EtherNet/IP

About 21 min read

The EtherNet/IP protocol lets 2WinScada communicate with PLCs, drives, remote I/O and similar devices that use CIP (Common Industrial Protocol). 2WinScada supports two communication paths:

• Explicit messaging: Reading and writing with a request/response model over TCP port 44818. Identity, parameter, diagnostics and tag access use this path.
• Implicit / cyclic I/O: A separate I/O connection is opened with the device, and Input/Output Assembly data is transferred continuously over UDP port 2222 at a set period (RPI).

Main supported features:

• Generic CIP: access to the CIP objects (class / instance / attribute) and Assembly data given in the manufacturer's documentation
• Rockwell / Allen-Bradley Logix (ControlLogix, CompactLogix): symbolic tag read/write, array elements, atomic members inside UDTs
• Omron NX/NJ: symbolic read/write of network variables published for external access
• Discovering EtherNet/IP devices on the network and testing the connection
• Browsing tags on Rockwell Logix controllers and bulk import
• Reading and writing a single bit inside an integer as Bool
• Pulse and Rising edge command behaviors for Bool tags

Safety

Before trying write operations on production equipment, verify the manufacturer's documentation, process safety, user permission and the operating state of the device. Even if 2WinScada makes access possible, not every CIP object or tag is writable. CIP Safety, CIP Motion and CIP Security are not supported; do not use EtherNet/IP communication in place of a safety function.

License

EtherNet/IP is available in the Standard and Professional license editions; it is not available in the Starter edition. If the license does not include EtherNet/IP, saved EtherNet/IP definitions are not deleted, but creating, updating and duplicating definitions, connection tests and runtime communication are blocked. For license details, see the License page.

Device profiles

The Device profile field in the device definition determines how addresses are interpreted and how data is encoded.

Device profile	Use	Supported address types
Generic CIP	Any EtherNet/IP device whose CIP object map is given in the manufacturer's documentation (drive, remote I/O, valve terminal, robot controller, gateway, etc.)	CIP Object, Assembly
Rockwell Logix	ControlLogix and CompactLogix (1769/5069) controllers	Symbolic, CIP Object, Assembly
Omron NX/NJ	NX/NJ CPUs with network variables published for external access over EtherNet/IP in Sysmac Studio	Symbolic, CIP Object, Assembly

TIP

The Rockwell Micro800, MicroLogix, SLC and PLC-5 families are not supported with the Rockwell Logix profile. For the Generic CIP profile, take the service, class, instance, attribute or Assembly information and the data types from the device manufacturer's documentation; there is no single universal Assembly number.

Channel Definition

A channel holds EtherNet/IP devices that share the same timeout and concurrency settings. On the General tab of the new channel window, enter the channel name and select EtherNetIp as the Connection Type. The default values are a safe starting point; change them after measuring the network delay on site.

Connection Parameters tab:

Field	Description	Default	Range
Connect timeout (ms)	Time to wait for the TCP connection and session registration	5000	100–120000
Read timeout (ms)	Time to wait for a read response	3000	100–120000
Write timeout (ms)	Time to wait for a write response	3000	100–120000
Default polling interval (ms)	Default read interval for tags	1000	50–3600000

Advanced Parameters tab:

Field	Description	Default	Range
Reconnect delay (ms)	Wait before the first reconnection attempt after the connection is lost	1000	100–300000
Retry count	Limits how many steps the reconnection wait time can grow	5	0–100
Maximum concurrent requests	Number of requests the channel can send at the same time	4	1–32

TIP

Retry count does not stop reconnection attempts; it only limits how much the wait time increases. The wait time grows up to at most 300 seconds, and attempts continue until the device connects.

Device Definition

A device record represents a physical or simulated EtherNet/IP endpoint. On the General tab, the device name and Active are set as for other protocols.

Parameters tab:

Field	Description	Rule
Host / IP address	IPv4/IPv6 address or DNS name of the device	Required; at most 253 characters
Port	EtherNet/IP TCP port	Default 44818; 1–65535
Device profile	Generic CIP, Rockwell Logix or Omron NX/NJ	Required; determines the address and data encoding behavior
CIP route path	Port/link value pairs for routing through a chassis or bridge	Optional; see the description below

The CIP route path consists of comma-separated port/link value pairs. Values can be written in decimal (1,0) or in hexadecimal with a 0x prefix (0x01,0x00). The number of values must be even; at most 32 pairs can be entered. It is usually left empty when connecting directly to a CPU or to a Generic CIP device. In a ControlLogix chassis, 1,0, 1,1 and 1,2 are used for the CPU in slot 0, 1 and 2 through backplane port 1. Verify the actual path for the site topology against the manufacturer's documentation.

