三菱PLC编程口协议.docx

1、三菱PLC编程口协议最近做一个PC通过编程口与FXPLC通讯的程序,在网上找好久,内部软元件的地址还是找不全。没办法，只好使用串口监视软件分析GXDeveloperPLC编程软件发送的代码由于没有寄存器类型信息，所以地址的计算十分关键，如D100和M100分别对应哪个地址呢？下面就是三菱Fx系列PLC地址对应表：Public Const PLC_D_Base_AddRess = 4096 Public Const PLC_D_Special_Base_AddRess = 3584Public Const PLC_Y_Group_Base_AddRess = 160Public Const PL

2、C_PY_Group_Base_AddRess = 672Public Const PLC_T_Group_Base_AddRess = 192Public Const PLC_OT_Group_Base_AddRess = 704Public Const PLC_RT_Group_Base_AddRess = 1216Public Const PLC_M_SINGLE_Base_AddRess = 2048(命令为7或8时)Public Const PLC_M_Group_Base_AddRess = 256Public Const PLC_PM_Group_Base_AddRess = 7

3、68Public Const PLC_S_Group_Base_AddRess = 0Public Const PLC_X_Group_Base_AddRess = 128Public Const PLC_C_Group_Base_AddRess = 448Public Const PLC_OC_Group_Base_AddRess = 960Public Const PLC_RC_Group_Base_AddRess = 1472Public Const PLC_TV_Group_Base_AddRess = 2048Public Const PLC_CV16_Group_Base_AddR

4、ess = 2560Public Const PLC_CV32_Group_Base_AddRess = 3072 当我们用DEVICE READ命令时，D100地址=100*2+4096；M100地址=100+256；不同的是D类型寄存器存放的是字，M寄存器存放的是位，同样是读两个字节，D100返回的就是PLC中D100地址的值，M类型寄存器返回的是M100到M116的值。所以当我们用FORCE ON 命令时，M100寄存器地址=100+2048；这也没有什么复杂的，不是吗？可是三菱公司好像不甘于如此，FORCE ON/Off命令中地址排列与DEVICE READ/WRITE不同，是低位在前

5、高位在后。如Y20，地址是0510H，代码中4个字节地址表示为：1005。（注意：Y寄存器为八进制，如Y20 地址=16+1280=0510H）三菱FX系列PLC编程口通信协议总览该协议实际上适用于PLC编程端口以及FX-232AW模块的通信。感谢网友visualboy提供。通讯格式：命令命令码目标设备DEVICEREADCMD0X,Y,M,S,T,C,D/设备读DEVICEWRITECMD1X,Y,M,S,T,C,D/设备写FORCEONCMD7X,Y,M,S,T,C/置位FORCEOFFCMD8X,Y,M,S,T,C/复位传输格式:RS232C波特率:9600bps奇偶:even校验:累加

6、方式（和校验）字符:ASCII16进制代码：ENQ05H请求ACK06HPLC正确响应NAK15HPLC错误响应STX02H报文开始ETX03H报文结束帧格式：STXCMDDATA.DATAETXSUM(upper)SUM(lower)例子：STX,CMD,ADDRESS,BYTES,ETX,SUM02H,30H,31H,30H,46H,36H,30H,34H,03H,37H,34HSUM=CMD+.+ETX；30h+31h+30h+46h+36h+30h+34h+03h=74h;累加和超过两位取低两位命令格式1、DEVICEREAD（读出软设备状态值）计算机向PLC发送：始命令首地址位数终和

7、校验STXCMDGROUPADDRESSBYTESETXSUM例子：从D123开始读取4个字节数据02h30h31h,30h,46h,36h30h,34h03h37h,34h地址算法:address=address*2+1000h再转换成ASCII31h,30h,46h,36hPLC返回STX1STDATA2NDDATA.LASTDATAETXSUM注：最多可以读取64个字节的数据例子：从指定的存储器单元读到3584这个数据02h33h35h38h34h03h44h,36h2、DEVICEWRITE（向PLC软设备写入值）始命令首地址位数数据终和校验STXCMDGROUPADDRESSBYTE

8、S1STDATA2NDDATA.LASTDATAETXSUM例子：向D123开始的两个存储器中写入1234,ABCD02h31h31h,30h,46h,36h30h,34h33h,34h,31h,32h,43h,44h,41h,42h03h34h,39hPLC返回ACK(06H)接受正确NAK(15H)接受错误3、位设备强制置位/复位FORCEON置位始命令地址终和校验STXCMDADDRESSETXSUM02h37haddress03hsumFORCEOFF复位始命令地址终和校验STXCMDADDRESSETXSUM02h38haddress03hsumPLC返回ACK(06H)接受正确NA

