做一手房有哪些网站比较好啊,网络推广企业,百度导航,作品 上海高端网站设计接上篇
C#使用TCP-S7协议读写西门子PLC(二)-CSDN博客
这里我们进行封装读写西门子PLC的S7协议命令以及连接西门子PLC并两次握手
新建部分类文件SiemensS7ProtocolUtil.ReadWrite.cs
主要方法#xff1a;
连接西门子PLC并发送两次握手。两次握手成功后#xff0c;才真正连…接上篇
C#使用TCP-S7协议读写西门子PLC(二)-CSDN博客
这里我们进行封装读写西门子PLC的S7协议命令以及连接西门子PLC并两次握手
新建部分类文件SiemensS7ProtocolUtil.ReadWrite.cs
主要方法
连接西门子PLC并发送两次握手。两次握手成功后才真正连接到PLC
public OperateResult ConnectPlcAndHandshake(SiemensPlcCategory siemensPlcCategory, IPEndPoint endPoint, int timeout 3000)
生成一个写入字节数据的指令
public static OperateResultbyte[] BuildWriteByteCommand(OperateResultbyte, int, ushort analysis, byte[] data)
生成一个读取字数据指令头的通用方法【一个字Word占用两个字节Byte】
public static OperateResultbyte[] BuildReadCommand(OperateResultbyte, int, ushort[] address, ushort[] length)
SiemensS7ProtocolUtil.ReadWrite.cs源程序如下
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Sockets;
using System.Text;
using System.Threading.Tasks;namespace PlcSiemesS7Demo
{/// summary/// 西门子S7协议封装读写命令/// 关键方法:连接PLC并发送两次握手、生成写PLC命令生成读PLC命令/// (1).public OperateResult ConnectPlcAndHandshake(SiemensPlcCategory siemensPlcCategory, IPEndPoint endPoint, int timeout 3000)/// (2).public static OperateResultlt;byte[]gt; BuildWriteByteCommand(OperateResultlt;byte, int, ushortgt; analysis, byte[] data)/// (3).BuildReadCommand(OperateResultlt;byte, int, ushortgt;[] address, ushort[] length)/// /summarypublic partial class SiemensS7ProtocolUtil{#region 西门子S7协议握手【两次握手】命令固定.不同型号的PLC握手命令有少许不同private byte[] plcHead1 new byte[22]{0x03,0x00,0x00,0x16,0x11,0xE0,0x00,0x00,0x00,0x01,0x00,0xC0,0x01,0x0A,0xC1,0x02,0x01,0x02,0xC2,0x02,0x01,0x00};private byte[] plcHead2 new byte[25]{0x03,0x00,0x00,0x19,0x02,0xF0,0x80,0x32,0x01,0x00,0x00,0x04,0x00,0x00,0x08,0x00,0x00,0xF0,0x00,0x00,0x01,0x00,0x01,0x01,0xE0};private byte[] plcHead1_200smart new byte[22]{0x03,0x00,0x00,0x16,0x11,0xE0,0x00,0x00,0x00,0x01,0x00,0xC1,0x02,0x10,0x00,0xC2,0x02,0x03,0x00,0xC0,0x01,0x0A};private byte[] plcHead2_200smart new byte[25]{0x03,0x00,0x00,0x19,0x02,0xF0,0x80,0x32,0x01,0x00,0x00,0xCC,0xC1,0x00,0x08,0x00,0x00,0xF0,0x00,0x00,0x01,0x00,0x01,0x03,0xC0};#endregion/// summary/// 连接西门子PLC并发送两次握手。两次握手成功后才真正连接到PLC/// 使用网络终结点和PLC型号枚举进行连接/// /summary/// param namesiemensPlcCategory/param/// param nameendPoint/param/// param nametimeout/param/// returns/returnspublic OperateResult ConnectPlcAndHandshake(SiemensPlcCategory siemensPlcCategory, IPEndPoint endPoint, int timeout 3000){isConnected false;this.SiemensPlcCategory siemensPlcCategory;switch (siemensPlcCategory){case SiemensPlcCategory.S1200:case SiemensPlcCategory.S1500:plcHead1[21] 0;break;case SiemensPlcCategory.S300:plcHead1[21] 2;break;case SiemensPlcCategory.S400:plcHead1[21] 3;plcHead1[17] 0x00;break;case SiemensPlcCategory.S200Smart:plcHead1 plcHead1_200smart;plcHead2 plcHead2_200smart;break;default:plcHead1[18] 