FACON-PLC

Communication
Protocol

FATEK AUTOMATION CORP.

3/16/2001

Ver. 1.1
 FACON PLC Communication Protocol
Contents

1: The definition of Master and Slave device ............................................................................................1

2: The communication message format of FACON PLC .....................................................................1

3: The communication error code of FACON PLC .................................................................................2

4: The function description of communication command .................................................................3

4.1 The accessible elements and its designation ....................................................... 3

4.2 The description of communication command ........................................................ 4

Command 40 Read the brief system status of PLC ....................................................... 6

Command 41 Control the PLC RUN/STOP.................................................................... 7

Command 42 Control single discrete element............................................................... 8

Command 43 Read multiple ENABLE/DISABLE status of discrete elements ................... 9

Command 44 Read multiple status of consecutive discrete elements ............................. 10

Command 45 Write multiple status of consecutive discrete elements ............................. 11

Command 46 Read multiple consecutive registers ........................................................ 12

Command 47 Write to multiple consecutive registers .................................................... 13

Command 48 Mixed read the arbitrary discrete and register data .................................. 14

Command 49 Mixed write the arbitrary discrete and registers........................................ 15

Command 4E Loop back test....................................................................................... 16

Command 4F Read program ....................................................................................... 17

Command 50 Write program........................................................................................ 18

Command 53 Read the detail system status of PLC ...................................................... 19

 The Communication Protocol of FACON PLC
T h e FA C O N P L C c o m m u n i c a t i o n p r o t o c o l i s a p p l i c a b l e f o r a l l c o m m u n i c a t i o n p o r t s o f FA C O N P L C
t h a t w o r k u n d e r t h e s t a n d a r d m o d e . A n y p e r i p h e r a l s t h a t w a n t t o c o m m u n i c a t e w i t h FA C O N P L C ,
b e s i d e s h a r d w a r e i n t e r f a c e , c o m m u n i c a t i o n p a r a m e t e r s m u s t a c c o r d a n c e w i t h FA C O N P L C a l s o t h e
format of the message must follow this communication protocol.

1. The definition of Master and Slave device

FA C O N P L C a c t s a s a s l a v e w h i l e c o m m u n i c a t i n g w i t h p e r i p h e r a l d e v i c e t h a t a l w a y s a c t s a s
m a s t e r w h e n c o m m u n i c a t e w i t h FA C O N P L C . A l l t h e p e r i p h e r a l d e v i c e s a c t i v e l y s e n d t h e m e s s a g e t o
t h e FA C O N P L C a n d FA C O N P L C w i l l p a s s i v e l y r e s p o n s e t h e m e s s a g e a f t e r r e c e i v e t h e m e s s a g e f r o m
m a s t e r.

Command message
Master Slave
(Peripheral devices) ( FA C O N P L C )
Response

2.The Message Format of FACON Communication Protocol

T h e r e a r e 6 f i e l d s i n t h e FA C O N P L C m e s s a g e i n c l u d i n g c o m m a n d ( m a s t e r ) a n d r e s p o n s e ( s l a v e )
message.

Sending direction
First send Last send


Start Slave Command End
Field
code station code Data Checksum code
name
No.
ASCII code STX H L H L 0 500 ASCII code H L ETX

LRC sum

Start code(STX) The ASCII code of STX is 02H in hexadecimal format. The start character is
STX both for command and response message. While receiving, can
discriminate the message start by checking the STX code.

The station No. of slave The station number consists of two hexadecimal characters. There is only
o n e m a s t e r s t a t i o n a n d 2 5 5 s l a v e s t a t i o n s c a n b e e x i s t e d f o r FA C O N P L C
communication network. Every slave station has a unique station number from
1 FEH (If the station No. is 0 means the message is for all slave station).

1
 When the master want to send a command message to a certain slave it will
put the station no. of the accordant slave into the slave station field of the
command message in order to address that slave. The slave will put its own
station no. into the slave station field of the response message then send
b a c k t o m a s t e r.

R e m a r k T h e s t a t i o n n o . o f FA C O N P L C a r e a l l s e t t o 1 b e f o r e s h i p m e n t . T h e s t a t i o n n o . c a n n o t b e
s e t t h r u t h e FA C O N c o m m u n i c a t i o n p r o t o c o l , i t c a n o n l y b e c h a n g e d b y u s i n g t h e F P - 0 7 o r
P r o g r a m m i n g s o f t w a r e s u c h a s P R O - L A D D E R o r W i n P r o l a d d e r.

