LOGO! PG Protocol Reference Guide

Rev. Cd

December 2020

Preface

This guide is written for persons who will communicate with a Siemens (TM) LOGO! 0BA4, 0BA5 or 0BA6 using the PG Interface. The PG Interface used an undocumented protocol for program loading, diagnostics, etc. which is referred to here as PG protocol. This guide describes how messages are constructed, and how transactions take place by using the PG protocol.

Siemens and LOGO! are registered trademarks of Siemens AG.

Used and Related Publications

This reference guide cite and uses passages of text from the following documentation:

• Modicon Modbus Protocol Reference Guide published by Modbus Organization, Inc.

Refer to the following publication for details about well known commands:

• SNATAX @ https://forums.ni.com Data Monitoring, PLC Control, System Info (0BA6)
• cacalderon @ https://forums.ni.com PLC Control, System Info (0BA5) and LOGO DE-9 cable pin-out
• ask @ https://support.industry.siemens.com data monitoring python script (0BA4)
• Superbrudi @ https://support.industry.siemens.com data monitoring excel VBA script (0BA5 and 0BA6)

Refer to the following publications for details about the related commands categories of Date and Time, Password Security and Cyclic Data Read

• chengrui @ http://www.ad.siemens.com.cn Date and Time
• neiseng @ https://www.amobbs.com Password Security (@post 23)
• neiseng @ https://www.amobbs.com Cyclic Data Read (@post 29)

Refer to the following publication for details about the LOGO address layout:

• neiseng @ https://www.amobbs.com decodes most of the functions and the 0BA5 data address space (@post 42)

Refer to the following publication for details about the RS232 specifications and use cases:

• RS232 Specifications and standard by Lammert Bies
• LOGO! Interface by W. Kriegmaier Elektor 7/1999 page 55
• Get power out of PC RS-232 port by Tomi Engdahl
• RS-232 vs. TTL Serial Communication by SparkFun

Contents

• Chapter 1 - PG Protocol
  • Introducing PG Protocol
  • The Serial Transmission Mode
  • The Message Frame
  • The Connection Phases
  • Error Checking Methods
• Chapter 2 - Data Commands
  • Message Frame
  • Data Commands Supported by LOGO
  • Write Byte Command 01
  • Read Byte Command 02
  • Write Block Command 04
  • Read Block Command 05
• Chapter 3 - Control Commands
  • Message Frame
  • Control Commands Supported by LOGO
  • Stop Operating 12
  • Start Fetch Data 13
  • Stop Fetch Data 14
  • Operating Mode 17
  • Start Operating 18
  • Diagnostic 1b
• Chapter 4 - Tool Commands
  • Message Frame
  • Tool Commands Supported by LOGO
  • Clear Program 20
  • Connection Request 21
  • Restart 22
• Chapter 5 - Errors and Confirmations
  • Confirmed Codes Used by LOGO
  • Acknowledge Response 06
  • Exception Response 15
• Appendix A - Address Scheme
• Appendix B - Application Notes
• Appendix C - Checksum Generation

---

Chapter 1 - PG Protocol

Introducing PG Protocol

The common language used by all LOGO! devices is the PG protocol. This protocol defines a message structure that controllers will recognize and use, regardless of the type of networks over which they communicate.

Standard Interface for LOGO! 0BA0 to 0BA6 controllers use an 4-wire RS–232C compatible serial interface that defines connector pin-outs, cabling, signal levels, transmission baud rates, and parity checking.

The Siemens Software LOGO! Comfort communicate using a master–slave technique, in which only a personal computer called DTE (data terminal equipment) can initiate transactions (called queries). The LOGO! device called DCE (data communication equipment) respond by supplying the requested data to the DTE, or by taking the action requested in the query.

The Query–Response Cycle

Direction	Query message from DTE	Response message from DCE
PC->LOGO	Command [data]
LOGO->PC		Confirmation [data]
PC->LOGO	Command [data]
LOGO->PC		Confirmation [data]
...	...	...

Figure DTE-DCE Query–Response Cycle

The Query: The command code in the query tells the LOGO! device what kind of action to perform. The data bytes contain any additional information that the LOGO! will need to perform the function.

For example, command code 05 will query the LOGO! to read a memory block and respond the content. The Data field must contain the information telling the LOGO! which address to start at and how many bytes to read.

The Response: If the LOGO! makes a normal response, the first byte in the response contains an positive confirmation code. The confirmation code allows the DTE to check that the message contents are valid. The following data bytes contain the data collected by the LOGO!, such a value or status. If an error occurs, the LOGO! response is an error response, followed by on byte, which contain a exception code that describes the error.

The Serial Transmission Mode

When the PC communicate to the LOGO! controller with using the PG protocol, each 8–bit byte in a message contains hexadecimal characters. The main advantage of using hexadecimal characters is that its greater character density allows better data throughput than for example ASCII for the same baud rate. Each message must be transmitted in a continuous stream.

The specification for each communication via the PG Interface:

Cable / Connectors:

• 5-wire TIA-574
• PC (DTE Connector) DE-9 male
• LOGO! (DCE Connector) DE-9 female

Pinout:

• RxD Receive Data; DTE in direction; pin 2
• TxD Transmit Data; DTE out direction; pin 3
• DTR Data Terminal Ready; DTE out direction; pin 4 *)
• GND Ground; pin 5
• RTS Request to Send; DTE out direction; pin 7 *)

Note: *) DTS and/or RTS are used to power the plug electronics

Baud rate / Bits per byte:

• 9600 baud rate
• 1 start bit
• 8 data bits, least significant bit sent first
• 1 bit for even parity
• 1 stop bit
• RTS (or DTS) set to high (>= 5V)

Coding System:

• 8–bit binary, hexadecimal 0–9, A–F

The Message Frame

In either of the two transmission modes (query or request), all data are placed by the transmitting device into a message that has a known beginning and ending point. This allows receiving devices to begin at the start of the message, read the address portion and determine which data is addressed, and to know when the message is completed. Partial messages can be detected and errors can be set as a result.

Start	Content
1 byte	n bytes
Query/Response	Optional

Figure Message Frame

The next Figures shows an example of a DTE query message and a LOGO! normal response. Both examples show the field contents in hexadecimal, and also show how a message framed.

The DTE query is a monitoring request to the LOGO! device. The message requests a Fetch Data command for monitoring.

Field Name	Code (hex)	Meaning
Command	55	Control
Function	13 13	Fetch Data
Byte Count	00	Number of additional bytes
Trailer	aa	End Delimiter

Figure DTE Query message

The LOGO! response with an acknowledgment, indicating this is a normal response. The Byte Count field specifies how many bytes are being returned.

