【技术资料】台达可编程逻辑控制器plc 通信协议

【技术资料】台达可编程逻辑控制器plc 通信协议 DELTA DVP Series PLC COMMUNICATION PROTOCOL VER 1.0 DELTA ELECTRONICS, INC. 1. Communication Interface: RS-232C 2. Communication Protocol ASCII mode, 9600，Baud rate，, EVEN，Parity，, 1，Start bit，,1，Stop bit， 3. Communication Data Frame STX Start character „:?，3AH， ADR 1 Communication address: ADR 0 8-bit address consists of 2 ASCII codes CMD 1 Command code: CMD 0 8-bit command consists of 2 ASCII codes DATA，0， Contents of data: DATA，1， n，8-bit data consist of 2n ASCII codes. ………. n,37, maximum of 74 ASCII codes DATA，n-1， LRC CHK 1 LRC check sum: LRC CHK 0 8-bit check sum consists of 2 ASCII codes END 1 End character: END 0 END 1 = CR，0DH，,END 0 = LF，0AH， , ADR，Communication Address， Valid communication addresses are in the range of 0…31. Communication address equals to 0 means broadcast to all PLC, the PLC will reply normal message to the master device. For example, communication to PLC with address 16 decimal: (ADR 1, ADR 0)=?1?,?0?,?1?=31H, „0? = 30H , CMD (Command code) and DATA (data characters) The format of data characters depends on the command code. For example, reading continuous 8 words form starting device address 0614H of PLC with address 01H. Field Name Example (Hex) Heading 3A Slave Address 01 Command code 03 Starting Address Hi 06 Starting Address Lo 14 Number of Points Hi 00 Number of Points Lo 08 Error Check ( LRC ) DA Number of Points(max) = 18，for 16 bit register， = 9，for 32 bit register， Example,Reading Coils T20~T27 from slave device 01 PC?PLC “,01 03 06 14 00 08 DA CR LF” PLC?PC “,01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 B8 CR LF” Field Name Example (Hex) Slave Address 01 Command code 03 Bytes Count 10 Data Hi，T20， 00 Data Lo，T20， 01 Data Hi，T21， 00 Data Lo，T21， 02 Data Hi，T22， 00 Data Lo，T22， 03 Data Hi，T23， 00 Data Lo，T23， 04 Data Hi，T24， 00 Data Lo，T24， 05 Data Hi，T25， 00 Data Lo，T25， 06 Data Hi，T26， 00 Data Lo，T26， 07 Data Hi，T27， 00 Data Lo，T27， 08 Error Check，LRC， C8 , LRC CHK，check sum， LRC (Longitudinal Redundancy Check) is calculated by summing up, module 256, the values of the bytes from ADR1 to last data character then calculating the hexadecimal representation of the 2?s-complement negation of the sum. For example, reading 1 word form address 0401H of the PLC with address 01H STX „,? ADR 1 „0? ADR 0 „1? CMD 1 „0? CMD 0 „3? „0? „4? Starting data address „0? „1? „0? „0? Number of data „0? „1? LRC CHK 1 „F? LRC CHK 0 „6? END 1 CR END 0 LF 01H+03H+04H+01H+00+01H = 0AH the 2?s-complement negation of 0AH is F6H Exception response: The PLC is been expected to return a normal response after receiving command messages from the master device. The following depicts the conditions that no normal response is replied to the master device. The PLC does not receive the messages due to a communication error; thus the PLC has no response. The master device will eventually process a timeout condition. The PLC receives the messages without a communication error, but cannot handle it, an exception response will return to the master