Command code The command code consists of two hexadecimal characters. It is the action which
the master wants slave to execute. For example, to read or write the status of
discrete, forcing, run, stop The command code of the response message is
identical to the command message.

D a t a i n f o r m a t i o n T h e d a t a i n f o r m a t i o n c o n t a i n s 0 ( n o d a t a ) 5 0 0 A S C I I c h a r a c t e r s . T h e d a t a i n t h i s
field is to assign the address or value for reading or writing. The first data of the
response message is the error code. In normal condition (no error happened) the
error code must be 0(30H) and then follow the responding status or value in the
response message. When error happened, its value will be other than 0(30H)
and the data information will be absent.

Checksum Checksum is the summation of the hexadecimal value of ASCII code in the
previous fields and the sum will only takes byte value (two hexadecimal
value 00 FF) that is so called LRC (Longitudinal Redundancy Check) method.
This message will be checked with the same way at the receiving side when the
message is received. When the two check values are the same, it means the data
t r a n s f e r r e d c o r r e c t l y. I f t h e t w o c h e c k v a l u e s a r e d i ff e r e n t , t h e r e a r e s o m e e r r o r
happened. The calculation of LRC method is to add all the hexadecimal value (8
bits length) of ASCII code and ignore the carry to keep the check value at 8 bits
length.

End code (ETX) The hexadecimal code of ETX code of ASCII is 03H. The ETX code for both the
command or response message is the same. When the receiving side receives the
ETX code, it means that the data transmission of this message is ended and can
start to process the command.

3.The communication error code of FACON PLC

If the message has errors in command code, address or over range of value or hardware problem
will cause the slave device can not process the command comes from master device. If there is error
happened, slave device will respond the message to master device. No matter what command code or
data the master device sends, the format of responding message is all the same. Including the
required start code (STX), end code (ETX) and checksum value, the command code and station No.
will be sent back to master device. The slave device will judge what kind of the error and respond the
e r r o r c o d e t o m a s t e r d e v i c e a c c o r d i n g l y.

2
 F o l l o w i n g t a b l e i s t h e r e s p o n s e e r r o r c o d e o f FA C O N P L C

Error code (Hex) Description

0 No error
2 Illegal value (ex. Decimal format contains hexadecimal number)
3 Wr i t e p r o h i b i t e d ( P L C e q u i p p e d w i t h R O M PA C K )

Illegal command format (Includes illegal command code)

4
or command can not execute

5 Can not run (Ladder Checksum error when run PLC)

6 Can not run (PLC ID not identical with Ladder ID when run PLC)
7 Can not run (Syntax check error when run PLC)
Can not run (One or more instructions in ladder program is not
9
supported by this PLC)
A Illegal reference address

4.The function description of communication command

In this section will illustrate the format of the command and response messages for all
c o m m a n d c o d e s t h a t FA C O N s u p p o r t e d . ( O n l y t h e s u c c e s s f u l r e s p o n s e w i l l b e i l l u s t r a t e d , f o r t h e e r r o r
response please refer section 3)

4.1 The accessible elements and its designation

The main function of PLC communication is to read and write the status or value inside PLC
elements. Concerning the discrete and register which are available for read and write are designated
and referenced by following table
Elements

16 bits register
Symbol

Discrete address 32 bits register address

Name address
(5 characters) (7 characters)
(6 characters)

X Input discrete X0000 X9999 WX0000 WX9984 DWX0000 DWX9968

Y Output relay Y0000 Y9999 WY0000 WY9984 DWY0000 DWY9968
Discrete

M Internal relay M0000 M9999 WM0000 WM9984 DWM0000 DWM9968

S Step relay S0000 S9999 WS0000 WS9984 DWS0000 DWS9968
T Timer discrete T0000 T9999 WT0000 WT9984 DWT0000 DWT9968
C Counter discrete C0000 C9999 WC0000 WC9984 DWC0000 DWC9968
TMR Timer register RT 0 0 0 0 RT 9 9 9 9 D RT 0 0 0 0 D RT 9 9 9 8
Data register

CTR Counter register RC0000 RC9999 DRC0000 DRC9998

HR Data register R00000 R65535 DR00000 DR65534

DR Data register D00000 D65535 DD00000 DD65534

3
 The discrete status(X Y M S)can combine 16 or 32 consecutive status as the 16-bit or 32-bit
r e g i s t e r, s u c h a s t h e a b o v e t a b l e W X o r D W X , b u t s h o u l d b e t h e
multiple of 8.

