Omron CJ2M EtherNet/IP Communication Configuration Guide
This technical reference covers EtherNet/IP setup for Omron CJ2M and CJ2H programmable controllers, including built-in port configuration, CX-Programmer/CX-One integration, CIP explicit messaging, and third-party scanner integration (e.g., a Raspberry Pi running pycomm3 or cpppo). The procedures, register tables, and diagnostic flows apply to any CJ-series adapter that exposes CIP over TCP/UDP port 44818 (explicit) and UDP port 2222 (implicit I/O). Cross-references to the official Omron EtherNet/IP product catalogue and the CJ-series RFID Connection Guide are included where they validate the configuration steps.
1. Overview
EtherNet/IP is the ODVA-managed industrial Ethernet implementation of the Common Industrial Protocol (CIP). Omron CJ2M and CJ2H families expose CIP over Ethernet through either an on-board EtherNet/IP port (CJ2M-CPU3x) or the CJ1W-ETN21 Ethernet module mounted on the CJ-series backplane. The same connection path is used by HMIs, VFDs, remote I/O blocks, vision systems, and third-party controllers such as a Raspberry Pi acting as a CIP scanner.
Two distinct CIP services dominate field traffic:
- CIP Explicit Messaging – request/reply transactions over TCP/44818. Used for non-realtime data such as reading/writing DM/HR/CIO words or setting parameters.
- CIP Implicit (I/O) Messaging – cyclic, multicast UDP datagrams on UDP/2222. Used for deterministic I/O data exchange between scanner and adapter.
Both services share the CIP object model. Omron CJ-series controllers implement the standard CIP objects (Identity 0x01, Message Router 0x02, Assembly 0x04, Connection 0x05, TCP/IP Interface 0xF5, EtherNet/IP Interface 0xF6) plus vendor-specific extensions for direct DM/CIO access. See the Omron EtherNet/IP product category for the current list of CIP-capable products and their corresponding EDS files: Omron EtherNet/IP product catalogue.
2. Hardware Platform Selection
| Controller | Built-in EtherNet/IP | EtherNet/IP Module Option | Typical Use |
|---|---|---|---|
| CJ2M-CPU11/12/13/14/15 | No | CJ1W-ETN21 (compatible backplane) | Serial-only retrofits |
| CJ2M-CPU31/32/33/34/35 | Yes (1 port, 100Base-TX) | Optional second port via ETN21 | Most common new designs |
| CJ2H-CPU64/65/66/67/68 | No | CJ1W-ETN21 | High-speed instruction execution |
| CS1 / CJ1 series | No | CS1W-ETN21 / CJ1W-ETN21 | Legacy platforms |
3. Protocol Stack and Port Allocation
The EtherNet/IP encapsulation header follows ODVA Volume 2. Port allocation for CJ2M EtherNet/IP traffic:
| Port | Protocol | Purpose |
|---|---|---|
| TCP 44818 | ENIP encapsulation | Explicit messaging, register access, UCMM |
| UDP 2222 | CIP implicit I/O | Class 0/1 multicast, heartbeat, I/O datagrams |
| UDP 44818 | ENIP encapsulation | List Identity / List Services (broadcast discovery) |
| TCP 2222 | Reserved | Not used by CIP |
Firewalls and managed switches must permit TCP/44818 between scanner and adapter, and UDP/2222 between scanner and any multicast group the adapter subscribes to (default range 239.192.0.0 – 239.255.255.255 per ODVA recommendation).
