Configuring Omron Serial FINS Communication: Wiring and Protocol Setup
Omron's FINS (Factory Interface Network Service) protocol operates on three physical layers: Ethernet (UDP/TCP), RS-232C, and RS-422A/485. Serial FINS remains the dominant choice on legacy CS/CJ-series racks and on CP-series compact PLCs because it preserves Host-Link framing at the byte level while layering the FINS service set on top. This reference covers wiring, framing, addressing, and driver configuration for any host that speaks serial FINS — CX-Programmer, SCADA, a custom .NET/AdvancedHMI client, or a C-more HMI panel.
FINS Protocol Architecture
A FINS message is a framed packet consisting of a Host-Link-compatible wrapper, a 16-byte FINS header, and a command-specific data block. Three addressing parameters must match between the host and the target PLC:
| Parameter | Range | Field in FINS Header | Purpose |
|---|---|---|---|
| Network Address | 0–127 (0 = local network) | Byte 7 (DNA) | Identifies the destination FINS network number. The default network in a single-PLC cell is 0. |
| Node Address | 0–254 (255 = broadcast) | Byte 8 (DA1) | Identifies the node (PLC or PC) inside the network. On a serial port the PLC defaults to node 1; the PC typically uses 2. |
| Unit Address | 0–15 (16–31 = CPU Bus Unit, 32+ = special) | Byte 9 (DA2) | Identifies the CPU or peripheral port. For the built-in RS-232C port of a CS/CJ CPU use 0 (CPU); for an RS-232C option board use the unit number set on the board's rotary switch. |
The full FINS header layout (16 bytes) is documented in the CS/CJ/CP/CJ2-series Communications Commands Reference Manual (W342). The four most significant header bytes are reserved for the ICF, RSV, GCT, and DNA fields; the next bytes specify destination network (DA1, DA2, SNA) and source identification.
Supported PLC Families and Ports
Serial FINS is implemented on the following Omron product families. Each uses a slightly different framing for the same byte-stream service:
| PLC Family | Serial Port | Connector | Default Node |
|---|---|---|---|
| CV-series (CV500/CV1000/CV2000/CVM1) | RS-232C + RS-422A ports on CPU | DB-9 / terminal block | 01 (DIP switch SW2) |
| CS1G/CS1H/CJ1G/CJ1H/CJ1M | Built-in RS-232C port on CPU; RS-232C option boards (CP1W-CIF01, CJ1W-SCU21, etc.) | DB-9 | 01 (per-port rotary) |
| CJ2H/CJ2M | Built-in RS-232C (port 1 / port 2) | DB-9 | 01 (per-port rotary) |
| CP1E / CP1L / CP1H | Built-in RS-232C port + option board CP1W-CIF01 | Mini-DIN / DB-9 | 01 (per-port rotary) |
| NJ/NX-series | RS-232C option module (NX1W-CIF01) on NX side, or via EtherNet/IP FINS gateway | DB-9 | 01 |
RS-232C Wiring — Direct Cable Pinout
The classic Omron serial cable (Omron p/n XW2Z-200S for 2 m, XW2Z-500S for 5 m) implements a null-modem-style crossover suitable for the CS/CJ/CJ2 DB-9 port. PC COM port pins on the left, PLC DB-9 pins on the right:
| Signal | PC DB-9 (DE-9 male) | PLC DB-9 (DE-9 male, XW2Z) |
|---|---|---|
| RD (Receive Data to PC) / TXD (PLC sends) | 2 | 2 |
| TD (Transmit Data from PC) / RXD (PLC receives) | 3 | 3 |
| RTS (PC request-to-send) | 7 | 4 (DTR on PLC) |
| CTS (PC clear-to-send) | 8 | 5 (DSR on PLC) |
| Signal Ground | 5 | 9 |
| Frame Ground (recommended) | — | Shell |
This is a 3-wire active crossover: pins 2↔2 and 3↔3 cross to swap TX/RX, while pins 7↔4 and 8↔5 give hardware handshaking using the PLC's DTR/DSR signals. Pin 5↔9 establishes common ground. Do not cross pins 2↔3 and 3↔2 in the wrong direction — the PLC simply will not respond and no LED activity will appear on either side.
