CQM1-CPU41 DIP Switch Write-Protect: Resolving Program Lock

James Nishida13 min read
OmronPLC HardwareTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Resolving CQM1-CPU41 Program Lock: DIP Switch Write-Protect and Operating Mode

The Omron CQM1-CPU41 CPU Unit occasionally presents a frustrating condition: the controller appears online in CX-Programmer, the user can read (upload) the program, but every write, edit, or clear (unload) operation is rejected. This article isolates the two underlying causes that produce this exact symptom on the CQM1-CPU41 (and the closely related CQM1-CPU11/21/42/43/44-EV1 variants): the user-memory (UM) write-protect DIP switch on the front of the CPU, and the controller's operating mode (RUN vs. MONITOR vs. PROGRAM). Every diagnostic step, the relevant AR-area status flags, the required cable configuration, and the CX-Programmer v4.x / v9.x settings are documented below for an engineer working against a CQM1-CPU41 with a Windows XP (or later) host running the CX-One or CX-Programmer suite.

Field Note: Before suspecting a hardware fault, always verify the front-panel DIP switch block and the active operating mode. The CQM1-CPU41 does not need to be powered down to toggle SW7 (write protect), but it must be in PROGRAM mode for the controller to accept a UM overwrite or program clear command.

1. Problem Summary

When connected to a CQM1-CPU41 with an RS-232C peripheral or host-link cable, the engineer observes one or more of the following:

  • CX-Programmer reports the PLC is online.
  • Program upload (PLC -> PC) succeeds.
  • Program download (PC -> PLC) is rejected with messages such as "Write protected," "Cannot write to UM," or "Protected by DIP switch."
  • Online edit attempts in MONITOR mode return "Write disabled" or produce a red error indicator.
  • Program clear / memory clear (unload) is blocked.

The reported DIP switch state on the unit is:

SW1 SW2 SW3 SW4 SW5 SW6 SW7 SW8
OFF OFF ON ON OFF OFF ON OFF

SW7 in the ON position is the most common cause of the locked-out condition described in the source case. SW3/SW4 govern RS-232C communications parameters, and SW8 controls the expansion-instruction set (must be ON to use advanced instructions such as PID, MSG, SCL, etc.).

2. CQM1-CPU41 Hardware Reference

The CQM1-CPU41 is a compact modular CPU Unit in the CQM1 series introduced in the 1990s and superseded by the CJ1M. Key specifications relevant to this troubleshooting case:

Parameter CQM1-CPU41 Specification
Program capacity 8 K words (UM)
I/O bits (IR area) IR 000 - IR 243 (work bits available between dedicated functions)
Cycle time 0.5 ms typical (LD instruction)
Memory type RAM (battery backed: C500-BAT08 / 3G2A9-BAT08), optional EPROM (ROM)
Serial ports 1 x Peripheral port (4-pin mini-DIN), 1 x RS-232C (DB-9 male, host-link / NT-link / 1:1 / 1:N)
Maximum I/O points 256 (with expansion racks)
Front panel 8-position DIP switch, mode key switch, LED indicators (RUN, ERR, COMM, INH, etc.)
Programming software CX-Programmer (SYSMAC-CPT, LSS, SSS historically)

For complete programming and installation details consult the CQM1/CPM1/CPM1A/SRM1 Programming Manual (W228-E1-08) hosted by Omron eData.

3. Front-Panel DIP Switch Reference (SW1-SW8)

The CQM1-CPU41 front-panel 8-position DIP switch (often labelled "DIP" or "SET" on the housing) controls default peripheral-port and RS-232C communications, write protection, and expansion-instruction set availability. Pin numbering is left-to-right with switch 1 nearest the LED array.

Switch Function OFF ON
SW1 Peripheral port comms parameter - bit 0 SW1/SW2 select standard host-link framing: 9600/7/E/2 default (OFF-OFF), or alternate rates/parameters per CQM1 datasheet.
SW2 Peripheral port comms parameter - bit 1
SW3 RS-232C port comms parameter - bit 0 SW3/SW4 select default 9 600 bps, 7 data bits, even parity, 2 stop bits (standard host link). For Perigheral Port settings, see CPU documentation.
SW4 RS-232C port comms parameter - bit 1
SW5 Peripheral port data length 7 bits (ASCII) 8 bits (binary)
SW6 RS-232C port data length 7 bits (ASCII) 8 bits (binary)
SW7 UM write protect UM writes allowed UM write protected
SW8 Expansion instruction set Disabled (no PID, MSG, SCL, etc.) Enabled (expansion instruction set active)
Critical: With SW7 = ON the user-memory (UM) area containing the ladder program is hardware-protected. CX-Programmer cannot write, transfer, or clear the program block even with the PLC in PROGRAM mode. The controller also ignores "program clear" instructions issued from a hand-held programmer (CQM1-PRO01-E) when SW7 is ON.

