Configuring Vijeo Citect v6.1 to Omron CJ1M via Serial Host Link

James Nishida13 min read
OmronSerial CommunicationTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Overview

This reference documents the field-proven procedure for establishing reliable serial communication between Vijeo Citect v6.1 (Schneider Electric's SCADA/HMI runtime, originally Citect) and an Omron CJ1M-CPU11 programmable controller using the Host Link (Sysmac Way) protocol. The CJ1M does not appear by name in the legacy Citect driver catalogue, but its communication subsystem is fully compatible with the CJ1/CS1 family and exposes the same Host Link command set used by the older C-series, so the OMRON C200H driver configured for Sysmac Way is the correct selection.

Three configuration elements must converge before I/O is exchanged:

  1. The PC serial port must be wired to the CJ1M RS-232C port using a semi-universal crossover cable (or a manufacturer-approved equivalent such as the Omron XW2Z family for peripheral-port installations).
  2. The PLC must be placed in Host Link mode (not Toolbus, not NT Link) at a baud rate that matches the Citect port configuration.
  3. The Citect project must reference the C200H driver with matching serial parameters, unit number, and protocol framing.
Field-proven caveat: FINS Gateway drivers are designed for Ethernet/IP, Controller Link, or Sysmac Link layers; they are not the correct choice for a direct serial Host Link connection. Use FINS Gateway only when routing serial traffic through an Omron ETN21 or similar FINS-to-Ethernet gateway. For point-to-point serial, the C200H driver with Sysmac Way protocol is the supported path.

2. Prerequisites

Item Specification
HMI/SCADA Vijeo Citect v6.1 (also applicable to straight Citect 6.x and 7.x for the legacy driver path)
PLC Omron CJ1M-CPU11 (built-in RS-232C port + peripheral USB port)
Backplane CJ1W-PA205R or CJ1W-PA202R power supply, CJ1M-CPU11 mounted on a CJ1W-IC101 or equivalent I/O control unit
Cable DB9-female (PC) to DB9-male (PLC) semi-universal RS-232C crossover, or Omron XW2Z-200S-CV / XW2Z-500S-CV for peripheral-port routing
Configuration software CX-Programmer v9.x or later for PLC Setup (FINS/Host Link parameters)
Serial parameters 9600 bps (default), 7 data bits, Even parity, 2 stop bits, unit number 0
Driver DLL Citect legacy OMRON C200H (Sysmac Way protocol)

3. CJ1M-CPU11 Communication Hardware

The CJ1M-CPU11 ships with two physical communication interfaces, and selecting the correct one is critical because Citect must terminate its serial session on the same port that is configured for Host Link inside the PLC.

Port Connector Default Mode Available Modes (PLC Setup)
Peripheral USB USB-B (slave) Toolbus (CX-Programmer default) Toolbus only (no Host Link on this port)
RS-232C (built-in) DB9 male, top of CPU Host Link (factory default for CPU11) Host Link, Toolbus, NT Link (1:N), No-protocol, Serial Gateway
Option board slot CP1W-CIF01 (RS-232C) or CP1W-CIF11 (RS-422A/485) Host Link Host Link, Toolbus, NT Link, No-protocol, Serial PLC Link

For a direct Citect-to-PLC serial cable, terminate on the built-in RS-232C DB9 port. Verify the port location against the CJ1M CPU11 Datasheet (Cat. No. R142-E1) before wiring, because the CJ1M-CPU12/CPU13/CPU22/CPU23 variants relocate or duplicate these connectors.

4. Driver Selection: C200H (Sysmac Way) Protocol

The Citect driver chooser presents several Omron entries; the correct mapping is governed by the wire protocol, not the marketing product family.

Citect Driver Entry Protocol Physical Layer Use With CJ1M?
OMRON C200H Sysmac Way (Host Link, C-mode + FINS commands) RS-232C / RS-422 point-to-point Yes — primary choice for serial
OMRON CS1 FINS over Ethernet (FINS/TCP port 9600) or Host Link Ethernet or serial Yes for Ethernet; for serial use C200H instead
OMRON FINS Gateway FINS routing through ETN21/CLK21/CMR21 Ethernet, Controller Link, Sysmac Link Only when bridging an existing FINS network
OMRON Toolbus CX-Programmer Toolbus Peripheral port, USB No — programming-only, not for SCADA polling

The CJ1M and CS1 share the same Host Link command interpreter, so any reference to "CS1" in Citect documentation applies equally to CJ1. However, when the wire is RS-232C and the goal is point-to-point SCADA polling without FINS routing, the C200H driver is the most direct and least failure-prone path.

