PCCC：Programmable Controller Communication Commands.
AB PLC常用指令
根据http://www.iatips.com/pccc_tips.html，SLC5/MicroLogix常用指令如下：
The best commands for SLC5/MicroLogix controllers are:
- Protected Typed Logical Read with 3-Address Fields (Cmd=0x0F, SubFnc=0xA2)
- Protected Typed Logical Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAA)
- Protected Typed Logical Masked-Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAB)
- Protected Typed Logical Read with 2-Address Fields (Cmd=0x0F, SubFnc=0xA1)
- Protected Typed Logical Write with 2-Address Fields (Cmd=0x0F, SubFnc=0xA9)
Only the first two (0xA2/AA) are documented in the official DF1 protocol specification. The third (0xAB) is not documented but is commonly used by OPC servers; In fact a Rockwell engineer formally sent me details of it when I asked; it is not considered "secret".
The last two (0xA1/A9) are only of value if you're creating a slave driver since a few of Rockwell's software tools assume these are supported. While they are not documented in the DF1 specification, RSLogix5000 outlines support for them as part of its legacy support for PCCC messages. But there is no reason for an OPC server or master to use 0xA1/A9 since support by slaves is not universal. Using SubFnc 0xA1 instead of 0xA2 just drops one unrequired NULL byte from the command, so is of modest value. For example, to read N7:1 your Read command would include the 6 bytes "A2 02 07 89 01 00" for the 3-Address Fields form and only the 5 bytes "A1 02 07 89 01" for the 2-Address Fields form. Big deal, eh? Well, yes - a big deal if you try to use 0xA1 with a slave that doesn't understand 0xA1.
怎样单独写一位：
How do I write single bits on a SLC5/MicroLogix?
use the undocumented (but well supported) Cmd=0x0F SubFnc=0xAB Masked Write
The command looks much like the documented Protected Typed Logical Write with 3-Address Fields (Cmd=0x0F, SubFnc=0xAA) except you'll find an added 16-bit word of data. So here are examples of each:
0xAA 02 03 85 00 00 01 00
0xAB 02 03 85 00 00 01 00 01 00
0xAB 04 03 85 00 00 01 00 01 00 00 00
The first command (0xAA) in effect clears bits B3:0/1 to B3:0/15 and sets bit B3:0/0. So the entire first word of the B3 table is changed - often not the desired action. In contrast, the second command (0xAB) just sets B3:0/0 to 1 without affecting the other 15 bits of B3:0. Notice that the 16-bit "mask" is not included in the byte count of 2. The third command (0xAB) shows that more than one data word can be sent, but there is always just a single 16-bit mask. The third command would set B3:0/0 to "1" and clear B3:1/0 to "0". If you - for example - desire to set both bits B3:0/0 and B3:1/6 to "1", then you'd need to issue two separate commands since they don't share the same 16-bit mask.
AB PLC常用指令--具体
A2指令--protected typed logical read with three address fields
Reads data from a logical address in a SLC 500 module
读取N7:1一个字（2bytes）
request: 10 02 01 00 0F 00 36 0D A2 02 07 89 01 00 10 03 80 D8
reply: 10 06 10 02 00 01 4F 00 36 0D E8 03 10 03 75 65
读取N7:0五个字（10bytes）
request: 10 02 01 00 0F 00 08 52 A2 0A 07 89 00 00 10 03 8D 4D
reply: 10 06 10 02 00 01 4F 00 08 52 D0 07 E8 03 00 00 00 00 00 00 10 03 5F E2
AA指令--protected typed logical write with three address fields
Writes data to a logical address in a SLC processor
写B3:0
request: 10 02 01 00 0F 00 08 54 AA 04 03 85 00 00 03 00 01 00 10 03 DB B2
reply: 10 06 10 02 00 01 4F 00 08 54 10 03 AB 1C 10 05 10 05 10 05 10 05
示例
一组PLC数据定义：
DF1协议
DF1协议控制字符
DF1协议传输标志
DF1协议链路协议帧
Half-duplex
Full-duplex
DF1协议应用帧
