JayPrakashTiwari

Hello Everyone, I have a Omron CJ2M PLC, and I have configured the Ethernet/IP port of this PLC to communicate over ethernet connection. I want to read/write the DM, HR memory areas of Omron PLC (CJ2M) using eip protocol communication. Is there any protocol specification which explains the telegram structure to be sent over ethernet to be able to read/write the values in omron plc over EIP? I want to know the command structure which can be sent to PLC and PLC will respond with the proper response. 

Which communication?  Is it Hostlink, FINS or EIP??

Thanks Everyone.  I am able to read/write the values from CJ2M PLC using EIP protocol. We can send requests to Omron EIP using "Send Unit Data" with service code 0x4d. This service (0x4d) is used to send write request as per EIP documentation, but we can insert the Omron specific commands (FINS) to read the memory areas in command specific data. 0000   00 00 00 00 00 80 0e 00 01 00 80 00 02 00 00 00 0010   00 00 00 12 01 01 82 00 00 00 00 01 Once again, thanks everyone for your replies.

Hello Kaiser, Thanks for providing the document. But this document is more towards the commissioning part. I wanted to know the protocol specification, telegram structure which is sent from PLC to other devices, and from other devices to PLC (Request/response).  Is it possible for you to record / sniff the packets using some tool and provide me. That would be helpful for me.

Yes, In EIP commands I too found 0x4d is for write. Where can i get the document to implement this protocol specially for Omron PLC?

Hello Jay, Actually, My requirement is to implement this using EIP protocol, so I can not use FINS here.  

Hello All, Thanks for your replies. As Michael saying, i need to connect my PC to send read / write commands to omron CJ2M PLC. As per my understanding, Omron PLCs can be communicated over 3 methods: 1) Hostlink, 2) FINS, (TCP or UDP) and 3) EIP. My requirement here is to connect CJ2M through EIP, and send Read/Write commands over EIP(CIP) protocol. Initally EIP communication needs to send 2 requests: 1) List Services and 2) Register Sessions Register Sessions returns a handle which should be used in further communication over EIP. I am successfully able to send List Services, Register Session and Forward Open (RR Data) and these are successfully replied by the Omron PLC. There is no problem in these 3 requests/responses. Now I want to know which command/service need to be used to read the memory area of Omron (say DR 20 memory). I am sending service code 0x4d over RR Data, but it says "Vendor Specific Error" and then connection gets terminated. I need wireshark logs or some sniffed packets where a request / response is captured over EIP communication from PC to Omron PLC (no fins, no hostlink).

I want to implement Omron CIP, which communicates with CJ2M CPU35 Controllers across an Ethernet/IP network using the Common Industrial Protocol (CIP). Which commands they will use? FINS? or some other commands? Can someone help me to understand the protocol or command structure which can be used to implement Omron CIP (Ethernet/IP)?

Thanks CrossBow. Do you have some documents related to CIPRead and CIPWrite for Omron NJ series PLCs?    

Hello Everyone, I am new to this thread. I have CX-ONE and I have configured my Omron CJ2M CPU35 PLC to work over EIP. So i have configured the Ethernet/IP port and assigned an IP address. Now I want to read/write the values from Omron PLC for addresses in DM memory area. Anyone can help here with the request format or telegram structure to read / write the values from omron PLC ?  

I want to read and write the memory areas inside an OMRON - CJ2M CPU 35 PLC using Ethernet/IP protocol. I have configured the IP address to Ethernet / IP slot, and able to ping it. I want to know the protocol specification or request byte structure to read/write the values from/to omron PLC.