Omron FINS

FINS (Factory Interface Network Service) is the message protocol of Omron PLCs. EnvisionSCADA communicates with Omron PLCs as a FINS client over FINS/TCP or FINS/UDP. This covers the CS, CJ and CP series through an Ethernet Unit or a built-in Ethernet port, and the NJ and NX series through the memory they provide for CJ-series Units: the CIO, Work, Holding, DM and EM areas. Each Omron FINS device represents one PLC connection. Variables map PLC words, bits, strings and timer or counter values into the project variable space.

Configure the device first, then add variables to it. A variable is referenced at runtime by its full name, for example Tank1_Level, or PLC1.Tank1_Level when the name is written as {Device}.Tank1_Level on the device PLC1.

The PLC answers FINS on port 9600 unless the port is changed in the unit settings. Which transports a controller offers depends on the model:

An NJ or NX controller answers FINS for the memory used for CJ-series Units, so the Auxiliary area and the timers and counters are read from CS, CJ and CP PLCs. A write to an NJ or NX controller requires FINS write protection to be turned off in the controller settings.

Variables address PLC memory in CX-Programmer notation, for example D100, CIO10.05, W20 or E0_100. EnvisionSCADA reads neighbouring addresses together in one request and combines scattered values into one multiple memory area read, which keeps the number of requests per scan low.

The Omron FINS entry is marked BETA in the configuration menu while the driver is released for evaluation.

Device Settings

Each Omron FINS device represents one PLC connection. Configure the connection endpoint, the transport, the FINS node addresses, the timing and the block scanning options.

Create a new device with the Add button in the toolbar. The Add device dialog contains all device settings organized in the sections General, Connection, FINS Node Addresses, Scanning, and Diagnostics, with default values already filled in. Enter at least the Name and IP Address and press Create. The defaults connect over FINS/TCP to port 9600 with automatic node addresses, which suits a PLC on the local network.

The device row shows Enable, Name, IP Address, Port, Transport, Scan Rate, Timeout, Template, Description, Simulation, Status and Quality, and these values can be edited in place. The other settings are available as table columns, which are shown with Columns as described in the Configuration Tables article. Press the Settings icon on a device row to open the Edit device dialog, which contains the same sections and all settings of the device. Press Save to apply the changes.

Device Advanced Settings

The following settings are available in the Connection, FINS Node Addresses, Scanning, and Diagnostics sections of the device dialog. The defaults work for a PLC on the local FINS network. A node address of 0 is automatic, as described per setting.

FINS/TCP and FINS/UDP

With FINS/TCP, EnvisionSCADA opens a TCP connection and exchanges FINS node addresses with the PLC before the first request. With Source Node 0 the PLC allocates the node address of EnvisionSCADA from its automatic range, 239 to 254 on an Ethernet Unit, so each connection receives its own node address and a reconnect is accepted at once. An Ethernet Unit serves up to 16 FINS/TCP connections; when all of them are in use, the PLC refuses the connection and the System Log shows the error reported by the PLC.

With FINS/UDP every request is one datagram. EnvisionSCADA sends an unanswered request again up to the Retries setting and ignores a late answer to an earlier request. The PLC sends its response according to the address conversion method of the Ethernet Unit: with automatic generation (dynamic) it answers the address and port the request came from, so Local Port 0 works; with automatic generation (static), the IP address table method or the combined method it answers port 9600, so set Local Port to 9600.

In a redundant installation, only the primary server communicates with the PLC. The standby server opens no connection and sends no requests, and it takes over the devices when it becomes primary. With FINS/TCP and Source Node 0 the new primary receives its own node address, so the takeover does not wait for the connection of the former primary to expire in the PLC.

Variable Settings

Variables are added per device. Each variable maps one PLC address to the project variable space.

Create a new variable with the Add button in the toolbar. The Add variable dialog organizes all variable settings in the tabs General, Scaling, Historian, and Gateway, with default values already filled in. Enter at least the Name and Address on the General tab and press Create. When the variable is created on a template device, it is also created on all instance devices that use the template. On a template device, start the Name with the {Device} replacer, so that each instance device gets its own variable. The Name must resolve to a different variable on each device; this is checked for every instance device before anything is saved, when a variable is created and when it is renamed.

The variable row shows Enable, Name, Asset, Type, Address, and Description directly and these values can be edited in place. Press the Settings icon on a variable row to open the Edit variable dialog, which contains the same tabs and all settings of the variable. Press Save to apply the changes. Changes made on a template device are also applied to the matching variable on all instance devices, while each instance keeps its own Modbus Address value. The Gateway tab settings Modbus Address, OPC UA, Writeable, MQTT Publisher, Kafka Device, Kafka Remap Device, and Kafka Remap Variable are also available as table columns, which are shown with Columns as described in the Configuration Tables article.

