CQM1H-SCB41 Host Link to Red Lion DA30D: Setup Guide

James Nishida16 min read
OmronSerial CommunicationTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Overview: CQM1H-CPU51 to Red Lion DA30D via SCB41

The CQM1H-CPU51 is a member of the Omron CQM1H modular PLC family, supporting up to 512 I/O points, full instruction set including floating-point, and 15.2K words of program memory. It is widely deployed on legacy packaging, material handling, and machine tool cells where a C200H-style control architecture is preferred but where a compact modular footprint is required.

The Red Lion DA30D Data Station is an HMI / data-logging platform running Crimson 3.x software. It supports more than 300 industrial protocols out of the box, including an Omron "Series C" driver that is functionally a Host Link (SYSWAY) master. When configured correctly, the DA30D polls the CQM1H for I/O status, data register values, and counter PVs and renders them on a user-defined display page while also logging them to CSV/Excel for cycle-count trending.

The CQM1-SCB41 is a serial communication board that snaps into the option slot of a CQM1H-CPU51 CPU. It provides one additional RS-232C port (designated as port B on the CPU) plus port A on the CPU itself. The SCB41 does not use a standard IBM-PC RS-232C pinout; a custom wiring harness or adapter cable is mandatory to connect it to a Red Lion RJ-style or DB-9 port.

This guide consolidates the field-proven procedure for establishing Host Link communication between a CQM1H-CPU51 (with SCB41) and a Red Lion DA30D, including the critical "power-cycle after parameter change" behavior, the memory-area mapping that Host Link expects, and the most common tag-mapping errors that produce blank values on the DA30D display.

2. Prerequisites

Hardware required:

  • Omron CQM1H-CPU51 CPU unit (firmware any 3.x or higher; CQM1H was released circa 1999 and remains in supported life-cycle status — confirm with Omron Industrial Automation distributor for current part availability).
  • Omron CQM1-SCB41 Serial Communication Board (one RS-232C port) installed in the CPU option slot.
  • Power Supply Unit (CQM1-PA203, CQM1-PA206, or CQM1-PD026) sized for the rack and I/O load.
  • Red Lion DA30D Data Station with Crimson 3.x configuration software.
  • DB-9 male-female serial cable with custom SCB41 pinout (see Section 8).
  • CX-Programmer version 7.5 or higher (CX-One 4.x) for ladder upload and PLC setup editing.

Software required:

  • CX-Programmer 7.5 / 9.x with the CQM1H device support file installed.
  • Crimson 3.0 or 3.1 (build 3116 or higher recommended) for DA30D configuration.
Critical precondition: A live USB-to-serial or RS-232C port on the engineering PC is needed to upload the program and to verify Host Link with CX-Programmer's "Online Serial Communications Test" before connecting the DA30D.

3. Hardware Architecture

The integration uses a point-to-point serial topology. The CQM1H-CPU51 is the Host Link slave; the DA30D is the Host Link master. There is no daisy-chaining unless multiple slaves are addressed by changing the unit number on the PLC Setup.

Topology summary:

  • SCB41 connector (DB-9 male) → custom cable → DA30D Port 1 (DB-9 male RJ-style). Null-modem crossover required (TD↔RD, RTS↔CTS, DTR↔DSR, SG↔SG).
  • Cable length should not exceed 15 m (50 ft) at 9600 baud per RS-232C drive-strength limits.
  • Shielded cable recommended in plant environments; tie shield to chassis ground on one end only (DA30D end is preferred).

4. CQM1H PLC Setup in CX-Programmer

Open the CQM1H project in CX-Programmer and navigate to PLC → Edit PLC Setup. The following parameters must be set for Host Link operation on the SCB41 (port B):

PLC Setup Word Parameter Value (Host Link)
Word 161 Port B: communications mode 00 (Host Link)
Word 162 Port B: baud rate 00 (9600 bps)
Word 163 bits 00-07 Port B: data length / parity / stop 07 (7 data bits, even parity, 2 stop bits — i.e. 9600, 7, E, 2)
Word 164 Port B: unit number (slave #) 00 (set to 00 unless a multi-drop network is used)
Word 165 Port B: CTS control 0 (no CTS handshake) or 1 (CTS enabled) per DA30D requirements

For port A (CPU built-in RS-232C), the same setup words are at words 144-148 if the SCB41 is absent or if port A is used for the DA30D. Match exactly between both endpoints.

