Configuring Keyence CV-X170 EtherNet/IP on Omron CJ2M-CPU31

James Nishida12 min read
EtherNet/IPOmronTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem Definition

Two Keyence CV-X170 vision systems must publish inspection results to a single Omron CJ2M-CPU31 PLC. Channel A — wired through the PLC serial port — already streams inspection data using RS-232C Host Link commands, and that path is stable. Channel B — wired through the onboard RJ-45 Ethernet port of the same PLC — fails to deliver data: the PLC never sees the OK/NG or measurement words that the vision system should be publishing. The root cause is almost always a mismatch between the default TCP/socket interface of the CV-X170 and the EtherNet/IP scanner expected by the CJ2M CPU31 port. Switching Channel B from raw TCP socket to EtherNet/IP on both endpoints resolves the problem, and the ladder logic that consumes the data becomes nearly identical to the RS-232C version.

Safety note: Disconnect EtherNet/IP and serial wiring before changing rotary switches or DIP switches on the CV-X170. The unit retains its last configuration in non-volatile memory but will momentarily drop I/O during a write.

Hardware and Communication Capabilities

Before commissioning, validate that each device actually supports the protocol you intend to use. The CV-X170 supports four distinct communication modes; the CJ2M-CPU31 supports three.

Feature Keyence CV-X170 Omron CJ2M-CPU31
RS-232C Yes (Host Link / no-protocol / KV protocol) Yes (built-in port, Host Link / no-protocol)
Ethernet TCP/IP server (raw socket) Yes (port configurable, default 8500) Yes (via SOCKET/TCPRCV/TCPSND instructions)
EtherNet/IP Adapter (server) Yes (implicit + explicit messaging) Yes (built-in port, supports both Adapter and Scanner roles)
EtherNet/IP Scanner (originator) No Yes
PROFINET (optional unit) Optional (CV-EP300 expansion) No on CPU31; requires CJ1W-PNT21
Max cyclic I/O bytes (EtherNet/IP) Input 504 B / Output 504 B Per connection, 2 KB typical
Fieldbus update rate 4 to 1000 ms (RPI configurable) 0.5 to 10000 ms (RPI configurable)

Because the CJ2M-CPU31 includes a native EtherNet/IP scanner on its 100BASE-TX port, you do not need an additional CJ1W-EIP21 module. A single Cat-5e cable and a managed switch (or a direct cross-over) is sufficient. Reference: Omron CJ2M CPU Units datasheet and the Keyence CV-X170 series product page.

Prerequisites

  1. CX-Programmer version 9.6 or later (CX-One 4.61+) with the EtherNet/IP EDS files for the CV-X170 installed. If you do not have the EDS file, request it from Keyence support or download the generic Vision System EDS from the Keyence download portal.
  2. CV-X170 firmware 3.20 or later. Earlier builds do not fully expose the EtherNet/IP menu tree.
  3. CX-ConfiguratorFDT (optional) for advanced EtherNet/IP diagnostics, or the built-in EtherNet/IP Connection Tool shipped with CX-Programmer.
  4. IP addresses on the same subnet. Typical plan: PLC 192.168.1.10/24, Vision 1 (RS-232C) — not networked, Vision 2 (EtherNet/IP) 192.168.1.20/24. Disable the PLC port's DHCP client; use static addresses to avoid RPI flapping.
  5. Network cabling: Cat-5e or better, ≤ 100 m. EtherNet/IP mandates DTE-to-DTE or switch, not a hub.
  6. Understand the difference between implicit (cyclic I/O) and explicit (CIP message) communication. For real-time OK/NG + measurement results, implicit is preferred; for parameter change and recipe download, explicit is required.

Network Topology

CJ2M-CPU31192.168.1.10EIP ScannerCV-X170 #1 (RS-232C)Host LinkCJ2M Port 1CV-X170 #2 (EIP)192.168.1.20EIP AdapterCat-5e (implicit I/O)RS-232C Host Link

The PLC is the only EtherNet/IP node on this subnet. The switch is optional for two devices but recommended when future cameras or HMIs are planned.

