OMRON C28K Replacement: Migrating to CPM1A with Host Link Communication

The OMRON C28K-CDR-A and related K-series "shoebox" programmable controllers have been obsolete since March 2002, leaving hundreds of machines in service with no factory support, dwindling spare parts, and degraded relay output contacts. This reference documents the field-proven migration path from a failing C28K to a current-generation CPM1A-30CDR-A-V1, including host link cabling (LK201 and C500-CN220-EU equivalents), program extraction using LSS or Syswin, password recovery considerations, and step-by-step I/O re-termination so the swap is transparent to the controlled machine.

Problem Overview: OMRON C28K Hardware Failure

The symptom that typically triggers this migration is one or more output points failing to energize consistently, with visible discoloration on the relay contacts or the printed-circuit board around the output terminals. On the C28K-CDR-A, output relays are socketed inside the housing; while individual relay replacement is mechanically possible, the underlying issue is the age of the unit — many of these controllers are now 25+ years old with electrolytic capacitors, optocouplers, and the CPU quartz resonator all approaching end-of-life. Replacement of the entire controller, not just the relay, is the only reliable long-term fix.

The OMRON K-series comprises the C20K, C28K, C40K, and C60K CPUs and is part of the original "shoebox" generation that preceded the CQM1, CPM1A, and CPM2A families. Discontinuation of the K-series in March 2002 means new units, factory repair, and most firmware updates are no longer available. Sourcing a "new old stock" C28K on the surplus market usually means buying another 20- to 25-year-old unit with the same aging profile and a higher probability of latent faults.

C28K-CDR-A Model Specifications and I/O Mapping

The model number encodes the controller configuration. The user's unit is designated C28K-CDR-A with the suffix 22Z5C:

Base I/O count on a C28K is 16 inputs (word IR 000) and 12 outputs (word IR 010), totaling 28 points. Note that the suffix -D variant referenced in field reports denotes the DC-powered equivalent (24 VDC supply, same I/O count). Both share the same peripheral port pinout and use the same instruction set, so a program written for one runs unmodified on the other after a peripheral-port upload.

Root Cause Analysis: Aging Relays and Discontinued K-Series

Three failure modes converge on the C28K at this age:

1. Relay contact wear. The G6B-family relays inside the C28K are rated for 100,000 operations at rated load (2 A, 250 VAC resistive) and 200,000 operations at lower loads. Machines running 8–16 hours/day, 250 days/year with mixed inductive loads (solenoids, motor starters) typically exceed 50% contact life by year 15 and reach end-of-life between years 18 and 22. Burned output terminals indicate arcing damage propagated to the PCB trace.
2. Electrolytic capacitor drift. The internal 5 VDC and 24 VDC rail filter capacitors drift in ESR and capacitance after 15+ years at elevated ambient temperature. Symptoms include CPU watchdog faults (ERR LED) during cold-start in cold environments and intermittent communication dropouts on the peripheral port.
3. Discontinuation impact. OMRON discontinued the C20K/C28K/C40K/C60K family in March 2002. Spare CPU boards, I/O boards, and replacement relays are only available through surplus channels with no traceability or warranty. Syswin (the last officially supported programming environment for the C-series) reached end-of-life status alongside the hardware.

Migration Path: CPM1A-30CDR-A-V1 Replacement Strategy

The CPM1A-30CDR-A-V1 is the direct functional replacement for the C28K-CDR-A. It provides the same 24 VDC input structure, the same relay output structure, the same AC power supply input range, and 30 I/O points (18 inputs, 12 outputs) instead of the C28K's 28. The two extra inputs can be left unused or repurposed for new sensors. Confirm the unit on the official OMRON industrial automation product pages before ordering.

The CPM1A instruction set is a superset of the C-series basic set used in the C28K. Programs uploaded from the C28K run on the CPM1A without code modification in the vast majority of cases. The two notable exceptions are (a) any instructions referencing SR area flags that changed numbering between C-series and CPM1A, and (b) any TIM/CNT high-speed counter usage, which requires re-mapping in the CPM1A's HR/AR area.

