Configuring Omron CJ1M SCU21 Protocol Macro for V720S RFID Head

James Nishida14 min read
OmronSerial CommunicationTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. System Overview

The V720S RFID system provides ISO/IEC 18000-63 (EPCglobal Gen2) tag read/write capability over a serial interface. When paired with a CJ1M-series PLC equipped with a CJ1W-SCU21(-V1) Serial Communication Unit, the head can be controlled from a ladder program using Omron's Protocol Macro feature. The Protocol Macro engine embedded in the SCU21 offloads all byte-level framing, checksumming, retries, and inter-character/frame timing from the CPU scan, which is essential because the V720S command/response cycle is too tight to be served by raw TXD/RXD instructions at typical CJ1M scan times.

Frame control on the V720S is selectable between several methods; for serial (RS-232C or RS-422/485) attachment to the SCU21, the unit supports an ASCII command set framed as <STX> ... <CR>. The same envelope is used by the related V700-series controllers, so V700 protocol macros are valid reference designs for a V720S implementation.

Engineering note: The V720S is a multi-drop-capable reader. If the host port is configured for RS-422/485, a single SCU21 port can address up to 16 heads with a unique ID. For a 1:1 connection via RS-232C, leave the multi-drop address at the default 00 and the SCU21 in 1:1 mode.

2. Hardware Architecture and Cabling

Component Catalog Number Role
CPU CJ1M-CPU11 / CPU12 / CPU13 / CPU21 / CPU22 / CPU23 Hosts ladder and triggers PMCR
Serial Unit CJ1W-SCU21-V1 (port 1 RS-232C, port 2 RS-232C) or CJ1W-SCU41-V1 (RS-422/485) Runs the Protocol Macro
RFID Head V720S-HMD11-AP (antenna integrated) or V720S-HMD11-APR (separate antenna) 13.56 MHz HF RFID read/write
Tag V720S-D23P (or compatible ISO 18000-3 / Mode 1 tag) Carries EPC / user data
Configuration software CX-Protocol (integrated with CX-One) Builds/loads the PMCR sequence
Ladder editor CX-Programmer Hosts PMCR(260) call

The SCU21 plugs into a free slot on the CJ1M CPU Rack. Up to 16 SCU units can be mounted per CPU, but only one Protocol Macro is in progress per port at any time. A typical layout places the SCU in slot 0 (immediately to the right of the CPU) for the lowest word allocation: the unit occupies 25 words of CIO and 100 words of DM starting at n = CIO 1500 + 25*unit_no for CIO and D30000 + 100*unit_no for DM.

Wiring (RS-232C, 1:1):

  1. SCU21 port 1 DB9 pin 2 (SD) → V720S RXD.
  2. SCU21 port 1 DB9 pin 3 (RD) → V720S TXD.
  3. SCU21 port 1 DB9 pin 5 (SG) → V720S SG.
  4. SCU21 port 1 DB9 pins 4/6 (RTS/CTS) and 7/8 (RTS-shorted/CTS-shorted) — wire as required by the V720S control line direction set in the head's Host Interface Mode.
  5. Set the SCU21 port 1 DIP switches to RS-232C, no termination; set the V720S host port to RS-232C, 1:1, CR control, no echo via the head's configuration tool or the rotary switches.

For cable runs longer than 15 m, switch to RS-422/485 and use the SCU41 (CJ1W-SCU41-V1) instead of the SCU21, which keeps the Protocol Macro structure identical — only the port setting changes.

3. V720S Communication Frame Format

The V720S host interface uses ASCII command frames terminated by carriage return. The minimum envelope is:

<STX> <Command> [ <Parameter> ] [ , <Data> ] <CR>

Common commands used in a typical read/write macro:

Command ASCII Direction Function
Read ID ID Master → Head Inventory (UID-only, no data read)
Read RD Master → Head Read user data block
Write WR Master → Head Write user data block
Write Verify WV Master → Head Write then verify same block
Copy CP Master → Head Copy between tag blocks
UID Read UR Master → Head Get 8-byte UID
Command Control CC Master → Head Reset / RF on / RF off

An example Read exchange for 16 bytes from address 0x0000 is:

Send: <STX>RD,0000,16<CR>
Recv: <STX>RD,<status>,<ASCII hex 32 chars><CR>

The status field is a 2-character ASCII code; common values are 00 (normal end), 10 (no tag in RF field), 21 (write-protect error), 70 (communications error), and FF (undefined). Always reserve head data for at least 2 status bytes + the maximum payload (e.g., 64 hex characters = 32 bytes).

