1. Overview
This reference documents the field-proven procedure for establishing reliable serial communication between Vijeo Citect v6.1 (Schneider Electric's SCADA/HMI runtime, originally Citect) and an Omron CJ1M-CPU11 programmable controller using the Host Link (Sysmac Way) protocol. The CJ1M does not appear by name in the legacy Citect driver catalogue, but its communication subsystem is fully compatible with the CJ1/CS1 family and exposes the same Host Link command set used by the older C-series, so the OMRON C200H driver configured for Sysmac Way is the correct selection.
Three configuration elements must converge before I/O is exchanged:
- The PC serial port must be wired to the CJ1M RS-232C port using a semi-universal crossover cable (or a manufacturer-approved equivalent such as the Omron XW2Z family for peripheral-port installations).
- The PLC must be placed in Host Link mode (not Toolbus, not NT Link) at a baud rate that matches the Citect port configuration.
- The Citect project must reference the C200H driver with matching serial parameters, unit number, and protocol framing.
2. Prerequisites
| Item | Specification |
|---|---|
| HMI/SCADA | Vijeo Citect v6.1 (also applicable to straight Citect 6.x and 7.x for the legacy driver path) |
| PLC | Omron CJ1M-CPU11 (built-in RS-232C port + peripheral USB port) |
| Backplane | CJ1W-PA205R or CJ1W-PA202R power supply, CJ1M-CPU11 mounted on a CJ1W-IC101 or equivalent I/O control unit |
| Cable | DB9-female (PC) to DB9-male (PLC) semi-universal RS-232C crossover, or Omron XW2Z-200S-CV / XW2Z-500S-CV for peripheral-port routing |
| Configuration software | CX-Programmer v9.x or later for PLC Setup (FINS/Host Link parameters) |
| Serial parameters | 9600 bps (default), 7 data bits, Even parity, 2 stop bits, unit number 0 |
| Driver DLL | Citect legacy OMRON C200H (Sysmac Way protocol) |
3. CJ1M-CPU11 Communication Hardware
The CJ1M-CPU11 ships with two physical communication interfaces, and selecting the correct one is critical because Citect must terminate its serial session on the same port that is configured for Host Link inside the PLC.
| Port | Connector | Default Mode | Available Modes (PLC Setup) |
|---|---|---|---|
| Peripheral USB | USB-B (slave) | Toolbus (CX-Programmer default) | Toolbus only (no Host Link on this port) |
| RS-232C (built-in) | DB9 male, top of CPU | Host Link (factory default for CPU11) | Host Link, Toolbus, NT Link (1:N), No-protocol, Serial Gateway |
| Option board slot | CP1W-CIF01 (RS-232C) or CP1W-CIF11 (RS-422A/485) | Host Link | Host Link, Toolbus, NT Link, No-protocol, Serial PLC Link |
For a direct Citect-to-PLC serial cable, terminate on the built-in RS-232C DB9 port. Verify the port location against the CJ1M CPU11 Datasheet (Cat. No. R142-E1) before wiring, because the CJ1M-CPU12/CPU13/CPU22/CPU23 variants relocate or duplicate these connectors.
4. Driver Selection: C200H (Sysmac Way) Protocol
The Citect driver chooser presents several Omron entries; the correct mapping is governed by the wire protocol, not the marketing product family.
| Citect Driver Entry | Protocol | Physical Layer | Use With CJ1M? |
|---|---|---|---|
| OMRON C200H | Sysmac Way (Host Link, C-mode + FINS commands) | RS-232C / RS-422 point-to-point | Yes — primary choice for serial |
| OMRON CS1 | FINS over Ethernet (FINS/TCP port 9600) or Host Link | Ethernet or serial | Yes for Ethernet; for serial use C200H instead |
| OMRON FINS Gateway | FINS routing through ETN21/CLK21/CMR21 | Ethernet, Controller Link, Sysmac Link | Only when bridging an existing FINS network |
| OMRON Toolbus | CX-Programmer Toolbus | Peripheral port, USB | No — programming-only, not for SCADA polling |
The CJ1M and CS1 share the same Host Link command interpreter, so any reference to "CS1" in Citect documentation applies equally to CJ1. However, when the wire is RS-232C and the goal is point-to-point SCADA polling without FINS routing, the C200H driver is the most direct and least failure-prone path.