Settings tab:

• Enable Implicit / Cyclic I/O: Opens the cyclic I/O connection. When selected, the cyclic I/O fields appear (see Implicit / cyclic I/O).
• Use native Logix bit writes when supported: Appears only with the Rockwell Logix profile and is on by default. When writing to bits of Logix symbolic integers, it uses the atomic mask operation in the controller; unrelated bits are preserved on the controller side. If the controller reports that it does not support this service, 2WinScada reads the value again and switches to a sequential read-modify-write method. After a timeout or another error, the write is not repeated. To always use read-modify-write, clear the option; this method does not protect against other systems writing to the same value at the same time.

The Advanced Parameters tab contains the expected identity information for the Generic CIP profile. These fields are optional (0–65535):

• Expected vendor ID
• Expected device type
• Expected product code

If cyclic I/O is enabled, the same tab also contains the advanced cyclic I/O settings.

Device discovery

The Discover devices button in the device window lists the EtherNet/IP devices on the network:

1. Select an active IPv4 network interface of the 2WinScada server from the Network interface list.
2. Set the listening time (250–10000 ms, default 2000 ms) and click Start discovery. 2WinScada broadcasts a single identity query to the subnet of the selected interface and lists the responses. You can stop the operation with Cancel discovery.
3. The list shows Source IP address, Product, Vendor ID, Product code, Revision, Serial number and Suggested profile. Rockwell Logix is suggested for devices with vendor ID 1, Omron NX/NJ for vendor ID 47, and Generic CIP for the others.
4. If needed, choose a different profile in the Device profile (manual override) field and click Use selected device.

The address and profile of the selected device are copied to the device form; the device is not written to the database until the form is saved. Invalid responses are ignored without hiding valid devices, and their number is reported.

Connection test

The Test connection button validates the entered settings, connects to the device, opens an EtherNet/IP session and reads the device's identity information. If cyclic I/O is enabled, it also opens the I/O connection and closes it immediately to validate the Assembly, RPI and port settings; this test sends no output data.

1. Enter the channel and device settings.
2. Click Test connection and wait for the result.
3. Compare the returned identity information (product, vendor ID, product code, revision, serial number) with the device label or project.
4. Only then enable the device and allow write operations.

When the test fails, only a general error message appears on the screen; the technical details are in the service log. A successful connection test does not validate the address or data type of every tag.

Implicit / cyclic I/O

In cyclic I/O, 2WinScada is the side that opens the connection (Originator), and the field device has the Adapter role. The Input Assembly is transferred from the device to 2WinScada (T→O), and the Output Assembly from 2WinScada to the device (O→T). The fields appear step by step: first select Enable Implicit / Cyclic I/O; the output fields appear only if Enable cyclic outputs (O→T) is also selected.

WARNING

Cyclic I/O can be used only when the CIP route path is empty, that is, when the adapter is directly reachable. Output Assembly data can directly control physical equipment. Before enabling cyclic outputs, verify the manufacturer's Assembly definition, the safe state (failsafe) behavior, the Run/Idle requirement and every mapped output bit.

Fields on the Settings tab:

Field	Default / range	Description
Input Assembly instance (T→O)	1–4294967295	Assembly number of the input data produced by the device
Input Assembly size (bytes)	1–32768	Size of the application data only
Input RPI (ms)	100; 10–60000	Period at which the device sends input data
Input connection type	Point-to-point	Point-to-point or Multicast
Enable cyclic outputs (O→T)	Off	Separate safety switch for output traffic
Output Assembly instance (O→T)	1–4294967295	Assembly number of the output data consumed by the device
Output Assembly size (bytes)	1–32768	Size of the application data only
Output RPI (ms)	100; 10–60000	Period at which 2WinScada sends output data
Output connection type	Point-to-point	Point-to-point or Multicast
Configuration Assembly instance (optional)	Empty	Configuration Assembly number expected by the device
Configuration data (hex, optional)	Empty; at most 488 bytes	Two-digit hexadecimal values; e.g. 01 02 or 01-02

Fields on the Advanced Parameters tab:

