台達PLC的通讯协议是公开的，只要对该协议有清楚理解，所有台达产品的通讯问题迎刃而解，下面是协议全文：1. Communication Interface: RS-232C2. Communication Protocol ASCII mode, 9600（Baud rate）, EVEN（Parity）, 1（Start bit）,1（Stop bit）3. Communication Data FrameSTX Start character ‘:’（3AH）ADR 1 Communication address:ADR 0 8-bit address consists of 2 ASCII codesCMD 1 Command code:CMD 0 8-bit command consists of 2 ASCII codesDATA（0） Contents of data:DATA（1） n´8-bit data consist of 2n ASCII codes. ………. n£37, maximum of 74 ASCII codesDATA（n-1） LRC CHK 1 LRC check sum:LRC CHK 0 8-bit check sum consists of 2 ASCII codesEND 1 End character:END 0 END 1 = CR（0DH），END 0 = LF（0AH）n ADR（Communication Address）Valid communication addresses are in the range of 0…31. Communication address equals to 0 means broadcast to all PLC, the PLC will reply normal message to the master device. ----------------------------------------------------- For example, communication to PLC with address 16 decimal:(ADR 1, ADR 0)=’1’,’0’ð’1’=31H, ‘0’ = 30Hn CMD (Command code) and DATA (data characters)The format of data characters depends on the command code. For example, reading continuous 8 words form starting device address 0614H of PLC with address 01H.Field Name Example (Hex)Heading 3ASlave Address 01Command code 03Starting Address Hi 06Starting Address Lo 14Number of Points Hi 00Number of Points Lo 08Error Check ( LRC ) DANumber of Points(max) = 18（for 16 bit register）= 9（for 32 bit register）Example：Reading Coils T20~T27 from slave device 01PC→PLC“：01 03 06 1400 08 DA CR LF”PLC→PC“：01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 0700 08 B8 CR LF”Field Name Example (Hex)Slave Address 01Command code 03Bytes Count 10Data Hi（T20） 00Data Lo（T20） 01Data Hi（T21） 00Data Lo（T21） 02Data Hi（T22） 00Data Lo（T22） 03Data Hi（T23） 00Data Lo（T23） 04Data Hi（T24） 00Data Lo（T24） 05Data Hi（T25） 00Data Lo（T25） 06Data Hi（T26） 00Data Lo（T26） 07Data Hi（T27） 00Data Lo（T27） 08Error Check（LRC） C8n LRC CHK（check sum）LRC (Longitudinal Redundancy Check) is calculated by summing up, module 256, the values of the bytes from ADR1 to last data character then calculating the hexadecimal representation of the 2’s-complement negation of the sum. For example, reading 1 word form address 0401H of the PLC with address 01HSTX ‘：’ADR 1 ‘0’ADR 0 ‘1’CMD 1 ‘0’CMD 0 ‘3’Starting data address ‘0’‘4’‘0’‘1’Number of data ‘0’‘0’‘0’‘1’LRC CHK 1 ‘F’LRC CHK 0 ‘6’END 1 CREND 0 LF01H+03H+04H+01H+00+01H = 0AHthe 2’s-complement negation of 0AH is F6HException response:The PLC is been expected to return a normal response after receiving command messages from the master device. The following depicts the conditions that no normal response is replied to the master device.The PLC does not receive the messages due to a communication error; thus the PLC has no response. The master device will eventually process a timeout condition.The PLC receives the messages without a communication error, but cannot handle it, an exception response will return to the master device. In the exception response, the most significant bit of the original command code is set to 1, and an exception code explains the condition that caused the exception is returned.An example of exception response of command code 01H and exception 02H:Command message:Field Name Example (Hex)Heading 3ASlave Address 01Function 01Starting Address Hi 04Starting Address Lo 00Number of Points Hi 00Number of Points Lo 10Error Check ( LRC ) EAResponse message:Field Name Example (Hex)Heading 3ASlave Address 01Function 81Exception Code 02Error Check ( LRC ) 7CException code: Meaning:01 Illegal command code:The command code received in the command message is not available for the PLC.02 Illegal device address:The device address received in the command message is not available for the PLC.03 Illegal device value:The device value received in the command message is not available for the PLC.07 Check Sum ErrorCheck if the check Sum is correctIllegal command messagesThe command message