Omron CJ2M EtherNet/IP Communication Configuration Guide

James Nishida11 min read
EtherNet/IPOmronTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Omron CJ2M EtherNet/IP Communication Configuration Guide

This technical reference covers EtherNet/IP setup for Omron CJ2M and CJ2H programmable controllers, including built-in port configuration, CX-Programmer/CX-One integration, CIP explicit messaging, and third-party scanner integration (e.g., a Raspberry Pi running pycomm3 or cpppo). The procedures, register tables, and diagnostic flows apply to any CJ-series adapter that exposes CIP over TCP/UDP port 44818 (explicit) and UDP port 2222 (implicit I/O). Cross-references to the official Omron EtherNet/IP product catalogue and the CJ-series RFID Connection Guide are included where they validate the configuration steps.

1. Overview

EtherNet/IP is the ODVA-managed industrial Ethernet implementation of the Common Industrial Protocol (CIP). Omron CJ2M and CJ2H families expose CIP over Ethernet through either an on-board EtherNet/IP port (CJ2M-CPU3x) or the CJ1W-ETN21 Ethernet module mounted on the CJ-series backplane. The same connection path is used by HMIs, VFDs, remote I/O blocks, vision systems, and third-party controllers such as a Raspberry Pi acting as a CIP scanner.

Two distinct CIP services dominate field traffic:

  • CIP Explicit Messaging – request/reply transactions over TCP/44818. Used for non-realtime data such as reading/writing DM/HR/CIO words or setting parameters.
  • CIP Implicit (I/O) Messaging – cyclic, multicast UDP datagrams on UDP/2222. Used for deterministic I/O data exchange between scanner and adapter.

Both services share the CIP object model. Omron CJ-series controllers implement the standard CIP objects (Identity 0x01, Message Router 0x02, Assembly 0x04, Connection 0x05, TCP/IP Interface 0xF5, EtherNet/IP Interface 0xF6) plus vendor-specific extensions for direct DM/CIO access. See the Omron EtherNet/IP product category for the current list of CIP-capable products and their corresponding EDS files: Omron EtherNet/IP product catalogue.

2. Hardware Platform Selection

Controller Built-in EtherNet/IP EtherNet/IP Module Option Typical Use
CJ2M-CPU11/12/13/14/15 No CJ1W-ETN21 (compatible backplane) Serial-only retrofits
CJ2M-CPU31/32/33/34/35 Yes (1 port, 100Base-TX) Optional second port via ETN21 Most common new designs
CJ2H-CPU64/65/66/67/68 No CJ1W-ETN21 High-speed instruction execution
CS1 / CJ1 series No CS1W-ETN21 / CJ1W-ETN21 Legacy platforms
Selector caveat: The CJ2M-CPU1x family shares the chassis with the CPU3x family but lacks the on-board EtherNet/IP port. Verify the suffix "3" (CPU3x) before commissioning – the CPU1x units communicate via RS-232C, USB, or option boards only.

3. Protocol Stack and Port Allocation

The EtherNet/IP encapsulation header follows ODVA Volume 2. Port allocation for CJ2M EtherNet/IP traffic:

Port Protocol Purpose
TCP 44818 ENIP encapsulation Explicit messaging, register access, UCMM
UDP 2222 CIP implicit I/O Class 0/1 multicast, heartbeat, I/O datagrams
UDP 44818 ENIP encapsulation List Identity / List Services (broadcast discovery)
TCP 2222 Reserved Not used by CIP

Firewalls and managed switches must permit TCP/44818 between scanner and adapter, and UDP/2222 between scanner and any multicast group the adapter subscribes to (default range 239.192.0.0 – 239.255.255.255 per ODVA recommendation).

