Troubleshooting S7-300 AG_SEND / AG_RECV P-Area Access Errors on a CP 343-1 Lean

A CPU 313C stations that fails to bring up a TCP connection through a CP 343-1 Lean and surfaces diagnostic buffer entries such as "P area, word access, Access address: 4" is almost always hitting an ANY-pointer fault inside the AG_SEND / AG_RECV call interface. The peripheral (P) area is being addressed because a malformed ANY pointer is being interpreted by the operating system as a process-image I/O read. The symptom is not a defective CP module and the supplied Siemens remedy ("Replace the module") is misleading - the pointer is wrong, not the hardware. This reference walks through the exact pointer construction, the diagnostic buffer interpretation, and the commissioning checks for the S7-300 / CP 343-1 Lean combination.

1. Affected Hardware and Firmware

2. Diagnostic Buffer Entry Decoded

The diagnostic buffer of the CPU reports two repeated entries:

Event ID  W#16#39xx  "I/O access error when updating the process image"
  P area, word access, Access address : 4
  P area, word access, Access address : 8

The error is generated by the CPU when the ANY pointer passed to AG_SEND / AG_RECV is corrupted or constructed incorrectly. The byte-offset field inside the ANY resolves to a small integer (4 or 8), which the CPU interprets as an offset from the start of the P area rather than from the referenced data block. Siemens lists two remedies - "replace the module" and "correct the logical address". In this fault pattern, the third remedy that actually applies is correct the source pointer.

3. Root Cause: ANY Pointer Construction

An ANY pointer in STEP 7 is a 10-byte structure describing a memory area, its byte offset, and its length. For AG_SEND the relevant parameter is SEND (input, ANY), which tells the function block what to transmit. A syntactically valid ANY for sending 420 bytes from DB100 looks like this in STL:

     L  W#16#10        // Syntax ID: S7ANY
     L  W#16#14        // Transport size: BYTE
     L  P#DB100.DBX0.0 // Byte offset pointer
     L  420            // Length in bytes
     T  P#DB100.DBX0.0 BYTE 420  // Combined ANY pointer literal

In LAD/FBD the pointer is typically entered at the SEND input. A common field failure is writing the literal in a way the editor accepts but the CPU rejects at runtime:

The mechanism that produces the "P area, word access, Access address : 4 / 8" diagnostic is the following sequence:

1. The AG_SEND FB is called with a length that exceeds the declared size of the data block referenced in the pointer.
2. When the SEND FB passes the data to the CP via the backplane, the CP hardware requests the buffer from the CPU.
3. The CPU's integrated I/O read logic interprets the byte offset of the malformed ANY (typically the first 16 bits of the pointer's low word) as a P-area slot offset.
4. Because the P-area read returns nothing useful (slot 4 / 8 on a CPU 313C is not assigned to any signal module), the CPU logs the I/O access error and the AG_SEND call returns STATUS = 80A1_hex or 8081_hex.
5. The CP's TCP connection eventually aborts, and the diagnostic buffer fills with W#16#39xx entries.

4. Correct ANY Pointer Examples

For a CPU 313C paired with a CP 343-1 Lean, the SEND and RECV pointers must satisfy three rules:

1. The data block referenced in the pointer must already exist with sufficient declared length. Declare DB100 with length >= 420 bytes BEFORE calling AG_SEND; otherwise the editor accepts the pointer but the CPU cannot resolve it.
2. The transport-size tag (BYTE, WORD, DWORD, REAL) must match a real divisor of the buffer length. AG_SEND supports BYTE, WORD and DWORD as transport tags.
3. The pointer must be inside a data block or a bit-memory area that is also written by application code. Pointers into P#I or P#Q areas are not supported by AG_SEND - they always produce the P-area error.

// STL example for SEND parameter
     CALL  FB 5 , DB115            // AG_SEND, instance DB115
      ID        :=1               // Connection ID from NetPro
      LEN       :=420             // Number of bytes to send
      DONE      :=M100.0
      ERROR     :=M100.1
      STATUS    :=MW102
      SEND      :=P#DB100.DBX 0.0 BYTE 420

For an FB 6 (AG_RECV) the equivalent RECV buffer is declared ahead of time. The pointer passed to RECV describes the buffer that will be written by the CP, not the buffer that will be read by the application.