0;break;}// 重新连接之前先将旧的数据进行清空CoreSocket?.Close();OperateResultSocket result ConnectPlc(endPoint, timeout);if (result.IsSuccess){// 第一次握手 - First handshakeOperateResultbyte[] read_first SendDataAndWaitResult(result.Content, plcHead1);if (!read_first.IsSuccess){RecordLogEvent?.Invoke($第一次握手出错{read_first.Message});return read_first;}// 第二次握手 - Second handshakeOperateResultbyte[] read_second SendDataAndWaitResult(result.Content, plcHead2);if (!read_second.IsSuccess){RecordLogEvent?.Invoke($第二次握手出错{read_second.Message});return read_second;}// 返回成功的信号 CoreSocket result.Content;result.IsSuccess true;isConnected true;RecordLogEvent?.Invoke($连接PLC【{endPoint}】成功并且两次握手成功);}else{result.Content?.Close();CoreSocket null;result.IsSuccess false;}return result;}/// summary/// 连接西门子PLC并发送两次握手。两次握手成功后才真正连接到PLC/// 使用IP地址和端口【默认102】和PLC型号枚举进行连接/// /summary/// param namesiemensPlcCategory/param/// param nameipAddress/param/// param nameport/param/// param nametimeout/param/// returns/returnspublic OperateResult ConnectPlcAndHandshake(SiemensPlcCategory siemensPlcCategory, string ipAddress, int port 102, int timeout 3000){return ConnectPlcAndHandshake(siemensPlcCategory, new IPEndPoint(IPAddress.Parse(ipAddress), port), timeout);}private OperateResultbyte[] Read(OperateResultbyte, int, ushort[] address, ushort[] length){// 构建指令 - Build read commandOperateResultbyte[] command BuildReadCommand(address, length);if (!command.IsSuccess) return command;// 核心交互 - Core InteractionsOperateResultbyte[] read SendDataAndWaitResult(command.Content);if (!read.IsSuccess) return read;// 分析结果 - Analysis resultsint receiveCount 0;for (int i 0; i length.Length; i){receiveCount length[i];}if (read.Content.Length 21 read.Content[20] length.Length){byte[] buffer new byte[receiveCount];int kk 0;int ll 0;for (int ii 21; ii read.Content.Length; ii){if ((ii 1) read.Content.Length){if (read.Content[ii] 0xFF read.Content[ii 1] 0x04){Array.Copy(read.Content, ii 4, buffer, ll, length[kk]);ii length[kk] 3;ll length[kk];kk;}}}return OperateResult.CreateSuccessResult(buffer);}else{return new OperateResultbyte[]() { ErrorCode read.ErrorCode, Message 数据块长度校验失败请检查是否开启put/get以及关闭db块优化 };}}private OperateResultbyte[] ReadBitFromPLC(OperateResultbyte, int, ushort analysis){// 指令生成 - Build bit read commandOperateResultbyte[] command BuildBitReadCommand(analysis);if (!command.IsSuccess) return OperateResult.CreateFailedResultbyte[](command);// 核心交互 - Core interactiveOperateResultbyte[] read SendDataAndWaitResult(command.Content);if (!read.IsSuccess) return read;// 分析结果 - Analysis read resultint receiveCount 1;if (read.Content.Length 21 read.Content[20] 1){byte[] buffer new byte[receiveCount];if (22 read.Content.Length){if (read.Content[21] 0xFF read.Content[22] 0x03){buffer[0] read.Content[25];}}return