PLC User - S Manual of Communication Module
PLC User - S Manual of Communication Module
Communication Module
User Manual & Application Case
User Manual
目 录
Programmable
Logic Controller
Model: SMC-T01EN
Power: DC24V 0.4A
P/N:1605261053011810012
SAVCH ELECTRIC CO.,LTD.
S M C - T 01 E N
Product name Output type
N (No digital I/O)
0
COM
95.0
35.0
SMC-T01EN
PWR
LINK
82.0 30.0
1
1.4 Front / side view
① ⑥ ⑦ ⑧
⑨
TX
RS232
Rx
GND
A+
RS485
B-
③
0
④ COM
SMC-T01EN
PWR
LINK
2
1.7 Module terminal wiring diagram
Tx
RS232
Rx
GND
RS485
A+
B-
3
Chapter 2 Application Case
Tx Tx Tx
RS232
RS232
RS232
Rx Rx Rx
GND GND GND
RS485
RS485
RS485
A+ A+ A+
24G S/S X4 X5 X6 X7
AC POWER L N +24V X0 X1 X2 X3 B- B- B-
0 1 2 3 4 5 6 7
0 0 0
DI(X)
COM COM COM
PWR
SMC-T01EN SMC-T01EN SMC-T01EN
RUN
SMC-S16MT
COM
ERR PWR PWR PWR
ON DIP LINK LINK LINK
DO(Y) AI AQ
1 2 3 4 0 1 2 3 4 5 0 0
Y0 Y1 Y4 Y5 GND A+ B- RS485
C0 Y2 Y3 C4 Y6 Y7
When the communication module is expanded, the communication port closest to the host PLC is COM3,
next is COM4 and last is COM5. The position of communication module can be random, and the communication
port number can be viewed in the hardware configuration, as shown in the figure below:
4
2.5 SAVCH bus communication example description: Communication between
two SAVCH host PLCs
This example shows the communication between two host PLC. It is known that communication baud rate is
19200 between the master and slave PLC, data format is N 8 2 RTU, and slave station number is 2.
① Master reads 2 # slave data: for example, read X0 of slave into master M0; read X3 of slave into master
M11, etc., as follows:
② Master writes 2 # slave data: for example, write V0 of master into slave V100; write V50 of master into
slave V102, etc., as follows:
Programming ideas: In the SAVCH PLC programming software, set up SAVCH bus read communication
table, special floating-point and 32-bit data occupy two consecutive addresses, if the master wants to write the
floating-point or 32-bit data into the slave, it needs to fill two consecutive registers, such as write V11V12 into
V80V81, as follows:
5
In the SAVCH PLC programming software, set up SAVCH bus write communication table, as follows:
After the table is established, use HWRD and HWWR instructions, and enter the slave address in the
"Slave" terminal of the instructions. In this case, the slave PLC address is "2", directly input the table name in the
"Table", or double-click the terminal to select the established table. "Port "is the communication port number, as
described in the second point above, "2" indicates the master's COM2 for 485 communication port. In this way,
the communication program which reads and writes from the slave is completed, as follows:
Judge the communication error code situation through the communication instruction "Out" terminal. "Out"
terminal has power indicating that communication is very good without error; "Out" terminal has no power
indicating that the communication does not succeed, in this way, just check the slave parameter settings and
networking wiring; "Out" terminal flashes to indicate a communication error code, and occasional error code in
communications does not matter, communication may be disturbed, therefore, it is possible to check whether the
outside uses shielded twisted pair or not, also, multiple slaves need to be in the way of "hand in hand". The
following is an example of a disconnection alarm program for slave communication:
Communication disconnection time can be set according to the actual, the above when M5 is more than 5
seconds in OFF state, T0 coil will indicates communication disconnection alarm.
6
2.6 Modbus communication example introduction:
In this example, the host PLC is expanded with a communication expansion module SMC-T01EN,
communication port is 3, the communication port is connected to a SAVCH thermal resistance module
SMC-TR08EN and a inverter:
① SMC-TR08EN module is built-in RS485 port which can be used for remote IO, supporting Modbus RTU /
ASCII protocol, communication parameters is 19200 N 8 2 RTU, station number is 1 #, from the
programming software online help - hardware manual - expansion module parameters, we can see the 8
temperature values are stored in Modbus start address 10 ~ 17H, which is decimal 16 ~ 23.
② Inverter, 9600 E 7 1 ASCII, station No. 2 #. It is required to read and write the inverter frequency,from the
inverter manual we can see that the parameter address of the setting frequency is 2001H, decimal 8193,
and the parameter address of the operating frequency is 2103H, decimal 8451. In this way, write the
program as follows:
Port = 3, in this example, it indicates the communication port of SMC-T01EN. 8193 can be quickly entered,
such as put the mouse on the "Write" terminal, then it can directly enter 0x2001.