4. CIP Connection Types and Omron Memory Access
CJ2M memory areas are exposed through standard CIP services. The most frequently accessed areas:
| Omron Memory | Typical CIP Path | Read Method | Write Method |
|---|---|---|---|
| CIO (Core I/O) | Assembly 0x04 instance 100 (input) / 150 (output) | Get_Attribute_Single on Assembly | Set_Attribute_Single on Assembly |
| DM (Data Memory) | Vendor D-tag object (CJ2M) or Assembly instance | CIP Read Tag service (NJ/NX) or vendor service (CJ2M) | CIP Write Tag service |
| WR (Work) | Same as DM | Vendor CIP service | Vendor CIP service |
| HR (Holding Relay) | Same as DM | Vendor CIP service | Vendor CIP service |
| EM (Extended Memory) | Bank-switched, requires routing path | Read Tag with bank qualifier | Write Tag with bank qualifier |
5. Configuring the CJ2M Built-In EtherNet/IP Port
- Open CX-Programmer (part of CX-One) and connect to the CPU via USB or the existing serial port.
- Select PLC → Ethernet in the IO Table. Double-click the on-board port icon labelled CPU/Built-in Ethernet.
- Set IP Address, Subnet Mask, and Default Gateway. Use a static address; DHCP behaviour on the built-in port is firmware-dependent and not recommended for control traffic.
- Set the FINS Node Address to the last octet of the IP address (e.g., IP 192.168.1.10 → Node 10).
- Open Settings → Option → Built-in Ethernet Port → TCP/IP and enable FINS/TCP if HMI traffic is required in parallel with CIP.
- Under CIP Settings, enable CIP Routing and select the maximum number of CIP connections. The CJ2M-CPU3x supports up to 32 simultaneous CIP connections per firmware revision; consult the CJ2M Built-in Ethernet Operation Manual for the exact limit of your unit.
- Download the configuration. CX-Programmer prompts to apply the new settings live; a power cycle is normally not required for the built-in port.
For ETN21 modules the procedure is identical but launched from IO Table → Special I/O → ETN21 → Edit. The same dialog also configures FINS/UDP and CIP routing through the module.
6. EDS File and Network Configurator Integration
The CJ2M-CPU3x on-board port EDS is bundled with CX-One. If the third-party scanner is on a different vendor tool (Allen-Bradley RSLogix 5000, Beckhoff TwinCAT, or a Linux-based stack), import the EDS manually:
- Download the EDS bundle from the Omron Industrial Automation site – the EtherNet/IP product category page lists all supported CIP products and their EDS files: Omron EtherNet/IP product category.
- Run the EDS Hardware Installation Tool (typically %SystemRoot%\EDS in Windows) and select Register an EDS file.
- Restart the configuration tool and re-scan the network; the CJ2M appears as a vendor-specific CIP adapter with the configured IP.
The same workflow is documented for CJ-series slaves in the official RFID Connection Guide (P626), which describes connection of a V680S RFID reader/writer to a CJ-series controller over EtherNet/IP: CJ-series EtherNet/IP RFID Connection Guide (P626). The CIP commissioning sequence is identical for any third-party EtherNet/IP adapter attached to the same CJ2M.
7. Third-Party Scanner Integration — Raspberry Pi Example
A Linux host such as a Raspberry Pi 4 can act as a CIP scanner using open-source or commercial stacks. Two popular options:
-
pycomm3 – explicit messaging support, very stable on Raspbian. Supports
generic_message()for low-level CIP service construction. - cpppo – full CIP stack including implicit I/O, written in pure Python. Suitable for class 1 connections and deterministic polling.
Minimum scanner-side checklist before any CIP request is issued:
- Assign the Pi a static IP in the same subnet as the CJ2M (e.g., 192.168.1.50/24) and disable any local firewall on port 2222 and 44818.
- Confirm bi-directional UDP/2222 reachability:
nc -u 192.168.1.10 2222 < /dev/nullfrom the Pi should not produce an immediate ICMP unreachable. - Confirm TCP/44818 with
nc -vz 192.168.1.10 44818– the command must return succeeded. - Issue a
List Identityrequest. With pycomm3:LogixDriver('192.168.1.10').discovery()returns all CIP nodes on the segment; with cpppo:cpppo.server.enip.list_identify(host='192.168.1.10').