5. Host Link Protocol Frame Format
Sysmac Way uses an ASCII frame bounded by @ on the host-to-PLC side and response frames starting with @ followed by a two-character node number, command code, status/header, and FCS checksum terminated by *CR. Citect handles the frame formatting internally once the driver and parameters are set, but understanding the frame helps when interpreting raw traffic on a serial line analyzer.
Host → PLC: @ 0 0 RR 00 00 00 01 FCS * CR
PLC → Host: @ 0 0 RR 00 FCS * CR (normal completion)
PLC → Host: @ 0 0 RR xx FCS * CR (xx = non-zero error code)
| Field | Meaning |
|---|---|
@ |
Start of frame (1 char) |
| Node | Two ASCII digits, 00–31 (matches PLC unit number) |
| Header (RR) | Two-char command, e.g. RD, WR, RR, RW, MS, SC
|
| Body | Address + count + data, ASCII-hex |
| FCS | 2-char XOR checksum of all bytes between @ and the last body byte |
*CR |
End of frame |
Common Host Link error codes returned by the CJ1M:
| Code | Meaning | Remedy |
|---|---|---|
| 00 | Normal completion | — |
| 01 | Not executable in RUN mode | Switch to MONITOR or PROGRAM, or use a write command permitted in RUN |
| 02 | Not executable in MONITOR mode | Use a read command, or change mode |
| 04 | Address over area | Verify Citect tag area and offset |
| 13 | FCS error | Check for line noise; verify baud, parity, stop bits; shorten cable |
| 14 | Format error | Check command body ASCII hex |
| 15 | Entry number data error | Verify address and word count |
| 18 | Frame length error | Reduce poll block size in Citect; check for split frames |
| 21 | Not executable due to CPU error | Clear CPU error in CX-Programmer |
| 23 | Memory card write-protected | Disable write command or unprotect memory card |
6. Cable Wiring: Semi-Universal RS-232C
The CJ1M-CPU11 RS-232C port is wired as a DTE (Data Terminal Equipment) with a DB9 male connector on the front face. A standard PC COM port (DB9 male) is also DTE, so a one-to-one straight cable will not work: at minimum, TX and RX must be crossed. A semi-universal cable additionally loops back the hardware handshaking lines so the PC believes the device is ready (DSR high, CTS high) and asserts DTR/RTS that the PLC sees as valid.
| Signal | PC DB9-F (DTE) | Direction | PLC CJ1M DB9-M (DTE) |
|---|---|---|---|
| RD (Received Data) | Pin 2 | ← | Pin 3 (TD) |
| TD (Transmitted Data) | Pin 3 | → | Pin 2 (RD) |
| DTR (Data Terminal Ready) | Pin 4 | → | Pin 6 (DSR) + Pin 1 (CD) |
| DSR (Data Set Ready) | Pin 6 | ← | Pin 4 (DTR) |
| SG (Signal Ground) | Pin 5 | ↔ | Pin 5 |
| RTS (Request to Send) | Pin 7 | → | Pin 8 (CTS) |
| CTS (Clear to Send) | Pin 8 | ← | Pin 7 (RTS) |
| CD (Carrier Detect) | Pin 1 | ← | Pin 4 (DTR) |
| RI (Ring Indicator) | Pin 9 | — | No connect |
The following SVG illustrates the same wiring for quick reference at the panel:
Maximum recommended cable length for RS-232C at 9600 bps is 15 m (50 ft). If the panel layout forces a longer run, drop to an RS-422 option board (CP1W-CIF11) and the Citect OMROM C200H-RS422 driver entry, or move the Citect server closer to the panel.
