1、臺達(dá)PLC通訊協(xié)議原文1、通訊協(xié)議ASCII模式，9600,7,e,12、通訊資料格式：STX頭碼：（3AH）ADR1ADR0通訊地址：8-bit位址包含了2個ASCII碼CMD1CMD0命令碼：8-bit命令包含了2個ASCII碼DATA(0)DATA(1),DATA(n-1)資料內(nèi)容：n個8-bit資料包含了2n個ASCII碼n=74個ASCII碼LRCCHK1LRCCHK0校驗(yàn)碼：8-bit校驗(yàn)碼包含了2個ASCII碼END1END0尾碼：END1=CR(0DH),END0=LF(0AH)ADR（通訊地址）：PLC通訊地址出廠設(shè)定為0X01,因此（ADR1,ADR0）=0,1一二30H,

2、31H校驗(yàn)碼：校驗(yàn)碼采用LRC方式，將ADR1至最后一個資料內(nèi)容加總，將該值取2的補(bǔ)數(shù)，結(jié)果即為LRC校驗(yàn)碼。例：STXADR1ADR001CMD10CMD03啟始資料地址0401，資料數(shù)0001，LRCCHK1LRCCHK0F6END1END0CRLF01H+03H+04H+01H+00+01H=0AH0AH的2的補(bǔ)數(shù)為F6H注1:2補(bǔ)數(shù)的求法：(1補(bǔ)數(shù)再加1)0A(H)=00001010(B)先取1補(bǔ)數(shù)(將b0-b7反相)得11110101(B),再力口1為11110110(B)=F6(H)即為0A(H)的2補(bǔ)數(shù)。注2：在收到一串完整的通訊命令，要檢查這串通訊命令是否有誤，只要將(ADR1

3、,0)至(LRC1,0)加總等于0,則通訊無誤，否則表示命令中資料有些是錯誤的。通訊異常PLC的回應(yīng)：PLC收到完整的通訊命令時，會判斷命令是否有效，造成無效的原因有:原因EXCEPTIONCODELRCCHKERROR07DEIVCEADDRESSINVALID02要求的資料超過范圍03COMMANDCODEINVALID01通訊命令格式INVALID07例：使用命令碼01讀取X000-X017的狀態(tài)FieldNameExample(Hex)Heading3ASlaveAddress01Function01StartingAddressHi04StartingAddressLo00Numbe

4、rofPointsHi00NumberofPointsLo10ErrorCheck(LRC)EAPLC回應(yīng):FieldNameExample(Hex)Heading3ASlaveAddress01Function81ExceptionCode02ErrorCheck(LRC)7C因?yàn)锳ddress0400對Function01是不合法的，所以回應(yīng)ExceptionCode=0X02,且Function01被設(shè)為81(b7被設(shè)為1),亦即由回應(yīng)的Functioncode的MSB被設(shè)為1表示PLC回應(yīng)ERRORMESSAGE,并且由Functioncode可得知是何種錯誤。可用的命令碼敘述如下：(

5、每個device的address,請參考最后一頁)CodeNameDescription01ReadCoilStatusS,Y,M,T,C02ReadInputStatusS,X,Y,M,T,C03ReadHoldingRegistersT,C,D05ForceSingleColiS,Y,M,T,C06PresetSingleRegisterT,C,D15ForceMultipleColiS,Y,M,T,C16PresetMultipleRegisterT,C,D17ReportSlaveIDNone資料字元的格式依命令碼而定，依可用的命令碼的資料內(nèi)容分別敘述如下:FunctionCode:0

6、1,ReadCoilStatusFieldNameExample(Hex)Heading3ASlaveAddress01Function01StartingAddressHi06StartingAddressLo14NumberofPointsHi00NumberofPointsLo25ErrorCheck(LRC)BFNumberofPoints(max)=255=0x00FF例：從從動裝置01讀取線圈T20-T56PC-PLC“：010106140025BFCRLF”PLC-PC“：010105CD6BB20E1BE6CRLFFieldNameContentsSlaveAddress01F

7、unction01BytesCount05Data(CoilsT27,T20)CDData(CoilsT35,T38)6BData(CoilsT43,T36)B2Data(CoilsT51,T44)0EData(CoilsT56,T52)1BErrorCheck(LRC)E6FunctionCode:02,ReadInputStatusFieldNameExample(Hex)Heading3ASlaveAddress01Function02StartingAddressHi05StartingAddressLo14NumberofPointsHi00NumberofPointsLo25Err

