Resolving Programming Error 34 on System Blocks FB423 and FB428 OR_H16PN in PCS 7

In SIMATIC PCS 7, a CPU diagnostic buffer message reporting 'Programming error 34: area length error when reading' for system blocks FB423 (OR_16_PN) or FB428 (OR_H16PN) indicates that an auto-generated module driver block in chart @(1) is attempting to access an invalid or truncated diagnostic data block offset. This mismatch occurs when PROFINET or PROFIBUS I/O hardware configurations are altered and downloaded without regenerating module drivers. To resolve this, perform a full compilation of all CFC charts with 'Generate module drivers' enabled, verify hardware address ranges in HW Config, and download the updated user program to the CPU.

Executive Summary

During plant commissioning or online modifications in PCS 7 V9.0 / V9.1, controllers (such as CPU 410-5H or S7-400H) can experience cyclic diagnostic buffer flooding where 'Programming error 34' is logged continuously. The diagnostic entry references system blocks FB423 (OR_16_PN) or FB428 (OR_H16PN) located inside system chart @(1) with an internal instruction offset such as /4128/2/4.

These blocks originate from the @SYSTEM family (author DRIVER90) and collect module diagnostic alarms across redundant PROFINET or PROFIBUS network topologies. When field I/O configurations are changed but system @ charts are not regenerated, or when an engineer attempts to manually delete @ charts while the CPU is online, the module driver pointers access memory beyond the allocated boundary of diagnostic DBs. Because the CPU cannot read non-existent DB memory, it logs cyclic programming errors that can overload the diagnostic buffer and obscure genuine plant faults. This guide details the root cause mechanics and step-by-step remediation procedure.

Architecture and Fundamental Mechanics

The PCS 7 driver generator manages automated diagnostic tracking through interconnected system blocks and dynamic data structures:

Role of Driver Blocks FB423 and FB428:
- PCS 7 automatically creates module driver blocks during CFC compilation when 'Generate module drivers' is checked.
- For PROFINET IO devices and remote I/O stations (such as ET 200SP HA or ET 200M), blocks OR_16_PN (FB423) and OR_H16PN (FB428) evaluate the diagnostic health of up to 16 submodules or carrier slots.
- These blocks continuously query diagnostic data blocks (DBs) created dynamically in the background to monitor module health.
Mechanics of Programming Error 34:
- In S7-400 system architecture, Programming Error 34 (Event ID 16#2534) represents an Area Length Error (Bereichslängenfehler beim Lesen).
- It occurs when an instruction performs indirect memory addressing into a Data Block (DBX, DBW, DBD) at a byte address exceeding the allocated length of the target DB.
- The notation /4128/2/4 identifies the exact machine code offset within the block where the out-of-bounds memory read occurred.
The Desynchronization Trap and Delta Downloads:
- When hardware submodules are deleted, readdressed, or modified in HW Config and downloaded online without compiling charts with 'Generate module drivers', the existing driver block FB423/FB428 in chart @(1) still attempts to scan the old address ranges.
- Alternatively, if an engineer manually deletes @ charts in CFC to clear errors, the Step 7 database cross-references become corrupt. The CPU retains old DB numbers in memory while the charts reference new structures, causing cyclic pointer overruns.

Step-by-Step Implementation Procedure

Follow these steps to eliminate Programming Error 34 and restore module driver integrity:

Analyze CPU Diagnostic Buffer:
- In SIMATIC Manager, select the S7 CPU and press Ctrl+D (or 'PLC > Diagnostic/Setting > Module Information').
- Switch to the 'Diagnostic Buffer' tab.
- Locate the entry 'Programming error 34: area length error when reading'.
- Note the reported block number (e.g., FB423 or FB428) and the calling chart location (e.g., PAZ_PRG/@(1)/02_PAZ_1).
- Do NOT delete the @ charts manually in SIMATIC Manager!
Verify HW Config Consistency and Address Boundaries:
- Open HW Config for the target automation station.
- Select 'Station > Check Consistency' to identify overlapping I/O address ranges or unassigned slot configurations.
- Verify that all PROFINET IO device names and IP addresses match the physical network.
- Select 'Station > Save and Compile'.
Execute Full CFC Compilation with Module Drivers:
- Open any CFC chart in the project.
- Select 'Chart > Compile > Charts as Program...'.
- In the compilation dialog, select 'Entire program'.
- Crucially, verify that the checkbox 'Generate module drivers' is CHECKED.
- Click 'OK'. The PCS 7 driver generator parses HW Config, regenerates all @ charts (e.g., @(1), @(2)), and resizes diagnostic DBs to match current submodule counts.
Reconcile Delta Download Compatibility:
- In CFC, select 'CPU > Download...'.
- If the system allows 'Changes only', perform the delta download in RUN mode. The compiler updates FB423/FB428 parameters and DB boundaries without stopping the process.
- If changes in structural DB lengths prevent a delta download, PCS 7 will display a warning requiring a full download in STOP mode.
Schedule Controlled Stop and Download (if required):
- If structural DB mismatch blocks delta download, coordinate with plant operations to plan a maintenance window.
- Switch CPU to STOP mode, download the entire program ('Entire program'), and perform a warm restart.

Verification

Open the CPU Diagnostic Buffer (Ctrl+D): verify that 'Programming error 34' entries cease to appear.
Check CPU operating state LEDs: confirm that the SF (System Fault) LED turns off or only reflects genuine field device disconnects.
Open chart @(1) in CFC: switch to Test Mode (Online) and confirm FB423/FB428 blocks execute without generating error codes at output pins QERR or STATUS.
Verify that diagnostic alarms from remote I/O racks are received correctly on the WinCC operator station.

Limitations and Operational Precautions

NEVER manually delete @ charts in the CFC chart folder; they are managed exclusively by the PCS 7 driver generator. Manually deleting them leaves orphaned DB pointers and causes compiler inconsistencies. In redundant S7-400H systems, ensure both CPUs receive identical system DB updates to prevent redundant sync loss. For safety and critical control licensing, verify expansion card and AS RT PO entitlements through an authorized Siemens distributor or the Siemens Industry Mall.

Engineer FAQ

What causes Programming Error 34 in S7 controllers?

An Area Length Error where an instruction attempts to read or write beyond the allocated boundary of a Data Block.

What is the role of FB423 (OR_16_PN) and FB428 (OR_H16PN)?

They are PCS 7 system driver blocks that collect and OR diagnostic states from up to 16 PROFINET I/O submodules.

Can I resolve this error without stopping the controller?

Yes, if changes allow a delta download after compiling charts with 'Generate module drivers' enabled.

Why did deleting the @(1) chart not resolve the error?

Manual deletion breaks cross-reference pointers and causes the driver generator to recreate mismatched blocks or leave stale DBs in CPU memory.

What does the instruction offset /4128/2/4 indicate?

It specifies the internal instruction byte offset in the block where the out-of-bounds pointer read occurred.

Technical References

Related Tags

Programming Error 34
Area Length Error
FB423
FB428
Module Drivers
PCS 7 V9.0 SP3

20 respuestas

Resolving Programming Error 34 on System Blocks FB423 and FB428 OR_H16PN in PCS 7