device. In the exception response, the most significant bit of the original command code is set to 1, and an exception code explains the condition that caused the exception is returned. An example of exception response of command code 01H and exception 02H: Command message: Field Name Example (Hex) Heading 3A Slave Address 01 Function 01 Starting Address Hi 04 Starting Address Lo 00 Number of Points Hi 00 Number of Points Lo 10 Error Check ( LRC ) EA Response message: Field Name Example (Hex) Heading 3A Slave Address 01 Function 81 Exception Code 02 Error Check ( LRC ) 7C Exception code: Meaning: Illegal command code: 01 The command code received in the command message is not available for the PLC. Illegal device address: 02 The device address received in the command message is not available for the PLC. Illegal device value: 03 The device value received in the command message is not available for the PLC. Check Sum Error Check if the check Sum is correct 07 Illegal command messages The command message is too short. Command message length is out of range. , The format of data characters depends on the command. The available command codes are described as followed, Code Name Description 01 Read Coil Status S, Y, M, T, C 02 Read Input Status S, X, Y, M,T, C 03 Read Holding Registers T, C, D 05 Force Single Coil S, Y, M, T, C 06 Preset Single Register T, C, D 15 Force Multiple Coils S, Y, M, T, C 16 Preset Multiple Register T, C, D 17 Report Slave ID None DELTA DVP-ES Series PLC DEVICE ADDRESS Device Range Effective Range Address S 000~255 0000~00FF S 256~511 0100~01FF 000~127 S 512~767 0200~02FF S 768~1023 0300~03FF X 000~377 (Octal) 000~177 (Octal) 0400~04FF Y 000~377 (Octal) 000~177 (Octal) 0500~05FF T 000~255 000~127 0600~06FF M 000~255 0800~08FF M 256~511 0900~09FF M 512~767 0000~1279 0A00~0AFF M 768~1023 0B00~0BFF M 1024~1279 0C00~0CFF 000~127 C 000~255 0E00~0EFF 232~255 D 000~255 1000~10FF D 256~511 1100~11FF 000~599 D 512~767 1200~12FF 1000~1143 D 768~1023 1300~13FF D 1024~1279 1400~14FF Command Code,01, Read Coil Status Field Name Example (Hex) Heading 3A Slave Address 01 Command code 01 Starting Address Hi 06 Starting Address Lo 14 Number of Points Hi 00 Number of Points Lo 25 Error Check ( LRC ) BF Number of Points(max) = 255 = 0x00FF Example,Reading Coils T20~T56 from slave device 01 PC?PLC “,01 01 06 14 00 25 BF CR LF” PLC?PC “,01 01 05 CD 6B B2 0E 1B D6 CR LF” Field Name Example (Hex) Slave Address 01 Command code 01 Bytes Count 05 Data，Coils T27…T20， CD Data，Coils T35…T38， 6B Data，Coils T43…T36， B2 Data，Coils T51…T44， 0E Data，Coils T56…T52， 1B Error Check，LRC， E6 , Command Code,02, Read Input Status Field Name Example (Hex) Heading 3A Slave Address 01 Command code 02 Starting Address Hi 05 Starting Address Lo 14 Number of Points Hi 00 Number of Points Lo 25 Error Check ( LRC ) BF Example,Reading Contact Y024~Y070 from slave device 01 PC?PLC “,01 02 05 14 00 25 BF CR LF” PLC?PC “,01 02 05 CD 6B B2 0E 1B E5 CR LF” Field Name Example (Hex) Slave Address 01 Command code 02 Bytes Count 05 Data，Coils