JayPrakashTiwari

Read/Write value of Omron memory area using Ethernet/IP (EIP) protocol

24 posts in this topic

Hello Everyone,

I have a Omron CJ2M PLC, and I have configured the Ethernet/IP port of this PLC to communicate over ethernet connection.

I want to read/write the DM, HR memory areas of Omron PLC (CJ2M) using eip protocol communication.

Is there any protocol specification which explains the telegram structure to be sent over ethernet to be able to read/write the values in omron plc over EIP?

I want to know the command structure which can be sent to PLC and PLC will respond with the proper response. 

Share this post


Link to post
Share on other sites

Read the manual re FINS commands.

Share this post


Link to post
Share on other sites

No need for FINS commands when working with Ethernet/IP.

Share this post


Link to post
Share on other sites
On ‎7‎/‎28‎/‎2016 at 0:45 PM, Crossbow said:

No need for FINS commands when working with Ethernet/IP.

That is correct, if he wants to use EIP protocol, he does not need FINS.  Perhaps it would be much easier to use FINS to do what he wants to do though.

Share this post


Link to post
Share on other sites

Since he never did say what it was communicating to, it's hard to say.  He just said he has a CJ2, didn't say if that's the master or slave, if he's trying to get data to another CJ, or a PC.  Not enough detail to really answer.

Share this post


Link to post
Share on other sites

That is true. I guess that I assumed the way that it was worded that it was a PC communicating to the CJ2M since he was concerned with details of the protocol. 

Share this post


Link to post
Share on other sites

Hello All,

Thanks for your replies.

As Michael saying, i need to connect my PC to send read / write commands to omron CJ2M PLC.

As per my understanding, Omron PLCs can be communicated over 3 methods:

1) Hostlink,

2) FINS, (TCP or UDP) and

3) EIP.

My requirement here is to connect CJ2M through EIP, and send Read/Write commands over EIP(CIP) protocol.

Initally EIP communication needs to send 2 requests:

1) List Services and 2) Register Sessions

Register Sessions returns a handle which should be used in further communication over EIP.

I am successfully able to send List Services, Register Session and Forward Open (RR Data) and these are successfully replied by the Omron PLC. There is no problem in these 3 requests/responses.

Now I want to know which command/service need to be used to read the memory area of Omron (say DR 20 memory).

I am sending service code 0x4d over RR Data, but it says "Vendor Specific Error" and then connection gets terminated.

I need wireshark logs or some sniffed packets where a request / response is captured over EIP communication from PC to Omron PLC (no fins, no hostlink).

Share this post


Link to post
Share on other sites

All of us who have responded to this topic strongly feel that you should be using FINS protocol rather than EIP protocol.  It is so much easier from a PC.

Share this post


Link to post
Share on other sites

Hello,

Service code 0x4D is "Write Tag Service". But you post that you want to "read". Use read tag service or read tag fragmented service. And you need to use the correct addressing.

 

Share this post


Link to post
Share on other sites
On 8/12/2016 at 0:43 AM, Jay Anthony said:

All of us who have responded to this topic strongly feel that you should be using FINS protocol rather than EIP protocol.  It is so much easier from a PC.

Hello Jay,

Actually, My requirement is to implement this using EIP protocol, so I can not use FINS here.

 

Edited by JayPrakashTiwari

Share this post


Link to post
Share on other sites
On 8/12/2016 at 3:26 AM, Mark- said:

Hello,

Service code 0x4D is "Write Tag Service". But you post that you want to "read". Use read tag service or read tag fragmented service. And you need to use the correct addressing.

 

Yes, In EIP commands I too found 0x4d is for write.

Where can i get the document to implement this protocol specially for Omron PLC?

Share this post


Link to post
Share on other sites

CIP is published by ODVA. AB does publish some documents related to CIP services AB devices support and the breakdown of some structures.

As to OMRON specific, I would assume Omron publishes how it supports CIP. Omron publishes information on FINS and other protocols supported and I could not see why Omron would keep CIP access unpublished.