Keyence CV-X170 EtherNet/IP Configuration

On the CV-X170 main console press MENU → Interface → EtherNet/IP. The following parameters must be set before scanning is initiated from the PLC.

  1. Enable: On. This disables the parallel PLC link and the raw TCP server socket on the same port.
  2. IP address: 192.168.1.20 (must match the subnet of the PLC port).
  3. Subnet mask: 255.255.255.0.
  4. Gateway: 192.168.1.1 (only if a router sits between PLC and vision).
  5. Output assembly instance: 100 (default; this is the control word from the PLC into the vision).
  6. Input assembly instance: 112 (default; this is the 16-word result block from the vision to the PLC).
  7. Configuration instance: 0 (not used on CV-X170 unless explicit configuration is enabled).
  8. Connection type: Point-to-point multicast (recommended) or Point-to-point unicast.
  9. RPI: 50 ms. This is the requested packet interval — keep it ≥ 20 ms to avoid CPU overload on the vision side.
  10. Trigger source: EtherNet/IP assembly bit 0 OR (parallel input OR RS-232C OR continuous). In most lines you select EtherNet/IP assembly bit 0 so the PLC controls triggering entirely.
  11. Save to scene. Power-cycle to commit.
Important: If the CV-X170 has a non-default TCP port opened (commonly 8500), close it. Two protocol stacks on the same Ethernet port cause the connection to time out. Disable Ethernet (TCP/IP) in the menu tree unless you specifically need it.

Reference: Keyence CV-X170 User's Manual — Communication Settings.

Omron CJ2M-CPU31 EtherNet/IP Configuration in CX-Programmer

  1. Open the project, double-click Ethernet/IP Section in the PLC tree.
  2. Right-click Built-in PortAdd Device. If the EDS file is installed, CV-X170 appears under Vision Systems; if not, use the generic Generic Ethernet/IP Adapter profile and configure the assemblies manually.
  3. Set the Scanner IP to 192.168.1.10 (the CJ2M CPU31 port).
  4. Click the new device and assign the following I/O allocation:
Direction CIP Connection Assembly Instance Size (words) PLC Memory Area
Output (PLC → Vision) Implicit, point-to-point 100 (0x64) 2 (32 bits control) CIO 3300
Input (Vision → PLC) Implicit, point-to-point 112 (0x70) 16 (32 bytes results) CIO 3200
  1. Set the Requested Packet Interval (RPI) to 50 ms. Set Timeout Multiplier to ×4 (= 200 ms). Lower RPI is supported but the vision CPU may shed inspection throughput.
  2. Click Download to the PLC. Cycle power or perform an online Clear All Memory Areas only after saving the project to disk.

Reference: CJ2M Built-in EtherNet/IP Section and the CX-Programmer Operation Manual (W446).

CIP Assembly Instance Mapping

The CV-X170 publishes 16 words (32 bytes) per inspection cycle in Input Assembly 112. The exact layout depends on the active inspection program, but a representative mapping is:

Word offset Bit range Meaning
0 bit 0 Overall judgement (0 = NG, 1 = OK)
0 bit 1 Inspection complete
0 bit 2 Trigger acknowledge
0 bits 4–7 Active program number (0–15)
1 Number of detected features
2–3 Feature 1: X coordinate (signed 32-bit, 0.01 mm)
4–5 Feature 1: Y coordinate (signed 32-bit)
6–7 Feature 1: width / score (signed 32-bit)
8–9 Feature 2: X coordinate
10–11 Feature 2: Y coordinate
12–13 Feature 3: X coordinate
14–15 Feature 3: Y coordinate

Output Assembly 100 from the PLC carries 2 words of control:

Word offset Bit range Meaning
0 bit 0 Trigger (1 = start inspection, edge-detected)
0 bit 1 Program change request
0 bits 4–7 Target program number
1 Reserved (0)
Layouts vary by firmware. Confirm the assembly layout for the installed CV-X170 firmware using the CV-X Series Communication Library from Keyence or the explicit EDS attribute. The numbers above are representative for firmware 3.30.