4. CIP Connection Types and Omron Memory Access

CJ2M memory areas are exposed through standard CIP services. The most frequently accessed areas:

Omron Memory Typical CIP Path Read Method Write Method
CIO (Core I/O) Assembly 0x04 instance 100 (input) / 150 (output) Get_Attribute_Single on Assembly Set_Attribute_Single on Assembly
DM (Data Memory) Vendor D-tag object (CJ2M) or Assembly instance CIP Read Tag service (NJ/NX) or vendor service (CJ2M) CIP Write Tag service
WR (Work) Same as DM Vendor CIP service Vendor CIP service
HR (Holding Relay) Same as DM Vendor CIP service Vendor CIP service
EM (Extended Memory) Bank-switched, requires routing path Read Tag with bank qualifier Write Tag with bank qualifier
Tag-based vs word-based: CJ-series PLCs do not expose named tags over CIP the way NJ/NX controllers do. To read CIO 100 from a third-party scanner, configure an Assembly object (instance 100/101) in CX-Programmer, or use the vendor-specific CIP Read service. For new designs with named-tag access, migrate to NJ/NX with the Sysmac Studio tag-database export.

5. Configuring the CJ2M Built-In EtherNet/IP Port

  1. Open CX-Programmer (part of CX-One) and connect to the CPU via USB or the existing serial port.
  2. Select PLC → Ethernet in the IO Table. Double-click the on-board port icon labelled CPU/Built-in Ethernet.
  3. Set IP Address, Subnet Mask, and Default Gateway. Use a static address; DHCP behaviour on the built-in port is firmware-dependent and not recommended for control traffic.
  4. Set the FINS Node Address to the last octet of the IP address (e.g., IP 192.168.1.10 → Node 10).
  5. Open Settings → Option → Built-in Ethernet Port → TCP/IP and enable FINS/TCP if HMI traffic is required in parallel with CIP.
  6. Under CIP Settings, enable CIP Routing and select the maximum number of CIP connections. The CJ2M-CPU3x supports up to 32 simultaneous CIP connections per firmware revision; consult the CJ2M Built-in Ethernet Operation Manual for the exact limit of your unit.
  7. Download the configuration. CX-Programmer prompts to apply the new settings live; a power cycle is normally not required for the built-in port.

For ETN21 modules the procedure is identical but launched from IO Table → Special I/O → ETN21 → Edit. The same dialog also configures FINS/UDP and CIP routing through the module.

6. EDS File and Network Configurator Integration

The CJ2M-CPU3x on-board port EDS is bundled with CX-One. If the third-party scanner is on a different vendor tool (Allen-Bradley RSLogix 5000, Beckhoff TwinCAT, or a Linux-based stack), import the EDS manually:

  1. Download the EDS bundle from the Omron Industrial Automation site – the EtherNet/IP product category page lists all supported CIP products and their EDS files: Omron EtherNet/IP product category.
  2. Run the EDS Hardware Installation Tool (typically %SystemRoot%\EDS in Windows) and select Register an EDS file.
  3. Restart the configuration tool and re-scan the network; the CJ2M appears as a vendor-specific CIP adapter with the configured IP.

The same workflow is documented for CJ-series slaves in the official RFID Connection Guide (P626), which describes connection of a V680S RFID reader/writer to a CJ-series controller over EtherNet/IP: CJ-series EtherNet/IP RFID Connection Guide (P626). The CIP commissioning sequence is identical for any third-party EtherNet/IP adapter attached to the same CJ2M.

7. Third-Party Scanner Integration — Raspberry Pi Example

A Linux host such as a Raspberry Pi 4 can act as a CIP scanner using open-source or commercial stacks. Two popular options:

  • pycomm3 – explicit messaging support, very stable on Raspbian. Supports generic_message() for low-level CIP service construction.
  • cpppo – full CIP stack including implicit I/O, written in pure Python. Suitable for class 1 connections and deterministic polling.

Minimum scanner-side checklist before any CIP request is issued:

  1. Assign the Pi a static IP in the same subnet as the CJ2M (e.g., 192.168.1.50/24) and disable any local firewall on port 2222 and 44818.
  2. Confirm bi-directional UDP/2222 reachability: nc -u 192.168.1.10 2222 < /dev/null from the Pi should not produce an immediate ICMP unreachable.
  3. Confirm TCP/44818 with nc -vz 192.168.1.10 44818 – the command must return succeeded.
  4. Issue a List Identity request. With pycomm3: LogixDriver('192.168.1.10').discovery() returns all CIP nodes on the segment; with cpppo: cpppo.server.enip.list_identify(host='192.168.1.10').

