1. Overview: CQM1H-CPU51 to Red Lion DA30D via SCB41
The CQM1H-CPU51 is a member of the Omron CQM1H modular PLC family, supporting up to 512 I/O points, full instruction set including floating-point, and 15.2K words of program memory. It is widely deployed on legacy packaging, material handling, and machine tool cells where a C200H-style control architecture is preferred but where a compact modular footprint is required.
The Red Lion DA30D Data Station is an HMI / data-logging platform running Crimson 3.x software. It supports more than 300 industrial protocols out of the box, including an Omron "Series C" driver that is functionally a Host Link (SYSWAY) master. When configured correctly, the DA30D polls the CQM1H for I/O status, data register values, and counter PVs and renders them on a user-defined display page while also logging them to CSV/Excel for cycle-count trending.
The CQM1-SCB41 is a serial communication board that snaps into the option slot of a CQM1H-CPU51 CPU. It provides one additional RS-232C port (designated as port B on the CPU) plus port A on the CPU itself. The SCB41 does not use a standard IBM-PC RS-232C pinout; a custom wiring harness or adapter cable is mandatory to connect it to a Red Lion RJ-style or DB-9 port.
This guide consolidates the field-proven procedure for establishing Host Link communication between a CQM1H-CPU51 (with SCB41) and a Red Lion DA30D, including the critical "power-cycle after parameter change" behavior, the memory-area mapping that Host Link expects, and the most common tag-mapping errors that produce blank values on the DA30D display.
2. Prerequisites
Hardware required:
- Omron CQM1H-CPU51 CPU unit (firmware any 3.x or higher; CQM1H was released circa 1999 and remains in supported life-cycle status — confirm with Omron Industrial Automation distributor for current part availability).
- Omron CQM1-SCB41 Serial Communication Board (one RS-232C port) installed in the CPU option slot.
- Power Supply Unit (CQM1-PA203, CQM1-PA206, or CQM1-PD026) sized for the rack and I/O load.
- Red Lion DA30D Data Station with Crimson 3.x configuration software.
- DB-9 male-female serial cable with custom SCB41 pinout (see Section 8).
- CX-Programmer version 7.5 or higher (CX-One 4.x) for ladder upload and PLC setup editing.
Software required:
- CX-Programmer 7.5 / 9.x with the CQM1H device support file installed.
- Crimson 3.0 or 3.1 (build 3116 or higher recommended) for DA30D configuration.
3. Hardware Architecture
The integration uses a point-to-point serial topology. The CQM1H-CPU51 is the Host Link slave; the DA30D is the Host Link master. There is no daisy-chaining unless multiple slaves are addressed by changing the unit number on the PLC Setup.
Topology summary:
- SCB41 connector (DB-9 male) → custom cable → DA30D Port 1 (DB-9 male RJ-style). Null-modem crossover required (TD↔RD, RTS↔CTS, DTR↔DSR, SG↔SG).
- Cable length should not exceed 15 m (50 ft) at 9600 baud per RS-232C drive-strength limits.
- Shielded cable recommended in plant environments; tie shield to chassis ground on one end only (DA30D end is preferred).
4. CQM1H PLC Setup in CX-Programmer
Open the CQM1H project in CX-Programmer and navigate to PLC → Edit PLC Setup. The following parameters must be set for Host Link operation on the SCB41 (port B):
| PLC Setup Word | Parameter | Value (Host Link) |
|---|---|---|
| Word 161 | Port B: communications mode | 00 (Host Link) |
| Word 162 | Port B: baud rate | 00 (9600 bps) |
| Word 163 bits 00-07 | Port B: data length / parity / stop | 07 (7 data bits, even parity, 2 stop bits — i.e. 9600, 7, E, 2) |
| Word 164 | Port B: unit number (slave #) | 00 (set to 00 unless a multi-drop network is used) |
| Word 165 | Port B: CTS control | 0 (no CTS handshake) or 1 (CTS enabled) per DA30D requirements |
For port A (CPU built-in RS-232C), the same setup words are at words 144-148 if the SCB41 is absent or if port A is used for the DA30D. Match exactly between both endpoints.
