通过对串口的监听，终于找到了PPI通讯协议对S7-200PLC数据读取的格式。下面是DELPHI 7的源代码。
var
i,j,fcs_read,fcs_write:integer;
nbyte,readdata_byte,writedata_byte:array of byte;
procedure Tshenchanform.FormCreate(Sender: TObject);
begin
nbyte:=vararrayof([16,2,0,92,94,22]); //确认信息返回给PLC。
fcs_read:=0;
readdata_byte:=vararrayof ([104,27,27,104,2,0,108,50,1,0,0,0,0,0,14,0,0,4,1,18,10,16,2,0,1,0,1,132,0,3,32,139,22]);//读数据
readdata_byte[32]:=22; //结束符
readdata_byte[29]:=trunc(890*8/256); //起始地址为vw890
readdata_byte[30]:=(890*8)mod 256;
readdata_byte[27]:=132; //读取数据为一个字
readdata_byte[24]:=110;//总共有110个字长
for i:=4 to 30 do
begin
fcs_read:=fcs_read +readdata_byte[i];
end;
readdata_byte[31]:=fcs_read mod 256; //校验码计算
mscomm1.output:=readdata_byte;//向串口传送字节
end;
procedure Tshenchanform.BitBtn1Click(Sender: TObject);
begin
s_pf[0]:=256;//要写入PLC的值
writedata_byte:=vararrayof([104,33,33,104,2,0,124,50,1,0,0,0,0,0,14,0,6,5,1,18,10,16,4,0,1,0,1,132,0,3,32,0,4,0,10,12,11,185,22]);
writedata_byte[38]:=22; //结束符
writedata_byte[22]:=4;//写入一个字
writedata_byte[24]:=1;//写入字长
writedata_byte[26]:=1;
writedata_byte[27]:=132;//写入字
writedata_byte[28]:=0;
writedata_byte[32]:=4;
writedata_byte[34]:=16;
writedata_byte[29]:=trunc(12000/256);//写入地址VW1500
writedata_byte[30]:=12000 mod 256;
writedata_byte[35]:=trunc(s_pf[0]/256);//写入的值
writedata_byte[36]:=(s_pf[0] mod 256);
for i:=4 to 36 do
begin
fcs_write:=fcs_write+writedata_byte[i];
end;
writedata_byte[37]:=fcs_write mod 256;//校验码
mscomm1.output:=writedata_byte;//向串口写入数据
end;