Omron CJ1M .NET FINS Communication: Protocol Reference

1. Overview: Why Implement FINS in .NET

Industrial gateways that bridge Omron CS/CJ-series PLCs to SCADA, MES, or cloud telemetry stacks often rely on third-party OPC servers or vendor-locked ActiveX controls. Both paths age poorly: classic Omron CX-Server COM components only work in 32-bit hosts, and many FINS toolkits on the market are abandoned. Building a native .NET FINS gateway against the CJ1M-CPU13 gives you a modern async, cross-platform, 64-bit-clean implementation that you control end-to-end.

The CJ1M-CPU13 is a compact, modular CPU that ships with one RS-232C port (peripheral or Host Link) and supports an Ethernet Communication Unit (ETN21) on the backplane. Both transports speak the same application layer — FINS (Factory Interface Network Service) — so a single .NET state machine can drive serial and TCP/UDP sessions with only the transport layer changing.

This reference documents the FINS frame format, the memory-area model, the command codes you need for CIO/HR/DM access, and a production-ready C# transport implementation with code samples, error handling, and verification steps.

2. FINS Protocol Architecture

FINS is a request/response application-layer protocol. The CPU (or a Communication Unit) accepts a command frame, executes it on the specified memory area, and returns a response frame. Every frame has a fixed header followed by command-specific data.

2.1 Layer Model

2.2 Frame Topology

Every FINS frame is structured: [FINS Header (10 or 16 bytes)] [Command Code (2 bytes)] [Command Body] [Response Body]. For Ethernet, the header expands to 16 bytes to include the Gateway count and destination/source network addresses; serial frames use 10 bytes because the Host Link layer adds its own addressing wrapper.

3. FINS Header Layout (Ethernet / TCP-UDP)

The CPU responds with the same SID, swapped SA/DA, and bits 0–3 of ICF holding the completion code (MRES/SRES codes). The main response code is at offset 12 in the response payload, sub-code at 13.

4. Memory Areas and Address Encoding

Each FINS memory command encodes the target area as a 2-byte area code followed by a 3-byte address. Word addresses are little-endian; bit addresses use the lower 4 bits of byte 2 of the address (0x0–0xF).

5. Core FINS Commands

W421 enumerates ~80 commands. The following subset covers 95% of SCADA/IIoT gateway use cases against a CJ1M-CPU13.

5.1 Command Body: Memory Area Read (01 01) Example

To read 10 words starting at DM D00100:

1. Area code: 0x82 (DM legacy) or 0x02 (DM 20000+). Pick one based on PLC Setup → DM Area Setup.
2. Address: 0x64 0x00 0x00 (=100 decimal, little-endian).
3. Number of items: 0x0A 0x00 (little-endian word count).

Command payload (after the 2-byte command code): 82 64 00 00 0A 00. Full request frame on Ethernet: 10-byte FINS header + 01 01 + payload. Response payload carries the 10 words little-endian (20 bytes), and the trailing MRES/SRES end codes (0x0000 = success).

5.2 Command Body: Multiple Memory Area Read (01 05) Example

Read CIO 0, HR 0, and DM 0, each 5 words:

Body: 03 00         // number of area entries
      30 00 00 00 05 00   // CIO 0, 5 words
      32 00 00 00 05 00   // HR 0, 5 words
      02 64 00 00 05 00   // DM 100, 5 words

Response packs the three blocks in order. Maximum 198 words across all entries.

6. Transport: Ethernet (TCP / UDP)

The ETN21 supports both TCP and UDP FINS on port 9600. UDP gives the lowest latency for periodic polling; TCP gives a session model that survives PLC reboots and is recommended for write operations.

6.1 ETN21 Configuration (CX-Programmer)

1. Set the unit's IP address, subnet, and gateway in the ETN21's I/O Table → Unit Setup dialog.
2. Set FINS/UDP Port = 9600, FINS/TCP Port = 9600.
3. Set FINS Node Number = last octet of the IP (e.g., 100 for 10.0.0.100).
4. Set Network Number (1–127) for routing across multiple subnets.
5. Set Routing Table entries if crossing ETN21 → CPU.
6. Transfer settings, then power-cycle the rack.

