日本語
English
Variable Access with CIP Explicit Messages
Variable read/write services
CIP explicit messaging is the message communication method used in EtherNet/IP.
On OMRON NJ/NX series controllers, PLC variables can be accessed with Read Tag Service (0x4C) and Write Tag Service (0x4D).
This page explains the request and response formats.
Read Tag Service (0x4C)
| Name | Byte count | Data | ||
|---|---|---|---|---|
| Common Industrial Protocol | ||||
| Service Code | 1 | 0x4c | ||
| Request Path | ||||
| Length | 1 | 5 (word) | ||
| ANSI Extended Symbol Segment | 10 | 0x9107+"testInt"+0x00 (padded with 0 for an odd number of bytes) | ||
| CIP Class Generic | ||||
| Request Service Data | ||||
| Num of Element | 2 | 0x0100 (number of array elements) | ||
| Name | Byte count | Data | ||
|---|---|---|---|---|
| Common Industrial Protocol | ||||
| Service | 1 | 0xcc (MSB ON + 0x4c) | ||
| (Fixed) | 1 | 0x00 (fixed value) | ||
| Status | ||||
| General Status | 1 | 0x00 | ||
| Additional Status | 1 | 0x00 | ||
| CIP Class Generic | ||||
| Responce Service Data | ||||
| Data Type | 1 | 0xc3 | ||
| AddInfoLength | 1 | 0x00 (0x02 for a structure) | ||
| (AddInfo) | (2) | A CRC code is included only for structures | ||
| Data | 2 | 0x3412 (size depends on the variable type) | ||
Write Tag Service (0x4D)
| Name | Byte count | Data | ||
|---|---|---|---|---|
| Common Industrial Protocol | ||||
| Service Code | 1 | 0x4d | ||
| Request Path | ||||
| Length | 1 | 5 (word) | ||
| ANSI Extended Symbol Segment |
10 | 0x9107+"testInt"+0x00 (padded with 0 for an odd number of bytes) |
||
| CIP Class Generic | ||||
| Request Service Data | ||||
| Data Type | 1 | 0xc3 | ||
| AddInfo Length | 1 | 0x00 (0x02 for a structure) | ||
| (AddInfo) | (2) | CRC value for structures only | ||
| Num of Element | 2 | 0x0100 | ||
| Write Data | 2 | 0x3412 (change the size according to the variable type) |
||
Response
| Name | Byte count | Data | ||
|---|---|---|---|---|
| Common Industrial Protocol | ||||
| Service | 1 | 0xcd (MSB ON + 0x4d) | ||
| Fixed | 1 | 0x00 (fixed value) | ||
| Status | ||||
| General Status | 1 | 0x00 | ||
| Additional Status | 1 | 0x00 | ||
Request Path
The Request Path is the field that specifies the name of the variable to access.
On OMRON NJ/NX, the tag name is specified with an ANSI Extended Symbol Segment (0x91).
If the variable name has an odd number of bytes, 0x00 is appended to align to an even byte boundary.
| Name | Data | Description |
|---|---|---|
| Segment Type | 0x91 (0b10010001) |
Data Segment (0b100) + ANSI Ectended Symbol Sengment (0b10001) |
| Segment Sub Type | ||
| Length | 7 | Number of bytes in the variable name |
| Variable name | "testInt" | Encoding is UTF-8 |
| (pad) | (0x00) | Add 0x00 if the variable name has an odd number of bytes |
CIP object services
How to specify CIP objects
CIP objects for the NJ/NX built-in EtherNet/IP port
Request path
Status meanings
| General Status | Description | Additional Status | Description |
|---|---|---|---|
| 0x00 | SUCCESS | Normal end | |
| 0x02 | RESOURCE_UNAVAILABLE | The internal processing buffer is currently unavailable | |
| 0x04 | PATH_SEGMENT_ERROR | The Request Path specification is incorrect | |
| 0x05 | PATH_DESTINATION_UNKNOWN | The variable destination is specified incorrectly | |
| 0x0c | OBJECT_STATE_CONFLICT | 0x8010 | Downloading or starting up |
| 0x8011 | Tag memory error | ||
| 0x11 | REPLY_DATA_TOO_LARGE | The response exceeds the maximum response length | |
| 0x13 | NOT_ENOUGH_DATA | The data length for the specified service is insufficient | |
| 0x15 | TOO_MUCH_DATA | The data length for the specified service is too large | |
| 0x1F | VENDOR_SPECIFIC_ERROR | 0x0102 0x2104 | The read target is a variable I/O that cannot be read |
| 0x0104 0x1103 | An address or size beyond the segment area was specified | ||
| 0x8001 | Internal error | ||
| 0x8007 | A variable that cannot be accessed was specified | ||
| 0x8029 | An area that cannot be accessed in bulk with SimpleDataSegment was specified | ||
| 0x8031 | Internal error (memory allocation error) | ||
| 0x20 | INVALID_PARAMETER | 0x8009 | Segment type error |
| 0x800F | Inconsistent data length information in the request data | ||
| 0x8017 | More than one element requested for single data | ||
| 0x8018 | Zero elements, or data beyond the range, requested for array data | ||
| 0x8021 | A value other than 0 or 2 was specified in the AddInfo area | ||
| 0x8022 | The Data Type of the Request Service Data does not match the type of the TAG information The AddInfo Length of the Request Service Data is not 0 | ||
| 0x8023 | Internal error (invalid command format) | ||
| 0x8024 | Internal error (invalid command length) | ||
| 0x8025 | Internal error (invalid parameter) | ||
| 0x8027 | Internal error (parameter error) | ||
| 0x8028 | A value outside the range was written to a variable with a subrange specification An undefined value was written to an Enum variable |
Data type meanings
Data Type represents the data type of the variable.
By looking at the Data Type returned in the response, you can determine the type of the variable on the PLC.
| DataType | VariableType | Size |
|---|---|---|
| 0xc1 | BOOL | Bit |
| 0xc2 | SINT | 1byte |
| 0xc3 | INT | 2byte |
| 0xc4 | DINT | 4byte |
| 0xc5 | LINT | 8byte |
| 0xc6 | USINT | 1byte |
| 0xc7 | UINT | 2byte |
| 0xc8 | UDINT | 4byte |
| 0xc9 | ULINT | 8byte |
| 0xca | REAL | 4byte |
| 0xcb | LREAL | 8byte |
| 0xd0 | STRING | |
| 0xd1 | BYTE | 1byte |
| 0xd2 | WORD | 2byte |
| 0xd3 | DWORD | 4byte |
| 0xd4 | LWORD | 8byte |
| 0xdb | TIME | 8byte |
| 0xa0 | Abbreviated STRUCT | |
| 0xa2 | STRUCT | |
| 0xa3 | ARRAY |