1 Introduction In traditional PLC-frequency converter integrated systems, the start/stop and fault monitoring of the frequency converter are achieved end-to-end by the PLC through digital signals. The frequency of the frequency converter is controlled by the PLC through analog output ports outputting 0-5 (10)V or 4-20mA signals, requiring the PLC to be configured with expensive analog output port modules. When the frequency converter malfunctions, the PLC reads the fault alarm contacts of the frequency converter, but the specific cause of the fault is not clear. It is necessary to check the alarm information of the frequency converter and then read the frequency converter manual to find out. With the development of AC frequency converter control systems and communication technology, serial communication between the PLC and the frequency converter can be used to realize the control of the frequency converter by the PLC. 2 Selection of Frequency Converter Danfoss VLT series frequency converters provide support for serial communication technology. The serial communication technologies it supports include standard RS-485, PROFIDrive, Lonworks and other fieldbus methods. Among them, RS-485 communication provides users with the most affordable and practical serial communication method without any additional costs. Communication with the VLT inverter can be achieved simply by sending data according to the communication data structure, control word, and status word format specified by the Danfoss VLT inverter. VLT provides users with two control word and status word format standards: the Danfoss standard Danfoss FC protocol and the PROFIBUS standard PROFIDrive protocol. The FC protocol provides users with more control and status information related to the VLT. The Danfoss FC protocol is selected for this project. 3. PLC Selection Siemens industrial control products have a high market share in the industrial control application field. The S7-200 series is a small-scale PLC member of the Siemens SIMATIC family. A unique feature of the S7-200 PLC is its free communication port mode, which allows users to define their own communication protocols. Due to this free communication port mode, the PLC can be easily connected to the inverter in this system. The PLC communicates with the frequency converter via its free communication port to control the converter's operation and read parameters such as voltage, current, power, frequency, and all alarm information including overvoltage, overcurrent, and overload. This method offers higher reliability than controlling the frequency converter through external ports, saves valuable PLC I/O ports, and obtains a significant amount of information about the frequency converter. In this example, the author will program the S7-200's free port according to the Danfoss FC protocol. 4 VLT Serial Communication 4.1 VLT Communication Principle The VLT frequency converter's serial communication is asynchronous half-duplex, using byte parity check and block transfer XOR check methods. Each frequency converter is equipped with a standard RS-485 communication port, allowing the protocol to be transmitted via the RS-485 electrical interface. The PLC acts as the master, and the frequency converter as the slave. The transmission of system codes is controlled by the master, which continuously sends codes for a specific address to the slave, waiting for the slave's response. The master unit can support up to 31 slave units, which can be increased to 126 slave units with repeaters, meaning the slave unit addresses can be set up to 126. During communication, each byte is transmitted starting with a start bit, followed by 8 data bits, forming a new byte. Each byte is checked for correctness by a parity bit and terminated by a stop bit. A single byte consists of 11 bits. 4.2 VLT Code Structure Each code begins with a start byte (stx), where stx = 02h. This is followed by a byte indicating the code length (lge) and a byte indicating the inverter address (adr). Then come some data bytes (which vary depending on the code type). The entire code ends with a data control byte (bcc). The structure is shown in the attached table. [align=center] Appendix VLT Code Structure[/align] In the above data structure: (1) pke occupies two bytes, including the parameter command type and the number of parameters; (2) ind is the index, also occupying two bytes. The index byte is used to indicate whether it is a read command or a write command. In read commands, it must have the format 0400h, and in write commands, it must have the format 0500h; (3) pwe is the parameter value block. It occupies four bytes, divided into a high word (pwe h) and a low word (pwe l). "For example, if the host wants to change the current inverter parameters, the new parameters should be written in the parameter pwe and sent to the inverter;" (4) pcd is the process block, occupying 4 bytes. It has two states. When the host sends to the slave, pcd1 is the control word and pcd2 is the reference value; when the slave sends to the host, pcd1 is the status word and pcd2 is the current output frequency; (5) bcc is the data control byte. It is used to check whether the received command is correct. Its initial value is 0, and then it is XORed with all bytes preceding that byte. 5. PLC Programming Example 5.1 Inverter Initialization Subroutine: The PLC executes the initialization subroutine during the first scan to initialize the ports and the RCV instruction. To increase program reliability, after initialization, if an idle port is detected, the RCV instruction is executed to put the port into an accepting state. The initialization subroutines are as follows: network 1 // Network header check port free (programmable in main program) // Set port attributes ld sm0.0 movb 73, smb30 network 2 // Receive information status ld sm0.0 movb 102, smb87 network 3 ld sm0.0 movb 16#02, smb88 movb 50, smb92 movb 50, smb94 r sm87.2, 1 network 4 ld sm0.0 atch int1, 23 // Interrupt for port 0 receiving completed network 5 ld sm0.0 atch int0, 9 // Interrupt for port 0 transmitting completed network 6 ld sm0.0 eni // Interrupt enabled network 7 ld sm0.0 movd &vb250, vd220 // Load address pointer movb 0, vb242 // Clear BCC code register movd &vb300, vd224 // Load address pointer movb 0, vb246 // Clear BCC code register 5.2 Inverter Parameter Modification Subroutine When information that needs to change the current inverter state needs to be transmitted, the "Control Subroutine" is called. First, it disables port reception, then edits the control code and calculates the BCC checksum, and sends it; when no information that needs to change the current inverter state needs to be transmitted, the "Empty Command" subroutine is called. Because the PLC needs to send commands to the inverter to read its current operating status, and the "control subroutine" code is cumbersome and inefficient, we can pre-arrange the Morse code that the "empty command" program needs to transmit (using short Morse code). The "control subroutine" program code is as follows: network 1 ld sm0.0 //Stop receiving on port 0 r sm87.7, 1 rcv vb300, 0 network 2 ld l0.0 movw 16#047c, vw211 movw lw1, vw213 network 3 ld l0.1 movw 16#0434, vw211 movw 0, vw213 network 4 ld sm0.0 movw lw1, vw213 network 5 // Network title // Network comment ld sm0.0 movb 16#02, vb200 movb 16#0e, vb201 movb lb3, vb202 movd 0, vd203 movd 0, vd207 hta vb200, vb250, 15 network 6 ld sm0.0 //Calculate BCC checksum for vw240, +1, +15 network 7 ld sm0.0 xorb *vd220, vb242 network 8 ld sm0.0 incd vd220 network 9 next network 10 ld sm0.0 hta vb242, vb265, 1 //Write BCC checksum to transmit buffer network 11 ldb= vb251, 16#0e //Send after transmit buffer is ready s s0.1, 1 network 12 lscr s0.1 network 13 ld sm4.5 xmt The VB250, 0 network 14 SCRE 5.3 inverter communication completes the transmission process. After transmission, the transmission completion interrupt routine is executed. Its operations include: enabling RCV; clearing the BCC code register; reloading the address pointer used to calculate the BCC checksum; clearing the byte storing the instruction end character in the receive buffer to determine if the next instruction format is correct. After receiving, the receive completion interrupt routine is executed, which restores the hexadecimal ASCII code in the receive buffer to data and saves it. Then, the "receive processing" subroutine is called. It mainly calculates the BCC checksum of the instruction in the receive buffer and compares it with the BCC checksum in the instruction, and processes the data in the code. 6 Conclusion Using this method, a Siemens PLC is used to control a Danfoss inverter via a free port using the Danfoss FC protocol, greatly reducing the complexity of wiring connections and avoiding the impact of various electromagnetic interferences on the control equipment.