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment
Command	55	Control
Function	11 11	Data Response
Byte Count	40 00	Number of bytes 64 (dec)
Data	00 7f .. 00	data block
Trailer	aa	End Delimiter

Figure LOGO! Response message

Command Query

All commands are packed into a message by the DTE sending device, which have a known structure. Valid command codes are in the range of 01 to 55 hexadecimal. Some of these codes apply to all LOGO! controllers, while some codes apply only to certain models. Current codes are described in the following chapters.

When a message is sent from a DTE to a LOGO! device the Command Code field tells the LOGO! what kind of action to perform. Examples are to read the RUN/STOP operation mode; to read the data contents; to read the diagnostic status of the LOGO!; to write some designated data; or to allow loading, recording, or verifying the program within the LOGO!.

Start	Content
1 byte	n bytes
Command Code	Optional

Figure Query Message Frame

The Content field can be nonexistent (length of zero) in certain kinds of messages.

Confirmation Response

When the LOGO! responds to the DTE, it uses the confirmation code to indicate either a normal (error–free) response or that some kind of error occurred (called exception response). For a normal response, the LOGO! simply confirm the message with an acknowledgment. For an exception response, the LOGO! returns an negative-acknowledgement with an exception code.

In addition to the error confirmation code for an exception response, the LOGO! places a unique code into the Content field of the response message. This tells the DTE what kind of error occurred, or the reason for the exception. The DTE application program has the responsibility of handling exception responses. Typical processes are to post subsequent retries of the message, to try diagnostic messages to the LOGO!, and to notify the operator.

Start	Content
1 byte	n bytes
Confirmation Code	Optional

Figure Response Message Frame

The Content field can be nonexistent (length of zero) in certain kinds of messages.

How Numerical Values are Expressed

Unless specified otherwise, numerical values (such as addresses, codes, or data) are expressed as hexadecimal values in the text and in the message fields of the figures.

Content Field

The Content field of a message sent from a DTE to a LOGO! device may contain additional information, depending on the query. The content field is constructed using sets of two hexadecimal digits, in the range of 00 to FF hexadecimal.

If no error occurs, the Content field of a response from the LOGO! to the DTE contains the content requested. If an error occurs, the field contains an exception code that the PDE application can use to determine the next action to be taken.

How a Function Field is Handled

If a Function field exists, then this consists of two bytes with same value. Valid function codes are in the range of 11 11 to 18 18 hexadecimal. Functions that are inserted into a message without addressing something in the memory use a terminator (called end delimiter) AA. The allowable bytes transmitted for the data content are hexadecimal 00 to FF (including AA).

How a Address Field is Handled

The Address field of a message frame contains two bytes (0BA4, 0BA5) or four bytes (0BA6). Valid device addresses or memory addresses depends on the LOGO! controller. A DTE addresses the memory by placing the address in the Address field of the message. When the LOGO! sends its response, it echos the address in the Address field of the response to let the DTE know which address is requested.

How to Use the Byte Count Field

If you need to transfer more than one data byte from the DTE to the LOGO! device, then you must use a Byte Count value that indicates the number of bytes in your message data. When storing responses in buffers, you should use the Byte Count value, which is the number of bytes in your message data. The value refers to the following field contents.

For example, if the DTE requests the LOGO! to read a group of data (e.g. function code 05), the content specifies the starting address and how many bytes are to be read. If the DTE writes to a group of data to the LOGO! (e.g. function code 04), the content specifies the starting address, the count of data bytes to follow in the Data field, and the data to be written into the registers.

How a Data Field is Handled

The Data field is constructed using sets of two hexadecimal digits, in the range of 00 to FF hexadecimal.

How Characters are Transmitted Serially

When messages are transmitted via the PG Interface, each byte is sent in this order (left to right):

Least Significant Bit (LSB) . . . Most Significant Bit (MSB)

As a reminder, the communication takes place with parity check. The bit sequence is:

Start | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | Par | Stop

Figure Bit Order

The Connection Phases

The process of exchange the payload data passes through several distinct phases, during which messages are exchanged between the endpoints of the connection.

• Negotiation Phase
• Data Exchange Phase
• Termination Phase

Negotiation Phase

The configuration parameters are negotiated by an exchange of connection commands (21 or 02 1f 02). If the version has been negotiated, the connection is established and the data exchange phase can be started. If the endpoints fail to negotiate a connection, it is closed immediately.

Data Exchange Phase

This phase are used to exchange the appropriate data. Once the connection is established by identifying the version, data and control commands will be transmitted across the connection.

Termination Phase

The connection may be terminated at any time. Termination may occur due to failure, carrier loss, or the expiration of the inactivity timeout. Only the Cyclic Fetch Data mode uses an end messages (Stop Fetch Data 14) to terminate active the connection.

Error Checking Methods

The PG serial communication use two kinds of error checking. Parity checking (even) is applied to each character. Frame checking (XOR) is applied to some kind of messages. Both the character check and message frame check are generated by the device and applied to the message contents before transmission. The receiving device checks each character and the entire message frame during the reception.

The DTE is configured by the user to wait for a predetermined timeout interval before aborting the transaction. This interval is set to be long enough for any LOGO! to respond normally (in general between 75 and 600 ms). If the LOGO! detects a transmission error, the message will be acted upon with an exception response. When the timeout will expire the DTE’s program has to handle these state.

Parity Checking

Users must configure controllers for Even Parity checking. Since Even Parity is specified, the quantity of 1 bits will be counted in the data portion over all eight data bits. The parity bit will then be set to a 0 or 1 to result in an Even total of 1 bits.

For example, these eight data bits are contained:

1100 0101

The total quantity of 1 bits in the frame is four. If Even Parity is used, the frame’s parity bit will be a 0, making the total quantity of 1 bits still an even number (four). If Odd Parity is used, the parity bit will be a 1, making an odd quantity (five).

When the message is transmitted, the parity bit is calculated and applied to the frame of each byte. The receiving device counts the quantity of 1 bits and sets an error if they are not the same as configured for that device (DTE and DCE must be configured to use the even parity check method).

Note that parity checking can only detect an error if an odd number of bits are picked up or dropped in a character frame during transmission.

XOR Checking

For the block commands 04 and 05, the DTE query or LOGO! response messages include an error–checking field that is based on a Checksum XOR method. The Checksum field checks the contents of the entire data. It is applied regardless of any parity check method used for the individual characters of the message.

The Checksum field is one byte, containing an 8–bit binary value. The Checksum value is calculated by the transmitting device, which appends the XOR value to the message. The receiving DTE program must calculate the Checksum during receipt of the message, and compares the calculated value to the actual value it received in the Checksum field. If the two values are not equal, an error results.

Note: The application of Checksum field in response message are not mandatory.

