西门子PLC1500以太网通讯协议分析

 初始化1500，192.168.0.1，端口：102

   1、初始化连接

   to:   03 00 00 16 11 E0 00 00 00 01 00 C1 02 01 00 C2 02 01 01 C0 01 09

   from: 03 00 00 16 11 d0 00 01 00 06 00 c0 01 09 c1 02 01 00 c2 02 01 01

     或  03 00 00 16 11 d0 00 01 00 21 00 c0 01 09 c1 02 01 00 c2 02 01 01

   2、初始化通讯

   to:   03 00 00 19 02 F0 80 32 01 00 00 FF FF 00 08 00 00 F0 00 00 01 00 01 07 80

   from: 03 00 00 1b 02 f0 80 32 03 00 00 ff ff 00 08 00 00 00 00 f0 00 00 01 00 01 03 c0

3、读 1500 ，DB10块  红色00 08表示8个数据，12 0A 10 04 其中04 表示 字（02表示字节，06表示双字）

   000000表示数据起始位置（10表示2*8 第三个字节开始），84表示 读DB块，0E表示04开始

的字节数。00 1F表示发送数据长度，（22位是标志位，FF表示读写成功，05代表DB块没有定义地址，0A代表没有打开或定义DB块。00 0A 表示DB块编号10.）

偏移地址表示格式：字节是8位，00 00 10 表示2个字节  2*8=16 。

读出来的数是00 0b 00 16 00 21 00 2c 00 37 00 42 00 4d 00 58

               11    22    33    44    55    66    77    88

 

to:   03 00 00 1F 02 F0 80 32 01 00 00 00 00 00 0e 00 00 04 01 12 0A 10 04 00 08 00 0A 84 00 00 00

from: 03 00 00 29 02 f0 80 32 03 00 00 00 00 00 02 00 14 00 00 04 01 ff 04 00 80 00 0b 00 16 00 21 00 2c 00 37 00 42 00 4d 00 58

03 00 00 1F 02 F0 80 32 01 00 00 00 00 00 0e 00 00 04 01 12 0A 10 04 00 08 00 0A 84 00 00 10

03 00 00 29 02 f0 80 32 03 00 00 00 00 00 02 00 14 00 00 04 01 ff 04 00 80 00 16 00 21 00 2c 00 37 00 42 00 4d 00 58 00 00

读出来的是：00 16 00 21 00 2c 00 37 00 42 00 4d 00 58 00 00

              22    33    44     55    66    77    88    00

容错测试：05 代表DB10块里没有定义数据

TO:   03 00 00 1F 02 F0 80 32 01 00 00 00 00 00 0e 00 00 04 01 12 0A 10 04 00 86 00 0a 84 00 00 00

from: 03 00 00 19 02 f0 80 32 03 00 00 00 00 00 02 00 04 00 00 04 01 05 00 00 00

0a代表没有DB块9

to:   03 00 00 1F 02 F0 80 32 01 00 00 00 00 00 0e 00 00 04 01 12 0A 10 04 00 06 00 09 84 00 00 00

from: 03 00 00 19 02 f0 80 32 03 00 00 00 00 00 02 00 04 00 00 04 01 0a 00 00 00

4、写数据  DB10

29代表总数据长度，12代表0x0c+要写入的字节数，12 0a 10 04 代表字操作方式（以字排列方式），00 03 代表操作数目（字），00 0A 代表DB10,00 00 00 代表起始地址，00 04代表非位操作（00 03是位操作），00 30 代表 6*8个字节（48位），后面是写入的数据 00 01 00 02 00 03。

TO:  03 00 00 29 02 F0 80 32 01 00 00 00 00 00 12 00 06 05 01 12 0A 10 04    00 03 00 0a 84 00 00 00 00 04 00 30 00 01 00 02 00 03

FROM: 03 00 00 16 02 f0 80 32 03 00 00 00 00 00 02 00 01 00 00 05 01 ff

 

读DB11   开始地址是0F 40   04个数字。

to:03 00 00 1F 02 F0 80 32 01 00 00 00  00 00 0E 00 00 04 01 12 0A 10 06 00 04 00 0B 84 00 0F 40

from:03 00 00 29 02 f0 80 32 03 00 00 00 00 00 02 00 14 00 00 04 01 ff 04 00 80 00 00 00 0e 00 00 00 0f 00 00 00 10 00 00 00 11

 

读DB11   开始地址是00 00   7a个数字。

 

to:03 00 00 1F 02 F0 80 32 01 00 00 00  00 00 0E 00 00 04 01 12 0A 10 06 00 7a 00 0B 84 00 00 00

 

from:03 00 02 01 02 f0 80 32 03 00 00 00 00 00 02 01 ec 00 00 04 01 ff 04 0f 40 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 0c 00 00 00 0c 00 00 00 0d 00 00 00 ee 00 00 00 0f 00 00 00 10 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0d

 

读DB11   开始地址是00 00   8a个数字。

03 00 00 1F 02 F0 80 32 01 00 00 00  00 00 0E 00 00 04 01 12 0A 10 06 00 8a 00 0B 84 00 00 00

 

 

03 00 02 04 02 f0 00 32 03 00 00 00 00 00 02 02 2c 00 00 04 01 ff 04 11 40 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 0c 00 00 00 0c 00 00 00 0d 00 00 00 ee 00 00 00 0f 00 00 00 10 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0d 00 00 00 03 00 00 44 02 f0 80 0e 00 00 00 0f 00 00 00 10 00 00 00 11 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

 

03 00 00 44 02 f0 80 无效数据，要剔去。