Integrating Omron PLC with NI Vision Builder AI via TCP/IP

Integrating Omron PLC with NI Vision Builder AI over Ethernet (FINS/TCP)

National Instruments Vision Builder for Automated Inspection (VBAI) ships with a dedicated TCP I/O step category that streams inspection results to a programmable controller. On the controller side, an Omron CP1, CJ, CS, or NX/NJ-series PLC terminates the socket, parses the payload, and routes the data into the standard I/O table. This reference covers the full path: IP planning, the VBAI TCP I/O configuration, the Omron CX-Programmer TCP receive/transmit function blocks, the FINS command set used for unsolicited messaging, an RS-232C fallback path to the DM (Data Memory) area, and the field-proven verification and troubleshooting flow.

1. Machine Vision and PLC Integration: Architectural Model

Machine vision systems in industrial automation perform three roles:

1. Inspection – presence/absence, dimensional gauging, OCR, pattern matching, defect detection.
2. Identification – 1D/2D barcode, DataMatrix, and label verification.
3. Guidance – robot pick-and-place offsets, alignment feedback, part orientation.

Per the Cognex definition, a machine vision system "inspects, measures, and analyzes parts and products throughout all phases of industrial automation" (Cognex: Machine Vision Basics). The vision processor produces a result envelope – pass/fail, numeric measurements, decoded strings – that must reach the line controller within the cycle time of the machine. A PLC is the natural sink because it already owns the safety chain, motion axes, and HMI tags.

Unlike "computer vision," which is a research field that focuses on the algorithmic capture and automation of image analysis (Zebra: Machine Vision vs Computer Vision), industrial machine vision is deterministic, time-budgeted, and always bound to a downstream control device.

2. System Architecture and Topology

The reference architecture places the VBAI runtime and the Omron CPU on the same Layer-2 segment, with the HMI on a routed subnet:

Table 1 – Address and protocol assignment:

For the FINS/TCP listener, Omron allocates TCP port 9600 by default on CJ2 and CS1 with built-in Ethernet (ETN21). On CP1L-EM/CP1H-EM, the ETN option board listens on the same port. The Sysmac NJ/NX controller exposes FINS/TCP via the FINS Connection Service on the same port.

3. Prerequisites

• VBAI Development or Runtime license (VBAI 2019 SP1 or later recommended for the modern TCP I/O editor).
• Smart camera or frame grabber supported by VBAI (Basler ace, FLIR/Teledyne Blackfly S, NI 17xx, ISC-17xx).
• Omron PLC with built-in Ethernet: CP1H-XA, CP1L-EM, CP1L-EL, CJ2M-CPU3x with ETN21, CS1G/H-CPUxx-H with ETN21, or any NJ/NX-series.
• CX-Programmer 9.x (CP/CJ/CS) or Sysmac Studio 1.5x (NJ/NX).
• Layer-2 managed switch; static IPs reserved for the vision host and the PLC's ETN port.
• FINS node numbers assigned and unique. FINS node 0 is reserved for the default gateway; do not assign it to any device.

4. Configuring the Omron PLC Ethernet and FINS Settings

Open CX-Programmer → PLC → Edit Ethernet/Comms Settings on the CP/CJ/CS project, or Sysmac Studio → Configurations and Setup → Controller Setup → Built-in EtherNet/IP Port → FINS/UDP and FINS/TCP on the NJ/NX.

1. Set the IP address to 192.168.1.10, subnet mask 255.255.255.0.
2. Set the FINS node number to 10 (decimal). The ETN21 module in CP1H/CP1L is fixed to node 1 by default; change it via the routing table to avoid a conflict with the CPU node.
3. Open the FINS/TCP tab. Enable Use FINS/TCP. Leave the FINS/TCP port number at 9600 unless the IT policy requires a custom port.
4. Click Transmit to PLC, then cycle the controller's Ethernet initialize bit (A610.1 for ETN21) only if you changed the node number. Most PLCs pick up IP/port changes live.

Confirm the listener is up. From the engineering PC shell:

A blank screen that doesn't immediately disconnect indicates a TCP socket has been accepted; this is FINS/TCP's normal behavior (it does not echo a banner). Press Ctrl+] to exit.

5. Building the TCP Receive Ladder in CX-Programmer

VBAI's TCP I/O step is a TCP client. It opens a session to 192.168.1.10:9600, sends a binary or ASCII payload, optionally waits for an acknowledgement, then closes (or holds open, depending on the Connection Type parameter). On the Omron side, you must accept the socket, frame the data, and write to a known word range.

CX-Programmer provides the TCP/IP Communications function blocks introduced in the CP1H-EM/CP1L-EM firmware V1.1 and back-ported to the CJ2M with unit version 2.0. The relevant blocks live in the _TCP library (Functions & Subroutines):

• TCP_OPEN – opens a passive listener on a port and stores the socket ID in a word.
• TCP_ACCEPT – accepts an incoming connection on a listener socket.
• TCP_RECV – receives up to N bytes into a byte array (you must convert to words for the I/O table).
• TCP_CLOSE – orderly close.

