Omron CJ1M to CPM1A RS422 Host Link: TXD/RXD Programming Guide

System Overview

This reference describes a point-to-multipoint RS422/485 network built from one CJ1M-CPU13 acting as a Host Link master and two CPM1A-40IDR (40I family) CPUs acting as Host Link slaves. Each slave is fitted with a CPM1-CIF11 RS422/485 adapter on its peripheral port; the master is fitted with a CJ1W-CIF11 RS422/485 option board on its option board slot. The physical layer is 4-wire differential (RS422 full duplex) and the application layer is the Omron Host Link (SYSWAY) command set using the TXD(236), RXD(235), and FCS(180) instructions on the master. The application goal is to read three words from each CPM1A and write three words back to each CPM1A, with the CJ1M orchestrating all transactions.

The architecture deliberately uses Host Link (not PC Link, not NT Link, not 1:1 PLC Link) because the CJ1M must control the data flow, the CPM1A CPUs do not support PC Link between more than two units, and the CJ1M does not have a CP1L-style serial port 2 that can be reconfigured as a PC Link master for the CPM1A family. Host Link over RS422 is the supported multi-vendor multi-drop configuration documented in the Omron CS/CJ Serial Communications Manual (Cat. No. W345).

Prerequisites and Hardware Inventory

All PLCs must use the same serial parameters. The de-facto Host Link defaults are 9600 bps, 7 data bits, even parity, 2 stop bits (commonly written 9600,7,E,2). Do not change these from the factory defaults unless all three PLCs are reconfigured in the same way. The manual protocol-mode description "RS232C" in the CJ1M I/O table dialog simply means "the port is in serial-protocol mode driven by TXD/RXD"; the physical driver on the option board is RS422 or RS485. See the CS/CJ Serial Communications Manual (W345) section 2 for the relationship between the port-mode setting and the physical layer.

Physical Layer: RS422 Wiring and Pinout

RS422 is a 4-wire differential, full-duplex bus. Each node has a dedicated transmit pair (SDA/SDB) and a dedicated receive pair (RDA/RDB). Because every node is listening on its own receive pair simultaneously, a true multi-drop Host Link bus daisy-chains the transmit pair of the master into the receive pair of every slave in parallel and the transmit pair of every slave into the receive pair of the master in parallel. Termination is required at the two physical ends of the bus only.

Keep the shield continuous from end to end and ground it at one point only (typically the master cabinet ground). The Omron IA Global site hosts the SYSMAC CJ1 Series Catalog (Cat. No. P052) which documents cable construction and maximum bus length versus baud rate.

Protocol Selection: Host Link vs PC Link vs 1:1 PLC Link

Three Omron serial protocols could theoretically move data between these CPUs. Each has restrictions that disqualify it for this topology, with one exception.

Host Link is the only Omron serial protocol that all three of these CPUs can speak on the same physical bus. The CJ1M becomes the master, polls each slave in turn, and the slaves only respond when addressed. There is no peer-to-peer traffic between the two CPM1A PLCs; if data must be exchanged between them, the CJ1M reads from one and writes to the other.

Configuring the CJ1M-CPU13 Serial Port

The CJ1W-CIF11 option board occupies slot 1 of the CJ1M CPU's option board bay. The port is logically Serial Port 1 on the option board. The following PLC Setup words must be programmed either through CX-Programmer's PLC Settings dialog or by writing the values from ladder at first scan. The values shown are the W345 defaults for Host Link on a 4-wire RS422/485 option board.

Configuring the CPM1A-40I Slave Ports

On the CPM1A, the peripheral port (the round mini-DIN on the CPU) is repurposed as an RS422/485 port by the CPM1-CIF11 adapter. The peripheral port protocol, unit number, and serial format are configured in DM 6650–DM 6653. The factory defaults are normally already correct for Host Link slave operation, but they must be verified.

Pin 5 of the CPM1A's built-in RS232C port (not the peripheral port) has historically caused an EX header to be appended to responses on older CQM1 CPUs. This is a CQM1-specific issue and does not affect the CPM1A's peripheral port when the CIF11 is fitted, but flag the pin for any technician migrating the design to a CQM1 platform.

Host Link Frame Structure and FCS Calculation

Every Host Link command has the same envelope. The 8-bit Frame Check Sum (FCS) is the two's complement of the XOR of every byte between @ and the last byte of the data field. Many programmers implement the OMRON FCS calculation as: start with 0x00, XOR each ASCII byte, take the one's complement, then take the two's complement (or equivalently XOR with 0xFF). The result is two ASCII-hex characters that are appended before the terminator.

