Well, the indirection appears to all take place in file B15 which is 130 elements in length. All of the indirection I found is at the bit level. There are about twenty different variables used as pointers into this bit file. None of them are out of range in the state "as saved". I created a CDM (custom data monitor) with a list of these indirect indices. I would recommend recreating the fault condition while monitoring this CDM, and look for the greatest value in the list, right click, "Find All" and look for the indirect reference and check its value.
There are a lot of manipulations of the values of the various indirect values...too many to quickly sort through off line with out better documentation of what they are supposed to do.
A quick and dirty (as in it may let the machine keep running with bogus numbers) would be to expand the length of file B15 out to 256 elements.
Also, none of the indirect values are limit checked. When using indirect addressing, it is always wise to limit check them for validity before each and every usage, especially if you are a less than perfect human programmer or if any of them can be affected by a remote device.
Paul
