Problem Definition
Two Keyence CV-X170 vision systems must publish inspection results to a single Omron CJ2M-CPU31 PLC. Channel A — wired through the PLC serial port — already streams inspection data using RS-232C Host Link commands, and that path is stable. Channel B — wired through the onboard RJ-45 Ethernet port of the same PLC — fails to deliver data: the PLC never sees the OK/NG or measurement words that the vision system should be publishing. The root cause is almost always a mismatch between the default TCP/socket interface of the CV-X170 and the EtherNet/IP scanner expected by the CJ2M CPU31 port. Switching Channel B from raw TCP socket to EtherNet/IP on both endpoints resolves the problem, and the ladder logic that consumes the data becomes nearly identical to the RS-232C version.
Hardware and Communication Capabilities
Before commissioning, validate that each device actually supports the protocol you intend to use. The CV-X170 supports four distinct communication modes; the CJ2M-CPU31 supports three.
| Feature | Keyence CV-X170 | Omron CJ2M-CPU31 |
|---|---|---|
| RS-232C | Yes (Host Link / no-protocol / KV protocol) | Yes (built-in port, Host Link / no-protocol) |
| Ethernet TCP/IP server (raw socket) | Yes (port configurable, default 8500) | Yes (via SOCKET/TCPRCV/TCPSND instructions) |
| EtherNet/IP Adapter (server) | Yes (implicit + explicit messaging) | Yes (built-in port, supports both Adapter and Scanner roles) |
| EtherNet/IP Scanner (originator) | No | Yes |
| PROFINET (optional unit) | Optional (CV-EP300 expansion) | No on CPU31; requires CJ1W-PNT21 |
| Max cyclic I/O bytes (EtherNet/IP) | Input 504 B / Output 504 B | Per connection, 2 KB typical |
| Fieldbus update rate | 4 to 1000 ms (RPI configurable) | 0.5 to 10000 ms (RPI configurable) |
Because the CJ2M-CPU31 includes a native EtherNet/IP scanner on its 100BASE-TX port, you do not need an additional CJ1W-EIP21 module. A single Cat-5e cable and a managed switch (or a direct cross-over) is sufficient. Reference: Omron CJ2M CPU Units datasheet and the Keyence CV-X170 series product page.
Prerequisites
- CX-Programmer version 9.6 or later (CX-One 4.61+) with the EtherNet/IP EDS files for the CV-X170 installed. If you do not have the EDS file, request it from Keyence support or download the generic Vision System EDS from the Keyence download portal.
- CV-X170 firmware 3.20 or later. Earlier builds do not fully expose the EtherNet/IP menu tree.
- CX-ConfiguratorFDT (optional) for advanced EtherNet/IP diagnostics, or the built-in EtherNet/IP Connection Tool shipped with CX-Programmer.
- IP addresses on the same subnet. Typical plan: PLC
192.168.1.10/24, Vision 1 (RS-232C) — not networked, Vision 2 (EtherNet/IP)192.168.1.20/24. Disable the PLC port's DHCP client; use static addresses to avoid RPI flapping. - Network cabling: Cat-5e or better, ≤ 100 m. EtherNet/IP mandates DTE-to-DTE or switch, not a hub.
- Understand the difference between implicit (cyclic I/O) and explicit (CIP message) communication. For real-time OK/NG + measurement results, implicit is preferred; for parameter change and recipe download, explicit is required.
Network Topology
The PLC is the only EtherNet/IP node on this subnet. The switch is optional for two devices but recommended when future cameras or HMIs are planned.
Keyence CV-X170 EtherNet/IP Configuration
On the CV-X170 main console press MENU → Interface → EtherNet/IP. The following parameters must be set before scanning is initiated from the PLC.
- Enable: On. This disables the parallel PLC link and the raw TCP server socket on the same port.
- IP address: 192.168.1.20 (must match the subnet of the PLC port).
- Subnet mask: 255.255.255.0.
- Gateway: 192.168.1.1 (only if a router sits between PLC and vision).
- Output assembly instance: 100 (default; this is the control word from the PLC into the vision).
- Input assembly instance: 112 (default; this is the 16-word result block from the vision to the PLC).
- Configuration instance: 0 (not used on CV-X170 unless explicit configuration is enabled).
- Connection type: Point-to-point multicast (recommended) or Point-to-point unicast.
- RPI: 50 ms. This is the requested packet interval — keep it ≥ 20 ms to avoid CPU overload on the vision side.
- Trigger source: EtherNet/IP assembly bit 0 OR (parallel input OR RS-232C OR continuous). In most lines you select EtherNet/IP assembly bit 0 so the PLC controls triggering entirely.
- Save to scene. Power-cycle to commit.
Reference: Keyence CV-X170 User's Manual — Communication Settings.
Omron CJ2M-CPU31 EtherNet/IP Configuration in CX-Programmer
- Open the project, double-click Ethernet/IP Section in the PLC tree.
- Right-click Built-in Port → Add Device. If the EDS file is installed, CV-X170 appears under Vision Systems; if not, use the generic Generic Ethernet/IP Adapter profile and configure the assemblies manually.