PLC Setup word 161 options:

Value Mode
00 Host Link (SYSWAY) — required for Red Lion Series C driver
01 RS-232C (no protocol, ASCII/binary free-run)
02 1:N NT Link (1:N connection to an Omron PT)
03 1:1 NT Link (master/slave to a single PT)
04 Peripheral bus (CX-Programmer upload only — do not select for Host Link)
Mandatory: power-cycle the PLC after writing PLC Setup to flash. CQM1H does not commit PLC Setup changes at runtime; the port will retain the previous baud, parity, and unit number until the power supply is removed and re-applied (capacitor-backed RAM is also insufficient — a true hard reboot is required). This is the single most common reason a brand-new Host Link connection returns no data on the first attempt.

5. SCB41 Serial Communication Board: Physical and Pinout Detail

The CQM1-SCB41 occupies the option slot on the front-right of the CQM1H-CPU51. The board has one DB-9 male connector labeled "PORT B" and a bank of DIP switches to select frame format when PLC Setup is not used. Because the CQM1H-CPU51 ignores the SCB41 DIP switches (PLC Setup overrides), leave SW1/SW2 on default or off, and rely exclusively on PLC Setup words 161-165.

SCB41 DB-9 pinout (per the CQM1H Operation Manual, section 8):

Pin Signal Direction (DTE perspective of the SCB41)
1 Not used
2 SD (Send Data, TXD) Output from SCB41
3 RD (Receive Data, RXD) Input to SCB41
4 RS (RTS, Request To Send) Output from SCB41
5 CS (CTS, Clear To Send) Input to SCB41
6 Not used
7 Not used (no DSR tied)
8 Not used
9 SG (Signal Ground) Common

This is the same DCE-style D-sub arrangement found on legacy Omron NS-series PTs and C200H peripherals, but it is not the same as a standard PC COM port (which has RD on pin 2 and SD on pin 3). A direct 1:1 DB-9 cable will not work — the cable must cross TX/RX and pass-through RTS/CTS.

6. Host Link (SYSWAY) Protocol Reference

Host Link is Omron's native point-to-point protocol used between a master (PT or HMI) and a slave (CP1/CJ/CS/CQM1H/CV-series). The CQM1H supports the standard frame format beginning with @ and terminated with * + \r (0x0D). All multi-word values are returned in 4-digit hex ASCII.

Frame structure (master → slave):

@[NN][CC][FA][Text][FCS]*\r

Where:

  • NN = 2-digit unit number (00-31) — must match PLC Setup word 164
  • CC = 2-letter command (RD, WD, RR, WR, RC, WC, RG, WG, TS, TR, etc.)
  • FA = first word address (4-digit hex, no leading "D" or "CIO")
  • Text = optional sub-fields (e.g. number of words to read)
  • FCS = 2-char 8-bit XOR checksum of all bytes between @ and the last char before FCS
  • \r = carriage return (0x0D)

Most commonly used Host Link commands for HMI integration:

Command Description Typical use on DA30D
RR Read CIO/IR/SR/LR/HR/AR area Discrete I/O, internal relays, contact status
WR Write CIO/IR/SR/LR/HR/AR area Command bits, lamp outputs
RD Read DM area (D0000-Dxxxx) Recipe values, cycle counts, runtime data
WD Write DM area Setpoints, time/date to PLC
RC Read timer/counter PV Batch counters, elapsed-time values
RG Read timer/counter status (bit) TT/CU contact equivalents
RE Read EM area (if CPU has EM banks) Data logging buffer
MM Read CPU model code DA30D initial handshake diagnostic
TS/TR Test/Set or Test/Reset single bit One-shot commands from HMI buttons

End code returned in the slave's response (always 2-digit hex, in positions 11-12 of the response frame):