Serial Frame Parameters
All four parameters must match on PC and PLC. Default Omron values are shown in bold:
| Parameter | Range / Choices | Default (CS/CJ/CP) | Set With |
|---|---|---|---|
| Baud Rate | 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 | 9600 bps (newer CPUs ship 115200) | PLC: DIP switches or DM DIP area; PC: driver property |
| Data Bits | 7 or 8 | 7 (Command-mode Host Link/FINS) | DM area |
| Parity | Even, Odd, None | Even | DM area |
| Stop Bits | 1, 2 | 2 (when parity=Even, 7 data bits) | DM area |
| Node Address | 0–126 (default 01) | 01 | Rotary switch on CPU option board or DIP SW2 |
The PLC's CPU serial port is configured through the PLC Setup area in CX-Programmer. For CS/CJ the settings reside in DM areas DM32000 (port 1) and DM32010 (port 2) when Peripheral Bus mode is disabled. Set the relevant word to the four-digit hex value where lower nibble = baud rate code, next nibble = data/para/stop bit pattern, and upper byte = node number.
Step-by-Step: Configuring Serial FINS with CX-Programmer
The fastest path to a working communication link is to let CX-Programmer auto-discover the parameters. Once the link is up, copy those values into your host application.
Prerequisites
- CX-Programmer (CX-One or Sysmac Studio) installed on the host PC.
- Approved serial cable (XW2Z-200S for 2 m, XW2Z-500S for 5 m, or CP1W-CIF01 for CP-series).
- PLC and PC powered, with PLC in PROGRAM or MONITOR mode (communication works in RUN too, but be cautious).
- USB-to-RS232 adapter verified working at full-duplex (e.g., FTDI FT232 chipset recommended; avoid cheap CH340 converters for field commissioning).
Procedure
- Open CX-Programmer and create a new project for the correct CPU family (CS1G, CJ2M, CP1L, etc.). When prompted for the device type, choose the actual CPU — auto-online works for all families but the offline program upload will only match the project type.
- Click Auto-Online (PLC → Auto Online → Auto Online with Windows Dialog…). CX-Programmer scans the COM ports, transmits probing Host-Link frames, and reports the COM port, baud rate, data bits, parity, and stop bits it found. Write these down — they are the canonical settings for your PLC's serial port.
- Verify the discovered parameters with a manual Transfer to PLC of a small known change (e.g., toggle a contact) to confirm full bi-directional communication. If the Transfer succeeds, the link is solid.
- Quit CX-Programmer completely. The Omron serial driver reserves the COM port for its exclusive lifetime; any other process holding the port — including a stuck background sync task — will prevent the SCADA or HMI driver from opening it.
- Configure your host driver (AdvancedHMI, Ignition, TOP Server, C-more, Node-RED, etc.) with the exact COM port, baud, data, parity, and stop values recorded earlier. Enter the FINS routing triplet: Target Network, Node, and Unit.
-
Set network/node/unit on the driver side:
- Network destination (= 0 in a single-PLC cell, = 1 if bridging through a serial->Ethernet gateway).
- Target Node = PLC's node address set on its rotary switch (commonly
01). - Unit =
0for the CPU's built-in port,1for slot 1 option board, etc.
- Do not configure the PLC to transmit data unsolicited at this stage. The host driver polls the PLC on a cycle and unsolicited writes from the PLC side can corrupt the receive buffer of the driver, which typically presents as intermittent "tag quality bad" events. Use the PLC's scheduled SEND(090) only if the SCADA supports a periodic-write model.
-
Test by reading a known word (e.g.,
D100in a free data-memory area). If the response times out and the SD/RD LEDs on the PLC show no activity, revisit wiring and parity; if SD flashes once per second but no RD response follows, the host-to-PLC frame is correct but node numbers do not match.
Configuring a C-more Panel (HMI Side)
When the host is an AutomationDirect C-more HMI, the FINS implementation is treated as an Omron CPU serial protocol. The C-more help topic 247 documents the panel-side setup:
- On the panel project, right-click Protocol Setup and add an Omron CPU Serial protocol.
- Enter the PLC Node Address (0–31; default 0).
- Set the port parameters: baud, data bits, parity, stop bits. These must match the PLC exactly.
- Set the Scan Rate — the interval the panel waits between executing a complete read sequence of the displayed screen (typically 500 ms for status panels, 200 ms for control panels).
- Map each tag to an Omron memory area (CIO, DM/HR/WR/EM-bank) using FINS byte/word addresses.
