DBRead (and AreaRead) Bug?

[Rial Williams]

If I do a DBRead with the starting address greater than 1608, I get error 9437184 which I believe translates to 0X09 or "errCliAddressOutOfRange". My S7-1200 non-optimized DB is >3200 bytes long and I know it to be good. I am running this C++ code on Raspberry Pi 3B Raspbian Stretch Lite. I am using snap7-iot-arm-1.4.2. Any ideas?

code: int DB901ReadResult24=Client->DBRead(901,1609,1652,&GW::PLCData[1894]);
error: 2018-06-27 08:32:12.924 INFO [1453] [DBRead@233] DB901ReadResult24: 9437184

[Davide Nardella]

A bug id DBRead after 3 years seems to me a bit strange :D :D

Either your DB is not unotimized (did you re-download the code into the CPU ?) or you don't have GET/PUT rights (did you re-download the hardware configuration into the CPU ?)

I guess it's the first, the error is that

[Rial Williams]

DB is known good and "friendly" with Snap7. In an earlier version of my C++ code, I was reading the entire DB into a C++ array and all was running as expected. I am trying to rewrite my code to be more efficient as this DB's 0..48 "CDA" array is typically only filled to the fifth or sixth array so I don't want to waste time reading DB data that is meaningless to the application. Now, instead of reading the entire DB, I want to grab it one "CDA" at a time depending on whether my particular machine has it in his system. All is fine for the first 24 CDAs, but on #25 through 48 I get the error mentioned above. I hacked around in my application and found that if I start reading anywhere < 1609 all is well, but if I put anything >= 1609 it bombs.

Here is DB definition:
DATA_BLOCK "DB_MBGatewayRecievedData"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
NON_RETAIN
STRUCT
CDA : Array[0..48] of "CDAfromMBG";
ModBUSWrite : Struct
WriteReq : Bool;
TransferArea : Array[1..6] of Int;
ValidateArea : Array[1..6] of Int;
END_STRUCT;
END_STRUCT;

BEGIN
CDA[0].Reg0.UNT := true;

END_DATA_BLOCK

[Rial Williams]

Here are DB UDTs involved:

TYPE "Reg0"
VERSION : 0.1
   STRUCT
      UNT : Bool;   // Units 0=F/1=C
      LOG : Bool;   // Logging (microSD)
      BYP : Bool;   // Bypass enabled
      RUN : Bool;   // Run (command & status)
      ADR : Bool;   // Active drying enabled (Over-drying protection)
   END_STRUCT;

END_TYPE

TYPE "Reg1"
VERSION : 0.1
   STRUCT
      IN1 : Bool;   // Enable
      IN2 : Bool;   // Low flow
      IN3 : Bool;   // Motor overload
      IN4 : Bool;   // SPARE
      OT1 : Bool;   // Heater
      OT2 : Bool;   // Setback mode
      OT3 : Bool;   // Spare
      OT4 : Bool;   // Spare
      OT5 : Bool;   // Over temperature alarm
      OT6 : Bool;   // Dryer bypass
      OT7 : Bool;   // SPARE
   END_STRUCT;

END_TYPE

TYPE "Reg3"
VERSION : 0.1
   STRUCT
      FW : Array[0..5] of Char;   // Firmware version (ASCII)
      TC1 : Int;   // Hopper inlet (1/10 C)
      TC2 : Int;   // Hopper outlet (1/10 C)
      TC3 : Int;   // SPARE
      TC4 : Int;   // SPARE
      DPR : Int;   // Dew point reading (whole deg)
      ALC : Int;   // Alarm condition error code
      SP2 : Int;   // Active setpoint
      SP3 : Int;   // Over-drying protection threshold
   END_STRUCT;

