
However they have provided me with the export of the buffer (see below).
Is there a way to determine the code reference (network for STL/LAD or line for SCL) within the guilty module (in my case FC71) from the data below?

Many Thanks in Advance
JD

Code:

Diagnostic buffer of module WinLC RTX
Order No./ Description         Component                      Version                       
6ES7 611-4SB00-0YB7            Firmware                       V 4.6.0                       
Rack:                          0
Slot:                          2
Event 1 of 120:  Event ID 16# 530D
New startup information in STOP mode
Startup prevented by:
- STOP request exists
- Cold restart or warm restart necessary
Startup information: 
- Time for time stamp at the last backed up power on
- Single processor operation
Current/last startup type:
- Warm restart triggered by switch setting; last power on backed up
Permissibility of certain startup types: 
- Manual warm restart permitted
- Automatic warm restart permitted
Last valid operation or setting of automatic startup type at power on:
- Warm restart triggered by switch setting; last power on backed up
Operating mode: STOP (internal)
Incoming event
03:33:52.298 PM  08/08/2011
 
Event 2 of 120:  Event ID 16# 4562
STOP caused by programming error (OB not loaded or not possible, or no FRB) 
Breakpoint in user program: Cyclic program (OB1) 
Priority class:    1
FC number:     71
Module address:    206
Previous operating mode: RUN
Requested operating mode: STOP (internal)
Internal error, Incoming event
03:33:51.990 PM  08/08/2011
 
Event 3 of 120:  Event ID 16# 2522
Area length error when reading
Instance DB, word access, Access address:  61474
FC number:     71
Module address:    206
Requested OB: Programming error OB (OB121)
OB not found, or disabled, or cannot be started in the in the current operating mode
Internal error, Incoming event
03:33:51.990 PM  08/08/2011
 
Event 4 of 120:  Event ID 16# 2522
Area length error when reading
Global DB, byte access, Access address:  61485
FC number:     71
Module address:    540
Requested OB: Programming error OB (OB121)
Priority class:  1
Internal error, Incoming event
03:33:51.890 PM  08/08/2011
 
Event 5 of 120:  Event ID 16# 2522
Area length error when reading
Global DB, byte access, Access address:  61484
FC number:     71
Module address:    540
Requested OB: Programming error OB (OB121)
Priority class:  1
Internal error, Incoming event
03:33:51.890 PM  08/08/2011

iant · Aug 8, 2011

Where are you based JayD

PeterW · Aug 8, 2011

Its telling you that in FC71 you are trying to access DB's which are either not present or not long enough.

OB121 is not present in the PLC, this is the software error OB, which will stop the PLC from going into STOP, you don't want that OB in any case, that should only really be used when commissioning.

So firget OB121 and look for the problem in FC71.

JesperMP · Aug 8, 2011

If you force the CPU to stop upon encountering the error, you simply go to the online CPU Properties, and open the "Stacks" tab.
Use the "open block" button to go the place in the program with the offending code. To my experience, the cursor location may land at the line just AFTER the line that actually causes the fault.

uptown47 · Aug 8, 2011

It looks like somewhere in FC71 you are accessing a datablock and trying to 'read' an address around 61485.

ie. L DBW 61485

Would cause your error if the datablock wasn't that big.

Hope that helps

;-)

L D[AR2P#0.0] · Aug 8, 2011

Open FC71, Edit->Go To->Block Address

L D[AR2P#0.0] · Aug 8, 2011

.. enter 540 from the Diagnostic buffer entry...

L D[AR2P#0.0] · Aug 8, 2011

and the cursor will flash at the errant line of code.

JayD · Aug 8, 2011

Many Thanks All,

I understand that the issue is that the program is attempting to access memory beyond the defined boundaries in FC71.
I have asked for my Chinese colleague to remove OB121 for diagnostic purpose only. If I was on site I would follow the procedure JesperMP defined.

The function Edit->Go To->Block Address is new to me, thanks L D[AR2,P#0.0]. However FC71 is in SCL and that function isn't available in the SCL Editor. When I open the compiled STL code in the LAD/STL/FBD Editor it is avaiable.

I asked my colleague also for the I-Stack data and was given what is below. I am uncertain if you need to select the last module from the B-Stack on the Stacks tab (in my case FC71) before you select the I Stack button to review the status.

So I have a few more specific questions:
1) Can I use the module address to trace the SCL line number?
2) Why does the module address change from 540 to 206?
3) What is "Global DB, byte access, Access address:"?
4) Is the I-Stack data dependent on what module is selected from the B-Stack? (or is there only one set of I-Stack data?)

