Omron FINS communication protocol

Supported device types and versions
Communication line configuration
Station configuration
I/O tag configuration
Literature
Changes and modifications
Document revisions

Supported device types and versions

The FINS protocol (Factory Interface Network Service) implements client (master) communication with Omron PLCs. The FINS/UDP protocol variant based on the UDP protocol (on the TCP/IP-UDP line) as well as the FINS/TCP protocol variant using the TCP protocol (on the TCP/IP-TCP line) are implemented. Read (MEMORY AREA READ) and write (MEMORY AREA WRITE) commands are supported.
Note: it is recommended to use the FINS/UDP protocol variant; FINS/TCP protocol has a higher overhead (16 bytes for each request and response) and is suitable for demanding network environments (firewalls, the need for address translation - NAT, etc.). Not every Omron PLC supports the FINS/TCP protocol variant.

Communication was tested against a CJ-series CJ2M CPU (both FINS/UDP and FINS/TCP protocol variant).

Communication line configuration

  • Communication line category: TCP/IP-UDP (FINS/UDP protocol ) or  TCP/IP-TCP (FINS/TCP protocol).
  • TCP/IP-UDP parameters:
    • Host: IP address or of the network interface that is used for communication by the KOM process. A symbolic name that can be translated to an IP address can be entered too.
      Note: a symbolic name ALL can be entered - in which case all available interfaces are used.
    • Port: UDP port number that is used for communication by the KOM process (according to standard 9600).
    • Note: The parameters of the backup server (Host and Port) are not used in this protocol.
  • TCP/IP-TCP parameters:
    • As the Host, Port and Line Number parameters are not used (PLC address is configured on the station), arbitrary values can be specified.


Station configuration

  • Communication protocol "Omron FINS".
  • IP Address: IP address of the Omron device with which the KOM process communicates directly via the Ethernet network. This can be the target device or an intermediary (a gateway device). If it is a gateway, the target device is specified using the Destination Network Address (DNA), Destination Node (DA1), Destination Unit (DA2) protocol parameters.
  • Port: TCP/UDP port number of the Omron device (according to standard 9600)


Station protocol parameters

Configuration dialog box - tab Parameter.
They influence some optional parameters of the protocol. The following station protocol parameters can be set:

Table 1

ParameterMeaningUnitDefault value
Source Parameters

Section of parameters describing the source address (D2000 KOM process)

Source Network Address (SNA)

This parameter specifies the network address number of the source device (D2000 KOM process). The Source Network Address is sometimes referred to as SNA in Omron FINS documentation.
The valid range is 0 to 127. Actual network numbers can range from 1 to 127. FINS interprets 0 as 'use the local network'; as such, 0 must not be used when data will be routed through gateway PLCs. The default value for network addresses is zero. This is interpreted by FINS as an instruction to use the local network. Actual network numbers can range from 1 to 127. Using zero is convenient if there is only one network level. When using gateway devices, however, specify the actual network number (1–127) to avoid routing ambiguities.		-0

Source Node (SA1)

This parameter specifies the node number of the source device (D2000 KOM process). The Source Node is sometimes referred to as SA1 in Omron FINS documentation. The valid range is 0 to 254. If the destination PLC is configured to use automatic address generation, then this number must be the host number portion of the host computer's IP address.
For example, if the host computer has an IP of 111.222.333.123 and the subnet mask is 255.255.255.000, the source node number should be 123. If the target PLC is configured to use an address table, then the table must have an entry for the host computer's IP. The node number in this table entry must agree with the source node number entered for the driver.
Note: if the line is configured as TCP/IP-TCP (FINS/TCP protocol), it is recommended to use a value of 0, which means that the node number of the source device will be assigned by the PLC during connection establishment.		-254

Source Unit (SA2)

This parameter specifies the number of the Unit at the source device (D2000 KOM process). The Source Unit is sometimes referred to as SA2 in Omron FINS documentation. It is an arbitrary number in range 0-255.-0
Destination ParametersSection of parameters describing the destination address (Omron PLC)

Destination Network Address (DNA)

This parameter specifies the network address number of the destination device. The Destination Network Address is sometimes referred to as DNA in Omron FINS documentation. The valid range is 0 to 127.
Actual network numbers can range from 1 to 127. FINS interprets 0 as use the local network; as such, 0 must not be used when data will be routed through gateway PLCs.		-0

Destination Node (DA1)

This parameter specifies the node number of the destination device. The Destination Node is sometimes referred to as DA1 in Omron FINS documentation. The valid range is 0 to 254.
Note: if the line is configured as TCP/IP-TCP (FINS/TCP protocol), this parameter is not used, as the node number of the destination device will be announced by the PLC during the connection establishment.		-0

Destination Unit (DA2)

This parameter specifies the destination device unit number, which is sometimes referred to as DA2. The valid range is 0 to 255. The default number for DA2 is 0.-0
Other ParametersOther communication parameters

4-byte Endian Mode

The parameter affects the work with 4-byte values ​​(DWORD, LONG, FLOAT), which are read in two consecutive registers. E.g. I/O tag with address DM28,FLOAT will read registers 28 and 29 from DM memory and interpret them as a 4-byte real number. The "4-byte Endian Mode" parameter specifies the order of the registers and bytes in the resulting number.
Meaning of letters and numbers in the parameter value name:

  • The numbers 1, 2, 3 and 4 indicate the byte order in the TCP/UDP packet in the communication (bytes are always received in the order 1,2,3,4, i.e. bytes 1 and 2 form a lower register, bytes 3 and 4 form a higher register).
  • b - register with lower address interpreted as big-endian (i.e. bytes 1,2 where 1st byte is more significant, 2nd byte is less significant)
  • B - register with higher address interpreted as big-endian (i.e. bytes 3,4 with 3rd byte is more significant, 4th byte is less significant)
  • l - register with lower address interpreted as little-endian (i.e. bytes 1,2 where 2nd byte is more significant, 1st byte is less significant)
  • L - register with higher address interpreted as little-endian (i.e. bytes 3.4 with 4th byte is more significant, 3rd byte is less significant)

The order of letters and numbers indicates the order of registers and bytes in the interpretation of the resulting 32-bit number, on the left is the most significant byte/register, on the right the least significant.