It needs 5 characters when assign the discrete address and 6 characters when assign the 16-bit
register address and 7 characters to assign the 32-bit register address.

T h e a d d r e s s r a n g e o f e l e m e n t s i n a b o v e t a b l e i s t h e l a r g e s t f o r a l l m o d e l s o f FA C O N P L C . T h e
users should notice the applicable address of each element for PLC in hand. (Ex. For FBE-PLC,
the range for X Y address is 0000 0255; for S is 0000 0999)If exceed the range of valid
address, PLC will reply error code A (illegal address), and will not execute that command.

4.2 The description of communication command

The description of communication command

Command Data size can be

code Function description processed with one Remark
(Hex) command

40 Read the brief system status of PLC

41 Control the RUN/STOP of PLC
42 Write single discrete status 1 point
Read multiple ENABLE/DISABLE status of
43 1 256 points
discrete elements
Read multiple status of consecutive 1 256 points
44
discrete elements
Write multiple status of consecutive 1 256 points
45
discrete elements
46 Read multiple consecutive registers data 1 6 4 Wo r d s
47 Write multiple consecutive registers data 1 6 4 Wo r d s
Mixed read of arbit rary discrete and
48 1 6 4 p o i n t s o r Wo r d s
register status
Mixed write of arbitrary discrete and
49 1 3 2 p o i n t s o r Wo r d s
register status
4E Loop back test 0 256 characters
4F Read program 6 4 Wo r d s
50 Write program 6 4 Wo r d s
53 Read the detail system status of PLC

4
1 The message of discrete status is represented by one character (1 means ON, 0 means
OFF) and the data of 16-bit register uses 4 characters to represent the value of one
WORD(0000H FFFFH)

2 T h e d a t a o f 3 2 - b i t r e g i s t e r i s D W ( t w o c o n s e c u t i v e Wo r d s ) , i t h a s t o u s e 8 c h a r a c t e r s t o
r e p r e s e n t i t s d a t a . I f t h e e l e m e n t i s 3 2 - b i t r e g i s t e r, t h e e l e m e n t h a s t o b e t r e a t e d a s 2 W.
For example, the command code 46 or 47 can process 64 16-bit elements and only can
process 32 32-bit elements.

3 In the command code 48 and 49, the data length is the total of discrete and register
element and can not exceed 64W(command 48) and 32W(command 49). As increase one
point, its total registers will decrease one word, vice versus. Because the data length of
32-bit element is 2 words, the applicable register or discrete will be reduced by 2 when
i n c r e a s e o n e 3 2 - b i t e l e m e n t . F o r e x a m p l e , t h e d a t a l e n g t h o f c o m m a n d 4 8 i s 1 6 4 W. I f
it read 20 32-bit elements, its message will occupy 40 words and remain 24W available
f o r d i s c r e t e o r 1 6 - b i t r e g i s t e r. I n t h i s e x a m p l e , c o m m a n d c o d e c a n r e a d 4 4 e l e m e n t s ( 2 0
32-bit elements and 24discrete or 16-bit elements) in one communication.

4 The operation (read and write) of consecutive discrete or register can be easily assigned
by the starting reference number and its size, no enumeration is required. The operating
elements can only being one of discrete or register and can not be operated mixed.

5 The command of arbitrary operating on objects can read or write several discrete and
register at will. As their number is not consecutive, you have to designate their number
h e n c e c a n a l l o w o p e r a t i n g o n d i s c r e t e a n d r e g i s t e r r a n d o m l y.

6 T h e R e a d a n d Wr i t e p r o g r a m o p e r a t i o n r e t r i e v e a l l t h e p r o g r a m a r e a o f P L C o r w r i t e t h e
PLC program to PLC. The maximum data transferring in one communication is 64 words
so that it will takes many times of communication to complete the operation.

5
 Command code 40 (Read the brief system status of PLC)

Format

Station No.

Command
S E
MASTER

code
T 0 1 4 0 C 7 T
Command
X X
H L H L H L
Command code

S E
Station No.