---

Chapter 2 - Data Commands

Message Frame

Command	Address	Content
1 byte	2 or 4 bytes	n bytes
Data Code	16/32bit Address	Optional

Figure Data Command Frame

The content field is usually required. It is not available (length of zero) only for the read byte command 02. The format depends on the command codes.

Note: LOGO! version 0BA6 uses 32bit addresses, version 0BA4 and 0BA5 16bit addresses.

Data Commands Supported by LOGO

The listing below shows the data command codes supported by LOGO!. Codes are listed in hexadecimal.

Y indicates that the command is supported. N indicates that it is not supported.

Code	Name	0BA4	0BA5	0BA6
01	Write Byte Command	Y	Y	Y
02	Read Byte Command	Y	Y	Y
04	Write Block Command	Y	Y	Y
05	Read Block Command	Y	Y	Y

Write Byte Command 01

Description

The command writes a byte value to the specified memory address of the LOGO! device. For example, the contents of a byte in the memory of the LOGO! device can be manipulated with this command.

Query

The query message specifies the Byte reference to be writing. The data are addressed starting at zero.

Command	Address	Data
1 byte	2 or 4 bytes	1 byte
Data Code	16/32bit Address	Data Byte

Figure Write Byte Query Message

The Address field is an offset of the memory specified by the LOGO! device. The Data field is a numeric expression that write a byte value into the memory.

Here is an example of a request for write 00 to the memory address 1f 02:

Field Name	Code (hex)	Meaning
Command	01	Write Byte
Address	1f 02	16bit Address
Data	00	Data Byte

Figure Example Write Byte Query

Response

The normal response is a simple Acknowledgment of the query, returned after the data byte has been written.

Here is an example of a response to the query above:

Field Name	Code (hex)	Meaning
Command	06	Acknowledgment

Figure Example Write Byte Response

Read Byte Command 02

Description

Read Byte is a memory function that returns the byte stored at a specified memory location.

The maximum length of the address field depends on the LOGO! controller. In the LOGO! device is an addressing error exception handling implemented. For example, an instruction for an non existing address causes an exception response.

Query

The query message reads a Byte value from the specified address and send it as a return value to the DTE.

Command	Address
1 byte	2 or 4 bytes
Data Code	16/32bit Address

Figure Read Byte Query Message

Here are two examples of a request to read a byte from the address (00 ff)1f 02:

Field Name	Code (hex)	Meaning
Command	02	Read Byte
Address	1f 02	16bit Address

Figure Example Read Byte Query

Field Name	Code (hex)	Meaning
Command	02	Read Byte
Address	00 ff 1f 02	32bit Address

Figure Example Read Byte Query 0BA6

Response

The byte value in the response message is packed into the Data field.

Here is a example of a response to the query above:

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment
Command	03	Data Response
Address	00 ff 1f 02	32bit Address
Data	40	Data Byte

Figure Example Read Byte Response 0BA6

Write Block Command 04

Description

Writes data contents of bytes into the Memory of the LOGO! device.

Query

The command contains the standard fields of command code, address offset and Byte Count. The rest of the command specifies the group of bytes to be written into the LOGO! device.

Command	Address	Byte Count	Data	Checksum
1 byte	2 or 4 bytes	2 bytes	n bytes	1 byte
Data Code	16/32bit Address	Number of bytes	Data Content	CheckSum8 XOR

Figure Write Block Query Message

Response

The write block query can have a very large data part. To prevent an timeout, LOGO! sends two replies to the DTE: first one will be sent immediately from the LOGO! to the DTE after the command code 04 has been received and the second one after the data contents have been written.

The normal response is an confirmation of the query, returned after the data contents have been written.

The following diagram illustrates the mentioned behavior:

   DTE              DCE
:       :        :       :
+-------+        : .. .. :
|  (1)  |--(04)->:       : Write Block
+-------+        +-------+
:       :<-(06)--|  (2)  | Acknowledgment
+-------+        +-------+
|  (3)  |--(0e)->:       : Addr HiByte
|       |--(04)->:       : Addr LoByte
| .. .. |        : .. .. :
|       |--(00)->:       : Byte Count HiByte
|       |--(30)->:       : Byte Count LoByte
| .. .. |        : .. .. :
|       |--(80)->:       : Data Content
|       |--(00)->:       :
|       |--(ff)->:       :
|       |--(ff)->:       :
:       :        :       :
:       :        :       :
|       |--(ff)->:       :
|       |--(ff)->:       :
| .. .. |        : .. .. :
|       |--(80)->:       : CheckSum XOR
+-------+        +-------+
:       :<-(06)--|  (4)  | Acknowledgment
: .. .. :        +-------+
:       :        :       :

Figure Flow Diagram of a Write Block Command 04

Read Block Command 05

Description

Reads the binary contents at the specified Memory address of the LOGO! device.

Query

The query message specifies the starting Byte and quantity of Data to be read. The data are addressed starting at zero.

Command	Address	Byte Count
1 byte	2 or 4 bytes	2 bytes
Data Code	16/32bit Address	Number of bytes

Figure Read Block Query Message

The following example reads the program name from LOGO! memory:

Field Name	Code (hex)	Meaning
Command	05	Read Byte 1)
Address	05 70	16bit Address
Byte Count	00 10	Number of bytes 16 (dec)

Figure Example Read Block Query

Notes: 1) The LOGO! sends an response (normally Ack 06) immediately after receiving the command code 05.

Response

The data in the response message is sent as hexadecimal binary content. The number of data bytes sent corresponds to the requested number of bytes.

Please note, the read block query can have a very large data part (up to 3000 bytes). To avoid an unwanted timeout, a response will be sent immediately from the LOGO! to the DTE after the command code 05 has been received.

Command	Data	Checksum
1 byte	n bytes	1 Byte
Confirmation Code	Data Block	CheckSum8 XOR

Figure Read Byte Response Message

Here is an example of a response to the query above:

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment 1)
Data	48 65 6C 6C 6F 20 77 6F 72 6C 64 21 20 20 20 20	Data Block
Checksum	21	XOR Byte

Figure Example Read Block Response

Notes: 1) The DTE expects an Acknowledgement (06) immediately after sending the command code 05.

In this example the program name is read out. The maximum text width is 16 characters. The reading direction is from left to right. In addition, the XOR checksum value is used in this example (21 hex).

Format	Data
Hexadecimal	48 65 6C 6C 6F 20 77 6F 72 6C 64 21 20 20 20 20
ASCII	_H _e _l _l _o __ _w _o _r _l _d _! __ __ __ __

Figure Example Read Block Data decoded

---

Chapter 3 - Control Commands

Message Frame

All control commands are placed into a frame that has a known beginning and ending point. They start with 55 and end with AA. The function code specifies the control command to be executed. The function code consists of two bytes and both bytes have the same value.

A typical message frame is shown below.