7. PLC Setup: Enabling Host Link on CJ1M
Use CX-Programmer to confirm the built-in RS-232C port is set to Host Link. The CJ1M stores these parameters in PLC Setup → Host Link Port (peripheral settings are a separate menu). The key fields are:
| PLC Setup Address | Parameter | Value for Host Link |
|---|---|---|
| 144 | Port 1 (RS-232C) communications mode | 00 (Host Link default for CPU11) |
| 145 | Port 1 transmission speed | 00 = 9600, 01 = 19200, 02 = 38400, 03 = 57600, 04 = 115200 |
| 146 | Port 1 frame format | 00 = 7-2-E (default), 03 = 7-2-O, 04 = 7-2-N, 05 = 7-1-E |
| 147 | Port 1 unit number | 00–31 (default 00) |
| 148 | Port 1 CTS control | 00 = No CTS, 01 = CTS used |
- In CX-Programmer, go online and open PLC → Edit → PLC Setup → Host Link Port.
- Confirm Word 144 =
00(Host Link). If it shows01(Toolbus) or02(NT Link 1:N), Citect will silently time out. - Set Word 145 to the desired baud rate. Leave at 9600 (Word 145 = 00) for first commissioning.
- Set Word 146 to
00for the standard 7-E-2 frame. - Set Word 147 to
00for the default unit number, unless multiple Host Link devices share the line. - Transfer the setup to the PLC and cycle power.
8. Citect v6.1 Project Configuration
Configure the Express Communication Wizard or manually edit the INCLUDE files. Manual configuration is more transparent for troubleshooting.
- Open the Citect Project Editor and select Communications → Boards. Create or edit the PC board:
Board Name = BOARD1 Board Type = COM (serial) Port = COM1 I/O Device = 0 Special Opts = (none) - Open Communications → Ports and create a matching port:
Port Name = PORT1 Board Name = BOARD1 Number = 0 (zero-based index of COM1) - Open Communications → I/O Devices and create the PLC:
I/O Device Name = PLC1 Number = 0 Address = 0 (Host Link unit number) Protocol = SysmacWay (the Citect protocol string for C200H) Port Name = PORT1 Baud Rate = 9600 Data Bits = 7 Parity = E (Even) Stop Bits = 2 Special Opts = (blank) - Open Communications → Clusters:
Cluster Name = CLUSTER1 I/O Device = PLC1 Enable = Yes - Compile and run the Citect project. The driver DLL
OMRH.DLLloads under[SYSTEM]"Citect Drivers".
If you prefer the Express wizard, the equivalent selections are: Vendor = OMRON, Driver = C200H (Sysmac Way), Port = COM1, Baud = 9600, Parity = Even, Data = 7, Stop = 2.
9. Citect Tag Address Mapping for CJ1M
The C200H Sysmac Way driver uses Omron-style area tags. Map Citect variable tags to PLC memory areas with the prefix syntax shown:
| Citect Tag Format | CJ1M Memory Area | Example | Description |
|---|---|---|---|
B |
CIO (I/O + Internal) | B000100 |
Bit 10 of word 100 (CIO 100) |
W |
CIO word | W000100 |
Word CIO 100 |
DM |
D (Data Memory) | DM00100 |
Word D100 |
HR |
H (Holding Relay) | HR00010 |
Word H10 |
AR |
A (Auxiliary Relay) | AR00000 |
Word A0 |
LR |
— (not present on CJ1M) | LR00000 |
Returns 0; do not use |
T |
TC (Timer/Counter PV) | T00001 |
Timer 1 PV (BCD-coded word) |
C |
TC (Counter PV) | C00001 |
Counter 1 PV |
For bit-level tags, append a dot and bit number (0–15) to the word address, e.g. DM00100.05 for bit 5 of D100. The driver performs the word read/write and extracts the bit.