Check sum

Error code
T T

Check
PLC STATUS STATUS STATUS

sum
X 0 1 4 0 X
response 1 2 3

H L H L H L H L H L H L

B0 Run/Stop
0 Stop, 1- Run
B1 Battery status
0 Normal, 1 Low energy
H L B2 Ladder checksum status
STATUS 1 B7 B6 B5 B4 B3 B2 B1 B0 0 Normal , 1- Error
00H ,RESERVE B3 ROM PACK usage
FFH ,FB 8K Step program 0- Not use, 1- use
STATUS 2 53H ,FBE 8K Step program B4 WDT status
(LADDER 54H ,FBE 13K Step program 0 OK , 1 - Error
program 55H ,FBN 8K Step program B5 ID status
capacity) 56H ,FBN 13K Step program 0 Not set, 1- set
B6 Emergency stop status
STATUS 3 0 (Reserve for future) 0 OK , 1 Emergency stop
B7 0 (Reserve for future)

Ex. If the PLC is equipped with ROM PACK and ID is set in both PLC and ROM PACK and PLC status is
RUN under normal condition, the system status of PLC which MASTER read will be as following:
(B5,B3, and B0 are 1 and the other are all 0 that the STATUS is 29H) .

S E
MASTER
T 0 1 4 0 C 7 T
Command
X X
02H 30H 31H 34H 30H 43H 37H 03H

S E
PLC
T 0 1 4 0 0 2 9 0 0 0 0 2 2 T
response
X X
02H 30H 31H 34H 30H 30H 32H 39H 30H 30H 30H 30H 30H 32H 32H

6
 Command code 41 (Control the RUN/STOP of PLC)

Format

Station No.
Control code

Command
S E
MASTER

code
T 0 1 4 1 C 7 T
Command
X X
H L H L H L
Command code

S E
Station No.

Error code
T T

Check
PLC

sum
X 0 1 4 1 X
response

H L H L H L

Control 0 STOP
code 1 RUN

Ex. Control the PLC to RUN

S E
MASTER
T 0 1 4 1 1 F 9 T
Command
X X
02H 30H 31H 34H 31H 31H 46H 39H 03H

S E
PLC
T 0 1 4 1 0 F 8 T
response
X X
02H 30H 31H 34H 31H 30H 46H 38H 03H

7
 Command code 42 (Control single discrete element)

This command can control the designated discrete to do ENABLE, DISABLE, SET, RESET four
Format
operations.

Running code

Command code
Station No.
S E

Check
MASTER

sum
T 0 1 4 2 Discrete No. T
Command
X X

H L H L H L

Error code
S E

sum
Check
PLC
T 0 1 4 2 T
response
X X
H L H L H L

1 Disable
Running 2 Enable
code 3 Set
4 Reset

Ex. The following communication format is the example to DISABLE the discrete X16.

S E
MASTER
T 0 1 4 2 1 X 0 0 1 6 1 9 T
Command
X X
02H 30H 31H 34H 32H 31H 58H 30H 30H 31H 36H 31H 39H 03H

S E
PLC
T 0 1 4 2 0 F 9 T
response
X X
02H 30H 31H 34H 32H 30H 46H 39H 03H

8
 Command code 43 (Read multiple ENABLE/DISABLE status of discrete elements)

Format Use this command to read the ENABLE/DISABLE status of consecutive discrete elements.

Command code
Station No.
S Number N E

Check
MASTER

sum
T 0 1 4 3 Star No. T
Command
X X

H L H L H L
Command code
Station No.

Error code
S E

Status N
Status 0
Status 1

Check
PLC

sum
T 0 1 4 3 T
response
X X

H L H L H L

The range of two-digit Hex value can be 1N256

Number N
(When N=00H it equals to256)

Ex. Among the 7 consecutive discrete elements of Y10~Y16, if the DISABLE/ENABLE status of Y10, Y12,
Y16 are DISABLE, and the others are all ENABLE, the PLC status of this command reading is as

S E
MASTER
T 0 1 4 3 0 7 Y 0 0 1 0 4 B T
Command
X X
02H 30H 31H 34H 33H 30H 37H 59H 30H 30H 31H 30H 34H 42H 03H

S E
PLC
T 0 1 4 3 0 1 0 1 0 0 0 1 4 D T
response
X X
02H 30H 31H 34H 33H 30H 31H 30H 31H 30H 30H 30H 31H 34H 44H 03H

9
 Command code 44 (Read multiple status of consecutive discrete elements)

Format

Command code
Station No.
S E
Number

Check
MASTER

sum

T 0 1 4 4 Start No. T
Command
X X

H L H L H L
Command code
Station No.

