Configuring CJ1M Serial Communications: Hostlink, FINS, Modbus

Overview: CJ1M Serial Communication Architecture

The Omron CJ1M series PLC exposes three primary serial-protocol paths for external device integration: Host Link (C-mode), FINS, and Modbus (RTU/ASCII). Each protocol targets a different system topology, addressing model, and integration effort. Selection depends on whether the upstream system is an Omron-native HMI/SCADA, a generic SCADA package, or a custom PC application writing to a virtual COM port.

Per the official CJ1M CPU Units specification page, the CJ1M-CPU11/12/13/21/22/23 family integrates a peripheral RS-232C port on the CPU module for Host Link or FINS traffic. Modbus RTU/ASCII requires an additional CJ1W-SCU Serial Communications Unit on the backplane — the CPU’s built-in peripheral port does not implement Modbus framing. The CJ1M also supports up to 20 I/O units total — 10 on the CPU rack and 10 on a single CJ1W-IC101 expansion rack.

The CJ1M-CPU2x datasheet confirms the CPU2x variant integrates high-speed I/O (two 100 kHz pulse outputs and high-speed counters) without altering serial port capability. CPU1x and CPU2x variants share identical RS-232C behavior on the peripheral port.

Protocol Comparison: Host Link vs FINS vs Modbus

Hardware Requirements and Cable Specifications

The CJ1M CPU peripheral port is a 9-pin D-sub male RS-232C connector located on the front face of the CPU module. For a direct PC connection, a crossover (null-modem) cable is required. For long runs or noise-prone environments, an RS-422A/485 link through a CJ1W-SCU31/SCU41 module is preferred.

For multi-drop Host Link or FINS networks, RS-422A/485 via a CJ1W-SCU31 or SCU41 unit provides multi-drop capability with up to 32 nodes per port, addressing each CPU by its unit number (00–31).

Host Link (C-mode) Technical Details

Host Link frames use ASCII characters. The frame structure is:

@<HH><NN><BB><payload><FCS>*<CR>

Where:

• @ — Start character
• HH — Header (two ASCII hex characters; identifies message destination on multi-drop networks)
• NN — Node number (00–31 in ASCII hex; 00 = broadcast for commands that allow it)
• BB — Command code (e.g., RR, WR, RD, WD, SC)
• payload — Command-specific parameters (area code, address, word count, data)
• FCS — Frame Check Sequence (two ASCII hex chars; XOR of all preceding bytes after @)
• *<CR> — Terminator

The FCS algorithm is an 8-bit XOR of every byte between (and including) @ up to the last byte before FCS. The result is converted to two ASCII hex characters, with the most significant nibble transmitted first.

Common Host Link Commands for CJ1M

Operational Gate: MONITOR Mode Required for Writes

To query the current CPU mode, issue:

@00SC02<FCS>*<CR>  -- Request status (returns RUN / MONITOR / PROGRAM + error flags)
@00SC03<FCS>*<CR>  -- Switch to MONITOR mode
@00SC04<FCS>*<CR>  -- Switch to RUN mode (ladder executes; Host Link writes still blocked)
@00SC05<FCS>*<CR>  -- Switch to PROGRAM mode (stops ladder execution)

FINS Protocol Technical Details

FINS (Factory Interface Network Service) is Omron's unified network messaging protocol. The Omron W342 Communication Commands Reference Manual documents FINS message transport over Host Link, SYSMAC NET, SYSMAC LINK, and Ethernet (FINS/UDP, FINS/TCP). When carried over the CJ1M peripheral RS-232C port, FINS frames are wrapped inside a Host Link envelope, with the FINS command embedded as the Host Link payload.

A FINS command frame structure (after the Host Link envelope is stripped):

FINS header (10 bytes):
  ICF (1)  - Information Control Field (response required, etc.)
  RSV (1)  - Reserved (always 0x00)
  GCT (1)  - Permissible number of gateways (0x02 typical)
  DNA (1)  - Destination network address
  DA1 (1)  - Destination node number
  DA2 (1)  - Destination unit address (0x00 for CPU)
  SNA (1)  - Source network address
  SA1 (1)  - Source node number
  SA2 (1)  - Source unit address
  SID (1)  - Service ID (transaction ID, 0x00–0xFF)

Command code (2 bytes) - e.g., 0x0101 = memory area read, 0x0102 = memory area write
Parameters - command-specific

Key FINS Commands for CJ1M

FINS Memory Area Codes

FINS over Host Link Advantages

• Larger data payload per transaction reduces serial overhead.
• Uniform memory area addressing via FINS area codes (above).
• Service ID byte enables multiplexing multiple masters on the same network without collision.
• Identical command set across Ethernet (FINS/UDP, FINS/TCP) and serial — the same PC code base works on both transports.
• Cleaner error reporting through FINS response codes (0x00 = success, 0x10–0x1F = format errors, 0x20–0x2F = command-specific errors).

