Configuring Cross-Subnet RECV on Omron CP1L-E with FINS/UDP

Affected hardware: Omron CP1L-EL/EM (built-in Ethernet, CP1L-E series), Omron NJ-301-#### (NJ/NX series Sysmac controller).
Affected firmware: CP1L-E unit version 1.0 or later; Sysmac Studio / CX-Programmer 9.x or later.
Symptoms: RECV instruction in the CP1L-E times out (error flag turns ON after the C4 timeout word) when the target is on a different IP subnet, even though the destination IP responds to PING from a workstation and the workstation HMI can reach both PLCs without changes.

1. Problem Description

A CP1L-E CPU at IP 10.1.14.214 is programmed to receive one word of UINT data from an Omron NJ-301 at IP 10.1.46.118. The two controllers are physically attached to the same industrial Ethernet switch (or, in some plants, the same physical switch fabric across multiple VLANs), but the two IPs sit on different subnets — 10.1.14.0/24 and 10.1.46.0/24. The HMI and engineering workstations can reach both nodes because they have a default gateway and a routed path through the plant L3 switch/router, but the CP1L-E itself cannot perform the same route because it has no default gateway or no FINS/UDP routing entry that points to the NJ's subnet.

The CP1L-E RECV control words are configured as follows (in DM/EM allocated to the first instance starting at D per the CP1L-EL/EM operation manual, manual number W516):

The instruction completes with the error flag ON, error code in the response word D+0 will read 0x00F0 (FINS-level timeout) or 0x00F7 (transmission failed / no response) when the local stack never receives a reply because the request was never routed off the local subnet. The same symptom occurs on SEND from CP1L-E to NJ when the routing entries are absent.

2. Network Model: Hub vs Switch vs Router vs VLAN

Omron FINS is an application-layer protocol that rides on top of either UDP (port 9600) or TCP (port 9600) depending on configuration. The FINS stack on the CP1L-E uses its own network / node / unit address table to figure out where to send a packet. Understanding the L1/L2/L3 path the packet will actually take is mandatory before writing any FINS routing entries.

2.1 L1 — Hub

A legacy 10BASE-T / 100BASE-TX hub repeats every electrical signal out every other port. It has no knowledge of MAC addresses and no concept of subnet. FINS broadcasts will reach every port. Routing on a hub is impossible because there is no L3 device. Treat the hub as a passive copper bus.

2.2 L2 — Unmanaged / Managed Switch

An Ethernet switch builds a MAC address table (CAM table) by learning source MACs on each port. Packets destined for a known MAC are forwarded only to the correct port. Packets destined for an unknown MAC, plus broadcasts (FF:FF:FF:FF:FF:FF) and certain multicasts, are flooded out all ports in the VLAN. The switch will not forward a packet between two ports that are in different VLANs — VLAN membership is enforced at L2. A managed switch can also have an SVI / VLAN interface (L3) that acts as a default gateway for that VLAN, in which case it is acting as both a switch and a router.

2.3 L3 — Router (or L3 Switch)

A router examines the destination IP address. If the destination is on a subnet directly connected to one of its interfaces, it ARPs for the destination MAC and rewrites the Ethernet header. If the destination is not directly connected, the router consults its routing table and forwards the packet to the next hop. The CP1L-E in this scenario is a host, not a router — when it has to reach 10.1.46.118 and its own IP is 10.1.14.214/24, the destination subnet 10.1.46.0/24 is not local, so the CP1L-E must hand the packet to its default gateway at the MAC layer. The IP of that gateway is the IP of the router's 10.1.14.0/24 SVI (for example 10.1.14.1).

2.4 VLAN Stacking on a Single Patch Panel

If the plant's IT group placed the two subnets on the same physical switch but separated them with VLANs (the OP eventually confirmed VLAN 20 on 10.1.46.0/24), then logically the two subnets are on two separate broadcast domains. L2 traffic cannot cross VLANs. The two PLCs can only reach each other through the L3 gateway, which is a router-on-a-stick (SVI on the L3 switch) or a physical router. From the FINS perspective, the two PLCs are on different IP networks, full stop.

3. Root Cause Analysis

There are three independent things that must all be correct for the CP1L-E to RECV from the NJ-301 across subnets. If any one is wrong, the FINS/UDP packet either never leaves the local subnet or never returns to the CP1L-E.

3.1 Missing Default Gateway on the CP1L-E

The CP1L-E's built-in Ethernet port in CX-Programmer has separate fields for IP address, subnet mask, and default gateway. A default gateway of 0.0.0.0 is the factory default and means "no off-subnet traffic". For a cross-subnet RECV to leave the CP1L-E, the gateway must be the IP of the L3 interface on the 10.1.14.0/24 segment, typically 10.1.14.1 or 10.1.14.254. Without a valid gateway, the IP stack on the CP1L-E will ARP only for hosts inside 10.1.14.0/24 and the request will not be transmitted.