Alternative Replacement Targets

Host Link Communication: LK201 Module and Cable Selection

Host Link is OMRON's RS-232C/RS-422 master-slave protocol for programming, monitoring, and data exchange. The C28K exposes Host Link only through its peripheral port (RS-422 levels, OMRON proprietary 4-pin mini-DIN), while the CPM1A offers a peripheral port and a built-in RS-232C port (DB-9 male), both configurable for Host Link (SYSWAY) mode.

LK201 Host Link Module

The LK201 is an OMRON Host Link interface module used in many C-series racks. It terminates the peripheral-port RS-422 signals and presents a standard 25-pin D-sub RS-232C female on the front of the module. When the LK201 is connected to a C28K peripheral port, the host PC sees a standard COM port and can run Syswin, LSS, or CX-Programmer at 9,600 or 19,200 bps. The LK201 also supplies the 5 VDC bias that the C28K peripheral port requires, so it cannot be replaced with a passive cable.

C500-CN220-EU Cable Equivalents

The C500-CN220-EU is a 2-meter peripheral-port extension cable with a male mini-DIN on one end and a female mini-DIN on the other, used to route the C28K peripheral port to a LK201 mounted remotely. This is a passive cable — no electronics inside — so it can be hand-built using the OMRON pinout. Refer to the C-series Peripheral Port documentation on the OMRON Industrial Automation portal for the exact shield and twisted-pair requirements.

CPM1A Direct Connection (No LK201 Required)

For the CPM1A replacement, the LK201 is unnecessary in most cases because the CPM1A's built-in RS-232C port (DB-9 male) operates in Host Link mode by default. A standard shielded DB-9 female-to-DB-9 female straight-through cable (OMRON part XW2Z-200S or equivalent, 2 m) connects the CPM1A directly to the PC's COM port or USB-to-serial adapter. Configure port settings in CX-Programmer as 9,600 bps, 7 data bits, even parity, 2 stop bits (default Host Link).

Program Backup: LSS vs Syswin vs CX-Programmer

Three programming environments are candidates for program extraction from the C28K. Only two of them support the C-series.

Recommended Upload Procedure (Syswin)

1. Connect LK201 to C28K peripheral port, then to PC COM port (or USB-serial adapter). Apply 100–240 VAC to the C28K and place the mode switch in RUN.
2. Start Syswin 3.x. Choose File > New, set PLC Type to C28K, CPU Type to C28K-CDR-A.
3. Set the COM port, baud rate (9,600 default), and node address (00 for C-series default).
4. Select Online > Connect. The status bar should show "Connected: C28K."
5. Select PLC > Upload from PLC. If the program is password protected, Syswin prompts for the 4-digit password before the upload begins.
6. Save the uploaded program as .c28 (Syswin binary) and as .cxt export for archival.

Conversion for Download to CPM1A

Syswin can convert a C28K program to a CPM1A target through the PLC > Change PLC Type menu. CX-Programmer can also import a Syswin .cxt file via File > Open CX-Programmer Project and then change the device type to CPM1A. After conversion, verify each instruction manually for I/O address remapping (CPM1A inputs are 000.00–001.01; outputs remain 010.00–010.11). Reference the OMRON CX-Programmer operation manual for the exact migration wizard behavior.

Password Protection: Detection and Removal

The C28K supports a 4-digit decimal password (0000–9999) stored in the program header. When set, Syswin and LSS both refuse to upload or go online in monitor mode until the password is supplied. There is no manufacturer backdoor or master password; OMRON considers the password final.

Detection Steps

1. Attempt upload in Syswin. If password protected, the prompt appears immediately.
2. Check the C28K's front-panel MODE switch position — passwords are honored in PROGRAM, MONITOR, and RUN positions but are not required to clear memory or change the mode switch position.
3. Set the mode switch to PROGRAM, select PLC > Clear All Memory Areas in Syswin. If the program is not password protected, this clears the user program and resets to factory defaults, including the password slot.

