Configuring Omron CJ2M FINS Node Address for Ethernet

Configuring Omron CJ2M FINS Node Address for Ethernet Communication

Field engineers commissioning CJ2M-CPU3x CPUs with FINS/TCP often hit a class of error where the client reports a timeout, a bad response code, or an illegal node address even though the TCP socket connects, the IP address is correct, and Wireshark shows the request leaving the PC. The root cause is almost never the wire, the switch, or the firewall — it is a mismatch between the CJ2M's FINS node address and the TargetNodeAddress configured on the HMI/SCADA client. This article walks through the diagnosis, the exact CX-Programmer and CX-Integrator settings, the FINS/TCP frame structure to verify in Wireshark, and the recovery procedure when the PLC has been left at a default or factory value.

1. Problem Description

A typical symptom report looks like this:

• TCP connection to the CJ2M on UDP/TCP port 9600 succeeds (no socket error).
• The HMI driver (e.g., OmronEthernetFINSCom, FINS/TCP, OPC server, or Ignition's FINS driver) writes a request and receives no reply, or receives a reply with a non-zero FINS error code such as 0x0105 (node address setting error) or 0x0205 (response timeout).
• Wireshark captures the request going out, but no FINS response — or a response with the destination node address field (DA1) still set to whatever the client broadcast (commonly 0 or 30).
• Identical project communicates fine with a CP1H, CP1L, or NX/NJ controller. The failure is specific to the CJ2M (or any FINS node whose address has not been set).

Wireshark trace evidence is unambiguous: the FINS request packet has the correct magic bytes (46 49 4E 53 = "FINS"), correct command frame layout, source node derived from the PC's IP address last octet, and an incrementing service ID. The PLC either drops the packet at the FINS routing layer (because the destination node address has no match in its routing table) or replies with a routing error.

2. Root Cause: FINS Node Address vs. TargetNodeAddress

FINS routing uses a 3-layer address tuple per node: Network Address (0–127), Node Address (0–254), and Unit Address (0–255). For an Ethernet-attached CJ2M, the network address is typically the local network number (commonly 0 or 1) and the unit address is the CPU unit number (default 0 for the CPU itself, or 10 + EE for the built-in Ethernet port on some platforms). The node address is the value that must be unique on the FINS network and is the field most often misconfigured.

On a CJ2M-CPU3x with built-in EtherNet/IP, the node address is stored in the CPU Unit's Built-in Ethernet Port Settings, accessible from CX-Programmer. It is not automatically derived from the IP address unless the user explicitly selects the "Use IP address last octet" option. Factory-fresh units often ship with a node address that does not match the IP last octet, and the value the engineer entered in CX-Programmer while setting the IP may have been overlooked.

The client-side TargetNodeAddress parameter must equal this exact value. If the client sends DA1 = 0 (broadcast) and the CJ2M is configured with a unicast node (e.g., 201), the PLC will either ignore the frame or reply with a routing error. If the client sends DA1 = 30 and the PLC is node 201, the same happens. Only when DA1 = 201 matches does the FINS frame reach the CPU's communication unit and get serviced.

3. Affected Hardware and Firmware

The fix applies to any Omron controller that participates in a FINS/TCP or FINS/UDP conversation. The most common offenders:

For the official hardware reference, see the CJ-series CJ2 CPU Unit Hardware User's Manual (W472). Section 7 covers the built-in EtherNet/IP port, including how node address selection interacts with IP address assignment.

4. Required Materials and Prerequisites

1. CX-Programmer version 9.5 or later (CX-One 4.x or Sysmac Studio for NJ/NX). FINS node address configuration requires at least CX-Programmer 7.x for legacy CJ2M.
2. Online USB connection (CS1W-CN226 or equivalent) or Ethernet online connection to the CJ2M. USB is preferred for the first commissioning because it bypasses any FINS routing problem.
3. A PC with Wireshark 3.x or later for FINS/TCP frame validation.
4. The HMI/SCADA client tool that exposes TargetNodeAddress (e.g., AdvancedHMI's OmronEthernetFINSCom, Ignition's FINS/TCP driver, Kepware Omron FINS driver, or a custom .NET/Python FINS client).
5. Network access to the PLC's IP on TCP port 9600 (FINS/TCP default). No firewall blocking inbound 9600 from the PLC to the PC.

5. Step-by-Step Resolution

5.1 Discover the PLC's current FINS node address

Before changing anything, read the value the PLC actually has. Two methods:

Method A — CX-Programmer (offline file):

1. Open the project and double-click Settings under the CPU in the project tree.
2. For CJ2M-CPU3x, expand Built-in Ethernet Port Settings.
3. Open the FINS/TCP tab and the FINS/UDP tab.
4. Note the FINS Node Address (FINS Node No.) field. If it shows 0, the PLC will ignore any unicast FINS frame sent to DA1 = 0 (it treats 0 as "local") and only accept broadcasts or specially routed frames.

Method B — Online via Ethernet:

1. Connect CX-Programmer directly to the CJ2M's IP (PLC → Connect → Ethernet).
2. If CX-Programmer connects successfully, the IP layer works. The node address is read in the same place as Method A, but with the live PLC selected.
3. If CX-Programmer cannot connect, switch to USB and read the node address from the offline project that was last downloaded to the unit.