Start	Function	Content	End
1 byte	2 bytes	n bytes	1 byte
Control Code	Function Field	Optional	End Delimiter

Figure Control Command Frame

The content of a control message sent from a DTE to a LOGO! device may contains additional information that the LOGO! must use to perform the action defined by the command code.

Control Commands Supported by LOGO

The listing below shows the function codes for the control command 55 supported by LOGO!. Codes are listed in hexadecimal.

Y indicates that the command is supported. N indicates that it is not supported.

Function	Name	0BA4	0BA5	0BA6
12	Stop Operating	Y	Y	Y
13	Start Fetch Data	Y	Y	Y
14	Stop Fetch Data	?	Y	Y
17	Operation Mode	Y	Y	Y
18	Start Operating	Y	Y	Y
1b	Diagnostic	N	N	N

Stop Operating 12

Description

Send to LOGO! to change the operation mode to STOP.

Query

Command	Function	Trailer
1 byte	2 bytes	1 byte
Control Code	Function Code	End Delimiter

Figure Function Message Frame

Here is an example how to set the operation mode to STOP:

Field Name	Code (hex)	Meaning
Command	55	Control
Function	12 12	Stop Operating
Trailer	aa	End Delimiter

Figure Example Stop Operating Query

Response

A normal response contains a confirmation that the LOGO! device has completed the command successfully.

Here is an example of a response to the query above:

Field Name	Code (hex)	Meaning
Command	06	Acknowledgment

Figure Example Stop Operating Response

Start Fetch Data 13

Description

This function fetching the current data from the LOGO! device. The LOGO! device responds with ACK (06), followed by control code 55, the response function code 11 and the data (length depends on the device type) or NAK (15), followed by an exception code. The fetching of the data can be done once or continuously (called Cyclic Fetch Data).

To fetch addional data, the Byte Count must set to none zero and the Data field must be existent.

Query

Command	Function	Byte Count	Data 1)	Trailer
1 byte	2 bytes	1 byte	1 byte	1 byte
Control Code	Function Code	Number of bytes	Data bytes 1)	End Delimiter

Figure Start Fetch Data Query Message

Notes: 1) Used when the Byte Count is greater than zero

Here is an example of a single request of fetching the monitoring data from LOGO! device:

Field Name	Code (hex)	Meaning
Command	55	Control
Function	13 13	Fetch Data
Byte Count	02	Number of additional bytes = 2
Data	0b 0a	Block B002, B001
Trailer	aa	End Delimiter

Figure Example Start Fetch Data Query

Response

Command	Command	Function	Byte Count	Data	Trailer
1 byte	1 byte	2 bytes	2 bytes	n bytes	1 byte
Confirmation Code	Control Code	Function Code	Number of bytes	Data Block	End Delimiter

Figure Fetch Data Response Message

The Byte Count value indicates the number of bytes that are followed (excluding the End Delimiter AA). The Byte Count is of the data type Word and in the format Little-Endian (LoByte, HiByte).

Notes: Minimum Byte Count value

• 0BA4 = 40 (hex) = 64 bytes
• 0BA5 = 40 (hex) = 64 bytes
• 0BA6 = 4a (hex) = 74 bytes

The Data field includes input image registers, run-time variables, etc. and the data for input, output, cursor key states, and the additionally requested variables.

The listing below shows the position in the Data field for the well known values. The positions start at one and are listed in decimal.

N indicates that it is not supported.

Register	0BA4	0BA5	0BA6	Description
B	6	6	6	Block output
I	23	23	31	input
F	N	N	34	function keys
O	26	26	35	output
M	28	38	37	flag
S	31	31	41	shift register
C	32	32	42	cursor keys
AI	33	33	43	analog input
AO	49	49	59	analog output
AM	53	53	63	analog flag

The examples shows how the Byte Count field is implemented in a LOGO! fetching data response:

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment
Command	55	Control
Function	11 11	Data Response
Byte Count	40 00	Number of bytes 64 (dec)
Data	7f 66 11 2a 00 80 01 10 00 00 00 00 00 00 00 00	Data Block 00-0f
Data	00 00 00 00 00 a8 00 00 00 00 00 00 00 00 00 00	Data Block 10-1f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 20-2f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 30-3f
Trailer	aa	End Delimiter

Figure Example Fetch Data Response 0BA4

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment
Command	55	Control
Function	11 11	Data Response
Byte Count	40 00	Number of bytes 64 (dec)
Data	35 08 11 2a 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 00-0f
Data	00 00 00 00 00 0C 09 00 00 01 00 00 00 00 00 00	Data Block 10-1f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 20-2f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 30-3f
Trailer	aa	End Delimiter

Figure Example Fetch Data Response 0BA5

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment
Command	55	Control
Function	11 11	Data Response
Byte Count	44 00	Number of bytes 68 (dec)
Data	f4 5f 11 2a 04 04 00 00 00 00 00 00 00 00 00 00	Data Block 00-0f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	Data Block 10-1f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 20-2f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 30-3f
Data	01 00 22 80	Data Block 40-43
Trailer	aa	End Delimiter

Figure Example Fetch Data Response 0BA5 with 4 addional bytes

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment
Command	55	Control
Function	11 11	Data Response
Byte Count	4a 00	Number of bytes 74 (dec)
Data	b7 c4 19 2c 00 10 84 6b 00 00 00 00 00 00 00 00	Data Block 00-0f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 10-1f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 20-2f
Data	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	Data Block 30-3f
Data	00 00 00 00 00 00 00 00 00 00	Data Block 40-49
Trailer	aa	End Delimiter

Figure Example Fetch Data Response 0BA6

Cyclic Data Reading

If a confirmation code 06 is sent by the DTE to the LOGO! device within 600 ms, the LOGO! device sends updated data (Cyclic Fetch Data). To stop the continuously data reading the Function Code 14 (Stop Fetch Data) should be sent.

The distance between the data transfers (scan distance) depends on the cycle time of the LOGO! device and the number of requested data (byte count). The data of the inputs and outputs as well as the flags are always read out as a block. The scan distance is about 200 ms (byte count = 0), so valid cycle times are greater than 200 ms. For a shorter cycle time, the requesting DTE system will not receive all data.

