三菱PLC编程口协议.doc

最近做一个PC通过编程口与FXPLC通讯的程序,在网上找好久,内部软元件的地址还是找不全。没办法，只好使用串口监视软件分析GXDeveloperPLC编程软件发送的代码 三菱FX系列PLC编程口通信协议总览该协议实际上适用于PLC编程端口以及FX-232AW模块的通信。感谢网友visualboy提供。通讯格式：命令命令码目标设备DEVICEREADCMD0X,Y,M,S,T,C,DDEVICEWRITECMD1X,Y,M,S,T,C,DFORCEONCMD7X,Y,M,S,T,CFORCEOFFCMD8X,Y,M,S,T,C传输格式:RS232C波特率:9600bps奇偶:even校验:累加方式（和校验）字符:ASCII16进制代码：ENQ05H请求ACK06HPLC正确响应NAK15HPLC错误响应STX02H报文开始ETX03H报文结束帧格式：STXCMDDATA.DATAETXSUM(upper)SUM(lower)例子：STX,CMD,ADDRESS,BYTES,ETX,SUM02H,30H,31H,30H,46H,36H,30H,34H,03H,37H,34HSUM=CMD+.+ETX；30h+31h+30h+46h+36h+30h+34h+03h=74h;累加和超过两位取低两位命令格式1、DEVICEREAD（读出软设备状态值）计算机向PLC发送：始命令首地址位数终和校验STXCMDGROUPADDRESSBYTESETXSUM例子：从D123开始读取4个字节数据02h30h31h,30h,46h,36h30h,34h03h37h,34h地址算法:address=address*2+1000h再转换成ASCII31h,30h,46h,36hPLC返回STX1STDATA2NDDATA.LASTDATAETXSUM注：最多可以读取64个字节的数据例子：从指定的存储器单元读到3584这个数据02h33h35h38h34h03h44h,36h2、DEVICEWRITE（向PLC软设备写入值）始命令首地址位数数据终和校验STXCMDGROUPADDRESSBYTES1STDATA2NDDATA.LASTDATAETXSUM例子：向D123开始的两个存储器中写入1234,ABCD02h31h31h,30h,46h,36h30h,34h33h,34h,31h,32h,43h,44h,41h,42h03h34h,39hPLC返回ACK(06H)接受正确NAK(15H)接受错误3、位设备强制置位/复位FORCEON置位始命令地址终和校验STXCMDADDRESSETXSUM02h37haddress03hsumFORCEOFF复位始命令地址终和校验STXCMDADDRESSETXSUM02h38haddress03hsumPLC返回ACK(06H)接受正确NAK(15H)接受错误设备强制中的地址公式:Address=Address/8+100h说明：1.帧中的BYTES表示需要读取或者写入的字节数。2.地址算法上有说明。3.累加和是从STX后面一个字节开始累加到ETX的和。通过串口监视得到的数据如下:PLC型号：FX0N使用GXDeveloper的在线调试软元件测试功能以下列出不同的操作发送的不同内容，前面一段是Hex码后面一段是对应的ASCII码/CMDONYO/023730303035034646.70005.FF/CMDOFFYO/023830303035033030.80005.00/CMDONY1/023730313035033030.70105.00/CMDOFFY1/023830313035033031.80105.01/CMDONXO/023730303034034645.70004.FE/CMDOFFXO/023830303034034646.80004.FF/CMDONX1/023730313034034646.70104.FF/CMDOFFX1/023830313034033030.80104.00/CMDONT0/023730303036033030.70006.00/CMDOFFT0/023830303036033031.80006.01/CMDONT1/023730313036033031.70106.01/CMDOFFT1/023830313036033032.80106.02/CMDONC0/023730303045033046.7000E.0F/CMDOFFC0/023830303045033130.8000E.10/CMDONC1/023730313045033130.7010E.10/CMDOFFC1/023830313045033131.8010E.11/CMDONM0/023730303038033032.70008.02/CMDOFFM0/023830303038033033.80008.03/CMDONM1/023730313038033033.70108.03/CMDOFFM1/023830313038033034.80108.04/CMDONS0/023730303030034641.70000.FA/CMDOFFS0/023830303030034642.80000.FB/CMDONS1/023730313030034642.70100.FB/CMDOFFS1/023830313030034643.80100.FC/CMDWRITED015AB16Bit/02313130303030324142313503.1100002AB15.343040/CMDWRITED115AB15AB32Bit/02313130303030344142313541.1100004AB15A423135033242B15.2B/CMDWRITET015AB16Bit/02313038303030324142313503.1080002AB15.343747/CMDWRITET115AB15AB32Bit/02313038303030344142313541.1080004AB15A423135033332B15.32/CMDWRITEC015AB16Bit/02313041303030324142313503.10A0002AB15.353050/CMDWRITEC115AB15AB32Bit/02313041303030344142313541.10A0004AB15A423135033342B15.3B以上是用FX-0NPLC时的情况,从上面的数据很容易分析出内部软元件的地址,有趣的是在换成FX-1N时发现有所不同FX-1NPLC以下列出不同的操作发送的不同内容/CMDONYO/02453730303043033532.E7000C.52/CMDOFFYO/02453830303043033533.E8000C.53/CMDONY1/02453730313043033533.E7010C.53/CMDOFFY1/02453830313043033534.E8010C.54/CMDONXO/02453730303132033432.E70012.42/CMDOFFXO/02453830303132033433.E80012.43/CMDONX1/02453730313132033433.E70112.43/CMDOFFX1/02453830313132033434.E80112.44/CMDONT0/02453730303130033430.E70010.40/CMDOFFT0/02453830303130033431.E80010.41/CMDONT1/02453730313130033431.E70110.41/CMDOFFT1/02453830313130033432.E80110.42/CMDONC0/02453730303046033535.E7000F.55/CMDOFFC0/02453830303046033536.E8000F.56/CMDONC1/02453730313046033536.E7010F.56/CMDOFFC1/02453830313046033537.E8010F.57/CMDONM0/02453730303030033346.E70000.3F/CMDOFFM0/02453830303030033430.E80000.40/CMDONM1/02453730313030033430.E70100.40/CMDOFFM1/02453830313030033431.E80100.41/CMDONS0/02453730303134033434.E70014.44/CMDOFFS0/02453830303134033435.E80014.45/CMDONS1/02453730313134033435.E70114.45/CMDOFFS1/02453830313134033436.E80114.46/CMDWRITED015AB16Bit/024531303430303030324142313503.E10400002AB15.4238B8/CMDWRITED115AB15AB32Bit/024531303430303230344142313541.E10400204AB15A423135034135B15.A5/CMDWRITET015AB16Bit/024531303130303030324142313503.E10100002AB15.4235B5/CMDWRITET115AB15AB32Bit/024531303130303230344142313541.E10100204AB15A423135034132B15.A2/CMDWRITEC015AB16Bit/024531303041303030324142313503.E100A0002AB15.4335C5/CMDWRITEC115AB15AB32Bit/024531303041303230344142313541.E100A0204AB15A423135034232B15.B2不同的地方在发送的命令多了个EHex代码是45CMDfx-0Nfx-1NREADCMD0CMDE0WRITECMD1CMD