is too short.Command message length is out of range.u The format of data characters depends on the command. The available command codes are described as followed, Code Name Description01 Read Coil Status S, Y, M, T, C02 Read Input Status S, X, Y, M,T, C03 Read Holding Registers T, C, D05 Force Single Coil S, Y, M, T, C06 Preset Single Register T, C, D15 Force Multiple Coils S, Y, M, T, C16 Preset Multiple Register T, C, D17 Report Slave ID NoneDELTA DVP-ES Series PLC DEVICE ADDRESSDevice Range Effective Range AddressS 000~255 000~127 0000~00FFS 246~511 0100~01FFS 512~767 0200~02FFS 768~1023 0300~03FFX 000~377 (Octal) 000~177 (Octal) 0400~04FFY 000~377 (Octal) 000~177 (Octal) 0500~05FFT 000~255 000~127 0600~06FFM 000~255 0000~1279 0800~08FFM 256~511 0900~09FFM 512~767 0A00~0AFFM 768~1023 0B00~0BFFM 1024~1279 0C00~0CFFC 000~255 000~127232~255 0E00~0EFFD 000~255 000~5991000~1143 1000~10FFD 256~511 1100~11FFD 512~767 1200~12FFD 768~1023 1300~13FFD 1024~1279 1400~14FFCommand Code：01, Read Coil StatusField Name Example (Hex)Heading 3ASlave Address 01Command code 01Starting Address Hi 06Starting Address Lo 14Number of Points Hi 00Number of Points Lo 25Error Check ( LRC ) BFNumber of Points(max) = 255 = 0x00FFExample：Reading Coils T20~T56 from slave device 01PC→PLC “：01 01 06 14 00 25 BF CR LF”PLC→PC “：01 01 05 CD 6B B2 0E 1B D6 CR LF”Field Name Example (Hex)Slave Address 01Command code 01Bytes Count 05Data（Coils T27…T20） CDData（Coils T35…T38） 6BData（Coils T43…T36） B2Data（Coils T51…T44） 0EData（Coils T56…T52） 1BError Check（LRC） E6n Command Code：02, Read Input StatusField Name Example (Hex)Heading 3ASlave Address 01Command code 02Starting Address Hi 05Starting Address Lo 14Number of Points Hi 00Number of Points Lo 25Error Check ( LRC ) BFExample：Reading Contact Y024~Y070 from slave device 01PC→PLC “：01 02 05 14 00 25 BF CR LF”PLC→PC “：01 02 05 CD 6B B2 0E 1B E5 CR LF”Field Name Example (Hex)Slave Address 01Command code 02Bytes Count 05Data（Coils Y033…Y024） CDData（Coils Y043…Y034） 6BData（Coils Y053…Y044） B2Data（Coils Y063…Y054） 0EData（Coils Y070…Y064） 1BError Check（LRC） E5n Command Code：03, Read Holding RegisterHolding Register：T, C, DField Name Example (Hex)Heading 3ASlave Address 01Command code 03Starting Address Hi 06Starting Address Lo 14Number of Points Hi 00Number of Points Lo 08Error Check ( LRC ) DANumber of Points(max) = 18（for 16 bit register）= 9（for 32 bit register）Example：Reading Coils T20~T27 from slave device 01PC→PLC“：01 03 06 14 00 08 DA CR LF”PLC→PC“：01 03 10 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 B8 CR LF”Field Name Example (Hex)Slave Address 01Command code 03Bytes Count 10Data Hi（T20） 00Data Lo（T20） 01Data Hi（T21） 00Data Lo（T21） 02Data Hi（T22） 00Data Lo（T22） 03Data Hi（T23） 00Data Lo（T23） 04Data Hi（T24） 00Data Lo（T24） 05Data Hi（T25） 00Data Lo（T25） 06Data Hi（T26） 00Data Lo（T26） 07Data Hi（T27） 00Data Lo（T27） 08Error Check（LRC） C8n Command Code：05, Force Single CoilField Name Example (Hex)Heading 3ASlave Address 01Command code 05Coil Address Hi 05Coil Address Lo 00Force Data Hi FFForce Data Lo 00Error Check ( LRC ) F6MMNN = 0xFF00….Coil ONMMNN = 0x0000….Coil OFF Example：Forcing Coil Y000 ONPC→PLC “：01 05 05 00 FF 00 F6 CR LF”PLC→PC “：01 05 05 00 FF 00 F6 CR LF”Field Name Example (Hex)Heading 3ASlave Address 01Command code 05Coil Address Hi 05Coil Address Lo 00Force Data Hi FFForce Data Lo 00Error Check ( LRC ) F6n Command Code：06, Preset Single RegisterField Name Example (Hex)Heading 3ASlave Address 01Command code 06Register Address Hi 06Register Address Lo 00Preset Data Hi 12Preset Data Lo 34Error Check ( LRC ) ADExample：Setting Register T0 to 00 03PC→PLC “：01 06 06 00 12 34 AD CR LF”PLC→PC “：01 06 06 00 12 34 AD CR LF”Field Name Example (Hex)Heading 3ASlave Address 01Command code 06Register T0 Address Hi 06Register T0 Address Lo 00Preset Data Hi 12Preset Data Lo 34Error Check ( LRC ) ADSwitch ( c )Case 0：T0Q →：01 06 06 00 12 34 AD CR LFCase 1：C0Q →：01 06 0E 00 