10. Verification and Diagnostics
After the project compiles and runs, perform these verification steps in order:
-
Hardware verification — observe the CJ1M RS-232C port LED. On the CPU11, the LED labeled
RDshould flicker when the Citect server polls. Steady dark = cable or baud mismatch. -
Citect Kernel log — open
Citect32.exewith kernel logging enabled (Kernel = 1inCitect.ini). Look for lines containing the I/O device name:
A "FCS error" or "timeout" line indicates framing problems.[I/O Devices] PLC1: Port opened: COM1 (9600,7,E,2) PLC1: Unit 0: Connected PLC1: RR 00 00 00 01 → OK -
Tag test — open the Citect Cicode debugger or a watch window, force a known value into
W000100, and confirm the corresponding bit toggles in CX-Programmer's watch window online. -
Bidirectional test — write a value from CX-Programmer to
DM00200and read it from Citect asDM00200. A mismatch points at the tag address, not the wire. - Stress test — leave the system polling for 30 minutes. Host Link frames lost at 9600 bps typically surface as FCS errors under EMI from VFDs or welding inverters. If errors rise above 0.1%, add shielded cable, ferrite beads, or move to 19,200 bps with shorter cable.
11. Troubleshooting Matrix
| Symptom | Likely Cause | Diagnostic | Fix |
|---|---|---|---|
| No COM activity at all | Wrong port (USB vs COM), cable TX/RX not crossed | Loopback test on PC port; check Device Manager for COM number | Re-wire cable; correct COM index in Boards configuration |
| Citect reports "timeout" immediately | Baud, parity, or stop-bit mismatch; PLC in Toolbus | Verify Word 145/146 in PLC Setup with CX-Programmer | Match PLC Setup to Citect Port settings; ensure Host Link not Toolbus |
| Reads work, writes fail with status 01 | PLC in RUN mode and command not permitted | Switch to MONITOR in CX-Programmer, retry | Use a write command valid in RUN, or accept read-only polling |
| Intermittent FCS errors (0x13) | Line noise, missing ground, cable too long | Replace with shielded cable, check shield is bonded at one end only | Re-pull cable, add ferrite, or move to RS-422/485 at lower baud |
| Citect reads constant zero | Wrong unit number or wrong area | Add Unit=0 in I/O Device, verify address in PLC online |
Set unit number to match Word 147; correct tag area prefix |
| Reads return 0x00FF for some words | Area out of range or unsupported area (LR) | Check memory map; LR not present on CJ1M | Re-map tag to D, CIO, or AR |
| Compiles but driver fails to load | OMRH.DLL missing or wrong Citect version | Check bin folder; verify vendor license |
Reinstall driver pack or copy DLL from a working Citect install |
| Connection drops after a few minutes | USB-to-serial adapter power management | Disable COM port power management in Device Manager | Use a powered RS-232 card (e.g., Moxa CP-132) instead |
12. Frequently Asked Questions
Which Citect driver should I use to talk to a CJ1M-CPU11 over serial?
Use the OMRON C200H driver with the Sysmac Way (Host Link) protocol. The C200H driver predates the CS1/CJ1 product line but is fully compatible with the CJ1M Host Link command set, and it is the most reliable choice for direct RS-232C serial communication.
Can I use the FINS Gateway driver instead of C200H?
Only if the serial cable terminates on an Omron FINS-to-Ethernet gateway (such as ETN21) and the Citect server connects to that gateway over Ethernet. For a direct PC-to-PLC serial cable, the FINS Gateway driver will not establish a session.
What is the correct cable pinout for a CJ1M RS-232C port to a PC?
Use a semi-universal DB9 crossover: TX (pin 3 on PLC) to RX (pin 2 on PC), RX (pin 2 on PLC) to TX (pin 3 on PC), with handshake lines looped (DTR → DSR + CD, RTS → CTS) and signal ground (pin 5) direct. Maximum reliable length is 15 m at 9600 bps.
Do I need to change a DIP switch on the CJ1M to enable Host Link?
On the CJ1M-CPU11, the built-in RS-232C port is factory-defaulted to Host Link. On CPU12/CPU13/CPU22/CPU23, you may need to change Word 144 in PLC Setup from 01 (Toolbus) to 00 (Host Link) using CX-Programmer. There is no physical DIP switch for this on the CPU module itself.
Why does Citect read zeros for Holding Relay (H) or Auxiliary Relay (A) areas?
The CJ1M has HR and AR areas, but they are accessed with the HR and AR prefixes in Citect, not LR. The LR area does not exist on the CJ-series, so any Citect tag mapped to LR will silently return zero. Re-map such tags to AR or HR as appropriate.