Reference: CS/CJ-series Ethernet Units Operation Manual W342 and the ProFace CS/CJ Ethernet Driver notes (PDF) for cross-vendor confirmation of port and FINS node behavior.

6.2 Connection Parameters to Cache in Your .NET App

6.3 .NET UDP Transport Skeleton

using System;
using System.Net;
using System.Net.Sockets;
using System.Threading;
using System.Threading.Tasks;

public sealed class FinsUdpClient : IDisposable
{
    private readonly UdpClient _socket;
    private readonly IPEndPoint _remote;
    private readonly byte _sid;
    private int _sidCounter;

    public byte LocalNode   { get; }
    public byte LocalNetwork { get; }
    public byte RemoteNode  { get; }
    public byte RemoteNetwork { get; }
    public byte RemoteUnit  { get; }

    public FinsUdpClient(string remoteIp, int port,
                         byte localNet, byte localNode,
                         byte remoteNet, byte remoteNode, byte remoteUnit = 0)
    {
        _socket = new UdpClient(0); // bind ephemeral
        _socket.Client.ReceiveTimeout = 2000;
        _remote = new IPEndPoint(IPAddress.Parse(remoteIp), port);
        LocalNetwork = localNet; LocalNode = localNode;
        RemoteNetwork = remoteNet; RemoteNode = remoteNode;
        RemoteUnit = remoteUnit;
    }

    public async Task<byte[]> SendAsync(byte[] commandBody, CancellationToken ct = default)
    {
        byte sid = (byte)Interlocked.Increment(ref _sidCounter);
        var frame = BuildFrame(sid, commandBody);
        await _socket.SendAsync(frame, frame.Length, _remote).ConfigureAwait(false);

        var result = await _socket.ReceiveAsync().WaitAsync(ct).ConfigureAwait(false);
        ValidateResponse(frame, result.Buffer, sid);
        return result.Buffer;
    }

    private byte[] BuildFrame(byte sid, byte[] body)
    {
        // 10-byte FINS header + 2-byte command code + body
        var frame = new byte[10 + body.Length];
        frame[0] = 0x80;                       // ICF: command, response required
        frame[1] = 0x00;                       // RSC
        frame[2] = 0x02;                       // GCT: 2 hops (PC -> ETN21 -> CPU)
        frame[3] = RemoteNetwork;
        frame[4] = RemoteNode;
        frame[5] = RemoteUnit;
        frame[6] = LocalNetwork;
        frame[7] = LocalNode;
        frame[8] = 0x00;                       // SA2 (PC unit)
        frame[9] = sid;
        Buffer.BlockCopy(body, 0, frame, 10, body.Length);
        return frame;
    }

    private static void ValidateResponse(byte[] request, byte[] response, byte sid)
    {
        if (response.Length < 14)
            throw new FinsException("Truncated FINS response");
        if (response[9] != sid)
            throw new FinsException($"SID mismatch: sent 0x{sid:X2} got 0x{response[9]:X2}");
        int main = response[12];
        int sub  = response[13];
        if (main != 0 || sub != 0)
            throw new FinsException($"FINS error 0x{main:X2}{sub:X2}");
    }

    public void Dispose() => _socket?.Close();
}

public class FinsException : Exception { public FinsException(string m): base(m) {} }

6.4 .NET TCP Transport Notes

TCP FINS prepends a 4-byte length header to the FINS frame (big-endian, length in bytes of the FINS payload). The PLC closes the socket if the unit is reset, so wrap your read loop in a reconnect task. Use a single NetworkStream with a SemaphoreSlim(1,1) to serialize requests; FINS is half-duplex on a given socket.

7. Transport: Serial (Host Link / FINS-on-Serial)

The CJ1M's peripheral port and the optional CP1W-CIF01 RS-232C/485 Option Board can run Host Link (C-mode) or a serial FINS variant. FINS over serial is rare in practice; most legacy installs use Host Link because it is the path supported by older HMI panels.

7.1 Host Link (C-mode) Frame Format

@ [FA header (optional 2B)] [node (2B ASCII)] [header (2B)] [text] [FCS (2B)] [* CR]

Default baud is 9600, 7E2, node 00. The '@' sentinel indicates the start; '*' and CR mark the end. The Frame Check Sequence is the two-character ASCII hex of the XOR of every byte between '@' and the FCS. The Host Link Command Reference W227 details each text code (RR, WR, RD, WD, etc.).