Error code
S E

Status N
Status 0
Status 1

Check
PLC

sum
T 0 1 4 4 T
response
X X

H L H L H L

The range of two-digit Hex value can be 1N256

Number N
(When N=00H, is equals to 256)

Ex. If the status of X50, X52, X55 are all 0 and X51, X53, X54 are all 1, following is the status of reading
the consecutive 6 inputs (X50 X55)

S E
MASTER
T 0 1 4 4 0 6 X 0 0 5 0 4 E T
Command
X X
02H 30H 31H 34H 34H 30H 36H 58H 30H 30H 35H 30H 34H 44H 03H

S E
PLC
T 0 1 4 4 0 0 1 0 1 1 0 1 E T
response
X X
02H 30H 31H 34H 34H 30H 30H 31H 30H 31H 31H 30H 31H 44H 03H
X55 Status
X54 Status
No error X53 Status
N=6
X52 Status
X51 Status
X50 Status

10
 Command code 45 (Write multiple status of consecutive discrete elements)

Format

Command code
Station No.
S E

Status N
Status 0
Status 1
Number

Check
MASTER

sum

T 0 1 4 5 Start No. T
Command
X X

H L H L H L
Command code
Station No.

Error code
S E

Check
PLC

sum
T 0 1 4 5 T
response
X X

H L H L H L

The range of two-digit Hex value can be

Number N
1N256 (When N=00H it equals to256)

Ex. Write the status to consecutive 4 outputs (Y0 Y3) , Y0 and Y3 are 1, Y1 and Y2 are 0.

Y0 Status
Y1 Status
Y2 Status
Y3 Status

S E
MASTER
T 0 1 4 5 0 4 Y 0 0 0 0 1 0 0 1 0 B T
Command
X X
02H 30H 31H 34H 35H 30H 34H 59H 30H 30H 30H 30H 31H 30H 30H 31H 30H 42H 03H

S E
PLC
T 0 1 4 5 0 F C T
response
X X
02H 30H 31H 34H 35H 30H 46H 43H 03H

11
 Command code 46 (Read multiple data of consecutive registers)

Format

Command code
Stations No.
S E
Number

Check
MASTER Start register No.

sum
T 0 1 4 6 T
N

Command (6 or 7 words)
X X

H L H L H L

Command code
Station No.

Error code
S Data 1 Data N E

Check
PLC

sum
T 0 1 4 6 (4 or 8 (4 or 8 T
response
X number) number) X

H L H L H L

N consists of two-digit Hex number, its range can be 01H 40H or 20H (32-bit element)

The address of 16-bit register consists of 6 characters and the Hex value of its data consists of 4
characters. (It can be shown as 0000H FFFFH)

The address of 32-bit register consists of 7 characters and the Hex value of its data consists of 8
characters. (It can be shown as 00000000H FFFFFFFFH)

Ex. Read the data of consecutive 3 16-bit registers and start with R12. (R12,R13,R14)

S E
MASTER
T 0 1 4 6 0 3 R 0 0 0 1 2 7 5 T
Command
X X
02H 30H 31H 34H 36H 30H 33H 52H 30H 30H 30H 31H 32H 37H 35H 03H

S E
PLC
T 0 1 4 6 0 1 0 A 5 7 F C 4 0 0 0 1 8 9 T
response
X X
02H 30H 31H 34H 36H 30H 31H 30H 41H 35H 37H 46H 43H 34H 30H 30H 30H 31H 38H 39H 03H

The data The data The data

of R12 of R13 of R14

Refer to the above example, the PLC responds as R12=10A5H, R13=7FC4H, R14=0001H

12
 Command code 47 (Write to multiple consecutive registers)

Format

Command code
Station No.
S Number Data 1 Data N E

Check
MASTER Start register No.

sum
T 0 1 4 7 (4 or 8 (4 or 8 T
N

Command (6 or 7 words)
X numbers) numbers) X

H L H L H L
Command code
Station No.