Field	Default / range	Description
Input uses Run/Idle header	Off	Whether the input data is preceded by a 4-byte header
Output uses Run/Idle header	Off	Whether a 4-byte Run/Idle header is added in front of the output data (visible only when cyclic outputs are enabled)
Local IPv4 interface (optional)	Empty = automatic	Local IPv4 address used for UDP communication
Local UDP port (0 = automatic)	0; 0–65535	In a multicast scenario, must match the port the device expects
Adapter UDP port	2222; 1–65535	I/O port of the device
Connection timeout multiplier	4	4, 8, 16, 32, 64, 128, 256 or 512; the connection timeout is calculated as RPI × multiplier
Large ForwardOpen mode	Auto	Auto, Standard ForwardOpen only or LargeForwardOpen required
Originator vendor ID	0; 0–65535	Entered if there is a registered originator identity
Originator serial number (0 = automatic)	0	Entered if there is a registered originator serial number

Match the Run/Idle options for input and output separately with the device's EDS file or manual; a wrong choice causes packet size validation to fail. When Large ForwardOpen mode is Auto and the connection size exceeds 511 bytes, the large connection request is used automatically; when Standard ForwardOpen only is selected, connection sizes greater than 511 bytes are not accepted.

Cyclic I/O behavior:

• If input data stops, only the quality of tags mapped to the input Assembly becomes Bad and the connection is reopened. If explicit messaging is healthy, it keeps working.
• Cyclic outputs start with output data filled with zeros; areas not mapped to a tag stay zero.
• The quality of a command tag mapped only to the Output Assembly may stay uncertain (Uncertain) until separate feedback comes from the device. Writing to an output does not confirm that the device applied the command; for confirmation, use a separate feedback tag mapped to the Input Assembly.
• RPI accuracy depends on the operating system and network conditions; no hard real-time control guarantee is given.

Tag Definition

Tags are defined in the device's tag table in the same way as for other protocols (see Tag Management). On EtherNet/IP devices, the Address cell opens an editor that shows the parts of the address as separate fields. The editor builds the address to be saved from these fields; in the table the address appears as single-line text starting with eip:v1; (e.g. eip:v1;mode=symbolic;address=MotorSpeed;count=1).

The Address mode list has these options depending on the device profile:

• Symbolic: Access by tag/variable name on the Rockwell Logix and Omron NX/NJ profiles
• CIP Object: Access by class / instance / attribute
• Assembly: Access to a byte or bit range inside the Assembly data

The Symbolic address mode cannot be used with the Generic CIP profile.

Symbolic addresses

Field	Description
Symbol / tag address	Tag or variable name in the controller; at most 200 printable ASCII characters
Element count	Number of elements to read from an array; 1–4096
Bit index (optional)	Rockwell Logix only: bit inside an integer tag
Source data type	Type of the integer when a bit is selected: SINT, INT, DINT or LINT

Rockwell Logix examples:

Address	Example type	Meaning
MotorSpeed	Real	Controller-scoped tag
Temperatures[3]	Real	Array element
Program:MainProgram.Motor01.Speed	Real	Program-scoped tag / atomic member of a UDT
OperatorMessage	String	Standard Logix STRING, at most 82 ASCII characters

For Rockwell Logix:

• Controller tags, program tags in the form Program:<ProgramName>.<Tag>, array indexes with up to 3 dimensions (e.g. Matrix[1,2]) and atomic members inside UDTs are supported.
• A whole UDT is not decoded automatically; address the atomic member.
• Data types that can be used with symbolic addresses: Automatic, Bool, Sbyte, Int, DInt, Real, LInt and String.
• In the controller project, verify that the External Access setting of the tag allows the operation.

For Omron NX/NJ:

• In Sysmac Studio, verify that the variable is published over EtherNet/IP (Network Publish) and check its type.
• The address is a single variable name; structure members are not decoded automatically. Atomic types and CIP STRING are supported.
• Request and response sizes are limited to 492/496 bytes; large arrays are not transferred in fragments.

The Automatic data type can be used only with Rockwell Logix and Omron NX/NJ symbolic addresses, and the tag must be marked Read Only.

CIP object addresses

Field	Description
Class (hex)	CIP class number, e.g. 0x64
Instance	Instance number (1 or greater)
Attribute (optional)	Attribute number (1 or greater)
Bit index (optional)	Bit inside an integer attribute

When the Technical details check box in the address editor is selected, these fields also appear:

• Service (hex): Default 0x0E (Get Attribute Single). On write, 0x0E is automatically changed to the 0x10 (Set Attribute Single) service. 0x01 (Get Attributes All) is read-only and takes no attribute number. Other services in the 0x01–0x7F range are validated and used unchanged; they require the manufacturer's service definition.
• Source data type: Type of the integer when a bit index is entered (see Bit access).

