10 Communication Instruction

Version 1.1 by Wecon on 2025/09/03 21:03

Communication Port Protocol Setting


Communication port protocol setting


PROTOCOL(P)

Set (s) protocol for (n) communication port.

-[PROTOCOL  (s)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom variable type
(s)Protocol number to be set-Unsigned BIN16 bitsANY16INT
(n)Which communication port to be set, 0 means COM1, 1 means COM20, 1Unsigned BIN16 bitsANY16INT

Device used

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
PROTOCOLParameter 1              
Parameter 2              

Function

This command is mainly used to set the protocol during RUN, and can also be used in the first cycle of RUN.

The value of the protocol address (COM1 SD2542, COM2 SD2592) and the protocol modification sign (COM1 SD2543, COM2 SD2593) can be directly set according to the command parameters.

The specific calculation formula for setting the protocol modification sign (COM1 SD2543, COM2 SD2593) is: (parameter setting value + offset of the corresponding serial port's initial special device+ 10)*2

For example, setting the protocol to 2, i.e. (2 +2593-2590 +10)*2, which is (2+3+10) *2=30. At this time, SD2592 will be set to 1, and SD2593 will be set to 32.

✎Note: 

Whether the value is set by self-calculation and then modifying the identification (COM1 SD2543, COM2 SD2593) to the protocol, or by using this command, the protocol can be modified when the PLC is in the RUN state.

Protocol modification sign (COM1 SD2543 and COM2 SD2593): during the RUN process, when the protocol and modification sign are set correctly (the correctness will be judged at the End of the program), it will be deemed as the correct first cycle; then the protocol and modification sign (COM1 SD2543, COM2 SD2593) will be cleared upon completion of modification and the same value that is consequently set will not be processed. It mainly aims to avoid repeated settings for multiple times.

Protocol number

Protocol numberContent
0HWecon Modbus slave station
2HModbus RTU slave station
3HModbus ASCII slave station
10HUser-defined protocol
20HModbus RTU master
30HModbus ASCII master

Related devices 

DevicesContent
SD2542COM1 protocol settings
SD2543COM1 protocol modification sign
SD2592COM2 protocol settings
SD2593COM2 protocol modification sign

Precautions

The setting of communication parameters will affect the overall communication. The parameters in PLC are modified when there is no communication or after a round of communication is completed. Attention shall be paid to this point.

If the set protocol does not match the provided protocol number, the protocol modification flag (COM1 SD2543, COM2 SD2593) will not be cleared after setting. At this time, the protocol will not be set successfully, and it will run according to the original protocol.

Error code

Error codeContent
4085HThe read address (s) (n) exceeds the device range.
4084H(n) is not 1.

Example 

1709191890650-622.png

As shown in above example, M1 turns from OFF to ON during RUN process.

SD2594 will be set to 32 (20H), SD2595 will be set to 90 and then it will be cleared. At this time, it has been set successfully.

1709191945171-155.png

If M1 turns from OFF to ON again,

SD2592 will be set to 32 (20H), SD2595 will be set to 90, which will not be cleared.

1709191962952-895.png

Modbus Serial Port Parameter Setting


PORTPARA/Modbus serial port parameter setting


PORTPARA(P)

Set (s) serial port parameters for (n) communication port.

-[PORTPARA  (s)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom variable type
(s)Serial port parameters to be set-Unsigned BIN16 bitsANY16INT
(n)Which communication port to be set, 0 means COM1, 1 means COM20, 1Unsigned BIN16 bitsANY16INT

Device used 

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
PORTPARAParameter 1              
Parameter 2              

Function

This command is mainly used to set serial port parameters during RUN, and can also be used in the first cycle of RUN.

The value of serial port parameter address (COM1 SD2540, COM2 SD2590) and the serial parameter modification sign (COM1 SD2541, COM2 SD2591) can be set directly according to the command parameters.

The specific calculation formula for setting the serial port parameter modification sign (COM1 SD2541, COM2 SD2591) is: (parameter setting value + offset of the corresponding serial port's initial special device + 10)*2

For example, setting the COM1 serial port parameter to 193 (HC1), i.e. (193 +2541-2540 +10)*2 which is (193 +1+10) *2=408. At this time, SD2540 is set to be 193(HC1) and SD2541 is set to be 408.

Note:

Whether the value is set by self-calculation and then modifying the sign (COM1 SD2541, COM2 SD2591) to the serial port parameters, or by using this command, the serial port parameters can be modified when the PLC is in the RUN state.

Serial port parameter modification sign (COM1 SD2541 and COM2 SD2591): during the RUN process, when the serial port parameter and modification sign are set correctly (the correctness will be judged at the End of the program), it will be deemed as the correct first cycle; then the serial port parameter and modification sign (COM1 SD2541, COM2 SD2591) will be cleared upon completion of modification and the same value that is consequently set will not be processed. It mainly aims to avoid repeated settings for multiple times.

Serial port parameter setting table

Bit numberNameContent
  0 (bit OFF)1 (bit ON)
b0Data length7 digits8 digits

b1

b2

Parity check

b2, b1

(0, 0): None

(0,1): Odd parity (ODD)

(1,1): Even parity (EVEN)

b3Stop bit1 bit2 bit

b4

b5

b6

b7

b8

b9

Baud rate(bps)

.b9,b8,b7,b6,b5,b4

( 0, 0, 0, 1, 1, 1): 4800

( 0, 0, 1, 0, 0, 0): 9600

( 0, 0, 1, 0, 0, 1): 19200

( 0, 0, 1, 0, 1, 0): 38400

( 0, 0, 1, 0, 1, 1): 57600

.b9,b8,b7,b6,b5,b4

( 0, 0, 1, 1, 0, 0): 115200

( 0, 0, 1, 1, 0, 1): 187500

( 0, 0, 1, 1, 1, 0): 230400

( 0, 0, 1, 1, 1, 1): 460800

( 0, 1, 0, 0, 0, 0): 921600

b10STXDisable STX functionEnable STX function, the specific value is set by D8124
b11ETXDisable ETX functionEnable the ETX function, the specific value is set by D8125
b12------
b13------
b14------
b15------

Related devices

DevicesContent
SD2540COM1 serial port parameter setting
SD2541COM1 serial port parameter modification sign  
SD2590COM2 serial port parameter setting
SD2591COM2 serial port parameter modification sign

Precautions

The setting of communication parameters will affect the overall communication. The parameters in PLC are modified when there is no communication or after a round of communication is completed. Attention shall be paid to this point.

STX function and ETX function are only useful in the case of user-defined protocol.

If the set protocol does not match the provided protocol number, the serial port parameter modification sign (COM1 SD2541, COM2 SD2591) will not be cleared after setting. At this time, the protocol will not be set successfully, and it will run according to the original protocol.

Error code

Error codeContent
4085HThe read address (s) and (n) exceeds the device range.
4084H(n) is not 0 or 1.

Example 

1709192341229-210.png

As shown in the above example,

M1 turns from OFF to ON during RUN process.