Confirm SW7 against the actual plastic silkscreen on the specific CPU. On CQM1-CPU41-EV1 units the legend is usually printed above the switch block; on CQM1H-CPUxx units the mapping differs (SW5 = expansion set, SW6 = write protect), so always cross-check the variant marking on the side label.

4. Operating Mode and AR Status Flags

The CQM1-CPU41 has a physical three-position key switch on the front panel:

  • RUN - program executes; online edits disabled.
  • MONITOR - program executes; online edits, force-set/reset, and online program modification are permitted (subject to UM write protect).
  • PROGRAM - program execution stopped; full download, program clear, and UM transfer permitted (subject to UM write protect).

The current operating mode and the write-protect state are reflected in the Auxiliary Relay (AR) area:

AR Address Name Meaning
AR 00.15 UM write-protect flag 1 = UM is write-protected (SW7 = ON)
AR 00.14 Operating mode - bit 0 0/0 = PROGRAM, 0/1 = MONITOR, 1/0 = RUN (per W228 manual)
AR 00.13 Operating mode - bit 1
AR 00.12 Memory backup status 1 = battery OK, 0 = battery low (data retention risk)

To verify the write-protect state without altering the program, open the CX-Programmer Watch window, set AR 00 as the data type, and read the value. Bit 15 high (1) confirms UM is hardware-locked. With AR 00.15 = 1 there is no software workaround that overrides the SW7 = ON condition.

5. Root Cause Analysis

The reported condition (program uploads, edits and program clears rejected; CX-Programmer reports a write-protect error) maps to two distinct but additive conditions, both of which the source case exhibits:

  1. Hardware UM write-protect active. SW7 = ON disables all writes to the user-memory (UM) area. The CX-Programmer transfer dialog will report "Could not transfer to PLC: write-protect switch is ON" (the exact wording varies with CX-Programmer version: v3.x, v4.x, v9.x differ slightly).
  2. Operating mode mismatch. If the controller key switch is in RUN, even with SW7 = OFF the program cannot be edited online (download and program clear are rejected). The engineer must move the key to PROGRAM for a full transfer or clear, or to MONITOR for online edits.

Both conditions must be addressed before the program can be written, edited, or cleared. In the source case the DIP switch word 1=OFF, 2=OFF, 3=ON, 4=ON, 5=OFF, 6=OFF, 7=ON, 8=OFF clearly indicates SW7 = ON, so the UM is hardware-locked. The first corrective action is to set SW7 = OFF.

6. Resolution Procedure

6.1 Prerequisites

  • Small flat-blade screwdriver or non-conductive tool for DIP switch actuation.
  • Valid RS-232C host-link cable (Omron XW2Z-200S-CV, 2 m, or compatible) or CQM1-CIF01 / CQM1-CIF02 peripheral-to-serial adapter.
  • CX-Programmer v4.x or v9.x installed and licensed. (CX-One v1.x / v4.x bundles CX-Programmer; the CQM1-CPU41 is supported in CX-Programmer v3 and later. CX-Programmer v9.7x is the last version supporting Windows 10 / 11 for legacy C/CQM1/CV-series devices.)
  • Administrative rights on the host PC to install or update the Omron USB serial driver (DRV-USB-SERIAL / VCP bridge).

6.2 Step-by-Step

  1. Stop the controlled process. Switching the operating-mode key from RUN to PROGRAM halts program execution. The user is responsible for machine safety; coordinate with operations and apply lock-out/tag-out if the I/O drives machinery.
  2. Set the operating mode key to PROGRAM. This unlocks the transfer / clear commands in CX-Programmer.
  3. Toggle SW7 from ON to OFF. Use a small screwdriver to slide the switch position. The change takes effect immediately; no power cycle is required. SW7 must be set to OFF before initiating any download or program clear.
  4. (Optional) Toggle SW8 to ON if the program uses expansion instructions (PID, MSG, RXD/TXD, SCL, AVG, PID, TKY, HKY, etc.). Leaving SW8 = OFF with a program that contains expansion instructions will produce "instruction not recognized" errors at execution.
  5. Verify AR 00.15 is 0. In CX-Programmer, go online and open the Watch window. Add AR 00.15 as a binary address. The bit must read 0 for UM to be writable.
  6. Establish / verify the host-link connection. In CX-Programmer, select PLC > Auto Online > Direct Online, or manually configure the C-series driver. Recommended settings: 9 600 bps, 7 data bits, even parity, 2 stop bits, host link unit number 00.
  7. Perform the desired write operation. Choose PLC > Transfer > To PLC (download), PLC > Transfer > Program Clear, or right-click a rung and select Online Edit while in MONITOR mode.
  8. Return the key switch to RUN or MONITOR once the transfer completes. Re-arm the safety circuit before restarting the machine.
Tip: If the controller is connected to a peripheral port (4-pin mini-DIN) rather than the RS-232C DB-9, the default communications parameters are 9 600 bps, 7-E-2, and the host-link unit number 0. SW1/SW2 must be in OFF-OFF for this default. With SW3 = ON / SW4 = ON on the RS-232C port, the host-link standard settings apply.