The following diagram illustrates the continuously data reading (including start):

   DTE              DCE
:       :        :       :
+-------+        : .. .. :
|  (1)  |--(55)->:       : Control Command
| .. .. |        :       :
|       |--(13)->:       : Start Fetch Data
|       |--(13)->:       :
| .. .. |        :       :
|       |--(00)->:       : Byte Count
| .. .. |        :       :
|       |--(aa)->:       : End Delimiter
+-------+        +-------+
:       :<-(06)--|  (2)  | Acknowledgment
: .. .. :        +-------+
:       :<-(55)--|  (3)  | Control Command
: .. .. :        | .. .. |
:       :<-(11)--|       | Data Response
:       :<-(11)--|       |
: .. .. :        | .. .. |
:       :<-(4a)--|       | Byte Count LoByte
:       :<-(00)--|       | Byte Count HiByte
: .. .. :        | .. .. |
:       :<-(b7)--|       | Data Block
:       :<-(c4)--|       |
:       :<-(19)--|       |
:       :<-(c2)--|       |
:       :        :       :
:       :        :       :
:       :<-(00)--|       |
:       :<-(00)--|       |
: .. .. :        | .. .. |
:       :<-(aa)--|       | End Delimiter
+-------+        +-------+
|  (4)  |--(06)->:       : Acknowledgment
+-------+        +-------+
:       :<-(55)--|  (5)  | Control Command
: .. .. :        | .. .. |
:       :<-(11)--|       | Data Response
:       :<-(11)--|       |
: .. .. :        | .. .. |
:       :<-(4a)--|       | Byte Count LoByte
:       :<-(00)--|       | Byte Count HiByte
: .. .. :        | .. .. |
:       :<-(b7)--|       | Data Block
:       :<-(c4)--|       |
:       :<-(19)--|       |
:       :<-(c2)--|       |
:       :        :       :
:       :        :       :
:       :<-(00)--|       |
:       :<-(00)--|       |
: .. .. :        | .. .. |
:       :<-(aa)--|       | End Delimiter
+-------+        +-------+
|  (6)  |--(06)->:       : Acknowledgment
+-------+        +-------+
:       :<-(55)--|  (7)  | Control Command
: .. .. :        | .. .. |
:       :<-(11)--|       | Data Response
:       :<-(11)--|       |
: .. .. :        | .. .. |
:       :<-(4a)--|       | Byte Count LoByte
:       :<-(00)--|       | Byte Count HiByte
: .. .. :        | .. .. |
:       :<-(b7)--|       | Data Block
:       :<-(c4)--|       |
:       :<-(19)--|       |
:       :<-(c2)--|       |
:       :        :       :
:       :        :       :
:       :<-(00)--|       |
:       :<-(00)--|       |
: .. .. :        | .. .. |
:       :<-(aa)--|       | End Delimiter
: .. .. :        +-------+
:       :        :       :

Figure Flow Diagram of Cyclic Fetch Data

Stop Fetch Data 14

Description

The execution of this command terminates the Cyclic Fetch Data mode.

Query

Command	Function	Trailer
1 byte	2 bytes	1 byte
Control Code	Function Code	End Delimiter

Figure Function Message Frame

Here is an example how to stop fetching data:

Field Name	Code (hex)	Meaning
Command	55	Control
Function	14 14	Stop Fetch Data
Trailer	aa	End Delimiter

Figure Example Stop Fetch Data Query

Response

There are no further return data and any remaining data are discarded for LOGO! 0BA4 and 0BA5. Only the LOGO! version 0BA6 sends a confirmation that the device has completed the command successfully.

Here is an example of a 0BA6 response to the query above:

Field Name	Code (hex)	Meaning
Command	06	Acknowledgment

Figure Example Stop Fetch Data Response

Notes: only for the LOGO! device 0BA6 confirmes with an acknowledgment.

The following diagram illustrates the termination of fetching data:

   DTE              DCE
:       :        :       :
+-------+        : .. .. :
| (n+1) |--(06)->:       : Acknowledgment
+-------+        +-------+
:       :<-(55)--| (n+2) | Control Command
: .. .. :        | .. .. |
:       :<-(11)--|       | Data Response
:       :<-(11)--|       |
: .. .. :        | .. .. |
:       :<-(4a)--|       | Byte Count LoByte
:       :<-(00)--|       | Byte Count HiByte
: .. .. :        | .. .. |
:       :<-(b7)--|       | Data Block
:       :<-(c4)--|       |
:       :<-(19)--|       |
:       :<-(c2)--|       |
:       :        :       :
:       :        :       :
:       :<-(00)--|       |
:       :<-(00)--|       |
: .. .. :        | .. .. |
:       :<-(aa)--|       | End Delimiter
+-------+        +-------+
| (n+3) |--(55)->:       : Control Command
| .. .. |        : .. .. :
|       |--(14)->:       : Stop Fetch Data
|       |--(14)->:       :
| .. .. |        : .. .. :
|       |--(aa)->:       : End Delimiter
+-------+        +-------+
:       :<-(06)--| (n+4) | Acknowledgment
: .. .. :        +-------+
:       :        :       :

Figure Flow Diagram of a Stop Fetch Data Command 14

Operating Mode 17

Description

The Control Command 17 queries the current operating mode.

Query

Status query from DTE to the LOGO! device to query the operating mode.

Field Name	Code (hex)	Meaning
Command	55	Control
Function	17 17	Ask operation mode
Trailer	aa	End Delimiter

Figure Example Operating Mode Query

Response

The format of a normal response is shown below. The data content depends on the current operating mode. They are listed on the following heading.

Field Name	Code (hex)	Meaning
Confirmation	06	Acknowledgment
Data	01	Current Operating Mode is RUN

Figure Example Operating Mode Response

A Summary of Operation Modes

These are the Operation Modes returned by LOGO! controllers in the second byte of the confirmation response:

Data	Meaning
01	LOGO! in RUN mode
20	LOGO! in Parameter mode
42	LOGO! in STOP mode

Start Operating 18

Description

Executing the command switches the connected LOGO! device from the STOP mode to the RUN mode.

Query

Send to LOGO! to change the operation mode to RUN

Command	Function	Trailer
1 byte	2 bytes	1 byte
Control Code	Function Code	End Delimiter

Figure Function Message Frame

Here is an example how to set the operation mode to RUN:

Field Name	Code (hex)	Meaning
Command	55	Control
Function	18 18	Start Operating
Trailer	aa	End Delimiter

Figure Example Start Operating Query

Response

A normal response contains a confirmation that the LOGO! device has completed the command successfully.

Here is an example of a response to the query above:

Field Name	Code (hex)	Meaning
Command	06	Acknowledgment

Figure Example Start Operating Response

Diagnostic 1b

Diagnostic is only supportet by LOGO! 0BA7 and above.

---

Chapter 4 - Tool Commands

Message Frame

For example, in a request from the DTE to the LOGO! to respond with his serial no (function code 21 hexadecimal), the LOGO! does not require any additional information. The command code alone specifies the action.

Tool Commands Supported by LOGO

The listing below shows the information command codes supported by LOGO!. Codes are listed in hexadecimal.

Y indicates that the command is supported. N indicates that it is not supported.

