Integrating Omron CQM1H PLC with groov EPIC via Host Link

Integrating Omron CQM1H PLC with groov EPIC via Host Link

Field-proven reference for connecting Omron CQM1H series PLCs (CPU11/21/31/41/51/61) to an Opto 22 groov EPIC edge processor through a Modbus TCP to Host Link gateway. Covers protocol specifics, hardware selection, wiring, tag mapping, Node-RED implementation, and a complete troubleshooting matrix.

Integration Challenge

The CQM1H is a compact modular PLC widely deployed in machine and process control. It predates integrated Ethernet on the CPU module and exposes only serial interfaces:

• Peripheral port (4-pin mini DIN, RS-232 levels, used primarily for programming)
• RS-232C port (where equipped, used for Host Link, NT Link, or 1:1 links)
• Optional Serial Communications Board (CQM1H-SCB41) for additional RS-232/422/485 channels

The platform does not implement the FINS protocol used by newer Omron families (CJ/CS/NJ/NX). The only viable over-the-wire protocol for runtime data exchange is C-mode Host Link (C-mode command set) operating as an ASCII master/slave protocol over RS-232C. Confirm this against the CQM1H Series Programming Manual (W364).

The groov EPIC (GRV-EPIC-PR1 or GRV-EPIC-PR2) is an industrial edge processor that natively serves Modbus TCP, MQTT, OPC UA, and REST. It can host Node-RED flows and groov View HMIs. Bridging the CQM1H to groov EPIC therefore requires converting Host Link frames on a serial port into Modbus TCP register requests on Ethernet.

CQM1H Communication Architecture

The CQM1H family covers six CPU models. The CPU51 (16K words program capacity) and CPU61 (24K words, plus EM banks) are the most common in retrofit projects. Memory areas exposed over Host Link include CIO (I/O + internal), Work Relay (WR), Holding Relay (HR), Auxiliary Relay (AR), Data Memory (DM), Extended Memory (EM), and Timer/Counter Completion flags. The CQM1H Datasheet provides the current consumption and module selection data needed for power supply sizing; see W364 for the full memory map.

Host Link Protocol Fundamentals

C-mode Host Link is an ASCII framed master/slave protocol. A Host Link master (the gateway, in this case) initiates all transactions; the CQM1H only responds.

Single-frame read or write syntax:

Where:

• @ — start character (literal ASCII 0x40)
• NN — two-digit node address, ASCII hex (00–31 on CQM1H)
• CC — two-digit command code, ASCII hex (see table below)
• TEXT — variable-length ASCII payload (area selector, address, data)
• FCS — two-character Frame Check Sequence: 8-bit XOR of every byte from @ through the last character of TEXT, expressed as two ASCII hex digits
• * — terminator literal (ASCII 0x2A)
• [CR] — Carriage Return (ASCII 0x0D)

Common C-mode command codes accepted by the CQM1H:

Always validate command codes against the device-specific manual; C-mode command sets differ slightly between SYSMAC families. The CQM1H manual (W364) Appendix B documents the exact list accepted by the firmware.

Selecting the Integration Hardware

Three viable topologies bring CQM1H serial onto Ethernet:

1. Modbus TCP to Host Link gateway — dedicated converter such as a Moxa MGate 4101-MB-PBS, HMS Anybus X-gateway AB7649, or Weintek cMT-G series. The gateway polls the CQM1H over Host Link and exposes the data as Modbus TCP holding/input registers. Lowest-risk path, isolates the legacy serial bus from EPIC firmware updates.
2. Weintek cMT HMI with built-in protocol conversion — the HMI polls the PLC and exposes tags via Modbus TCP server, MQTT, or OPC UA. Useful when an HMI is already part of the scope.
3. groov EPIC GRV-CSERI-4 serial module — direct attachment of the CQM1H peripheral or RS-232C port to EPIC over RS-232/485; requires running a Host Link master inside Node-RED. Lower hardware cost but transfers protocol burden into application code.

Select a gateway that supports:

• C-mode Host Link slave with configurable node number (00–31)
• Modbus TCP server with both 16-bit and 32-bit register mapping
• RS-232C at 9,600 / 19,200 bps, even parity, 7 data bits, 2 stop bits (the CX-Programmer default)
• Per-request timeout ≥ 500 ms
• Configurable inter-frame delay (set ≥ 30 ms to avoid overrunning the CQM1H serial stack)
• Exportable configuration backup

Physical Wiring: Mini Peripheral Port to Gateway

The CQM1H peripheral port is a 4-pin mini DIN receptacle with the following pin assignment. Signal levels are RS-232.

For Host Link from the peripheral port, build a crossover cable to the gateway's DB-9 male RS-232C port:

If the gateway requires RTS/CTS handshaking (DB-9 pins 7 and 8), strap RTS to CTS at the gateway end or disable hardware flow control in the gateway configuration. The CQM1H peripheral port does not provide hardware handshaking.

Configuring the CQM1H Serial Port

The peripheral port must be set to Host Link slave mode using CX-Programmer (File → New → CQM1H, then double-click the peripheral port in the PLC Settings dialog):

Transfer the settings to the PLC and cycle power if prompted. Confirm the CPU is in Run or Monitor mode; Host Link slaves do not refuse reads in Program mode, but write attempts to non-writable areas return end code 0x2102 ("not executable in current mode" or "area protected").