SD2540 will be set to 129 (H81, baud rate: 9600, stop bit: 1, data bit: 8, parity bit: none), SD2541 will be set to 280 and then cleared. At this time, it has been set successfully.

1709192357577-580.png

If M1 turns from OFF to ON again,

SD2540 will be set to 129 (H81), SD2541 will be set to 280, which will not be cleared.

1709192373970-129.png

Modbus Station Number Setting


STATION/Modbus station number setting


STATION (P)

Under the Modbus slave station protocol. Set the station number (s) for the (n) communication port.

-[STATION  (s)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom variable type
(s)Station number to be set0~255Unsigned BIN16 bitsANY16INT
(n)Which communication port to set, 0 means COM1, 1 means COM20, 1Unsigned BIN16 bitsANY16INT

Device used 

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
STATIONParameter 1              
Parameter 2              

Function

This command is mainly used to set the station number during RUN, and can also be used in the first cycle of RUN.

  • The value of the station number address (COM1 SD2544, COM2 SD2594) and the station number modification sign (COM1 SD2545, COM2 SD2595) can be directly set according to the command parameters.

  • The specific calculation formula for setting the station number modification sign (COM1 SD2545, COM2 SD2595) is: (parameter setting value + offset of the corresponding serial port's initial special device + 10) *2

For example, setting COM2 station number to 1, i.e. (1 +2595 - 2590 +10) *2, which is (1 +5+10) *2=32. At this time, SD2594 will be set to 1, and SD2595 will be set to 32.

Note: Whether the value is set by self-calculation and then modifying the sign (COM1 SD2545, COM2 SD2595) to the station number, or by using this command, the station number can be modified when the PLC is in the RUN state.

Station number modification sign (COM1 SD2545 and COM2 SD2595): During RUN, when the station number and modification sign are set correctly (the correctness will be judged at the End of the program), it will be deemed as the correct first cycle; then the protocol and modification sign (COM1 SD2545, COM2 SD2595) will be cleared upon completion of modification and the same value that is consequently set will not be processed. It mainly aims to avoid repeated settings for multiple times.

Related devices

DevicesContent
SD2544COM1 station number settings
SD2545COM1 station number modification sign  
SD2594COM2 station number settings
SD2595COM2 station number modification sign

 Error code

Error codeContent
4085HThe read address (s) (n) exceeds the device range.
4084H(s) not within the range of 0~255.
(n) is not 0 or 1.

Precautions

The setting of communication parameters will affect the overall communication. The parameters in PLC are modified when there is no communication or after a round of communication is completed. Attention shall be paid to this point.

Example

1709192619027-553.png

As shown in the above example,

M1 turns from OFF to ON during RUN process.

SD2594 will be set to 2, SD2595 will be set to 34 and then it will be cleared. At this time, it has been set successfully.

1709192635876-596.png

If M1 turns from OFF to ON again,

SD2594 will be set to 2, SD2595 will be set to 34 but will not be cleared.

1709192654323-459.png

RS Instruction


RS/External communication command


RS

In Modbus master station protocol: the command is the setting interface for the master station to send protocol frames. According to the station number function code (s), slave station address (m), length (d) set by the command and the function code, it can be determined whether n data is required to automatically combine the transmission and reception of protocol frames. If it is a read type function code, the data will be written into (n).

-[RS  (s)  (m)  (d)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom variable type
(s)The starting address of the register area where the data to be sent is stored.-Unsigned BIN16 bitsANY16--
(m)The length (in bytes) of the data to be sent.0~523Unsigned BIN16 bitsANY16--
(d)The starting number of the device that stores written data.-Unsigned BIN16 bitsANY16--
(n)Volume of data written (in bytes).0~523Unsigned BIN16 bitsANY16--

In Modbus protocol: 

ParameterContentRangeData typeData type (label)
(s)The high byte stores the station number of the slave station, and the low byte stores the Modbus function code.-Unsigned BIN16 bitsANY16
(m)Slave station address. The address provided by the slave station will read or write data from the address of slave station.-Unsigned BIN16 bitsANY16
(d)Length, the data length read or written by Modbus, and the unit are determined by the function code.-Unsigned BIN16 bitsANY16
(n)The starting address for data to be read or written.-Unsigned BIN16 bitsANY16

Device used 

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
RSParameter 1                    
Parameter 2                    
Parameter 3                    
Parameter 4                    

User-defined protocol

When the communication protocol is set as a user-defined protocol. When the contact in front of RS command is turned on and SM2591 is also turned on at the same time, if the sending length (m) is not 0, (m) bytes of the data of (s) will be sent out, and then it will enter the mode of waiting for reception. When the data is received, (N) bytes of data will be stored in (d). SM2593 will be turned ON after receiving (n) data.

In addition, when the sending length (m) is 0, it will be in the receive-only mode. When the receiving length (n) is 0, it will be in the send-only mode.

To enable the start character (STX) and the end character (ETX) modes of RS command, the status of the 10th and 11th bits of the special address SD2600 must be set. See the table below for detailed settings:

Bit numberNameContent
  0 (bit OFF)1 (bit ON)
b0Data length7 digits8 digits

b1

b2

Parity check

b2, b1

(0, 0): None

(0,1): Odd parity (ODD)

(1,1): Even parity (EVEN)

b3Stop bit1 bit2 bit

b4

b5

b6

b7

b8

b9

Baud rate (bps)

.b9,b8,b7,b6,b5,b4

( 0, 0, 0, 1, 1, 1): 4800

( 0, 0, 1, 0, 0, 0): 9600

( 0, 0, 1, 0, 0, 1): 19200

( 0, 0, 1, 0, 1, 0): 38400

( 0, 0, 1, 0, 1, 1): 57600

.b9,b8,b7,b6,b5,b4

( 0, 0, 1, 1, 0, 0): 115200

( 0, 0, 1, 1, 0, 1): 187500

( 0, 0, 1, 1, 1, 0): 230400

( 0, 0, 1, 1, 1, 1): 460800

( 0, 1, 0, 0, 0, 0): 921600

b10STXDisable STX functionEnable STX function, the specific value is set by D8124
b11ETXDisable ETX functionEnable the ETX function, the specific value is set by D8125
b12------
b13------
b14------
b15------

Example

1709192957243-806.png

When M1 is ON, the sent and received data of communication are stored as follows after the command is executed:

1709192977624-617.png

As shown in the figure, the sent data are 01H, 02H, 03H, 04H and 05H in turn The number of dark backgrounds used is the sent data length (m).

As shown in the figure, the received data are 21H, 22H, 23H and 24H in turn The number of dark backgrounds used is the received data length (n).

Some configuration and preparation of serial communication are needed for actual programming in order to achieve communication as expected. For instance, sending and receiving mode of serial port, baud rate, number of bits, parity, software protocol settings, timeout judgment conditions, and data preparation for the transceiver buffer, sending and receiving sign processing shall be set. A relatively complete RS communication setting program is shown as follows:

1709193063665-172.png

Set the protocol to a user-defined protocol,

Sending interval: 5ms,

Reception timeout: 100ms,

Retries: 3 times,

Character interval timeout: 30ms,

Sending starting address D200 of user-defined protocol: sending length 8,

Directly trigger sending upon being.

