[Req Type][Name][DB.no][Low addr = start addr][Count][0xFF][Offset]
Req type: SEND = 0x41, FETCH = 0x45
Name: C (0x43), D (0x44),E (0x 45), R (0x52), S (0x53),T (0x54) or X (0x58).

For example to read dataword 5 of DB 10 (0x0A in hex), Citect sends out a message like:

00 00 45 44 0A 05 00 01 FF 0F 10 03.

A problem can occur with the way Byte10 (0F in the above example) in the frame is handled in non-Siemens devices.  This nibble is ignored by Siemens PLCs, but for non-Siemens PLCs this nibble is always checked.

This Byte 10 has the following meaning in 3964R/RK512 protocol:

Bits 0-3 : Coordination flags (right most bits)

Bits 4-7: CPU number of partner (number between 1 and 4).

If have not specified a Coordination flag, bits 0-3 will have the value 0xF

If you do not specify a CPU number, but a Coordination flag, bits 4-7 will have the value 0.

If you do not specify a CPU number and do not specify a Coordination flag, bits 4-7 will have the value 0xF.

Some non-Siemens devices require a 0xFF value for byte 10, in stead of the default value 0x0F.

To achieve this you simply have to set the address in the I/O Device form in Citect to a value of 15, in stead of the default value of 0.