Thanks Again
JD

Code:

WinLC RTX
=========
B Stack:
--------
Block       Symbol                   1st DB    2nd DB    
 OB1        SC_OB1_MAIN              - - -     DB70      
 FB70       SM_TCP_LOG_HANDLER       - - -     DB70      
 FC71       SM_PARSE_TCP_LOG         - - -     DB71      
 
I Stack: Register Contents in Priority Class (OB1)
--------------------------------------------------
 
Point of Interruption
Priority class:                 1, OB1
Interrupted block:              FC 71
Continuation in block:          FC 71
 
DBs Selected
                    1st DB 2nd DB
Number:             - - - DB 71
Size in bytes:      - - - 12010
 
Register Values at the Point of Interruption
Register            Value                    Display format      
ACCU 1:             0000  0000               Hex                 
ACCU 2:             FFFF  FFFF               Hex                 
ACCU 3:             0000  0000               Hex                 
ACCU 4:             0000  0000               Hex                 
Addr. reg.1:        ? 2093090.0              Address             
Addr. reg.2:        DB 0.0                   Address             
Status
word:        
                    BR   CC1  CC0  OV   OS   OR   STA  RLO  /FC  
                    1    1    0    0    0    0    1    1    0

L D[AR2P#0.0] · Aug 8, 2011

1) If you click on open block, the SCL editor will open and the cursor will point to the line of code where the error occurred.

L D[AR2P#0.0] · Aug 8, 2011

2) There are two separate access errors

L D[AR2P#0.0] · Aug 8, 2011

3) The program is accessing
Global DB, byte access, Access address: 61485

L DBB61485

as opposed to

L DIB61485 which is the instance DB

From your stack entry, the global DB number is the 1st DB, and there is no global DB open.

L D[AR2P#0.0] · Aug 8, 2011

Click on the Help for the i-stack:

L D[AR2P#0.0] · Aug 8, 2011

As AR1 contains ? 2093090.0, this suggests the program is indexing backwards through
an array (of structs ?) and the loop has allowed the index into the array to go negative
(my guess is that Ar1 is pointing to -P#4062)

JayD · Aug 8, 2011

Thanks Again for the Great Support!

I have found my issue, I couldn't use the Open Block method because I am not on site. I traced the issue via the STL compiled code and comparing to the SCL soure code.

The problem is the way I determined the start byte address of the data from an ANY data type.

For reference below is a sample of my FC71 SCL code:

Code:

VAR_IN_OUT
    LOG_ENTRY : ANY;
    ASCII_DATA : ANY;
END_VAR
 
VAR_TEMP
    t_adata : ANY;        
    t_pdata AT t_adata: STRUCT
         type1: BYTE;  //0x10
         type2: BYTE;  //0s00..0x1D: NIL, BOOL, .. TIMER
         count: INT;   //number of elements
         dbno:  WORD;   //DB number
         MemoryArea     : BYTE;         // Specified memory area = 0x84 = data block   
         ByteAddressMSB : BYTE;         // Byte address most significant bits   
         ByteAddressLSB : WORD;         // Byte address least significant bits   
         END_STRUCT;
    t_aascii : ANY;        
    t_pascii AT t_aascii: STRUCT
         type1: BYTE;  //0x10
         type2: BYTE;  //0s00..0x1D: NIL, BOOL, .. TIMER
         count: INT;   //number of elements
         dbno:  WORD;   //DB number
         MemoryArea     : BYTE;         // Specified memory area = 0x84 = data block   
         ByteAddressMSB : BYTE;         // Byte address most significant bits   
         ByteAddressLSB : WORD;         // Byte address least significant bits   
         END_STRUCT;
    t_ientry_LEN    :   INT;
    t_ientry_type : INT;
    t_idx : INT;
    t_idatabyte : INT;
    t_iasciibyte : INT;
    t_idatafirstbyte : INT;
    t_iasciifirstbyte : INT;
    t_idatalastbyte : INT;
    t_iasciilastbyte : INT;
    t_bdata : BYTE;
    t_bchar : BYTE;
    t_itmp          :   INT;
    t_ivalue        :   INT;
END_VAR  
 
BEGIN
    t_adata := LOG_ENTRY;
    t_aascii := ASCII_DATA;
    t_idatafirstbyte := (WORD_TO_INT(t_pdata.ByteAddressLSB) / 8);  //Incorrect conversion!!    
    t_iasciifirstbyte := (WORD_TO_INT(t_pascii.ByteAddressLSB) / 8);  //Incorrect conversion!!

I need to perform a double division operation (see the screen dump) not a integer division.

Could anyone suggest the correct SCL syntax for this?

Cheers
JD

Interpret S7 Diagnostic Buffer

JayD

Member

iant

Lifetime Supporting Member + Moderator

PeterW

Member

JesperMP

Lifetime Supporting Member + Moderator

uptown47

Lifetime Supporting Member

L D[AR2P#0.0]

Lifetime Supporting Member

L D[AR2P#0.0]

Lifetime Supporting Member

L D[AR2P#0.0]

Lifetime Supporting Member

JayD

Member

L D[AR2P#0.0]

Lifetime Supporting Member

L D[AR2P#0.0]

Lifetime Supporting Member

L D[AR2P#0.0]

Lifetime Supporting Member

L D[AR2P#0.0]

Lifetime Supporting Member

L D[AR2P#0.0]

Lifetime Supporting Member

JayD

Member

Similar Topics