Y033…Y024， CD Data，Coils Y043…Y034， 6B Data，Coils Y053…Y044， B2 Data，Coils Y063…Y054， 0E Data，Coils Y070…Y064， 1B Error Check，LRC， E5 , Command Code,03, Read Holding Register Holding Register,T, C, D Field Name Example (Hex) Heading 3A Slave Address 01 Command code 03 Starting Address Hi 06 Starting Address Lo 14 Number of Points Hi 00 Number of Points Lo 08 Error Check ( LRC ) DA Number of Points(max) = 18，for 16 bit register， = 9，for 32 bit register， Example,Reading Coils T20~T27 from slave device 01 PC?PLC “,01 03 06 14 00 08 DA CR LF” PLC?PC “,01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 B8 CR LF” Field Name Example (Hex) Slave Address 01 Command code 03 Bytes Count 10 Data Hi，T20， 00 Data Lo，T20， 01 Data Hi，T21， 00 Data Lo，T21， 02 Data Hi，T22， 00 Data Lo，T22， 03 Data Hi，T23， 00 Data Lo，T23， 04 Data Hi，T24， 00 Data Lo，T24， 05 Data Hi，T25， 00 Data Lo，T25， 06 Data Hi，T26， 00 Data Lo，T26， 07 Data Hi，T27， 00 Data Lo，T27， 08 Error Check，LRC， C8 , Command Code,05, Force Single Coil Field Name Example (Hex) Heading 3A Slave Address 01 Command code 05 Coil Address Hi 05 Coil Address Lo 00 Force Data Hi FF Force Data Lo 00 Error Check ( LRC ) F6 MMNN = 0xFF00….Coil ON MMNN = 0x0000….Coil OFF Example,Forcing Coil Y000 ON PC?PLC “,01 05 05 00 FF 00 F6 CR LF” PLC?PC “,01 05 05 00 FF 00 F6 CR LF” Field Name Example (Hex) Heading 3A Slave Address 01 Command code 05 Coil Address Hi 05 Coil Address Lo 00 Force Data Hi FF Force Data Lo 00 Error Check ( LRC ) F6 , Command Code,06, Preset Single Register Field Name Example (Hex) Heading 3A Slave Address 01 Command code 06 Register Address Hi 06 Register Address Lo 00 Preset Data Hi 12 Preset Data Lo 34 Error Check ( LRC ) AD Example,Setting Register T0 to 00 03 PC?PLC “,01 06 06 00 12 34 AD CR LF” PLC?PC “,01 06 06 00 12 34 AD CR LF” Field Name Example (Hex) Heading 3A Slave Address 01 Command code 06 Register T0 Address Hi 06 Register T0 Address Lo 00 Preset Data Hi 12 Preset Data Lo 34 Error Check ( LRC ) AD Switch ( c ) Case 0,T0 Q ?,01 06 06 00 12 34 AD CR LF Case 1,C0 Q ?,01 06 0E 00 12 34 AF CR LF Case 2,C232 Q ?,01 06 0E E8 12 34 56 78 EF CR LF Case 3,D10 Q ?,01 06 10 0A 12 34 99 CR LF Case 4,D1000 Q ?,01 06 13 E8 12 34 BA CR LF , Command Code,15, Force Multiple Coils Field Name Example (Hex) Heading 3A Slave Address 01 Command code 0F Coil Address Hi 05 Coil Address Lo 00 Quantity of Coils Hi 00 Quantity of Coils Lo 0A Byte Count 02 Force Data Hi CD Force Data Lo 01 Error Check (LRC) 11 Quantity of Coils (max) = 255 Example,Setting Coil Y007…Y000 = 1100 1101, Y011…Y010 = 01. PC?PLC “,01 0F 05 00 00 0A 02 CD 01 11 CR LF” PLC?PC “,01 0F 05 00 00 0A E1 CR LF” Field Name Example (Hex) Heading 3A Slave Address 01 Command code 0F Register T0 Address Hi 05 Register T0 Address Lo 00 Preset Data Hi 00 Preset Data Lo 0A Error Check ( LRC ) E1 , Command Code,16, Preset Multiple Register Field Name Example (Hex) Heading 3A Slave Address 01 Command code 10 Starting Address Hi 06 Starting Address Lo 00 Number of Register Hi 00 Number of Register Lo 02 Byte Count 