Example: for a temperature value, Class (hex) 0x64, Instance 1, Attribute 1, Data Type Real. On ABB FENA adapters, drive parameters are read with class 0x90: Instance is the parameter group and Attribute is the parameter index (e.g. Instance 99, Attribute 1 for 99.01). This is explicit parameter access; it does not mean cyclic I/O.

Assembly addresses

Field	Description	Range
Instance	Assembly number	1–4294967295
Byte offset	Byte where the data starts	0 or greater
Bit offset (optional)	Bit inside the selected byte; Bool tags only	0–7
Byte length	Byte range to read	1–32768

When cyclic I/O is off, Assembly addresses are read with explicit messaging. When cyclic I/O is on:

• Tags mapped to the Input Assembly instance number are updated from the incoming input data and must be Read Only.
• Tags mapped to the Output Assembly instance number build the output data; they must be writable and their bit/byte ranges must not overlap.
• Each tag must stay within the defined Assembly size. Other Assembly numbers can still be used for explicit access.

Example input mapping (8-byte Input Assembly):

Position	Tag	Data Type	Access
Byte offset 0, Bit offset 0	Running	Bool	Read Only
Byte offset 0, Bit offset 1	Fault	Bool	Read Only
Byte offset 2, Byte length 2	Speed	Int	Read Only
Byte offset 4, Byte length 4	Counter	DInt	Read Only

Bit access

A single bit of an integer value can be read and written as a Bool tag. When a bit is selected, the tag's Data Type is automatically set to Bool.

• CIP Object: The service must be 0x0E. The Source data type can be SINT, USINT, INT, UINT, DINT, UDINT, LINT, ULINT or LWORD; the valid bit range is 0–7, 0–15, 0–31 or 0–63 depending on the source width. If no source type is selected, UINT (16 bits) is assumed.
• Symbolic (Rockwell Logix only): The source can be SINT, INT, DINT or LINT; Element count must be 1.
• Assembly: Bit offset is between 0 and 7.

When writing a bit, 2WinScada reads the current integer value from the device, changes only the target bit and writes the value back, preserving the other bits. On Rockwell Logix, if Use native Logix bit writes when supported is on, this is done atomically on the controller side. In other cases, the read-modify-write method does not fully protect against the PLC program or another system changing the same value at the same time.

CIP object bit tags that use the same integer source (the same address mode, service, class, instance, attribute and source type) are updated with a single read from the device. The shortest Update Interval determines how often the source is read; slower tags are updated when their own interval expires.

Tag fields

Field	EtherNet/IP rule
Data Type	Must match the actual CIP type on the device (see Data types)
Length	Character capacity for String tags (1–8192); number of array elements for other types (1–4096)
Update Interval[s]	0.05–3600 seconds
Read Only	If selected, 2WinScada does not write to this tag
Command behavior	Normal write, Pulse (0 → 1 → 0) or Rising edge (0 → 1)
Pulse duration (ms)	Only when Pulse is selected; 50–60000 ms, default 500 ms

The Read Only setting limits writing only on the 2WinScada side. A read-only attribute or tag on the device cannot be written even if it is left writable in 2WinScada. During initial commissioning, define tags as read-only and enable writing only after controlled verification.

Data types

CIP type	2WinScada Data Type	Size	Note
BOOL	Bool	1 byte	All profiles
SINT	Sbyte	1 byte	All profiles
USINT	Byte	1 byte	Omron / Generic CIP; Byte and a length for byte arrays
INT	Int	2 bytes	All profiles
UINT	Word	2 bytes	Omron / Generic CIP
DINT	DInt	4 bytes	All profiles
UDINT	DWord	4 bytes	Omron / Generic CIP
LINT	LInt	8 bytes	All profiles
ULINT	ULInt / LWord	8 bytes	Omron / Generic CIP
REAL	Real	4 bytes	All profiles
LREAL	LReal	8 bytes	Omron / Generic CIP
STRING	String	Variable	Rockwell standard STRING at most 82 ASCII characters; Omron CIP STRING
Type read from the device	Automatic	—	Rockwell / Omron symbolic read only

TIP

The configured type must match the actual data representation on the device. For Rockwell Logix symbolic addresses, the Byte, Word, DWord, ULInt, LWord and LReal types do not appear in the list.

Command behavior (Pulse / Rising edge)

The tag table of EtherNet/IP devices has Command behavior and Pulse duration (ms) columns. Command behavior can be used only on writable, single (non-array) Bool tags and with explicit messaging. Tags mapped to cyclic I/O Assemblies, advanced tags, arrays and CIP services other than 0x0E do not accept this behavior.