5. Host Link Protocol Frame Format

Sysmac Way uses an ASCII frame bounded by @ on the host-to-PLC side and response frames starting with @ followed by a two-character node number, command code, status/header, and FCS checksum terminated by *CR. Citect handles the frame formatting internally once the driver and parameters are set, but understanding the frame helps when interpreting raw traffic on a serial line analyzer.

Host → PLC:  @  0  0  RR  00  00  00  01  FCS  *  CR
PLC → Host:  @  0  0  RR  00  FCS  *  CR      (normal completion)
PLC → Host:  @  0  0  RR  xx  FCS  *  CR      (xx = non-zero error code)
Field Meaning
@ Start of frame (1 char)
Node Two ASCII digits, 00–31 (matches PLC unit number)
Header (RR) Two-char command, e.g. RD, WR, RR, RW, MS, SC
Body Address + count + data, ASCII-hex
FCS 2-char XOR checksum of all bytes between @ and the last body byte
*CR End of frame

Common Host Link error codes returned by the CJ1M:

Code Meaning Remedy
00 Normal completion —
01 Not executable in RUN mode Switch to MONITOR or PROGRAM, or use a write command permitted in RUN
02 Not executable in MONITOR mode Use a read command, or change mode
04 Address over area Verify Citect tag area and offset
13 FCS error Check for line noise; verify baud, parity, stop bits; shorten cable
14 Format error Check command body ASCII hex
15 Entry number data error Verify address and word count
18 Frame length error Reduce poll block size in Citect; check for split frames
21 Not executable due to CPU error Clear CPU error in CX-Programmer
23 Memory card write-protected Disable write command or unprotect memory card

6. Cable Wiring: Semi-Universal RS-232C

The CJ1M-CPU11 RS-232C port is wired as a DTE (Data Terminal Equipment) with a DB9 male connector on the front face. A standard PC COM port (DB9 male) is also DTE, so a one-to-one straight cable will not work: at minimum, TX and RX must be crossed. A semi-universal cable additionally loops back the hardware handshaking lines so the PC believes the device is ready (DSR high, CTS high) and asserts DTR/RTS that the PLC sees as valid.

If you use the CJ1M peripheral port (round mini-DIN) instead of the built-in RS-232C, use Omron cable XW2Z-200S-CV (2 m) or XW2Z-500S-CV (5 m). For the DB9 RS-232C port, the cable below is correct.
Signal PC DB9-F (DTE) Direction PLC CJ1M DB9-M (DTE)
RD (Received Data) Pin 2 ← Pin 3 (TD)
TD (Transmitted Data) Pin 3 → Pin 2 (RD)
DTR (Data Terminal Ready) Pin 4 → Pin 6 (DSR) + Pin 1 (CD)
DSR (Data Set Ready) Pin 6 ← Pin 4 (DTR)
SG (Signal Ground) Pin 5 ↔ Pin 5
RTS (Request to Send) Pin 7 → Pin 8 (CTS)
CTS (Clear to Send) Pin 8 ← Pin 7 (RTS)
CD (Carrier Detect) Pin 1 ← Pin 4 (DTR)
RI (Ring Indicator) Pin 9 — No connect

The following SVG illustrates the same wiring for quick reference at the panel:

PC DB9-F (DTE) CJ1M DB9-M (DTE) 2 RD ↔ 3 TD 3 TD ↔ 2 RD 4 DTR → 6 DSR + 1 CD 6 DSR ← 4 DTR 5 SG ↔ 5 SG 7 RTS → 8 CTS 8 CTS ← 7 RTS

Maximum recommended cable length for RS-232C at 9600 bps is 15 m (50 ft). If the panel layout forces a longer run, drop to an RS-422 option board (CP1W-CIF11) and the Citect OMROM C200H-RS422 driver entry, or move the Citect server closer to the panel.