  • Bb (3412) - big-endian, 2nd register significant - byte order within the register is big-endian, 2nd register is more significant
  • bB (1234) - classic big-endian - byte order within the register is big-endian, 1. register is more significant
  • Ll (4321) - classic little-endian - byte order within the register is little-endian, 2. register is more significant
  • lL (2143) - little-endian, 1st register significant - byte order within the register is little-endian, 1st register is more significant

For example, if bytes <AA><BB><CC><DD> are received, the Bb (3412) order means that the hexadecimal value CCDDAABB will be interpreted, which in the case of DWORD type is a number 3 437 079 227. The IL (2143) order would mean interpretation as a hexadecimal value of BBAADDCC, which in the case of a DWORD type is a number 3 148 537 292.

Note: 2-Byte values are currently interpreted as big-endian. 

-Bb (3412) - big-endian, 2nd register significant

Data Size

Maximum count of data bytes that are requested in one request. The total size of a response is 14 bytes + Data Size.Byte512

Retry Count

Maximum count of request retries. If no reply returns after a request had been sent, the station will be in the status of a communication error.s2
Retry Timeout
Timeout before resending a request if no reply had not received.s0.1
Wait Timeout
Maximum wait time to receive a response.s0.1
Full debug
Logging of additional debug information about communication.YES/NONO

Note: the configuration of the network parameters for directly connected PLCs was as follows:

  • Source Node = 101 (the address of the computer with D2000 was 192.168.1.101). Other values worked too, with the exception of 0-2.
  • other Source/Network parameters were on defaults (0)


I/O tag configuration

Possible types of I/O tag values: Ai, Ao, Di, Do, Ci, Co.

I/O tag address:

In the Omron FINS protocol, the address space is divided into several areas. Work with the following areas is supported:

  • AR - Auxiliary Area
  • DM - DM Area
  • CIO - CIO Area (external inputs/outputs)
  • HR - Holding Area (persistent values, which are kept when power is turned OFF or operation stops in the PLC )
  • TC - Timer/Counter Area
  • WR - Work Area (memory used for programming)

In each area, there is independent addressing with an address size of 2 bytes, i.e. addresses from 0 to 65535. The actual size of the address space depends on the particular PLC model.
The size of the register in the AR, DM, CIO, HR, WR areas is 2 bytes.

The address of the I/O tag format is <area><offset> [.<bit>] [,<type>] where:

  • <area>is the address space area (AR, DM, CIO, HR, WR).
  • <offset> is the register address (0-65535). In the case of multi-register variables (e.g. FLOAT), this is the address of the first register. It is possible to enter a hexadecimal number using the # character, e.g. DM#3A.
  • <bit> is an optional part of the address that specifies a specific bit (0-15) within the register. This allows individual bits to be addressed.

  • <type> is an optional part of the address that specifies how the data is interpreted:

    TypeDescription
    BITWorking with a single bit (default value if the address contains a bit specification, eg HR1.3)
    BYTE_UThe higher (first) byte of the register
    BYTE_LThe lower (second) byte of the register
    WORDRegister interpreted as a 16-bit unsigned number (default value if the address does not contain a bit specification, e.g. HR1)
    SHORTRegister interpreted as a 16-bit signed number
    BCDRegister interpreted as an unsigned BCD number (0-9999).
    SBCDRegister interpreted as a signed BCD number (+/-7999). The sign is defined by the highest bit.
    LBCDTwo 16-bit registers interpreted a 4-byte unsigned BCD number (0-99999999).
    SLBCDTwo 16-bit registers interpreted a 4-byte signed BCD number (+/-79999999). The sign is defined by the highest bit.
    DWORD

    Two 16-bit registers interpreted as a 32-bit unsigned number (byte order depends on the  4-byte Endian Mode parameter)

    LONGTwo 16-bit registers interpreted as a 32-bit signed number (byte order depends on the  4-byte Endian Mode parameter)
    FLOATTwo 16-bit registers interpreted as a 32-bit float number (byte order depends on the  4-byte Endian Mode parameter)

Examples of configuration::

  • DM10 - DM area, register 10, interpreted as a 16-bit unsigned number
  • HR0200.0 - HR area, register 200, the lowest bit
  • DM#020, FLOAT - DM area, registers 32 and 33 interpreted as a 32-bit float number 



Literature


Changes and modifications

-

Document revisions

  • Ver. 1.0 - August 28th, 2020 - document created.
  • Ver. 1.1 - September 3rd, 2020 - support for FINS/TCP variant.
  • Ver. 1.2 - October 5th, 2020 - support for BCD numbers.

Related pages:

Communication protocols

Napíšte komentár