For detailed user-defined protocol instructions, please refer to “9.5.1 User-defined Protocol Description”.

Modbus protocol

When the protocol is set to Modbus master station protocol (whether it is RTU or ASCII), When the contact in front of the RS command is set ON. RS2 command will judge whether the data of (N) is needed to send the combined data frame according to station number function code (s), slave station address (m), the length (d) and function code.

1709193191809-462.png

After receiving, directly close the command and reset the command receiving sign.

ParameterContent
(s)The high byte stores the station number of slave station, and the low byte stores the function code of Modbus.
(m)Slave station address. The address provided by the slave station will read or write data from the address of slave station.
(d)Length: the length read or written by Modbus. The unit is determined by function code.
(n)

The starting address for data to be read or written.

1709193250935-338.png

 Communication protocol setting:

Sending interval: 5ms

Reception timeout: 100ms

Timeout retry times: 3 times

Station number 01H, function code 03H, slave station

As shown in above ladder diagram:

When M1 is turned ON, PLC will send data (hexadecimal) from COM2 of PLC: 01 03 00 0A 00 05 A5 C8

01: represents slave address, the high 8 bits of (s);

03: Modbus command code, the low 8 bits of (s), which means to read the slave register;

00 0A: the address of slave register to be read, the value of (m);

00 05: the number of registers to be read, the value of (d),

A5 C8: CRC parity code.

For detailed user-defined protocol instructions, please refer to “9.5.2 Modbus Protocol Description”.

Precautions

  1. Although the RS command currently allows all the parameters of the command to use constants such as K and H, different protocols have different restrictions.
  2. When the protocol is a user-defined protocol, S and D cannot be constants, otherwise it will report (3189H) error.
  3. When the protocol is Modbus protocol, n cannot be a constant, otherwise it will report (3189H) error.
  4. The combination of RTU protocol and 7-bit data bits cannot be set.
  5. If the serial port parameter settings are different, it may still be able to communicate. At present, it is normal.
  6. Currently, the RS comand cannot be used in interrupts and events.

Error code

Error codeContent
4085H(s), (m), (d) and (n) read address exceeds the range of the device.
3180HCOM2 data reception error. There may be interference on the communication cable, it is recommended to connect GND.
3181HCOM2 data reception timeout. Check the wiring, whether the serial port parameter settings correspond to master and slave, and whether there is interference. Check whether it is caused by the late response from the slave station. It is recommended to increase the sending interval SD2546.
3182HCOM2 CRC parity error. There may be interference on the communication cable, it is recommended to connect GND.
3183HCOM2 LRC parity error. There may be interference on the communication cable, it is recommended to connect GND.
3184HThe COM2 station number is incorrectly configured. Check the slave station number setting, and check whether there is any problem with the receiving and sending mechanism from slave station.
3185HCOM2 send buffer overflow If this error message appears, please contact technical personnel
3186HCOM2 function code is wrong. Check whether the set function code is a function code supported by PLC.
3187HCOM2 address is wrong. Check whether the slave station has this address. (Please refer to Modbus exception 02).
3188HThe length of COM2 is wrong. Check whether the communication length exceeds the length range specified by Modbus protocol or user-defined protocol.
3189HCOM2 data error. Check whether parameters of the command are wrong. Check whether the set value is supported by the slave station. (Please refer to Modbus exception 03).
318AHCOM2 slave station is busy. Message returned from slave station: Slave station is busy. (Please refer to Modbus exception 06).
318BHCOM2 slave station does not support function codes. Check whether this function code is supported by the slave station. (Please refer to Modbus exception 01).
318CHCOM2 slave station is faulty. Message returned from slave station: Slave station failed, please check whether slave station failed. (Please refer to Modbus exception 04).
318DHCOM2 slave station confirmation. Message returned from slave station: slave station confirmation. (Please refer to Modbus exception 05).
318EHAt present, COM2 does not support this command or function. When the slave protocol is set, the communication commands related to master station or master station functions cannot be used. Please change the protocol or close the contact before the corresponding command or close the corresponding communication function.
318FHCOM2 sending timeout. If this error message appears, please contact technical personnel.
31A0HNo available gateway for COM2 Message returned from the slave station: no available gateway. (Please refer to Modbus exception 0A).
31A1HCOM2 indicates that no response was obtained from the target device. Message returned from the slave station: The device is not networked. (Please refer to Modbus Exception 0B).

Instructions for Use of RS Instruction Protocol


User-defined Protocol Description


Introduction

The function of user-defined protocol: it can directly transmit data with equipment without any processing or the customer can set corresponding protocol to communicate with other equipment.

At present, the user-defined protocol of 6V PLC is configured and sent by COM2, and the command used is RS command. Protocol and serial port parameters need to be configured through devices.

The current user-defined protocol is generally similar to 3V.

Basic Configuration

(1)Instruction

The RS command itself is used in the same way as the previous RS command at 3V, and R devices can be used.

-[RS  (s)  (m)  (d)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom Variable Type
(s)The starting address of the register area where the data to be sent is stored-Unsigned BIN16 bitsANY16--
(m)The length (in bytes) of the data to be sent0~528Unsigned BIN16 bitsANY16--
(d)The start number of device that stores written data-Unsigned BIN16 bitsANY16--
(n)Volume of data written0~528Unsigned BIN16 bitsANY16--

Device used

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
RSParameter 1                    
Parameter 2                    
Parameter 3                    
Parameter 4                    

Note:

Although the RS command currently allows all the parameters of the command to use constants such as K and H, different protocols have different restrictions.

When the protocol is user-defined protocol, S and D cannot be constants, otherwise an error will be reported.

(2)Special device setting 

Special address table

COM2 special D device (SD)COM2 special M device (SM)
2590Communication port settings2590Sending control on
2591COM1 serial port parameter modification sign2591Send control/send prompt
2592Protocol settings2592Reception control on
2593Protocol modification sign2593Accept control/receive prompt
2594Station number settings25948-bit mode (for user-defined protocol)
2595Station number modification sign2595 
2596

Sending interval (0.1ms) 0~32767

Set 0 to 10 (1ms)

2596 
2597

Communication timeout setting (10ms)   0~32767

Set 0 to 10 (100ms)

2597 
2598Timeout retry times 0~327672598 
2599

Character interval timeout setting (for custom protocol) (0.1ms)

0 to 32767

Set 0 to 10 (1ms)

2599 
2600STX value2600 
2601ETX value2601 
... ... 
2610Volume of data received2610Communication completion sign
2611Last error2611Receiving sign
2612Current error2612Retry
2613Error steps2613Communication error
2614Error station number2614Communication timeout
2615Cumulative error times2615 

The contents that will be used or set by the user-defined protocol have been marked with “underline” and “in bold”.

In addition, the devices to be used as judgment conditions have been marked “in bold” in the table.

Note:

at present, COM1 doesn’t support user-defined protocol.