• Pulse (0 → 1 → 0): A true request writes false and then true to the target; after waiting for the Pulse duration, it writes false. The duration is measured after the true write is confirmed. While a pulse is running, new true requests are ignored and the duration is not extended.
• Rising edge (0 → 1): Writes false, then true, and leaves the target active. If you need an automatic reset, choose Pulse.
• A false request cancels an active pulse or resets the target.

Only users who have the Operate or Editor role and see the tag within their process group scope can send Pulse and Rising edge commands (see Tag Write Scope).

WARNING

On stop, deactivation, license loss, reload and communication errors, 2WinScada tries to reset the target; however, a reset cannot be guaranteed when the connection is lost. Network delay can lengthen the pulse duration. This feature is not a safety function or a precisely timed PLC output; precise timing must be done in the PLC program.

Rockwell tag browsing

In the tag table of a saved Rockwell Logix device, the Browse tags button lists the tags in the controller and imports the selected ones in bulk:

1. Click Browse tags. If needed, enter text in the Search address or data type field and choose All scopes, Controller or Program as the Scope; then click Browse.
2. Review the Symbolic address, Data type, Dimensions, Structure / UDT, Importable and Availability note columns in the list. Structure/UDT roots and unknown types appear in the list but cannot be imported.
3. Select the rows to import and choose the conflict policy: Cancel whole import on conflict, Skip conflicting tags or Rename name conflicts. Renaming only resolves name conflicts; an existing address is not added a second time.
4. Click Import selected tags. The selected tags are validated and saved in one go; no log or alarm definition is created automatically.

The Omron NX/NJ and Generic CIP profiles have no automatic tag browsing; define the tags manually according to the manufacturer's documentation.

Read, write and connection behavior

• Tag values are updated only when the value read changes.
• On a timeout, when the device is offline or on a network outage, the quality of the affected tags becomes Bad; the last values are not deleted.
• 2WinScada keeps trying to reconnect until the device connects; the wait time increases with each attempt and reaches at most 300 seconds.
• An address or configuration error specific to a single tag does not interrupt a healthy device session.
• When the same error repeats, the first error is written to the service log in detail; repeats are summarized every five minutes. If no new error appears in the log, it does not mean that the attempts have stopped.

Out of scope

• Automatic tag browsing for Omron NX/NJ and Generic CIP
• Automatic decoding of whole UDTs
• Produced/Consumed tags
• CIP Safety, CIP Motion and CIP Security
• Cyclic I/O connections routed through a CIP route path
• Automatic configuration of every EtherNet/IP device

Reusable tag templates for EtherNet/IP devices and creating profiles from EDS files are described on the Device Profiles page.

Troubleshooting

Symptom	Checks
The connection cannot be established	Check the Host / IP address, TCP port 44818, VLAN/routing, the firewall, that EtherNet/IP is enabled on the device and the Connect timeout (ms) value.
A Generic CIP tag is not read	Compare the service, class, instance, attribute and data type with the manufacturer's object manual; start with service 0x0E.
A Rockwell symbolic tag is not read	Check the spelling of the tag name, the controller/program scope, the External Access setting, the CIP route path value and the data type.
An Omron symbolic tag is not read	Check the variable's Network Publish setting, that the name is a single variable name, the supported atomic type and the message size.
Tag quality is Bad	Look for timeouts or network errors in the service log; allow time for reconnection.
Write fails	Check the Read Only setting, the user's permission, that the tag is writable on the device, the service/type match and the operating state of the device.
An array or string is truncated or rejected	Check Element count, Length, the Rockwell 82-character limit and the Omron 492/496-byte limit.
Rockwell tag browsing stops or returns an error	Check the device profile, the CIP route path value and access to the controller.
The cyclic I/O connection is rejected	Check the input/output/configuration Assembly numbers, the byte sizes, the RPI range, the connection type and the device's concurrent connection limit.
Assembly size does not match	Enter the data size given by the manufacturer. In 2WinScada the size is the application data only; the Run/Idle header is selected separately.
No input data arrives, quality is Bad	Check the firewall/VLAN path for UDP 2222, the Local IPv4 interface (optional) selection and the Adapter UDP port value.
Cyclic output does not work	Check the Enable cyclic outputs (O→T) setting, the output Assembly number and size, and that the output tags are writable and do not overlap.
Multicast does not work	Select the correct network interface; check IGMP and the switch settings. If needed, verify with Point-to-point first.
The RPI is not accepted	Choose a value in the 10–60000 ms range and within the limits the device supports.