Sending Email from an Omron CJ2H-CPU64-EIP via the CJ1W-ETN21 Ethernet Module

The CJ2H-CPU64-EIP is a high-performance CPU in the Omron CJ2 platform with a built-in EtherNet/IP port, 50 kSteps program capacity, and 32 Kwords of data memory. The EIP suffix designates the integrated Ethernet interface, but that port is limited to EtherNet/IP and FINS/TCP communications, peer-to-peer messaging, and socket service. It does not include an SMTP/POP3 mail client. To dispatch email directly from the controller you must add a dedicated Ethernet unit — the CJ1W-ETN21 — to the CJ2H backplane and use its built-in mail send function.

This article walks through the hardware selection, CX-Programmer configuration, ladder logic, NS-series HMI integration, and the audit-trail workflow required to alert management when a parameter such as a press force tolerance is changed by an operator holding an RFID badge.

1. Why the CJ2H-CPU64-EIP Cannot Send Email by Default

The on-board Ethernet port on the CJ2H-CPU64-EIP is implemented as an EtherNet/IP scanner/adapter with FINS/TCP wrapper. The Omron datasheet for the CJ2H-CPU6@-EIP series documents FINS network communications instructions, host link service, and remote programming, but no SMTP or POP3 client. Email send is a function exclusive to the CJ1W-ETN21 (and the older CJ1W-ETN11), which carries its own TCP/IP stack and an embedded mail engine that can resolve a DNS name, perform an AUTH LOGIN handshake, and push MIME-formatted messages to an SMTP relay.

If a SCADA package (Citect, Wonderware, WinCC, CX-Supervisor) is already present on the same Ethernet segment, the SCADA can take the role of mail client and the PLC only needs to push an event flag. In a no-SCADA architecture — the situation described in the source — the ETN21 is the cleanest path.

2. Hardware Prerequisites

The CJ1W-ETN21 is mounted in any I/O slot of the CPU rack. The CPU is unit 0; the ETN21 is typically unit 1 or 2. A CJ-series I/O allocation rule reserves the last 10 words of the rack for special I/O, so keep ETN21 in slots that do not collide with expansion chassis mapping.

3. CJ1W-ETN21 Email Engine Architecture

The CJ1W-ETN21 maintains an internal mail send queue. The PLC writes a structured message into a designated data area (D area) and issues a single FINS command (code 28 10 — MAIL_SEND) to the unit. The unit's firmware resolves the SMTP server, opens TCP/25 (or 465/587 for TLS-style submission if the destination supports it), transmits the headers and body, and stores a status word the PLC can poll.

The mail body is held as raw ASCII in consecutive DM words. With the default 16-bit word packing, the ASCII string "Press tolerance changed by OP42" occupies 17 words (34 bytes) plus a leading length word. Allocate generously — 500 words gives room for tags, timestamp, badge ID, and old/new value pairs.

4. CX-Programmer Configuration Steps

4.1 I/O Table Setup

1. Open the project in CX-Programmer. Double-click the I/O Table node in the project tree.
2. Right-click the slot where the ETN21 is physically mounted and select Add Unit → Special I/O.
3. Choose CJ1W-ETN21 from the catalog. Confirm the unit number (default 0).
4. Transfer the I/O table to the PLC. The unit should self-test and light the RDY LED green.

4.2 ETN21 IP and Routing

1. Open the ETN21 Setup dialog (double-click the unit).
2. Set a static IPv4 address, subnet mask, and default gateway. Do not leave DHCP enabled in a plant — the mail engine must reach the SMTP relay deterministically.
3. Define the SMTP Server IP, port, and authentication (USER/PASS as plain ASCII or Base64 — the unit encodes it).
4. Set the local mail sender (e.g. [email protected]) and a reply-to address.
5. Write the configuration to the unit using Toolbus → Transfer to Unit.

4.3 Memory Map for Mail

The exact starting DM is user-defined — these values are a workable convention. The structure must match the ETN21 operating manual's "Mail Send Command Area" tables.

5. Ladder Logic: CMND Instruction to Trigger MAIL_SEND

The PLC uses the CMND instruction to issue the FINS mail-send command to the ETN21. The SEND/RECV ladder blocks handle data only; CMND(490) is the path for arbitrary FINS commands.

Control block (C in the example):

D00100 = command word 1 (always 0x0102 for SEND/RECV, 0x0000 for CMND)
D00101 = number of words in command area
D00102 = number of words in response area
D00103 = destination unit address (ETN21 unit number, e.g. 0x0001)
D00104 = FINS command code 0x2810 (MAIL_SEND)
D00105 = subcommand 0x0000

Example rung (structured text equivalent):

// Rising edge of "ParamChangeFlag" builds subject + body, then fires MAIL_SEND
IF ParamChangeFlag = TRUE AND MailBusy = FALSE THEN
    Subject[0..39]  := "PRESS TOL CHANGED  ";   // pad to even length
    BodyLength      := 0;
    ASCII_APPEND(Body, "Operator:  ",  OpNameBuf);
    ASCII_APPEND(Body, "\r\nOld value: ", OldTolSTR);
    ASCII_APPEND(Body, "\r\nNew value: ", NewTolSTR);
    ASCII_APPEND(Body, "\r\nTime:      ", SysTimeSTR);
    TriggerWord     := 1;
    MailBusy        := TRUE;
END_IF;

IF TriggerWord = 1 THEN
    CMND(#0280, C, 6, R, 0, MailStatus, &MailCmdOK);
END_IF;

IF MailStatus = 2 THEN
    TriggerWord := 0;  // clear trigger
    MailBusy    := FALSE;
END_IF;

In ladder, the same flow is built with MOV blocks to copy ASCII strings from the parameter-change buffer into the ETN21 body area, an ADBL/SDBL chain to compute the length, and a single CMND on the rising edge of the change flag.