Framing caveat: The V720S does not echo the transmitted command back. The Protocol Macro Send & Receive step must therefore begin with a dummy discard or rely on a fixed-length receive rather than echo matching.

4. Protocol Macro Concepts

A Protocol Macro is a sequence of steps stored in the SCU's flash memory and called by ladder through PMCR(260). The relevant data model is:

  • Sequence — the highest-level construct, identified by a number 0..999. A sequence is what PMCR invokes.
  • Step — a single transmission, reception, or branch inside a sequence.
  • Message — the byte/character pattern of a step (header, data, terminator).
  • Address/Length — the data field that is filled in at runtime from a DM/EM/CIO source or stored to a destination.
  • Trigger — Rx trigger, count, or timer that decides when the step's Receive finishes.

For the V720S, a single inventory + read cycle is usually one sequence containing 2–3 steps:

  1. Step 1 — Send ID<CR> (or the read command with parameters baked in).
  2. Step 2 — Receive up to 2 + N characters, terminated on <CR>.
  3. Step 3 (optional) — Send RD,0000,16<CR> if Step 1 was an inventory.

By splitting the inventory and the data read into separate sequences, the ladder can decide whether to read user data based on the UID reported in step 2 — important for selective read applications.

5. Building the Protocol Macro in CX-Protocol

5.1 Project Setup

  1. Launch CX-Protocol, choose New Project, and select the SCU type as CJ1W-SCU21-V1 with the slot number assigned on the CJ1M rack.
  2. Set the port communication parameters to match the V720S head: baud 9600/19200/38400 (default 9600), 8 data bits, 1 stop bit, even/odd/none parity (default even), and Flow Control: None when using CR-based framing.
  3. In Port Settings, set the RS-232C Control Line to RS-232C Standard (not RS/CS Hardware Flow). CR framing assumes the V720S will not assert any hardware handshake line other than TX/RX.

5.2 Sequence Definition

For an inventory sequence (sequence number 100):

  1. Add a Send & Receive step.
  2. Send Message: Set Header to 02H (STX). Terminator: 0DH (CR). Command: literal string ID. No data field needed.
  3. Receive Trigger: Terminator 0DH, max length 24 bytes, 100 ms inter-character timer, 1000 ms total response timer.
  4. Receive Storage: Set the receive buffer start word to D00200, length 12. The first two bytes will be the status; the next 16 bytes will be the 8-byte UID as ASCII hex.

For a data read sequence (sequence number 101):

  1. Send Message: STX + literal RD,0000,16 + CR.
  2. Receive Trigger: CR terminator, max 40 bytes (2 status + 32 hex + CR).
  3. Receive Storage: Start D00250, length 20.

For a data write sequence (sequence number 102):

  1. Send Message: STX + literal WR,0000,16, + variable data (16 bytes ASCII hex) + CR.
  2. Set the data field source to D00300, length 16.
  3. Receive Trigger: CR terminator, length 6 (2 status + CR).
  4. Receive Storage: D00400, length 3.
Worked-example tip: When using the V700 macro as a template, the terminator on the V700 is also <CR>, and the V700 also uses STX at the start. The commands differ (V700 uses RS/WS for read/write), so swap the command strings but keep the envelope.

6. Ladder Logic with PMCR(260)

The PMCR(260) instruction has the form:

PMCR(260)
  C1 : #const unit_no  (e.g., 0 for slot 0, &0 DM-passed value)
  C2 : #const sequence_no  (100, 101, 102 ...)
  S   : first source word (e.g., D00010 for run-time parameters)
  N   : number of words to pass to the macro (0..1000)
  D   : first result word (e.g., D00050 for run-time results)

A typical trigger rung:

  |--[ Read_Trigger ]--[ !Port1_Busy CIO 1900.00 ]--( PMCR(260) )--|
  |                                                       C1:0      |
  |                                                       C2:#100    |
  |                                                       S:D00010   |
  |                                                       N:0        |
  |                                                       D:D00050   |

Replace CIO 1900.00 with the port-1 busy bit of the actual SCU slot: for slot n, the port-1 busy bit is CIO 1900 + 10*n . 00. The complete flag for the same port (rising edge detection) is CIO 1900 + 10*n . 03.