7.1 Explicit Messaging — Reading DM Area on CJ2M

The CJ2M exposes data memory through a vendor CIP tag object. A read of ten words starting at DM100 is constructed as a CIP request:

from pycomm3 import CIPDriver

driver = CIPDriver('192.168.1.10')
result = driver.generic_message(
    service=0x4C,                 # CIP Read Tag
    class_code=0x70,              # Omron vendor class
    instance=1,
    request_data=b'D100\x00',     # ASCII tag name, NUL-terminated
    route_path=b'',               # local CIP path
)
print(result)
Path caveat: The exact tag-path syntax differs between Omron CIP revisions. The Read Tag example above works on firmware revisions that expose the vendor D-tag object (default on CJ2M-CPU3x with CIP Routing enabled). For older firmware, configure an Assembly instance (class 0x04, instance 100) in CX-Programmer and read 30 bytes of payload per cycle instead.

7.2 Explicit Messaging — Writing a Single Bit

# Write CIO 100.00 = TRUE on CJ2M
driver.generic_message(
    service=0x4D,                 # CIP Write Tag
    class_code=0x70,
    instance=1,
    request_data=b'W100.00\x00\x01',  # tag name + 1-byte value
)

8. Implicit (I/O) Messaging Configuration

For deterministic exchanges the scanner opens a Class 1 connection. CJ2M-CPU3x supports up to 8 I/O connections plus explicit messaging connections (subject to firmware). The configuration is set in the scanner's EDS registration and pushed to the PLC:

  1. In the scanner tool (CX-One Network Configurator, RSNetWorx, or third-party equivalent), add the CJ2M EDS.
  2. Create a new Connection: select Exclusive Owner or Input Only depending on data direction.
  3. Set RPI (Requested Packet Interval) between 1 ms and 3200 ms in 1 ms increments. The CJ2M built-in port supports sub-millisecond RPI on recent firmware revisions; verify the exact minimum in the CJ2M Built-in Ethernet Operation Manual for your CPU revision.
  4. Configure Output Assembly Instance (default 150) and Input Assembly Instance (default 100). The CJ2M produces data on instance 100 and consumes data from instance 150 by default.
  5. Set the Trigger to Cyclic for SCADA use or Application for event-driven production.
  6. Download the configuration to the scanner and observe the connection state in the scanner's diagnostic panel.

9. Diagnostic Workflow

When a connection fails, follow this sequence:

  1. Physical layer: Verify the link LED on the CJ2M port, swap the patch cable, force port speed/duplex on the managed switch.
  2. IP layer: ping from the scanner host. If the ping fails, check VLAN tagging and ACLs.
  3. TCP/44818: nc -vz <ip> 44818 from the scanner host.
  4. UDP/2222: From the scanner host: nc -u <ip> 2222 < /dev/null; "Connection refused" is normal for UDP, "no route to host" indicates a firewall.
  5. List Identity: Run a CIP List Identity request. A successful reply confirms the CJ2M is alive on the CIP layer even if all higher services are misconfigured.
  6. Wireshark capture: Filter enip and inspect encapsulation commands. Look for error codes in the CIP response.

9.1 Common CIP Error Codes

Hex Code Symbol Meaning Typical Cause
0x01 Connection failure Resource unavailable Scanner requesting more connections than the PLC supports
0x02 Resource unavailable Out of CIP connections ETN21 capacity exceeded
0x04 Path segment error Invalid CIP path Wrong class/instance or malformed tag name
0x05 Path destination unknown Module offline ETN21 not seated properly or wrong slot
0x08 Service not supported Wrong service code Attempting Read Tag on a CJ2M without tag object support
0x0E Attribute not settable Read-only attribute Trying to write a status register
0x13 Not enough data Request too short Assembly instance mis-sized
0x14 Attribute not supported Vendor-specific attribute Wrong attribute ID in Get_Attribute_Single

