Resolving Siemens SFC14/SFC15 Error 80B1 on Profibus PPO6

Problem: SFC14/SFC15 Returns Error 80B1 with PPO6 and 4-WORD STRUCT

On a Siemens S7-300 CPU 315-2 DP running STEP 7 V5.5 SP4, calls to SFC14 (DPRD_DAT) and SFC15 (DPWR_DAT) against a Danfoss VLT 6000 HVAC drive (configured as PPO type 6, 4 WORD) consistently return error code 80B1_hex:

"The length of the specified destination area is not identical to the user data length configured with STEP 7."

With PPO3 (2 WORD) the exchange works. After changing the PPO type to PPO6 (4 WORD) and matching the STRUCT to 4 WORD, the error returns. Keeping PPO6 but reverting the STRUCT to 2 WORD suppresses the error - but at the cost of half the process data. The same symptom is widely reported on S7 DP slaves where the configured module consistency, the HW Config slot length, and the RECORD ANY pointer byte count disagree.

Affected platforms include S7-300 / S7-400 with PROFIBUS-DP, classic STEP 7 V5.x, and any DP slave using PPO1, PPO2, PPO3, PPO4, PPO5, PPO6, PPO7 (Danfoss FC profile). TIA Portal users see the equivalent error from DPRD_DAT / DPWR_DAT instructions.

Root Cause Analysis: Three Independent Triggers for 80B1

Error 80B1 is generated by the CPU's DP interface when the byte count of the source/destination area referenced by the RECORD parameter of SFC14/15 does not equal the configured user-data length of the DP module in HW Config. The mismatch has three distinct causes, all of which must be ruled out:

1. Module consistency setting - the slot is configured as Unit (byte-granular) rather than Total length consistent. Profibus-DP slave slots should display the diagnostic ID 4AX (4-axis / total length consistent) instead of 115.
2. ANY pointer byte count - the RECORD ANY in SCL/ST does not encode the full STRUCT byte length, often because the compiler aligns the first element to a byte boundary that excludes padding, or because the STRUCT was declared with the wrong type.
3. Odd-byte user data - the configured DP slot has an odd number of bytes (e.g., 5 or 7). Siemens explicitly documents that SFC14/15 raises 80B1 when the slave's configured byte count is odd, because the CPU cannot copy an odd-byte buffer to a STRUCT/ARRAY of even-word elements without splitting it.

Diagnostic Procedure

1. Capture RETVAL from both SFC14 and SFC15 into a WORD variable so the HMI/VAT can display the hex code. 80B1_hex = 32945 decimal.
2. Open HW Config and double-click the Danfoss VLT 6000 slot. Confirm the PPO type = PPO6 and the entry shows Total length consistent (DP Ident 4AX), not Unit.
3. Open the VAT table and read the configured PIW/PQW addresses directly. If PIWxxx already shows valid process data, the slave is healthy and the fault is in the SFC parameterization.
4. Check the GSD file - ensure the VLT 6000 GSD installed in STEP 7 matches the firmware of the drive. A mismatched GSD exposes the wrong slot length in HW Config.
5. Inspect the ANY pointer in online view - hover the RECORD parameter; the byte count must equal 4 WORD * 2 bytes = 8 bytes for PPO6.

Solution 1 - Correct Module Consistency in HW Config

The most common cause when changing PPO types is that the new slot inherits Unit consistency from the previous configuration. In HW Config:

1. Double-click the VLT 6000 slot in the DP slave rack.
2. Switch the dialog to Addresses tab and verify input/output length = 8 bytes (4 WORD) for PPO6.
3. Open the module properties and set consistency to Total length. The DP Ident should change to 4AX (visible in the device data sheet).
4. Save, compile, and download HW Config to the CPU. Recompile the S7 program.

This is the exact fix that resolved the original forum case: switching the slot from Unit to Total length consistency eliminated 80B1 immediately.

Solution 2 - Build the ANY Pointer Explicitly in TEMP

SCL's automatic ANY generation occasionally encodes an unexpected byte count, particularly when the STRUCT contains padding or when a 4-WORD field is interpreted as a partial reference. Build the ANY manually in a TEMP block of SFC14/15:

VAR_TEMP
  recvAny  : ANY;
  sendAny  : ANY;
  retWord  : WORD;
END_VAR

BEGIN
  // Build receive ANY: 8 bytes at the address of dataReceive
  recvAny.atyp  := 0x10;          // BYTE type
  recvAny.dtyp  := 0x04;          // BYTE granularity
  recvAny.count := 8;             // PPO6 = 4 WORD = 8 bytes
  recvAny.db    := 0;             // absolute, not DB-relative
  recvAny.ptr   := DWORD_TO_DWORD(P#DBX 0.0);

  retWord := INT_TO_WORD(DPRD_DAT(
      LADDR  := iDriveAddr,
      RECORD := recvAny));

  // Build send ANY: 8 bytes at the address of dataSend
  sendAny := recvAny;             // same length, different area
  retWord := INT_TO_WORD(DPWR_DAT(
      LADDR  := iDriveAddr,
      RECORD := sendAny));
END

Working with IN/OUT ANY parameters passed into an FB removes the ambiguity entirely and is the recommended approach for libraries that wrap SFC14/15.

Solution 3 - Match STRUCT to Configured Slot Byte Count Exactly

For PPO6 on the VLT 6000, the user data is 8 bytes (4 WORD). Declare the receive and send STRUCTs as 4 WORD each, with the first two words holding the Control/Status word (CTW/STW) and the last two words holding PCD read/write. Do not mix INT and WORD: keep the structure uniform to avoid padding issues. When switching back to PPO3, halve the STRUCT to 2 WORD and the slot length to 4 bytes - do not leave a 4-WORD STRUCT pointed at a 2-WORD slot.

Common Pitfalls and Field Caveats

• Odd-byte slots: Drives using 5, 7, or 9 bytes of process data are inherently incompatible with word-aligned SFC14/15. Use SFC5 (DPWR_DAT with byte array) or restructure the slot. See Siemens FAQ 10625180.
• Database conflict: If the STRUCT is declared inside a DB, the DB must not be optimized. SFC14/15 require a standard (non-optimized) DB so that the absolute address is stable.
• LADDR is W#16#... - it is the logical base address of the slot, not the PIW. Read it from HW Config (e.g., W#16#100).
• GSD mismatch - drive firmware upgrades sometimes require a new GSD; an old GSD in STEP 7 can report a 4-byte slot when the drive actually provides 8 bytes (or vice versa), producing 80B1.
• OB82/OB86 not loaded - a missing DP diagnostics OB does not cause 80B1, but it masks the underlying cause by suppressing error indicators.

Verification Steps

1. Online, force a VAT watch on danfossProfiBus.dataReceiveRetVal and dataSendRetVal. Both should read W#16#0000 (no error).
2. Read PIW [LADDR] through PIW [LADDR+6] in the VAT and confirm scaling matches the STRUCT fields.
3. Write a non-zero reference to PQW [LADDR+2] and observe the drive respond on the HMI or via FC parameter 3-0x reference.
4. Cycle power to the drive and confirm the connection re-establishes without 80B1 on the first cycle.

Related Error Codes and References

For background, see the Siemens SIMATIC S7-300 System Manual and the STEP 7 V5.5 online help for SFC14/15. Useful external references include the Industrial Monitor Direct 80B1 troubleshooting guide and the PLCTalk SFC14/15 thread.