台达PLC通讯协议V1.12通讯接口RS-232C RS-4852. 通讯协议ASCII模式,9600 （传输速率），偶同位，1个起始位，1个停止位9600,7,e,13. 通讯资料格式STX起始字符’：’（3AH）ADR 1通讯地址：ADR 0 8-bit地址包含了2个ASCII码CMD 1命令码：CMD 0 8-bit命令包含了2个ASCII码DATA（ 0）资料内容：DATA（1）n个8-bit资料包含了2n个ASCII码......... ... n <=74 个ASCII 码DATA （n-1）LRC CHK 1侦误值：LRC CHK 0 8-bit侦误值包含了2个ASCII码END 1结束字符：END 0 END 1 = CR（ 0DH）, END 0 = LF（ 0AH）ADR （通讯地址）PLC 通讯地址出厂设定值为0x01，因此（ADR 1, ADR 0 =' 0 ' ,' 1' ' 0' =30H, '1'= 31HLRC CHK（侦误值）CMD （命令指令）及DATA （数据字符）LRC CHK（侦误值）侦错方式采用LRC （Longitudinal Redundancy Check ）侦误值。

LRC侦误值乃是将ADR1至最后一个资料内容加总，将该值取2补码（2' s Complement ）得到之结果即为LRC侦误值。

附录-3例：STX '：'ADR 1 ' 0'ADR 0 ' 1'CMD 1 ' 0'CMD 0 ' 3'起始资料地址’0''4''0''1'资料数’0''0''0''1'LRC CHK 1 ' F'LRC CHK 0 ' 6'END 1 CREND 0 LF01H+03H+04H+01H+00+01H = OAHOAH的2补码为F6H注12补码的求法：(1补码再加1)0A ( H) = 0000 1010 ( B)先取1 补码(将b0~b7 反相)得1111 0101 (B),再加1 为1111 0110 (B) = F6 (H)即为0A (H)的 2 补码。

注2因此在收到一串完整的通讯命令，要检查这串通讯命令是否有误，只要将( ADR1,0)至(LRC1,0)加总等于0,则通讯无误，否则表示命令中资料有些是错误的。

通讯异常PLC的响应：附录-4PLC收到完整的通讯命令时，会判断命令是否有效，造成无效的原因有：原因EXCEPTION CODELRC CHK ERROR 07DEIVCE ADDRESS INVALID 02要求的资料超过范围03COMMAND CODE INVALID 01通讯命令格式INVALID 07例：使用命令码01读取X000~X017的状态Field Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 01Starti ng Address Hi 04Starti ng Address Lo 00Number of Points Hi 00Number of Poi nts Lo 10Error Check ( LRC ) EA附录-5PLC响应：Field Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 81Excepti on Code 02Error Check ( LRC ) 7C因为Address 0400 对Function 01 是不合法的，所以响应Exception code = 0x02，且Function 01 被设为81 (b7被设为1 )，亦即由响应的Function code的MSB被设为1表示PLC响应ERROR MESSAGE并且由Exception code可得知是何种错误。