Code	Name	0BA4	0BA5	0BA6
20	Clear Program	N	N	Y
21	Connection Request	N	N	Y
22	Restart	N	N	Y

Clear Program 20

This command allows you to clear the circuit program in the connected LOGO! device and the program password if a password exists. The circuit program and password (if configured) remain in the LOGO! device. LOGO! devices prior to version 0BA6 do not support this function.

Here is an example of a request to read the current Clear Program:

Field Name	Code (hex)	Meaning
Command	20	Control

Figure Example Clear Program Query

Here is an example of a response to the query above:

Field Name	Code (hex)	Meaning
Confirmation Code	06	Acknowledgment
Data	20	Current Operating Mode is EDIT

Figure Example Acknowledge Response

Connection Request 21

Send to LOGO! a Connection Request 21:

controller	command	request	response	description
0BA4	Connection Request	21	15 05	Exception Response 05
0BA5	Connection Request	21	n/a	no Response
0BA6.Standard	Connection Request	21	06 03 21 43	Confirmation Response 43
0BA6.ES3	Connection Request	21	06 03 21 44	Confirmation Response 44
0BA6.ES10	Connection Request	21	06 03 21 45	Confirmation Response 45

Figure Example Connection Request

Following are the phase diagrams for establishing the connection for the different LOGO! generations

   DTE              DCE
:       :        :       :
+-------+        : .. .. :
|  (1)  |--(21)->:       : Connection Request
+-------+        +-------+
:       :<-(06)--|  (2)  | Acknowledgment
: .. .. :        +-------+
:       :<-(03)--|  (3)  | Data Response
:       :<-(21)--|       | Connection Response
:       :<-(43)--|       | Ident 0BA6.Standard
: .. .. :        +-------+
:       :        :       :

Figure Negotiation Phase 0BA6

   DTE              DCE
:       :        :       :
+-------+        : .. .. :
|  (1)  |--(21)->:       : Connection Request
+-------+        : .. .. :
:       :        :       :
:       :        :       : -Timeout 1s-
:       :        :       :
+-------+        : .. .. :
|  (2)  |--(02)->:       : Read Byte
|       |--(1f)->:       : Addr HiByte
|       |--(02)->:       : Addr LoByte
+-------+        +-------+
:       :<-(06)--|  (3)  | Acknowledgment
: .. .. :        +-------+
:       :<-(03)--|  (4)  | Data Response
:       :<-(1f)--|       | Addr HiByte
:       :<-(02)--|       | Addr LoByte
:       :<-(40)--|       | Ident 0BA5
: .. .. :        +-------+
:       :        :       :

Figure Negotiation Phase 0BA5

   DTE              DCE
:       :        :       :
+-------+        : .. .. :
|  (1)  |--(21)->:       : Connection Request
+-------+        +-------+
:       :<-(15)--|  (2)  | Error Response
:       :<-(05)--|       | Error Code Unknown
+-------+        +-------+
|  (3)  |--(02)->:       : Read Byte
|       |--(1f)->:       : Addr HiByte
|       |--(02)->:       : Addr LoByte
+-------+        +-------+
:       :<-(06)--|  (4)  | Acknowledgment
: .. .. :        +-------+
:       :<-(03)--|  (5)  | Data Response
:       :<-(1f)--|       | Addr HiByte
:       :<-(02)--|       | Addr LoByte
:       :<-(42)--|       | Ident 0BA4
: .. .. :        +-------+
:       :        :       :

Figure Negotiation Phase 0BA4

Restart 22

In the case of a LOGO! device 0BA6, the execution of further commands is no longer possible after an error (for example, unauthorized memory access; exception code 03). Additional commands are always answered with an exception code (e.g. DEVICE TIMEOUT 02 or ILLEGAL ACCESS 03) by the LOGO device. To restart the communication (after an exception response), the Restart command 22 is used.

Notes: The Restart command 22 is currently only confirmed for the LOGO! device 0BA6.

Chapter 5 - Errors and Confirmations

---

Confirmed Codes Used by LOGO

The listing below shows the confirmation response code used by LOGO!. Codes are listed in hexadecimal.

Y indicates that the confirmation is supported. N indicates that it is not supported.

Code	Name	0BA4	0BA5	0BA6
06	Acknowledge Response	Y	Y	Y
15	Exception Response	Y	Y	Y

Acknowledge Response 06

Description

LOGO! confirmation code 06 (ACK), followed by zero or n bytes of data. The response message depends on the request. It can consist of a simple ACK or additionally contain the requested data.

Response

Confirmation	Content
1 byte	n bytes
Confirmation Code	Optional

Figure Acknowledge Response Message

Here is an example of a request to read the current Operation Mode:

Field Name	Code (hex)	Meaning
Command	55	Control
Function	17 17	Ask operation mode
Trailer	aa	End Delimiter

Figure Example Operating Mode Query

Here is an example of a response to the query above:

Field Name	Code (hex)	Meaning
Confirmation Code	06	Acknowledgment
Data	42	Current Operating Mode is STOP

Figure Example Acknowledge Response

Exception Response 15

Description

LOGO! confirmation code 15 (NOK), followed by an exception code (1 byte).

Response

The exception code can be a transport or protocol error. The field examples are in hexadecimal.

Confirmation	Content
1 byte	1 byte
Confirmation Code	Exception Code

Figure Exception Response Message

The next two Figures shows an example of a DTE query and a exception response from a LOGO! 0BA4 device (operation mode STOP):

Field Name	Code (hex)	Meaning
Command	21	Read Byte

Figure Example Faulty Command Query 0BA4

Here is an example of a response to the query above:

Field Name	Code (hex)	Meaning
Confirmation Code	15	Exception
Exception Code	05	Unknown command

Figure Example Exception Response 0BA4

Exception Codes

Type	Name	Meaning
01	DEVICE BUSY	LOGO! can not accept a telegram
02	DEVICE TIMEOUT	Resource unavailable, the second cycle of the write operation timed out
03	ILLEGAL ACCESS	Illegal access, read across the border
04	PARITY ERROR	parity, overflow or telegram error
05	UNKNOWN COMMAND	Unknown command, this mode is not supported
06	XOR INCORRECT	XOR-check incorrect
07	SIMULATION ERROR	Faulty on simulation, RUN is not supported in this mode

---

Appendix A - Address Scheme

This Appendix contains information about the memory address ranges of the LOGO! controller.

LOGO 0BA5

The listing below shows the address scheme of the LOGO! device 0BA5. Codes are listed in hexadecimal.

R indicates that is supported in operation mode RUN. W indicates that write is supported.