- Set the Scanner IP to 192.168.1.10 (the CJ2M CPU31 port).
- Click the new device and assign the following I/O allocation:
| Direction | CIP Connection | Assembly Instance | Size (words) | PLC Memory Area |
|---|---|---|---|---|
| Output (PLC → Vision) | Implicit, point-to-point | 100 (0x64) | 2 (32 bits control) | CIO 3300 |
| Input (Vision → PLC) | Implicit, point-to-point | 112 (0x70) | 16 (32 bytes results) | CIO 3200 |
- Set the Requested Packet Interval (RPI) to 50 ms. Set Timeout Multiplier to ×4 (= 200 ms). Lower RPI is supported but the vision CPU may shed inspection throughput.
- Click Download to the PLC. Cycle power or perform an online Clear All Memory Areas only after saving the project to disk.
Reference: CJ2M Built-in EtherNet/IP Section and the CX-Programmer Operation Manual (W446).
CIP Assembly Instance Mapping
The CV-X170 publishes 16 words (32 bytes) per inspection cycle in Input Assembly 112. The exact layout depends on the active inspection program, but a representative mapping is:
| Word offset | Bit range | Meaning |
|---|---|---|
| 0 | bit 0 | Overall judgement (0 = NG, 1 = OK) |
| 0 | bit 1 | Inspection complete |
| 0 | bit 2 | Trigger acknowledge |
| 0 | bits 4–7 | Active program number (0–15) |
| 1 | — | Number of detected features |
| 2–3 | — | Feature 1: X coordinate (signed 32-bit, 0.01 mm) |
| 4–5 | — | Feature 1: Y coordinate (signed 32-bit) |
| 6–7 | — | Feature 1: width / score (signed 32-bit) |
| 8–9 | — | Feature 2: X coordinate |
| 10–11 | — | Feature 2: Y coordinate |
| 12–13 | — | Feature 3: X coordinate |
| 14–15 | — | Feature 3: Y coordinate |
Output Assembly 100 from the PLC carries 2 words of control:
| Word offset | Bit range | Meaning |
|---|---|---|
| 0 | bit 0 | Trigger (1 = start inspection, edge-detected) |
| 0 | bit 1 | Program change request |
| 0 | bits 4–7 | Target program number |
| 1 | — | Reserved (0) |
Ladder Logic for Data Exchange
The implicit connection makes the data appear in allocated CIO addresses automatically. The trigger is fired by writing bit CIO 3300.00 for one scan. The result is read from CIO 3200. A minimal rung that issues a one-shot trigger and latches the OK bit:
|--[ CIO 3300.00 ]--+--[ CIO 3200.15 ]--( MOV #0001 D2000 )--| ; trigger latch
| |--[ CIO 3200.15 ]--( AND #0001 D2001 )--| ; read OK
| |
| +--[ CIO 3300.01 ]--( MOV #0000 D2002 )--| ; program change cmd
A more deterministic sequence using a one-shot and a handshake:
| TRIGGER_OK TRIGGER_REQ
STEP0 | RUNG 0: One-shot +-------+ +-------+
| [ DIFU W0.00 ] --( SET W0.01 ) ; set trigger
| |
| RUNG 1: Inspect start +-------+
| [ W0.01 ] [ NOT W0.02 ] --( MOV #0001 CIO 3300 )
| | ; write to output assembly
| RUNG 2: ACK wait +-------+
| [ CIO 3200.02 ] --( SET W0.02 )
| | ; flag trigger acknowledge
| RUNG 3: Clear trigger +-------+
| [ W0.02 ] --( MOV #0000 CIO 3300 )
| | ; release the trigger bit
| RUNG 4: Result read +-------+
| [ W0.02 ] --( MOV CIO 3200 D3000 )
| | ; copy 16 words to DM
For explicit CIP messaging — for example, downloading a recipe — use the CMND instruction. The CMND operand set to issue a CIP Read Attribute against the vision's parameter object:
; S: source command block (16 words)
; D: destination (response, 16 words)
; C: control block (3 words)
CIO 4000+ := #2801 ; CIP service 0x0E = Get Attribute Single
CIO 4001+ := #0002 ; Request path size (in 16-bit words)
CIO 4002+ := #200E ; Class ID 0x0E = Parameter Object
CIO 4003+ := #012C ; Instance = 300 (Recipe parameter block)
CIO 4004+ := #0C01 ; Attribute 12 (string data)
D2000 := CMND CIO 4000 D3000 D2000
Reference for explicit messaging: CJ2M Instructions Reference Manual (W474), section Network Instructions — CMND (CIP Message).
Verification and Diagnostics
- In CX-Programmer, expand EtherNet/IP Section → Connections. The CV-X170 connection must show Run with an RPI measurement equal to the configured value ± 5 %.
- Open the CV-X170 menu Interface → EtherNet/IP → Status. The connection state should read Connected, the scanner IP 192.168.1.10, and the dropped packet counter should be 0.