9、K(15H)接受错误设备强制中的地址公式:Address=Address/8+100h说明：1.帧中的BYTES表示需要读取或者写入的字节数。2.地址算法上有说明。3.累加和是从STX后面一个字节开始累加到ETX的和。通过串口监视得到的数据如下:PLC型号：FX0N使用GXDeveloper的在线调试软元件测试功能以下列出不同的操作发送的不同内容，前面一段是Hex码后面一段是对应的ASCII码/CMDONYO/023730303035034646.70005.FF/CMDOFFYO/023830303035033030.80005.00/CMDONY1/023730313035033030.7

10、0105.00/CMDOFFY1/023830313035033031.80105.01/CMDONXO/023730303034034645.70004.FE/CMDOFFXO/023830303034034646.80004.FF/CMDONX1/023730313034034646.70104.FF/CMDOFFX1/023830313034033030.80104.00/CMDONT0/023730303036033030.70006.00/CMDOFFT0/023830303036033031.80006.01/CMDONT1/023730313036033031.70106.01/

11、CMDOFFT1/023830313036033032.80106.02/CMDONC0/023730303045033046.7000E.0F/CMDOFFC0/023830303045033130.8000E.10/CMDONC1/023730313045033130.7010E.10/CMDOFFC1/023830313045033131.8010E.11/CMDONM0/023730303038033032.70008.02/CMDOFFM0/023830303038033033.80008.03/CMDONM1/023730313038033033.70108.03/CMDOFFM1

12、/023830313038033034.80108.04/CMDONS0/023730303030034641.70000.FA/CMDOFFS0/023830303030034642.80000.FB/CMDONS1/023730313030034642.70100.FB/CMDOFFS1/023830313030034643.80100.FC/CMDWRITED015AB16Bit/02313130303030324142313503.1100002AB15.343040/CMDWRITED115AB15AB32Bit/02313130303030344142313541.1100004A

13、B15A423135033242B15.2B/CMDWRITET015AB16Bit/02313038303030324142313503.1080002AB15.343747/CMDWRITET115AB15AB32Bit/02313038303030344142313541.1080004AB15A423135033332B15.32/CMDWRITEC015AB16Bit/02313041303030324142313503.10A0002AB15.353050/CMDWRITEC115AB15AB32Bit/02313041303030344142313541.10A0004AB15A

14、423135033342B15.3B以上是用FX-0NPLC时的情况,从上面的数据很容易分析出内部软元件的地址,有趣的是在换成FX-1N时发现有所不同FX-1NPLC以下列出不同的操作发送的不同内容/CMDONYO/02453730303043033532.E7000C.52/CMDOFFYO/02453830303043033533.E8000C.53/CMDONY1/02453730313043033533.E7010C.53/CMDOFFY1/02453830313043033534.E8010C.54/CMDONXO/02453730303132033432.E70012.42/CMD

15、OFFXO/02453830303132033433.E80012.43/CMDONX1/02453730313132033433.E70112.43/CMDOFFX1/02453830313132033434.E80112.44/CMDONT0/02453730303130033430.E70010.40/CMDOFFT0/02453830303130033431.E80010.41/CMDONT1/02453730313130033431.E70110.41/CMDOFFT1/02453830313130033432.E80110.42/CMDONC0/024537303030460335

16、35.E7000F.55/CMDOFFC0/02453830303046033536.E8000F.56/CMDONC1/02453730313046033536.E7010F.56/CMDOFFC1/02453830313046033537.E8010F.57/CMDONM0/02453730303030033346.E70000.3F/CMDOFFM0/02453830303030033430.E80000.40/CMDONM1/02453730313030033430.E70100.40/CMDOFFM1/02453830313030033431.E80100.41/CMDONS0/02

17、453730303134033434.E70014.44/CMDOFFS0/02453830303134033435.E80014.45/CMDONS1/02453730313134033435.E70114.45/CMDOFFS1/02453830313134033436.E80114.46/CMDWRITED015AB16Bit/024531303430303030324142313503.E10400002AB15.4238B8/CMDWRITED115AB15AB32Bit/024531303430303230344142313541.E10400204AB15A423135034135B15.A5/CMDWRITET015AB16Bit/0245313031303