04 Data Hi 00 Data Lo 0A Data Hi 01 Data Lo 02 Error Check (LRC) C6 Number of Register(max) = 16，for 16 bit register， = 8，for 8 bit register， Example,Setting Register T0 to 00 0A, T1 to 01 02. PC?PLC “,01 10 06 00 02 00 04 00 0A 01 02 D6 CR LF” PLC?PC “,01 10 06 00 00 02 E7 CR LF” Field Name Example (Hex) Heading 3A Slave Address 01 Command code 10 Starting Address Hi 06 Starting Address Lo 00 Number of Registers Hi 00 Number of Registers Lo 02 Error Check ( LRC ) E7 , Command Code,17, Report Slave ID Returns a description of controller present at the slave address, the current status of the slave Run indicator, and other information specific to the slave device. Command message: Field Name Example (Hex) Heading 3A Slave Address 01 Command code 11 Error Check (LRC) EE Response message: Field Name Example (Hex) Heading 3A Slave Address 01 Command code 11 Byte Count 04 Slave ID 01 Run Indicator Status 00 = OFF FF FF = ON Data 0，D1001 HI， 40 Data 1，D1001 LOW， 10 Error Check (LRC) 9A , DVP Series PLC Internal Device Communication Address Effective range Device Range Type Address ES/EX/SS SA/SX/SH EH S 000~255 bit 0000~00FF S 246~511 bit 0100~01FF 0~127 0~1024 0~1024 S 512~767 bit 0200~02FF S 768~1023 bit 0300~03FF X 000~377 (Octal) bit 0400~04FF 0~177 0~177 000~377 Y 000~377 (Octal) bit 0500~05FF T 000~255 bit/word 0600~06FF 0~127 000~255 000~255 M 000~255 bit 0800~08FF M 256~511 bit 0900~09FF M 512~767 bit 0A00~0AFF M 768~1023 bit 0B00~0BFF M 1024~1279 bit 0C00~0CFF M 1280~1535 bit 0D00~0DFF M 1536~1791 bit B000~B0FF M 1792~2047 bit B100~B1FF 0~1279 0~4095 0000~4095 M 2048~2303 bit B200~B2FF M 2304~2559 bit B300~B3FF M 2560~2815 bit B400~B4FF M 2816~3071 bit B500~B5FF M 3072~3327 bit B600~B6FF M 3328~3583 bit B700~B7FF M 3584~3839 bit B800~B8FF M 3840~4095 bit B900~B9FF 0~199 16-bit bit/word 0E00~0EC7 0~127 0~199 0~199 C 200~255 32-bit bit/Dword 0EC8~0EFF 232~255 200~255 200~255 Effective Device Range Type Address ES/EX/SS SA/SX/SH EH D 000~256 word 1000~10FF D 256~511 word 1100~11FF D 512~767 word 1200~12FF D 768~1023 word 1300~13FF D 1024~1279 word 1400~14FF D 1280~1535 word 1500~15FF D 1536~1791 word 1600~16FF D 1792~2047 word 1700~17FF D 2048~2303 word 1800~18FF D 2304~2559 word 1900~19FF D 2560~2815 word 1A00~1AFF D 2816~3071 word 1B00~1BFF D 3072~3327 word 1C00~1CFF D 3328~3583 word 1D00~1DFF D 3584~3839 word 1E00~1EFF D 3840~4095 word 1F00~1FFF D 4096~4351 word 9000~90FF D 4352~4607 word 9100~91FF 0~1311 0~4999 0000~9999 D 4608~4863 word 9200~92FF D 4864~5119 word 9300~93FF D 5120~5375 word 9400~94FF D 5376~5631 word 9500~95FF D 5632~5887 word 9600~96FF D 5888~6143 word 9700~97FF D 6144~6399 word 9800~98FF D 6400~6655 word 9900~99FF D 6656~6911 word 9A00~9AFF D 6912~7167 word 9B00~9BFF D 7168~7423 word 9C00~9CFF D 7424~7679 word 9D00~9DFF D 7680~7935 word 9E00~9EFF D 7936~8191 word 9F00~9FFF D 8192~8447 word A000~A0FF D 8448~8703 word A100~A1FF D 8704~8959 word A200~A2FF D 8960~9215 word A300~A3FF D 9216~9471 word A400~A4FF D 9472~9727 word A500~A5FF D 9728~9983 word A600~A6FF D 9984~9999 word A700~A70F