Omron FINS communication protocol

Supported device types and versions
Communication line configuration
Station configuration
I/O tag configuration
Literature
Changes and modifications
Document revisions

Supported device types and versions

The FINS protocol (Factory Interface Network Service) implements client (master) communication with Omron PLCs. The FINS/UDP protocol variant based on the UDP protocol (on the TCP/IP-UDP line) as well as the FINS/TCP protocol variant using the TCP protocol (on the TCP/IP-TCP line) are implemented. Read (MEMORY AREA READ) and write (MEMORY AREA WRITE) commands are supported.
Note: it is recommended to use the FINS/UDP protocol variant; FINS/TCP protocol has a higher overhead (16 bytes for each request and response) and is suitable for demanding network environments (firewalls, the need for address translation - NAT, etc.). Not every Omron PLC supports the FINS/TCP protocol variant.

Communication was tested against a CJ-series CJ2M CPU (both FINS/UDP and FINS/TCP protocol variant).

Communication line configuration

Communication line category: TCP/IP-UDP (FINS/UDP protocol ) or TCP/IP-TCP (FINS/TCP protocol).
TCP/IP-UDP parameters:
- Host: IP address or of the network interface that is used for communication by the KOM process. A symbolic name that can be translated to an IP address can be entered too.
  Note: a symbolic name ALL or * can be entered - in which case all available interfaces are used.
- Port: UDP port number that is used for communication by the KOM process (according to standard 9600).
- Note: The parameters of the backup server (Host and Port) are not used in this protocol.
TCP/IP-TCP parameters:
- As the Host, Port, and Line Number parameters are not used (PLC address is configured on the station), arbitrary values can be specified.

Station configuration

Communication protocol "Omron FINS".
IP Address: IP address of the Omron device with which the KOM process communicates directly via the Ethernet network. This can be the target device or an intermediary (a gateway device). If it is a gateway, the target device is specified using the Destination Network Address (DNA), Destination Node (DA1), Destination Unit (DA2) protocol parameters.
Port: TCP/UDP port number of the Omron device (according to standard 9600)

Station protocol parameters

Configuration dialog box - tab Parameter.
They influence some optional parameters of the protocol. The following station protocol parameters can be set:

Table 1

Parameter	Meaning	Unit	Default value
Source Parameters	Section of parameters describing the source address (D2000 KOM process)
Source Network Address (SNA)	This parameter specifies the network address number of the source device (D2000 KOM process). The Source Network Address is sometimes referred to as SNA in Omron FINS documentation. The valid range is 0 to 127. Actual network numbers can range from 1 to 127. FINS interprets 0 as 'use the local network'; as such, 0 must not be used when data will be routed through gateway PLCs. The default value for network addresses is zero. This is interpreted by FINS as an instruction to use the local network. Actual network numbers can range from 1 to 127. Using zero is convenient if there is only one network level. When using gateway devices, however, specify the actual network number (1–127) to avoid routing ambiguities.	-	0
Source Node (SA1)	This parameter specifies the node number of the source device (D2000 KOM process). The Source Node is sometimes referred to as SA1 in Omron FINS documentation. The valid range is 0 to 254. If the destination PLC is configured to use automatic address generation, then this number must be the host number portion of the host computer's IP address. For example, if the host computer has an IP of 111.222.333.123 and the subnet mask is 255.255.255.000, the source node number should be 123. If the target PLC is configured to use an address table, then the table must have an entry for the host computer's IP. The node number in this table entry must agree with the source node number entered for the driver. Note: if the line is configured as TCP/IP-TCP (FINS/TCP protocol), it is recommended to use a value of 0, which means that the node number of the source device will be assigned by the PLC during connection establishment.	-	254
Source Unit (SA2)	This parameter specifies the number of the Unit at the source device (D2000 KOM process). The Source Unit is sometimes referred to as SA2 in Omron FINS documentation. It is an arbitrary number in the range 0-255.	-	0
Destination Parameters	Section of parameters describing the destination address (Omron PLC)
Destination Network Address (DNA)	This parameter specifies the network address number of the destination device. The Destination Network Address is sometimes referred to as DNA in Omron FINS documentation. The valid range is 0 to 127. Actual network numbers can range from 1 to 127. FINS interprets 0 as use the local network; as such, 0 must not be used when data will be routed through gateway PLCs.	-	0
Destination Node (DA1)	This parameter specifies the node number of the destination device. The Destination Node is sometimes referred to as DA1 in Omron FINS documentation. The valid range is 0 to 254. Note: if the line is configured as TCP/IP-TCP (FINS/TCP protocol), this parameter is not used, as the node number of the destination device will be announced by the PLC during the connection establishment.	-	0
Destination Unit (DA2)	This parameter specifies the destination device unit number, which is sometimes referred to as DA2. The valid range is 0 to 255. The default number for DA2 is 0.	-	0
Other Parameters	Other communication parameters
4-byte Endian Mode	The parameter affects the work with 4-byte values (DWORD, LONG, FLOAT), which are read in two consecutive registers. E.g. I/O tag with address DM28,FLOAT will read registers 28 and 29 from DM memory and interpret them as a 4-byte real number. The "4-byte Endian Mode" parameter specifies the order of the registers and bytes in the resulting number. Meaning of letters and numbers in the parameter value name: The numbers 1, 2, 3, and 4 indicate the byte order in the TCP/UDP packet in the communication (bytes are always received in the order 1,2,3,4, i.e. bytes 1 and 2 form a lower register, bytes 3 and 4 form a higher register). b - register with lower address interpreted as big-endian (i.e. bytes 1,2 where 1st byte is more significant, 2nd byte is less significant) B - register with higher address interpreted as big-endian (i.e. bytes 3,4 with 3rd byte is more significant, 4th byte is less significant) l - register with lower address interpreted as little-endian (i.e. bytes 1,2 where 2nd byte is more significant, 1st byte is less significant) L - register with higher address interpreted as little-endian (i.e. bytes 3.4 with 4th byte is more significant, 3rd byte is less significant) The order of letters and numbers indicates the order of registers and bytes in the interpretation of the resulting 32-bit number, on the left is the most significant byte/register, on the right the least significant. Bb (3412) - big-endian, 2nd register significant - byte order within the register is big-endian, 2nd register is more significant bB (1234) - classic big-endian - byte order within the register is big-endian, 1. register is more significant Ll (4321) - classic little-endian - byte order within the register is little-endian, 2. register is more significant lL (2143) - little-endian, 1st register significant - byte order within the register is little-endian, 1st register is more significant For example, if bytes <AA><BB><CC><DD> are received, the Bb (3412) order means that the hexadecimal value CCDDAABB will be interpreted, which in the case of DWORD type is a number 3 437 079 227. The IL (2143) order would mean interpretation as a hexadecimal value of BBAADDCC, which in the case of a DWORD type is a number 3 148 537 292. Note: 2-Byte values are currently interpreted as big-endian.	-	Bb (3412) - big-endian, 2nd register significant
Data Size	Maximum count of data bytes that are requested in one request. The total size of a response is 14 bytes + Data Size.	Byte	512
Retry Count	Maximum count of request retries. If no reply returns after a request had been sent, the station will be in the status of a communication error.	s	2
Retry Timeout	Timeout before resending a request if no reply had been received.	s	0.1
Wait Timeout	Maximum wait time to receive a response.	s	0.1
Full debug	Logging of additional debug information about communication.	YES/NO	NO