PLC Setup word 161 options:
| Value | Mode |
|---|---|
| 00 | Host Link (SYSWAY) — required for Red Lion Series C driver |
| 01 | RS-232C (no protocol, ASCII/binary free-run) |
| 02 | 1:N NT Link (1:N connection to an Omron PT) |
| 03 | 1:1 NT Link (master/slave to a single PT) |
| 04 | Peripheral bus (CX-Programmer upload only — do not select for Host Link) |
5. SCB41 Serial Communication Board: Physical and Pinout Detail
The CQM1-SCB41 occupies the option slot on the front-right of the CQM1H-CPU51. The board has one DB-9 male connector labeled "PORT B" and a bank of DIP switches to select frame format when PLC Setup is not used. Because the CQM1H-CPU51 ignores the SCB41 DIP switches (PLC Setup overrides), leave SW1/SW2 on default or off, and rely exclusively on PLC Setup words 161-165.
SCB41 DB-9 pinout (per the CQM1H Operation Manual, section 8):
| Pin | Signal | Direction (DTE perspective of the SCB41) |
|---|---|---|
| 1 | Not used | — |
| 2 | SD (Send Data, TXD) | Output from SCB41 |
| 3 | RD (Receive Data, RXD) | Input to SCB41 |
| 4 | RS (RTS, Request To Send) | Output from SCB41 |
| 5 | CS (CTS, Clear To Send) | Input to SCB41 |
| 6 | Not used | — |
| 7 | Not used (no DSR tied) | — |
| 8 | Not used | — |
| 9 | SG (Signal Ground) | Common |
This is the same DCE-style D-sub arrangement found on legacy Omron NS-series PTs and C200H peripherals, but it is not the same as a standard PC COM port (which has RD on pin 2 and SD on pin 3). A direct 1:1 DB-9 cable will not work — the cable must cross TX/RX and pass-through RTS/CTS.
6. Host Link (SYSWAY) Protocol Reference
Host Link is Omron's native point-to-point protocol used between a master (PT or HMI) and a slave (CP1/CJ/CS/CQM1H/CV-series). The CQM1H supports the standard frame format beginning with @ and terminated with * + \r (0x0D). All multi-word values are returned in 4-digit hex ASCII.
Frame structure (master → slave):
@[NN][CC][FA][Text][FCS]*\r
Where:
-
NN= 2-digit unit number (00-31) — must match PLC Setup word 164 -
CC= 2-letter command (RD, WD, RR, WR, RC, WC, RG, WG, TS, TR, etc.) -
FA= first word address (4-digit hex, no leading "D" or "CIO") -
Text= optional sub-fields (e.g. number of words to read) -
FCS= 2-char 8-bit XOR checksum of all bytes between@and the last char beforeFCS -
\r= carriage return (0x0D)
Most commonly used Host Link commands for HMI integration:
| Command | Description | Typical use on DA30D |
|---|---|---|
| RR | Read CIO/IR/SR/LR/HR/AR area | Discrete I/O, internal relays, contact status |
| WR | Write CIO/IR/SR/LR/HR/AR area | Command bits, lamp outputs |
| RD | Read DM area (D0000-Dxxxx) | Recipe values, cycle counts, runtime data |
| WD | Write DM area | Setpoints, time/date to PLC |
| RC | Read timer/counter PV | Batch counters, elapsed-time values |
| RG | Read timer/counter status (bit) | TT/CU contact equivalents |
| RE | Read EM area (if CPU has EM banks) | Data logging buffer |
| MM | Read CPU model code | DA30D initial handshake diagnostic |
| TS/TR | Test/Set or Test/Reset single bit | One-shot commands from HMI buttons |
End code returned in the slave's response (always 2-digit hex, in positions 11-12 of the response frame):
| End Code | Meaning | Likely cause on a CQM1H |
|---|---|---|
| 00 | Normal completion | — |
| 01 | Not executable in run mode | TS/TR attempted against a read-only area or in PROGRAM mode attempted against run-only setting |