Example ladder extract (structured text follows for clarity):

// Once-per-scan: accept a new connection if no socket is open
IF W_sockID = 0 AND W_listenerOK = 1 THEN
    IF TCP_ACCEPT(SrcPort := UINT#9600,
                  SocketID := W_sockID) = 0 THEN
        W_state := 1;          // Connected
    END_IF;
END_IF;

// Receive up to 32 bytes (16 words) per call
IF W_state = 1 THEN
    iRet := TCP_RECV(SocketID := W_sockID,
                     RecvDat  := B_recvBuf,
                     RecvSize := UINT#32,
                     RecvLen  := W_recvLen);
    IF iRet = 0 AND W_recvLen > 0 THEN
        // Convert first 16 bytes to 8 D-words (big-endian, ASCII string mode)
        FOR n := 0 TO 7 DO
            D_payload[n] := BYTE_TO_UINT(B_recvBuf[2*n]) * 256
                         + BYTE_TO_UINT(B_recvBuf[2*n + 1]);
        END_FOR;
        D_passCnt  := D_payload[0];   // Pass counter
        D_failCnt  := D_payload[1];   // Fail counter
        D_overall  := D_payload[2];   // 1 = pass, 0 = fail
        D_cycleMs  := D_payload[3];   // Inspection cycle time
    END_IF;
END_IF;

// Heartbeat to VBAI: write the current pass counter as ASCII back
IF W_state = 1 AND W_tick100ms THEN
    B_sendBuf[0] := UINT_TO_BYTE(D_passCnt / 256);
    B_sendBuf[1] := UINT_TO_BYTE(D_passCnt MOD 256);
    TCP_SEND(SocketID := W_sockID,
             SendDat  := B_sendBuf,
             SendSize := UINT#2);
END_IF;

// Linger watchdog – close after 60 s of silence
IF W_state = 1 AND W_idleCnt > 600 THEN
    TCP_CLOSE(SocketID := W_sockID);
    W_sockID := 0;
    W_state  := 0;
END_IF;

For the CJ2M-CPU3x, the same _TCP library is included in CX-Programmer 9.0 and later. For CS1H with ETN21, the equivalent symbols are SEND/RECV with the FINS command 02 04 01 (FINS/TCP data send) – see the CS/CJ Series Ethernet Units Operation Manual (W465) for the framing table.

6. Configuring the VBAI TCP I/O Step

Open the inspection in the VBAI Configuration Interface and add a Communicate → TCP I/O step at the end of the state diagram (after all Inspect and Calculate steps). The configuration dialog has four tabs:

1. Connection – set Remote IP to 192.168.1.10, Remote Port to 9600, Local Port to 0 (any), Connection Type to Client, Connect on Start to Yes, Reconnect on Disconnect to Yes, retry every 1000 ms.
2. Data – choose Send on Inspection Complete. Add a row per variable. For pass/fail use a Boolean mapped to 0/1; for numeric results use a 16-bit unsigned integer (VBAI's Measurement output type already matches this). Set the byte order to Big-Endian unless the PLC is a CP1L running CX-Programmer 9.5+, which can be flipped to Little-Endian in the project CPU settings.
3. Format – select Raw Binary for the tightest payload (4 bytes per U16). Select ASCII String if you want the data human-readable in Wireshark during commissioning.
4. Acknowledgement – set the Wait for Ack timeout to 250 ms. The payload is the 2-byte pass counter echo from the ladder above.

To verify the byte layout, enable Tools → Options → Logging → Log TCP I/O Traffic. The on-disk log file shows each transaction as [SND] 00 01 00 03 00 00 00 01 etc. Cross-check the first four bytes against the CP1H word order: D0 = pass counter, D1 = fail counter, D2 = overall, D3 = cycle time.

7. RS-232C Fallback Path to the DM Area (Host Link)

When the Ethernet infrastructure is not available – early-stage commissioning, brown-field retrofit, or a single-station test bench – VBAI can be pointed at the PLC's serial port using the standard Communicate → Serial step and the Omron Host Link (C-mode) command set. Host Link frames the request as ASCII with the structure @ 02 RR WW * CR, where:

• 02 – the unit (CPU) address, set in the PLC's PLC Setup.
• RR – the read command: RD for DM, RR for CIO/IR, RH for HR.
• WW – starting word (4 hex digits, little-endian per Omron convention; 0100 = D100).
• * – terminator; the PLC appends a 2-character FCS before it.

For the DM read of D0..D15 used by the TCP path, the Host Link command issued by VBAI is:

where 10 is the CPU unit number (decimal 16 → hex 10), RD selects the DM area, 0000 starts at D0, and 16 reads 16 words (0x10). The two-character FCS is the two's-complement of the sum of the ASCII bytes from @ through *. The PLC responds with the words in the same byte order VBAI expects for the TCP path.

