CIP Message Communication (UCMM)

Notes

The explanations and samples here are based on the user's manual for the "NJ/NX-series CPU Unit Built-in EtherNet/IP Port" (SBCD-377?) and on analysis of messages actually exchanged by CX-Compolet
They include content not described in the EtherNet/IP user's manual, and some parts of the messages are unclear, so treat this as a way to get a feel for the CIP message communication protocol
The application downloadable here can read and write variables, but use it only for testing

For production CIP message communication, use CX-Compolet
OMRON CX-Compolet
CX-Compolet explanation page

Overview

A PC can read and write memory values by sending CIP (Common Industrial Protocol) commands via Ethernet to devices such as PLCs on the network
Here, PLC memory values are read using UCMM, one of the two kinds of CIP message communication, CLASS3 and UCMM
CIP message communication has Connected Messaging (Class 3) and Unconnected Messaging (UCMM). This page explains how to access PLC variables using UCMM.

The steps for reading variable values with the following configuration are explained here
Configuration diagram for CIP UCMM communication from a PC to an OMRON NJ/NX PLC

UCMM message flow

	After connecting via TCP/IP
	Send the ListService command to prepare to start the IP connection (command code in parentheses)
	Next, send the RegisterSession command to get a handle (Session Handle) This handle is used in subsequent SendRRData
	Set a variable read or write command in the Service of SendRRData and send it
	Send UnRegisterSession to finish

TCP connection
ListService
RegisterSession
SendRRData
UnRegisterSession

Message format

Basic format
Name		Byte count
Encapsulation Header
	Command	2
	Length	2
	SessionHandle	4
	Status	4
	Sender	8
	Options	4
Command Specific Data
	Command	Variable length

Set ListService, RegisterSession, SendRRData or UnRegisterSession in the Command of the encapsulation header and send

NOTE
Data is set in little endian

Send/receive data for each command

ListService

Send data
Name		Byte count	Data
Encapsulation Header
	Command	2	0x0004 (ListService)
	Length	2	0
	SessionHandle	4	0x00000000
	Status	4	0x00000000
	Sender Context	8	0x0000000000000000
	Options	4	0x00000000

Command Specific Data is not needed

Example of received data
Name			Byte count	Data
Encapsulation Header
	Command		2	0x0004
	Length		2	26
	SessionHandle		4	0x00000000
	Status		4	0x00000000
	Sender Context		8	0x0000000000000000
	Options		4	0x00000000
Command Specific Data
	Item Count		2	1
	Item1	Type ID	2	0x0100 = List Service Response
		length	2	20
		Capability Flags	2	0x0120 5bit=Support CIP Encapsulation 8bit=Supports CIP Class 0 or 1
		Name of Service	16	"Communications",0x0000

RegisterSession

Send data
Name		Byte count	Data
Encapsulation Header
	Command	2	0x0065 (RegisterSession)
	Length	2	4
	SessionHandle	4	0x00000000
	Status	4	0x00000000
	Sender Context	8	0x0000000000000000
	Options	4	0x0000000000
Command Specific Data
	Protocol Version	2	1
	Option Flags	2	0x0000

Example of received data
Name		Byte count	Data
Encapsulation Header
	Command	2	0x0065
	Length	2	4
	SessionHandle	4	0x0001016d Contains the handle
	Status	4	0x00000000
	Sender Context	8	0x0000000000000000
	Options	4	0x0000000000
Command Specific Data
	Protocol Version	2	1
	Option Flags	2	0x0000

SendRRData

Send data
Name			Byte count	Data
Encapsulation Header
	Command		2	0x006f (SendRRData)
	Length		2	30
	SessionHandle		4	0x0001016d
	Status		4	0x00000000
	Sender Context		8	0x0100000000000000
	Options		4	0x0000000000
Command Specific Data
	Interface Handle		4	0x00000000
	Timeout		2	0x0000
	Item Count		2	2
	Item1	Type ID	2	0x0000 (Null Address Item)
	Item1	length	2	0
	Item2	Type ID	2	0x00b2 (Unconnected Data Item)
	Item2	length	2	14
Common Industrial Protocol
	Service Code		1	0x4c
	Request Path Length		1	5 (word)
	Request Path		10	0x9107+"testInt"+0x00 (padded with 0 for an odd number of bytes)
CIP Class Generic
	Request Service Data		2	0x0100

Example of received data
Name			Byte count	Data
Encapsulation Header
	Command		2	0x006f (SendRRData)
	Length		2	24
	SessionHandle		4	0x0001016d
	Status		4	0x00000000
	Sender Context		8	0x0100000000000000
	Options		4	0x0000000000
Command Specific Data
	Interface Handle		4	0x00000000
	Timeout		2	0
	Item Count		2	2
	Item1	Type ID	2	0x0000 (Null Address Item)
	Item1	length	2	0
	Item2	Type ID	2	0x00b2 (Unconnected Data Item)
	Item2	length	2	8
Common Industrial Protocol
	Service		1	0xcc (MSB ON + 0x4c)
	(Fixed)		1	0x00
	Status	General Status	1	0x00
	Status	Additional Status	1	0x00
CIP Class Generic
	Response Service Data
		Data Type	1	0xc3
		AddInfoLength	1	0x00
		Data	2	0x3412

UnregisterSession

Send data
Name		Byte count	Data
Encapsulation Header
	Command	2	0x0066 (UnregisterSession)
	Length	2	0
	SessionHandle	4	0x0001016d Set the handle to disconnect
	Status	4	0x00000000
	Sender Context	8	0x0000000000000000
	Options	4	0x0000000000

Command Specific Data is not needed

There is no received data

FAQ

What is UCMM?

UCMM (Unconnected Messaging) is unconnected CIP message communication used in EtherNet/IP. Unlike Connected Messaging (Class 3), which establishes a connection in advance, it sends messages only when needed to access PLC variables.

What is the basic procedure for CIP message communication?

After the TCP connection, send messages in the order ListService, RegisterSession, SendRRData, UnRegisterSession. The Session Handle obtained with RegisterSession is used in SendRRData.

What does SendRRData do?

SendRRData is the command that sends the actual CIP service in UCMM communication. It carries CIP commands such as Read Tag Service and Write Tag Service to the PLC.

What is a Session Handle?

The Session Handle is an identifier obtained in the response to RegisterSession. It is used in subsequent SendRRData and UnRegisterSession to identify the communication session.

Applications

TCP and UDP communication test tool

ComCom

An application that sends messages you create using Ethernet socket communication

CIP communication analysis tool

CipMes

An application that sends CIP messages using Ethernet socket communication

If you found this site helpful, your support would be greatly appreciated