7.1 Explicit Messaging — Reading DM Area on CJ2M
The CJ2M exposes data memory through a vendor CIP tag object. A read of ten words starting at DM100 is constructed as a CIP request:
from pycomm3 import CIPDriver
driver = CIPDriver('192.168.1.10')
result = driver.generic_message(
service=0x4C, # CIP Read Tag
class_code=0x70, # Omron vendor class
instance=1,
request_data=b'D100\x00', # ASCII tag name, NUL-terminated
route_path=b'', # local CIP path
)
print(result)
Read Tag example above works on firmware revisions that expose the vendor D-tag object (default on CJ2M-CPU3x with CIP Routing enabled). For older firmware, configure an Assembly instance (class 0x04, instance 100) in CX-Programmer and read 30 bytes of payload per cycle instead.7.2 Explicit Messaging — Writing a Single Bit
# Write CIO 100.00 = TRUE on CJ2M
driver.generic_message(
service=0x4D, # CIP Write Tag
class_code=0x70,
instance=1,
request_data=b'W100.00\x00\x01', # tag name + 1-byte value
)
8. Implicit (I/O) Messaging Configuration
For deterministic exchanges the scanner opens a Class 1 connection. CJ2M-CPU3x supports up to 8 I/O connections plus explicit messaging connections (subject to firmware). The configuration is set in the scanner's EDS registration and pushed to the PLC:
- In the scanner tool (CX-One Network Configurator, RSNetWorx, or third-party equivalent), add the CJ2M EDS.
- Create a new Connection: select Exclusive Owner or Input Only depending on data direction.
- Set RPI (Requested Packet Interval) between 1 ms and 3200 ms in 1 ms increments. The CJ2M built-in port supports sub-millisecond RPI on recent firmware revisions; verify the exact minimum in the CJ2M Built-in Ethernet Operation Manual for your CPU revision.
- Configure Output Assembly Instance (default 150) and Input Assembly Instance (default 100). The CJ2M produces data on instance 100 and consumes data from instance 150 by default.
- Set the Trigger to Cyclic for SCADA use or Application for event-driven production.
- Download the configuration to the scanner and observe the connection state in the scanner's diagnostic panel.
9. Diagnostic Workflow
When a connection fails, follow this sequence:
- Physical layer: Verify the link LED on the CJ2M port, swap the patch cable, force port speed/duplex on the managed switch.
-
IP layer:
pingfrom the scanner host. If the ping fails, check VLAN tagging and ACLs. -
TCP/44818:
nc -vz <ip> 44818from the scanner host. -
UDP/2222: From the scanner host:
nc -u <ip> 2222 < /dev/null; "Connection refused" is normal for UDP, "no route to host" indicates a firewall. - List Identity: Run a CIP List Identity request. A successful reply confirms the CJ2M is alive on the CIP layer even if all higher services are misconfigured.
-
Wireshark capture: Filter
enipand inspect encapsulation commands. Look for error codes in the CIP response.