| 02 | Not executable in monitor mode | Same family of issues |
| 04 | Address over area boundary | DM address exceeds D6143; LR > L0199; HR > H0511 |
| 0B | Not executable in current mode | PLC in PROGRAM — switch to MONITOR/RUN |
| 0C | Not executable due to EM bank not set | RE on an EM bank not in the EM bank register (word 270) |
| 13 | FCS error | Baud, parity, or stop-bit mismatch — DA30D and PLC disagree |
| 14 | Format error | Invalid command code, wrong frame length |
| 15 | Entry number data error | Address is not a valid 4-digit hex value |
| 16 | Command not supported | Command not valid for the target area |
| 18 | Frame length error | More or fewer bytes than the command expected |
| 23 | Memory write-protected | Attempted WD/WR into PLC Setup or read-only DM (D0000-D1999 user, D2000-D6143 protected by default — switchable in PLC Setup word 169) |
7. Memory-Area Mapping for Host Link
When the DA30D Series C driver is configured, the address entered in Crimson is converted to a Host Link command and an absolute first-word address. The Red Lion Series C driver expects the prefix-less area notation used in CX-Programmer. The mapping is:
| CX-Programmer Area | Address Range (host-link numeric) | Host Link cmd | Notes |
|---|---|---|---|
| CIO 0-CIO 511 (IR) | 0000-01FF | RR / WR | Bit-level: append 00-0F for bit 0-15 |
| SR 232-SR 255 | 00E8-00FF (some use 0244-0255; check Crimson driver) | RR | Includes first-cycle flag, clock pulses |
| HR 0-HR 511 | 0000-01FF (with HR prefix in Crimson) | RR / WR | Retained across power cycle |
| AR 0-AR 959 | 0000-03BF (with AR prefix) | RR | Special relays, read-only from HMI |
| LR 0-LR 199 | 0000-00C7 | RR / WR | Inter-PLC link area |
| DM 0-DM 6143 | 0000-17FF | RD / WD | Workhorse data area; D0000-D1999 are user-only by default |
| TC 0-TC 2047 (PV) | 0000-07FF | RC | Reads current value |
| TC 0-TC 2047 (status) | 0000-07FF | RG | Reads completion flag bit |
8. SCB41-to-DA30D Cable Wiring
The following wiring diagram is valid for a Red Lion DA30D Port 1 (DB-9 male, RS-232C DCE). All signals must be crossed (null-modem style). Shield should be connected to chassis ground at the DA30D end and floated at the SCB41 end to prevent ground loops.
| SCB41 (DB-9 Male, DCE) Pin | Signal | Direction | DA30D (DB-9 Male, DCE) Pin | Signal |
|---|---|---|---|---|
| 2 | SD (TXD from SCB41) | → | 3 | RD (into DA30D) |
| 3 | RD (into SCB41) | ← | 2 | TXD (from DA30D) |
| 4 | RTS (from SCB41) | → | 8 | CTS (into DA30D) |
| 5 | CTS (into SCB41) | ← | 7 | RTS (from DA30D) |
| 9 | SG | ↔ | 5 | SG |
| Shell | Shield | — | Shell | Shield (DA30D end only) |
Maximum cable length: 15 m (50 ft) for reliable operation at 19,200 baud and below. For runs above 10 m, use shielded twisted pair with #24 AWG or larger conductors.
9. Red Lion DA30D Configuration in Crimson 3
Step-by-step procedure:
- Open the DA30D project in Crimson 3 and select Communication → Serial Ports.
- Set Port 1 to RS-232C, baud = 9600, data bits = 7, parity = Even, stop bits = 2. Flow control = None (most common) or RTS/CTS if PLC Setup word 165 is set to 1.
- Select the active protocol on Port 1: choose Omron → Series C (not FINS Master — FINS uses the same physical RS-232C but a different command set, with a different header, longer frames, and a 16-bit CRC). For an SCB41, FINS will not work; only Host Link (Series C) will work.
- Set the unit number (Node Address) to match PLC Setup word 164 (default 00).
