One. PLC basic concept
PLC: programmable logic controller is a digital electronic computing system designed for use in industrial environments. A programmable memory for storing an execution internal logical, sequential control, timing, and operation of the instruction arithmetic calculation, etc., and through digital, analog input and output control of various types of machinery or production processes . Programmable controllers and related equipment, all should be easy industrial control systems together into a whole, easy to extend the principle of functional design.
Run a block diagram of PLC: internal processing power and scan à à Diagnosis and error handling
And internal processing power: after some initial work on the power of the entire system, such as hardware initialization, the IO block configuration, power settings, and other protective initialization.
Scan: consists of three parts. The first is the input scan, followed by the program scan, the last one is the output of the scanning phase.
Diagnosis and error handling: PLC not scan once, perform a self-diagnosis, examination such as CPU, battery voltage, program memory, IO communication is abnormal or wrong, as found lights on the error or exception, CPU panel will only, and an error code is stored in a special register. If a fatal error occurs, CPU will be forced into STOP mode, stop scanning.
PLC: the main power supply, a processor (CPU), input-output unit (I / O), a special unit and a number of external input and output units (e.g., programming, etc.).
Installation: often mounted on a common input-output frame. Frame in which a CPU module is referred to the basic framework, for the other extensible framework. Between the base frame and the extension frame shorter distances (typically less than 30m), may be connected to local expansion frame by a plurality of extended local IO communication port; long distances (typically less than 3000m), may be connected by remote IO.
Key performance indicators: 1) storage capacity; 2) control capacity: IO is the capacity, also called IO capability, typically discrete (digital) count number; 3) scanning period; 4) command functions, and software support; 5) network and communication.
two. Product Series
AB PLC according to the system size and performance level is divided into the following series:
High-performance PLC: ControlLogix series, PLC5 series
Performance PLC: SLC500 series (SLC 5 / 01,5 / 02,5 / 03,5 / 04,5 / 05), FlexLogix series, CompactLogix
Small PLC: MicroLogix series, Micro800 series
AB's PLC is currently divided into five categories:
1. MicroLogix1500, programming software for the RS Logix500
2. Mid minicomputer SLC500, programming software RS Logix500. It supports a variety of network, up to 4096 I / O.
3. Mid new CompactLogix, programming software RS Logix5000.
4. High-end mainstream models ControlLogix5000, programming software RS Logix5000. 128K maximum support point I / O.
5. Old high-end models PLC5, programming software RS Logix5.
reference:
1． https://wenku.baidu.com/view/6d95c35fb42acfc789eb172ded630b1c59ee9be3.html
2． https://wenku.baidu.com/view/fbeba8eb0975f46527d3e183.html?sxts=1570678308327
3．https://ab.rockwellautomation.com/zh/Programmable-Controllers
three. program
3.1 basic concepts
PLC programming mode: Three, ladder diagram, structured text, and sequential function chart SFC.
Physical address : IO module location in a physical frame, often expressed as the first terminal of the first few few few frame groove. The 0th frame slot 1 put a 32-point input module is to be noted that the fifth terminal, which is the physical address of the frame 1, slot 0 the fifth terminal.
Logical addresses : an address corresponding to a memory, often several No. rack (Rack) No. several IO group (Group) of several represented. Wherein a rack group consisting of eight IO. A group corresponding to one IO input image table word (16) and an output image table word (16-bit), equivalent to 16 input terminals and 16 output terminals. The input image table I: 021/12 I represents the input module, the rack 02 representative number 2, represents a group of the IO No. 1, 12 represents the terminal 12 slashes.
Relationship between the physical address and the logical address
Addressing mode address units (descending)
Physical address terminal frame slot number
Rack IO bit logical address group number
Addressing of 3.2 PLC-5
Addressing groove : two I / O modules IO group to form a groove, i.e. the groove each physical IO module corresponding to the input word a (16) and a mapping table in the output image table word (16). Different densities (8:00, 16:00) and then determines the number of modules in the bit map table is used for each word.
Two 8-point discrete modules a group IO
FIG 8 is a front two input module, after 8 illustrates an input and an output module 8
Conclusion: IO module 8 in the IO frame can be placed in any order.
16-point discrete groove addressing module 2
Since each module 16 points when used throughout the entire image table word, therefore, a 16-point input module slots (at the even slot) to the other adjacent modules to form a slot groove IO 2 group, the other module must be 8 or 16-point output module, complementary.
Since all block transfer modules (e.g., analog modules) are double-acting (both occupies the input image table, and occupying the output image table), it can not be used complementary input or output module.
Note: the address of the frame groove 32 point module can not be used.