Configuring the Modbus TCP to Host Link Gateway

Although exact menus vary by manufacturer, the gateway must be told four things:

1. Serial side: Host Link slave, node address matching the PLC, baud 9,600, 7E2.
2. Polling map: which CQM1H memory areas to read, at what rate, into which Modbus register offsets. A typical temperature poll is:
   • DM D00100–D00109 → Modbus Holding Registers 400100–400109 (10 words, 1 s poll)
   • CIO 0000 (bit inputs) → Modbus Input Registers via the gateway bit-pack function
3. Ethernet side: static IP, Modbus TCP server port 502, unit ID 1, ≥ 4 simultaneous masters allowed.
4. FCS and timeout: enable FCS checking on Host Link; set request timeout to 800 ms and inter-frame delay to 50 ms to avoid overrunning the CQM1H serial stack.

Export the gateway configuration backup before commissioning and store it in the project documentation folder.

groov EPIC Modbus TCP Client Setup

Register the gateway as a Modbus TCP device on the EPIC. From groov Manage → Devices and Tags → Modbus TCP/IP Devices, create a new device with these parameters:

Import tags by browsing the gateway's register map or by manually entering each address. The EPIC tag server will expose Modbus holding register 400100 as CQM1H_Shop1:D100 by default; rename tags to match engineering units (e.g., Tank1TempC) and apply scale factor 0.1 and offset 0 to convert the PLC's BCD-encoded 0–1000 reading to engineering units (0.0–100.0 °C).

Register and Tag Mapping Reference

Map CQM1H memory areas to Modbus holding/input registers consistently across the project:

Document the mapping table inside the EPIC project and replicate it in the gateway configuration file so future engineers can trace a Modbus register back to the original CQM1H area.

Node-RED Implementation Alternative

When a dedicated gateway is unavailable or when the project scope calls for custom processing, the groov EPIC's Node-RED runtime can act as a Host Link master. Two routes exist:

1. Use node-red-contrib-modbus with a TCP-attached gateway as above. This is the recommended path for production.
2. Use the node-red-node-serialport node plus a custom JS function to assemble Host Link frames, attaching a GRV-CSERI-4 module directly to the CQM1H peripheral or RS-232C port.

Example Host Link read frame builder (single-word read from DM D00100 on node 00):

// Build C-mode Host Link read DM frame
const node = "00";
const cmd  = "RD";   // Read DM, current bank
const addr = "0100"; // DM word address, 4-digit hex
const cnt  = "0001"; // 1 word to read
const text = node + cmd + addr + cnt;
function fcs(s) {
  let x = 0;
  for (let i = 0; i < s.length; i++) x ^= s.charCodeAt(i);
  return ("0" + x.toString(16).toUpperCase()).slice(-2);
}
const frame = "@" + text + fcs(text) + "*\r";
msg.payload = Buffer.from(frame, "ascii");
return msg;

Pair the function node with a serial request node (serial-port configured at 9,600 7E2) and a parser that strips the echoed frame, leaving the response payload for the next stage. Write a second function node that performs the same FCS check on the response and surfaces end codes as msg.error for alerting.

Expose the resulting values as Modbus TCP server registers using modbus-flex-server, or publish them to the EPIC tag server through the Ignition Edge OPC UA server if licensed.

Verification and Diagnostics

After wiring and configuration, walk the following checks in order:

1. Power-on: confirm the CQM1H RUN LED is lit, the gateway shows link on its RS-232C port LEDs, and the groov EPIC shows the Modbus device as Connected.
2. Raw serial test: from a laptop running a terminal emulator at 9,600 7E2, send the frame @00RD01000001<FCS>*<CR> (compute FCS over 00RD01000001; the result is two ASCII hex characters). The PLC should respond within 50–150 ms with @00RD00XXXX*<CR> where XXXX is the value in DM 100.
3. Gateway poll: from the gateway's diagnostic page, force a single read and confirm the value matches the manual read.
4. EPIC tag live value: open groov View or the tag server page; the tag should update within the configured poll interval.
5. Round-trip write test: write a value to a non-critical DM word (e.g., D00200) and confirm it lands; reset immediately afterward.

Successful completion of all five steps is the minimum acceptance criterion for moving from commissioning to operations.

Troubleshooting Matrix

Field Commissioning Checklist

• Confirm CX-Programmer upload of the PLC program as a backup (.cxp or .csm) before any changes.
• Record the CQM1H CPU model, DIP switch positions, and current port settings.
• Photograph the wiring between the CQM1H, gateway, and EPIC; attach to the commissioning report.
• Export the gateway configuration and tag it with site, PLC serial, and date.
• Validate write paths on a dummy DM word before enabling any production writes.
• Capture a baseline trace from a serial monitor during a full poll cycle; archive with the project.
• Schedule periodic polls of AR 1300 (fatal fault word) and AR 1413 (non-fatal fault word) to surface CPU faults in the EPIC.

Document References

Cross-check command codes, port pin assignments, and DIP-switch positions against the official CQM1H Series Programming Manual (W364-E1-) and the CQM1H Datasheet. The Host Link command set varies slightly between C-mode and FINS-mode devices; do not assume CV-series or CS-series command codes apply to the CQM1H without verification.

Frequently Asked Questions