Through the hardware and software listening methods, the PPI communication protocol inherent in plc is analyzed, and then the upper computer adopts VB programming, follows the PPI communication protocol, reads and writes PLC data, and realizes man-machine operation tasks. Compared with the general free communication protocol, this communication method omits the programming of the PLC communication program, and only needs to write the communication program resources of the upper computer.
The physical layer of the programming port of S7-226 is RS-485 structure. SIEMENS provides MicroWin software, which uses PPI (Point to Point) protocol, which can be used to transmit and debug PLC programs. In the field application, when the PLC and the host computer are required to communicate, more and more custom protocols are used to communicate with the host computer. In this communication mode, the programmer needs to first define his own free communication format, write code in the PLC, and use the interrupt mode to control the data transmission and reception of the communication port. In this way, plc programming and debugging is more cumbersome, consuming PLC software interrupts and code resources, and when the PLC communication port is defined as a free communication port, the PLC programming software cannot monitor the PLC, which brings inconvenience to the PLC program debugging. .
The programming communication interface of SIEMENS S7-200PLC, the internal curing communication protocol is PPI protocol. If the upper computer follows the PPI protocol to read and write the PLC, the communication code of the PLC can be omitted. How to get the PPI agreement? When the PLC programming software reads and writes the PLC data, the third serial port can be used to listen to the PLC communication data, or the software method can be used to intercept the data of the port that has been opened and is communicating, and then summarize and parse the data of the PPI protocol. Read and write messages. In this way, the host computer follows the PPI protocol, and can conveniently read and write the data inside the PLC to realize the man-machine operation function of the upper computer.
software design
The measurement and control tasks in the system are completed by SIEMENS S7-226PLC. The PLC works in cyclic scan mode. When the timing time is up, the data acquisition or PID control task is executed to complete the signal control on site. The monitoring software of the computer is compiled by VB, and the serial communication is completed by the MSComm control. The protocol followed by the communication is the PPI protocol.
PPI agreement
Siemens' PPI (Point to Point) communication protocol adopts master-slave communication mode. The steps of one read and write operation include: first, the upper computer issues a read/write command, and the PLC makes a correct response, and the upper computer receives the response and sends a confirmation. When applying for the order, the PLC completes the correct read and write response and responds to the host computer data. In this way, the data is sent and received twice, and the reading and writing of the data is completed [5].
The format of its communication data message is roughly as follows:
1. The data format of the read and write application is as follows:
SD LE LER SD DA SA FC DASP SSAP DU FCS ED
SD: (Start Delimiter) start delimiter (68H)
LE: (Length) message data length
LER: (Repeated Length) repeat data length
SD: (Start Delimiter) start delimiter (68H)
SA: (Source Address) The source address, which is a pointer to the address, multiplied by 8 for the address value.
DA: (Destination Address), which is a pointer to the address, multiplied by 8 for the address value.
FC: (Function Code) function code
DSAP: (Destination Service Access Point) destination service access point
SSAP: (Source Service Access Point) source service access point
DU: (Data Unit) data unit
FCS: (Frame Check Sequence) check code
ED: (End Delimiter) end delimiter (16H)
The message data length and the repeat data length are the data lengths from DA to DU, and the check code is the sum check of the DA to DU data, and only the last byte value is taken.
In the variable data of the read/write PLC, the function code of the read data is 6CH, and the function code of the write data is 7CH.
2. The PLC receives the read/write command and is correct after verification. The returned data format is E5H.
3. Confirm the data format of the read and write commands as:
SD SA DA FC FCS ED
Where SD is the start character and is 10H
SA is the data source address
DA is the destination address
FC is the function code, take 5CH
FCS is the last byte of the sum of SA+DA+FC
ED is the end character, take 16H
Software development of PPI protocol
When using the host computer to communicate with the PLC, the host computer adopts VB programming. The computer uses PPI cable or ordinary 485 serial port card to connect with the PLC programming port. The communication system adopts the master-slave structure, and the upper computer follows the PPI protocol format to issue read and write applications. , PLC returns the corresponding data. The program is implemented as follows:
1, the serial port initialization program:
MSComm1.CommPort = 1
MSComm1.Settings = "9600,e,8,1"
MSComm1.InputLen = 0
MSComm1.RThreshold = 1
MSComm1.InputMode = comInputModeBinary
The PPI protocol defines that the serial port transmits and receives data in binary form, so that the communication efficiency of the message is higher than that of the ASCII code.
