PPI protocol of S7-200 PLC
Through hardware and software listening methods, the PPI communication protocol inherent in the PLC is analyzed, and then the upper computer adopts VB programming, follows the PPI communication protocol, reads and writes PLC data, and realizes man-machine operation tasks. Compared with the usual free communication protocol, this communication method omits the programming of the PLC communication program, and only needs to write the communication program resources of the upper computer.
S7-226’s programming port physical layer is RS-485 structure, SIEMENS provides MicroWin software, using PPI (Point to
Point) protocol, which can be utilized to transfer and debug PLC programs. In the field application, when the PLC is needed to communicate with the host computer, more custom protocols are used to communicate with the host computer. In this communication mode, the programmer needs to first define his own honest communication format, write code in the PLC, and use the interrupt mode to control the data transmission and reception of the communication port. In this way, PLC programming debugging is more cumbersome, consuming PLC software interrupts and code resources, and when the PLC communication port is defined as a free communication port, the PLC programming software cannot monitor the PLC, which brings inconvenience to the PLC program debugging. .
SIEMENS
The programming communication interface of S7-200PLC, the internal curing communication protocol is PPI protocol. If the upper computer follows the PPI protocol to read and write the PLC, the communication code of the PLC can be shown. How to get the PPI agreement? When the PLC programming software reads and writes PLC data, the third serial port can be used to listen to the PLC communication data, or the software method can be used to intercept the data of the port that has been opened and is communicating, and then summarize and parse the data of the PPI protocol. Read and write messages. In this way, the host computer follows the PPI protocol, and can conveniently read and write the data inside the PLC to realize the man-machine operation function of the host computer.
Software design
Measurement and control tasks in the system by SIEMENS
The S7-226PLC is completed, and the PLC works in a cyclic scan mode. When the timing time is up, the data acquisition or PID control task is executed to supplement the on-site signal control. The monitoring software of the computer is compiled by VB, and the serial communication is accomplished by the MSComm control. The protocol monitored by the communication is the PPI protocol.
PPI agreement
Siemens PPI (Point
To
Point) communication protocol adopts master-slave communication mode. The steps of one read/write operation include: first, the upper computer issues a read/write command, and the PLC makes a correct response. When the upper computer receives the response, it sends a confirmation application command, and the PLC completes. The correct reads and writes response, responds to the host computer data. In this approach, the data is sent and received twice, and the reading and writing of data is completed [5].
The format of its communication data message is roughly as follows:
1. The data format of the read and write application is as follows:
SD
LE LER SD DA SA FC DASP SSAP DU FCS ED
SD: (Start
Delimiter) Start delimiter (68H)
LE: (Length) message data length
LER: (Repeated Length) repeat data length
SD:
(Start Delimiter) Start Delimiter (68H)
SA: (Source
Address) The source address, which is a pointer to the address, multiplied by the address value by 8.
DA: (Destination
Address) The target address, which is a pointer to the address, multiplied by 8 for the address value.
FC: (Function Code) function code
DSAP: (Destination
Service Access Point) destination service access point
SSAP: (Source Service Access
Point) source service access point
DU: (Data Unit) data unit
FCS: (Frame Check Sequence) check code
ED: (End
Delimiter) end delimiter (16H)
The message data length and the repeat data length are the data lengths from DA to DU, and the check code is the sum check of the DA to DU data, and only the last byte value is taken.
In the variable data of reading and writing PLC, the function code of the read data is
6CH, the function code for writing data is 7CH.
2. The PLC receives the read/write command and is correct after verification. The returned data format is
E5H
3. Confirm the data format of the read and write commands as:
SD SA DA FC FCS ED
Where SD is the start character and is 10H
SA is the data source address
DA is the destination address
FC is the function code, take 5CH
FCS is the last byte of the sum of SA+DA+FC
ED is the end character, take 16H
Software compilation of PPI protocol
When using the host computer to communicate with the PLC, the host computer adopts VB programming. The computer uses PPI cable or ordinary 485 serial port card to connect with the PLC programming port. The communication system adopts the master-slave structure, and the upper computer follows the PPI protocol format to issue read and write applications. , PLC returns the corresponding data. The program is implemented as follows:
1, the serial port initialization program:
MSComm1.CommPort = 1
MSComm1.Settings = “9600,e,8,1″
MSComm1.InputLen = 0
MSComm1.RThreshold = 1
MSComm1.InputMode =
comInputModeBinary
The PPI protocol defines that the serial port transmits and receives data in binary form, so that the communication efficiency of the message is higher than that of the ASCII code.
2. The serial port reads the data program to read the VB100 data unit as an example:
Dim
Str_Read(0 To 32) ‘Defines the data being sent as an array of bytes as elements.