可用之命令码叙述如下：(每个device的address，请参考最后一页) Code Name Descripti on01 Read Coil Status S, YM, T, C02 Read In put Status S, X, Y M,T, C03 Read Holding Registers T, C, D05 Force Si ngle Coil S, YM, T, C06 Preset Sin gle Register T, C, D15 Force Multiple Coils S, Y, M, T, C16 Preset Multiple Register T, C, D17 Report Slave ID None附录-6资料字符之格式依命令码而定，依可用之命令码的资料内容分别叙述如下: Function Code: 01, Read Coil StatusField Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 01Starti ng Address Hi 06Starti ng Address Lo 14Number of Points Hi 00Number of Poi nts Lo 25Error Check ( LRC ) BFNumber of Poi nts(max) = 255 = 0x00FF例：由从动装置(slave device)01读取线圈T20~T56PS PLC “：01 01 06 14 00 25 BF CR LFPLS PC “：01 01 05 CD 6B B2 0E 1B D6 CR LFField Name Con te ntsSlave Address 01Fu nction 01Bytes Cou nt 05Data ( Coils T27…T20) CDData ( Coils T35…T38) 6BData ( Coils T43…T36) B2Data ( Coils T51 …T44) 0EData ( Coils T56…T52) 1BError Check ( LRC) E6Function Code：02, Read In put Status附录-7Field Name Example (Hex)Headi ng 3ASlave Address 01Fun ction 02Starti ng Address Hi 05Starti ng Address Lo 14Number of Points Hi 00Number of Poi nts Lo 25Error Check ( LRC ) BF例：由从动装置01读取接点Y024~Y070PS PLC “：01 02 05 14 00 25 BF CR LFPLS PC “：01 01 05 CD 6B B2 0E 1B E5 CR LFField Name Con te ntsSlave Address 01Fun ction 02Bytes Cou nt 05Data ( Coils Y033…Y024) CDData ( Coils Y043…Y034) 6BData ( Coils Y053 …Y044) B2Data ( Coils Y063…Y054) 0EData ( Coils Y07O …Y064) 1BError Check ( LRC) E5附录-8Function Code：03, Read Holding RegisterHolding Register: T, C, DField Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 03Starti ng Address Hi 06Starti ng Address Lo 14Number of Points Hi 00Number of Poi nts Lo 08Error Check ( LRC ) DANumber of Poi nts(max)=18 (for 16 bit register)=9 (for 32 bit register )例：由从动装置01读取线圈T20~T27PS PLC “：01 03 06 14 00 08 DA CR LFPLS PC “：01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 B8 CR LF3A 30 31 30 33 31 30 30 30 30 30 30 30 30 30 30 30 30 3030 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 43 0D 0A3A 30 B1 30 33 B1 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 C5 C3 8D 0A3A 8A 30 A6 83 30 82 30 82 30 82 30 82 30 82 30 82 30 82 30 82 30 82 30 82 30 2A C3 63 E1 Field Name Con te ntsSlave Address 01Fu nction 03Bytes Cou nt 10Data Hi (T20) 00Data Lo (T20)01Data Hi (T21)00Data Lo (T21)02Data Hi (T22)00附录-9Data Lo (T22)03Data Hi (T23)00Data Lo (T23)04Data Hi (T24)00Data Lo (T24)05Data Hi (T25)00Data Lo (T25)06Data Hi (T26)00Data Lo (T26)07Data Hi (T27)00Data Lo (T27)08Error Check ( LRC B8Function Code：05, Force Single CoilField Name Example (Hex)Headi ng 3ASlave Address 01Function 05Coil Address Hi 05Coil Address Lo 00Force Data Hi FFForce Data Lo 00Error Check ( LRC ) F6MMNN = 0xFF00 ….CoiONMMNN = 0x0000 ….Coil OFF例：强制设定线圈Y000 ONPS PLC “：01 05 05 00 FF 00 F6 CR L”PLS PC “：01 05 05 00 FF 00 F6 CR L” 附录-10 Field Name Example (Hex)Headi ng 3ASlave Address 01Function 05Coil Address Hi 05Coil Address Lo 00Force Data Hi FFForce Data Lo 00Error Check ( LRC ) F6Function Code：06, Preset Single Register Field Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 06Register Address Hi 06Register Address Lo 00Preset Data Hi 12Preset Data Lo 34Error Check ( LRC ) AD例：设定缓存器TO to 00 03PS PLC “：01 06 06 00 12 34 AD CR LF PLS PC “：01 06 06 00 12 34 AD CR LF Field Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 06附录-11Register T0 Address Hi 06Register T0 Address Lo 00Preset Data Hi 12Preset Data Lo 34Error Check ( LRC ) ADSwitch ( c )Case 0 T0Q T： 01 06 06 00 12 34 AD CR LFCase 1: C0Q T： 01 06 0E 00 12 34 AF CR LFCase 2 C232Q T： 01 06 0E E8 12 34 56 78 EF CR LF Case 3: D10Q T： 01 06 10 0A 12 34 99 CR LFCase 4： D1000Q T： 01 06 13 E8 12 34 BA CR LF附录-12Fun ction Code：15, Force Multiple Coils Field Name Example (Hex)Headi ng 3ASlave Address 01Function 0FCoil Address Hi 05Coil Address Lo 00Quantity of Coils Hi 00Qua ntity of Coils Lo 0AByte Cou nt 02Force Data Hi CDForce Data Lo 01Error Check (LRC) 11Qua ntity of Coils (max) = 255例：设定线圈Y007…Y000 = 1100 1101, Y011 …Y010 = 01. PS PLC “：01 OF 05 00 00 0A 02 CD 01 11 CR LFPLS PC “：01 0F 05 00 00 0A E1 CR LF附录-13Field Name Example (Hex)Headi ng 3ASlave Address 01Function 0FRegister T0 Address Hi 05Register T0 Address Lo 00Preset Data Hi 00Preset Data Lo 0AError Check ( LRC ) E1Fu nction Code：16, Preset Multiple RegisterField Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 10Starti ng Address Hi 06Starti ng Address Lo 00Number of Register Hi 00Number of Register Lo 02Byte Cou nt 04Data Hi 00Data Lo 0AData Hi 01Data Lo 02Error Check (LRC) C6附录-14Number of Register(max)=16 (for 16 bit register)=8 (for 8 bit register)例：设定缓存器T0为00 0A, T1为01 02.PS PLC “：01 10 06 00 02 00 04 00 0A 01 02 D6 CR LF PLS PC “：01 10 06 00 00 02 E7 CR LFField Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 10Starti ng Address Hi 06Starti ng Address Lo 00Number of Registers Hi 00Number of Registers Lo 02Error Check ( LRC ) E7Fu nction Code：17, Report Slave IDReturns a description of controller present at the slave address, the current status of the slave Runindicator, and other information specific to the slave device.Field Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 11Error Check (LRC) EE附录-15Field Name Example (Hex)Headi ng 3ASlave Address 01Fu nction 11Byte Cou nt 04Slave ID 01Run In dicator Status00 = OFFFF = ONFFData 0 ( D1001 HI) 40Data 1 ( D1001 LOW) 10Error Check (LRC) 9A附录-16台达DVP系列PLC装置地址(DEVICE ADDRESSDevice Range Effective Range AddressS 000~255 000~127 0000~00FFS 246~511 0100~01FFS 512~767 0200~02FFS 768~1023 0300~03FFX 000~377 ( 8 进制) 000~177 ( 8 进制) 0400~04FFY 000~377 ( 8 进制) 000~177 ( 8 进制) 0500~05FFT 000~255 000~127 0600~06FFM 000~255 0000~1279 0800~08FFM 256~511 0900~09FFM 512~767 0A00~0AFFM 768~1023 0B00~0BFFM 1024~1279 0C00~0CFFC 000~255 000~127232~2550E00~0EFFD 000~255 000~599 1000~10FFD 256~511 1000~1143 1100~11FFD 512~767 1200~12FFD 768~1023 1300~13FFD 1024~1279 1400~14FF。