2. The serial port reads the data program to read the VB100 data unit as an example:
Dim Str_Read(0 To 32) 'Defines the data sent as an array of bytes.
Str_ Read (32) = &H16 'The corresponding array element is assigned, in the following format:
Str_ Read (29) = (100*8) \ 256 'The address is the pointer value, first take the high address pointer
Str_ Read (30) = (100*8) Mod 256 'take low address pointer
Str_ Read (24) = 1 'The length of the read data (the number of Bytes)
For I=4 to 30
Temp_FCS = Temp_FCS + Str_Read(i)
Next I
Str_Read(31)= Temp_FCS Mod 256 'Calculate the FCS checksum. The assignment of other array elements is omitted.
68 1B 1B 68 2 0 6C 32 1 0 0 0 0 0 E 0 0 4 1 12 A 10 2 0 1 0 1 84 0 3 20 8B 16
After the PLC returns the data E5, confirm the read command and send the following data:
10 2 0 5C 5E 16
Then the host computer VB program receives the following data:
68 16 16 68 0 2 8 32 3 0 0 0 0 0 2 0 5 0 0 4 1 FF 4 0 8 22 78 16
First, the target address and the source address are identified, and the return data of this application is confirmed, and then the check check is performed. After the correct analysis, the 26th data (&H22) is the data of VB 100 bytes.
3, the serial port write data program, to write VB100 data unit as an example:
Dim Str_Write(0 To 37) 'Defines the data being sent as an array of bytes as elements.
Str_Write (37) = &H16 'The corresponding array element is assigned, according to the following format
Str_Write (35) = &H10 'Data value to be written
68 20 20 68 2 0 7C 32 1 0 0 0 0 0 E 0 5 5 1 12 A 10 2 0 1 0 1 84 0 3 20 0 4 0 8 C B9 16
After the PLC returns the data E5, confirm the write command and send the following data:
10 2 0 5C 5E 16
Then the host computer VB program receives the following data:
68 12 12 68 0 2 8 32 3 0 0 0 0 0 2 0 1 0 0 5 1 FF 47 16
This is the return data that the PLC correctly receives and writes information.
4, serial port receiving program:
In the data receiving program, the MSComm control in VB is used to receive all the data in the buffer at one time, store it in the temporary storage unit in the form of an array, and then analyze the value of each element to obtain the read and write data.
Dim RCV_Array() As Byte
Dim Dis_Array As String
Dim RCV_Len As Long
RCV_Array = MSComm1.Input 'Remove the data from the serial receive buffer.
RCV_Len = UBound(RCV_Array)
ReDim Temp(0 To UBound(RCV_Array))
For i = 0 To RCV_Len
Dis_Array = Dis_Array & Hex(RCV_Array (i)) & " "
Next i
Text1.Text = Dis_Array 'The received data is sent to the display.
In the process of reading and writing of the program, a maximum of 222 bytes can be read and written at a time, and the currently given data is read and written in an integer format.
Data type Str_ Read(27)
S 04H
SM 05H
I 81H
Q 82H
M 83H
V 84H
The above procedure is based on the V variable area of ​​the read and write PLC. The PPI protocol can also read and write various types of data in the S7-200PLC, including I, Q, SM, M, V, T, C, S and other data. Type, can directly read the bits, bytes, words, double words, etc. in the above variables, when reading the bit variable, it is to read the byte value of the bit, and then the host computer automatically recognizes the value of the bit. According to the data type of reading and writing, the values ​​of Str_Read(27) are different:
In the control system, the communication between the PLC and the host computer uses the PPI communication protocol, and the host computer cyclically reads and writes the PLC every 0.5 seconds. When the PLC is programmed, the detected value and output value to be read are stored in a continuous variable area of ​​the PLC. When the host computer reads the data of the PLC, the set of consecutive data can be read out at one time, and the data is reduced. The frequency is frequently read in fractions. When the data such as the set value is modified, the communication operation of writing the data is performed.
Ac Cross-Flow Fan,Ac Cross Blower Fan,Ac Cross Flow Cooling Fan,Ac Cross-Flow Fan For Sale
Original Electronics Technology (Suzhou) Co., Ltd. , https://www.original-te.com