OperateResult.CreateSuccessResult(buffer);}else{return new OperateResultbyte[](read.ErrorCode, 数据块长度校验失败请检查是否开启put/get以及关闭db块优化);}}/// summary/// 基础的写入数据的操作支持 - Operational support for the underlying write data/// /summary/// param nameentireValue完整的字节数据 - Full byte data/param/// returns是否写入成功的结果对象 - Whether to write a successful result object/returnsprivate OperateResult WriteBase(byte[] entireValue){OperateResultbyte[] write SendDataAndWaitResult(entireValue);if (!write.IsSuccess) return write;if (write.Content[write.Content.Length - 1] ! 0xFF){// 写入异常 - WriteErrorreturn new OperateResult(write.Content[write.Content.Length - 1], 写入数据异常代号为 write.Content[write.Content.Length - 1]);}else{return OperateResult.CreateSuccessResult();}}/// summary/// 生成一个写入字节数据的指令 - Generate an instruction to write byte data/// /summary/// param nameanalysis内存区域标识起始地址*8DB块编号 /param/// param namedata原始的字节数据 - Raw byte data/param/// returns包含结果对象的报文 - Message containing the result object/returnspublic static OperateResultbyte[] BuildWriteByteCommand(OperateResultbyte, int, ushort analysis, byte[] data){byte[] _PLCCommand new byte[35 data.Length];_PLCCommand[0] 0x03;_PLCCommand[1] 0x00;// 长度 - Length_PLCCommand[2] (byte)((35 data.Length) / 256);_PLCCommand[3] (byte)((35 data.Length) % 256);// 固定 - Fixed_PLCCommand[4] 0x02;_PLCCommand[5] 0xF0;_PLCCommand[6] 0x80;_PLCCommand[7] 0x32;// 命令 发 - command to send_PLCCommand[8] 0x01;// 标识序列号 - Identification serial Number_PLCCommand[9] 0x00;_PLCCommand[10] 0x00;_PLCCommand[11] 0x00;_PLCCommand[12] 0x01;// 固定 - Fixed_PLCCommand[13] 0x00;_PLCCommand[14] 0x0E;// 写入长度4 - Write Length 4_PLCCommand[15] (byte)((4 data.Length) / 256);_PLCCommand[16] (byte)((4 data.Length) % 256);// 读写指令 - Read and write instructions_PLCCommand[17] 0x05;// 写入数据块个数 - Number of data blocks written_PLCCommand[18] 0x01;// 固定返回数据长度 - Fixed, return data length_PLCCommand[19] 0x12;_PLCCommand[20] 0x0A;_PLCCommand[21] 0x10;// 写入方式1是按位2是按字 - Write mode, 1 is bitwise, 2 is by word_PLCCommand[22] 0x02;// 写入数据的个数 - Number of Write Data_PLCCommand[23] (byte)(data.Length / 256);_PLCCommand[24] (byte)(data.Length % 256);// DB块编号如果访问的是DB块的话 - DB block number, if you are accessing a DB block_PLCCommand[25] (byte)(analysis.Content3 / 256);_PLCCommand[26] (byte)(analysis.Content3 % 256);// 写入数据的类型 - Types of writing data_PLCCommand[27] analysis.Content1;// 偏移位置 - Offset position 因65535*8 即0x07 FF F8 偏移地址占用三个字节下面注释的三行等价于BitConverter.GetBytes(Int32) //_PLCCommand[28] (byte)(analysis.Content2 / 256 / 256 % 256);//_PLCCommand[29] (byte)(analysis.Content2 / 256 % 256);//_PLCCommand[30] (byte)(analysis.Content2 % 256);byte[] offsetAddress BitConverter.GetBytes(analysis.Content2);_PLCCommand[28] offsetAddress[2];_PLCCommand[29] offsetAddress[1];_PLCCommand[30] offsetAddress[0];// 按字写入 - Write