Resolving CPU Area Length Error in DrvPAC FB1084 When Connecting SENTRON Meters

An S7-400 CPU diagnostic buffer fault reporting 'Area length error when reading' on FB1084 (DrvPAC) and instance DB137 (access address 788, module address 822) occurs when the logical start addresses of configured SENTRON PAC meters exceed the CPU Process Image Partition (PIP) boundary or fall outside the peripheral addressing range supported by SFC14 (DPRD_DAT). When connecting more than 12 PAC3200 meters, cumulative I/O address assignment frequently exceeds default process image boundaries or assigns addresses crossing the maximum partition limit. To resolve this, reassign PAC module addresses into a contiguous address range within the process image partition assigned to the cyclic execution OB, or expand the process image size in CPU Hardware Properties.

Root Cause of Area Length Errors in Driver Blocks

In SIMATIC PCS 7, the SENTRON PAC Library integrates PAC3200 and PAC4200 power meters using the channel driver block DrvPAC (FB1084) and the technological block PAC3200 (FB1085). DrvPAC reads cyclical measurement data blocks (such as Basic Type 1, Basic Type 2, Energy Counters, and Limit Violations) directly from the distributed I/O peripheral area using the system function SFC14 (DPRD_DAT) or direct peripheral access (PIW/PID).

The CPU diagnostic buffer event 16#2522 or 16#2523 ('Area length error when reading/writing') is logged when an instruction attempts to access an address outside the configured CPU memory area. When adding meter number 13 and above, the hardware configuration tool assigns module addresses that exceed the default Process Image Partition (TPA) boundary configured for cyclic OBs (e.g., OB35). If DrvPAC is configured to read via process image or if SFC14 attempts to read a module address that is assigned outside the consistent peripheral address space, the CPU halts or invokes OB121 (Programming Error Organization Block).

S7-400 Process Image and Peripheral Address Boundaries

S7-400 CPUs provide a large overall addressing range (up to 16 KB on standard CPUs and CPU 410-5H), but the Process Image (E/A-Prozessabbild) is partitioned into distinct Process Image Partitions (Teilprozessabbilder, TPA):

By default, Process Image Partition 0 (TPA 0 / OB1-PA) is sized to 512, 1024, or 2048 bytes depending on CPU firmware.
Process Image Partitions 1 through 15 can be assigned to cyclic interrupt organization blocks (such as OB32 to OB38).
If a PAC3200 module is assigned an input address (e.g., address 822) that falls outside the process image partition assigned to OB35, direct reading via process image pointers generates an area length error.
Furthermore, SFC14 requires that the entire byte length configured for the PROFIBUS DP or PROFINET IO sub-slot (e.g., 20 bytes for Basic Type 1, 24 bytes for Basic Type 2) must be read in a single consistent call. If the module address crosses the boundary of configured memory, the SFC reports return error W#16#8090 or causes an internal pointer violation in DrvPAC.

SENTRON PAC Data Structure and Address Allocation Matrix

The following table outlines the byte allocations and address configuration parameters for PAC3200 data types:

Data Structure ModuleSize (Bytes)Consistency RequirementDirect Access vs SFC14Recommended Address AlignmentBasic Type 120 BytesTotal Length ConsistentSFC14 (DPRD_DAT)Word-aligned; Must fit within assigned PIPBasic Type 224 BytesTotal Length ConsistentSFC14 (DPRD_DAT)Word-aligned; Must fit within assigned PIPEnergy Counters8 BytesTotal Length ConsistentSFC14 (DPRD_DAT)Word-aligned; DInt / Float consistencyDigital I/O & Status4 BytesWord ConsistentDirect PIW or SFC14Word-aligned in process imageLimit Violations4 BytesWord ConsistentDirect PIW or SFC14Word-aligned in process image

Step-by-Step Address Reconfiguration and Driver Correction

To resolve the area length error when expanding SENTRON PAC meters beyond 12 units:

Audit Hardware Configuration Addresses:
- Open HW Config in SIMATIC Manager.
- Review the I/O start addresses for all configured PAC3200 meters. Identify the meter at module address 822.
- Determine the highest address allocated across all PAC devices.
Expand Process Image Partition in CPU Properties:
- In HW Config, double-click the S7-400 CPU to open Properties.
- Navigate to the Cycle/Clock Memory tab.
- Check the Size of the process image (Inputs/Outputs). If set to default (e.g., 512 or 1024), increase the size to 2048, 4096, or 8192 bytes.
- Check the Process image partition settings for OB35 (or the OB where DrvPAC is executed). Ensure the partition range encompasses address 822 and all subsequent meters.
Reassign Contiguous I/O Addresses:
- To prevent fragmentation, assign PAC module addresses contiguously (for example, starting at input address 512 onwards).
- Ensure each PAC meter's Basic Type and additional modules are placed in the same Process Image Partition.
Update CFC Driver Connections and Compile:
- In CFC, ensure the Laddr input on DrvPAC matches the new hardware module start address.
- Perform a full CFC compilation with Generate Module Drivers checked to update address mapping.
- Download the hardware configuration and CFC changes to the CPU in STOP/RUN according to plant operating procedures.

Verification

Verify error resolution:
1. Open the CPU Diagnostic Buffer in SIMATIC Manager (PLC -> Diagnostic/Setting -> Module Information).
2. Verify that event 16#2522 / 16#2523 ('Area length error when reading') no longer occurs.
3. In CFC, open chart containing DrvPAC and PAC3200 online. Verify that the output Error is FALSE and Quality Code (ST) indicates good status (16#80).
4. Check live measurements (voltage, current, active power) on the WinCC PAC3200 faceplate and confirm accurate readings.

Limitations and Operational Precautions

CPU Stop Risk during HW Config Download: S7-400 CPUs may require transitioning to STOP mode when modifying CPU properties such as Process Image size, unless utilizing Configuration in RUN (CiR) on compatible redundant H-systems.
SFC14 Address Range Limitations: SFC14 can only access addresses configured with total length consistency. If addresses are changed without updating consistency settings, SFC14 will return error 8090.
OB121 Presence: Ensure OB121 is loaded in the CPU. If OB121 is missing, an area length error causes the CPU to transition immediately to STOP.

Engineer FAQ

Why did the error only appear after adding meter number 13?

Meters 1 through 12 had module addresses below the default Process Image boundary (e.g., below address 768). Adding meter 13 pushed addresses above 800, exceeding the configured process image partition.

What is the difference between error address 788 and module address 822?

Address 822 is the hardware logical start address of the PAC module in HW Config. Address 788 is the internal byte offset within the instance data block (DB137) or process image where the read pointer overflowed.

Can DrvPAC read PAC meters configured outside the Process Image?

Yes, DrvPAC uses SFC14 (DPRD_DAT) which can read consistent peripheral memory outside the process image, provided the module address does not exceed the maximum physical addressing capability of the CPU rack.

Does increasing the process image size impact CPU scan cycle time?

Yes, expanding the process image increases memory consumption and marginally lengthens cyclic update time because more peripheral data is exchanged during OB start and completion.