Modbus Protocol Implementation on CJ1M

The CJ1M base unit does not implement Modbus on the peripheral serial port. Modbus RTU or ASCII integration requires:

• CJ1W-SCU21 — RS-232C, 2 ports
• CJ1W-SCU31 — RS-422A/485, 2 ports
• CJ1W-SCU41 — RS-232C + RS-422A/485 combination

Modbus-RTU Configuration Using CX-Protocol

1. Add the SCU module to the I/O table in CX-Programmer (slot 01+).
2. Open CX-Protocol; create a new protocol macro project for the SCU port.
3. Define Modbus RTU master sequences. For a read of 10 holding registers starting at address 0: 01 03 00 00 00 0A C5 CD (slave ID, FC03, start, count, CRC-16).
4. Allocate DM words for the receive buffer (e.g., D0200–D0299 for register values).
5. Use the SCU's RXDU (receive complete) and TXDU flags in ladder logic to trigger processing.

Modbus Function Code Mapping on CJ1M

Memory Area Mapping Reference

CX-One Configuration Procedure

To configure the CJ1M peripheral port for Host Link or FINS over Host Link:

1. Connect the PC to the CJ1M peripheral port using the null-modem cable.
2. Launch CX-Programmer; establish an online connection (auto-detect on first run; default baud is 9600 with auto-baud negotiation).
3. Open the PLC menu → Edit → I/O Table to verify the rack layout and confirm the CPU module.
4. Double-click the Peripheral Port icon in the I/O table (slot 00).
5. In the Peripheral Port Settings dialog:
   • Custom: Enable
   • Mode: Host Link
   • Baud: 9600, 19200, 38400, 57600, or 115200
   • Data bits: 7 (Host Link standard) or 8 (FINS extended)
   • Stop bits: 2
   • Parity: Even
   • Unit number: 00 (default for single-node)
6. Click Transfer → To PLC to download the new parameters.
7. Cycle power to the CPU (recommended — not strictly required on CJ1M but eliminates residual auto-baud state).

For FINS over Host Link, the same peripheral port configuration applies. The difference is on the PC side: the application wraps FINS commands inside Host Link envelopes. CX-Programmer and CX-Server runtime translate internal FINS calls automatically.

SCADA Integration Patterns

Open-source SCADA packages (OpenSCADA, ScadaBR, FUXA, Node-RED with Modbus nodes) typically support Modbus natively. For a CJ1M-only system without an SCU module, three practical paths exist:

Path A — Direct Modbus via SCU (Recommended for Open-Source SCADA)

Add a CJ1W-SCU21 to the rack, configure Modbus RTU master or slave sequences using CX-Protocol, and connect to the SCADA's Modbus driver. Mirror logic in the ladder program keeps DM synchronized with CIO, WR, and HR for full SCADA visibility.

Path B — Host Link with Serial-to-IP Converter + Custom Driver

Use a serial-to-IP converter (e.g., Moxa NPort) on the CJ1M peripheral port and create a virtual COM port on the SCADA PC. The SCADA must implement Host Link framing manually, or use an Omron-specific driver (limited in open-source ecosystems). Real-world performance is constrained by the per-packet write limit (~30 words) and the MONITOR-mode requirement.

Path C — FINS/UDP via ETN Module

For Ethernet-connected SCADA, a CJ1W-ETN21 module allows FINS/UDP messaging. The same FINS command set works across Ethernet and serial, so PC-side code is portable without rewriting for the transport layer.

Ladder Logic Mirror Example (CIO → DM)

-- Ladder snippet to mirror CIO 0.00–0.15 to D00100
-- Run on every scan; low overhead.

LD   P_On
MOV  CIO0   D100    -- Copy first CIO word (16 bits) to DM D00100

-- To make these bits Modbus-readable, the SCADA polls
-- FC03 against address 100 (mapping to D00100). Each DM
-- bit address maps as: holding_register = 4 * (DM_offset + 1) + (bit_offset / 16)

Troubleshooting Matrix

Verification Checklist

• Peripheral port LEDs (RD/SD) blink during active transactions.
• CX-Programmer online connection succeeds at the configured baud rate.
• A test Host Link RR 00 00 01 returns the expected CIO word (e.g., input status of slot 0).
• A test WR command succeeds only in MONITOR mode and fails in PROGRAM mode (confirming the safety gate).
• For Modbus: a 01 03 00 00 00 01 request returns the expected D00000 value with valid CRC-16.
• For FINS: command 01 01 reads the configured DM range and returns ICF=0x40 in the response.
• Watchdog / cycle time in CX-Programmer's Task Monitor shows no abnormal increase after SCADA polling begins.
• No CPU ERR/ALM LED activity over a 10-minute SCADA polling soak test.

Reference Documentation

The definitive reference for Host Link, FINS, and SCU protocol macros is the Omron W342 Communication Commands Reference Manual. Verify against the latest edition available through the official Omron Industrial Automation portal. Cross-reference CJ1M hardware and I/O limits using the official CJ1M CPU Units specification page and the CJ1M-CPU2x datasheet.

FAQ