Communication port settings SD2590

Bit numberNameContent
  0 (bit OFF)1 (bit ON)
b0Data length7 digits8 digits

b1

b2

Parity check

b2, b1

(0, 0): None

(0,1): Odd parity (ODD)

(1,1): Even parity (EVEN)

b3Stop bit1 bit2 bit

b4

b5

b6

b7

b8

b9

Baud rate (bps)

.b9,b8,b7,b6,b5,b4

( 0, 0, 0, 1, 1, 1): 4800

( 0, 0, 1, 0, 0, 0): 9600

( 0, 0, 1, 0, 0, 1): 19200

( 0, 0, 1, 0, 1, 0): 38400

( 0, 0, 1, 0, 1, 1): 57600

.b9,b8,b7,b6,b5,b4

( 0, 0, 1, 1, 0, 0): 115200

( 0, 0, 1, 1, 0, 1): 187500

( 0, 0, 1, 1, 1, 0): 230400

( 0, 0, 1, 1, 1, 1): 460800

( 0, 1, 0, 0, 0, 0): 921600

b10STXDisable STX functionEnable STX function, the specific value is set by D8124
b11ETXDisable ETX functionEnable the ETX function, the specific value is set by D8125

 According to the bit setting provided in the above table, the serial port parameter is set to SD2590. At present, the setting is basically the same as 3V. As a higher baud rate can be set, the bits used for enabling STX and ETX need to be moved back by two bits.

For instance, set serial port parameters: baud rate: 115200, stop bit: 1, data bit: 8, parity bit: none, enable STX.

Then set the value H4C1 (K1217) on SD2590. At present, the parameters directly set to SD2590 are only valid in the first cycle of PLC RUN, and if they need to be modified during RUN, they can be set by PORTPARAM command.

Protocol settings SD2592

Protocol settingsProtocol settings
0 HWecon Modbus slave station10 HUser-defined protocol
2 HModbus RTU slave station20 HModbus RTU master station 
3 HModbus ASCII slave station30 HModbus ASCII master station

The corresponding protocol can be set by setting the corresponding value in SD2592.

At present, the parameters directly set to SD2590 are only valid in the first cycle of PLC RUN.

If the parameters need to be modified during RUN, they can be set by PROTOCOL command.

Sending interval SD2596

The main function of sending interval is: to determine how long does it take to wait to send the next command when one command is completed. When 0 is set, it will not wait for sending at specified interval, but it will be affected by scanning period.

The unit of transmission interval is 0.1 ms, i.e. the interval time is 10ms when the value is set to be 100.

Communication timeout SD2597 and timeout retry SD2598

1709194693483-466.png

The main function of communication timeout is: to determine when the retry is required or an error needs to be reported when the data is not received after being sent by PLC. When 0 is set, it is 100ms by default.

The unit of transmission interval is 10ms, i.e. the timeout judgment time is 100ms when the value is set to be 10.

When receiving timeout occurs, it will judge whether there are retries and the current retry times. If the retry times are greater than or equal to SD2598, an error will be reported.

If SD2598 is set to 0, no retry is required.

When it is set to 1, send the data once and then send it again after timeout.

Character interval timeout SD2599

At present, this setting is available for user-defined protocol.

The main function of character interval timeout is: after receiving at least one character before there is no communication timeout, judge whether the interval time between the following two characters exceed the time limit, report an error if it exceeds the time limit, and end communication.

1709194729585-457.png

This setting is mainly designed after considering that some devices may send data slowly or there are other specific sending requirements. No retry is required in case of character interval timeout.

Serial port parameter setting command

Upper computer interface settings

1709194773560-219.png

Through the PLC parameter setting in the upper computer interface, if the protocol is switched to “no protocol”, it means the user-defined protocol.

Serial port parameters mainly include baud rate, data bits and other serial port parameters.

Start/end characters can be sent when start characters are enabled. Start/end characters will be distinguished when they are received. See the instructions in the sending and receiving process for details.

It is important to note that the characters here are actually decimal values.

PORTPARA command

 -[PORTPARA  (s)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom variable type
(s)Serial port parameters to be set0 to 256Unsigned BIN16 bitsANY16--
(n)Which communication port to set, 0 means COM1, 1 means COM20, 1Unsigned BIN16 bitsANY16INT

Device used 

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
PROTOCOLParameter 1              
Parameter 2              

Function

It is used to set the communication protocol at the time of RUN, and the above command is actually used to set a specific value for the parameter modification sign.

●The specific calculation formula is: (parameter setting value + offset of the corresponding serial port's initial special device + 10)*2

For example, setting the protocol to Modbus RTU master station (H20), i.e. (0x20 +2593-2590 +10) * 2, which is (32 +3 +10) *2=90, which mainly aims to avoid random modification of serial port parameters during operation.

For user-defined protocol, if the set parameters are triggered, the value will be changed only after the command is completely completed.

For Modbus master station protocol, if the set parameters are triggered, the value will be changed only after the command is completely completed.

For Modbus slave station protocol, if the set parameters are triggered, switching can be performed when the received data is not being processed.

For details, please refer to “PROTOCOL Instruction Description”.

Priority description of serial port parameters

The priority of serial port parameter setting is listed below. At present, serial port parameters are saved at the time of power failure.

Serial port parameter setting command setting = using ladder diagram MOV command to set corresponding SD device > upper computer downloading parameters > previous data saved at the time of power outage.

Basic ladder diagram

1709195811192-573.png

Setting serial port parameters:

Baud rate: 115200, stop bit: 1, data bit: 8, parity

Set the protocol to a user-defined protocol

Sending interval: 5ms

Reception timeout: 100ms

Retries: 3 times

Character interval timeout: 30ms

Sending starting address D200 of user-defined protocol: sending length 8

Directly trigger sending upon being

After receiving, directly close the command and reset the command receiving sign.

1.Sending and receiving mechanism

(1)No start character (STX) and end character (ETX)

16-bit (SM2594 is OFF)

Devices will be divided into high and low directly and then the data in the low address will be sent first, followed by the data in the high address.

1709197260367-911.png

1709197271332-974.png

For instance, the sent data are 01, 02, 03, 04 and 05

When X1 is ON, the sent and received data of communication are stored as follows after the command is executed.

For instance, the received data are 11, 12, 13 and 14

8-bit (SM2594 is ON)

Get the value of the low address of the device directly and send it

1709197320390-469.png

1709197331830-332.png

 As shown in above ladder diagram and under above data transmission, the sent data should be: 70 E1 31 62 6C.

1709197349815-564.png

The received data will also be stored at low address.

(2)Opening and setting the start character STX

The value of the start character SD2600 is valid only when it is at low bit.

When STX is opened, the data will start with the start character STX at the time of sending, and the data starting with STX will be received, but no STX will be shown.

When the data starting with STX is received in the half way,the reception process will restart.

If the first character is not received, it will be judged as time out in case of the timeout of the first character; if the first character is received, no matter what kind of data is received, the character timeout will be counted since the last character is received.

1709197411454-969.png

1709197419797-167.png

As shown in above ladder diagram and under above data transmission, the sent data should be FE 70 7D E1 00 31.

