Serial Communication protocol - Keyence

In my application, I use a Keyence KV16DT PLC attached to a Proface ST HMI via a serial port. Does anybody know details of the serial communication protocol between the two units? I have monitored it with a RS232 analyser and it is a ASCII protocol with messages in the format <ENQ> <SOH> < variable length data packet> <Checksum> <EOT>. However I have no information of the command bytes in the data packet.
If I can understand the serial communication protocol, it would help me in simulating the PLC with a VB app.
No information is available in Keyence / ST manuals. Has anyone encountered such a protocol earlier?

Hi
You have only way to print out monitored dada and carefully look a logical connections. Ofcourse it takes a lot of time. I did it succesfully with mitsubishi PLC and I use also Vbasic for visualise PLC.
Please calculate very carefully checksum!

Kelm

The GE CCM protocol which was used in some of the older GE Fanuc PLC models has those characteristics. The same protocol is also known as TI/Simatic Hostlink and Automation Direct DirectNet.

You can get the details from the GE Fanuc manual GFK-0582d, available here . Download the manual and see if your captures make sense when compared to the manual.

I did communicate with Keyence CV751 vision system. Cable pinout,
modes of operation and all commands were in the manual. Keyence
manuals can be downloaded from their website.

Thanks for the response.
I should perhaps be more clear on what I am looking at.
The serial ports of the Keyence PLC can be used to connect to external serial devices OR to system peripherals such as KV-D20 operator interface, hand-held programmer etc. These devices will operate in a transparent way without requiring ladder programmes from the programmer. Their command set also has to be more extensive requiring access to system functions. I remember a post in this forum where a command sequence was sent to the Keyence KV PLC to switch to a higher baud rate. This was in exactly the same format that I had observed and this operation cannot be carried out through the command set given in the manual, which by the way uses a pure ASCII protocol so that it can be accessed through a terminal emulator.

In continuation to my earlier post, as an example - the ST sends the following query packet to read 8 consecutive DM starting from 108 (all values in decimal):
ST: <ENQ(05)>
PLC: responds with <ACK(06)>
ST: <SOH(01)> 0 255 7 100 0 0 0 8 128 108 <checksum = 162>
PLC: responds with <ACK(06)>
ST: <EOT(04)>
PLC: responds with <ACK(06)>

Response packet from PLC to ST:
PLC: <ENQ>
ST: responds with <ACK>
PLC: <SOH> 0 255 22 100 0 0 0 0 8 <DM108H><DM108L> ... <DM115H><DM115L> <checksum>
ST: responds with <ACK>
PLC: <EOT>
ST: responds with <ACK>

I am looking for details of this 'native Keyence ASCII serial protocol' so that the simulator I write in VB can connect to KV-D20 HMI, handheld programmer, 3rd party HMIs supporting Keyence serial ASCII protocol etc. Another objective is to use these Keyence peripherals (at least the KV-D20 operator interface) in my microcontroller projects or as a neat display with a PC. The GE CCM protocol was somewhat similar but not what I was looking for.

Pl. go to
http://forum.mrplc.com/index.php?showtopic=1299

There is a small sample code for switching the Keyence PLC to a higher baud rate. This is the protocol whose details I am looking for. Does anybody have any details ?