End Code Meaning Likely cause on a CQM1H
00 Normal completion
01 Not executable in run mode TS/TR attempted against a read-only area or in PROGRAM mode attempted against run-only setting
02 Not executable in monitor mode Same family of issues
04 Address over area boundary DM address exceeds D6143; LR > L0199; HR > H0511
0B Not executable in current mode PLC in PROGRAM — switch to MONITOR/RUN
0C Not executable due to EM bank not set RE on an EM bank not in the EM bank register (word 270)
13 FCS error Baud, parity, or stop-bit mismatch — DA30D and PLC disagree
14 Format error Invalid command code, wrong frame length
15 Entry number data error Address is not a valid 4-digit hex value
16 Command not supported Command not valid for the target area
18 Frame length error More or fewer bytes than the command expected
23 Memory write-protected Attempted WD/WR into PLC Setup or read-only DM (D0000-D1999 user, D2000-D6143 protected by default — switchable in PLC Setup word 169)

7. Memory-Area Mapping for Host Link

When the DA30D Series C driver is configured, the address entered in Crimson is converted to a Host Link command and an absolute first-word address. The Red Lion Series C driver expects the prefix-less area notation used in CX-Programmer. The mapping is:

CX-Programmer Area Address Range (host-link numeric) Host Link cmd Notes
CIO 0-CIO 511 (IR) 0000-01FF RR / WR Bit-level: append 00-0F for bit 0-15
SR 232-SR 255 00E8-00FF (some use 0244-0255; check Crimson driver) RR Includes first-cycle flag, clock pulses
HR 0-HR 511 0000-01FF (with HR prefix in Crimson) RR / WR Retained across power cycle
AR 0-AR 959 0000-03BF (with AR prefix) RR Special relays, read-only from HMI
LR 0-LR 199 0000-00C7 RR / WR Inter-PLC link area
DM 0-DM 6143 0000-17FF RD / WD Workhorse data area; D0000-D1999 are user-only by default
TC 0-TC 2047 (PV) 0000-07FF RC Reads current value
TC 0-TC 2047 (status) 0000-07FF RG Reads completion flag bit
CRITICAL MAPPING PITFALL: The Red Lion Crimson "Series C" driver in some firmware revisions expects the first word as the plain hex offset, not the CX-Programmer visual address. For DM area, "D0200" in CX-Programmer becomes host-link address 00C8 (decimal 200 = hex 00C8). For CIO 0000-0015 in CX-Programmer, the host-link address is 0000-000F. For bit-level access the convention is 4-digit word address + 2-digit bit (e.g. 0000 03 = CIO word 0, bit 03). Misalignment here is the most common cause of "lights indicate I am talking thru the serial port but the data addressing from the Red Lion to what is in CX-Programmer don't really match up." Always verify the first polled address using CX-Programmer's Watch window before placing a tag on the DA30D.

8. SCB41-to-DA30D Cable Wiring

The following wiring diagram is valid for a Red Lion DA30D Port 1 (DB-9 male, RS-232C DCE). All signals must be crossed (null-modem style). Shield should be connected to chassis ground at the DA30D end and floated at the SCB41 end to prevent ground loops.

SCB41 (DB-9 Male, DCE) Pin Signal Direction DA30D (DB-9 Male, DCE) Pin Signal
2 SD (TXD from SCB41) 3 RD (into DA30D)
3 RD (into SCB41) 2 TXD (from DA30D)
4 RTS (from SCB41) 8 CTS (into DA30D)
5 CTS (into SCB41) 7 RTS (from DA30D)
9 SG 5 SG
Shell Shield Shell Shield (DA30D end only)

Maximum cable length: 15 m (50 ft) for reliable operation at 19,200 baud and below. For runs above 10 m, use shielded twisted pair with #24 AWG or larger conductors.

9. Red Lion DA30D Configuration in Crimson 3

Step-by-step procedure:

  1. Open the DA30D project in Crimson 3 and select Communication → Serial Ports.
  2. Set Port 1 to RS-232C, baud = 9600, data bits = 7, parity = Even, stop bits = 2. Flow control = None (most common) or RTS/CTS if PLC Setup word 165 is set to 1.
  3. Select the active protocol on Port 1: choose Omron → Series C (not FINS Master — FINS uses the same physical RS-232C but a different command set, with a different header, longer frames, and a 16-bit CRC). For an SCB41, FINS will not work; only Host Link (Series C) will work.
  4. Set the unit number (Node Address) to match PLC Setup word 164 (default 00).
  5. Set the Scan Time to 500-1000 ms; faster scans (<200 ms) overload the SCB41's modest buffering and cause intermittent end-code 0B (PLC not ready) responses.

