Regarding OTW/OTA firmware update, 1) make sure bootloader, keys are already programmed into the device before upgrading; 2). be aware that only a GBL file with an increased version number is allowed to be upgraded. That is, you cannot load a GBL file with same firmware version as that the device is currently running. 

Unfortunately, the error code is not documented as I known. To understand your current OTW update issue, can you please share more information about your controller being upgraded and testing procedure:

1. Is it a UZB-7 or a custom EFR32ZG14 board? What is the version of the SerialAPI controller running on the device?

2. Are the ZG14 keys generated by yourself or provided in Z-Wave SDK release? If using the keys in Z-Wave SDK, what is the SDK version?

For test purpose, you may use the ZG14 keys and ZG14 GBL file offered in Z-Wave SDK. If you create your own ZG14 keys, then you have to generate a GBL file for the new version of firmware with the same keys you created.

For the ZW_SerialAPI_Controller_7.14.6_327_EFR32ZG14_REGION_EU.gbl you are requesting, I am not sure where you get it, if you install the latest official Z-Wave SDK release available in Simplicity Studio 5, you will see the version of SerialAPI Controller binaries for ZG14 is v7.14.3 shown as below. 

The SWD (Serial Wire Debug) interface is a standard ARM program/debug interface using the pins - SWCLK, SWDIO.

The interface is required when you program a bootloader, signing/encryption keys, or an initial application image into a Z-Wave 700 device.

Is it ok to program keys to zwave device once just during production ?

After the device delivered, we only  update FW more times, is it ok?

Yes, it is OK. Once you have a new version of FW to upgrade, you will need to use the same set of keys to generate a GBL file for the new firmware.

It is likely the Z-Wave device being updated does not contain signing and encryption keys.

The keys for upgrading firmware must be flashed to the device after flashing bootloader and application firmware.

Please refer to the OTA procedure in the KBA below, and then try to flash ZG14 keys in Z-Wave SDK 7.13.6, the same version as your GBL file. The ZG14 keys are located at \z-wave\BootLoader\ZG14_keys\

commander flash --tokengroup znet --tokenfile zg14_encrypt.key --tokenfile zg14_sign.key-tokens.txt

Note: each manufacturer should have his own set of keys. New keys can be generated with simplicity commander. More information can be found in INS14259 Z-Wave Plus V2 Application Framework SDK7, section 9 Firmware Update Images and Bootloader.

Edit: adding KBA: Z-Wave 700: OTA of End-Device

It is likely the Z-Wave device being updated does not contain signing and encryption keys.

The keys for upgrading firmware must be flashed to the device after flashing bootloader and application firmware.

Please refer to the OTA procedure in the KBA below, and then try to flash ZG14 keys in Z-Wave SDK 7.13.6, the same version as your GBL file. The ZG14 keys are located at \z-wave\BootLoader\ZG14_keys\

commander flash --tokengroup znet --tokenfile zg14_encrypt.key --tokenfile zg14_sign.key-tokens.txt

Note: each manufacturer should have his own set of keys. New keys can be generated with simplicity commander. More information can be found in INS14259 Z-Wave Plus V2 Application Framework SDK7, section 9 Firmware Update Images and Bootloader.

You can erase the main Flash, bootloader and Lock Bits page before programming, and then reset the device.

commander device masserase -d Cortex-M4
commander device pageerase --region @bootloader -d Cortex-M4
commander device pageerase --region @lockbits -d Cortex-M4