@ [unit#] [header] [text] [FCS hi] [FCS lo] [terminator]
   2 chars   2 chars  n chars    2 chars      1 char (0x0D)

Example command to read 3 words starting at DM 0000 in slave unit #1:

ASCII :  @  0  1  R  R  0  0  0  0  0  0  0  3  F  C  S  CR
HEX   : 40 30 31 52 52 30 30 30 30 30 30 30 33 -- -- -- 0D

The RR header is the read-DM-area command. The first four digits after the header are the starting word address in BCD. The next four digits are the number of words in BCD. The two FCS bytes are computed across bytes 1 through 12 (the characters from 0 to 3). A worked example using 8-bit XOR then one's complement:

0x30 ^ 0x31 ^ 0x52 ^ 0x52 ^ 0x30 ^ 0x30 ^ 0x30 ^ 0x30 ^ 0x30 ^ 0x30 ^ 0x30 ^ 0x33 = 0x7E
One's complement of 0x7E = 0x81
Two's complement of 0x81 = 0x7F
ASCII FCS characters = '7' and 'F' (0x37 0x46)

The Omron FCS(180) instruction does exactly this calculation in ladder. Place the source string starting at the @ character with control words C+1, C+2 specifying the start offset and length to be included in the checksum. The instruction writes the two ASCII FCS bytes to C+3 and C+4.

Master Ladder Logic: TXD/RXD/FCS Polling Sequence

The CJ1M runs a single state machine that walks through six states for each poll cycle: build a write command for slave #1, calculate FCS, transmit, wait for response or timeout, build a read command, repeat for slave #2. Two 200-step ladder rungs fit comfortably. The sequence below is the canonical implementation referenced throughout the W345 manual's example programs.

State 0 — Build write command for slave #1

Pre-load the following ASCII characters into the string buffer starting at D01000:

D01000 : '@' (0x40)         -- Start of frame marker
D01001 : '0' (0x30)         -- Unit #1, tens
D01002 : '1' (0x31)         -- Unit #1, ones
D01003 : 'W' (0x57)         -- Write DM command
D01004 : 'R' (0x52)         -- DM area specifier
D01005 : '0' (0x30)         -- Start address, thousands
D01006 : '0' (0x30)         -- Start address, hundreds
D01007 : '0' (0x30)         -- Start address, tens
D01008 : '0' (0x30)         -- Start address, ones
D01009 : '0' (0x30)         -- Word count, thousands
D01010 : '0' (0x30)         -- Word count, hundreds
D01011 : '0' (0x30)         -- Word count, tens
D01012 : '3' (0x33)         -- Word count, ones (3 words)
D01013..D01024 : 3 words × 4 ASCII hex chars = 12 bytes of data
D01025 : placeholder for FCS high
D01026 : placeholder for FCS low
D01027 : CR (0x0D)

Copy the three data words from D00050–D00052 (the CJ1M's source registers) and convert each to four ASCII-hex characters using HEX(–) or a custom BCD-to-hex routine before storing in D01013–D01024.

State 1 — Calculate FCS

FCS(180)
   S   : D01000      ; pointer to first byte of string
   C   : D01028      ; control block:
                     ;  C+1 = D01029 = 0 (start offset, 0 = '@')
                     ;  C+2 = D01030 = 24 (length: bytes 0 through 23)
                     ;  C+3 = D01031 (FCS high returned here)
                     ;  C+4 = D01032 (FCS low returned here)

Move the two computed FCS bytes from D01031/D01032 into D01025/D01026 (the placeholders built in State 0).

State 2 — Transmit

TXD(236)
   S   : D01000      ; source string
   C   : D01033      ; control block:
                     ;  C = 0000 (port 1, no protocol macro, binary mode)
                     ;  C+1 = 28 (number of bytes to send: 25 ASCII + 2 FCS + 1 CR)
                     ;  C+2 = 0 (no offset)

State 3 — Wait for response with timeout

Use the Port 1 Port Re-Execute bit A526.13 to monitor transmission complete. Arm a 1-second TIM instruction in parallel. If the response is not received before the timer expires, the CJ1M increments an error counter and aborts the current slave's transaction.

State 4 — Receive response with RXD

RXD(235)
   D   : D02000      ; destination buffer
   C   : D02050      ; control block:
                     ;  C = 0000 (port 1, store raw bytes)
                     ;  C+1 = 30 (max bytes to receive)
                     ;  C+2 = 0 (no offset)

The expected response is @01WR…FCS CR for a successful write or @01ERFCS CR for an error. The error code 0x0F inside the ER response means the slave did not recognize the command; 0x10 means the command was rejected; 0x11 means the starting address is out of range. See W345 section 5-2 for the full error-code table.