7. Cable and Adapter Reference

Cable / Adapter Length Connector A (PC) Connector B (CQM1-CPU41) Notes
XW2Z-200S-CV 2 m DB-9 female DB-9 male (RS-232C port) Standard host-link cable. Do not use a null-modem; the Omron cable is a straight-through host-link cable.
XW2Z-500S-CV 5 m DB-9 female DB-9 male Longer version of the above.
CQM1-CIF01 - DB-9 female (host) Peripheral mini-DIN Peripheral-port to RS-232C adapter; supports host link on the peripheral port.
CQM1-CIF02 - USB-A (PC) Peripheral mini-DIN USB-to-peripheral adapter. Requires Omron USB-Serial driver on the host.
CS1W-CN118 0.1 m DB-9 female DB-9 female RS-232C port-to-port adapter; useful for bench testing.

USB-to-serial converters using FTDI FT232 or Prolific PL2303 chipsets generally work, but CX-Programmer v3 / v4 was originally developed for native COM ports. On Windows XP, install the legacy Omron VCP driver before plugging in the converter, and assign the resulting COM port a number between 1 and 16 (CX-Programmer v3 has trouble with COM > 16). On Windows 7 / 10 / 11 use the certified FTDI driver and CX-Programmer v9.7x for reliable operation.

8. CX-Programmer Configuration

8.1 Driver and Network Setup

  1. Open CX-Programmer and select File > New or open the existing .cxp project.
  2. From the project tree, right-click the PLC icon and select Change PLC Type > CQM1-CPU41.
  3. Double-click the icon to open the Change PLC dialog. Click Settings next to the Driver and choose C-series Host Link (peripheral or RS-232C port).
  4. Configure the COM port number, baud rate (9 600 default), data bits (7), parity (Even), stop bits (2), and unit number (0). These must match the SW1-SW6 setting on the CPU.
  5. Click Test to verify communication. A green OK confirms the host link is alive.

8.2 Transfer and Online-Edit Procedure

  1. Set the controller key to PROGRAM (for full download) or MONITOR (for online edit / rung overwrite).
  2. Toggle SW7 to OFF.
  3. Select PLC > Transfer > To PLC... in CX-Programmer. The dialog should report "UM write protect: OFF"; if it reports "ON" the DIP switch has not been correctly actuated.
  4. Confirm the transfer. A progress bar indicates the write; on success the project memory equals the controller memory.
  5. To perform a program clear / unload, select PLC > Clear > All Memory Areas or PLC > Transfer > Program Clear (CX-Programmer v4 and later). Confirm the prompt.

9. Verification

After completing the resolution, perform the following verification sequence:

  1. Re-read the AR area: confirm AR 00.15 = 0 (write protect cleared) and the operating-mode bits in AR 00.13 / AR 00.14 match the key-switch position.
  2. Compare the project memory with the controller memory: PLC > Compare > With PLC. The dialog should report "No differences."
  3. Cycle the power (off, wait 5 seconds, on) and re-online. The program should load and execute without errors.
  4. Check the ERR LED on the front of the CPU. It must be OFF. If it lights red, cycle the key switch to PROGRAM, look for the first error in the ladder, and resolve before returning to RUN.
  5. Check the battery status (AR 00.12). If low, replace the C500-BAT08 / 3G2A9-BAT08 backup battery before relying on RAM-resident program storage.
Safety warning: The CQM1-CPU41 retains program data only while the battery is healthy. If the battery has been removed or has failed, the UM will be cleared on power-down. Always back up the program to the PC before replacing the battery, and verify the controller holds the program across a power cycle after the change.