7.2 Choosing the Transport

8. Tag Mapping and Polling Patterns

A SCADA gateway rarely reads one word at a time. The recommended pattern is to build a tag list, then issue a single 01 05 Multiple Memory Area Read per scan for all tags that share the same FINS node, batching by maximum 198 words. A second 01 05 handles any overflow or tags in different EM banks.

8.1 Address Resolution Rules

• DM100 (CX-Programmer notation) → area code 0x82, word 100.
• D20100 → area code 0x02, word 100. The D20000 offset is implied.
• CIO 0.07 → area code 0x30, word 0, bit 0x07.
• HR10 → area code 0x32, word 10.
• E0_0 → area code 0x18, word 0 (EM bank 0).

8.2 Polling Cadence

On a CJ1M-CPU13, the FINS response time for a 198-word read is typically < 30 ms over a 100 Mbit LAN. A 100 ms scan gives three full reads per second and is a sensible default. Avoid issuing a new FINS request before the previous response arrives on the same TCP socket; on UDP, allow a 100 ms timeout for lost frames before retrying with the same SID.

9. .NET Implementation Building Blocks

9.1 Frame Encoder

public static class FinsEncoder
{
    public static byte[] BuildReadWords(byte area, int address, ushort count)
    {
        if (count == 0 || count > 999)
            throw new ArgumentOutOfRangeException(nameof(count));
        return new byte[]
        {
            0x01, 0x01,                      // Memory Area Read
            area,
            (byte)(address & 0xFF),
            (byte)((address >> 8) & 0xFF),
            (byte)((address >> 16) & 0x0F),
            (byte)(count & 0xFF),
            (byte)((count >> 8) & 0xFF)
        };
    }

    public static byte[] BuildWriteWords(byte area, int address, ushort[] data)
    {
        if (data.Length == 0 || data.Length > 999)
            throw new ArgumentOutOfRangeException(nameof(data));
        var body = new byte[6 + data.Length * 2];
        body[0] = 0x01; body[1] = 0x02;       // Memory Area Write
        body[2] = area;
        body[3] = (byte)(address & 0xFF);
        body[4] = (byte)((address >> 8) & 0xFF);
        body[5] = (byte)((address >> 16) & 0x0F);
        body[6] = (byte)(data.Length & 0xFF);
        body[7] = (byte)((data.Length >> 8) & 0xFF);
        for (int i = 0; i < data.Length; i++)
        {
            body[8 + i*2]     = (byte)(data[i] & 0xFF);
            body[8 + i*2 + 1] = (byte)((data[i] >> 8) & 0xFF);
        }
        return body;
    }
}

9.2 Async Tag Poller

public sealed class FinsTagPoller
{
    private readonly FinsUdpClient _fins;
    private readonly CancellationTokenSource _cts = new();
    public event Action<TagSnapshot>? OnSnapshot;

    public async Task RunAsync(TimeSpan period, IEnumerable<FinsTag> tags)
    {
        var grouped = tags.GroupBy(t => t.FinsNode).ToList();
        while (!_cts.IsCancellationRequested)
        {
            var snap = new TagSnapshot(DateTime.UtcNow);
            foreach (var g in grouped)
            {
                var body = FinsEncoder.BuildMultiRead(g.Select(t => t.Descriptor).ToArray());
                var resp = await _fins.SendAsync(body, _cts.Token).ConfigureAwait(false);
                FinsDecoder.UnpackMultiRead(resp, g.ToList(), snap);
            }
            OnSnapshot?.Invoke(snap);
            await Task.Delay(period, _cts.Token).ConfigureAwait(false);
        }
    }
}