The serial parameters in PLC Setup → Host Link Port (CP1H serial option board CP1W-CIF01, or the built-in RS-232C on CJ2M-CPU3x) are 9600 bps, 7 data bits, even parity, 2 stop bits by default. CX-Programmer's Host Link (SYSMAC WAY) driver uses the same values, so a PC running CX-Programmer can be used to validate the link from the engineering side before VBAI ever connects.

8. FINS Command Reference for Cross-Verification

When TCP and Host Link both work, the third verification path is an explicit FINS command sent from CX-Programmer's Network Debugger or Sysmac Studio's FINS Command Send tool. FINS command/response frames use a 16-byte header followed by the command body:

To read D0..D15 from CX-Programmer's Network Debugger over FINS/UDP, the body bytes are:

where 82 is the DM area code, 0000 is the starting word (D0), 0010 is 16 words, and the trailing zeros are padding for the response buffer. The reply will be 16 words / 32 bytes of payload, which is exactly what the TCP I/O step expected to send.

9. State Machine and Cycle-Time Budget

VBAI's state diagram has three logical states: Acquire, Inspect, and Communicate. The total cycle time is the sum of the three. The PLC must not drop sockets or miss payloads if a state stalls, so add a watchdog. A typical 200 ms machine cycle budgets as follows:

The vision step + PLC processing is 120 ms of the 200 ms budget; the remaining 80 ms covers the conveyor index and rejects. If the cycle time climbs, the first thing to check is the VBAI inspection's Image Source debounce – an exposed Continuous acquisition can starve the I/O step.

10. Verification Procedure

Run the following checks in order, with the PLC in PROGRAM mode for the first three and MONITOR mode for the rest:

1. Physical layer. Verify link LEDs on the switch port and the ETN21. A green/orange pair at 100 Mb full-duplex is the minimum.
2. IP layer. From the VBAI host, ping 192.168.1.10 must return < 1 ms. A > 5 ms response on a switched network indicates duplex mismatch.
3. FINS layer. From CX-Programmer, PLC → Transfer → From PLC must complete. This round-trips FINS/TCP and proves the listener is up.
4. TCP I/O step. Force the inspection by clicking Single Step in VBAI. The TCP log shows [SND] followed by 8 bytes; Wireshark on the same segment should see a single 66-byte FINS/TCP frame (16-byte FINS header + 16-byte TCP wrapper + 8-byte payload + standard headers).
5. PLC side. Open a Data Trace in CX-Programmer on D0..D3. Each VBAI step should bump the Pass or Fail word. If the values are swapped, the byte order in the VBAI step is wrong – switch Big-Endian to Little-Endian or vice versa.
6. End-to-end. Run 1000 inspections with the part stream on. Inspections / sec on the HMI must equal the VBAI's Inspection Count; if not, sockets are being silently dropped (check Wireshark for FIN/RST from the PLC – the 60 s linger in the ladder example above is the canonical cause).

11. Troubleshooting Matrix

12. Edge Cases and Field-Proven Caveats

• CJ2M unit-version 2.0 vs 1.0. The FINS/TCP server on pre-2.0 units silently drops any payload larger than 1 KB. If your inspection is large (e.g. 256-byte ASCII string of OCR results), confirm the CPU is unit version 2.0 or later. The unit version is in CX-Programmer's PLC Properties → CPU Type.
• Sysmac NJ/NX and FINS/TCP. The NJ-series supports FINS/TCP only with the FINS Connection Service enabled in Built-in EtherNet/IP Port Settings → Services. It is disabled by default on NJ firmware 1.00; enable it and cycle the controller.
• Multicast on industrial switches. If FINS/UDP is used in addition to FINS/TCP, IGMP snooping on the managed switch can drop the FINS broadcast. Either disable IGMP snooping for the vision VLAN or pin the PLC port to multicast router.
• Windows firewall on the VBAI host. Outbound TCP is usually allowed by default, but if the IT policy has been tightened, the first connection will hang for 5 s and then time out. The Windows Defender log will show the dropped SYN.
• Hot-swapping the smart camera. A new camera has a different MAC. If the IT policy uses MAC-based DHCP reservations, the new device will not get the reserved IP. Either use a DHCP reservation on the camera's serial number or pin the MAC in the switch's port-security table.

13. Scaling Beyond One Camera

For multi-camera cells, the same pattern extends with two changes:

1. Assign each VBAI runtime a unique Local Port on the PLC side (e.g. 9600 for station 1, 9601 for station 2). Open a second TCP_OPEN listener per port in the CX-Programmer ladder.
2. Map each station to a non-overlapping D-area range. A common convention is D1000..D1015 for station 1, D1100..D1115 for station 2. The HMI is then responsible for aggregating; with NB-series panels, build a Multiview tag list rather than nesting ladder logic.

For cells with more than 8 stations, switch to a CP1H + ETN21 in FINS Gateway mode. The gateway PLC relays the FINS/TCP frames onto a downstream serial Host Link network where the legacy CJ1M units live. This pattern lets a brown-field cell add a modern vision stack without replacing the existing controllers.

14. Frequently Asked Questions