10. Related Error Conditions

Symptom Likely Cause Corrective Action
"Write protected" error in CX-Programmer SW7 = ON Set SW7 to OFF
"Cannot go online" / COM timeout Wrong baud rate / parity / port / unit number Verify SW1-SW6 against host settings; check cable continuity; verify the COM port number in Device Manager
"Instruction not recognized" at run time SW8 = OFF but program uses expansion instructions Set SW8 = ON and re-download
Program cleared on power cycle Battery low or removed Replace C500-BAT08 battery; back up program first
ERR LED solid red Memory parity / instruction error Cycle key to PROGRAM, read AR 00 / AR 01 error codes, resolve offending instruction
Cannot read / write the I/O table Expansion I/O rack powered off or bus fault Verify expansion rack PSU, check I/O bus terminator

11. Best Practices and Field Notes

  • Document the DIP switch settings. Every CQM1-CPU41 commissioning should record SW1-SW8 on the controller label, the electrical drawing, and the project submittal. SW7 and SW8 are the most frequently changed after commissioning.
  • Disable write-protect after commissioning only when actively editing. Leaving SW7 = ON during production prevents accidental overwrites from a misrouted host-link session. Toggle it to OFF only during scheduled program changes.
  • Use the 1:1 host link rather than 1:N when the project is being actively developed. 1:N host link on a multi-drop RS-485 line is convenient in production but slows transfers and complicates unit-number management.
  • Always go online and verify AR 00.15 before declaring a write failure. This bit is the unambiguous indicator of the SW7 state, regardless of what CX-Programmer says in the error dialog.
  • Prefer CX-Programmer v9.7x on Windows 10/11. CX-Programmer v3 and v4 run on Windows XP / 7 but are not officially supported on Windows 10. If a Windows 10+ host is required for the legacy CQM1-CPU41, install CX-One v4.x (which bundles CX-Programmer v9.7x) and confirm the C-series driver is licensed.
  • Replace the battery every 5 years as preventive maintenance, or sooner if AR 00.12 indicates a low-battery state. A dead battery erases the program on the next power-down.
  • Avoid mixing expansion instructions across the SW8 boundary. If the program must remain SW8 = OFF, replace PID, MSG, RXD/TXD, SCL, and similar instructions with their basic-instruction equivalents where possible.

12. Frequently Asked Questions

Which DIP switch on the CQM1-CPU41 controls the program write-protect?

DIP switch SW7 controls the user-memory (UM) write protect. SW7 = ON hardware-locks the UM and prevents any program download, program clear, or online edit, even if the key switch is in PROGRAM. SW7 = OFF allows writes. The state is reflected in AR 00.15 (1 = locked, 0 = unlocked).

Why can I upload the program from the CQM1-CPU41 but cannot edit it?

Uploads (PLC -> PC) are read operations and are not blocked by SW7. Edits, downloads, and program clears are write operations and are blocked whenever SW7 is ON. Place the key switch in PROGRAM or MONITOR and set SW7 to OFF to allow edits.

Can I edit a CQM1-CPU41 program online while the controller is in RUN mode?

No. RUN mode disables all online edits. The key switch must be in MONITOR for online edit (rung overwrite) or in PROGRAM for a full download, transfer, or program clear. Operating-mode state is reflected in AR 00.13 / AR 00.14.

Which Omron programming cable do I need for the CQM1-CPU41 RS-232C port?

Use the XW2Z-200S-CV (2 m) or XW2Z-500S-CV (5 m) host-link cable for the DB-9 RS-232C port. These are straight-through host-link cables, not null-modem cables. For the peripheral port, use the CQM1-CIF01 (RS-232C) or CQM1-CIF02 (USB) adapter.

What is the correct CX-Programmer setting for the CQM1-CPU41 default host link?

Configure the C-series host link driver for 9 600 bps, 7 data bits, even parity, 2 stop bits, unit number 0. These match the default SW1-SW6 settings of OFF, OFF, ON, ON, OFF, OFF. Use CX-Programmer v9.7x (bundled in CX-One v4.x) on Windows 10/11, or CX-Programmer v3 / v4 on Windows XP / 7.

Does SW8 = ON affect the write-protect state?

No. SW8 controls the expansion-instruction set only. SW8 = ON enables advanced instructions such as PID, MSG, RXD/TXD, SCL, AVG, and HKY. SW8 = OFF forces the controller to reject any program containing these instructions at run time, producing an instruction-not-recognized error. The two switches are independent; toggle SW8 = ON whenever the program uses expansion instructions, and SW7 = OFF only when actively editing.

Back to blog