Base Address	Byte Count (dec)	Access	Meaning	Example
0522	1	W		01 05 22 00
--	--	--	--	--
0552	1	W	Display at power-on? I/O = 01; DateTime = FF	02 05 52
--	--	--	--	--
0553 - 0557	5		Analog output in mode STOP	05 05 53 00 05
--	--	--	--	--
055E	1	W	Program Checksum HiByte	02 05 5E
055F	1	W	Program Checksum LoByte	02 05 5F
--	--	--	--	--
0566 - 056F	10		Password memory area	05 05 66 00 0A
0570 - 057F	16		Program Name	05 05 70 00 10
--	--	--	--	--
05C0 - 05FF	64		Block Name index	05 05 C0 00 40
0600 - 07FF	512		Block Name	05 06 00 02 00
0800 - 0A7F	640		Text Box 1..10 (64 bytes per Text Box)	05 08 00 02 80
--	--	--	--	--
0C00 - 0D17	280		Program memory index	05 0C 00 01 18
--	--	--	--	--
0E20 - 0E47	40		Digital output Q1..16	05 0E 20 00 28
0E48 - 0E83	60		Merker M1..24	05 0E 48 00 3C
0E84 - 0E97	20		Analog output AQ1..2	05 0E 84 00 14
0E98 - 0EBF	40		Open Connector X1..16	05 0E 98 00 28
0EC0 - 0EE7	40			05 0E C0 00 28
0EE8 - 16B7	2000		Program memory area	05 0E E8 07 D0
--	--	--	--	--
4100	1	W		01 41 00 00
--	--	--	--	--
4300	1	W	Write RTC DT = 00	01 43 00 00
4301	1	W	Write RTC S/W = 00	01 43 01 00
--	--	--	--	--
4400	1	W	Load RTC DT = 00	01 44 00 00
4401	1	W	Load RTC S/W = 00	01 44 01 00
--	--	--	--	--
4740	1	W	Password R/W initialization; Data Byte = 00	01 47 40 00
--	--	--	--	--
4800	1	W		01 48 00 00
--	--	--	--	--
48FF	1	W	Password set? yes = 40; no = 00	02 48 FF
--	--	--	--	--
1F00	1			02 1F 00
1F01	1			02 1F 01
1F02	1	R	Ident Number	02 1F 02
1F03	1		Version character = V	02 1F 03
1F04 - 1F08	5		Firmware	02 1F 04 ..
--	--	--	--	--
FB00 - FB05	6	W	Clock memory area	01 FB 00 03 ..

---

Appendix B - Application Notes

This Appendix contains information and suggestions for using the protocol in your application.

Maximum Query/Response Parameters

The listings in this section show the maximum amount of data that each controller can request or send in a DTE query, or return in a LOGO! response. All codes are in hexadecimal and the quantities (number of bytes) are in decimal. The correct amount of data (c = Byte Count) is a multiple of 4 bytes.

Query/Response Parameters List 0BA4 and 0BA5

N indicates that it is not supported. 0 indicates that the command generate no response. ( XX ) indicates the corresondending command code.

Command	Description	Query	Response
01	Write Byte Command	4	1
02	Read Byte Command	3	(03)
03	Read Byte Response	(02)	5
04	Write Block Command	6 + n	1
05	Read Block Command	5	2 + n
06	Acknowledge Response	(..)	1
06	Fetch Data Command	1	(11)
11	Fetch Data Response	(13/06)	70 + n
12	Stop Operating	4	1
13	Start Fetch Data	5 + n	(11)
14	Stop Fetch Data	4	0
15	Exception Response	(..)	2
17	Operating Mode	4	2
18	Start Operating	4	1
20	Clear Program	N	(15)
21	Connection Request	N	(15)
22	Restart	N	(15)

Figure Maximum Q/R Parameters 0BA4 and 0BA5

Notes:

1. The information in brackets shows the corresponding command code.
2. The LOGO! Version 0BA4 generate no response for command code 20, 21 and 22.

Query/Response Parameter List for 0BA6

0 indicates that the command generate no response.

Command	Description	Query	Response
01	Write Byte Command	4	1
02	Read Byte Command	3	(03)
03	Read Byte Response	(02)	7
04	Write Block Command	8 + n	1
05	Read Block Command	7	2 + n
06	Acknowledge Response	(..)	1
06	Fetch Data Command	1	(11)
11	Fetch Data Response	(13/06)	80 + n
12	Stop Operating	4	1
13	Start Fetch Data	5 + n	(11)
14	Stop Fetch Data	4	0
15	Exception Response	(..)	2
17	Operating Mode	4	2
18	Start Operating	4	1
20	Clear Program	1	2
21	Connection Request	1	6
22	Restart	1	1

Figure Maximum Q/R Parameters 0BA6

Notes: The information in brackets shows the corresponding command code.

Estimating Serial Transaction Timing

The Transaction Sequence

The following sequence of events occurs during a serial transaction. Letters in parentheses ( ) refer to the timing notes at the end of the listing.

1. The DTE composes the message
2. The query message is transmitted to the LOGO! ( 1 )
3. The LOGO! processes the query message ( 2 ) ( 3 )
4. The LOGO! calculates an error check field ( 4 )
5. The response message is transmitted to the DTE ( 1 )
6. The DTE application acts upon the response and its data

Timing Notes

1. Use the following formula to estimate the transmission time:

            1000 * (character count) * (bits per character)   1000 * (count of bytes) * 8
Time (ms) = ----------------------------------------------- = ---------------------------
                              Baud Rate                                   9600

2. The message is processed at the end of the controller cycle. The worst–case delay is one cycle time, which occurs if the controller has just begun a new cycle. The cycle time of each function is less than 0.1 ms.

The time allotted for servicing the PG interface at the end of the controller cycle (before beginning a new cycle) depends upon the controller model.

3. The Commands 04, 05, 11 and 13 permit the DTE to send or request more data than can be processed during the time allotted for servicing the LOGO! PG interface. If the LOGO! cannot process all of the data in one controller cycle, it will be processed the data over more cycles.

4. Checksum calculation time is about 0.1 ms for each 8 bits of data to be returned in the response.

Application Examples

The following examples show some simple command blocks and the resulting output values.

Read Ident Number

Read the revision byte from the LOGO! address 1f 02:

Command	Query	Response	Description
Read Byte	02 1f 02	06 03 1f 02 40	connection established to 40 (LOGO! 0BA4)
Read Byte	02 1f 02	06 03 00 ff 1f 02 43	connection established to 43 (LOGO! 0BA6)

Figure Example Read Ident Number

Read Firmware

Commands for reading the Firmware (only available for 0BA5 and 0BA6). The access is only available in mode STOP.