9.3 Graceful Shutdown and Reconnect (TCP)

while (!ct.IsCancellationRequested)
{
    try
    {
        using var tcp = new TcpClient();
        await tcp.ConnectAsync(_ip, _port, ct);
        await using var ns = tcp.GetStream();
        while (!ct.IsCancellationRequested)
        {
            var req = await _queue.Reader.ReadAsync(ct);
            var frame = BuildFrame(req.Sid, req.Body);
            var length = BitConverter.GetBytes(frame.Length).Reverse().ToArray();
            await ns.WriteAsync(length, ct);
            await ns.WriteAsync(frame, ct);
            var hdr = new byte[4];
            await ReadExactAsync(ns, hdr, ct);
            int n = (hdr[0] << 24) | (hdr[1] << 16) | (hdr[2] << 8) | hdr[3];
            var resp = new byte[n];
            await ReadExactAsync(ns, resp, ct);
            req.CompletionSource.TrySetResult(resp);
        }
    }
    catch (Exception ex) when (!ct.IsCancellationRequested)
    {
        await Task.Delay(TimeSpan.FromSeconds(2), ct);
        // log ex, loop back to reconnect
    }
}

10. Error Codes and Recovery

For a complete list, see W421-E1 §8 "Error Code Lists." The 2-byte end code appears at offsets 12–13 of the response frame.

11. Verification and Commissioning

1. Layer-2 ping. From a Windows admin shell, run ping 10.0.0.100. The ETN21 should reply.
2. Port probe. Use Test-NetConnection 10.0.0.100 -Port 9600 (PowerShell) to confirm TCP FINS is open.
3. CX-Programmer online. Connect via Ethernet in CX-Programmer and read CIO 0.00 to confirm the rack and ETN21 are correctly configured.
4. Minimal .NET test. Use the FinsUdpClient class above to read 5 words from DM 0. Expect a 0000 end code and 10 bytes of payload.
5. Multi-area read smoke test. Combine CIO, HR, DM in a single 01 05 and verify each unpacked word matches the CX-Programmer value.
6. Write / read-back. Write a known pattern (e.g., 0x1234) to DM 200, then read it back. This catches address/area-code mistakes that would otherwise silently corrupt data.
7. Stress test. Poll 198 words at 100 ms for 10 minutes; verify no SID drops, no exception leaks, and no socket exhaustion.
8. Fault injection. Disconnect the Ethernet cable; confirm reconnect logic restores communication without leaking sockets.

12. Common Pitfalls and Field Notes

• Wrong GCT. Setting GCT=0 in a FINS header going PC → ETN21 → CPU yields 0x02-01 "Local node not in network." GCT counts the number of networks to traverse, not the number of nodes.
• Confusing FINS node with IP last octet. A node number of 100 maps to a /24 address ending in .100 only when the network administrator has not manually remapped. Verify in ETN21 setup → FINS Node Number.
• DM area code mismatch. Mixing 0x02 and 0x82 for the same D-word reads two different physical locations on some firmware revisions. Standardize on one and document it.
• UDP receive race. A single UdpClient instance can interleave responses if multiple SIDs are in flight. Either serialize with a SemaphoreSlim or use TCP.
• Endianness. FINS is little-endian for both address and data. Reading a D-word and showing it as the wrong value is almost always an endianness bug, not a PLC bug.
• Time data is BCD. 07 01 returns time as packed BCD, not decimal. 0x21 = 21, not 33.
• UM protection. Reading the program (UM) area without supplying the password returns 0x26-01. Most SCADA gateways should not need UM access; stay in CIO/HR/DM/AR/WR/EM.

13. Extending the Gateway

Once the CIO/HR/DM core is stable, layer in:

• Tag-list import from CX-Programmer CSV exports or a JSON manifest. Validate every area code and address against a built-in table to catch typos at startup, not at 2 a.m.
• OPC UA server on top of the poller. The Software Toolbox overview of Omron protocols highlights OPC UA bridges as the modern replacement for FINS-only SCADA.
• Event-driven reads using MSG instructions inside the ladder. The PLC sends unsolicited FINS messages to a registered SA1; the .NET listener must maintain an open UDP/TCP socket and a SID table for matching.
• Redundancy. Two ETN21 units on the same rack with different FINS networks and a watchdog in the gateway. Verify failover end-to-end by pulling an Ethernet cable.
• Modern replacements. Newer Omron CPUs (NJ/NX) drop FINS-on-TCP in favor of EtherNet/IP (CIP) and OPC UA. If a refresh is on the roadmap, plan a parallel implementation against the NX-series FINS Function Manual W596 and the EtherNet/IP EDS for CIP-Forward-Open.

14. Reference Summary