CJ1M SCU41 Modbus RTU Master: PMCR Programming Guide

Overview

The Omron CJ1M series PLC combined with a CJ1W-SCU41 Serial Communication Unit is a common platform for Modbus RTU field integration, particularly when the CJ1M-CPU11/CPU12/CPU13 base unit is paired with RS-485 transducer networks. Because the CPU's built-in RS-232C port interprets every byte through the host link / NT-Link ASCII frame handler, engineers cannot use plain TXD(236) / RXD(235) instructions to push raw Modbus RTU frames directly out of the CPU's peripheral port without configuring the port for Serial Gateway mode or Serial PLC Link sub-mode and then carefully pre-building binary buffers.

The reliable production path is the Protocol Macro mechanism executed by the PMCR(260) instruction on the SCU41. The macro lives in non-volatile memory on the SCU, is downloaded once, and is then triggered from ladder as a black-box function call. The article below documents all three implementation paths (Protocol Macro, CX-Protocol source, and direct RXD/TXD), pinout, CRC16 byte order, master/slave sequence addressing, and the typical commissioning traps including the well-documented CRC byte-order error in third-party documentation.

Hardware Prerequisites

The CJ1M-CPU2@ datasheet confirms the CJ1M family supports 2 × 100 kHz pulse outputs and special-instruction based positioning, while reserving dedicated word allocations for the peripheral port and the optional SCU expansion.

Communication Architecture

The SCU41 occupies a slot on the CJ1M backplane and is allocated a logical port pair (Port 1 / Port 2) plus an I/O refresh word area starting at n = 1500 + (25 × unit_number). For unit number 0 (slot immediately to the right of the CPU), the SCU occupies CIO 1500–1524 and DM 30000–30099 by default.

For Modbus RTU master operation the SCU port must be configured:

• Serial mode: Serial Gateway (default after macro download) or Protocol Macro
• Data length: 8 bits (Modbus RTU is fixed 8N1 or 8E1)
• Parity: None, Even, or Odd — must match the slave (transducers default to None / 2 stop bits (N,8,2) or Even (E,8,1))
• Baud: 9600 / 19200 typical for transducer buses
• Transmission protocol: Protocol Macro (not Host Link, not NT Link, not 1:N)

Three Modbus RTU Implementation Paths

Engineers building a Modbus RTU master on a CJ1M + SCU41 typically choose between three approaches. Each has different tool, license, and engineering-cost tradeoffs.

Path 1 — Protocol Macro with PMCR(260)

The Protocol Macro is a compiled, time-deterministic sequence stored in the SCU's flash. The PLC side simply tells the SCU "run sequence N, with these parameters, store results at this address" via the PMCR(260) instruction.

PMCR operand layout

Standard PMCR call to a protocol macro sequence:

PMCR(260)
  C1  : #0000     ; Control word 1 — unit address (bits 8–15) + port (bits 0–7)
  C2  : #0004     ; Sequence number in HEX — e.g. 04h for "Read Holding Registers" master
  S   : D00200   ; Source word area: first parameter block
  D   : D00300   ; Destination word area: response storage

Operands in detail:

• C1 = unit number in the high byte and port number in the low byte. For SCU41 in slot 0, port 2: C1 = #0102 (unit 01, port 02). For port 1: C1 = #0101.
• C2 = sequence number, entered in hexadecimal. Sequence 0 is reserved ("no operation").
• S = first source word; the macro reads parameter inputs (e.g. slave address, register number, register count) from consecutive words starting here.
• D = first destination word; the macro writes the slave response (and status flags) into consecutive words starting here.

For a 4-channel Modbus master macro (read holding registers function 03 or input registers function 04) the parameter block layout is typically:

Response block at D:

Path 2 — CX-Protocol Source vs Compiled Macro

A common misconception is that the .psw project file can be opened in CX-Programmer. It cannot — .psw is a CX-Protocol project that compiles into a .pmr runtime object. The runtime object, plus the Protocol Macro Transfer Utility (bundled with CX-Protocol) is what allows deployment to the SCU without a CX-Protocol license at the receiving site.

1. Author the macro in CX-Protocol on a licensed engineering PC.
2. Compile to .pmr.
3. Distribute the .pmr plus the Transfer Utility to the field PC.
4. Use the Transfer Utility to download the .pmr to the SCU over the SCU's configuration port (CX-Protocol writes the macro into SCU flash via FINS commands over the CPU's peripheral port).

Path 3 — Direct TXD(236) / RXD(235) on the CPU Serial Port

When CX-Protocol is unavailable, a workable but labour-intensive path is to build the Modbus ADU in the CPU and send it via the built-in RS-232C port (port 1 on CJ1M-CPU1x/CPU2x). The CPU port must be set to Serial Gateway (PLC Setup: Port 1 Serial Mode = Serial Gateway) and the port settings in the TXD(236) instruction must be 8N1 (or 8E1) at the slave's baud rate.