7
2.7 Typical freedom protocol applications
Serial communication COMM instruction is divided into high-low byte mode and low byte mode. In
accordance with the sending and receiving, it also can achieve that only sending、only receiving、waiting for data
receiving after sending commands. For more detail of instructions introduction, you can refer to the software
online help. As for freedom communication, the essence is to understand the communication protocol, the
following we will introduce the typical application of COMM instruction.
Assuming that the net weight of weighing instrument is 1.23Kg, then the weighing instrument will send 18
bytes of data to the PLC according to the above format, the data is in hexadecimal:
53 54 2C 4E 54 2C 2B 20 20 20 31 2E 32 33 4B 67 0D 0A
The above data indicating the weight is 2B 20 20 20 31 2E 32 33, it represents 1.23 Kg. 2B is the "+" sign, 20
is a space, 2E is the decimal point, 30 ~ 39H is the character 0 ~ 9. So we just use the COMM instruction to
receive the 18 bytes back, and parse out the weight we want. In this way, we write the COMM instruction below:
8
When PLC is running, and COMM instruction is scanned, since Tn = 0, there is no need to send command.
Therefore, COMM instruction will be in receiving status according to baud rate and data format defined by
protocol, at this moment, when the weighing instrument sends the data of 53 54 2C 4E 54 2C 2B 20 20 20 31 2E
32 33 4B 67 0D 0A, the COMM instruction will receive the data, and store it in the start register of V200, when the
data is stored, first stored in the low byte of the register, then stored the high byte of the register, as follows:
...... 0A0D 674B 3332 2E31 2020 202B 2C54 4E2C 5453
...... V208 V207 V206 V205 V204 V203 V202 V201 V200
From the above we can see that we want the data in V203 ~ 206, these four registers, a total of 8 bytes. The
next is data analysis, SAVCH has a very convenient instruction of character to floating point, that is, CTOF. So we
write the program as follows, and get the simulation results through communication simulator running:
Click on the "simulation", open the communication simulation in the debug menu, fill in the data in the
answering area, click on the "answer" to simulate the communication program, if the serial interface of computer
is actually connected to instrumentation, you can check the "use the actual serial port" so that the software can
co-simulation with the actual instrument, very convenient.
9
The final simulation program is as follows:
10
In this case, the instrument address is 1, baud rate is 9600, data format is N 8 1. When reading the current
temperature, assume the current temperature is 254.1 ℃ (2541 = 0x9ED), then send and reply data as follows
(why the following data is the content for sending and replying , please refer to the AI instrument manual
agreement section):
Send: 81 81 52 00 00 00 53 00
Reply: ED 09 00 00 00 60 00 00 EE 69
In general, read commands are fixed. SAVCH provides a very convenient initialized data table: it is initial
register value table, the commands which will be sent are filled in the initial register value table, in this case, the
starting address is V1020, the length is 4, a total of 8 bytes, as follows:
...... 00 53 00 00 00 52 81 81
...... V1023 V1022 V1021 V1020
The COMM instruction has two modes, one is high-low byte mode, first, sending the low-byte data of the
start address , then, sending the high-byte, and so on. The other is the low-byte mode of COMM.LIB. You can
double-click to set the COMM instruction, it only sends the low-byte data of the register. In this example of
high-low byte mode, first, send the low-byte 81H of V1020, then send high-byte 81H, send the low-byte 52H of
V1021, then send high-byte 00H of V1021 .... and so on.
The following is the initial register values table of "read AI instrument commands":
11
Then according to the regulation of the instrument, we write the COMM instruction, and the simulation is
carried out as follows:
When PLC is running, COMM instruction is scanned,because Tn=8> 0, COMM instruction will send
command to communication port 2 according to the baud rate and data format defined by protocol: 81 81 52 00
00 00 53 00, after sending completed, judge Rn=10> 0, then it turns into the receiving state. After receiving the
command, it will reply the data: ED 09 00 00 00 60 00 00 EE 69, the data received by the PLC will be placed in
the starting register of V50, first it will be stored in the low byte of V50, and then it will be stored in the high byte of
V50 , low byte of V51, high byte of V51 ...... and so on, when receiving data of Rn=10, OUT terminal is ON,
marking the success of this communication
....... 69 EE 00 00 60 00 00 00 09 ED
...... V54 V53 V52 V51 V50
Received data is arranged as shown above, hexadecimal 09ED is the decimal number 2541, a decimal
precision, which is the actual 254.1 ℃.
12
2.8 The system registers of communication timeout time, communication
instruction execution interval, communication port character receiving
timeout time and application introduction
2.8.1 Communication timeout time
The unit is ms, the default is 200, that means 200ms, indicating the time which is waiting for the response
and replying data from the slave, after PLC sending commands to communication port. Communication timeout
is used for PLC master station, there is no need to use this communication system register when PLC is used as
a slave station.