5.2 Set the FINS node address explicitly

Inside CX-Programmer → Built-in Ethernet Port Settings → FINS/TCP tab:

1. Select "Use the following IP address conversion method" (do not leave on auto-default unless you have confirmed the IP last octet matches).
2. Set FINS Node No. to a unique value in the range 1–254. The value 255 is reserved for broadcast. Values above 254 are invalid and will be rejected by the CPU.
3. Common practice is to mirror the IP last octet (e.g., IP 192.168.250.201 → node 201). This is the value that worked in the field — when the client was set to TargetNodeAddress = 201, communication succeeded.
4. Set FINS Network No. to your local network number (commonly 0 or 1). This is the value that appears in the DNA/SNA fields.
5. Set the FINS Node No. Conversion Table entries if you want explicit IP ↔ node mapping rather than 1:1 with IP last octet.
6. Download the project to the PLC. The CPU will prompt to confirm the Ethernet setting change; accept.

CX-Programmer parameter map (illustrative default values — verify against your project):

5.3 Align the client TargetNodeAddress

On the HMI/SCADA client, change the parameter that controls the destination FINS node:

• AdvancedHMI / OmronEthernetFINSCom: Set the driver's TargetNodeAddress (sometimes labelled TargetNode or DA1) to match the value set in step 5.2 (e.g., 201).
• Ignition FINS/TCP driver: Set the PLC Address field on the device connection to the node number, not the IP address — Ignition uses the node as the FINS-level identifier and the IP only for socket connection.
• Kepware / TOP Server Omron FINS driver: On the channel or device, set Destination FINS Node Address.
• Custom .NET / Python (pyFINS, fins.py): Set DA1 in the FINS frame header before calling send_frame().

5.4 Verify in Wireshark

Apply the filter tcp.port == 9600 and trigger one read from the client. Inspect the request packet:

FINS/TCP Header (16 bytes):
  46 49 4E 53  -- "FINS" magic
  00 00 00 1A  -- length (26 bytes of FINS frame)
  00 00 00 00  -- command, error code
FINS Frame (26 bytes):
  ICF  = 0x80   -- command, response required
  RSV  = 0x00
  GCT  = 0x02   -- 2 gateways allowed
  DNA  = 0x00   -- dest network
  DA1  = 0xC9   -- dest node = 201  <-- must equal PLC's FINS node
  DA2  = 0x00   -- dest unit (CPU)
  SNA  = 0x00   -- src network
  SA1  = 0x01   -- src node = PC IP last octet
  SA2  = 0x00   -- src unit
  SID  = 0xN+   -- service ID, increments
  MRC  = 0x01   -- memory area read
  SRC  = 0x01
  ...data...

If DA1 = 0xC9 (= 201 decimal) and the response carries 0x0000 in the FINS end code field, the fix is confirmed.

6. FINS/TCP Frame Structure (for engineers)

Understanding the frame is essential for diagnosing this class of error. The complete FINS/TCP message has two parts: a 16-byte FINS/TCP header followed by a variable-length FINS frame.

The FINS frame body itself is laid out as:

7. Common FINS Error Codes Encountered During This Failure

Codes 0x0105 and 0x0205 are the two that show up most often with the CJ2M node address mismatch described here.

8. Verification Procedure

After applying the configuration change and downloading to the PLC:

1. Power-cycle is not required on CJ2M for FINS setting changes; the new node is live immediately. Existing TCP sessions are dropped — clients will reconnect.
2. From the PC, run ping 192.168.250.201. Confirm ICMP reachability.
3. Open Wireshark with capture filter tcp port 9600.
4. Trigger a single read from the HMI client on a known memory address (e.g., D0000).
5. Confirm in the capture:
   • Request frame has DA1 = 0xC9 (= 201).
   • Response frame has SA1 = 0xC9 (PLC replying from its configured node).
   • FINS end code = 0x0000.
   • Service ID in response matches request SID + 1 (per FINS convention).
6. In CX-Programmer, PLC → Monitor, force-toggle a bit in the read area and confirm the HMI sees the change within one poll cycle.

9. Extended Troubleshooting Matrix

10. Performance and Load Considerations

Once communication is established, do not assume the FINS/TCP session can sustain unlimited poll rates. The CJ2M's built-in EtherNet/IP port serializes FINS and CIP traffic on the same Ethernet processor. Practical limits observed in field deployments:

• Sustained FINS read throughput on a CJ2M-CPU31 with default scan time: roughly 50–80 single-word reads per second before response latency climbs above 100 ms.
• Block reads (e.g., 100 words per request) are dramatically more efficient than single-word polling — 10 block reads/sec ≈ 1000 words/sec with stable latency.
• Concurrent FINS/TCP clients: up to 16 simultaneous FINS/TCP sockets supported on CJ2M built-in Ethernet; exceeding this yields connection refusals.
• If the HMI is also consuming EtherNet/IP traffic (e.g., for NX-I/O or other CIP devices), budget the FINS bandwidth accordingly. Mixed load can push latency above 500 ms if the CPU scan time is > 20 ms.

11. CP1H / CP1L vs. CJ2M Behaviour Comparison

Engineers often confuse the CJ2M with the CP1H because both use FINS/TCP. They differ in one subtle but critical way for node addressing:

This asymmetry is why the same driver that works flawlessly on a CP1H fails silently on a freshly configured CJ2M. The fix is the same in principle (align the node), but the CX-Programmer navigation differs.

12. Preventative Configuration Checklist

For new CJ2M deployments, use this checklist to avoid the node address trap entirely:

1. In CX-Programmer, set IP address, subnet mask, and gateway on the Built-in Ethernet Port TCP/IP tab.
2. On the FINS/TCP tab, explicitly enter the FINS Node No. to match the IP last octet. Tick "Use the following IP address conversion method" with "Use IP address" as the conversion method if you want automatic 1:1 mapping.
3. Record the node number in the PLC's nameplate comment so future engineers can correlate IP and FINS node without re-reading CX-Programmer.
4. Download and verify with a single FINS read from a known-good client.
5. Save the project to the PLC's Memory Card for backup.

13. Frequently Asked Questions