OMRON PLC hostlink protocol sorting


OMRON PLC hostlink protocol sorting

1. Common memory function area


Input relay} 272 points (17 CH) 0.00 ~ 16.15

Output relay} 272 points (17 CH) 100.00 ~ 116.15

Internal auxiliary relay: 4800 points (300 CH) 1200.00 ~ 1499.15 (1200 ~ 1499 CH)

37504 points (2344 CH) 3800.00 ~ 6143.15 (3800 ~ 6143 CH)

Internal auxiliary relay:

8192 points (512 CH) w000 00~W511. 15  (W0~W511 CH)

Temporary storage relay:

16 points tr0 ~ tr15

Hold relay:

8192 points (512 CH) H0 00~H511. 15 (H0~H511 CH)

Special auxiliary relays:

Read only (not writable) 7168 points (448 CH) A0 00~A447. 15 (A0~A447CH)

Read / write 8192 points (512 CH) a448 00~A959. 15 (A448~A959 CH)


4096 points t0 ~ t4095


4096 point C0 ~ c4095

DM area:

32K word d0 ~ d32767

Data register:

16 points (16 bits) DR0 ~ DR15

Index register:

16 points (32 bits) ir0 ~ ir15

Task flag:

32 points tk0000 ~ tk0031

2. Hostlink serial port test typical setting: 9600 e-7-2

3. Hostlink communication protocol has two modes: C-mode and fins

1. Cmode: it is specially used for hostlink communication instruction and adopts ASCII code, which is suitable for PLC communication of all Omron. Only the upper computer can send instructions to the CPU, and the CPU cannot actively send data to the upper computer.

2. Fins: the binary code adopted is applicable to the newly developed PLC. It can be used in a variety of network devices (Controller Link, Ethernet, etc.) and can be actively sent by CPU, IO module and host computer. Different instructions are applicable to different information receiving units. There are two link protocols: cmnd and hostlink. When the host computer is the sending source, the hostlink protocol must be used.

4. Communication protocol message sorting

The data of hostlink communication protocol consists of four parts.

1. Header code

2. Fins command

3. XOR check

4. End code

The following data is used to send the serial port debugging tool to PLC, so the following is composed of the above 1 and 2 parts

Header code: Red} fins command: Blue


Data analysis of red part:

@The last 1-2 bits are the PLC address. The default PLC address is 0, and 0-31 can be set

@The FA after is the header code, which can be “Fa”, “Rd” or “WR”

@The fifth digit after is the waiting time, which is 0 * 10ms by default

The following data from right to left are: ICF \ DA2 \ SA2 \ Sid each occupies one byte, and the default is 00. For specific settings, refer to hostlink (for details, refer to section 3-3-3 of hostlink communication reference manual w342-e1-15)

Operation example

(1) Read one word of cio100


Read: 0101 write: 0102

Function code B0: specify the corresponding register type (see attached table 1 for details)

006400: 0064 is the number of memory (hexadecimal 0064 is hexadecimal 100)

00 after 0064 is the bit of memory (hex 00)

0001: read 1 word

(2) Write cio100 05-100.09 bit address


0102: write data

31: W storage area

006405:100.05 (decimal system)

0005: write 5 consecutive bits

0101000001: write 5-bit data

(3) Distribution data: @ 00fa0000000000 10231001e06001000

Return data: @ 00fa0040000000102000040 * \ Cr

Content of distribution: write data (0102) to W30 register (001E) register W30 of W storage area (31) 06 (06), write 1 byte continuously (0001), and the content written is 0 (00)

Content returned: the operation before returning is write (0102), and the data is written normally (0000). The (* \ CR) attached to the data is the terminator of XOR check.

(4) Read / write D storage area

Rd instruction command format


0006 words with address w1023 of reading station 00

5. Message format

The order of communication between Omron cpm1a PLC and upper computer is that the upper computer sends command information to PLC first, and PLC returns response information to the upper computer. A set of data sent / received in each communication is called a “frame”. The frame is composed of data with less than 131 characters. If the transmitted data is to be sent in a split frame, the end of the split frame is replaced by the delimiter of one character of Cr code. After the sending party has the right to send the frame, hand it over to the sending party.

The basic format of transmission frame is:


Machine number

Identification code




Of which:

@- is the frame start flag;

Machine number – specifies the PLC to communicate with the upper computer (set in dm6653 of PLC);

Identification code – the communication command code of the frame (two bytes);

Text – set command parameters;

FCS – frame check code (two characters), which is the result of bit exclusive or operation of ASC Ⅱ codes of all characters from @ to the end of the text;

Terminator – command terminator. Set “*” and “enter” to indicate the end of the command.

The basic format of the response is:


Machine number

Identification code

End code




Of which:

@– is the frame start flag;

Machine number —- the PLC number of the response, which is the same as the PLC number specified by the upper computer;

Identification code —- the communication command code of the frame, which is the same as the command code sent by the upper computer;

End code — returns the status of whether there is an error at the end of the command;

Text – set the command parameters, which will take effect only when the upper computer has read data;

FCS – frame check code, which is calculated and given by PLC, and the calculation method is the same as above;

Terminator – command terminator.

6. Attention

If the communication protocol is ASCII code transmission, 1 word data = 4 byte character

That is: 1 word binary number, transmitted by as II code, will be converted into 4-byte as II code for transmission

Word is the unit of measurement, corresponding to 16bit = 2 bytes, byte ≠ character,

Character is a character that can hold a 1-byte ASII code or a 2-byte Chinese character encoded by Unicode.

7. 131 maximum characters

If the command communication is carried out according to the following, the command format is determined according to the official manual as follows:

① The starting character @, which must be placed at the beginning of each command// 1 ASCII code = 1 byte

② The node number is the PLC unit number, which is used to identify PLC, and the range is 0 ~ 30 (BCD number)// 2 ASCII codes

③ The command character is the purpose of sending the command, and a 2-character command code is set// 2 ASCII codes

④ The operation content represents the parameters of the command operation. The contents are different with different commands, up to 31 words// 31 * 4 = 122 ASCII codes

⑤ The check character is FCS check, which performs XOR operation on the content of the check, and the result is 2 characters// 2 ASCII codes

⑥ The ending character is * sign + Enter key//* Number and enter are 1 respectively, with 2 ASCII codes in total

Statistics 1 + 2 + 2 + 122 + 2 + 2 = 131 ASCII codes, i.e. 131 characters.

Recommended Today

Golang influxdb basic operation

Infixdb basic operation Basic operation connect [[email protected] ~]# influx -precision rfc3339 Connected to http://localhost:8086 version 1.8.0 InfluxDB shell version: 1.8.0 > precisionThe parameter indicates the format and precision of any returned timestamp. In the above example,rfc3339Yes, let influxdb returnRFC339Timestamp of format (yyyy-mm-ddthh: mm: SS. Nnnnnnnz). validate logon > auth username: icms password: [email protected] Operation database […]