State 5 — Build read command for slave #1, then repeat for slave #2

Build the read command (RR header) the same way. After both slaves have been polled, return to State 0 and begin the next cycle. A typical poll period of 100–500 ms is sufficient for a 3-word read/write on a 9600 baud bus.

State machine summary

Function Block Alternative: _CPU015_TXD and _CPU015_RXD

If a programmer is migrating the design to a CPU11/21, the two FBs encapsulate the TXD and RXD sequences above and reduce the state machine to a single call per transaction. The function block bodies expect a control block of the form:

Control word for _CPU015_TXD:
   W0 = port number (1 = option board)
   W1 = source DM address of string
   W2 = byte count to send
   W3 = completion flag (set by FB)
   W4 = error code (set by FB)

The same gotcha with the starting DM being 0 applies: the string's first byte (the @ marker) must be at a non-zero DM offset or the CJ1M will not transmit anything. The reference test string is 0x40 0x30 0x30 0x52 0x52 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x31 0x31 0x2A 0x0D, with the two FCS placeholders in 0x12 and 0x13.

Port Error Recovery Procedure

On the CJ1M, the serial port error flags live in the auxiliary area:

When Host Link polling stalls and the port is stuck, the field-proven recovery is:

1. Force the restart bit A526.13 = 1 for one scan.
2. Move the constant #0001 into A528 to clear all port-1 error flags.
3. Disable polling for 100 ms to allow the port to reinitialize.
4. Resume the state machine from State 0.

This four-step sequence restores the port without requiring a power cycle and is documented in the troubleshooting section of the CS/CJ Serial Communications Manual (W345). The same procedure applies to CS1 series CPUs on their serial port 1 or 2.

Multi-Drop Addressing and Polling Discipline

RS422 supports up to 32 drivers on the bus, but Host Link is a strict master/slave protocol: only one node transmits at a time, and slaves only respond when addressed. The CJ1M must therefore interleave transactions with a guard time equal to the maximum slave response time, typically 100 ms at 9600 baud. If the CJ1M is also using the same option-board port to talk to an HMI, that HMI must be off the bus or on a separate port — Host Link does not allow the HMI to interleave reads on the same bus while the CJ1M is polling the CPM1A PLCs.

Verification and Commissioning Checklist

1. Confirm DM 6650 on each CPM1A is unique and matches the addresses hard-coded in the CJ1M's TXD frames.
2. Confirm CJ1M PLC Setup words 160–168 are written to the values shown in the table above and that the PLC Setup area is protected from inadvertent writes.
3. Open CX-Programmer's PLC Transfer window and watch the Port 1 error flags in A526 during a single poll cycle. All bits should remain 0.
4. Insert a temporary breakpoint in the CJ1M's RXD handler and inspect D02000–D02030. Verify the response begins with 0x40 0x30 0x31 (or 0x32 for slave #2) and ends with 0x0D.
5. Force a known value into D00050 of the CJ1M, run one full poll cycle, and read back DM 0–2 of the matching CPM1A from CX-Programmer. Verify they match.
6. Disconnect slave #1's RS422 cable. Confirm the timeout path increments the error counter and that slave #2 continues to be polled successfully.
7. Reconnect slave #1, run the A528 recovery routine from ladder, and confirm the bus self-heals within one second.

Troubleshooting Matrix

Field-Proven Pitfalls

• String at DM 0: Always place the Host Link frame buffer at a non-zero DM offset. The TXD(236) and RXD(235) instructions interpret a zero in the first word as a null pointer and abort silently.
• Parity mismatch: The CJ1M's default Host Link format is 7-E-2. The CPM1A's peripheral port default is also 7-E-2. If either side is changed to 8-N-1 (a common mistake when programmers think "modern serial"), every FCS calculation will fail because the byte count and the parity bit interpretation no longer match.
• HMI on the same bus: Many HMIs default to the Host Link protocol on the same RS422 bus. An HMI scanning the bus at 50 ms poll rate will collide with the CJ1M's poll of the CPM1A PLCs. The fix is to put the HMI on the CJ1M's built-in RS232C port and reserve the CJ1W-CIF11 option board exclusively for the CPM1A bus.
• Terminator configuration: The CJ1M's end-code setting in PLC Setup word 165 must be 0x0D (CR) to match the CPM1A's response terminator. If the CJ1M is set to 0x0D 0x0A (CRLF), the first byte of the next response will appear in the FCS field of the previous frame and the port will report a constant FCS error.

FAQ