Addressing

Addresses use the notation of CX-Programmer: an area prefix followed by the word number in decimal. A bit address adds the bit number 00 to 15 after a period, and a STRING adds its length in characters after a colon. The EM bank number is hexadecimal, as in CX-Programmer, so EA_100 is word 100 of EM bank A (10). Upper and lower case are both accepted.

The ranges are the largest any supported PLC offers. A PLC with less memory refuses an address beyond its memory; the variable then shows FormatError while the other variables keep reading, as described in Reading and Faults.

A value of several words must fit in its area: an LREAL at D32766 would run past D32767 and is refused when the variable is saved. A timer or counter is read as BOOL for its completion flag and as INT or UINT for its present value.

Variable Arrays

A variable can expand into an array by setting the Array size field to a value between 2 and 512. The variable itself is the first element and its Name must end in the first index, for example Levels[0]. The remaining elements are created automatically as Levels[1], Levels[2] and so on. Each element advances the Address by the size of the data type: INT and UINT by 1 word, DINT, UDINT and REAL by 2 words and LREAL by 4 words. A BOOL on a bit address advances by one bit and continues in the next word after bit 15, so CIO20.15 is followed by CIO21.00. A timer or counter advances by one. Arrays use the types BOOL, INT, UINT, DINT, UDINT, REAL and LREAL, and the last element must stay inside its memory area.

The element rows are managed by the first element: they follow its settings, appear locked in the variable list, and are edited by editing the first element. Changing the Array size adds or removes elements at the end. Renaming the first element or changing its address renames and re-addresses all elements. Setting Array size back to 0 while elements exist removes the elements.

To turn the elements into ordinary independent variables, use the Ungroup array action on the first element's row in the variable list, or the Configuration API (POST /API/Config/VariableArrays/Ungroup). All rows are kept and only the grouping is removed. This is one-way. The element count badge next to the first element's name folds and unfolds the element rows in the list.

Reading and Faults

EnvisionSCADA plans the reads once when the device starts. Neighbouring addresses of one area are read with MEMORY AREA READ in blocks of up to Max Block Size Allowed words. Small values spread over the memory are combined into one MULTIPLE MEMORY AREA READ of up to 167 values. With Verbose 1 the System Log shows the number of requests per scan and every request. A PLC that answers MULTIPLE MEMORY AREA READ as an unsupported command is read with MEMORY AREA READ from then on, which is logged once.

When the PLC refuses an address, for example an address beyond the memory of the CPU, EnvisionSCADA finds the variable that causes it, sets it to FormatError, logs the end code once and reads it on its own every 60 seconds. The other variables of the device keep reading. When the address reads again, the variable returns to Good and rejoins the regular reads.

When the PLC does not answer, the connection is lost or the PLC reports a communication error, the Channel State of the device becomes Offline, its Channel Quality Bad and every variable ConnectionLost. EnvisionSCADA connects again after Scan Rate and doubles the waiting time after each failed attempt, up to 30 seconds. The cause is logged once per outage; Verbose 1 and 2 log every attempt.

Every response of the PLC also reports whether the CPU Unit has a fatal or a non-fatal error, for example a battery error. EnvisionSCADA logs each change of these flags in the System Log and keeps reading the values.

Writing

A write is sent as MEMORY AREA WRITE and is complete when the PLC confirms it. When the PLC refuses the write, for example because the memory is write protected or the operating mode does not allow it, the value is not written, the variable shows FormatError until the next successful read and the System Log shows the end code. A write through the Runtime API or MCP returns this message instead of OK.

The value must match the type: a number within the range of the type for the numeric types, and true, false, 1 or 0 for a BOOL. A value outside the range, for example 40000 for an INT, or text for a number is not sent. A STRING longer than its length is cut to the length.

The Set, Reset, Toggle and Momentary On actions write to BOOL variables on a bit address. Momentary On writes the bit on, waits 1.5 seconds and writes the bit off. A0 to A447 and timer and counter completion flags are read only.

When the PLC does not answer a write within Timeout, the write is reported as failed. The PLC may have carried it out, which the next read shows.

Notes

A UDT definition maps a variable member onto an Omron FINS device through the Fins group of the member, with a Type and an Address. The Address accepts tokens and expressions, for example D{BaseAddress}, E{Bank}_100 or D{= {Base} + 2 }, so one definition serves PLCs with different memory layouts. An address without tokens is checked when the definition is saved. See the UDT Manager article.

Enable Verbose only during commissioning or diagnostics. Verbose 1 and 2 log every request and increase the log volume significantly.