3.2 Missing FINS/UDP Routing Table Entry

FINS uses a 3-tuple addressing scheme — network number, node number, unit number. When a PLC on FINS network 1, node 17 (last octet 214) wants to talk to FINS network 1, node 118 (last octet of 10.1.46.118), the FINS stack on the CP1L-E first looks at the local routing table. If the destination is in a different IP subnet, the stack must know which remote IP address corresponds to the target FINS node, and that remote IP is the IP of the gateway that will forward the FINS frame. This is the FINS/UDP routing table inside the CP1L-E Ethernet Setup Tool (the "FINS/UDP" tab).

3.3 Wrong Network Number on the Source (NJ) Variable

The NJ-301 publishes a tag at %W0 via Network Publish. The C-mode equivalent address of %W0 on the NJ series is in the CJ memory area — typically W0 — but the NJ family does not natively support C-mode "Memory Area Start Address" without an AT specification. The CP1L-E must therefore issue a FINS command that uses the CJ address space. The RECV instruction itself is byte-count based, so the address translation is done by specifying the source address as a CJ address in the SEND/RECV parameter block, not in the FINS header.

4. Required Configuration on the CP1L-E

Open the Ethernet Setup Tool for the CP1L-E in CX-Programmer (Tools → Ethernet → Open Ethernet Setup). The relevant tabs are Built-in Ethernet, FINS/UDP, and FINS/TCP (use UDP for this configuration unless the path goes through a NAT).

4.1 Built-in Ethernet Tab

The default gateway is the single most important field. If left at 0.0.0.0, no off-subnet FINS/UDP packet will be transmitted regardless of any FINS/UDP table entry. The reference for these fields is the Omron CP1L-EL/EM CPU Unit Operation Manual (W516), section 6-3 "Built-in Ethernet Port Settings".

4.2 FINS/UDP Tab — Local Network and Node

On the FINS/UDP tab, the CP1L-E's own FINS network number and FINS node number are configured. These are application-layer identifiers that are independent of the IP address but conventionally derived from the last octet of the IP.

Pick a node numbering convention and apply it to every PLC in the plant. The most common industrial convention is to make the FINS node number identical to the last octet of the IP address; this makes the routing tables easier to read at a glance. The W516 manual uses the term "FINS node number = IP address last byte" in the routing example diagrams.

4.3 FINS/UDP Tab — IP Address / FINS Node Conversion Table

This is the table that maps a remote FINS node to a remote IP address. The CP1L-E needs an entry for every PLC it will communicate with across a subnet boundary. The conversion table overrides the local-subnet rule (last-octet-equality) and forces the FINS stack to use the IP that you specify.

For the NJ-301 at 10.1.46.118, the entry is:

The second row is the CP1L-E's own entry — it must be in the table for proper ARP / FINS resolution, even on the same subnet. Without it, some FINS/UDP routing implementations will not know the MAC of the local node when a remote gateway bridges the FINS frame back.

4.4 RECV Control Words (Corrected)

With the routing table populated, the RECV control words should be:

The C1 / C2 / C3 encoding follows the SYSMAC CP Series operation manual W516, section on the RECV(098) / SEND(090) instructions. The original OP setting C1 = 0001 was sending network 1 / port 0, which is invalid; with the routing table the correct value is 0101 for local port 1 / network 1.

5. Required Configuration on the NJ-301

The NJ side must also know how to send a FINS reply back. The NJ-301 uses Sysmac Studio for configuration.

1. Open the project for the NJ-301, double-click Configurations and Setup → Controller Setup → Built-in EtherNet/IP Port.
2. Confirm IP address 10.1.46.118, subnet mask 255.255.255.0, default gateway 10.1.46.1 (the IT-managed SVI for VLAN 20).
3. Under Network Publish for the tag, set the publication direction to Output and the destination network / node if the NJ is expected to push. For a polled RECV from the CP1L-E, no publishing is required — the CP1L-E pulls.
4. Under FINS/UDP settings (accessible via the Communications Setup utility or via the Controller Setup → FINS tab), add a routing entry for the CP1L-E:
     - FINS network 1, FINS node 17, IP 10.1.14.214, UDP 9600.
5. Cycle power on the NJ to commit FINS routing changes (NJ requires restart for FINS routing modifications, unlike CP1L-E which writes to flash on-the-fly).

If the NJ is on the same FINS network number as the CP1L-E, no FINS network-to-IP routing is required on the NJ side — only the FINS node ↔ IP conversion. If you have assigned a different FINS network number to the NJ (for example network 46 to mirror the IP subnet), then a network-to-IP routing entry is required on the NJ to point network 46 at IP 10.1.46.118 for the local FINS stack.

6. Required Configuration on the L3 Switch / Router

The L3 switch must be told that 10.1.14.0/24 is reachable via VLAN 14 and 10.1.46.0/24 is reachable via VLAN 20 (or via a routed interface on the next hop). This is the IT group's job; from the controls side you only need to confirm that the gateway IP you entered on the CP1L-E responds to PING from the CP1L-E's own subnet.

