WinCC Omron PLC Communication: Ethernet/IP, Host Link, OPC Setup

Overview

Siemens WinCC supports Omron PLCs through three distinct communication paths, each tied to a specific WinCC edition and Omron controller family. The choice depends on the WinCC version deployed (WinCC v7.x, WinCC Professional in TIA Portal, or WinCC Unified), the Omron CPU in service (CS1, CJ1, CJ2, NJ, NX, or compact CP-series), and the physical network available (Ethernet/IP, RS-232/RS-422, or routed through an OPC server). No single WinCC edition ships a universal Omron driver, so engineers must match the protocol stack to the runtime target before commissioning.

Modern installations should target Ethernet/IP on WinCC Unified V17 or later, where the native driver enumerates CJ1, CJ2, CS1, NX, and NJ series without additional middleware. Legacy systems with serial infrastructure rely on Host Link (C-mode) for CJ1/CJ2/CS1 or OPC DA/UA through KEPServerEX, Matrikon OPC, or the Omron SYSMAC Gateway when no native channel is licensed.

Supported WinCC Editions and Omron Series Matrix

Communication Protocol Options

Ethernet/IP (CIP over TCP/UDP)

Ethernet/IP is the preferred path for new deployments. CIP services ride on TCP port 44818 (explicit messaging) and UDP port 2222 (implicit/I/O). Omron implements CIP for the CJ2 CPU unit option (CJ2M-CPU3x with Ethernet/IP unit CJ1W-EIP21, or built-in port on CJ2H/CJ2M), NJ/NX series, and CS1 with the CS1W-EIP21 module. The connection is configured in WinCC Unified as a standard Ethernet/IP channel, with tag references resolved through CIP class/instance/attribute triples (e.g., Input Assembly 0x64 / Output Assembly 0x96 on the NJ/NX).

Host Link (C-mode serial)

Host Link uses a master-slave character protocol on RS-232C or RS-422A at default 9600 bps, 7 data bits, even parity, 2 stop bits. Each frame begins with @, includes a 2-digit unit number (00–31), a 2-letter command (RD, WR, RH, WH, MD, etc.), and ends with a 2-character FCS checksum plus *CR. WinCC Professional in TIA Portal V15.1 supports Host Link as a documented channel; refer to the SIMATIC WinCC Engineering V15.1 – Communication manual for the channel DDL and registered tag syntax.

OPC DA / OPC UA Bridging

When the WinCC edition lacks a native Omron driver, route the data through an OPC server. KEPServerEX V6 (Kepware/PTC) ships an Omron FINS driver that exposes Channel.Device.Group.Tag hierarchies to any OPC DA client. The SYSMAC Gateway service (installed with CX-Integrator or the SYSMAC Studio) acts as an OPC server over FINS/UDP on port 9600, and modern versions also expose OPC UA on port 4840. WinCC v7.5+ connects to these servers through the OPC channel or OPC UA channel respectively.

Prerequisites

• Omron PLC: CJ1M/CJ1H, CJ2M/CJ2H, CS1G/CS1H, NJ501-xxxx, NX102-xxxx, NX1P2-xxxx, or CP1L/CP1H. The Ethernet/IP path requires a CPU with built-in Ethernet/IP (e.g., CJ2M-CPU35) or an CJ1W-EIP21 / CS1W-EIP21 unit.
• Omron firmware: NJ/NX controllers should run Sysmac Studio project version 1.30 or later; CJ2 series should be unit version 1.5 or later for full Ethernet/IP tag support.
• WinCC license: WinCC Unified V21 with the "Omron Ethernet/IP" channel license (RT/ES bundle 6AV2170-....); WinCC Professional V15.1 with RT 2048 tags minimum; WinCC v7.5 with the "OPC" channel option (no separate channel license required when used with KEPServerEX).
• Network: Managed Ethernet switch, static IP addresses, and the Omron CPU and engineering PC on the same subnet (or routed through a firewall that allows UDP 2222, TCP 44818, TCP 9600, and UDP 9600 as needed).
• Engineering software: TIA Portal V15.1+ for WinCC Professional, WinCC Unified Configuration Tool V21 for the Unified runtime, CX-Programmer / CX-Integrator / SYSMAC Studio for the Omron side, and optionally KEPServerEX V6.4+ for OPC bridging.

Step-by-Step: Configuring WinCC Unified Ethernet/IP with an Omron PLC

The Ethernet/IP integration is the simplest and most maintainable option. The procedure below references the official WinCC Unified V21 Omron Ethernet/IP configuration guide.

1. Open TIA Portal with the WinCC Unified Configuration Tool and load the HMI project.
2. In the project tree, expand Devices & Networks and right-click Connections → Add new connection. Select the Omron Ethernet/IP driver from the channel list.
3. Assign a connection name (e.g., PLC_NJ501_ShopFloor) and set the Omron CPU's IP address (e.g., 192.168.250.10). Confirm port 44818 is reachable with ping and telnet 192.168.250.10 44818.
4. From the dropdown, choose the CPU family: CJ1/CJ2/CS1 or NJ/NX. For NJ/NX, register an Ethernet/IP tag set in SYSMAC Studio first (e.g., Assembly 100 at 100 hex with 32 input words, Assembly 150 at 150 hex with 32 output words) and confirm the connection type is Tag Data Link.
5. Map the HMI tags to the assembly offsets. Example mapping:

   WinCC Tag	Direction	Omron Variable	Address (CIP)
   HMI_StartButton	Read	E00_Start	Input Assembly 100, Word 0, Bit 0
   HMI_RunStatus	Write	E00_Run	Output Assembly 150, Word 0, Bit 0
   HMI_RecipeValue	Read	RecipeData[0]	Input Assembly 100, Word 1 (INT)

6. Compile the project and download the HMI configuration to the Unified Runtime PC.
7. Start the runtime and verify the connection status in the WinCC Unified diagnostics view. A green Connected indicator confirms the CIP connection is open.

