Troubleshooting TIA Portal V15 Hardware Configuration Mismatch

1. Problem Overview

Hardware configuration faults in TIA Portal V15 (and the closely related V15.1) typically surface as a red banner in the project tree, a flashing SF/ERROR LED on the physical CPU, or as discrete event entries inside the online Diagnostics buffer. Two failure modes account for the majority of the field reports on S7-1200 and S7-1500 stations during the V15 generation:

1. Module article number mismatch – the article number (MLFB / order number) of the device configured offline in the device view does not match the article number reported by the physical module. The CPU refuses to go to RUN and posts an entry such as "Difference between configured and plugged module".
2. Area length fault (OB121 / SF) – the user program reads or writes a memory range that exceeds the configured length of a data block, an input/output area, or a multi-instance. TIA Portal logs an IO access error or Area length error in the diagnostic buffer.

Both faults are recoverable without re-installation of the engineering software. This reference documents the diagnosis, root cause, and correction procedure for each, including the diagnostic buffer navigation path, the meaning of each event, and the verification sequence used to clear the CPU back to RUN.

2. Prerequisites

Before opening any project, confirm the following:

• TIA Portal V15 or V15.1 installed with administrative rights; the latest Hotfix bundle applied (HSPs for new modules are mandatory for S7-1500 firmware ≥ V2.6).
• Online access to the target station via PROFIBUS, PROFINET, or Ethernet – the PG/PC interface must match the subnet the CPU is on.
• Read/write access to the project file (offline) and the read/write password (online) for the CPU.
• The exact article number (printed on the front of the module, e.g. 6ES7511-1AK02-0AB0) and the Firmware version (printed below the article number, e.g. V2.6) for every physical module in the rack.
• The current offline project should be backed up before any online compare or download.

3. Symptom Matrix

4. Reading the Diagnostic Buffer

The diagnostic buffer is the authoritative source for any fault that brings a Siemens S7 CPU out of RUN. In TIA Portal V15, the buffer is reached via Project tree → [CPU] → Online → Diagnostics buffer after an online connection has been established. The buffer is a circular log; the most recent event is on top. Each row contains the timestamp, the event ID, and a short text.

1. Right-click the CPU in the project tree and choose Go online → Online and diagnostics.
2. Expand the Diagnostics folder in the diagnostics tree and double-click Diagnostics buffer.
3. The default view shows the events in a list. Click a single row to populate the Details section below the table.
4. For each event, note the Event ID, the Address (slot / channel / offset), and the Additional details block. The Go to button (the blue arrow icon at the top of the properties pane) jumps from the event to the affected FB/FC/DB in the program editor – this is the fastest way to locate the line that raised the fault.
5. Export the entire buffer to a text file via the Save as icon on the diagnostics toolbar; the resulting .txt is the canonical evidence you should attach to any support ticket.

5. Root Cause A – Module Article Number Mismatch

The CPU compares, on every restart and at every configuration download, the article number of every slot in the offline project against the article number returned by the physically inserted module. If the numbers differ, the CPU logs event 0x0E0E ("Difference between configured and plugged module") and refuses to enter RUN. The most common reasons are:

• The offline project still references the PLCSIM simulator (article numbers in the 6ES7 841-… range) because a previous online test against PLCSIM was not replaced before downloading to the real CPU.
• The firmware version of the real CPU is newer than the firmware supported by the installed HSP. The article number is the same, but the firmware suffix (e.g. 0AB0 vs 0AB1) is treated as a different article.
• The slot is empty in the rack but the project still has a module ordered – the diagnostic event is the same as for an article mismatch.

5.1 Procedure – resolve article number mismatch

1. Identify the slot the diagnostic buffer is complaining about (column "Slot" in the event row).
2. Right-click the device in the project tree and choose Device view; the slot in question is highlighted with a red icon.
3. Delete the wrongly ordered module from the slot.
4. Open the Hardware catalog on the right side of the device view. Use the search field and enter the article number that is printed on the physical module (for example 6ES7511-1AK02-0AB0).
5. Drag the correct module into the slot.
6. Right-click the CPU and choose Compile → Hardware (rebuild all) to refresh the system data blocks.
7. Download the new hardware configuration to the CPU. Use Download to device → Hardware configuration; do not perform a full download of the software – the program blocks are unchanged.
8. Restart the CPU (STOP → RUN) and verify the diagnostic buffer no longer contains the 0x0E0E event.