END_TYPE

TYPE "Reg4"
VERSION : 0.1
   STRUCT
      SP1 : Int;   // Target temperature setpoint
      SP4 : Int;   // High temp. deviatin setpoint
      SP5 : Int;   // Dewpoint control setpoint
      SP6 : Int;   // Dewpoint delta setpoint
      TOP : Int;   // Maximum target temperature
      ADJ : Int;   // Rate of correction constant UP
      ADN : Int;   // Rate of correction constant DOWN
      FUT : Int;   // Anticipated temp.
      UPD : Int;   // Heat timeout [s]
      RAP : Int;   // Cycle frequency by heat
      HOT : Int;   // Heat OFF temp.
      FAL : Int;   // Heat failure const. [s]
      NHA : Int;   // No heat alarm [s]
      HPF : Int;   // Heat power factor
      AUT : Int;   // Adjustment UP temp. range
      AUL : Int;   // Adjustment UP limit
      ADT : Int;   // Adjustment DOWN temp. range
      ADL : Int;   // Adjustment DOWN limit
      HCT : Int;   // Heat cycle time
      DPA : Int;   // Dewpoint alarm trigger
   END_STRUCT;

END_TYPE

TYPE "CDAfromMBG"
VERSION : 0.1
   STRUCT
      Reg0 : "Reg0";
      Reg1 : "Reg1";
      Reg3 : "Reg3";
      Reg4 : "Reg4";
   END_STRUCT;

END_TYPE

[Davide Nardella]

try clientdemo.exe from a windows PC .
what happens ?

[Rial Williams]

It works. Now, I'm really confused. Below is piece of C++ source:

int DB901ReadResult02=Client->DBRead(901,132,197,&GW::PLCData[464]);
    int DB901ReadResult03=Client->DBRead(901,198,263,&GW::PLCData[529]);
    int DB901ReadResult04=Client->DBRead(901,264,329,&GW::PLCData[594]);
    int DB901ReadResult05=Client->DBRead(901,330,395,&GW::PLCData[659]);
    int DB901ReadResult06=Client->DBRead(901,396,461,&GW::PLCData[724]);
    int DB901ReadResult07=Client->DBRead(901,462,527,&GW::PLCData[789]);
    int DB901ReadResult08=Client->DBRead(901,528,593,&GW::PLCData[854]);
    int DB901ReadResult09=Client->DBRead(901,594,659,&GW::PLCData[919]);
    int DB901ReadResult10=Client->DBRead(901,660,725,&GW::PLCData[984]);
    int DB901ReadResult11=Client->DBRead(901,726,791,&GW::PLCData[1049]);
    int DB901ReadResult12=Client->DBRead(901,792,857,&GW::PLCData[1114]);
    int DB901ReadResult13=Client->DBRead(901,858,923,&GW::PLCData[1179]);
    int DB901ReadResult14=Client->DBRead(901,924,989,&GW::PLCData[1244]);
    int DB901ReadResult15=Client->DBRead(901,990,1055,&GW::PLCData[1309]);
    int DB901ReadResult16=Client->DBRead(901,1056,1121,&GW::PLCData[1374]);
    int DB901ReadResult17=Client->DBRead(901,1122,1187,&GW::PLCData[1439]);
    int DB901ReadResult18=Client->DBRead(901,1188,1253,&GW::PLCData[1504]);
    int DB901ReadResult19=Client->DBRead(901,1254,1319,&GW::PLCData[1569]);
    int DB901ReadResult20=Client->DBRead(901,1320,1385,&GW::PLCData[1634]);
    int DB901ReadResult21=Client->DBRead(901,1386,1451,&GW::PLCData[1699]);
    int DB901ReadResult22=Client->DBRead(901,1452,1517,&GW::PLCData[1764]);
    int DB901ReadResult23=Client->DBRead(901,1518,1583,&GW::PLCData[1829]);
    int DB901ReadResult24=Client->DBRead(901,1584,1649,&GW::PLCData[1894]);
/*  There is apparent bug in Snap7 that throws error 9437184 (I think it traps out to 0x09, "An address out of range was specified").  
    // 20180626: next line and all other DB901 reads fails with error 9437184...See log.
    int DB901ReadResult25=Client->DBRead(901,1650,1715,&GW::PLCData[1959]);

[Rial Williams]

I see nothing wrong here. I will try making new Portal project with just DB in it and see if it behaves differently. I am running on Linux, ARM machine. Perhaps something in Snap7 broke during compile time. I used the Snap7 object code. If the new Portal project doesn't show me anything, I'll recompile the Snap7 source code and see what happens.