This technote sheds some light on the inconsistent behavior we have observed:
False Rung Execution and Indirect addressing
Access: Everyone
Basically, what it says is: if your indirectly addressed array element will result in a value change on a false input-in condition, the processor will fault if the index is beyond the upper array bound. A simple example, based on the technote and verified (rev 20) is:
AFI OTE dintarray[index].0
The processor will fault if index is greater than the upper bound because it will attempt to clear bit zero, which it cannot access.
As also described, any indirect access to a data type with status bits that are manipulated by a false rung-condition-in state will be similarly affected (e.g., timers) by an index out of range.
On the other hand, if the rung output instructions only result in data movement, the indirect address will not be resolved on false input, and therefore no fault by an out of range index.
Maybe this explains every occurrence in my experience. Hard to say.
One thing I vaguely remember is that a rung-in-false/out-of-bounds data move would be fine until the rung was displayed in run mode by RS-Logix 5000. This would force it to resolve the indirect address for display purposes and fault the processor. Now it just shows "????" in this situation.