Error code
S E

Check
PLC

sum
T 0 1 4 7 T
response
X X

H L H L H L

N consists of two-digit Hex number, its range can be 01H 40H or 20H (32-bit element)

The address of 16-bit register consists of 6 characters and the Hex value of its data consists of 4
characters. (It can be shown as 0000H FFFFH)

The address of 32-bit register consists of 7 characters and the Hex value of its data consists of 8
characters. (It can be shown as 00000000H FFFFFFFFH)

Ex. Write AAAAH to the 16-bit register WY8 and 5555H to WY24. This can use the multiple write register
command because WY8 and WY24 are consecutive registers.

Start element WY8 Data WY24 Data

numbers

S E
MASTER
T 0 1 4 7 0 2 WY 0 0 0 8 A A A A 5 5 5 5 8 0 T
Command
X X
02H 30H 31H 34H 37H 30H 32H 57H 59H 30H 30H 30H 38H 41H 41H 41H 41H 35H 35H 35H 35H 38H 30H 03H

S E
PLC
T 0 1 4 7 0 F F T
response
X X
02H 30H 31H 34H 37H 30H 46H 45H 03H

13
 Command code 48 Mixed read the arbitrary discrete and register data

Format

Command code
Station No.
Number N
S E

Check
MASTER Element No.1 Element No.N

sum
T 0 1 4 8 T
Command (5, 6 or 7 words) (5, 6 or 7 words)
X X

H L H L H L

Station No.

Error code
Command

S
PLC
code

T 0 1 4 8
response
X
H L H L

E

Check
Element No.1 data Element No.N data

sum
T
(1, 4 or 8 numbers) (1, 4 or 8 numbers)
X

H L

N consists of two-digit Hex number; it means the total numbers of elements. Its range can be 01H 40H.
Refer to the item 3
If the element is discrete, its address consists of 5 characters and status response consists of one
character 1 or 0
If the element is 16-bit register, its address consists of 6 characters and data response consists of
4-character Hex value.
If the element is 32-bit register, its address consists of 7 characters and data response consists of
8-character Hex value.

Ex. Read the status of R1 Y9 and DWM0 i.e. M31 M0

Element 1 Element 2 Element 3

S E
MASTER
T 0 1 4 8 0 3 R 0 0 0 0 1 Y 0 0 0 9 D W M 0 0 0 0 3 F T
Command
X X
02H 30H 31H 34H 38H 30H 33H 52H 30H 30H 30H 30H 31H 41H 41H 41H 41H 41H 44H 57H 4DH 30H 30H 30H 30H 33H 46H 03H

S
PLC
The status of T 0 1 4 8
response
element 2 X
02H 30H 31H 34H 37H
Data of element 1 Data of element 3

E
0 5 C 3 4 1 0 0 3 5 4 7 B A C 5 T
X
30H 35H 43H 33H 34H 31H 30H 30H 33H 35H 34H 37H 42H 41H 43H 35H 03H
In the above example, R1=5C34H and Y9 status is 1 ON DWM0=3547BAH

14
 Command code 49 Mixed write the arbitrary discrete and registers

Format

Number N
S
MASTER Element No.1 Element No.1 data Element No.N
T 0 1 4 9
Command (5, 6 or 7 words) (1, 4 or 8 words) (5, 6 or 7 words)
X

H L H L

Station No.
Command code

Check
Element No.N data

sum
T
(1, 4 or 8 words)
X

H L

Error code
S E

Check
PLC

sum
T 0 1 4 9 T
response
X X

H L H L H L

N consists of two-digit Hex number; it means the total elements to write. Its range can be 01H 20H.
Refer to the item 3
If the element is discrete, its address consists of 5 characters and status response consists of one
character 0 or 1
If the element is 16-bit register, its address consists of 6 characters and data response consists of 4-digit
Hex value.
If the element is 32-bit register, its address consists of 7 characters and data response consists of 8-digit
Hex value.