Power-off Default
System register Note Read/write
preserve value
COM1 and Ethernet communication timeout
SV45 R/W Yes 200
time, unit: ms
SV47 COM2 communication timeout time, unit: ms R/W Yes 200
SV55 COM3 communication timeout time, unit: ms R/W Yes 200
SV57 COM4 communication timeout time, unit: ms R/W Yes 200
SV59 COM5 communication timeout time, unit: ms R/W Yes 200
In general, the value is default, it is generally used in the situation when some slave instruments response
data slowly, for example, when slave instrument receives the commands from PLC, it will take 0.5 second to
reply the data, at this time, you need to increase the communication timeout time. If you need to increase the
communication timeout time, there are two ways for settings:
① In the PLC program, use MOV assignment instruction to assign values to system registers, such as
COM2 communication timeout time setting.
② After PLC online, in the menu bar - PLC pull-down option - communication parameters settings-set the
communication timeout time.
13
③ Serial debugging tools can record the data's interval time from sending to replying. Therefore, it is
recommended that before PLC and instruments communication, you can use the serial port debugging
tools to communicate with instruments, so that we can confirm the instrument station number, baud rate,
data format, and the Modbus addresses to be read and written, response time and so on. In this way,
writing PLC communication instruction will be easier. For example, the following figure of 16ms:
14
Power-off Default
System register Note Read/write
preserve value
COM1 communication port character receiving
SV851 R/W Yes 0
timeout time, unit: ms
COM2 communication port character receiving
SV852 R/W Yes 0
timeout time, unit: ms
COM3 communication port character receiving
SV853 R/W Yes 0
timeout time, unit: ms
COM4 communication port character receiving
SV854 R/W Yes 0
timeout time, unit: ms
COM5 communication port character receiving
SV855 R/W Yes 0
timeout time, unit: ms
Note:
⚫ Four series of E/H/M can be set separately.
⚫ Communication port character receiving timeout time is used for PLC master station, there is no need to use
this communication system register when PLC is used as a slave station.
2.9 When PLC is used as slave station, there is no need to to write any
communication program, and supporting a variety of human-machine
interfaces and configuration softwares
CPU host which is built-in Ethernet port and two serial ports can be extended to the Ethernet port plus five
serial ports, each communication port can be programmed and networked, also it can be used as master or slave.
Support the networking ways of 1: N, N: 1, N: N, support a variety of human-machine interfaces and
configuration softwares, also it can be networked with any third-party device which has communication functions
(such as inverters, instruments, bar-code readers, etc.). The figure below shows the networking way of N:1 when
the PLC is used as a slave:
COM1
RS232
Modbus
Text display PLC
There is no need to write any program when PLC is used as slave, the default parameter is 19200 N 8 2
RTU, station number is 1. For configuration software and touch screen, which has the built-in SAVCH driver can
directly select SAVCH driver, if there is no SAVCH driver, you can choose Modicon's Modbus driver. The
corresponding Modbus communication code table of SAVCH is as the following figure:
① SAVCH PLC bit component table (equivalent to Modbus address type of 0,1, supporting Modbus function
code of 1, 2, 5, 15)
15
Modbus communication address
Comp Read/Write
Name Range code Description
onent attribute
Hexadecimal Decimal
X Digital input X0~X1023 read 0x0000~0x03FF 0~1023
Y Digital output Y0~Y1023 read/write 0x0600~0x09FF 1536~2559
M Auxiliary relay M0~M12287 read/write 0x0C00~0x3BFF 3072~15359
T Timer(coil) T0~T1023 read/write 0x3C00~0x3FFF 15360~16383
C Counter(coil) C0~C255 read/write 0x4000~0x40FF 16384~16639
System Status all be read/
SM SM0~SM215 0x4200~0x42D7 16896~17111
bit some be wrote
S Step relay S0~S2047 read/write 0x7000~0x77FF 28672~30719
② SAVCH PLC register component table (equivalent to Modbus address type of 3, 4, supporting Modbus
function code of 3,4,6,16)
Modbus communication address
Comp Read/Write
Name Range code Description
onent attribute
Hexadecimal Decimal
Used when
Modbus
Expansion
all be read/ accesses
CR module CR0~CR255 0x00~0xFF 0~255
some be wrote expansion
parameters
module
parameters
Analog input
AI AI0~AI255 read 0x0000~0x00FF 0~255
register
Analog output
AQ AQ0~AQ255 read/write 0x0100~0x01FF 256~511
register
Internal data
V V0~V14847 read/write 0x0200~0x3BFF 512~15359
register
Current value
TV TV0~TV1023 read/write 0x3C00~0x3FFF 15360~16383
of timer
Only
Current value CV48~CV79
CV CV0~CV255 read/write 0x4000~0x40FF 16384~16639
of counter are 32-bit
register
System all be read/
SV SV0~SV900 0x4400~0x4784 17408~18308
register some be wrote
③ Description:
SAVCH PLC adopts standard Modbus protocol (supporting RTU and ASCII format) it can communicate with
all HMI and configuration softwares that support Modbus protocol.