7. PLC Setup: Enabling Host Link on CJ1M

Use CX-Programmer to confirm the built-in RS-232C port is set to Host Link. The CJ1M stores these parameters in PLC Setup → Host Link Port (peripheral settings are a separate menu). The key fields are:

PLC Setup Address Parameter Value for Host Link
144 Port 1 (RS-232C) communications mode 00 (Host Link default for CPU11)
145 Port 1 transmission speed 00 = 9600, 01 = 19200, 02 = 38400, 03 = 57600, 04 = 115200
146 Port 1 frame format 00 = 7-2-E (default), 03 = 7-2-O, 04 = 7-2-N, 05 = 7-1-E
147 Port 1 unit number 00–31 (default 00)
148 Port 1 CTS control 00 = No CTS, 01 = CTS used
  1. In CX-Programmer, go online and open PLC → Edit → PLC Setup → Host Link Port.
  2. Confirm Word 144 = 00 (Host Link). If it shows 01 (Toolbus) or 02 (NT Link 1:N), Citect will silently time out.
  3. Set Word 145 to the desired baud rate. Leave at 9600 (Word 145 = 00) for first commissioning.
  4. Set Word 146 to 00 for the standard 7-E-2 frame.
  5. Set Word 147 to 00 for the default unit number, unless multiple Host Link devices share the line.
  6. Transfer the setup to the PLC and cycle power.
CPU11 vs CPU12+: On the CJ1M-CPU11, the RS-232C port is the default Host Link port and Word 144 is pre-set to 00 at the factory. On CPU12/CPU13/CPU22/CPU23, the port is reconfigurable and Word 144 may default to 01 (Toolbus). Always verify before commissioning.

8. Citect v6.1 Project Configuration

Configure the Express Communication Wizard or manually edit the INCLUDE files. Manual configuration is more transparent for troubleshooting.

  1. Open the Citect Project Editor and select Communications → Boards. Create or edit the PC board:
    Board Name     = BOARD1
    Board Type     = COM (serial)
    Port           = COM1
    I/O Device     = 0
    Special Opts   = (none)
  2. Open Communications → Ports and create a matching port:
    Port Name      = PORT1
    Board Name     = BOARD1
    Number         = 0  (zero-based index of COM1)
  3. Open Communications → I/O Devices and create the PLC:
    I/O Device Name  = PLC1
    Number           = 0
    Address          = 0              (Host Link unit number)
    Protocol         = SysmacWay      (the Citect protocol string for C200H)
    Port Name        = PORT1
    Baud Rate        = 9600
    Data Bits        = 7
    Parity           = E (Even)
    Stop Bits        = 2
    Special Opts     = (blank)
  4. Open Communications → Clusters:
    Cluster Name  = CLUSTER1
    I/O Device    = PLC1
    Enable        = Yes
  5. Compile and run the Citect project. The driver DLL OMRH.DLL loads under [SYSTEM]"Citect Drivers".

If you prefer the Express wizard, the equivalent selections are: Vendor = OMRON, Driver = C200H (Sysmac Way), Port = COM1, Baud = 9600, Parity = Even, Data = 7, Stop = 2.

9. Citect Tag Address Mapping for CJ1M

The C200H Sysmac Way driver uses Omron-style area tags. Map Citect variable tags to PLC memory areas with the prefix syntax shown:

Citect Tag Format CJ1M Memory Area Example Description
B CIO (I/O + Internal) B000100 Bit 10 of word 100 (CIO 100)
W CIO word W000100 Word CIO 100
DM D (Data Memory) DM00100 Word D100
HR H (Holding Relay) HR00010 Word H10
AR A (Auxiliary Relay) AR00000 Word A0
LR — (not present on CJ1M) LR00000 Returns 0; do not use
T TC (Timer/Counter PV) T00001 Timer 1 PV (BCD-coded word)
C TC (Counter PV) C00001 Counter 1 PV

For bit-level tags, append a dot and bit number (0–15) to the word address, e.g. DM00100.05 for bit 5 of D100. The driver performs the word read/write and extracts the bit.

The CJ1M does not have L or LR memory. Mapping a Citect tag to LR will not error immediately but will return 0 and silently mask field faults. Use AR for system flags instead.