Test the gateway from the CP1L-E itself by writing a simple ladder routine that copies the FINS/UDP ping reply flag to a contact. The CP1L-E does not have a built-in PING instruction, but you can validate by attempting a FINS/UDP SEND to a node that is known to be online (e.g., another CP1L-E) on a different subnet and checking for a non-zero response code.

7. Step-by-Step Commissioning Procedure

1. Verify IP connectivity from a laptop with a static IP on 10.1.14.0/24: PING 10.1.14.214 and 10.1.46.118. Both must reply.
2. Verify L3 path from the laptop: tracert 10.1.46.118 should show the gateway hop 10.1.14.1 first, then the destination. If the trace times out at the first hop, the L3 switch is not routing — escalate to IT.
3. Set the CP1L-E gateway to the value obtained from IT (10.1.14.1 assumed). Transfer the project to the CP1L-E and cycle power.
4. Add the FINS/UDP routing entries in CX-Programmer on the CP1L-E per §4.3. Transfer and cycle power.
5. Add the FINS/UDP routing entry on the NJ-301 in Sysmac Studio per §5. Transfer and cycle power on the NJ.
6. Insert the RECV instruction in the CP1L-E with the corrected control words per §4.4.
7. Force the NJ variable at %W0 to a known value, e.g., 1234, from Sysmac Studio's watch window.
8. Run the CP1L-E in MONITOR mode. The RECV Done flag should turn ON within 5 s and the destination word should read 1234.
9. Capture a Wireshark trace on the trunk port between the CP1L-E and the switch. Filter on udp.port == 9600. Verify a request from 10.1.14.214 to 10.1.46.118 and a reply in the opposite direction. The FINS frame will show network 1, node 17, request from CP1L-E; the reply will show network 1, node 118, response from NJ.

8. Verification Checklist

9. Fault Code Matrix for RECV(098)

10. Common Pitfalls

• Two PLCs on the same physical switch but different subnets with no L3 device in between. ARP requests for off-subnet destinations will not be answered. The CP1L-E silently drops the FINS request. Fix: add a router or re-IP one of the PLCs.
• VLAN 20 set up on the switch but no SVI / no inter-VLAN routing. The switch drops inter-VLAN frames because the destination MAC is in a different VLAN. Fix: enable L3 routing on the switch for VLAN 20, or set the NJ port to VLAN 14.
• Firewall between VLANs. UDP 9600 blocked. Fix: ACL permit for UDP 9600 between the two subnets.
• CP1L-E default gateway left at 0.0.0.0. Fix: set to the L3 SVI IP for the local subnet.
• NJ FINS routing not committed because power was not cycled. Fix: power-cycle the NJ after any FINS routing change.
• C1 = 0001 (port 0) instead of 0101 (port 1) on RECV. The CP1L-E will not transmit on port 0. Fix: use port 1 for FINS/UDP, as in §4.4.
• Last-octet of IP used as FINS node, but IP is on different subnet from gateway. FINS/UDP auto-conversion works only on the local subnet. Fix: add a static IP ↔ FINS node entry for every cross-subnet destination.
• Subnets are non-contiguous (10.1.14.0 and 10.1.46.0 are not a single /16 or /12). A static route is mandatory on the CP1L-E; routing on the L3 device must also be specific (/24 routes), not a single summarized route. The W516 manual addresses this in its IP router table example.

11. Remote Connectivity Variant (3G/4G Modem Reference)

When the CP1L-E is reachable only through a cellular modem that places the PLC on a private APN subnet, the same FINS/UDP routing table mechanism applies, but an additional subnet entry is required on the modem's NAT and a corresponding remote FINS node entry on the master PLC. The Omron knowledge base article "CP1L-E Remote Connection with 3G/4G modem" provides a worked example of adding a second subnet entry to the modem and configuring the CP1L-E FINS routing table for a remote FINS/UDP endpoint. The same logic (default gateway = modem LAN IP, static FINS node ↔ IP entry) applies to the cross-subnet case in this article.

12. Related Controllers and Protocol Notes

Omron CS1, CJ2, and CV-series PLCs use the same RECV(098) / SEND(090) instruction and the same FINS/UDP routing model, with the parameter set documented in Delta Motion's reference on using Omron CS1 / CV PLCs with the RMC ENET. The same network, node, and unit number conventions apply, and the same static routing table approach resolves cross-subnet RECV / SEND on those controllers.

For NJ/NX series controllers as the master, use the Sysmac Studio FINS routing configuration (Controller Setup → Built-in EtherNet/IP → FINS Node Address → Routing Table). The semantics are identical to the CP1L-E FINS/UDP tab, with the addition of EtherNet/IP CIP routing on the same dialog.

13. FAQ