- Set the Scan Time to 500-1000 ms; faster scans (<200 ms) overload the SCB41's modest buffering and cause intermittent end-code 0B (PLC not ready) responses.
9.1 Tag Configuration Example
To display CIO 0000.00 (an input from the machine, e.g. a cycle-limit switch):
- Open the Tags database in Crimson. Click New Tag.
- Name:
CycleLimitSw; Type: Boolean; Source: PLC Address. - Protocol: Omron Series C; Area: CIO; Word:
0; Bit:0(host-link notation 0000 00). - Display scaling: leave at default (1:1).
- Drag the tag onto a display page and assign it to a discrete indicator. The DA30D will request Host Link command
RRwith first-word address 0000, 1 word, bit 0 → response is 0xF0 (bit 0 set) or 0x00 (bit 0 clear).
To display DM 0200 (a 16-bit cycle count):
- New tag
CycleCount; Type: Integer (16-bit). - Protocol: Omron Series C; Area: DM; Word:
200(host-link address 00C8). - Read/Write: Read Only if the PLC is the sole writer; otherwise enable Read/Write with a 200 ms read poll and 1 s write timeout.
- Drag the tag onto the display page and bind it to a numeric field with scaling 1:1.
10. Verification Procedure
- CX-Programmer loopback test: After writing the PLC Setup, disconnect the DA30D cable and connect the SCB41 directly to the engineering PC. In CX-Programmer, choose PLC → Connect → Serial Connection with the same 9600, 7, E, 2 settings. Click Online Workstation Monitor. If it connects, the SCB41 + PLC Setup is correct.
- Hard reboot: Remove power from the CQM1H for at least 10 seconds; re-apply. Confirm the COMM LED on the SCB41 blinks green for each valid Host Link frame.
- DA30D Diagnostic page: In Crimson, enable Diagnostic Display → Communication Status. Verify that polled frames are incrementing and the End Code is consistently 00.
- Watch window comparison: In CX-Programmer, open a Watch window with the same address as the tag (e.g. D0200). Set the DA30D display to show the tag value. Both should match within ±1 count due to scan-time race conditions.
-
Crimson Data Logger: Configure a CSV log of
CycleCountat 1 s interval. Force a change in the PLC and confirm the log records the new value. Confirm timestamp format is YYYY-MM-DD HH:MM:SS in the CSV output.
11. Troubleshooting Matrix
| Symptom | Likely Root Cause | Fix |
|---|---|---|
| No data on DA30D, COMM LED on SCB41 dark | Cable wiring reversed; no TD/RX crossover | Re-wire per Section 8; check with oscilloscope on pins 2/3 for activity |
| COMM LED flickers, DA30D shows 0 or stale value | PLC Setup not power-cycled | Power down CQM1H for ≥10 s, re-apply |
| DA30D diagnostic shows end code 13 (FCS error) | Baud, parity, or stop bits mismatch | Re-confirm 9600, 7, E, 2 on both sides; check PLC Setup word 163 |
| End code 14 (format error) | FINS protocol selected on DA30D instead of Series C | Switch Crimson protocol to Omron Series C (not FINS Master) |
| End code 04 (address over area) | DM address above D6143 (17FF hex) or LR above 199 | Adjust tag address; check unit number matches PLC |
| Tag shows 65535 for integer read | Bit number misapplied on word access (Crimon picked bit 0 of a word where 0xFFFF is misread) | Verify tag is word type, not bit; remove bit field |
| Discrete I/O read but DM returns 0 | DM area write-protected (D2000+) and PLC Setup word 169 not set to allow writes | Verify read path; writes to DM are not required for read-only logging |
| DA30D hangs after 2-3 minutes of polling | SCB41 buffer overflow from over-polling | Increase Crimson scan time to ≥500 ms; reduce tag count below 50 per port |
| Disconnected after PLC mode change (PROG ↔ RUN) | Host Link unit number reset by PLC Setup reload | Re-verify PLC Setup; power-cycle |
| Crimson compile error: "Unsupported address" | Address uses CX-Programmer prefix (D, HR, CIO) instead of bare numeric | Use only the numeric offset per Section 7 mapping table |
12. Advanced Topics and Field Notes
12.1 Multi-drop on Port A or Port B
The CQM1H supports a single Host Link master per port. To log to the DA30D while leaving the existing machine SCADA on port A, place the DA30D on the SCB41 (port B) with unit number 00 and configure port A as Host Link unit 01 for the existing master. The two masters will poll the same CPU without conflict as long as the same data areas are not being written simultaneously.