Frame format to read holding registers (function 03) from slave 1, register 0, qty 2:

[01]  [03]  [00 00]  [00 02]  [CRC_LO]  [CRC_HI]
Addr  Func  StartHi/Lo   Qty     16-bit CRC little-endian

Sample ladder extract using TXD(236):

; Build 6-byte Modbus request in DM area
; DM00000 = Slave address   =  #0001
; DM00001 = Function code   =  #0003  (holding registers)
; DM00002 = Start register  =  #0000
; DM00003 = Quantity        =  #0002
; DM00004 = CRC16 (LO/HI)   =  computed and stored as word
;
; TXD(236) sends N words from DM00000 as raw binary (no ASCII conversion)
; because the CPU port is in Serial Gateway mode (not Host Link).
TXD(236)
  C   : #0000   ; control: 0 = RS-232C, no start/end code, 8-bit data
  S   : D00000  ; source start word
  N   : #0006   ; number of words (12 bytes) to send
  C2  : #0000   ; not used for port 1 in serial gateway mode
;  ↑ ladder then issues RXD(235) to receive 9 bytes:
;  [01 03 04 xx xx xx xx CRC_LO CRC_HI]
RXD(235)
  C   : #0000
  D   : D00100  ; destination word area for received bytes
  N   : #0009   ; number of words (18 bytes) to read
  C2  : #0000

The reason naive TXD(236) attempts convert bytes to ASCII is that the CPU port defaults to Host Link mode, where the FINS protocol wraps every byte in STX/ETX and escapes control codes. Switch the port to Serial Gateway in the PLC Setup (peripheral port settings) and the data goes out raw.

CRC16 Byte Order — A Documented Trap

The Modicon Modbus specification defines the CRC16 to be appended low byte first, high byte second (CRC-Lo, CRC-Hi). The byte order is independent of the data byte order inside the PDU.

Modbus RTU frame (request example):
  [Addr][Func][StartHi][StartLo][QtyHi][QtyLo] [CRC_LO] [CRC_HI]
                                                   ^^^^^^^^  appended
                                                   little-endian

Several third-party macro documentation sheets reverse this order, stating "Hi, Lo". A SCU41 macro that appends CRC in the wrong order will pass the Modbus parameter check on the slave (function 03 or 04) and the slave will silently not respond, because the CRC fails and the frame is discarded. To confirm a SCU macro is correct:

1. Capture the bytes the SCU transmits with a Modbus tap or RS-485 line monitor.
2. Compute the CRC16 (poly 0xA001) over all bytes before the trailing two.
3. Compare to the trailing two bytes — the last byte must equal the high byte of the computed CRC.

Standard CRC16 implementation (commonly used in macro parameter step "Send Attribute / Variable"):

CRC = 0xFFFF
for each byte b in {addr, func, data...}:
    CRC = CRC XOR b
    for 8 bits:
        if (CRC AND 0x0001):
            CRC = (CRC SHR 1) XOR 0xA001
        else:
            CRC = CRC SHR 1
append CRC as: [CRC AND 0xFF] , [CRC SHR 8]   ; little-endian

Master vs Slave Sequence Numbers

When both a master macro and a slave macro are loaded on the same SCU, the second operand of PMCR(260) selects which one runs. The sequence number is a single global namespace per SCU — the macro type (master/slave) is encoded into the macro itself, not the sequence number. Convention is to allocate:

• Sequences 0x0100–0x01FF: master transmits then receives (modbus master)
• Sequences 0x0200–0x02FF: slave receives then transmits (modbus slave)

A common compile-time convention is to use the Modbus function code as the low byte of the sequence number, so a master read-holding-registers macro lives at sequence 0x0103 and a slave read-holding-registers at 0x0203. Engineers can therefore tell at a glance which routine is being triggered by reading the hex constant in the second operand of PMCR(260) — and crucially, the SCU will not execute the wrong direction because master sequences expect a request from the CPU and produce a request to the bus, while slave sequences do the opposite.

RS-485 Wiring and SCU41 Pinout

The SCU41 ships with two RS-232C DB-9 ports. For RS-485 transducer buses you need either the CJ1W-SCU31 variant (port 2 is RS-422/485) or an external RS-232C-to-RS-485 converter on the SCU41. Wiring notes:

Implementing Function 04 (Read Input Registers)

Most transducer manufacturers implement function 04 (Read Input Registers), not 03. The Modbus PDU is identical, but the function code byte is 0x04. A working PMCR call for reading 4 input registers from slave 1, starting at register 30001 (1-based — subtract 1 to get 0-based start = 0):

; Parameter block in D00200–
D00200 = #0001   ; Slave address 1
D00201 = #0004   ; Function code 04 (Read Input Registers)
D00202 = #0000   ; Start register 0 (0-based)
D00203 = #0004   ; Quantity = 4 registers
D00204 = #0064   ; Timeout = 100 × 100 ms = 10 s
D00205 = #0003   ; Retries = 3

PMCR(260)
  C1  : #0102          ; SCU unit 01, port 02
  C2  : #0104          ; Sequence 0x0104 (master, function 04)
  S   : D00200
  D   : D00300
;
; After execution D00300 holds status; D00301 = bytes received;
; D00302..D00305 hold the 4 input register values in big-endian (Hi/Lo)

The slave response for function 04 is:

[01] [04] [08] [D0 D1 D2 D3 D4 D5 D6 D7] [CRC_LO] [CRC_HI]
 Addr  Func  ByteCnt      4 × 16-bit data        CRC

Each 16-bit value arrives in big-endian (Modbus byte order); when the SCU writes it to a CJ1M word the macro is responsible for swapping the bytes to the little-endian DM area convention. Check the macro's Receive Attribute / Variable "Swap" flag — it must be set to "Swap each word" for the data to land in DM as the integer the transducer means.

Verification Procedure

1. Connect a Modbus RTU line monitor (or a second SCU31 running a slave emulator macro) on the bus.
2. From CX-Programmer, force PMCR(260) to run with the parameter block above.
3. Confirm on the line monitor: 8-byte request frame with the trailing CRC matching the CRC computed from the first 6 bytes.
4. Confirm on the line monitor: slave response with byte count 08 and 4 register values.
5. In CX-Programmer, observe D00300 = 0 (status OK) and D00302..D00305 populated with the expected values.
6. Run a poll at 1 Hz for 10 minutes; verify zero Port communication error flags in the SCU (AR area bits in the SCU status).

Troubleshooting Matrix

FAQ