Ex. Set the status of Y0 at 1, Y1 to 0, 16-bit register WM8 to 5555H, 32-bit register DR2 to FFH.
The status of element 1 The status of element 2
Element 1 Element 2 Element 3 Data of element 3

S
MASTER
T 0 1 4 9 0 4 Y 0 0 0 0 1 Y 0 0 0 1 0 W M 0 0 0 8 5 5 5 5
Command
X
02H 30H 31H 34H 39H 30H 34H 59H 30H 30H 30H 30H 31H 59H 30H 30H 30H 31H 44H 57H 4DH 30H 30H 30H 38H 35H 35H 35H 35H

Element 4 Data of element 4

E
D R 0 0 0 0 2 0 0 0 0 0 0 F F 3 C T
X
44H 52H 30H 33H 30H 30H 32H 30H 30H 30H 30H 30H 30H 46H 46H 33H 43H 03H

S E
PLC
T 0 1 4 9 0 0 0 T
response
X X
02H 30H 31H 34H 39H 30H 30H 30H 03H

15
 Command code 4E Loop back test

Format This command makes slave PLC respond all test data back to Master. It is only for testing the
communication condition between Master and PLC and it will not influence the PLC operation.

Command
S E

Station
Check
MASTER

code
sum

No.
T 0 1 4 E Testing data X T
Command
X X

H L H L H L
Command code
Station No.

S E

Check
PLC

sum
T 0 1 4 6 Testing data X T
response
X X

H L H L H L

These two data is the same

Ex. Use this command to send the data ABCDEFG from Master to PLC to test weather the PLC respond
normally.

S E
MASTER
T 0 1 4 E A B C D E F G B 8 T
Command
X X
02H 30H 31H 34H 45H 41H 42H 43H 44H 45H 46H 47H 42H 38H 03H

S E
PLC
T 0 1 4 E A B C D E F G B 8 T
response
X X
02H 30H 31H 34H 45H 41H 42H 43H 44H 45H 46H 47H 42H 38H 03H

16
 Command code 4F Read program

Format

MASTER uses command code 53 to read the detail system status of PLC before perform the operation of
read PLC program. From the response message of command code 53 can get the capacity of PLC program
and hence can determine how many transactions (64 Words for each transaction) needed to carry in order
to completely read the PLC program.
Ex. When the program capacity of PLC is 8192 8KWords, Master should read 0,1,2,,128, total 129
pages data page 0 is the program header, the actual program starts from page 1 to 128
Ex. When the program capacity of PLC is 13184 13KWords, Master should read 0,1,2,,206, total
207 pages data page 0 is the is the program header, the actual program starts from page 1 to
206 The total pages to be transfer
Program capacity
N=
64
Station No.

Page Page
Command

S E
MASTER No. No.
Check

code
sum

T 0 1 4 F Hi- Lo- T
Command
X Byte Byte X

H L H L H L H L H L
Command code
Station No.

S E
Checksum

Check
PLC

sum
T 0 1 4 F One page program64 Words T
response
X X

H L H L H L

Word 1 . Word 64
Page 00H
64 Words The format of program header
Program header
64 Words Page 01H 00H 46H F
01H 42H or 4DH B or M
02H 30H 39H 0 9
03H 30H 39H 0 9
Actual program page

04H Ladder Size Hi-Byte

05H Ladder Size Lo-Byte
06H FFH

64 Words Page N 7FH FFH

When program capacity is 8192 Words, Ladder Size Hi-Byte=20H Ladder Size Lo-Byte=00H
When program capacity is 13184 Words, Ladder Size Hi-Byte=33H Ladder Size Lo-Byte=80H

17
 Command code 50 Write program

Format

Master can use this command code to write program to PLC, which were retrieved by previous command
code 4F.
If the capacity of writing program is 8192 (8K) Words, Master should transfer 129 pages data to the PLC
(page 0 is the program header, the actual program starts from page 1 to 128).
If the saved program capacity is 13184 (13K) Words, Master should transfer 206 pages data to the PLC
(page 0 is the program header, the actual program starts from page 1 to 206).

Program capacity
N=
64

Checksum
S P No. P No. E
MASTER
T 0 1 5 0 Hi- Lo- One page program64 Words T
Command
X Byte Byte X

02H 30H 31H 35H 30H H L H L H L 03H

Word 1 . Word 64
Station No.