For example a 16-point discrete input module and a 16-point discrete output module using bit input and output image tables when an IO group:
Addressing groove : an IO module IO group to form a groove, i.e., each physical channel frame to a corresponding input and output image table word.
In the PLC frame can be mixed in any order 8-point or 16-point module.
例：带16点IO模块的1槽寻址及其IO映像表
1槽寻址中使用32点IO模块
1槽寻址中使用32点IO模块时，必须从偶数槽开始，在IO槽的2个相邻槽（奇偶对）中成对地安装一块输入模块和一块输出模块。如果不能按此规定把模块配对，那么一对槽中的一个槽必须空置。例如，如果0号插槽有一块32点输入模块，那么，1号IO槽必须插8点、16点或32点输出模块（或一块只使用背板电源、不占IO点的模块），否则，这个槽必须空置。带有两块32点IO模块的1槽寻址：
1/2槽寻址：半个IO模块槽组成一个IO组，也就是说，在框架中的每一个物理槽对应两个输入和两个输出映像表字。
因为在处理器映像表中，对每一个IO槽有32个输入位和32个输出位，所以可以在IO框架中以任意次序混用8点、16点和32点IO模块。
带32点IO模块的1/2槽寻址：
机架号的分配
在一个框架中的机架数取决于框架的大小和寻址方式
框架尺寸 2槽寻址 1槽寻址 1/2槽寻址
4槽 1/4机架 1/2机架 1机架
8槽 1/2机架 1机架 2机架
12槽 3/4机架 3/2机架 3机架
16槽 1机架 2机架 4机架
机架分配的一般原则：
1） 处理器驻留框架中分配一个（128个输入和128个输出）至4个机架。
2） 不能将处理器驻留本地IO机架分解成两个或多个框架。
3） 不能将不使用的处理器驻留本地IO组分配给远程IO机架
4） 不能以同一机架号来寻址扩展本地IO和远程IO框架。
例如：一个8槽的扩展本地IO框架设置为IO机架2的IO组0~3，则一个8槽的远程IO框架就不能设置为IO机架2的IO组4~7。
处理器驻留框架的机架首址：缺省为0，对于PLC-5/30、-5/40、-5/60处理器可以通过改变处理器控制字S:26（S是状态文件，26位字号）中的第2位，将缺省值改为1。
寻址远程IO机架的一般规则：1）一个远程IO机架可以是一个框架的一部分，也可以是一个满框架，甚至是多个框架。2）将远程IO机架数限制在所选用PLC-5处理器能够支持的最大机架数之内（最大机架数=处理器的IO点数/每个机架的IO点数（128点））。3）PLC-5处理器和1771-ASB适配器模块会自动将下一个更高标号的机架分配给框架中剩余的I/O组。例如，如果在处理器驻留框架中选择1/2槽寻址，并且使用的是16槽框架，那么处理器会在这个框架中寻址机架0，1，2，3。
本地IO机架分配规则：
PLC-5/40L或PLC-5/60L处理器的通道2是一个扩展本地IO扫描器。一个PLC-5/40L或PLC-5/60L处理器可用于扫描远程或本地IO机架。
1） 远程IO和扩展本地IO机架两者的总数必须不能超过处理器所允许的最大机架数（PLC-5/40L为16个机架，而PLC-5/60L为24个机架）。
2） 不要再扩展本地IO和远程IO之间分解机架号。例如，如果将机架的部分用作远程IO，就不能将机架的剩余部分用作扩展本地IO。
3） 可以将扩展本地IO机架分配给扩展本地IO母线上的多个框架。
4） 在PLC-5系统中，可以对每个扩展本地IO框架选择不同的硬件寻址方法。
3.3 PLC内存组织
PLC除了微处理器外，还包括存储器，其中一部分是用户存储器。用户存储器包含程序存储器和数据存储器。
处理器所检查和修改的所有数据均存储在内存中的数据文件中，数据包含：1）从输入模块接收的数据；2）发送到输出模块的数据；3）程序运算的中间结果；4）预先装入的数据；5）与指令有关的状态信息；6）与处理器操作有关的信息等。
在PLC-5中可以定义1000个数据文件（用文件号0~999表示），为了编址方便，每个文件均由一个字母（标识符）和一个文件号（0~999）来标识。一般，0~8号文件是系统为用户建立的缺省文件。如果需增加数据文件，用户可以通过设定适当的标识符及从9开始的文件号（9~999）来建立各种文件。
文件类型 标识符 文件号
输出 O 0
输入 I 1
状态 S 2
位 B 3
计时器 T 4
计数器 C 5
控制 R 6
整数 N 7
浮点 F 8
可定义的数据文件类型
类型 标识符 编号 大小
位 B 9~999 1000字
计时器 T 9~999 1000个3字元素
计数器 C 9~999 1000个3字元素
整数 N 9~999 1000字
浮点 F 9~999 1000个单字元素（每字32位）
ASCII A 9~999 1000字
BCD D 9~999 1000字
块传输 BT 9~999 1000个6字元素
控制 R 9~999 1000个3字元素
信息 MG 9~999 585个56
PID PD 9~999 399个82字元素
其他还有SFC状态（SC）文件和ASCII串（ST）文件等。
数据文件的地址：由文件名称（T）、文件号（f）、元素号（e）、字号（W）及位（b）构成，相互之间用一定的定界符分开，如一个计时器文件是一个三字元素，可表示为：
T f:e.W/b 位号（0~15）
数据文件从元素构成的字数可以分为：
单字元素：一个元素一个字
三字元素：一个元素三个字
多字元素：一个元素多个字
输入输出文件
I:017/01---- 1号机架、7号IO组，1号端子上的输入
O:026/00----2号机架，6号IO组，0号端子上的输出
注：输入/输出文件IO的机架号、IO组号、端子号全部用八进制表示，其他数据文件的元素号、字号及位号用十进制表示。