To chain inventory → conditional read, capture the status bytes from D00200..D00201 immediately after the first PMCR completes:

  |--[ PMCR100_Done ]--[ &D00201 = #0010 (ASCII "10" = no tag) ]--( Error_Latch )--|
  |--[ PMCR100_Done ]--[ &D00201 = #0030 (ASCII "30" = OK) ]--( PMCR(260) )--|
  |                                                             C1:0            |
  |                                                             C2:#101          |
  |                                                             S:D00010         |
  |                                                             N:0              |
  |                                                             D:D00050         |

Status character codes are ASCII, so use constants #0010 for the two-character ASCII code '1','0' (decimal 49 and 48), or use CMP(020) against the literal BCD/hex form. A robust implementation checks for both 00 (normal) and any non-zero value before deciding to read data.

7. Commissioning and Verification

  1. Loopback test first. Before attaching the V720S, connect SCU21 port 1 to a PC running a serial terminal. Use CX-Protocol's Sequence Trace to step through the sequence manually and confirm the transmitted bytes match <STX>ID<CR> exactly. A common bug is the SCU outputting 16-bit raw numbers instead of ASCII — the Data Type in CX-Protocol must be set to ASCII, not Numeric.
  2. Check the head's address switches. The V720S rotary ID switch must be set to 00 for 1:1 connection; otherwise the head discards the frame as a multi-drop mismatch.
  3. Verify response time. The head's first response arrives within 50–150 ms under normal RF conditions. If the SCU's response timer in CX-Protocol is set below 50 ms, occasional timeout fault 03 (response time-over) will be raised. Set the timer to 1000 ms for development and reduce once the system is stable.
  4. Confirm error code path. When PMCR finishes with the error flag CIO 1900 + 10*n . 04 = 1, the error code is in CIO 1900 + 10*n . 05 (8-bit) and the detailed code in CIO 1900 + 10*n . 06 (16-bit). Always read both for diagnostics. The most common error at commissioning is error 0205H (sequence number undefined) — usually because the macro was not yet transferred to the SCU's flash. Use Transfer to Unit in CX-Protocol, not Transfer to PLC.
  5. Field test with a known tag. Place a V720S-D23P tag in the head's RF field, then run the inventory sequence from the ladder. The UID in D00200 should be stable across multiple reads.

8. Diagnostic Reference — Error and Status Codes

Symptom Likely Cause Verification / Fix
PMCR error flag set, error code 0205H Sequence number not downloaded to SCU flash Use CX-Protocol Transfer to Unit, cycle power
PMCR completes but no receive data Rx terminator mismatch (CR vs. CRLF) Match SCU terminator to V720S — typically CR (0x0D) only
Status bytes always 0x70 0x30 Head's host port is in command wait state but baud wrong Match baud/parity/stop; verify by sending <STX>CC,0000<CR> from a PC
Receive data is one byte short Trigger Count includes terminator Set Receive Length = max length INCLUDING terminator
Intermittent timeouts under load Scan-time-jitter overrunning the head's reply window Raise Response Monitor Time in CX-Protocol to 2 s
Tag not detected at full range Antenna tuning shifted (metal in front of head) Re-run V720S RF channel auto-set via the head's configuration tool
Write sequence returns status 0x21 0x30 Tag is in locked state or password-protected Issue a CC unlock command or replace the tag

9. Program Reference: Minimal Inventory + Read Block

The following CX-Programmer-style pseudocode summarises a working control flow for a single SCU21 port. It assumes the macros described in section 5 are loaded into the unit.

RUNG 1  - Request inventory on rising edge of "Start_Read"
   IF Start_Read AND NOT PortBusy
     THEN PMCR(260)  C1:0  C2:#100  S:D00010  N:0  D:D00050
   END_IF

RUNG 2  - When PMCR100 done, check status
   IF PMCR100_Done
     IF D00201 = 16#3030  (* ASCII "00" *)
       THEN Inventory_OK := TRUE
            Tag_UID := D00202 .. D00209  (* 16 hex chars = 8-byte UID *)
     ELSIF D00201 = 16#3130  (* ASCII "10" *)
       THEN Inventory_OK := FALSE
            No_Tag := TRUE
     END_IF
   END_IF

RUNG 3  - If tag present, request data read
   IF Inventory_OK AND NOT PortBusy
     THEN PMCR(260)  C1:0  C2:#101  S:D00010  N:0  D:D00050
   END_IF

RUNG 4  - Parse read response
   IF PMCR101_Done
     IF D00251 = 16#3030  (* status 00 *)
       THEN Read_Data_Hex := D00252 .. D00271  (* 32 hex chars = 16 bytes *)
     ELSE Read_Error_Code := D00251 .. D00252
     END_IF
   END_IF

Convert the ASCII hex data to binary using HEX(162) or by parsing each nibble to a BCD/MOVB pipeline. For 32 bytes (64 hex chars), the data ends up in 16 contiguous words, ready to feed into a comparator or a recipe table.