6. NS10 / NS8 HMI Integration

The NS10-TV01 and NS8-TV01 panels are programmed in CX-Designer. The two HMIs read parameter values over Ethernet (FINS or EtherNet/IP) and display the live press tolerance. When an operator types a new tolerance into a numeric input field and presses Enter, the HMI writes the value back to a holding word in the PLC (e.g. D00300) and sets a confirmation bit W0.05.

To capture the who along with the what, the panel is also tied to the RFID reader. The recommended approach is to expose a "Login" numeric entry on the HMI that the operator fills by tapping the badge; the panel writes the badge ID to a dedicated DM block (D00400..D00409) and sets W0.00 = logged-in. A lookup table in the PLC maps badge ID to operator name for inclusion in the mail body.

The HMIs themselves do not need to send mail. They only need to present a confirmation dialog. The PLC owns the audit event.

7. Capturing the Change Event

Detect the parameter change in the PLC with a one-shot on the change bit:

// One-shot on tolerance change
OldTol := D00300;
// ... operator presses Enter on NS panel ...
IF D00300 <> OldTol AND NewTolValid = TRUE THEN
    ParamChangeFlag  := TRUE;
    OldTolSTR        := REAL_TO_STRING(OldTol, "0.00");
    NewTolSTR        := REAL_TO_STRING(D00300, "0.00");
    OpNameBuf        := LookupName(D00400);   // RFID → ASCII
    SysTimeSTR       := SysTime_To_ASCII;
    OldTol           := D00300;
END_IF;

The flag triggers the mail block, which fires the CMND, and then the flag is cleared on the success status word.

8. SMTP Relay Selection and Authentication

For a corporate environment, point the ETN21 at an internal relay (e.g. smtp.plant.local:25) and let the relay handle TLS, anti-spam, and external delivery. For an isolated cell, an on-network SMTP forwarder such as postfix bound to inet_interfaces = 192.168.10.0/24 is the lightest path. Modern relays requiring AUTH LOGIN work on the ETN21 provided the firmware supports it — confirm against the unit's version label.

Common SMTP error codes that surface in the ETN21 status word:

9. Alternative Architectures

If adding the ETN21 to the rack is undesirable, three workarounds exist:

9.1 SCADA as Mail Client

Install CX-Supervisor, Ignition, or any HMI/SCADA that exposes a "send mail" action bound to a tag. The PLC raises the change bit; the SCADA composes the message and pushes it. This is the most flexible but introduces a Windows box.

9.2 Industrial Gateway with SMTP

A small DIN-rail device (e.g. an Moxa MGate or a Hirschmann RSP) accepts Modbus/TCP or FINS reads from the CJ2H and acts as a mail client. The PLC does not change; the gateway polls for the change bit.

9.3 Cellular SMS / MQTT

If the goal is "alert the right person," SMS via a cellular modem (Sierra Wireless, MultiTech, or a Teltonika TRB) or an MQTT publish to a cloud broker (AWS IoT, Azure IoT Hub) may be a more direct route than email, especially when the recipient is mobile. The CJ1W-ETN21 does not natively support MQTT, so a gateway is again required.

10. Verification Procedure

1. Loopback test: With the PLC offline, manually set D00500 = 1 and watch D00501 transition 0 → 1 → 2 within 3 seconds on a local SMTP relay.
2. Subject/Body inspection: Use a packet capture (Wireshark on the switch mirror port) to confirm the SMTP envelope matches the ASCII buffer.
3. End-to-end test: From the NS10, edit D00300 and confirm the operator's email lands in the manager's inbox with badge ID, old value, and new value.
4. Negative test: Disconnect the SMTP cable. Trigger an event. D00502 should report 0x0402 or 0x0404 within the timeout window and the PLC should record a fault in the audit log rather than silently retrying forever.

11. Troubleshooting Matrix

12. Operational Notes and Best Practice

• One-shot, not level-triggered. The CMND instruction must be edge-fired; leaving the trigger word on will re-send mail on every scan and overwhelm the relay.
• Rate limit. The ETN21 mail queue is small. If the change flag can be set by an HMI on every touch, debounce with a 200 ms timer.
• Audit log mirror. In parallel with the email, append the same event to a circular DM buffer (D05000..D05199) so a forensic record exists even if the network is down.
• Watchdog. If the status word never leaves 0x0001 within 30 s, the PLC should clear the trigger, log a fault, and raise a discrete output to the HMI.
• Crypto posture. Email is not a control signal. Use it for notification only; never wire a return path from the mail body to a control action.

13. Summary

The CJ2H-CPU64-EIP is fully capable on EtherNet/IP, but it cannot send email on its own. Adding a CJ1W-ETN21 to the backplane gives the rack a dedicated SMTP client that the PLC drives with a single CMND instruction. With the ASCII subject and body built in ladder from the HMI-entered tolerance, the RFID-looked-up operator name, and a timestamp, the PLC can deliver a complete audit-grade email on every parameter change without a SCADA in the loop. For installations where a SCADA is acceptable, that path remains the most flexible, but for a standalone cell the ETN21 route is the most direct.