10. Troubleshooting Matrix

Symptom Likely Root Cause Verification Corrective Action
No List Identity reply IP mismatch or firewall ping + nc test Re-address the port; open TCP/UDP 44818
List Identity ok, Read Tag fails Wrong CIP path Wireshark decode of CIP path Verify ASCII tag string and NUL terminator
Class 1 connection times out RPI below port minimum Scan tool log Increase RPI; consult operation manual for minimum
Connection drops after ~30 s Multicast TTL exceeded Switch IGMP snooping Enable IGMP querier on the access switch
Implicit data is one cycle behind Application trigger not set EDS connection parameters Set trigger = Cyclic
Read returns all zeros PLC in PROGRAM mode CX-Programmer mode indicator Switch to MONITOR/RUN
Write succeeds but value reverts Forced bit conflict Memory viewer forced status Clear force; forced bits override CIP writes
Intermittent timeouts Duplex mismatch Switch port statistics Force 100M/Full on both ends
High latency on implicit I/O Non-managed switch flooding multicast Switch CPU load Replace with managed switch; enable IGMP snooping

11. Acromag EtherNet/IP Remote I/O Use Case

When a third-party EtherNet/IP adapter (e.g., Acromag EtherStax or BusWorks modules) is added downstream of the CJ2M, the same CX-One workflow applies. Acromag publishes an application note titled How to Configure Omron PLCs with Ethernet/IP for Use with Remote I/O. The procedure mirrors Sections 5–8 of this article and is a useful cross-reference for CJ2H installations where a remote I/O block replaces a wired expansion rack.

12. Recommended Verification Procedure

After each configuration change, run a five-step verification:

  1. From the scanner host, issue List Identity and confirm the CIP Vendor ID matches Omron (vendor 0x002F per ODVA registration).
  2. Read a known DM word (e.g., DM0) via CIP Read Tag and verify the value matches the CX-Programmer memory view.
  3. Write a known pattern (e.g., DM100 = 0x1234) and read it back. Confirm persistence across a CPU scan cycle.
  4. If using implicit I/O, force a bit in the input assembly and confirm the scanner sees the change within one RPI cycle.
  5. Disconnect the Ethernet cable for 10 s, reconnect, and confirm the connection re-establishes automatically with the original RPI.

Passing all five steps confirms correct CIP routing, vendor object configuration, and physical layer integrity. Failures at any step map directly into the troubleshooting matrix in Section 10.

FAQ

Does the CJ2M-CPU31 support EtherNet/IP out of the box?

Yes. The CJ2M-CPU31/32/33/34/35 has a built-in 100Base-TX EtherNet/IP port. Configure it via CX-Programmer under IO Table → CPU/Built-in Ethernet. The CJ2M-CPU11/12/13/14/15 variants require an external CJ1W-ETN21 module.

Which TCP and UDP ports must be open for EtherNet/IP?

Open TCP 44818 for explicit (request/reply) messaging and UDP 2222 for implicit I/O multicast. Some discovery functions also use UDP 44818 for List Identity broadcasts.

Can a Raspberry Pi act as an EtherNet/IP scanner against a CJ2M?

Yes. Use pycomm3 for explicit-only messaging, or cpppo for a full CIP stack including implicit I/O. Confirm reachability of TCP 44818 and UDP 2222 with nc before attempting tag reads or class 1 connections.

Why does my CIP Read Tag request return error 0x04 (Path Segment Error)?

The CIP path is malformed. For Omron vendor tag reads the path is typically class 0x70, instance 1, attribute 1, with the ASCII tag name (e.g., "D100") as request data. Verify NUL termination and length fields using a Wireshark capture filtered on enip.

What is the minimum RPI the CJ2M built-in port supports?

The CJ2M-CPU3x built-in port supports RPI down to roughly 1 ms on older firmware and sub-millisecond RPI on recent revisions; verify the exact minimum in the CJ2M Built-in Ethernet Operation Manual for your CPU revision. For cross-vendor interoperability, 5 ms is a safe lower bound.

Back to blog