by Word_PLCCommand[31] 0x00;_PLCCommand[32] 0x04;// 按位计算的长度 - The length of the bitwise calculation_PLCCommand[33] (byte)(data.Length * 8 / 256);_PLCCommand[34] (byte)(data.Length * 8 % 256);data.CopyTo(_PLCCommand, 35);return OperateResult.CreateSuccessResult(_PLCCommand);}public static OperateResultbyte[] BuildWriteBitCommand(OperateResultbyte, int, ushort analysis, bool data){//OperateResultbyte, int, ushort analysis AnalysisAddress(address);if (!analysis.IsSuccess) return OperateResult.CreateFailedResultbyte[](analysis);byte[] buffer new byte[1];buffer[0] data ? (byte)0x01 : (byte)0x00;byte[] _PLCCommand new byte[35 buffer.Length];_PLCCommand[0] 0x03;_PLCCommand[1] 0x00;// 长度 - length_PLCCommand[2] (byte)((35 buffer.Length) / 256);_PLCCommand[3] (byte)((35 buffer.Length) % 256);// 固定 - fixed_PLCCommand[4] 0x02;_PLCCommand[5] 0xF0;_PLCCommand[6] 0x80;_PLCCommand[7] 0x32;// 命令 发 - command to send_PLCCommand[8] 0x01;// 标识序列号 - Identification serial Number_PLCCommand[9] 0x00;_PLCCommand[10] 0x00;_PLCCommand[11] 0x00;_PLCCommand[12] 0x01;// 固定 - fixed_PLCCommand[13] 0x00;_PLCCommand[14] 0x0E;// 写入长度4 - Write Length 4_PLCCommand[15] (byte)((4 buffer.Length) / 256);_PLCCommand[16] (byte)((4 buffer.Length) % 256);// 命令起始符 - Command start character_PLCCommand[17] 0x05;// 写入数据块个数 - Number of data blocks written_PLCCommand[18] 0x01;_PLCCommand[19] 0x12;_PLCCommand[20] 0x0A;_PLCCommand[21] 0x10;// 写入方式1是按位2是按字 - Write mode, 1 is bitwise, 2 is by word_PLCCommand[22] 0x01;// 写入数据的个数 - Number of Write Data_PLCCommand[23] (byte)(buffer.Length / 256);_PLCCommand[24] (byte)(buffer.Length % 256);// DB块编号如果访问的是DB块的话 - DB block number, if you are accessing a DB block_PLCCommand[25] (byte)(analysis.Content3 / 256);_PLCCommand[26] (byte)(analysis.Content3 % 256);// 写入数据的类型 - Types of writing data_PLCCommand[27] analysis.Content1;// 偏移位置 - Offset position_PLCCommand[28] (byte)(analysis.Content2 / 256 / 256);_PLCCommand[29] (byte)(analysis.Content2 / 256);_PLCCommand[30] (byte)(analysis.Content2 % 256);// 按位写入 - Bitwise Write_PLCCommand[31] 0x00;_PLCCommand[32] 0x03;// 按位计算的长度 - The length of the bitwise calculation_PLCCommand[33] (byte)(buffer.Length / 256);_PLCCommand[34] (byte)(buffer.Length % 256);buffer.CopyTo(_PLCCommand, 35);return OperateResult.CreateSuccessResult(_PLCCommand);}/// summary/// 解析地址返回元组【地址类型起始地址DB块编号】/// /summary/// param nameplcRegisterCategory寄存器类型/param/// param nameoffsetAddress偏移量偏移地址/param/// param namedbNumberDB块号/param/// param namebitIndex位索引0~7/param/// returns/returnsprivate static OperateResultbyte, int, ushort AnalysisAddress(PlcRegisterCategory plcRegisterCategory, ushort offsetAddress, ushort dbNumber 0, int bitIndex 0){//地址类型起始地址DB块编号OperateResultbyte, int, ushort result new OperateResultbyte, int, ushort();result.Content3 0;switch (plcRegisterCategory){case PlcRegisterCategory.DB:result.Content1 0x84;result.Content2 offsetAddress * 8 bitIndex;result.Content3 dbNumber;break;case PlcRegisterCategory.M:result.Content1 0x83;result.Content2 offsetAddress * 8 bitIndex;break;case PlcRegisterCategory.Input:result.Content1 0x81;result.Content2 offsetAddress * 8 bitIndex;break;case PlcRegisterCategory.Quit:result.Content1 0x82;result.Content2 offsetAddress * 8 bitIndex;break;case PlcRegisterCategory.T:result.Content1 0x1D;result.Content2 offsetAddress * 8 bitIndex;break;case PlcRegisterCategory.C:result.Content1 0x1C;result.Content2 offsetAddress * 8 bitIndex;break;case PlcRegisterCategory.V:result.Content1 0x84;result.Content2 offsetAddress * 8 bitIndex;result.Content3 1;break;default:result.Message 输入的类型不支持请重新输入;result.Content1 0;result.Content2 0;result.Content3 0;return result;}result.IsSuccess true;return result;}/// summary/// 生成一个读取字数据指令头的通用方法【一个字Word占用两个字节Byte】 -/// A general method for generating a command header to read a Word data/// /summary/// param nameaddress起始地址例如M100I0Q0DB2.100 -/// Start address, such as M100,I0,Q0,DB2.100/param/// param namelength读取数据长度 - Read Data length/param/// returns包含结果对象的报文 - Message containing the result object/returnspublic static OperateResultbyte[] BuildReadCommand(OperateResultbyte, int, ushort[] address, ushort[] length){if (address null) throw new NullReferenceException(address);if (length null) throw new NullReferenceException(count);if (address.Length ! length.Length) throw new Exception(两个参数的个数不一致);if (length.Length 19) throw new Exception(读取的数组数量不允许大于19);int readCount length.Length;byte[] _PLCCommand new byte[19 readCount * 12];// _PLCCommand[0] 0x03; // 报文头 - Head_PLCCommand[1] 0x00;_PLCCommand[2] (byte)(_PLCCommand.Length / 256); // 长度 - Length_PLCCommand[3] (byte)(_PLCCommand.Length % 256);_PLCCommand[4] 0x02; // 固定 - Fixed_PLCCommand[5] 0xF0;_PLCCommand[6] 0x80;_PLCCommand[7] 0x32; // 协议标识 - Protocol identification_PLCCommand[8] 0x01; // 命令发 - Command: Send_PLCCommand[9] 0x00; // 冗余标识保留- redundancy identification (reserved): 0x0000;_PLCCommand[10] 0x00; // protocol data unit reference; it’s increased by request event;_PLCCommand[11] 0x00;_PLCCommand[12] 0x01; // 参数命令数据总长度 - Parameter command Data total length_PLCCommand[13] (byte)((_PLCCommand.Length - 17) / 256);_PLCCommand[14] (byte)((_PLCCommand.Length - 17) % 256);_PLCCommand[15] 0x00; // 读取内部数据时为00读取CPU型号为Data数据长度 - Read internal data is 00, read CPU model is data length_PLCCommand[16] 0x00;// _PLCCommand[17] 0x04; // 读写指令04读05写 - Read-write instruction, 04 read, 05 Write_PLCCommand[18] (byte)readCount; // 读取数据块个数 - Number of data blocks readfor (int ii 0; ii readCount; ii){//// 指定有效值类型 - Specify a valid value type_PLCCommand[19 ii * 12] 0x12;// 接下来本次地址访问长度 - The next time the