The two things to know for Omron are what services does the device support and what addressing format. CIP defines the remaining parts, assuming Omron did not do something vendor specific.

Ask Omron.

 

Share this post


Link to post
Share on other sites

Does anyone have sample project used to read/write memory of CJ2M from PC

Share this post


Link to post
Share on other sites

Search for FINS in Omron downloads...

Share this post


Link to post
Share on other sites

Thanks Everyone. 

I am able to read/write the values from CJ2M PLC using EIP protocol.

We can send requests to Omron EIP using "Send Unit Data" with service code 0x4d.

This service (0x4d) is used to send write request as per EIP documentation, but we can insert the Omron specific commands (FINS) to read the memory areas in command specific data.

0000   00 00 00 00 00 80 0e 00 01 00 80 00 02 00 00 00
0010   00 00 00 12 01 01 82 00 00 00 00 01

Once again, thanks everyone for your replies.

Share this post


Link to post
Share on other sites
On 8/23/2016 at 10:05 PM, Nguyen Duy Nghia said:

Does anyone have sample project used to read/write memory of CJ2M from PC

Which communication? 

Is it Hostlink, FINS or EIP??

Share this post


Link to post
Share on other sites

Hello Jay, I am also trying to read/write data on a Omron NJ.

I am studying the 'NJ_NX-series CPU Unit Built-in EtherNetIP Port User's Manual.pdf'  to understand the CIP messages structure for accessing variables but with no luck.

The point that I missing is: how the destination address should be specified in the datagram? Should I use TCP or UDP? A lot of confusion!

Now I am trying to sniff the packets between two NJ controllers that are exchanging data trough CIPUCMMWrite/CIPUCMMRead istructions with wireshark, to better understand how the CIP messages are composed.

Can you point me to the right way to start this challenge? (any website or manual with better informations)  thanks!

 

 

cip message structure.PNG

Share this post


Link to post
Share on other sites

You'll need to explain what your ultimate objective is.

CIP messaging is not Omron specific. It is an ODVA standard that will work with any compliant manufacturer. The nuts and bolts of this standard are fairly complex.

If your objective is to write a program to communicate with Omron PLCs, then you should use FINS as many others have suggested. 

Share this post


Link to post
Share on other sites

In one NJ, you put the variable names you wish to access in the other inside of quotes, because it is deemed a string value.

Here in the states Omron offers a 2 day class on EtherNet/IP, and it covers NJ, CJ, NX-EIC, and even communication to an AB PLC.  It was a really useful class.

Share this post


Link to post
Share on other sites

Yes my objective is to write a program (VB or C#) to communicate with NJ/NX controller.

I already use FINS with that controllers but I need to declare variables like old CJ standard (DM,HR,W,CIO).

With CIP you can access the tag  names directly.

Crossbow:  I know there is CX-Compolet, but it is not free. Are you talking about CX-Compolet? What you mean 2 day class?

Thanks everyone!

Share this post


Link to post
Share on other sites

No, I am talking about PLCs sharing information with each other over CIP.  I know nothing about CX-Compolet.

And when I said 2 day class, I meant that Omron offers a training class on linking PLCs over EtherNet/IP in the US.  But it doesn't cover writing your own program on a PC to do it.

Share this post


Link to post
Share on other sites

You necromancer, you.

Do note that Omron NJ/NX only respond to services 0x4c, 0x4d, and 0x4e.  In my experiments for my Ignition driver, they did not support services 0x52 and 0x53 for fragmented transfers, and will therefore be unable to bulk transfer structured data types larger than can fit in a large connection, and they only support large connections a bit under 2000 bytes.

 

Hmm. Not so sure about 0x4e, now.  Will have to experiment some more.

Share this post


Link to post
Share on other sites

Hi pturmel,

Just in case someone found this link, it's a complement!

Not tried Read Modify Write Tag Service Request (0x4e). 
You can read/write User Data Type structure with Read Tag Service (0x4c) and Write Tag Service (0x4d) in the limit of connection.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now