Recovery Without the Password

There is no software-only bypass. Field-proven options are:

• Brute-force with Syswin — write a simple loop that tries passwords 0000–9999. At 4 passwords/second over Host Link, the full keyspace exhausts in ~40 minutes. Some Syswin versions throttle this automatically.
• Contact the machine OEM — original equipment builders frequently archive the program with the password recorded in the documentation package.
• Re-create the program from scratch — if a printed ladder diagram exists or the I/O list and sequence-of-operation are known, the program can be re-entered manually. C28K ladder is simple enough that this is feasible for programs under 800 rungs.

Step-by-Step Migration Procedure

Plan a 4- to 6-hour maintenance window for the complete swap, including I/O re-termination, program upload, verification, and machine restart.

Phase 1 — Pre-Migration Preparation

1. Document the existing wiring: photograph the C28K terminal strips from multiple angles, label each wire with the IR address it connects to (000.00–000.15 for inputs, 010.00–010.11 for outputs).
2. Upload the C28K program via Syswin on a laptop running outside the cabinet. Save the file in two locations.
3. Confirm the password situation. If unknown, run the brute-force loop in advance so the program is ready before the maintenance window.
4. Verify the CPM1A-30CDR-A-V1 unit powers up on the bench with a known-good 120 VAC supply and that the PWR and RUN LEDs illuminate.

Phase 2 — Mechanical Swap

1. De-energize the machine. Lock out and tag out (LOTO) per OSHA 1910.147 / equivalent.
2. Remove each input and output wire from the C28K terminal block, leaving the wire labels attached.
3. Unbolt the C28K from the DIN rail or panel mount. Note that the CPM1A-30CDR-A-V1 has the same 35 mm DIN-rail clip footprint, so no drilling is required if DIN-rail mounted.
4. Mount the CPM1A in the same location. Confirm the AC supply wiring terminals (L, N, ⏚) match the C28K's terminal layout; both use the same input range (100–240 VAC).

Phase 3 — I/O Re-termination

The CPM1A-30CDR-A-V1 has the following terminal layout (top to bottom of the removable terminal block):

1. Reconnect each input wire to the corresponding CPM1A input terminal. The CPM1A input common is internal; 24 VDC sourcing sensors connect directly.
2. Reconnect each output wire to the corresponding CPM1A output terminal. The COM terminals are internally jumpered on the CPM1A.
3. Connect any spare inputs (000.16, 000.17) to a known-good 24 VDC source so they read as OFF in the program (or leave open if the program treats them as NC).

Phase 4 — Program Download and Verification

1. Connect the CPM1A's RS-232C port (DB-9 male) directly to the PC with an XW2Z-200S or equivalent straight-through cable.
2. Open CX-Programmer 9.x. Create a new project, select PLC Type CPM1A, CPU Type 30CDR-A-V1.
3. Go online: PLC > Work Online. Confirm communication at 9,600 bps, 7-E-2.
4. Download the converted program: PLC > Transfer > To PLC. The dialog allows transferring the program only, or program + DM + HR.
5. Switch the CPM1A to RUN mode. Verify that the PWR, RUN, and COMM LEDs behave normally (PWR solid green, RUN solid green, COMM flicker during Host Link traffic).

Verification and Commissioning Checklist

Long-Term Reliability and Sourcing Considerations

The CPM1A-30CDR-A-V1 carries a current production status with no announced end-of-life, but OMRON has migrated new designs toward the CP1E series. If the controlled machine has a 10+ year service horizon, consider the CP1E-N30DR-A as a future migration target. The CP1E instruction set is a strict superset of the CPM1A, so the program written today will require only a CPU-type change in CX-Programmer 9.x when the next migration is needed.

For C28K-CDR-A units kept as spares or used as test fixtures, install a fresh CR633 battery-backed RAM module and document the program password on a label affixed to the inside of the cabinet door. Replace the socketed G6B relays every 7 years or 100,000 operations, whichever comes first. This service interval keeps the unit in a known-good state while it remains in service.

Frequently Asked Questions