If FE 51 26 34 15 is sent to PLC, the following data will be received.

If FE 25 63 FE 51 26 34 15 is sent to PLC, the following data will be received.

1709197434533-834.png

2.Opening and setting the end character ETX

The value of the end character SD2601 is valid only when it is at low bit.

When ETX is opened, the data will end with ETX at the end of sending.

SM2610 and SM2593 are immediately ON when an ETX is received, no matter whether sufficient length of data is received.

1709197515381-874.png

1709197524487-888.png

As shown in above ladder diagram and under above data transmission, the result is 70 7D E1 00 31 FD.

As shown in above ladder diagram, if 01 06 FD is sent, the following data will be received. If FD is sent directly, it will be judged as “end” directly.

1709197546086-345.png

Both start character (STX) and end character (ETX) are opened

When both start character and end character are opened, it is generally deemed as the combination of above single open state.

However, if only ETX data is received when both characters are opened, it will not end immediately, but it will change to judge the character interval time, without starting to receive data.

Receiving after sending (similar to Modbus master station mechanism)

1. OFF (default) state of sending control switch (SM2590) and receiving control switch (SM2592)

When the contact point of RS command is set ON, SM2591 will be sent immediately when it is set ON, and SM2591 will be automatically set OFF after sending.

After sending, judge the state of SM2593. If it is ON, it will stop in this command all the time and wait until it is set OFF and then receive data; if it is OFF, it will start receiving data.

After the first character timeout time (SD2597), if no character is received, it is judged as timeout; if retry time is set, retry it. If the communication cannot be achieved after retry, an error will be reported and SM2593 and SM2614 are set to be on.

After receiving the first character, judge whether the interval between characters exceeds the time set by SD2599, otherwise an error will be reported. (Please refer to “Character Interval Timeout” for details.)

If there are two or more commands, after SM2591 is set to be ON, RS command for setting the first ON will be sent, and then if this RS command is completed* 1and set to be ON, SM2591 will switch to the next RS command in the ladder diagram sequence* 2.

If there are two or more commands, another data will be sent when the data is half received, and the original command is continued to be executed for receiving until it is completed.

Note * 1: Completion refers to receiving data or reporting errors.

Note * 2: If there is no other RS command opened after the ladder diagram sequence, it will return to execute the first RS command opened in the ladder diagram sequence.

2.Sending mode when the sending control switch (SM2590) is ON

When the sending control switch (SM2590) is ON, there is no need to control SM2591 to be set as ON.

At this time, as long as the contact of RS command is triggered, it can be sent, and SM2591 is automatically set as ON.

3.Receiving mode when the receiving control switch (SM2592) is ON

When the receiving control switch (SM2592) is ON, SM2593 is automatically turned to OFF when the command is executed.

When receiving, the status of SM2593 will not be judged again, and SM2593 will still be set as ON after receiving.

4.ON state of sending control switch (SM2590) and receiving control switch (SM2592)

Under above circumstance, the data can be sent only by triggering the contact in front of the RS command, which will automatically turn to the waiting for receiving state, and when the reception is completed, it will turn to the next opened RS command.

(3)Send only

1709197775117-634.png

 When the sending length is set to a non-0 value, the receiving length is set to 0. This is send-only mode.

1.OFF state of sending control switch (SM2590)

When SM2591 is set as ON, it sends data and does not receive data.

If there are two or more commands, after SM2591 is set to be ON, RS command for setting the first ON will be sent, and then if this RS command is completed and set to be ON, SM2591 will switch to the next RS command in the ladder diagram.

2.ON state of sending control switch (SM2590)

The data will be sent when RS command is triggered.

When several commands are triggered, the data will be set in circular manner, and during the circular sending, the data will be sent at intervals according to the set sending intervals.

(4)Receive-only

1709197838060-527.png

When the sending length is set to a non-0 value, the receiving length is set to 0. This is send-only mode.

1.OFF state of sending control switch (SM2590)

When SM2591 is set as ON, it sends data and does not receive data.

If there are two or more commands, after SM2591 is set to be ON, RS command for setting the first ON will be sent, and then if this RS command is completed and set to be ON, SM2591 will switch to the next RS command in the ladder diagram.

2.ON state of sending control switch (SM2590)

The data will be sent when RS command is triggered.

When several commands are triggered, the data will be set in circular manner, and during the circular sending, the data will be sent at intervals according to the set sending intervals.

(5)Sending after receiving by the receive-only and send-only mode (similar to Modbus slave station mechanism)

1709715782626-666.png

Receive-only: when it is judged as completing reception, the command to be triggered will be judged according to the received contents; meanwhile, the received data will be saved.

Send-only: the sent contents are different after M2 is triggered and M3 is triggered. After the trigger is over, they will return to trigger the receive-only part of M1.

A. 9.5.1.4 Error information

The current error code will be displayed in theSD7, SD0 and SD2611 and SD2612.

The error codes that will occur in user-defined protocols are mainly shown as follows:

Error codeContent
3181HData reception timeout
3188HLength error
3189HCOM2 data error. “Check whether the parameters of the command are wrong. Check whether the set value is supported by the slave station. (Please refer to Modbus exception 03).”
318EHAt present, COM2 does not support this command or function. When the slave protocol is set, the communication commands related to master station or master station functions cannot be used. Please change the protocol or close the contact before the corresponding command or close the corresponding communication function.
318FHCOM2 sending timeout. If this error message appears, please contact technical personnel.
3190HCOM2 receives data beyond the cache limit.

After resetting the protocol or communication parameters, the reported errors will be cleared.

In addition, in case of communication completion/communication error/communication timeout, the sign bit will be set after executing the command.

B.9.5.1.5 Difference with Mitsubishi

Currently known difference:

⑴ For STX and ETX, Mitsubishi can set a maximum of 4 bytes, but we only have one byte.

⑵Support accumulation, parity, CR and LF.

⑶Mitsubishi's command control is to execute the command on a fixed basis when the command is triggered first. It will not be switched to other commands midway unless the contact of this command is closed.

Modbus Protocol Description


file:///C:\Users\ADMINI~1\AppData\Local\Temp\ksohtml10940\wps1.pngIntroduction

The current Modbus master station protocol is generally similar to LX3V. The address is modified in the slave station part.

Basic Configuration

(1) Instruction

The RS command itself is used in the same way as the previous RS command at 3V. R device can be used.

-[RS  (s)  (m)  (d)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)
(s)The high byte stores the station number of slave station, and the low byte stores the function code of Modbus.-Unsigned BIN16 bitsANY16
(m)Slave station address. The address provided by the slave station will read or write data from the address of slave station.-Unsigned BIN16 bitsANY16
(d)Length: the length read or written by Modbus. The unit is determined by function code.-Unsigned BIN16 bitsANY16
(n)The starting address for data to be read or written.-Unsigned BIN16 bitsANY16

Device used 

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
RSParameter 1                    
Parameter 2                    
Parameter 3                    
Parameter 4                      

✎Note:

Although the RS command currently allows all the parameters of the command to use constants such as K and H,

different protocols have different restrictions. When the protocol is Modbus master station protocol, n cannot be a constant, otherwise it will report an error.