Ladder Logic for Data Exchange

The implicit connection makes the data appear in allocated CIO addresses automatically. The trigger is fired by writing bit CIO 3300.00 for one scan. The result is read from CIO 3200. A minimal rung that issues a one-shot trigger and latches the OK bit:

 |--[ CIO 3300.00 ]--+--[ CIO 3200.15 ]--( MOV #0001 D2000 )--|  ; trigger latch
 |                   |--[ CIO 3200.15 ]--( AND #0001 D2001 )--|  ; read OK
 |                   |
 |                   +--[ CIO 3300.01 ]--( MOV #0000 D2002 )--|  ; program change cmd

A more deterministic sequence using a one-shot and a handshake:

      |                          TRIGGER_OK    TRIGGER_REQ
STEP0 |  RUNG 0: One-shot        +-------+      +-------+
      |  [ DIFU W0.00 ]  --( SET W0.01 )      ; set trigger
      |                          |
      |  RUNG 1: Inspect start  +-------+
      |  [ W0.01 ] [ NOT W0.02 ]  --( MOV #0001 CIO 3300 )
      |                          |       ; write to output assembly
      |  RUNG 2: ACK wait       +-------+
      |  [ CIO 3200.02 ]         --( SET W0.02 )
      |                          |       ; flag trigger acknowledge
      |  RUNG 3: Clear trigger  +-------+
      |  [ W0.02 ]               --( MOV #0000 CIO 3300 )
      |                          |       ; release the trigger bit
      |  RUNG 4: Result read    +-------+
      |  [ W0.02 ]               --( MOV CIO 3200 D3000 )
      |                          |       ; copy 16 words to DM

For explicit CIP messaging — for example, downloading a recipe — use the CMND instruction. The CMND operand set to issue a CIP Read Attribute against the vision's parameter object:

; S: source command block (16 words)
; D: destination (response, 16 words)
; C: control block (3 words)

CIO 4000+ := #2801     ; CIP service 0x0E = Get Attribute Single
CIO 4001+ := #0002     ; Request path size (in 16-bit words)
CIO 4002+ := #200E     ; Class ID 0x0E = Parameter Object
CIO 4003+ := #012C     ; Instance = 300 (Recipe parameter block)
CIO 4004+ := #0C01     ; Attribute 12 (string data)

D2000 := CMND CIO 4000 D3000 D2000

Reference for explicit messaging: CJ2M Instructions Reference Manual (W474), section Network Instructions — CMND (CIP Message).

Verification and Diagnostics

  1. In CX-Programmer, expand EtherNet/IP Section → Connections. The CV-X170 connection must show Run with an RPI measurement equal to the configured value ± 5 %.
  2. Open the CV-X170 menu Interface → EtherNet/IP → Status. The connection state should read Connected, the scanner IP 192.168.1.10, and the dropped packet counter should be 0.
  3. Force CIO 3300.00 from the watch window. Within one RPI (≤ 100 ms) CIO 3200.01 should toggle, signalling that the inspection completed.
  4. Place a known good part on the conveyor; confirm CIO 3200.00 = 1, and that DM 3002 / DM 3003 contain the X coordinate expected.
  5. For long-term monitoring, enable CIP Statistics Logging on the PLC port: EtherNet/IP Section → Right-click Built-in Port → Diagnostics → Statistics. Watch the IO Timeout counter; any value > 0 indicates the vision is missing RPIs.

RS-232C Reference (Working Channel)

Because the working channel is RS-232C, keep the Host Link settings intact for the first vision unit. The relevant configuration on the CJ2M side is:

Setting Value
Serial port Port 1 (built-in RS-232C)
Mode Host Link (SYSWAY)
Baud 115 200 bps
Data bits / parity / stop 7 / Even / 2
Unit number 01

For comparative performance: Host Link on a CJ2M at 115 200 bps typically returns an inspection result in 20–40 ms; EtherNet/IP implicit at 50 ms RPI returns in 50–80 ms end-to-end. If the application demands sub-30 ms latency, consider dropping the RPI to 20 ms on the CV-X170 — but validate that the vision CPU still achieves the rated inspection cycle time.