- Force
CIO 3300.00from the watch window. Within one RPI (≤ 100 ms)CIO 3200.01should toggle, signalling that the inspection completed. - Place a known good part on the conveyor; confirm
CIO 3200.00= 1, and thatDM 3002/DM 3003contain the X coordinate expected. - For long-term monitoring, enable CIP Statistics Logging on the PLC port: EtherNet/IP Section → Right-click Built-in Port → Diagnostics → Statistics. Watch the IO Timeout counter; any value > 0 indicates the vision is missing RPIs.
RS-232C Reference (Working Channel)
Because the working channel is RS-232C, keep the Host Link settings intact for the first vision unit. The relevant configuration on the CJ2M side is:
| Setting | Value |
|---|---|
| Serial port | Port 1 (built-in RS-232C) |
| Mode | Host Link (SYSWAY) |
| Baud | 115 200 bps |
| Data bits / parity / stop | 7 / Even / 2 |
| Unit number | 01 |
For comparative performance: Host Link on a CJ2M at 115 200 bps typically returns an inspection result in 20–40 ms; EtherNet/IP implicit at 50 ms RPI returns in 50–80 ms end-to-end. If the application demands sub-30 ms latency, consider dropping the RPI to 20 ms on the CV-X170 — but validate that the vision CPU still achieves the rated inspection cycle time.
Troubleshooting Matrix
| Symptom | Likely cause | Diagnostic | Remedy |
|---|---|---|---|
| Connection never reaches Run in CX-Programmer | EDS file mismatch or wrong assembly instance | Check CIP error code in Status: 0x01 = service not supported, 0x05 = path destination unknown, 0x0E = attribute not supported | Reinstall EDS from Keyence; verify instances match |
| Run, but no data toggles | Output assembly trigger never set, or inspection program disabled | Watch CIO 3300 and CV-X170 menu RUN screen; confirm Trigger Source = EtherNet/IP
|
Set CIO 3300.00 one-shot; enable EtherNet/IP trigger in vision |
| Intermittent I/O timeouts | RPI too aggressive, or shared switch saturated | Watch IO Timeout counter rise; ping vision; check switch error counters | Increase RPI to 100 ms; isolate PLC and vision on dedicated switch |
| PLC sees only 0xFFFF in input assembly | Wrong input instance (e.g., 101 vs 112) | Cycle through instances 100 / 101 / 112 and recheck | Set Input Assembly Instance = 112 per Keyence default |
| Connection established but vision locks up | Two protocols active on the same Ethernet port (TCP socket + EtherNet/IP) | CV-X170 menu shows both interfaces enabled | Disable TCP/IP server socket, leave only EtherNet/IP active |
| PLC IO error LED on | Duplicate IP or scanner conflict | Run ARP table dump on PLC; check for two scanners | Use only the CJ2M built-in port as scanner; remove any CJ1W-EIP21 |
| CMND returns 0x0204 (timeout) | TCP connection pool exhausted on PLC | Check Socket Statistics; count open TCP connections | Close sockets with CLOSE instruction; limit concurrent explicit messages |
Field-Commissioning Checklist
- Vision static IP set; PING reply from PLC within 1 ms on a 100 Mbit switch.
- Both TCP/IP server and EtherNet/IP — pick one. The other must be disabled.
- EDS installed; assembly instances 100 / 112 selected.
- RPI set to 50 ms; timeout multiplier ×4.
- One-shot trigger tested with a known good and a known bad part.
- Statistics monitored for 30 minutes; zero dropped IO Timeout events.
- Project saved and uploaded to the PLC's compact flash for reboot survival.
FAQ
Does the CJ2M-CPU31 need an extra EtherNet/IP module to scan a CV-X170?
No. The CJ2M-CPU31 has a built-in 100BASE-TX EtherNet/IP port that supports both scanner (originator) and adapter (target) roles. You only need a CJ1W-EIP21 if you require more than the built-in port's connection count, or if you need CIP routing between two subnets.
What RPI should I configure for a CV-X170 over EtherNet/IP?
50 ms is the recommended starting point. The vision CPU is rated for cyclic inspection at 50–100 ms; pushing RPI to 10–20 ms will work but inspect throughput may drop. Always raise RPI before chasing latency in the PLC logic.
Why does the CV-X170 fail to deliver data on raw TCP even though it works on RS-232C?
The CV-X170 speaks Host Link on RS-232C but defaults to a Keyence-proprietary TCP framing on the Ethernet port. The Omron TCPRCV instruction expects Omron FINS/UDP or open TCP. The result is a connection that opens but never produces the expected string. Switching to EtherNet/IP eliminates the framing mismatch.
Can I run both vision systems on EtherNet/IP and keep RS-232C?
Yes. The CV-X170 units are independent devices and the CJ2M has both a serial port and an Ethernet port. However, you must address each camera individually — only one EtherNet/IP node is allowed per scanner port without an Ethernet switch if you use multicast. Use a managed switch when adding a third node.
What CIP error code means the assembly instance is wrong?
CIP error code 0x08 / additional code 0x0115 in the IO Connection's error log means Invalid Input/Output Assembly. Re-verify the instance numbers match the CV-X170 default (100 out / 112 in). For other codes consult the CIP Volume 1 specification or the CV-X170 manual.