10. Verification and Diagnostics

After the project compiles and runs, perform these verification steps in order:

  1. Hardware verification — observe the CJ1M RS-232C port LED. On the CPU11, the LED labeled RD should flicker when the Citect server polls. Steady dark = cable or baud mismatch.
  2. Citect Kernel log — open Citect32.exe with kernel logging enabled (Kernel = 1 in Citect.ini). Look for lines containing the I/O device name:
    [I/O Devices]
    PLC1: Port opened: COM1 (9600,7,E,2)
    PLC1: Unit 0: Connected
    PLC1: RR 00 00 00 01 → OK
    A "FCS error" or "timeout" line indicates framing problems.
  3. Tag test — open the Citect Cicode debugger or a watch window, force a known value into W000100, and confirm the corresponding bit toggles in CX-Programmer's watch window online.
  4. Bidirectional test — write a value from CX-Programmer to DM00200 and read it from Citect as DM00200. A mismatch points at the tag address, not the wire.
  5. Stress test — leave the system polling for 30 minutes. Host Link frames lost at 9600 bps typically surface as FCS errors under EMI from VFDs or welding inverters. If errors rise above 0.1%, add shielded cable, ferrite beads, or move to 19,200 bps with shorter cable.

11. Troubleshooting Matrix

Symptom Likely Cause Diagnostic Fix
No COM activity at all Wrong port (USB vs COM), cable TX/RX not crossed Loopback test on PC port; check Device Manager for COM number Re-wire cable; correct COM index in Boards configuration
Citect reports "timeout" immediately Baud, parity, or stop-bit mismatch; PLC in Toolbus Verify Word 145/146 in PLC Setup with CX-Programmer Match PLC Setup to Citect Port settings; ensure Host Link not Toolbus
Reads work, writes fail with status 01 PLC in RUN mode and command not permitted Switch to MONITOR in CX-Programmer, retry Use a write command valid in RUN, or accept read-only polling
Intermittent FCS errors (0x13) Line noise, missing ground, cable too long Replace with shielded cable, check shield is bonded at one end only Re-pull cable, add ferrite, or move to RS-422/485 at lower baud
Citect reads constant zero Wrong unit number or wrong area Add Unit=0 in I/O Device, verify address in PLC online Set unit number to match Word 147; correct tag area prefix
Reads return 0x00FF for some words Area out of range or unsupported area (LR) Check memory map; LR not present on CJ1M Re-map tag to D, CIO, or AR
Compiles but driver fails to load OMRH.DLL missing or wrong Citect version Check bin folder; verify vendor license Reinstall driver pack or copy DLL from a working Citect install
Connection drops after a few minutes USB-to-serial adapter power management Disable COM port power management in Device Manager Use a powered RS-232 card (e.g., Moxa CP-132) instead

12. Frequently Asked Questions

Which Citect driver should I use to talk to a CJ1M-CPU11 over serial?

Use the OMRON C200H driver with the Sysmac Way (Host Link) protocol. The C200H driver predates the CS1/CJ1 product line but is fully compatible with the CJ1M Host Link command set, and it is the most reliable choice for direct RS-232C serial communication.

Can I use the FINS Gateway driver instead of C200H?

Only if the serial cable terminates on an Omron FINS-to-Ethernet gateway (such as ETN21) and the Citect server connects to that gateway over Ethernet. For a direct PC-to-PLC serial cable, the FINS Gateway driver will not establish a session.

What is the correct cable pinout for a CJ1M RS-232C port to a PC?

Use a semi-universal DB9 crossover: TX (pin 3 on PLC) to RX (pin 2 on PC), RX (pin 2 on PLC) to TX (pin 3 on PC), with handshake lines looped (DTR → DSR + CD, RTS → CTS) and signal ground (pin 5) direct. Maximum reliable length is 15 m at 9600 bps.

Do I need to change a DIP switch on the CJ1M to enable Host Link?

On the CJ1M-CPU11, the built-in RS-232C port is factory-defaulted to Host Link. On CPU12/CPU13/CPU22/CPU23, you may need to change Word 144 in PLC Setup from 01 (Toolbus) to 00 (Host Link) using CX-Programmer. There is no physical DIP switch for this on the CPU module itself.

Why does Citect read zeros for Holding Relay (H) or Auxiliary Relay (A) areas?

The CJ1M has HR and AR areas, but they are accessed with the HR and AR prefixes in Citect, not LR. The LR area does not exist on the CJ-series, so any Citect tag mapped to LR will silently return zero. Re-map such tags to AR or HR as appropriate.

Back to blog