Driver Map Across Host Platforms
| Host Platform | FINS Driver / Module | Key Configuration |
|---|---|---|
| AdvancedHMI (.NET) | OmronFINS driver (v3.99w or newer) | Network=0, Node=PLC node, Unit=port. Service code 0x0401 for cyclic read. |
| Ignition (Inductive Automation) | FINS Driver module | Server = PLC IP or COM port. Enable Server-Tag polling; configure heartbeat watchdog to recover from intermittent dropouts (see Inductive Automation forum thread referenced below). |
| TOP Server (Software Toolbox) | Omron FINS Ethernet Driver | Channel-level Node Address matching PLC; Device-level supports D, W, H, C, T, EM Area etc. |
| Node-RED | node-red-contrib-omron-fins | tested on CV, CP, CS, CJ, NJ, NX families; configure host as a FINS node (max 254) separate from PLC node. |
| C-more HMI | Omron CPU Serial protocol | PLC Node Address 0–31; scan rate in milliseconds. |
Verifying the Link
The strongest possible proof of a working FINS link is a successful MRC 0x01 0x01 (Memory Area Read) against a known address. Confirmation steps:
- Read a status word — for a CS1G use
DM00100, or anywhere inCIO 000–CIO 6143. - Read the PLC model/identifier with MRC
0x050x01to confirm node routing. - Read CPU Unit Status with MRC
0x060x01for a heartbeat - Watch
SDandRDLEDs on the PLC — both should toggle consistently with the poll interval.
If the PLC ERR/ALM LED is lit, capture the CPU error from CX-Programmer (Diagnostics → PLC Errors) before continuing; many communication problems are downstream symptoms of CPU faults such as cycle-overrun or I/O bus errors.
Troubleshooting Matrix
| Symptom | Likely Root Cause | Diagnostic Step | Fix |
|---|---|---|---|
| PC transmits (scope shows bursts) but PLC never replies; PLC RD LED dark | Tx/Rx crossed wrong way (2-3 / 3-2 mismatch) | Swap pins 2 and 3 at the PC end or use an Omron XW2Z cable | Replace with correct cable |
| PLC SD LED flashes once per second, no RD response | Node address mismatch (driver node vs. PLC node) | Compare rotary-switch setting with driver config | Match node; for host-as-node, set to any unused 02–254 |
| Random tag-quality-bad events that never recover | Driver session not properly rearmed after disconnect; watch-dog timer not enabled | Toggle PLC mode to PROGRAM/STOP/RUN; check driver logs for session timeout | Enable watchdog and auto-reconnect in driver; avoid PLC-side unsolicited SEND(090) unless driver supports periodic write |
| Communication succeeds the first 30 seconds then fails | Buffer overrun from simultaneous bi-directional traffic (PLC SEND + host polling) | Capture traffic with serial sniffer; observe overlap | Disable PLC transmit; let host poll exclusively |
Returns error 0x00000003 in FINS response |
No node exists at target address | Confirm node switch position; check DIP SW2 | Reset node; power-cycle PLC if DIP-switch changed |
Returns error 0x00000002 in FINS response |
Remote node busy / retry limit exceeded | Check poll rate vs. PLC cycle time | Reduce host poll frequency; raise PLC scan interval |
| CX-Programmer connects but host driver claims port busy | CX-Programmer session lingers after exit | Process explorer — kill CXP and FinsGateway tasks | Full exit CX-Programmer; restart FINS Gateway service if used |
| Tag quality continuously "uncertain" rather than "good" | Wrong FINS server type (Ethernet vs. Serial) configured on driver | Driver config → Server type | Switch to Serial server type and set COM port |
FINS Error Codes and Recovery
The end codes returned in the FINS response frame byte 18 (ERR) carry diagnostic value. The most common serial-FINS errors and their interpretation per W342:
| End Code (hex) | Meaning | Recommended Action |
|---|---|---|
| 0x00000001 | Service was not executed; destination node is not in the network | Verify routing path; check bridges and repeaters |
| 0x00000002 | Service was not executed; destination node busy; retry exceeded | Lower host poll rate, raise PLC scan interval, retry |
| 0x00000003 | Service was not executed; target node does not exist | Confirm target rotary/DIP address on PLC |
| 0x00000004 | Service was not executed; source node is not in the network | Confirm host source-node setting |
| 0x00000005 | Routing error | Check network-table entries; FINS Gateway required to bridge networks |
| 0x00000010 | Command formatting error; service code too long / short | Validate frame build in driver code |
| 0x00000011 | Parameter error; memory area invalid for this CPU | Verify memory area code in command |
| 0x00000022 | Memory area designation error | Validate area code, EM bank number (00–0C) |
| 0x00000023 | Address error (out of range) | Check offset vs. PLC's installed memory size |
| 0x00000024 | Data length too large | Split into multiple reads; FINS limits read to 999 words per message on serial |
| 0x00010100 | Serial parity / overrun / framing error | Check cable integrity; verify parity and stop bits match exactly |
| 0x00010200 | Receive buffer overflow | Reduce poll rate; disable unsolicited PLC SEND |
Intermittent Drop-Out Field Pattern
A pattern frequently reported with serial-FINS drivers — including the Inductive Automation FINS thread — is intermittent loss of tag quality that persists until the host driver is restarted. The underlying problem is almost always:
- The connection is reported as bound at the device level even while no traffic flows.