// STL example for RECV parameter
     CALL  FB 6 , DB116            // AG_RECV, instance DB116
      ID        :=1
      LEN       :=MW110           // Actual length received
      NDR       :=M120.0
      ERROR     :=M120.1
      STATUS    :=MW122
      RECV      :=P#DB200.DBX 0.0 BYTE 420

5. Step-by-Step Resolution

1. Stop the CPU in STOP mode from STEP 7 (PLC > Operating Mode > Stop).
2. Open DB100 in the offline project and confirm that the data block length is >= the value in the SEND pointer. If the length is 0, expand the DB to 420 bytes (or higher) and recompile.
3. Open the FB 5 call in OB1 (or wherever AG_SEND is called). Right-click the SEND input and select Symbolic > Edit. Re-type the literal as P#DB100.DBX0.0 BYTE 420 exactly. Make sure no hidden characters or different transport-size tags are present.
4. Compile the program with Save and Compile. Resolve any warnings about overlapping or uninitialised DBs.
5. Download the corrected program to the CPU with PLC > Download. Tick "Download to target system - overwrite all blocks" so that DB100 is refreshed with its new declared length.
6. Switch the CPU to RUN. Open PLC > Diagnostic Buffer and confirm that no new W#16#39xx entries are written.
7. Force AG_SEND / AG_RECV to run once by setting ACT = TRUE in the call. Watch the DONE bit and STATUS word. STATUS = 0000_hex for one scan indicates a successful TCP send. STATUS = 8183_hex means the CP is still starting up; wait two seconds and retry.
8. Capture the TCP connection in NetPro. Verify that the configured connection ID matches the ID input of FB 5 / FB 6. A mismatch produces STATUS = 8182_hex ("connection not established") and the CP will repeatedly reset the P-area fault.
9. Verify from the remote partner that bytes are being received. Use Wireshark or the partner's receive buffer to confirm that exactly 420 bytes are arriving per call.

6. Connection Resource Constraints on S7-300

Older S7-300 CPUs - and especially the CPU 313C paired with the CP 343-1 Lean - have very limited connection resources. The CP 343-1 Lean provides a maximum of 8 S7 connections and 4 PG/OP slots. If a partner opens more connections than the configured limit, the CP responds with ERROR = 1 and STATUS = 80C3_hex ("no resources available"), which the CPU's diagnostic buffer will sometimes represent as another P-area access error.

Use PLC > Accessible Nodes in STEP 7 to enumerate active connections. On the CP's web server (if enabled) the page Information > Connection Statistics lists every open ID, the partner IP, and the byte counters. Compare those against the IDs configured in NetPro to detect orphaned connections from previous commissioning attempts.

7. CP 343-1 Lean Configuration Requirements

The CP must be configured in HW Config with the correct slot (slot 4 for an S7-300 rack). The CP's Ethernet interface is then opened in NetPro with one or more connections of the appropriate type. For an AG_SEND/AG_RECV TCP connection:

1. Insert a new connection on the CP, choose TCP connection.
2. Set the partner IP address and the partner's port (default 2000 for ISO-on-TCP, 102 for S7). For raw TCP use the port chosen on the partner application.
3. Configure the CP's MAC or IP address; for the CP 343-1 Lean the MAC is on the front label.
4. Compile and download the HW Config.
5. Confirm the CP's LED pattern: SF off, BF1 off, LINK green, RX/TX flashing during traffic. A solid BF1 indicates the configured connection partner is unreachable.

8. Verification and Online Diagnostics

After correcting the pointer and downloading the program, perform the following acceptance checks:

9. Related Fault Codes and Edge Cases

Edge cases that frequently surface alongside the ANY-pointer fault:

• Symbolic vs absolute addressing: switching from symbolic to absolute addressing in STEP 7 can silently reformat the literal - always verify the resulting ANY pointer after a project-wide Find/Replace.
• Optimised DB vs standard DB: on S7-300 the option "Optimised block access" does not exist, but on S7-1500 it does. A project migrated from S7-1500 may carry over a non-deterministic DB layout; revert the DB to standard access before re-deploying to a CPU 313C.
• Multi-instance DB: when AG_SEND / AG_RECV are called as a multi-instance inside another FB, ensure the multi-instance DB has been generated and downloaded.
• PLC reinitialisation: a CPU cold restart resets all instance DBs to their initial values, including any pointer-adjacent data. Add an OB100 initialisation block to recreate SEND buffers on startup.

10. Preventive Maintenance Checklist

1. After every program download, open the diagnostic buffer and verify no P-area access entries are written within 30 seconds of RUN.
2. Add the following error ladder to every AG_SEND / AG_RECV call to capture STATUS history:

// STL snippet for capturing SEND errors
      A       ERROR                  // FB 5 ERROR output
      JCN     NOER
      L       STATUS                 // FB 5 STATUS word
      T       MW 200                // Snapshot to flag word
      S       M 205.0               // Latch "SEND error" bit
      JU      NOER
NOER: NOP   0

3. Add a watchdog timer (e.g. a TON with PT = 10 s) that clears the latch and calls the CP's restart FB if STATUS stays non-zero longer than the timeout.
4. Document each connection ID, partner IP and port in a table attached to the project. The CP 343-1 Lean frequently has the same connection ID reused for multiple protocols during commissioning - that overlap is one of the leading causes of intermittent P-area faults after a hot redeploy.

FAQ