Command code

S E

Checksum
Error code
PLC
T 0 1 5 0 T
response
X X

02H 30H 31H 35H 30H H L 03H

Page 00H
64 Words The format of program header
Program header
64 Words Page 01H 00H 46H F
01H 42H or 4DH B or M
02H 30H 39H 0 9
03H 30H 39H 0 9
Actual program page

04H Ladder Size Hi-Byte

05H Ladder Size Lo-Byte
06H FFH

64 Words Page N 7FH FFH

When program capacity is 8192 Words, Ladder Size Hi-Byte=20H, Ladder Size Lo-Byte=00H
When program capacity is 13184 Words, Ladder Size Hi-Byte=33H, Ladder Size Lo-Byte=80H

18
 Command code 53 Read the detail system status of PLC

Format

Command
S E

Station
MASTER

code
No.
T 0 1 5 3 C B T
Command
X X
H L H L H L
Command code
Station No.

Checksum

S E
Checksum

Check
PLC STATUS STATUS STATUS STATUS STATUS STATUS STATUS

sum
T 0 1 5 3 T
response 1 2 3 4 5 6 64
X X

H L H L H L H L H L H L H L H L H L H L

B0 RUN/STOP
B1 Battery Low/Normal
B2 Ladder checksum error/Normal
B3 Use ROM PACK/Not use
STATUS 1
B4 WDT Time out/Normal
B5 ID setting/Not set ID STATUS 15 M Relay Hi-Byte
B6 Emergency stop/Normal STATUS 16 M Relay Lo-Byte
B7 (reserve for future use) STATUS 17 S Relay Hi-Byte
Types of Main unit STATUS 18 S Relay Lo-Byte
00H MA/MU STATUS 19 L Relay Hi-Byte
STATUS 2 FB series
01H MC STATUS 20 L Relay Lo-Byte
Other values reserve STATUS 21 R Register Hi-Byte
Total I/O points of main unit STATUS 22 R Register Lo-Byte
01H 20 points STATUS 23 D Register Hi-Byte
STATUS 3 02H 28 points STATUS 24 D Register Lo-Byte
03H 40 points STATUS 25 Timer Hi-byte

STATUS 26 Timer Lo-byte
OS Version of PLC STATUS 27 Counter Hi-Byte
30H V3.0 STATUS 28 Counter Lo-Byte
STATUS 4
31H V3.1 STATUS 29


STATUS 5 Ladder Size Hi-Byte

STATUS 6 Ladder Size Lo-Byte

STATUS 7 Discrete input Hi-Byte

STATUS 8 Discrete input Lo-Byte
STATUS 9 Discrete output Hi-Byte

STATUS 10 Discrete output Lo-Byte STATUS 64

STATUS 11 Analog input Hi-Byte
STATUS 12 Analog input Lo-Byte
STATUS 13 Analog output Hi-Byte
STATUS 14 Analog output Lo-Byte

19
 Command code 53 Read the detail system status of PLC

Ex.
If the PLC model is FB E -28MC, OS version is 3.10, program capacity is 13K words, without ROM
PACK, and ID setting, all the status are normal and in RUN model, then the result of reading the
system status is as following

FBE 28Pt. OS

Station No.
Ladder size

Command
S E -MC CPU V3.1
MASTER =13184 DI=256

code
T 0 1 5 3 C B T
Command STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS
X X
02H 30H 31H 35H 33H 43H 42H 03H 1 2 3 4 5 6 7 8

Station No.

Checksum
Command

S
PLC
code

T 0 1 5 3 0 2 1 0 1 0 2 3 1 3 3 8 0 0 1 0 0
response
X
02H 30H 31H 35H 33H 30H 32H 31H 30H 31H 30H 32H 33H 31H 33H 33H 38H 30H 30H 31H 30H 30H

M Relay S Relay L Relay R Register

DO=256 AI=64 AO=64 = 2002 = 1000 =0 = 8072
STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS
9 10 11 12 13 14 15 16 17 18 19 20 21 22

0 1 0 0 0 0 6 4 0 0 6 4 0 7 D 2 0 3 E 8 0 0 0 0 1 F 8 8

30H 31H 30H 30H 30H 30H 36H 34H 30H 30H 36H 34H 30H 37H 44H 32H 30H 33H 45H 38H 30H 30H 30H 30H 31H 46H 38H 38H

D Register
= 3072 Timer=256 Counter=256 Reserve

STATUS STATUS STATUS STATUS STATUS STATUS STATUS STATUS

23 24 25 26 27 28 29 30

E
Check
sum

0 C 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 T
X

30H 43H 30H 30H 30H 31H 30H 30H 30H 31H 30H 30H 30H 30H 30H 30H 30H 30H 30H 30H 03H

20