- A single corrupted frame leaves the driver's receive-state machine out of sync.
- The polling task continues to write to a buffer expecting a FINS response that never matches.
Mitigation in driver configuration:
- Enable the watchdog / heartbeat option if available.
- Set FINS session timeout to a value slightly longer than the longest expected PLC scan (default often 3 s).
- Verify that nothing else is using the same physical COM port — including the Omron FINS Gateway service which can sit transparently between CX-Programmer and the driver.
- Replace USB-RS232 adapter when the field test confirms intermittent fails with bad-CRC bytes; the controller side is rarely at fault.
Ethernet FINS as a Successor
Most engineers moving off serial FINS move to Ethernet FINS for the higher poll rates (up to 4,096 words per message, 100/10 Mb/s wire speed) and easier cable management. The driver configuration is identical — same header, same MRC/SRC codes, same network/node/unit addressing — only the Connection Mode property changes from Serial to UDP or TCP on the TOP Server Ethernet FINS driver. node-red-contrib-omron-fins supports CV, CP, CS, CJ, NJ, and NX across both transports with the same API.
Final Commissioning Checklist
- CX-Programmer auto-online completes and reports a known node at the target COM port.
- A successful two-way transfer (PC-to-PLC upload and PLC-to-PC verify) confirms hardware.
- Host driver is configured with the recorded baud/frame/node/network/unit triplet.
- Host reads a known boolean (
CIO 100.00) and a known word (D100) within one poll interval. - PLC
SDandRDLEDs both flash in rhythm with the host poll. - CPU is in
RUNorMONITORmode withoutERR/ALMlights. - Host driver logs show no overrun or NACK for at least 5 minutes of continuous polling.
- Watchdog / auto-reconnect enabled in the host driver to recover from any future field-induced cable noise.
Frequently Asked Questions
What is the default serial FINS node address on an Omron CS1G/CJ1M PLC?
The default node is 01, set by the CPU board's rotary switch (or SW2 on legacy CV-series). With CX-Programmer auto-online, you can verify the live node. The host PC should typically use a different node (commonly 02) to avoid address collisions.
How do I make a serial FINS cable for a CJ2M or CP1L PLC?
For CJ2/CJ1/CS1 use the Omron XW2Z-200S (2 m) or XW2Z-500S (5 m) cable — DB-9 to DB-9 with the pinout PC 2↔PLC 2, PC 3↔PLC 3, PC 7↔PLC 4, PC 8↔PLC 5, PC 5↔PLC 9. For a CP1L built-in RS-232C port (mini-DIN) you must use the CP1W-CIF01 adapter; never plug a DB-9 cable directly into the mini-DIN as the pinout is reversed.
Why does the host driver report "tag quality bad" immediately after starting?
The most common cause is PLC node address mismatch between the driver and the rotary/DIP switch on the CPU. Check the PLC Setup DM area (DM32000 for port 1) to confirm the configured node. Second most common cause: a different application — CX-Programmer, FINS Gateway service, or another SCADA — is holding the COM port; exit all such applications before opening the host driver.
Can I run both serial FINS and Ethernet FINS on the same CJ1W-SCU21 option board?
The SCU21 has two physical ports (RS-232C on port 1, RS-422A/485 on port 2) and each supports either protocol independently. To run Ethernet FINS on the SCU41 you must add a CP1W-CIF41 (Ethernet) option board instead — it speaks FINS over UDP/TCP rather than serial. The CJ1W-SCU21 cannot speak Ethernet FINS.
What is the maximum number of words per FINS read on a serial link?
The serial-frame FINS read service (MRC 0x01, SRC 0x01) is limited to 999 words per message on a serial transport. Ethernet FINS lifts this limit to 4,096 words. When migrating from serial to Ethernet FINS, verify your driver's chunk size — applications that send more than 999-word requests over serial will return an end code 0x00000024 (data length too large) until retuned.