Mark-

Hello, I never found a published specification when I was looking for one several years ago. IIRC it was much like SNPX with an attach and establish session handshake before reading/writing data. Also, I do not recall if Wireshark had a dissector for  SRTP. You can use the demo of PeakHMI and in configuration mode capture the handshake and read commands. For write commands you would need to create points/tags and issue writes at runtime, still using the demo version.      

CIP is published by ODVA. AB does publish some documents related to CIP services AB devices support and the breakdown of some structures. As to OMRON specific, I would assume Omron publishes how it supports CIP. Omron publishes information on FINS and other protocols supported and I could not see why Omron would keep CIP access unpublished. The two things to know for Omron are what services does the device support and what addressing format. CIP defines the remaining parts, assuming Omron did not do something vendor specific. Ask Omron.  

Hello, Service code 0x4D is "Write Tag Service". But you post that you want to "read". Use read tag service or read tag fragmented service. And you need to use the correct addressing.  

Hello, PeakHMI might fit your needs.    

Hello, PeakHMI might be a good fit for you.  

Hello,   Today we released a FREE AB DF1 serial slave simulator. All of our simulators are freeware. File types supported Input, Output, Status, Binary, Timer, Counter, Control, Integer, Floating point, ASCII, BCD, Block-transfer, Message, PID, SFC status, ASCII string   File numbers 0-999 Logical binary addressing is supported. Command/functions supported CMD   Function       Name $0F     $00                 word range write $0F     $01                 word range read $0F     $26                 read modify write $0F     $A2                protected typed logical read with three address fields $0F     $AA                protected typed logical write with three address fields $0F     $AB                protected typed logical write with mask   Notes: 1) Message file data, zero (0) is returned for all internal/reserved memory for each element. 2) PID file data, zero (0) is returned for all words of each element. 3) Read-Modify-Write, single word only.   If you need any help/find a problem/request an addition or change, contact us using our support email address (in the “About” dialog).   Here is the link to the installer: http://www.hmisys.com/downloads/PeakHMISlaveSimulatorInstall.exe   Good luck,   Mark http://www.peakhmi.com/

What do you mean "really secure?"  

Hello, The protocol is named "FACON-PLC' and is defined in the FACON PLC Communications Protocol manual 3/16/2001 Ver 1.1. The protocol uses a master-slave approach. It is not a complicated protocol. The user manual has examples of the packets.  

To subjective of a subject.

Hi, PeakHMI might be a good fit and cost a bit less.  

Yeah, I strongly disagree with the first statement. PeakHMI, is full featured, is very easy to use and is low cost (compared to other HMIs with similar feature sets). And yes, I am associated with PeakHMI.  

Hello, PealHMI as an LG driver and a built in OPC server. It might work for you.  

Hello, >The protocol is proprietary so you cannot do that (unless you reverse engineer it). The protocol is described in several Mitsubishi user manuals. Q Corresponding MELSEC Communication Protocol Reference Manual (SH(NA)-080008-F(0406)MEE)  

Hello, You do not say which HMI.  

Hello, You might find Delivery of CIP Over RA Serial DF1 Links to be of help. IIRC, a few other documents exist that have snippets of useful data. Mark  

Hello, If you are referring to the ????. A lot of time it is an application defined value. By that I mean the protocol allows the application to use that space for any purpose. Like an incrementing value to track the message. I do not recall in the this case but, it could have been that the two fields were actually a word and not a byte. But, the protocol only supports 0-255 for the field. That happens sometimes. >you can't be very confident It may seem that way but, most protocols do not contain information about the devices using the protocol and protocols are not created with fields that are specific to a device type/model.  The thing to do is to create messages with all the possible values for an unknown field and see it anything fails/changes. Not all fields in a protocol are "breaking" fields. At other times the fields report status at some layer level that have nothing to do with a proper "message" and can contain any value. My2c. Mark  

Hello, This might help Byte Hex Dec Name Data 0 1 1 Request   1 7 7 PCCC command   2 0 0 Length   3 11 17     4 0 0 Session Handle   5 0 0     6 1 1     7 0 0     8 0 0 Status   9 0 0     10 0 0     11 0 0     12 0 0 Sender Context   13 0 0     14 0 0     15 0 0     16 0 0     17 0 0     18 0 0     19 0 0     20 0 0 Options   21 0 0     22 0 0     23 0 0     24 0 0 Handle   25 0 0     26 0 0     27 0 0     28 0 0 Target node   29 5 5 ?????   30 0 0 Our node   31 0 0 ???   32 0F 15   CMD - Command byte; typically 0x0F 33 0 0   STS - 0x00 in request 34 0 0   TNS - Increment per read 35 2 2     36 1 1 Function Code protected typed logical read with three address fields 37 0 0 Byte count to read   38 0 0 File number   39 1 1 File Type   40 0 0 Element number   41 6 6 Sub element   42 7       43 5       44 2         Regards, Mark http://www.peakhmi.com/  

Hello, PeakHMI can perform the task.

Hello, The protocol is documented in several manuals. I made a spreadsheet that breaks apart a few commands. PM me an email address and I will send it, if you want it.

Hello, You need to write some code that uses one of the Omron protocols. Omron publishes all the protocols in manuals. W342-E1-11 is a good manual. There are many manuals PeakHMI supports Omron. You can use the demo version if you want to snoop the packets or the full version if it fits your needs.

Hello, That is an OMRON Host link (C-mode) command, DM Area Write. Manual W342-07 covers the protocol.

Hello, > Is there a guide to configuring PeakHMI. Sure, there are videos, example projects, a 900+ page manual and a "Getting started" document. >..simulated PLC Omron FINS protocol. That is not what you said in your first message. Simulating the FINS protocol is one thing, not that difficult. Simulating a PLC, correctly, is a large undertaking. To your last post: open the socket and when it is connected (assuming TCP) issue the read command as is covered in the protocol specification. When you post a frame for us to look at, only post the data bytes, posting the source means I have to pick through all the code to get the data bytes. If you post only the data bytes, I can copy the bytes to a spreadsheet and decode rapidly. If I have to pick through, I will not do it. My2c.

Hello, Download and install the PeakHMI demo. In configuration mode set a read to read the data register you want. Install Wireshark if needed. Start Wireshark and begin a trace. Select the read test button in PeakHMI. Stop the read test after success. Stop Wireshark trace. Look at the trace in Wireshark and compare to what you are doing to find the error. My2c.

Hello, I could be wrong, I think all K series use KGL WIN for programming.

Hello, PeakHMI can read data from the PLC5 and save it to an Excel spreadsheet. The demo installer is at http://www.hmisys.com/downloads/PeakHMIDemoInstaller.exe Let me know if you need any help.