Troubleshooting Matrix

Symptom Likely cause Diagnostic Remedy
Connection never reaches Run in CX-Programmer EDS file mismatch or wrong assembly instance Check CIP error code in Status: 0x01 = service not supported, 0x05 = path destination unknown, 0x0E = attribute not supported Reinstall EDS from Keyence; verify instances match
Run, but no data toggles Output assembly trigger never set, or inspection program disabled Watch CIO 3300 and CV-X170 menu RUN screen; confirm Trigger Source = EtherNet/IP Set CIO 3300.00 one-shot; enable EtherNet/IP trigger in vision
Intermittent I/O timeouts RPI too aggressive, or shared switch saturated Watch IO Timeout counter rise; ping vision; check switch error counters Increase RPI to 100 ms; isolate PLC and vision on dedicated switch
PLC sees only 0xFFFF in input assembly Wrong input instance (e.g., 101 vs 112) Cycle through instances 100 / 101 / 112 and recheck Set Input Assembly Instance = 112 per Keyence default
Connection established but vision locks up Two protocols active on the same Ethernet port (TCP socket + EtherNet/IP) CV-X170 menu shows both interfaces enabled Disable TCP/IP server socket, leave only EtherNet/IP active
PLC IO error LED on Duplicate IP or scanner conflict Run ARP table dump on PLC; check for two scanners Use only the CJ2M built-in port as scanner; remove any CJ1W-EIP21
CMND returns 0x0204 (timeout) TCP connection pool exhausted on PLC Check Socket Statistics; count open TCP connections Close sockets with CLOSE instruction; limit concurrent explicit messages
Errata on prior guidance: Some older Keyence documentation suggests using the CV-X170's raw TCP socket with Omron's SOCKET and TCPRCV instructions. This works but it locks the vision into a single client, requires custom ladder to parse the stream, and cannot share the Ethernet port with the HMI. EtherNet/IP is the supported integration path and should be preferred whenever firmware ≥ 3.20 is installed.

Field-Commissioning Checklist

  1. Vision static IP set; PING reply from PLC within 1 ms on a 100 Mbit switch.
  2. Both TCP/IP server and EtherNet/IP — pick one. The other must be disabled.
  3. EDS installed; assembly instances 100 / 112 selected.
  4. RPI set to 50 ms; timeout multiplier ×4.
  5. One-shot trigger tested with a known good and a known bad part.
  6. Statistics monitored for 30 minutes; zero dropped IO Timeout events.
  7. Project saved and uploaded to the PLC's compact flash for reboot survival.

FAQ

Does the CJ2M-CPU31 need an extra EtherNet/IP module to scan a CV-X170?

No. The CJ2M-CPU31 has a built-in 100BASE-TX EtherNet/IP port that supports both scanner (originator) and adapter (target) roles. You only need a CJ1W-EIP21 if you require more than the built-in port's connection count, or if you need CIP routing between two subnets.

What RPI should I configure for a CV-X170 over EtherNet/IP?

50 ms is the recommended starting point. The vision CPU is rated for cyclic inspection at 50–100 ms; pushing RPI to 10–20 ms will work but inspect throughput may drop. Always raise RPI before chasing latency in the PLC logic.

Why does the CV-X170 fail to deliver data on raw TCP even though it works on RS-232C?

The CV-X170 speaks Host Link on RS-232C but defaults to a Keyence-proprietary TCP framing on the Ethernet port. The Omron TCPRCV instruction expects Omron FINS/UDP or open TCP. The result is a connection that opens but never produces the expected string. Switching to EtherNet/IP eliminates the framing mismatch.

Can I run both vision systems on EtherNet/IP and keep RS-232C?

Yes. The CV-X170 units are independent devices and the CJ2M has both a serial port and an Ethernet port. However, you must address each camera individually — only one EtherNet/IP node is allowed per scanner port without an Ethernet switch if you use multicast. Use a managed switch when adding a third node.

What CIP error code means the assembly instance is wrong?

CIP error code 0x08 / additional code 0x0115 in the IO Connection's error log means Invalid Input/Output Assembly. Re-verify the instance numbers match the CV-X170 default (100 out / 112 in). For other codes consult the CIP Volume 1 specification or the CV-X170 manual.

Back to blog