Str_ Read (32) = &H16
‘The corresponding array element is assigned, in the following format:
Str_ Read (29) = (100*8) \ 256 ‘Address is a pointer value, first take the high address pointer
Str_
Read (30) = (100*8) Mod 256 ‘take low address pointer
Str_ Read (24) = 1
‘Data length read (number of Bytes)
For I=4 to 30
Temp_FCS = Temp_FCS +
Str_Read(i)
Next I
Str_Read(31)= Temp_FCS Mod 256
‘Calculate FCS checksum, other array element assignments are omitted.
68 1B 1B 68 2 0 6C 32 1 0 0 0 0 0 E 0 0 4 1 12 A 10 2 0
1 0 1 84 0 3 20 8B 16
After the PLC returns the data E5, confirm the read command and send the following data:
10 2 0 5C 5E
16
Then the host computer VB program receives the following data:
68 16 16 68 0 2 8 32 3 0 0 0 0 0 2 0 5 0 0 4 1 FF 4 0
8 22 78
16
First, the target address and the source address are identified, and the return data of this application is confirmed, and then the check check is performed. After the correct analysis, the 26th data (&H22) is the data of VB 100 bytes.
3, the serial port write data program, to write VB100 data unit as an example:
Dim
Str_Write(0 To 37) ‘Defines the transmitted data as an array of bytes as elements.
Str_Write (37) = &H16
‘The corresponding array element assignment, according to the following format
Str_Write (35) = &H10 ‘Data value to be written
68 20 20 68 2 0 7C
32 1 0 0 0 0 0 E 0 5 5 1 12 A 10 2 0 1 0 1 84 0 3 20 0 4 0 8 C B9 16
PLC returns data
After E5, confirm the write command and send the following data:
10 2 0 5C 5E 16
Then the host computer VB program receives the following data:
68 12 12 68 0 2 8
32 3 0 0 0 0 0 2 0 1 0 0 5 1 FF 47
16
This is the return data that the PLC correctly receives and writes information.
4, serial port receiving program:
In the data receiving program, the MSComm control in VB is used to receive all the data in the buffer at one time, store it in the temporary storage unit in the form of an array, and then analyze the value of each element to obtain the read and write data.
Dim
RCV_Array() As Byte
Dim Dis_Array As String
Dim RCV_Len As
Long
RCV_Array = MSComm1.Input ‘Remove the data from the serial receive buffer.
RCV_Len =
UBound(RCV_Array)
ReDim Temp(0 To UBound(RCV_Array))
For i = 0 To
RCV_Len
Dis_Array = Dis_Array & Hex(RCV_Array (i)) & ” ”
Next
i
Text1.Text = Dis_Array
‘The received data is sent to the display.
In the program reading and writing process, a maximum of 222 bytes can be read and written at a time, and the currently given data is read and written in an integer format.
Data type Str_
Read(27)
S 04H
SM 05H
I 81H
Q 82H
M 83H
V 84H
The above procedure is based on the V variable area of ​​reading and writing PLC. The PPI protocol can also read and write various types of data in S7-200PLC, including I, Q, SM, M, V, T, C, S and other data. Type, can directly read the above variables in the bits, bytes, words, double words, etc., when reading the bit variable, is to read the byte value of the bit, and then the host computer automatically recognizes the value of the bit. According to the type of data read and written, where Str_
The value of Read(27) is different:
In the control system, the communication between the PLC and the host computer uses the PPI communication protocol, and the host computer cyclically reads and writes the PLC every 0.5 seconds. When the PLC is programmed, the data such as the detected value and output value to be read are stored in a continuous variable area of ​​the PLC. When the host computer reads the data of the PLC, the set of consecutive data can be read out at one time, and the data is reduced. The frequency is frequently read in fractions. When the data such as the set value is modified, the communication operation of writing the data is performed.

The NETR/NETW instruction can read and write the M and V variables of the partner (communication partner). Since the M area has limited space (maximum 32 bytes MB0 to 31), the V variable area (10240 bytes) is commonly used as the buffer for communication. Two buffers are identified in each PLC, one for reception and one for transmission.
Programming only needs to call the subroutine created by NETR/NETW in the master station. Then (the main and slave have to do) is to sort the I and AI input data into the send buffer in the v variable area, and then read the receive buffer. The data in the receive buffer of the partner are the same as the data in the send buffer here. Similarly, the data in the receive buffer can be interpreted by reading the data in the receive buffer.
Setting cpu224xp as a slave does not affect the touch screen plugged into PORT1. The two serial ports are separate from each other and can be used separately as master and slave respectively because they have different interrupt numbers. .