(2) Special device setting

Special address table

COM1 special D device (SD)
2540Communication port settings
2541COM1 serial port parameter modification sign
2542 
2543 
2544Station number settings
2545Station number modification sign

✎Note: COM1 doesn’t support modification of protocol.

COM2 special D device (SD)COM2 special M device (SM)
2590Communication port settings2590Sending control on
2591COM1 serial port parameter modification sign2591Send control/send prompt
2592Protocol settings2592Reception control on
2593Protocol modification sign2593Accept control/receive prompt
2594Station number settings25948-bit mode (for user-defined protocol)
2595Station number modification sign2595 
2596

Sending interval (0.1ms)  0-32767

Set 0 to 10 (1ms)

2596 
2597

Communication timeout setting (10ms)   0-32767

Set 0 to 10 (100ms)

2597 
2598Timeout retry times  0-327672598 
2599

Character interval timeout setting (for custom protocol) (0.1ms)

0 to 32767

Set 0 to 10 (1ms)

2599 
2600STX value2600 
2601ETX value2601 
... .. 
2610Volume of data received2610Communication completion sign
2611Last error2611Receiving sign
2612Current error2612Retry
2613Error steps2613Communication error
2614Error station number2614Communication timeout
2615Cumulative error times2615 

 The contents that will be used or set by the Modbus protocol have been marked with “underline” and “in bold”.

In addition, the devices to be used as judgment conditions have been marked “in bold” in the table.

1.Communication port settings SD2590

Bit numberNameContent
  0 (bit OFF)1 (bit ON)
b0Data length7 digits8 digits

b1

b2

Parity check

b2, b1

(0, 0): None

(0,1): Odd parity (ODD)

(1,1): Even parity (EVEN)

b3Stop bit1 bit2 bit

b4

b5

b6

b7

b8

b9

Baud rate (bps)

.b9,b8,b7,b6,b5,b4

( 0, 0, 0, 1, 1, 1): 4800

( 0, 0, 1, 0, 0, 0): 9600

( 0, 0, 1, 0, 0, 1): 19200

( 0, 0, 1, 0, 1, 0): 38400

( 0, 0, 1, 0, 1, 1): 57600

.b9,b8,b7,b6,b5,b4

( 0, 0, 1, 1, 0, 0): 115200

( 0, 0, 1, 1, 0, 1): 187500

( 0, 0, 1, 1, 1, 0): 230400

( 0, 0, 1, 1, 1, 1): 460800

( 0, 1, 0, 0, 0, 0): 921600

According to the bit setting provided in the above table, the serial port parameter is set to SD2590.

At present, the setting is basically the same as 3V. As a higher baud rate can be set, the bits used for enabling STX and ETX need to be moved back by two bits.

For instance, set serial port parameters: baud rate: 115200, stop bit: 1, data bit: 8, parity bit: none.

Then set the value HC1 (K1217) on SD2590.

At present, the parameters directly set to SD2590 are only valid in the first cycle of PLC RUN.

If the parameters need to be modified during RUN, they can be set by PORTPARAM command.

2.Protocol settings SD2592

Protocol settings
0HWecon Modbus slave station10HUser-defined protocol
2HModbus RTU slave station20HModbus RTU master station 
3HModbus ASCII slave station30HModbus ASCII master station

The corresponding protocol can be set by setting the corresponding value in SD2592.

At present, the parameters directly set to SD2590 are only valid in the first cycle of PLC RUN.

If the parameters need to be modified during RUN, they can be set by PROTOCOL command.

At present, COM1 cannot support the protocol other than W Modbus slave protocol.

3.Sending interval SD2596

The main function of sending interval is: to determine how long does it take to wait to send the next command when one command is completed. When 0 is set, it will not wait for sending at specified interval, but it will be affected by scanning period.

The unit of transmission interval is 0.1 ms, i.e. the interval time is 10ms when the value is set to be 100.

4.Communication timeout SD2597 and timeout retry SD2598

1709716850100-900.png

The main function of communication timeout is: to determine when the retry is required or an error needs to be reported when the data is not received after being sent by PLC. When 0 is set, it is 100ms by default.

The unit of transmission interval is 10ms, i.e. the timeout judgment time is 100ms when the value is set to be 10.

When receiving timeout occurs, it will judge whether there are retries and the current retry times. If the retry times are greater than or equal to SD2598, an error will be reported.

If SD2598 is set to 0, no retry is required.

When it is set to 1, send the data once and then send it again after timeout.

(3) Serial port parameter setting

1.PORTPARA command

-[PORTPARA  (s)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom variable type
(s)Serial port parameters to be set 0~256-Unsigned BIN16 bitsANY16INT
(n)Which communication port to be set, 0 means COM1, 1 means COM2

-2147483648~

2147483647

Unsigned BIN16 bitsANY16INT

Device used 

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
PORTPARAParameter 1              
Parameter 2              

Function

Used to set communication parameters at the time of RUN.

For details, please refer to “PORTPARA Instruction Description”.

2.PROTOCOL command

-[PROTOCOL  (s)  (n)]

Content, range and data type

ParameterContentRangeData typeData type (label)Custom variable type
(s)Protocol number to be set0 to 65535Unsigned BIN16 bitsANY16INT
(n)Which communication port to be set, 0 means COM1, 1 means COM21Unsigned BIN16 bitsANY16INT

Device used 

InstructionParameterDevicesIndex modificationPulse expansion
  XYMSSMT(bit)C(bit)LC(bit)HSC(bit)D.bKnXKnYKnMKnSTCDRSDLCHSCKHE[D]XXP
PROTOCOLParameter 1              
Parameter 2              

Function

It is used to set the communication protocol at the time of RUN, and the above command is actually used to set a specific value for the parameter modification sign.

The specific calculation formula is: (parameter setting value + offset of the corresponding serial port's initial special device + 10)*2

For example, setting the protocol to Modbus RTU master station (H20), i.e. (0x20 +2593-2590 +10) * 2, which is (32 +3 +10) *2=90, which mainly aims to avoid random modification of serial port parameters during operation.

For Modbus master station protocol, if the set parameters are triggered, the value will be changed only after the command is completely completed.

For Modbus slave station protocol, if the set parameters are triggered, switching can be performed when the received data is not being processed.

For details, please refer to “PROTOCOL Instruction Description”.

3.Upper computer settings

The PLC parameter setting of the upper computer can set the corresponding serial port parameters.

1709717121639-464.png

Specific protocol station number cannot be 0

Station number under Modbus RTU and Modbus ASCII protocol is 0: Protocol sets the master station.

Station number under Modbus RTU and Modbus ASCII protocol is non-0: Protocol sets the slave station.

Serial port parameters are filled in according to the contents in the table.

Note: RTU protocol cannot set 7-bit data bits.

4.Priority description of serial port parameters

The priority of serial port parameter settings is listed below.

At present, serial port parameters are saved at the time of power failure.