位文件B用在继电器逻辑指令、移位寄存器指令及顺序器指令中，其中每一个都可作为一个中间继电器来使用。两种编制方式：通过设定元素号（0~999共1000个字）和在元素内的位号（00~15共16位）进行编址，如B f:e/b；通过整个位文件依次从00开始对位进行编号，如B f/b
计时器文件T用在计时器指令中，用3字元素，字0是控制字（内部使用，不能编址），字1存储预置值PRE，字2存储累积值ACC。可编址的位：EN=位15，有效位，TT=位14，计时器计时位，DN=位13，计时器完成位；可编址的字：PRE=预置值，ACC=累积值。
T4:0.0/15 T4:0/15 T4:0.EN 等价
T4:0.1 T4:0.PRE 等价
T4:0.2 T4:0.ACC 等价
计数器文件C用于计数指令中，3字元素，字0是控制字，字1存储预置值，字2存储累积值。可编址的位：CU=位15，加数有效位；CD=位14，减数有效位；DN=位13，完成位；OV=位12，上溢位；UN=位11，下溢位。可编址的字：PRE=预置值，ACC=累积值。
整数文件用于放置一个16位的字，默认整数文件N7，整数文件可在元素及位上进行编址、寻址，如N f:e/b
N7:2 N7:2/08 N10:36
浮点文件F用于放置一个32位的字，浮点文件一般就是寻址到元素，F f:e
F8:0 F11:1
四． DF1协议
AB的PCCC指的是？
PCCC is the 'Application Layer Message Packet' of DF1
It is also referred to as PC-cubed. I'm not sure what it really stands for - a good guess would be Programmable Controller Communication Commands. These are the 'Application Layer Message Packets' as shown in the on-line DF1 Manual Chapter 6. AB people do not include the DST/SRC bytes when they speak of PCCC - these 2 bytes are really the DF1 header attached before a PCCC message.
What are the best commands to use for SLC5/MicroLogix?
The best commands for SLC5/MicroLogix controllers are:
- Protected Typed Logical Read with 3-Address Fields (Cmd=0x0F, SubFnc=0xA2)
- Protected Typed Logical Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAA)
- Protected Typed Logical Masked-Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAB)
- Protected Typed Logical Read with 2-Address Fields (Cmd=0x0F, SubFnc=0xA1)
- Protected Typed Logical Write with 2-Address Fields (Cmd=0x0F, SubFnc=0xA9)
Only the first two (0xA2/AA) are documented in the official DF1 protocol specification. The third (0xAB) is not documented but is commonly used by OPC servers; in fact a Rockwell engineer formally sent me details of it when I asked; it is not considered "secret".
The last two (0xA1/A9) are only of value if you're creating a slave driver since a few of Rockwell's software tools assume these are supported. While they are not documented in the DF1 specification, RSLogix5000 outlines support for them as part of its legacy support for PCCC messages. But there is no reason for an OPC server or master to use 0xA1/A9 since support by slaves is not universal. Using SubFnc 0xA1 instead of 0xA2 just drops one unrequired NULL byte from the command, so is of modest value. For example, to read N7:1 your Read command would include the 6 bytes "A2 02 07 89 01 00" for the 3-Address Fields form and only the 5 bytes "A1 02 07 89 01" for the 2-Address Fields form. Big deal, eh? Well, yes - a big deal if you try to use 0xA1 with a slave that doesn't understand 0xA1.
参考：
1． 罗克韦尔PLC培训教程https://wenku.baidu.com/view/2e7e2e0d84254b35effd3449.html
2． http://www.iatips.com/pccc_tips.html Rockwell一些协议tips