6. Root Cause B – Area Length Fault (OB121 / OB122)

An area length fault is a programming error: the user program reads or writes past the end of a configured memory area. On S7-1500, the CPU raises OB121 (Programming error) for a DB/FB/FC access beyond the block length, and OB122 (I/O access error) for a peripheral access past the I/O area or to a non-existent slot. If neither OB is loaded, the CPU transitions to STOP.

Typical code patterns that trigger the fault:

• SCL FOR loop counter exceeds the upper bound of an array declared in the DB.
• LAD/FBD MOVE_BLK or MOVE_BLK_VARIANT where the source + count exceeds the source DB length.
• Indirect addressing via P#DBxx.DBX<offset> where the offset is computed at runtime and the resulting pointer points past the DB length.
• Access to an I/O address that is not configured in the device view (e.g. %IW100 on a 16-channel analog module that only exposes 8 channels).

6.1 Interpreting the OB121 start information

6.2 Procedure – resolve area length fault

1. From the diagnostic buffer, click the Go to button in the Details view to jump to the offending instruction in the program editor.
2. Identify the access pattern. For an SCL array access, look at the declared array bounds in the DB and the index variable used at runtime.
3. Add a guard on the index variable, for example:

   // SCL – bounds check before array access
   IF (#iIndex >= 0) AND (#iIndex < "DB_MyData".iArrayLength) THEN
       "DB_MyData".arrValues[#iIndex] := #iValue;
   END_IF;

4. For a MOVE_BLK with a computed count, clamp the count to the remaining length of the source area:

   // SCL – clamp MOVE_BLK count
   #iCount := MIN(IN := #iRequestedCount,
                  IN2 := "DB_Source".iDataLength - #iSrcOffset);
   BLKMOV(SRCBLK := "DB_Source".arrData[#iSrcOffset],
          DSTBLK := "DB_Dest".arrData[#iDstOffset],
          COUNT  := #iCount);

5. Recompile the program blocks and download the software to the CPU.
6. Execute the program path that previously triggered the fault. Confirm the diagnostic buffer is clean for at least one full cycle.

7. Diagnostic Buffer Export Procedure

When escalating to a Siemens support engineer, the buffer must be exported, not screenshotted. From the diagnostics buffer view in TIA Portal V15:

1. Click the Save icon in the toolbar of the diagnostics buffer view (the floppy-disk symbol, rightmost in the view toolbar).
2. Choose Save as type: Text file (*.txt). The exported file contains every event with timestamp, Event ID, OB number, and full detail text – this is the version Siemens can parse.
3. Compress the export plus any project screenshots into a single .zip archive before sending; the forum/portal upload size limit is typically 5 MB, the zip usually fits well below that.

If the online connection is unstable and the live buffer cannot be read, the CPU retains the most recent ~120 events in non-volatile memory after a power cycle. Power-cycle the CPU once, reconnect, and read the buffer before the SF LED is cleared.

8. Online/Offline Compare and Configuration Download

After editing the device configuration, always run a structured online compare before downloading:

1. Right-click the device and choose Compare → Offline/online.
2. The compare editor opens with three columns: offline, online, and a status column. Differences are highlighted in orange.
3. For a pure article-number fix, only the Hardware configuration row should show a difference. The Software and PLC tags rows should remain green.
4. Click the Download to device button at the top of the compare editor. In the download dialog, leave Download hardware configuration checked and uncheck Download software to device unless the program has also changed.
5. Confirm the security prompt (TIA Portal V15 raises a dialog stating the article numbers differ). Acknowledge by clicking Load.