For the canonical procedure, follow the official Configuring a connection via Omron Ethernet/IP – WinCC Unified V21 guide.

Step-by-Step: WinCC Professional (TIA Portal) Host Link Connection

1. Wire the Omron CPU serial port (CJ1W-SCU21-V1 or built-in RS-232C on CP1L) to the engineering PC. Use a shielded cable, terminate at the PLC connector per Omron diagram (SD-RD, RD-SD crossed, SG-SG straight, RS-CS jumpered on the PLC side if no flow control is required).
2. In CX-Programmer, set the CPU serial port to Host Link mode and assign a unit number (default 00). Match the baud rate on the cable to the WinCC channel: 9600 / 7-E-2 is the safe default.
3. In TIA Portal, open the HMI project and add a connection of type OMRON Host Link. Configure the following parameters:
   • Port: COM1 or COM3 of the HMI panel
   • Baud rate: 9600
   • Data bits / Parity / Stop bits: 7 / Even / 2
   • Unit number: 00
   • Transmission delay: 50 ms
4. Create HMI tags using the Omron address format. WinCC expects the area prefix in uppercase. Examples:

   Omron Memory Area	WinCC Address Syntax	Sample Tag	Data Type
   Data Memory	DM	DM100	INT
   DM (BCD word)	DM	DM200.0	BOOL (bit access)
   CIO	IO	IO0.00	BOOL
   Holding Relay	HR	HR10	WORD
   Auxiliary Relay	AR	AR5.07	BOOL
   Timer PV	TN	TN0	INT
   Counter PV	CN	CN1	INT

5. Compile, download to the HMI panel, and run the runtime. Use the WinCC channel diagnostics to confirm frames are exchanged; a Communication error 0x7001 typically indicates an FCS or unit-number mismatch.

Step-by-Step: OPC Channel with KEPServerEX

1. Install KEPServerEX V6.4 or later on a Windows host that has IP connectivity to the Omron CPU. The KEPServerEX Omron driver speaks FINS over UDP/TCP.
2. Create a new Channel in the KEPServerEX configuration. Select the Omron FINS Ethernet driver. Set the PLC IP address (192.168.250.10), the FINS node number (often the last octet, e.g., 10), and the PC node number (250).
3. Add a Device for the CPU and choose the model (CJ2M, NJ501, NX102, etc.). KEPServerEX will scan the memory areas; if auto-discovery fails, manually add tags using the Omron address format (D100, W0.00, H0, CIO100).
4. Validate the channel with the built-in OPC Quick Client. Tag values must update at the configured scan rate (default 100 ms).
5. In WinCC v7.5 (or WinCC Unified), add an OPC DA or OPC UA channel. Point it at opcda://localhost/KEPServerEX or opc.tcp://localhost:49320. Browse the KEPServerEX namespace and import the tags.
6. Set the OPC update rate to a value higher than the KEPServerEX scan rate (e.g., 250 ms) to avoid buffering issues.

Tag Addressing Reference

Performance, Limits, and Tuning

• Ethernet/IP: RPI (Requested Packet Interval) of 10–50 ms on NJ/NX, 50–100 ms on CJ2 with CJ1W-EIP21. WinCC Unified cycle time should be set to 1/3 of the RPI for stability. A single Ethernet/IP connection supports up to 32 connections per CJ2W-EIP21; NJ501 supports 32 I/O connections plus 16 explicit connections.
• Host Link: One Host Link master can poll up to 124 words per RD/WR command, but the practical limit is 32 words to stay within the 1-second timeout at 9600 bps. Scan rates below 200 ms per tag are not reliable over serial.
• OPC: KEPServerEX default scan rate is 100 ms; lowering it below 50 ms on a CJ1/CJ1M with serial FINS will saturate the CPU's serial port. Use FINS/UDP (port 9600) for sub-50 ms cycles.

Troubleshooting Matrix

Verification and Commissioning Checks

1. Connectivity: From the HMI runtime PC, run ping 192.168.250.10 and telnet 192.168.250.10 44818. The telnet session should remain open (no immediate close) for Ethernet/IP.
2. Channel status: In WinCC, open the channel diagnostics and confirm the state is Connected and the byte counter increments over time.
3. Tag round-trip: Create a test HMI tag, force a value in the PLC (e.g., set D100 = 1234 in CX-Programmer), and verify the value appears in the HMI within one cycle. Reverse the direction to confirm a write path.
4. Sustained load: Run the runtime for at least one shift, monitor latency and error counters, and validate that no values are stuck at the last good state.
5. Failover: Disconnect the Ethernet cable for 10 seconds and reconnect; confirm the channel re-establishes automatically without restarting the HMI.

Decision Guide: Which Path to Choose