address access length_PLCCommand[20 ii * 12] 0x0A;// 语法标记ANY - Syntax tag, any_PLCCommand[21 ii * 12] 0x10;// 按字为单位 - by word_PLCCommand[22 ii * 12] 0x02;// 访问数据的个数 - Number of Access data_PLCCommand[23 ii * 12] (byte)(length[ii] / 256);_PLCCommand[24 ii * 12] (byte)(length[ii] % 256);// DB块编号如果访问的是DB块的话 - DB block number, if you are accessing a DB block_PLCCommand[25 ii * 12] (byte)(address[ii].Content3 / 256);_PLCCommand[26 ii * 12] (byte)(address[ii].Content3 % 256);// 访问数据类型 - Accessing data types_PLCCommand[27 ii * 12] address[ii].Content1;// 偏移位置 - Offset position_PLCCommand[28 ii * 12] (byte)(address[ii].Content2 / 256 / 256 % 256);_PLCCommand[29 ii * 12] (byte)(address[ii].Content2 / 256 % 256);_PLCCommand[30 ii * 12] (byte)(address[ii].Content2 % 256);}return OperateResult.CreateSuccessResult(_PLCCommand);}/// summary/// 生成一个位读取数据指令头的通用方法 -/// A general method for generating a bit-read-Data instruction header/// /summary/// param nameaddress起始地址例如M100.0I0.1Q0.1DB2.100.2 -/// Start address, such as M100.0,I0.1,Q0.1,DB2.100.2/// /param/// returns包含结果对象的报文 - Message containing the result object/returnspublic static OperateResultbyte[] BuildBitReadCommand(OperateResultbyte, int, ushort analysis){//OperateResultbyte, int, ushort analysis AnalysisAddress(address);if (!analysis.IsSuccess) return OperateResult.CreateFailedResultbyte[](analysis);byte[] _PLCCommand new byte[31];_PLCCommand[0] 0x03;_PLCCommand[1] 0x00;// 长度 - Length_PLCCommand[2] (byte)(_PLCCommand.Length / 256);_PLCCommand[3] (byte)(_PLCCommand.Length % 256);// 固定 - Fixed_PLCCommand[4] 0x02;_PLCCommand[5] 0xF0;_PLCCommand[6] 0x80;_PLCCommand[7] 0x32;// 命令发 - command to send_PLCCommand[8] 0x01;// 标识序列号_PLCCommand[9] 0x00;_PLCCommand[10] 0x00;_PLCCommand[11] 0x00;_PLCCommand[12] 0x01;// 命令数据总长度 - Identification serial Number_PLCCommand[13] (byte)((_PLCCommand.Length - 17) / 256);_PLCCommand[14] (byte)((_PLCCommand.Length - 17) % 256);_PLCCommand[15] 0x00;_PLCCommand[16] 0x00;// 命令起始符 - Command start character_PLCCommand[17] 0x04;// 读取数据块个数 - Number of data blocks read_PLCCommand[18] 0x01;//// 读取地址的前缀 - Read the prefix of the address_PLCCommand[19] 0x12;_PLCCommand[20] 0x0A;_PLCCommand[21] 0x10;// 读取的数据时位 - Data read-time bit_PLCCommand[22] 0x01;// 访问数据的个数 - Number of Access data_PLCCommand[23] 0x00;_PLCCommand[24] 0x01;// DB块编号如果访问的是DB块的话 - DB block number, if you are accessing a DB block_PLCCommand[25] (byte)(analysis.Content3 / 256);_PLCCommand[26] (byte)(analysis.Content3 % 256);// 访问数据类型 - Types of reading data_PLCCommand[27] analysis.Content1;// 偏移位置 - Offset position_PLCCommand[28] (byte)(analysis.Content2 / 256 / 256 % 256);_PLCCommand[29] (byte)(analysis.Content2 / 256 % 256);_PLCCommand[30] (byte)(analysis.Content2 % 256);return OperateResult.CreateSuccessResult(_PLCCommand);}}
}
