FINS over TCP communication from PC with Omron CP1L with CP1W-CIF41 Ethernet Option Board


Thread Starter


I am preparing
C/C++ communication code sequence ( class ) for sending/receiving commands using windows sockets FINS over TCP. The PLC is CP1L-L14 , Ethernet Option board is CP1W-CIF41.
I have a question - when I build FINS command array to send via socket (as in Omron Operation Manual):<pre>
fins_cmnd[0] = 0x80; /* ICF */
fins_cmnd[1] = 0x00; /* RSV */
fins_cmnd[2] = 0x02; /* GCT */
fins_cmnd[3] = 0x00; /* DNA */
fins_cmnd[4] = srv_node_no; /* DA1 *//* Ethernet Unit FINS NODE NUMBER*/
fins_cmnd[5] = 0x00; /* DA2 */
fins_cmnd[6] = 0x00; /* SNA */
fins_cmnd[7] = cli_node_no; /* SA1 *//* WS FINS NODE NUMBER OBTAINED
fins_cmnd[8] = 0x00; /* SA2 */
fins_cmnd[9] = ++sid; /* SID */
fins_cmnd[10] = 0x01; /* MRC */
fins_cmnd[11] = 0x01; /* SRC */
fins_cmnd[12] = 0x82; /* VARIABLE TYPE: DM*/
fins_cmnd[13] = 0x00; /* READ START ADDRESS: 100*/
fins_cmnd[14] = 0x64;
fins_cmnd[15] = 0x00;
fins_cmnd[16] = 0x00; /* WORDS READ: 150*/
fins_cmnd[17] = 0x96;</pre>
What to put to fins_cmnd[12] for variable
D0 - D32767
CIO0 - CIO6143
and to fins_cmnd[13] to assign begin and end addresses.
Where can I get information about this structure
fins_cmnd[]? Filling it for accessing PLC's registers for FINS over TCP?

I can't find answer (details) of the fins command structure in this case (addressing)in www or the manuals...

pmazniker(et sign)
Hi Mark,
ok I saw such table before ,
1)I've setted:
fins_cmnd[12] = 0x82; //(for DM area for example )

2)Word address 0000 - 7FFF as in the table, what should I set then:
for example register D7355
to read 16 bits,
each fins_cmnd cell is 8 bit as in the code example in Operation Manual you've signed <pre>
( unsigned char fins_cmnd[] )

fins_cmnd[13] = 0x??;
fins_cmnd[14] = 0x??;
fins_cmnd[15] = 0x??;
fins_cmnd[16] = 0x??;
fins_cmnd[17] = 0x??;</pre>
I do not understand yet...

3) When I read from registers I use fins_resp[] array - each cell 8 bit ( unsigned char from 0 to 255), then how is 16 bit register's value putted to cells ( cell 15 till max length 1998+14 )?
should construct one 16 bit value from two cells [15] and [16]?

thank you, I hope it is not very tedious question to answer , I'll be glad to help also, to clarify something perhaps...

I am not sure what you are asking.

From the manual, page 169:

40 /*
41 *
42 * (READ 150 WORDS FROM DM 100)
43 */


fins_cmnd[13] = 0x00; /* READ START ADDRESS: DM 100*/
58 fins_cmnd[14] = 0x64;
59 fins_cmnd[15] = 0x00;
60 fins_cmnd[16] = 0x00; /* WORDS READ: 150*/
61 fins_cmnd[17] = 0x96;

So the address is three bytes in length and the number of words to read is two byte in length.

The response will be 150 words of data plus the protocol overhead.

Good luck,

I am asking next questions:

1) What is the Area Designation Code for W0 - W511 (Work Area) 0DE00 - 0DFFF and in what manual (name, pag ) it is described ?
(some of the variables in current PLC's setting as in that area)

2)What values to put into
fins_cmnd[13] = 0x??;
fins_cmnd[14] = 0x??;
fins_cmnd[15] = 0x??;
fins_cmnd[16] = 0x??;
fins_cmnd[17] = 0x??;

if I wish, for example, to read 1 register value from 0x10000+7202 address?
Where is it described in manuals without loss of generality?


These values are listed in the manual.

SYSMAC CS/CJ Series ... Communications Commands (W342-E1-07)

Section 5-2-2 I/O Memory Address Designations

As you can see from the table the values vary based on CS/CJ mode or CV mode.

There is also another mode not listed, C mode.

Good luck,

Hi Mark,
Thank you for your help. I clarified concerns addressing

what is left to understand is next question:

when I use MEMORY AREA WRITE FINS command, to what array cells I put the actual data I need to write:

Each plc's register I write to is 16 bit - 2 bytes,
each array cell is 1 byte,
where to put 2 bytes of data inside fins_cmnd[] array as in the code examples in the manual.<pre>
fins_cmnd[15] = 0x00;//bit number
//number of words to write:
fins_cmnd[16] = 0x00; /* WRITE 1 WORD*/
fins_cmnd[17] = 0x01;
fins_cmnd[?] and fins_cmnd[?+1]</pre>
what index ?
Ok , thank you.

I formed the FINS frame and 'm testing sending, receiving now.

later after test is completed I inform about success once you answered my questions or I will post here questions.

I've succeeded to implement the FINS protocol (C++ for majority of platforms ) now connection works ok, read command sent ok and response is received, write command also sent ok but socket error - response timeout occured when waiting for response.

[Have such problems come up] when you run your FINS driver? If yes how to overcome/fix?

Thanks, be glad to share experience in the field if it is possible.

Nicola Basso

Hi guys,

I have to do a driver in Java for communicate with Omron PLC that use FINS protocol.

How is the correct implementation of this protocol?

I have to read some word to manage alarm in a factory; Can I send only a read command like this?<pre>
byte[] buf = new byte[18];

buf[0] = (byte) 0x80; //ICF
buf[1] = (byte) 0x00; //RSV
buf[2] = (byte) 0x02; //GCT
buf[3] = (byte) 0x00; //DNA
buf[4] = (byte) 0x01; //DA1
buf[5] = (byte) 0x00; //DA2
buf[6] = (byte) 0x00; //SNA
buf[7] = (byte) 0x02; //SA1
buf[8] = (byte) 0x00; //SA2
buf[9] = (byte) 0x00; //SID
buf[10] = (byte) 0x01; //MRC
buf[11] = (byte) 0x01; //SRC
buf[12] = (byte) 0x82; //Variable Type:DM
buf[13] = (byte) 0x00;
buf[14] = (byte) 0x64;
buf[15] = (byte) 0x00;
buf[16] = (byte) 0x00;
buf[17] = (byte) 0x96;</pre>
What does the PLC's packet response format?

Help me please.

Thanks a lot.