Serial port parameter setting command setting = using ladder diagram MOV command to set corresponding SD device > upper computer downloading parameters > previous data saved at the time of power outage.

(4) Basic ladder diagram

1709717196041-407.png

Serial port parameter setting

Baud rate: 115200, data bit: 8, parity bit: none, stop bit: 1

Communication protocol setting: ModbusRTU master station protocol

Sending interval: 5ms

Reception timeout: 100ms

Timeout retry times: 3 times

Station number 01H, function code 03H, slave station address 10, length 05

1.Sending and receiving process

Modbus master station

When programming, in front of each RS (Modbus mode) command, each operand unit should be assigned with a certain value according to the address of the communication operation object, operation type, operation register address, data number, sending or receiving unit. Once the execution starts, the system program will automatically calculate CRC parity, organize communication frames, and complete the operation of sending data and receiving response.

If Modbus-ASC protocol is used for communication (SD2592 is set to H30), the HEX-ASC format for sending and receiving data is automatically changed by PLC system program, and the method of using RS (Modbus mode) command by users is exactly the same as that of using Modbus-RTU protocol.

In the plc program, if multiple RS (Modbus Mode) commands are driven, when the system program is executed, the next RS command will be processed in the same way after the links of “sending, waiting for response, receiving, checking, analyzing and storing" of one RS command are completed, until all RS commands are executed and started again. Users don't need to care about the timing and process of its execution, which simplifies PLC programming design. This is the advantage of Modbus command.

List of Modbus Master Station Function

Function codeFunction nameDetails
0x01Coil state readoutCoil state readout (several points)
0x02Input readoutInput readout (several)
0x03Holding register readoutHolding register readout (several points)
0x04Input register readoutInput register readout (several points)
0x051 Coil writtenCoil written (only one point)
0x061 Register writtenHolding register written (only one point)
0x0FBatch coil writtenMulti-point coil written
0x10Batch register writtenMulti-point holding register written

file:///C:\Users\ADMINI~1\AppData\Local\Temp\ksohtml13328\wps1.pngFor instance:

1709789901403-566.png Serial port parameter setting

Baud rate: 115200, data bit: 8, parity bit: none, stop bit: 1

Communication protocol setting: ModbusRTU master station protocol

Sending interval: 5ms

Reception timeout: 100ms

Timeout retry times: 3 times

Station number 01H, function code 03H, slave station

As shown in above ladder diagram:

When M1 is turned ON, PLC will send data (hexadecimal) from COM2 of PLC: 01 03 00 0A 00 05 A5 C8

01: represents slave address, the high 8 bits of (s);

03: Modbus command code, the low 8 bits of (s), which means to read the slave register;

00 0A: the address of slave register to be read, the value of (m);

00 05: The number of registers to be read, the value of (d),

A5 C8: CRC parity code

✎Notes

With 1 coil written (0x05), if 1 is written, the used value is 0xFF00; if 0 is written, the used value is 0x0000.

With batch coil written (0x0F), pay attention to the high and low bytes switching. For example, when writing 1 length, the fourth parameter value is 1 (0x0001), which means sending 0, and only when 256 (0x0100) is written can 1 be written as the target address.

2.Modbus slave station

When plc is used as Modbus slave station, it supports communication operation commands such as 0x01, 0x03, 0x05, 0x06, 0x0f and 0x10 of Modbus; through these commands, the coils that can read and write PLC have variables such as M, S, T, C, X (read-only) SM, Y, LC, HSC, etc. Register variables include D, T, C, R, SD, LC and HSC.

When the Modbus communication host accesses (reads or rewrites) the internal variables of PLC slave, it must follow the following definition of communication command frame and variable address index method, so as to carry out normal communication operation.

Instruction code 0x01 (01): read coil

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x01 (command code)1 byteRead coil
3Start address of coil2 bytesHigh bit in the front and low bit in the rear, see the addressing of the coil
4Coil number2 bytesHigh bit in the front and low bit in the rear (N)
5CRC parity2 bytesHigh bit in the front and low bit in the rear

 Response frame format: slave address + 0x01 + bytes + coil status + CRC parity

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x01 (command code)1 byteRead coil
3Number of bytes1 byteValue: [(N+7)/8]
4Coil state[(N+7)/8] bytesEvery 8 coils are combined into one byte. If the last coil is less than 8 bits, the undefined part is filled with 0. The first 8 coils are in the first byte, and the coil with the smallest address is in the lowest bit. And so forth.
5CRC parity2 bytesHigh bit in the front and low bit in the rear

Error response: see error response frame

② Instruction code 0x03 (03): read register

Request frame format: slave address+ 0x03 + register start address + register number + CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x03 (command code)1 byteRead register
3Register start address2 bytesHigh bit in the front and low bit in the rear, see the addressing of the register
4Register number2 bytesHigh bit in the front and low bit in the rear (N)
5CRC parity2 bytesHigh bit in the front and low bit in the rear
No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x03 (command code)1 byteRead register
3Number of bytes1 byteValue: N*2
4Register valueN*2 bytesEvery two bytes represents a register value, with high bit in the front and low bit in the rear. Register with small address comes first
5CRC parity2 bytesHigh bit in the front and low bit in the rear

Response frame format: slave address+0x03+bytes+register value +CRC parity.

Error response: see error response frame

③ Instruction code 0x05 (05): write single coil

Response frame format: slave address + 0x05+ bytes + coil address + CRC parity

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x05 (command code)1 byteWrite single coil
3Coil address2 bytesHigh bit in the front and low bit in the rear, see the addressing of the coil
4Coil state2 bytesHigh bit in the front and low bit in the rear. If the value is not 0, it is valid.
5CRC parity2 bytesHigh bit in the front and low bit in the rear

 Response frame format: slave address+0x05+coil address+ coil state+ CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594.
20x05 (command code)1 byteWrite single coil
3Coil address2 bytesHigh bit in the front and low bit in the rear, see the addressing of the coil
4Coil state2 bytesHigh bit in the front and low bit in the rear. If the value is not 0, it is valid.
5CRC parity2 bytesHigh bit in the front and low bit in the rear

Error response: see error response frame

Wherein the coil state 0xFF00 means being set as ON and 0x0000 means being set as OFF.

④ Instruction code 0x06 (06): write single register

Request frame format: slave address+ 0x06 + register address + register value + CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x06 (command code)1 byteWrite single register
3Register address2 bytesHigh bit in the front and low bit in the rear, see the addressing of the register
4Register value2 bytesHigh bit in the front and low bit in the rear. If the value is not 0, it is valid.
5CRC parity2 bytesHigh bit in the front and low bit in the rear

Response frame format: slave address+0x06+register address+ register value+ CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x06 (command code)1 byteWrite single register
3Register address2 bytesHigh bit in the front and low bit in the rear, see the addressing of the register
4Register value2 bytesHigh bit in the front and low bit in the rear. If the value is not 0, it is valid.
5CRC parity2 bytesHigh bit in the front and low bit in the rear

Error response: see error response frame.