12 34 AF CR LFCase 2：C232Q →：01 06 0E E8 12 34 56 78 EF CR LFCase 3：D10Q →：01 06 10 0A 12 34 99 CR LFCase 4：D1000Q →：01 06 13 E8 12 34 BA CR LFn Command Code：15, Force Multiple CoilsField Name Example (Hex)Heading 3ASlave Address 01Command code 0FCoil Address Hi 05Coil Address Lo 00Quantity of Coils Hi 00Quantity of Coils Lo 0AByte Count 02Force Data Hi CDForce Data Lo 01Error Check (LRC) 11Quantity of Coils (max) = 255Example：Setting Coil Y007…Y000 = 1100 1101, Y011…Y010 = 01.PC→PLC “：01 0F 05 00 00 0A 02 CD 01 11 CR LF”PLC→PC “：01 0F 05 00 00 0A E1 CR LF”Field Name Example (Hex)Heading 3ASlave Address 01Command code 0FRegister T0 Address Hi 05Register T0 Address Lo 00Preset Data Hi 00Preset Data Lo 0AError Check ( LRC ) E1n Command Code：16, Preset Multiple RegisterField Name Example (Hex)Heading 3ASlave Address 01Command code 10Starting Address Hi 06Starting Address Lo 00Number of Register Hi 00Number of Register Lo 02Byte Count 04Data Hi 00Data Lo 0AData Hi 01Data Lo 02Error Check (LRC) C6Number of Register(max) = 16（for 16 bit register）= 8（for 8 bit register）Example：Setting Register T0 to 00 0A, T1 to 01 02.PC→PLC “：01 10 06 00 02 00 04 00 0A 01 02 D6 CR LF”PLC→PC “：01 10 06 00 00 02 E7 CR LF”Field Name Example (Hex)Heading 3ASlave Address 01Command code 10Starting Address Hi 06Starting Address Lo 00Number of Registers Hi 00Number of Registers Lo 02Error Check ( LRC ) E7n Command Code：17, Report Slave IDReturns a description of controller present at the slave address, the current status of the slave Run indicator, and other information specific to the slave device.Command message:Field Name Example (Hex)Heading 3ASlave Address 01Command code 11Error Check (LRC) EEResponse message:Field Name Example (Hex)Heading 3ASlave Address 01Command code 11Byte Count 04Slave ID 01Run Indicator Status00 = OFFFF = ON FFData 0（D1001 HI） 40Data 1（D1001 LOW） 10Error Check (LRC) 9An DVP Series PLC Internal Device Communication AddressDevice Range Type Address Effective rangeES/EX/SS SA/SX/SH EHS 000~255 bit 0000~00FF 0~127 0~1024 0~1024S 246~511 bit 0100~01FF S 512~767 bit 0200~02FF S 768~1023 bit 0300~03FF X 000~377 (Octal) bit 0400~04FF 0~177 0~177 000~377Y 000~377 (Octal) bit 0500~05FF T 000~255 bit/word 0600~06FF 0~127 000~255 000~255M 000~255 bit 0800~08FF 0~1279 0~4095 0000~4095M 256~511 bit 0900~09FF M 512~767 bit 0A00~0AFF M 768~1023 bit 0B00~0BFF M 1024~1279 bit 0C00~0CFF M 1280~1535 bit 0D00~0DFF M 1536~1791 bit B000~B0FF M 1792~2047 bit B100~B1FF M 2048~2303 bit B200~B2FF M 2304~2559 bit B300~B3FF M 2560~2815 bit B400~B4FF M 2816~3071 bit B500~B5FF M 3072~3327 bit B600~B6FF M 3328~3583 bit B700~B7FF M 3584~3839 bit B800~B8FF M 3840~4095 bit B900~B9FF C 0~199 16-bit bit/word 0E00~0EC7 0~127 0~199 0~199200~255 32-bit bit/Dword 0EC8~0EFF 232~255 200~255 200~255Device Range Type Address EffectiveES/EX/SS SA/SX/SH EHD 000~256 word 1000~10FF 0~1311 0~4999 0000~9999D 256~511 word 1100~11FF D 512~767 word 1200~12FF D 768~1023 word 1300~13FF D 1024~1279 word 1400~14FF D 1280~1535 word 1500~15FF D 1536~1791 word 1600~16FF D 1792~2047 word 1700~17FF D 2048~2303 word 1800~18FF D 2304~2559 word 1900~19FF D 2560~2815 word 1A00~1AFF D 2816~3071 word 1B00~1BFF D 3072~3327 word 1C00~1CFF D 3328~3583 word 1D00~1DFF D 3584~3839 word 1E00~1EFF D 3840~4095 word 1F00~1FFF D 4096~4351 word 9000~90FF D 4352~4607 word 9100~91FF D 4608~4863 word 9200~92FF D 4864~5119 word 9300~93FF D 5120~5375 word 9400~94FF D 5376~5631 word 9500~95FF D 5632~5887 word 9600~96FF D 5888~6143 word 9700~97FF D 6144~6399 word 9800~98FF D 6400~6655 word 9900~99FF D 6656~6911 word 9A00~9AFF D 6912~7167 word 9B00~9BFF D 7168~7423 word 9C00~9CFF D 7424~7679 word 9D00~9DFF D 7680~7935 word 9E00~9EFF D 7936~8191 word 9F00~9FFF D 8192~8447 word A000~A0FF D 8448~8703 word A100~A1FF D 8704~8959 word A200~A2FF D 8960~9215 word A300~A3FF D 9216~9471 word A400~A4FF D 9472~9727 word A500~A5FF D 9728~9983 word A600~A6FF D 9984~9999 word A700~A70F