9.1 Tag Configuration Example

To display CIO 0000.00 (an input from the machine, e.g. a cycle-limit switch):

  1. Open the Tags database in Crimson. Click New Tag.
  2. Name: CycleLimitSw; Type: Boolean; Source: PLC Address.
  3. Protocol: Omron Series C; Area: CIO; Word: 0; Bit: 0 (host-link notation 0000 00).
  4. Display scaling: leave at default (1:1).
  5. Drag the tag onto a display page and assign it to a discrete indicator. The DA30D will request Host Link command RR with first-word address 0000, 1 word, bit 0 → response is 0xF0 (bit 0 set) or 0x00 (bit 0 clear).

To display DM 0200 (a 16-bit cycle count):

  1. New tag CycleCount; Type: Integer (16-bit).
  2. Protocol: Omron Series C; Area: DM; Word: 200 (host-link address 00C8).
  3. Read/Write: Read Only if the PLC is the sole writer; otherwise enable Read/Write with a 200 ms read poll and 1 s write timeout.
  4. Drag the tag onto the display page and bind it to a numeric field with scaling 1:1.

10. Verification Procedure

  1. CX-Programmer loopback test: After writing the PLC Setup, disconnect the DA30D cable and connect the SCB41 directly to the engineering PC. In CX-Programmer, choose PLC → Connect → Serial Connection with the same 9600, 7, E, 2 settings. Click Online Workstation Monitor. If it connects, the SCB41 + PLC Setup is correct.
  2. Hard reboot: Remove power from the CQM1H for at least 10 seconds; re-apply. Confirm the COMM LED on the SCB41 blinks green for each valid Host Link frame.
  3. DA30D Diagnostic page: In Crimson, enable Diagnostic Display → Communication Status. Verify that polled frames are incrementing and the End Code is consistently 00.
  4. Watch window comparison: In CX-Programmer, open a Watch window with the same address as the tag (e.g. D0200). Set the DA30D display to show the tag value. Both should match within ±1 count due to scan-time race conditions.
  5. Crimson Data Logger: Configure a CSV log of CycleCount at 1 s interval. Force a change in the PLC and confirm the log records the new value. Confirm timestamp format is YYYY-MM-DD HH:MM:SS in the CSV output.

11. Troubleshooting Matrix

Symptom Likely Root Cause Fix
No data on DA30D, COMM LED on SCB41 dark Cable wiring reversed; no TD/RX crossover Re-wire per Section 8; check with oscilloscope on pins 2/3 for activity
COMM LED flickers, DA30D shows 0 or stale value PLC Setup not power-cycled Power down CQM1H for ≥10 s, re-apply
DA30D diagnostic shows end code 13 (FCS error) Baud, parity, or stop bits mismatch Re-confirm 9600, 7, E, 2 on both sides; check PLC Setup word 163
End code 14 (format error) FINS protocol selected on DA30D instead of Series C Switch Crimson protocol to Omron Series C (not FINS Master)
End code 04 (address over area) DM address above D6143 (17FF hex) or LR above 199 Adjust tag address; check unit number matches PLC
Tag shows 65535 for integer read Bit number misapplied on word access (Crimon picked bit 0 of a word where 0xFFFF is misread) Verify tag is word type, not bit; remove bit field
Discrete I/O read but DM returns 0 DM area write-protected (D2000+) and PLC Setup word 169 not set to allow writes Verify read path; writes to DM are not required for read-only logging
DA30D hangs after 2-3 minutes of polling SCB41 buffer overflow from over-polling Increase Crimson scan time to ≥500 ms; reduce tag count below 50 per port
Disconnected after PLC mode change (PROG ↔ RUN) Host Link unit number reset by PLC Setup reload Re-verify PLC Setup; power-cycle
Crimson compile error: "Unsupported address" Address uses CX-Programmer prefix (D, HR, CIO) instead of bare numeric Use only the numeric offset per Section 7 mapping table

12. Advanced Topics and Field Notes

12.1 Multi-drop on Port A or Port B

The CQM1H supports a single Host Link master per port. To log to the DA30D while leaving the existing machine SCADA on port A, place the DA30D on the SCB41 (port B) with unit number 00 and configure port A as Host Link unit 01 for the existing master. The two masters will poll the same CPU without conflict as long as the same data areas are not being written simultaneously.