10. Performance and Timing Notes

  • Single inventory (UID only): typical 60–120 ms on the V720S, dominated by tag anti-collision.
  • Inventory + 16-byte read: 90–180 ms total.
  • Inventory + 16-byte write: 150–300 ms (RF field must remain on during write).
  • Multiple tags in field: add 30–60 ms per additional tag for arbitration. Use the anti-collision slot parameter to bound the search time.

Because each PMCR blocks the port until the receive trigger fires, do not overlap two sequences on the same port. If the application requires simultaneous read of two heads, mount a second SCU21 in the next slot and dedicate one port per head.

11. Migration and Variant Notes

  • SCU21 vs SCU31/41: the macro code is identical. The only changes are port settings (RS-232C vs RS-422/485) and slot number. Use SCU41 for cable runs >15 m or for multi-drop.
  • CJ1M vs CJ2M: the SCU21 is supported in both families. On CJ2M, the high-speed interrupt bus also allows attaching a Macro Trace to the trace buffer for long-term diagnostics — useful when validating a noisy line.
  • CP1L / CP1H: the CP1W-CIF01 (RS-232C option board) supports a limited subset of Protocol Macro (no Send & Receive with variable data field). For full V720S support, use a CP1L with the CP1W-CIF11/CIF12-V1 plus a CJ1W-SCU21-V1 in the expansion rack.
  • V720S vs V680S: the V680S uses 134 kHz LF tags and a different command set (RD is replaced with SCAN). Do not reuse the V720S macro; rebuild against the V680S manual.

12. Safety, Compliance, and Field Considerations

RFID at 13.56 MHz is subject to local RF emissions regulations. In industrial environments, mount the head away from variable-frequency drives and switching power supplies; the 13.56 MHz carrier can be coupled into data lines by nearby SMPS radiated noise. Use shielded cable (Belden 3106A or equivalent) and ground the shield at the head end only. The V720S ships with a regional regulatory marking — confirm the -AP or -US suffix matches the destination country's allocation.

Functional safety: RFID read results must not be the sole input to a safety-rated decision. The head is a non-trusted device and the link is unprotected against substitution. Use the read data as an identification input only, and confirm critical actions with a redundant channel.

13. Cross-References and Standards

For background on the underlying RFID air interface and on cyber-security guidance for RFID systems, refer to:

For the SCU21, V720S, and CX-Protocol tooling, see the manufacturer documentation set on the Omron Industrial Automation product portal (search for V720S, CJ1W-SCU21-V1, and W462 CX-Protocol Operation Manual).

Frequently Asked Questions

What is the minimum Omron hardware stack to read a V720S tag from a CJ1M?

A CJ1M-CPU1x, one CJ1W-SCU21-V1 in slot 0, and the V720S-HMD11-AP. The ladder uses PMCR(260) with sequence numbers defined in CX-Protocol, and the receive data lands in DM words you choose in the macro (for example D00200).

Can I use a V700 protocol macro as a starting point for a V720S implementation?

Yes. Both families use STX at the start and CR at the end, with ASCII command parameters. The command verbs differ (V720S uses ID/RD/WR/UR, V700 uses RS/WS and variants), so copy the V700 envelope and replace the command strings, then re-verify the receive length against the V720S status + payload.

How do I read the UID of a tag without reading its user memory?

Use sequence 100 above (Send ID<CR>, receive up to 2 status bytes + 16 hex UID + CR). The status bytes in D00200..D00201 must read ASCII 00 (hex 3030) for a normal end; 10 (hex 3130) means the field is empty.

The PMCR instruction raises error code 0205H. What does that mean?

The sequence number was not transferred to the SCU21's flash. In CX-Protocol use Transfer to Unit (not Transfer to PLC) and cycle power to the unit. After power-up, the macros load into the execution RAM automatically.

Can I run inventory on one head and read data on another head at the same time?

No — each port of the SCU21 handles one PMCR at a time. To parallelise, mount a second SCU21 in the next slot and dedicate one port per head. The ladder tracks each port's busy (CIO 1900 + 10*n . 00) and complete (CIO 1900 + 10*n . 03) flag separately.

Back to blog