DF1协议常用命令

PCCC：Programmable Controller Communication Commands.

AB PLC常用指令

根据http://www.iatips.com/pccc_tips.html，SLC5/MicroLogix常用指令如下：

The best commands for SLC5/MicroLogix controllers are:

Protected Typed Logical Read with 3-Address Fields (Cmd=0x0F, SubFnc=0xA2)
Protected Typed Logical Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAA)
Protected Typed Logical Masked-Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAB)
Protected Typed Logical Read with 2-Address Fields (Cmd=0x0F, SubFnc=0xA1)
Protected Typed Logical Write with 2-Address Fields (Cmd=0x0F, SubFnc=0xA9)

Only the first two (0xA2/AA) are documented in the official DF1 protocol specification. The third (0xAB) is not documented but is commonly used by OPC servers; In fact a Rockwell engineer formally sent me details of it when I asked; it is not considered "secret".

The last two (0xA1/A9) are only of value if you're creating a slave driver since a few of Rockwell's software tools assume these are supported. While they are not documented in the DF1 specification, RSLogix5000 outlines support for them as part of its legacy support for PCCC messages. But there is no reason for an OPC server or master to use 0xA1/A9 since support by slaves is not universal. Using SubFnc 0xA1 instead of 0xA2 just drops one unrequired NULL byte from the command, so is of modest value. For example, to read N7:1 your Read command would include the 6 bytes "A2 02 07 89 01 00" for the 3-Address Fields form and only the 5 bytes "A1 02 07 89 01" for the 2-Address Fields form. Big deal, eh? Well, yes - a big deal if you try to use 0xA1 with a slave that doesn't understand 0xA1.

怎样单独写一位：

How do I write single bits on a SLC5/MicroLogix?

use the undocumented (but well supported) Cmd=0x0F SubFnc=0xAB Masked Write

The command looks much like the documented Protected Typed Logical Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAA) except you'll find an added 16-bit word of data. So here are examples of each:

0xAA 02 03 85 00 00 01 00

0xAB 02 03 85 00 00 01 00 01 00

0xAB 04 03 85 00 00 01 00 01 00 00 00

The first command (0xAA) in effect clears bits B3:0/1 to B3:0/15 and sets bit B3:0/0. So the entire first word of the B3 table is changed - often not the desired action. In contrast, the second command (0xAB) just sets B3:0/0 to 1 without affecting the other 15 bits of B3:0. Notice that the 16-bit "mask" is not included in the byte count of 2. The third command (0xAB) shows that more than one data word can be sent, but there is always just a single 16-bit mask. The third command would set B3:0/0 to "1" and clear B3:1/0 to "0". If you - for example - desire to set both bits B3:0/0 and B3:1/6 to "1", then you'd need to issue two separate commands since they don't share the same 16-bit mask.