9.1 Common CIP Error Codes
| Hex Code | Symbol | Meaning | Typical Cause |
|---|---|---|---|
| 0x01 | Connection failure | Resource unavailable | Scanner requesting more connections than the PLC supports |
| 0x02 | Resource unavailable | Out of CIP connections | ETN21 capacity exceeded |
| 0x04 | Path segment error | Invalid CIP path | Wrong class/instance or malformed tag name |
| 0x05 | Path destination unknown | Module offline | ETN21 not seated properly or wrong slot |
| 0x08 | Service not supported | Wrong service code | Attempting Read Tag on a CJ2M without tag object support |
| 0x0E | Attribute not settable | Read-only attribute | Trying to write a status register |
| 0x13 | Not enough data | Request too short | Assembly instance mis-sized |
| 0x14 | Attribute not supported | Vendor-specific attribute | Wrong attribute ID in Get_Attribute_Single |
10. Troubleshooting Matrix
| Symptom | Likely Root Cause | Verification | Corrective Action |
|---|---|---|---|
| No List Identity reply | IP mismatch or firewall |
ping + nc test |
Re-address the port; open TCP/UDP 44818 |
| List Identity ok, Read Tag fails | Wrong CIP path | Wireshark decode of CIP path | Verify ASCII tag string and NUL terminator |
| Class 1 connection times out | RPI below port minimum | Scan tool log | Increase RPI; consult operation manual for minimum |
| Connection drops after ~30 s | Multicast TTL exceeded | Switch IGMP snooping | Enable IGMP querier on the access switch |
| Implicit data is one cycle behind | Application trigger not set | EDS connection parameters | Set trigger = Cyclic |
| Read returns all zeros | PLC in PROGRAM mode | CX-Programmer mode indicator | Switch to MONITOR/RUN |
| Write succeeds but value reverts | Forced bit conflict | Memory viewer forced status | Clear force; forced bits override CIP writes |
| Intermittent timeouts | Duplex mismatch | Switch port statistics | Force 100M/Full on both ends |
| High latency on implicit I/O | Non-managed switch flooding multicast | Switch CPU load | Replace with managed switch; enable IGMP snooping |
11. Acromag EtherNet/IP Remote I/O Use Case
When a third-party EtherNet/IP adapter (e.g., Acromag EtherStax or BusWorks modules) is added downstream of the CJ2M, the same CX-One workflow applies. Acromag publishes an application note titled How to Configure Omron PLCs with Ethernet/IP for Use with Remote I/O. The procedure mirrors Sections 5–8 of this article and is a useful cross-reference for CJ2H installations where a remote I/O block replaces a wired expansion rack.
12. Recommended Verification Procedure
After each configuration change, run a five-step verification:
- From the scanner host, issue List Identity and confirm the CIP Vendor ID matches Omron (vendor 0x002F per ODVA registration).
- Read a known DM word (e.g., DM0) via CIP Read Tag and verify the value matches the CX-Programmer memory view.
- Write a known pattern (e.g., DM100 = 0x1234) and read it back. Confirm persistence across a CPU scan cycle.
- If using implicit I/O, force a bit in the input assembly and confirm the scanner sees the change within one RPI cycle.
- Disconnect the Ethernet cable for 10 s, reconnect, and confirm the connection re-establishes automatically with the original RPI.
Passing all five steps confirms correct CIP routing, vendor object configuration, and physical layer integrity. Failures at any step map directly into the troubleshooting matrix in Section 10.
FAQ
Does the CJ2M-CPU31 support EtherNet/IP out of the box?
Yes. The CJ2M-CPU31/32/33/34/35 has a built-in 100Base-TX EtherNet/IP port. Configure it via CX-Programmer under IO Table → CPU/Built-in Ethernet. The CJ2M-CPU11/12/13/14/15 variants require an external CJ1W-ETN21 module.
Which TCP and UDP ports must be open for EtherNet/IP?
Open TCP 44818 for explicit (request/reply) messaging and UDP 2222 for implicit I/O multicast. Some discovery functions also use UDP 44818 for List Identity broadcasts.
Can a Raspberry Pi act as an EtherNet/IP scanner against a CJ2M?
Yes. Use pycomm3 for explicit-only messaging, or cpppo for a full CIP stack including implicit I/O. Confirm reachability of TCP 44818 and UDP 2222 with nc before attempting tag reads or class 1 connections.
Why does my CIP Read Tag request return error 0x04 (Path Segment Error)?
The CIP path is malformed. For Omron vendor tag reads the path is typically class 0x70, instance 1, attribute 1, with the ASCII tag name (e.g., "D100") as request data. Verify NUL termination and length fields using a Wireshark capture filtered on enip.
What is the minimum RPI the CJ2M built-in port supports?
The CJ2M-CPU3x built-in port supports RPI down to roughly 1 ms on older firmware and sub-millisecond RPI on recent revisions; verify the exact minimum in the CJ2M Built-in Ethernet Operation Manual for your CPU revision. For cross-vendor interoperability, 5 ms is a safe lower bound.