12.2 Cycle-Count Persistence
Cycle counts written to DM 200-499 are retained across power cycle only if PLC Setup word 152 (DM hold bit) is set to 0 (retain). For long-term archival, enable the DA30D's Data Logger to write a timestamped CSV to a USB stick or FTP server at the end of each shift.
12.3 Replacement and Migration Path
For new deployments, the Omron CP1E-N30/N40DR-A or CP1L-EM30DR-D drop-in replacement supports the same Host Link command set and adds an Ethernet port for direct Modbus/TCP or FINS/TCP communication to a modern Red Lion Graphite HMI. The CQM1H-CPU51 is still supported for service and spare parts but is at end-of-life for new designs; consult Omron's product lifecycle portal before specifying a new design.
12.4 Diagnostic Frames
The CQM1H replies to a Host Link MM command with a 20-character model code: for a CQM1H-CPU51, the response begins with CQM1H and the CPU model number. Use this as a one-shot diagnostic when bringing the DA30D up: if Crimson is configured for "Series C" but the response comes back as end code 14, the wire is good but the protocol driver is wrong.
12.5 EMC / Industrial Environment Notes
In environments with VFDs or servo drives, place a ferrite clamp (Laird 28B0562-200 or equivalent) on the SCB41 cable within 50 mm of the SCB41 connector. This typically reduces induced common-mode noise by 8-10 dB and eliminates intermittent end-code 13 errors on long cable runs.
13. FAQ
Does the CQM1H-CPU51 require a power cycle after every PLC Setup change?
Yes. The CQM1H commits PLC Setup to flash only on a true power-down/power-up (≥10 s). PLC Setup word 161 (Host Link mode), word 162 (baud), word 163 (data/parity/stop), and word 164 (unit number) are not applied at runtime; a hard reboot is mandatory, or the SCB41 will continue to operate with the previous parameters.
Why is there no Host Link option in the Red Lion DA30D protocol list?
Red Lion labels the protocol "Omron Series C" in Crimson, which is functionally identical to Omron Host Link (SYSWAY). Do not select "FINS Master" — FINS is an Ethernet-based protocol that uses a 16-bit CRC and a different frame header; the SCB41 RS-232C port cannot run FINS.
What is the default serial frame format for a CQM1H Host Link port?
Factory default is 9600 bps, 7 data bits, even parity, 2 stop bits (9600, 7, E, 2). This matches the most common DA30D default profile. If the DA30D has been reconfigured for 19200 or odd parity, both ends must be updated and the PLC power-cycled.
Can I read a single bit (e.g. CIO 0.00) from the CQM1H using Host Link?
Yes. Use the RR command with a 4-digit word address and 2-digit bit suffix (e.g. 0000 00 for CIO word 0, bit 0). In Crimson, configure a Boolean tag with Word 0, Bit 0. The DA30D will issue RR 0000 0001 and decode the 0x01 response flag as the bit value.
How many tags can the SCB41 port sustain on a DA30D at 9600 baud?
At 500 ms scan time, the SCB41 reliably handles up to 50 polled tags (mixed word and bit). Above that, increase the scan time to 1000 ms or split the polling across port A and port B. The SCB41's 256-byte input buffer will overflow if a slow PLC response is followed by a fast burst of 10+ requests in a single scan window.
Why does my DM read return 65535 on the DA30D?
65535 (0xFFFF) is the uninitialized-pattern response when Crimson is configured for a 16-bit integer tag but the SCB41 is returning end code 04 (address over area). Verify the DM address does not exceed 6143 (decimal) and that the address is entered as a decimal value, not a CX-Programmer prefixed notation like D200.