9. Indirect Addressing and SCL Array Bounds – Field-Proven Patterns

Two programming patterns generate the majority of area-length faults in TIA Portal V15 projects:

9.1 Indirect any-pointer access

// SCL – safe indirect access with bounds guard
#iIndex := "DB_Ctrl".iIndex;
#iMax   := "DB_Data".iDataLength - 1;
IF (#iIndex >= 0) AND (#iIndex <= #iMax) THEN
    #dValue := "DB_Data".arrValues[#iIndex];
ELSE
    #dValue := 0;
    "DB_Ctrl".bRangeError := TRUE;     // alarm to HMI
END_IF;

9.2 MOVE_BLK with runtime count

// SCL – never let COUNT exceed the destination length
#iCount := LIMIT(MN := 0,
                 IN := "DB_Src".iValidCount,
                 MX := ("DB_Dst".iDataLength - #iDstOffset));
BLKMOV(SRCBLK := "DB_Src".arrData[#iSrcOffset],
       DSTBLK := "DB_Dst".arrData[#iDstOffset],
       COUNT  := UDINT_TO_UINT(#iCount));

9.3 Symbolic access preferred over absolute

Prefer symbolic tags (e.g. "DB_Motor".iSpeedSetpoint) over absolute addresses (DB100.DBD20). Symbolic access is type-checked at compile time; the compiler rejects an out-of-bounds symbolic access before the code ever reaches the CPU. Absolute addressing is checked only at runtime, where the only feedback is the OB121 event.

10. Firmware / HSP Compatibility

Article number mismatches are frequently caused by an installed TIA Portal that is older than the firmware of the physical module. TIA Portal V15 supports S7-1500 CPUs up to firmware V2.6 out of the box; firmware V2.7 and later require the matching Hardware Support Package (HSP) installed into the TIA Portal installation.

If the firmware of the physical CPU is newer than the highest version supported by your TIA Portal, the hardware catalog will not list the article number, and the device view will fall back to the closest older article – which is what produces the mismatch event at download time. The remediation is either to upgrade the engineering software or to downgrade the CPU firmware to a version supported by the installed TIA Portal.

To read the firmware of the physical module without a project, navigate Online → Accessible nodes, pick the CPU on the network, and inspect the Diagnostics → Module information tab – the article number, firmware version, and serial number are all listed there.

11. Verification Procedure After Repair

Once the configuration has been corrected and downloaded, run the following verification sequence to confirm the CPU is back to a clean state:

1. Read the diagnostic buffer; confirm the last entry has a green status (no error pending).
2. Confirm the CPU is in RUN and the RUN LED is solid green; SF/BF/MAINT LEDs are off.
3. Run an online/offline compare; all rows should be green (no difference).
4. Force a peripheral refresh (Online → Monitor → Update values) on the slots that were modified; the I/O values should follow the field wiring.
5. Trigger the code path that previously caused the area-length fault at least three times; the diagnostic buffer should remain clean.
6. Cycle power to the station (OFF, wait 5 s, ON) and re-read the buffer; the buffer must still be clean, confirming the fault is not hidden in a pending start-up event.

12. Best Practices – Preventing Hardware Configuration Errors in V15

• One CPU per project family. Maintain a master project per CPU article number; clone the master for every new station and only edit the station-specific I/O and program. This guarantees the article number in the device view matches the physical part.
• Lock the HSP set. In a multi-engineer team, agree on the exact TIA Portal version and the exact set of HSPs installed on every PG/PC. A drift of one HSP is enough to produce a mismatch event on download.
• Separate PLCSIM projects from real projects. A PLCSIM article number (6ES7 841-…) in the offline project is the most common cause of a configuration mismatch on the first download to a real CPU. Keep PLCSIM test projects in a separate folder and never copy/paste a PLCSIM device into a production project.
• Always include OB121 and OB122. With both error OBs loaded, an area-length fault no longer stops the CPU; it raises an entry in the diagnostic buffer and the program continues. The error can be diagnosed and corrected during normal operation instead of triggering an unscheduled stop.
• Use symbolic access for new code. Symbolic access is compile-checked; absolute access is only runtime-checked. Reserve absolute addressing for legacy code that cannot be migrated.
• Run "Compile → Software (rebuild all)" after every hardware change. TIA Portal V15 occasionally leaves stale system data blocks after a slot re-ordering; a full rebuild regenerates the SDBs and prevents download-time conflicts.
• Export the diagnostic buffer after every commissioning shift. A snapshot of the buffer taken at the end of the shift is the easiest way to detect intermittent faults that do not stop the CPU.

13. Quick Reference – Diagnostic Buffer Event IDs

14. FAQ