⑤ Instruction code 0x0f (15): write multiple coils

Request frame format: slave address + 0x 0f+ coil start address + coil number+ number of bytes+ coil state+ CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x 0f (command code)1 byteWrite multiple coils
3Start address of coil2 bytesHigh bit in the front and low bit in the rear, see the addressing of the coil
4Coil number2 bytesHigh bit in the front and low bit in the rear. N, maximum value: 1968
5Number of bytes1 byteValue: [(N+7)/8]
6Coil state[(N+7)/8] bytesEvery 8 coils are combined into one byte. If the last coil is less than 8 bits, the undefined part is filled with 0. The first 8 coils are in the first byte, and the coil with the smallest address is in the lowest bit. And so forth.
7CRC parity2 bytesHigh bit in the front and low bit in the rear

Response frame format: slave address+ 0x 0f +coil start address+ coil number+ CRC parity

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x 0f (command code)1 byteWrite multiple coils
3Start address of coil2 bytesHigh bit in the front and low bit in the rear, see the addressing of the coil
4Coil number2 bytesHigh bit in the front and low bit in the rear.
5CRC parity2 bytesHigh bit in the front and low bit in the rear

Error response: see error response frame

⑥ Instruction code 0x10 (16): write multiple registers

Request frame format: slave address+ 0x10 + register start address + register number +number of bytes+ register value+ CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x10 (command code)1 byteWrite multiple registers
3Register start address2 bytesHigh bit in the front and low bit in the rear, see the addressing of the register
4Register number2 bytesHigh bit in the front and low bit in the rear. N, maximum value: 120
5Number of bytes1 byteValue: N*2
6Register valueN*2 (N*4) 
7CRC parity2 bytesHigh bit in the front and low bit in the rear

Response frame format: slave address+0x10+ register start address+ register number + CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
20x10 (command code)1 byteWrite multiple registers
3Register start address2 bytesHigh bit in the front and low bit in the rear, see the addressing of the register
4Register number2 bytesHigh bit in the front and low bit in the rear. N, maximum value: 120
5CRC parity2 bytesHigh bit in the front and low bit in the rear

Error response: see error response frame

⑦ Error response frame

Error response: slave address + (command code + 0x80) + error code + CRC parity.

No.Data (byte) meaningNumber of bytesDescription
1Slave address1 byteTake value 1~247, which is set by SD2544 and SD2594
2Instruction code+0x801 byteError command code
3Error code1 byte1 to 4
4CRC parity2 bytesHigh bit in the front and low bit in the rear
No.Error codeDescription
101Not supported function codes
202Wrong address or function code
303Wrong length
404Incomplete command
505Address not allowed

⑧Slave station address table

Word address
Address typeOccupationAddress rangeDecimal addressTotal reserved address size
T0 to T511512 WORD0x0000 to 0x01ff01536
C0~C255256 WORD0x0600 to 0x06ff15361024
LC0 to LC255512 WORD0x0A000 to 0x0BFF25601024
HSC0 to HSC15128 WORD0x0E00 to 0x0E1F3584512
D0~D79998000 WORD0x1000 to 0x2F3F409616384
SD0 to SD40954096 WORD0x5000 to 0x5FFF2048012288
R0~R3000030000 WORD0x8000 to 0xF52F3276830000
Bit address
Address typeOccupationAddress rangeDecimal addressTotal reserved address size
T0 to T511512 bit0x0000 to 0x01ff01536
C0~C255256 bit-0x0600 to 0x06ff15361024
LC0 to LC255256 bit-0x0A00 to 0x0AFF25601024
HSC0 to HSC1564 bit0x0E00 to 0x0E0F3584512
M0 to M80008192 bit0x1000 to 0x2F3F409616384
SM0~SM40954096 bit0x5000 to 0x5FFF2048012288
Reserved 0x8000 to 0xBFFF 16383
S0 to S40954096 bit0xC000 to 0xCFFF491528192
X0 to X10231024 bit-0xE000 to 0xE3FF573444096
Y0~Y10231024 bit-0xF000 to 0xF3FF614404096

Error information

The current error code will be displayed in the SD7, SD0, SD2611 and SD2612.

The error codes that will occur in Modbus protocols are mainly shown as follows:

Error codeContent
4085H(s), (m), (d) and (n) read address exceeds the range of the device (this error is displayed in SD7 and SD0 only).
3180HCOM2 data reception error. There may be interference on the communication cable, it is recommended to connect GND.
3181HCOM2 data reception timeout. Check the wiring, whether the serial port parameter settings correspond to master and slave, and whether there is interference. Check whether it is caused by the late response from slave station. It is recommended to increase the sending interval SD2546.
3182HCOM2 CRC parity error. There may be interference on the communication cable, it is recommended to connect GND.
3183HCOM2 LRC parity error. There may be interference on the communication cable, it is recommended to connect GND.
3184HThe COM2 station number is incorrectly configured. Check the slave station number setting, and check whether there is any problem with the receiving and sending mechanism from slave station.
3185HCOM2 send buffer overflow If this error message appears, please contact technical personnel.
3186HCOM2 function code is wrong. Check whether the set function code is a function code supported by PLC.
3187HCOM2 address is wrong. Check whether the slave station has this address. (Please refer to Modbus exception 02).
3188HThe length of COM2 is wrong. Check whether the communication length exceeds the length range specified by Modbus protocol or user-defined protocol.
3189H

COM2 data error. Check whether parameters of the command are wrong. Check whether the set value is supported by the slave station.

(Please refer to Modbus exception 03).

318AHCOM2 slave station is busy. Message returned from slave station: Slave station is busy. (Please refer to Modbus exception 06).
318BHCOM2 slave station does not support function codes. Check whether this function code is supported by the slave station. (Please refer to Modbus exception 01).
318CHCOM2 slave station is faulty. Message returned from slave station: Slave station failed, please check whether slave station failed. (Please refer to Modbus exception 04).
318DHCOM2 slave station confirmation. Message returned from slave station: slave station confirmation. (Please refer to Modbus exception 05).
318EHAt present, COM2 does not support this command or function. When the slave protocol is set, the communication commands related to master station or master station functions cannot be used. Please change the protocol or close the contact before the corresponding command or close the corresponding communication function.
318FHCOM2 sending timeout. If this error message appears, please contact technical personnel.
3190HCOM2 receives data beyond the cache limit.
31A0HNo available gateway for COM2 Message returned from the slave station: no available gateway. (Please refer to Modbus exception 0A).
31A1HCOM2 indicates that no response was obtained from the target device. Message returned from the slave station: The device is not networked. (Please refer to Modbus Exception 0B).

After resetting the protocol or communication parameters, the reported errors will be cleared.

In addition, in case of communication completion/communication error/communication timeout, the sign bit will be set after executing the command.

WECON Modbus Protocol Description


At present, WECON Modbus protocol description (special protocol) is modified based on Modbus RTU protocol.

Therefore, 7-bit data bits cannot be used in serial port parameters.

This protocol is fully compatible with Modbus RTU protocol, and the address is the same as the default address of Modbus RTU protocol of LX6V PLC.

The extended function is mainly used to communicate with PLC Editor 2.