The Firmware can be read out on the LOGO! device as follows:

1. Device Operating Mode
2. Read Byte at address [00 ff] 1f 02 for reading the Ident Number.
3. Read Byte at address [00 ff] 1f 03 for reading the version character = V.
4. Read Byte(s)

• Major release 1st character at address [00 ff] 1f 04
• Major release 2nd character at address [00 ff] 1f 05
• Minor release 1st character at address [00 ff] 1f 06
• Minor release 2nd character at address [00 ff] 1f 07
• Patch level 1st character at address [00 ff] 1f 08
• Patch level 2nd character at address [00 ff] 1f 09

Example for the 1st major version of a firmware, in the 3rd minor version with the 32nd error correction (V1.03.32):

Command	Query	Response	Description
Operation Mode	55 17 17 aa	06 42	operation mode STOP (42, RUN = 01)
Read Byte	02 00 ff 1f 02	06 03 00 ff 1f 02 43	connection established to 43 (LOGO! 0BA6)
Read Byte	02 00 ff 1f 03	06 03 00 ff 1f 03 56	major release 1st character = V (ASCII)
Read Byte	02 00 ff 1f 04	06 03 00 ff 1f 04 30	major release 1st character = 0 (ASCII)
Read Byte	02 00 ff 1f 05	06 03 00 ff 1f 05 31	major release 2nd character = 1 (ASCII)
Read Byte	02 00 ff 1f 06	06 03 00 ff 1f 06 30	minor release 1st character = 0 (ASCII)
Read Byte	02 00 ff 1f 07	06 03 00 ff 1f 07 33	minor release 2nd character = 3 (ASCII)
Read Byte	02 00 ff 1f 08	06 03 00 ff 1f 08 33	patch release 1st character = 3 (ASCII)
Read Byte	02 00 ff 1f 09	06 03 00 ff 1f 09 32	patch release 2nd character = 2 (ASCII)

Figure Example Read Firmware 0BA6

Note: The firmware can only be read in STOP mode.

Read Clock

Commands for reading the RTC-Clock (if available). The access is only available in mode STOP.

The clock can be read out on the LOGO! device as follows:

1. Device Operating Mode
2. Write Byte 00 to address [00 ff] 44 00 for initialize reading
3. Read Byte(s)

• Day at address [00 ff] fb 00
• Month at address [00 ff] fb 01
• Year at address [00 ff] fb 02
• Minute at address [00 ff] fb 03
• Hour at address [00 ff] fb 04
• Day-Of-Week at address [00 ff] fb 05

Read Clock Example:

Command	Query	Response	Description
Connection Request	21	06 03 21 44	connection established to 44 (LOGO! 0BA6)
Operation Mode	55 17 17 aa	06 42	operation mode STOP (42, RUN = 01)
Write Byte	01 44 00 00	06	clock reading initialized
Read Byte	02 fb 00	06 03 00 ff fb 00 1e	day = 30 (dec)
Read Byte	02 fb 01	06 03 00 ff fb 01 0c	month = 12 (dec)
Read Byte	02 fb 02	06 03 00 ff fb 02 09	year = 09 (dec)
Read Byte	02 fb 03	06 03 00 ff fb 03 1c	minute = 28 (dec)
Read Byte	02 fb 04	06 03 00 ff fb 04 14	hour = 20 (dec)
Read Byte	02 fb 05	06 03 00 ff fb 05 03	day-of-week = 3 (dec)

Figure Example Read Clock 0BA6

Note: The clock can only be read in STOP mode.

Write Clock

Commands for writing the RTC-Clock (if available). The access is only available in mode STOP.

The clock can be set on the LOGO! device as follows:

1. Device Operating Mode
2. Write Byte(s)

• Day to address [00 ff] fb 00
• Month to address [00 ff] fb 01
• Year to address [00 ff] fb 02
• Minute to address [00 ff] fb 03
• Hour to address [00 ff] fb 04
• Day-Of-Week to address [00 ff] fb 05

3. Write Byte 00 to address [00 ff] 43 00 for writing complete

Write Clock Example:

Command	Query	Response	Description
Connection Request	21	06 03 21 44	connection established to 44 (LOGO! 0BA6)
Operation Mode	55 17 17 aa	06 42	operation mode STOP (42, RUN = 01)
Write Byte	01 fb 00 1e	06	day = 30 (dec)
Write Byte	01 fb 01 0c	06	month = 12 (dec)
Write Byte	01 fb 02 09	06	year = 09 (dec)
Write Byte	01 fb 03 24	06	minute = 36 (dec)
Write Byte	01 fb 04 14	06	hour = 20 (dec)
Write Byte	01 fb 05 03	06	day-of-week = 3 (dec)
Write Byte	01 43 00 00	06	clock writing completed

Figure Example Write Clock 0BA6

Note: The clock can only be set in STOP mode.

Password set?

The password can only be read or set in STOP mode.

The Example shows if a Password is set:

Command	Query	Response	Description
Ident Number	02 1f 02	06 03 1f 02 42	connection established to 42 (LOGO! 0BA5)
Operation Mode	55 17 17 aa	06 42	operation mode STOP (42, RUN = 01)
Read Byte	02 48 ff	06 03 48 ff 40	password exist Y (= 40, N = 00)

Figure Example Read Password 0BA5

Note: The commands order for reading and setting the password will not be described here. A program with password would not be protected otherwise.

Memory Access

The access is only available in mode STOP.

Here are a few example sequences for accessing the memory depending on operating mode:

 Set RTC
 Tx: 02 1f 02 55 17 17 aa 01 44 00 00
 Rx:
 @STOP 06 03 1F 02 42 06 42 06
 @RUN: 06 03 1F 02 42 06 01

 Detect LOGO! RUN?
 Tx: 55 17 17 AA
 Rx:
 @STOP 06 42
 @RUN 06 01

 Stop LOGO! RUN
 Tx: 55 12 12 AA
 Rx: 06

 Start LOGO!
 Tx: 55 18 18 AA
 Rx: 06

 Read the data
 Tx: 05 05 C0 00 40
 Rx:
 @STOP 06 ...
 @RUN n/a

Figure Example Memory Access

---

Appendix C - Checksum Generation

Checksum Generation

The Checksum field is one byte, containing a 8–bit binary value. The Checksum value is calculated by the transmitting device, which appends the Checksum to the Data field. The receiving device recalculates a Checksum during receipt of the message, and compares the calculated value to the actual value it received in the Checksum field. If the two values are not equal, an error results.

Only the data bytes of a message are used for generating the Checksum. Command, Address and Byte Count fields, and the End delimiter, do not apply to the Checksum.

Example

The implementation is simple because only an 8-bit checksum must be calculated for a sequence of hexadecimal bytes. We use a function F(bval,cval) that inputs one data byte and a check value and outputs a recalculated check value. The initial value for cval is 0. The checksum can be calculated using the following example function (in C language), which we call repeatedly for each byte of the Data field. The 8-bit checksum is the XOR off all bytes.

int F_chk_8( int bval, int cval )
{
  return ( bval ^ cval ) % 256;
}

Figure Checksum implementation in C language

Note: Therefore the Checksum value returned from the function can be directly placed into the message for transmission.