12.2 Cycle-Count Persistence

Cycle counts written to DM 200-499 are retained across power cycle only if PLC Setup word 152 (DM hold bit) is set to 0 (retain). For long-term archival, enable the DA30D's Data Logger to write a timestamped CSV to a USB stick or FTP server at the end of each shift.

12.3 Replacement and Migration Path

For new deployments, the Omron CP1E-N30/N40DR-A or CP1L-EM30DR-D drop-in replacement supports the same Host Link command set and adds an Ethernet port for direct Modbus/TCP or FINS/TCP communication to a modern Red Lion Graphite HMI. The CQM1H-CPU51 is still supported for service and spare parts but is at end-of-life for new designs; consult Omron's product lifecycle portal before specifying a new design.

12.4 Diagnostic Frames

The CQM1H replies to a Host Link MM command with a 20-character model code: for a CQM1H-CPU51, the response begins with CQM1H and the CPU model number. Use this as a one-shot diagnostic when bringing the DA30D up: if Crimson is configured for "Series C" but the response comes back as end code 14, the wire is good but the protocol driver is wrong.

12.5 EMC / Industrial Environment Notes

In environments with VFDs or servo drives, place a ferrite clamp (Laird 28B0562-200 or equivalent) on the SCB41 cable within 50 mm of the SCB41 connector. This typically reduces induced common-mode noise by 8-10 dB and eliminates intermittent end-code 13 errors on long cable runs.

13. FAQ

Does the CQM1H-CPU51 require a power cycle after every PLC Setup change?

Yes. The CQM1H commits PLC Setup to flash only on a true power-down/power-up (≥10 s). PLC Setup word 161 (Host Link mode), word 162 (baud), word 163 (data/parity/stop), and word 164 (unit number) are not applied at runtime; a hard reboot is mandatory, or the SCB41 will continue to operate with the previous parameters.

Why is there no Host Link option in the Red Lion DA30D protocol list?

Red Lion labels the protocol "Omron Series C" in Crimson, which is functionally identical to Omron Host Link (SYSWAY). Do not select "FINS Master" — FINS is an Ethernet-based protocol that uses a 16-bit CRC and a different frame header; the SCB41 RS-232C port cannot run FINS.

What is the default serial frame format for a CQM1H Host Link port?

Factory default is 9600 bps, 7 data bits, even parity, 2 stop bits (9600, 7, E, 2). This matches the most common DA30D default profile. If the DA30D has been reconfigured for 19200 or odd parity, both ends must be updated and the PLC power-cycled.

Can I read a single bit (e.g. CIO 0.00) from the CQM1H using Host Link?

Yes. Use the RR command with a 4-digit word address and 2-digit bit suffix (e.g. 0000 00 for CIO word 0, bit 0). In Crimson, configure a Boolean tag with Word 0, Bit 0. The DA30D will issue RR 0000 0001 and decode the 0x01 response flag as the bit value.

How many tags can the SCB41 port sustain on a DA30D at 9600 baud?

At 500 ms scan time, the SCB41 reliably handles up to 50 polled tags (mixed word and bit). Above that, increase the scan time to 1000 ms or split the polling across port A and port B. The SCB41's 256-byte input buffer will overflow if a slow PLC response is followed by a fast burst of 10+ requests in a single scan window.

Why does my DM read return 65535 on the DA30D?

65535 (0xFFFF) is the uninitialized-pattern response when Crimson is configured for a 16-bit integer tag but the SCB41 is returning end code 04 (address over area). Verify the DM address does not exceed 6143 (decimal) and that the address is entered as a decimal value, not a CX-Programmer prefixed notation like D200.

Back to blog