Note: the configuration of the network parameters for directly connected PLCs was as follows:

Source Node = 101 (the address of the computer with D2000 was 192.168.1.101). Other values worked too, with the exception of 0-2.
other Source/Network parameters were on defaults (0)

I/O tag configuration

Possible types of I/O tag values: Ai, Ao, Di, Do, Ci, Co.

I/O tag address:

In the Omron FINS protocol, the address space is divided into several areas. Work with the following areas is supported:

AR - Auxiliary Area
DM - DM Area
CIO - CIO Area (external inputs/outputs)
HR - Holding Area (persistent values, which are kept when power is turned OFF or operation stops in the PLC )
TC - Timer/Counter Area
WR - Work Area (memory used for programming)

In each area, there is independent addressing with an address size of 2 bytes, i.e. addresses from 0 to 65535. The actual size of the address space depends on the particular PLC model.
The size of the register in the AR, DM, CIO, HR, WR areas is 2 bytes.

The address of the I/O tag format is <area><offset> [.<bit>] [,<type>] where:

<area>is the address space area (AR, DM, CIO, HR, WR).
<offset> is the register address (0-65535). In the case of multi-register variables (e.g. FLOAT), this is the address of the first register. It is possible to enter a hexadecimal number using the # character, e.g. DM#3A.
<bit> is an optional part of the address that specifies a specific bit (0-15) within the register. This allows individual bits to be addressed.

<type> is an optional part of the address that specifies how the data is interpreted:

Type	Description
BIT	Working with a single bit (default value if the address contains a bit specification, eg HR1.3)
BYTE_U	The higher (first) byte of the register
BYTE_L	The lower (second) byte of the register
WORD	Register interpreted as a 16-bit unsigned number (default value if the address does not contain a bit specification, e.g. HR1)
SHORT	Register interpreted as a 16-bit signed number
BCD	Register interpreted as an unsigned BCD number (0-9999).
SBCD	Register interpreted as a signed BCD number (+/-7999). The sign is defined by the highest bit.
LBCD	Two 16-bit registers interpreted a 4-byte unsigned BCD number (0-99999999).
SLBCD	Two 16-bit registers interpreted a 4-byte signed BCD number (+/-79999999). The sign is defined by the highest bit.
DWORD	Two 16-bit registers interpreted as a 32-bit unsigned number (byte order depends on the 4-byte Endian Mode parameter)
LONG	Two 16-bit registers interpreted as a 32-bit signed number (byte order depends on the 4-byte Endian Mode parameter)
FLOAT	Two 16-bit registers interpreted as a 32-bit float number (byte order depends on the 4-byte Endian Mode parameter)

Examples of configuration::

DM10 - DM area, register 10, interpreted as a 16-bit unsigned number
HR0200.0 - HR area, register 200, the lowest bit
DM#020, FLOAT - DM area, registers 32 and 33 interpreted as a 32-bit float number

Literature

W342-E1-14 CS_CJ_CP+HostLink FINS ReferenceManual.pdf

Blog

You can read a blog about the Omron FINS protocol

Communication- Omron FINS

Changes and modifications

-

Document revisions

Ver. 1.0 - August 28th, 2020 - a document was created.
Ver. 1.1 - September 3rd, 2020 - support for FINS/TCP variant.
Ver. 1.2 - October 5th, 2020 - support for BCD numbers.

Related pages:

Communication protocols

Strom stránky