SAVCH PLC's Modbus address number starts from 0, some HMI or configuration software starts from 1, if
HMI or configuration software's Modbus address starts from 0, then it directly uses the communication address,
for example M0 is 0x3072, V0 is 4x0512; If the Modbus address of the HMI or configuration software starts from
1, the component address number needs to be increased by 1, for example, M0 is 0x3073 [3072 + 1] and V0 is
4x0513 [512 + 1]. The first digit of the address is the Modbus protocol component type (0/1 is bit component, 3/4
is register component, type 0/4 means read-write, type 1/3 means read-only) , the rest of the digit is the
component address number.
16
2.10 How to judge the communication failure and program analysis when PLC
is used as slave
The communication disconnection alarm program when the master station of PLC communicates with
instruments has been introduced in the above example of "SAVCH bus communication example introduction:
communication between two SAVCH host PLC", then when the slave station of PLC communicates with the host
computer, if communication line is broken, or the host computer parameters have been modified , at this time, as
a slave of PLC, how to check the communication disconnection? The following ideas:
The host computer constantly writes M900 as OFF to PLC, the program sets M900 every second. T0 is used
for host computer communication failure alarm. If the M900 has a delay of 3 seconds before getting electricity, it
means the host computer does not write M900 to be OFF, so that we can judge that the communication between
the host computer and the PLC fails.
17
We choose the function code, set the type of components, component number, station number of slave
PLC and so on, then click generate, you can get the command: 01 03 02 64 00 01 C4 6D, the command which
sent by host computer can help to read the V100 value of PLC .
The check code calculator can also carry on the positional notation conversion at the same time, check the
data, calculate the serial data such as CRC, LRC, SUM and other check codes, for communication engineers,
this tool is a very convenient programming assistant.
2.12 The introduction of supportive baud rate, data format and communication
instructions when PLC communication port is used as a master/slave station
2.12.1 PLC communication port used as a master station:
Supported by S/H/M series host PLC communication port:
Baud rate 1200,2400,4800,9600,19200,38400,57600,115200
S/H/M host PLC N,8,2 RTU,E,8,1 RTU,O,8,1 RTU,N,7,2 ASCII,E,7,1
Data format
communication ASCII,O,7,1 ASCII,N,8, 1 RTU
port MODR / MODW / HWWR / HWRD / COMM / RCV /
Communication instruction
XMT
Description: Host PLC' communication port, that is, COM1: RS232 (round-mouth); COM2: RS485
(terminal of A + B- ).
18
2.13 PLC communication frequently asked questions
① In order to read the register value of instrument, Modbus address is 40001, in SAVCH Modbus, how
much to fill in Read of read instruction MODR?
A: Fill in 0. The first digit of the address is the Modbus protocol component type (0/1 is bit component, 3/4 is
register component, type 0/4 means read-write, type 1/3 means read-only) , the rest of the digits are
component address numbers. Besides, there is no need to add 1 when SAVCH PLC reads Modbus
device address, so as for the address 40001, it only fills 0 in Read terminal as SAVCH PLC reading.
Similarly, for example, an address is 40387, then as long as fill 386 in SAVCH instructions.
Hard address: The address is set through the 4-bit DIP switch of module hardware, address range 1-15.
Hardware address setting example:
③ Where can we find SAVCH PLC online tutorial? (SAVCH official website-www.SAVCH.com)
A: SAVCH official website-Supports-FAQ “’PLC online steps described in detail and online problem solution”
④ Where can we find the communication example program between SAVCH PLC and other manufacturers'
frequency converter instrument?
A: SAVCH official website-Download-Program example “SAVCH PLC program example.rar”
⑤ Where can we find the communication example program between SAVCH PLC and other configuration
software、text or HMI?
A: SAVCH official website-Download-Program example “Communication example between SAVCH PLC and
other configuration software, text or HMI.zip”
⑥ Where can we find the communication wiring diagram between SAVCH PLC and other manufacturers'
HMI?
A: SAVCH official website-Download-User Manual “communication wiring diagram between SAVCH PLC
and other manufacturers' HMI”
19
■ Innovate for more | win forever
■ Industry intelligence | Energy saving | Green power
Savch wechat
Service Number
Quanzhou Factory
Address:3# Zixin Road, Jiangnan Hi-Tech Industrial Park, Sales service contact address
Quanzhou, Fujian, China
Tel:0595-24678267 Fax:0595-24678203
Service Network
Website:www.savch.net
Qualification
Received ISO9001 and CE recognition