8、orCheck(LRC)BF例：從從動裝置01讀取接點(diǎn)Y024-Y070PC-PLC“：010205140025BFCRLF”PLC-PC“：010205CD6BB20E1BE5CRLFFieldNameContentsSlaveAddress01Function02BytesCount05Data(CoilsY033,Y024)CDData(CoilsY043,Y034)6BData(CoilsY053,Y044)B2Data(CoilsY063,Y054)0EData(CoilsY070,Y064)1BErrorCheck(LRC)E5FunctionCode:03,ReadHolding

9、RegistetFieldNameExample(Hex)Heading3ASlaveAddress01Function03StartingAddressHi06StartingAddressLo14NumberofPointsHi00NumberofPointsLo08ErrorCheck(LRC)DANumberofPoints(max)=18(for16bitregister)=9(for32bitregister)例：從從動裝置01讀取線圈T20-T27PC-PLC“：010306140008DACRLF”PLC-PC“：01031000010002000300040005000600

10、070008B8CRLFFieldNameContentsSlaveAddress01Function03BytesCount10DataHi(T20)00DataLo(T20)01DataHi(T21)00DataLo(T21)02DataHi(T22)00DataLo(T22)03DataHi(T23)00DataLo(T23)04DataHi(T24)00DataLo(T24)05DataHi(T25)00DataLo(T25)06DataHi(T26)00DataLo(T26)07DataHi(T27)00DataLo(T27)08ErrorCheck(LRC)B8FunctionCo

11、de:05,ForceSingleCoilFieldNameExample(Hex)Heading3ASlaveAddress01Function05CoilAddressHi05CoilAddressLo00ForceDataHiFFForceDataLo00ErrorCheck(LRC)F6NMNN=0xFF00,CoilONNMNN=0x0000,CoilOFF例：強(qiáng)制設(shè)定線圈Y000ONPCPLC“：01050500FF00F6CRLFPLC-PC“：01050500FF00F6CRLFFieldNameExample(Hex)Heading3ASlaveAddress01Functi

12、on05CoilAddressHi05CoilAddressLo00ForceDataHiFFForceDataLo00ErrorCheck(LRC)F6FunctionCode:06,PresetSingleRegisterFieldNameExample(Hex)Heading3ASlaveAddress01Function06RegisterAddressHi06RegisterAddressLo00PresetDataHi12PresetDataLo34ErrorCheck(LRC)AD例：設(shè)定暫存器T0to0003PC-PLC“：010606001234ADCRLFPLC-PC“：0

13、10606001234ADCRLFFieldNameExample(Hex)Heading3ASlaveAddress01Function06RegisterAddressHi06RegisterAddressLo00PresetDataHi12PresetDataLo34ErrorCheck(LRC)ADSwitch(c)Case 1 :T0Q一：010606001234ADCRLFCase 2 :C0Q一：01060E001234AFCRLFCase 3 :C232Q一：01060EE812345678EFCRLFCase 4 :D10Q一：0106100A123499CRLFCase 5

14、 :D1000Q一：010613E81234BACRLFFunctionCode:15,ForceMultipleCoilsFieldNameExample(Hex)Heading3ASlaveAddress01Function0FCoilAddressHi05CoilAddressLo00QuantityofCoilsHi00QuantityofCoilsLo0AByteCount02ForceDataHiCDForceDataLo01ErrorCheck(LRC)11QuantityofCoils(max)=255例：設(shè)定線圈Y007,Y000=11001101,Y011,Y010=01。

15、PC-PLC“：010F0500000A02CD0111CRLF”PLC-PC“：010F0500000AE1CRLF”FieldNameExample(Hex)Heading3ASlaveAddress01Function0FRegisterToAddressHi05RegisterToAddressLo00PresetDataHi00PresetDataLo0AErrorCheck(LRC)E1FunctionCode:16,PresetMultipleRegisterFieldNameExample(Hex)Heading3ASlaveAddress01Function10Startin

16、gAddressHi06StartingAddressLo00NumberofRegisterHi00NumberofRegisterLo02ByteCount04DataHi00DataLo0ADataHi01DataLo02ErrorCheck(LRC)C6NumberofRegister(max)=16(for16bitregister)=8(for32bitregister)例：設(shè)定暫存器T0為000A,T1為0102。PC-PLC“：01100600020004000A0102D6CRLF”PLC-PC“：011006000002E7CRLF”FieldNameExample(Hex)Heading3ASlaveAddress01Function10StartingAddressHi06StartingAddressLo00NumberofRegisterHi00NumberofRegisterLo02ErrorCheck(LRC)E7FunctionCode:17,ReportSlaveIDReturnsadescriptionofcontrollerpresentattheslaveaddress,thecurrentstatusoftheslaveRunindicator,andotherinformationspecifi