Omron CJ2M RS-485 Modbus-RTU Slave Configuration Guide

The CJ2M programmable controller is most often commissioned over FINS because Sysmac Studio and CX-Programmer expose FINS commands natively over the on-board EtherNet/IP and serial channels. Yet in IIoT gateways, multi-vendor SCADA integrations, and lean edge pipelines running on industrial PCs, RS-485 Modbus-RTU remains the field-level lingua franca. This reference documents the complete engineering chain to configure an Omron CJ2M as a Modbus-RTU slave on RS-485—option-board DIP switch selection, trunk wiring topology, PLC Setup parameters, the CJ2M-to-Modbus memory map, frame structure with CRC-16 validation, and the diagnostic steps required to bring up a non-FINS serial-request/buffer-parser flow (Node-RED, generic C#, or Python) against the option-board port.

1. Overview: Why Use RS-485 Modbus-RTU on CJ2M Instead of FINS

FINS (Factory Interface Network Service) is Omron's native application-layer protocol. It carries commands over Ethernet (UDP), TCP, and over the CJ2M serial channel as Host Link. FINS is convenient in pure-Omron architecture but presents four practical friction points that drive engineers toward a Modbus-only fieldbus:

• Vendor lock-in: SCADA supervisory layers (Ignition, WinCC, AVEVA, FactoryTalk View) accept FINS through dedicated plug-ins, but the OPC-UA/MQTT bridges aggregating data from cell controllers typically speak Modbus or OPC-UA only. Presenting Modbus from the PLC keeps the upstream stack generic.
• FINS/TCP session state: FINS/TCP requires a session handshake (server/client SEND header RR/SR command pairs) plus periodic keep-alive. On resource-constrained edge gateways, partial packets, queueing delays, and silent retries produce slow tag updates. A polled Modbus master eliminates that session code path entirely.
• Deterministic slave behaviour: Modbus-RTU defines a deterministic slave-side response window, with exception codes (0x01–0x04) that simplify offline detection in the master.
• Embedded gateways: SBC-class Linux nodes with Node-RED or Python flows rarely include a FINS implementation. The same flow already ships with a Modbus input that maps straight onto the CJ2M slave.

The trade-off is two-fold. First, tag access becomes numeric—no symbolic FINS A/B/W/D prefixes, only register addresses. Second, the master owns frame integrity: CRC-16 validation, inter-frame timing, and turn-around handling. This document covers the entire configuration chain and the diagnostic steps that resolve the “buffer parser is also showing an error” symptom routinely encountered when a serial-request flow is wired directly to the CPU's serial port.

2. Hardware Prerequisites and Part Selection

Refer to the Omron industrial automation product catalogue and the CJ2M CPU Unit Hardware Reference Manual for absolute current consumption, surge rating, and operating temperature. The CJ2M module takes approximately 0.31 A at 24 VDC with the CIF12 option board installed. The CPU must be cold-started with the option board seated before PLC Setup takes effect on the option-board port.

3. CJ2M Option Board DIP Switch Configuration (CP1W-CIF12)

The CP1W-CIF12 carries a four-position DIP switch on the top of the PCB. Switches are read only at power-up; after changing any switch, cycle CPU power or issue PLC > Restart from CX-Programmer for the change to take effect. Default is RS-422A 4-wire with no termination. The table below reflects the labelling of the latest CIF12 revision.

For 2-wire RS-485 Modbus-RTU, set SW1=ON, SW4=ON, and SW3=ON only at the two physical ends of the trunk. The CIF12 contains an internal 2-wire/4-wire bridge link that ties the SDA± differential pair to the RDA± differential pair internally when SW1=ON. Do not wire both pairs simultaneously when SW1=ON, as this creates an out-of-spec short inside the option board.

4. RS-485 Wiring Topology and Termination

A Modbus-RTU multi-drop trunk is a single physical cable that connects every node in series. Tapped (star) connections are forbidden on RS-485 because reflections cause collisions; cable stubs must stay shorter than 1 m, which is automatic for typical 8-node trunks. The shield drains to the panel protective earth (PE) at exactly one point—usually the master cabinet—to prevent ground loops that modulate the common-mode voltage on A/B.

The maximum trunk length depends on baud rate per the TIA-485 reference curve:

These are conservative engineering numbers; field conditions often reduce the practical maximum by 30–50% due to common-mode noise coupling.

5. PLC Setup: Enabling Modbus-RTU Slave Mode

In CX-Programmer (or Sysmac Studio with the CJ2M plug-in), navigate to PLC > Settings > Serial Port 2 (Option). For a CJ2M-CPU3x with the CP1W-CIF12 option board fitted to the option slot, port 2 corresponds to the option board. The default protocol after a fresh installation is Host Link (FINS) on port 2; the engineer must change it to Modbus-RTU Slave through the Serial Port 2 parameters.

After transferring setup, cycle power on the CPU to commit the protocol change. Modbus-RTU Slave is a low-level firmware mode implemented by the CIF option board; the ladder application does not require explicit configuration blocks or device allocation instructions. The CPU simply exposes its memory areas at fixed register offsets, which is the key point of the next section.

6. Modbus-RTU Address to CJ2M Memory Map

With Modbus-RTU Slave mode active, the CPU answers requests against a fixed memory map. The exact boundaries depend on CPU model; the table below summarises the default mapping for a CJ2M-CPU3x with a 32 k-step program area.

Mapping is 1:1 offset-by-offset. Modbus register 40001 corresponds to D0, 40002 to D1, and so on. A request that starts at 40005 with quantity 10 reads D4–D13. Function codes supported by the CJ2M Modbus-RTU Slave firmware:

Modbus writes go directly into the DM area. No ladder allocation is required to expose DM, but the engineer typically writes a small routine to copy CIO inputs and arithmetic results into DM so they appear at the configured holding register addresses. A minimal latching block follows.

/* CJ2M ladder — populate DM for Modbus holding registers */
[Every 100ms via TMR block]
  LD   T100                // 100 ms heartbeat
  MOV(021) CIO 100  D100   // 1st 100 IO words to D100-D199 (modbus 40101-40299)

[Counter update]
  LD   P_1s
  @INC(021) D0200          // Modbus register 40201 increment per second

[Cross-area copy]
  XFER(070) 10 CIO 200 D0200  // 10-word block copy

Because the DM area is volatile on a power-down cycle (unless explicitly configured as retained), values that must survive a cold start should either be (a) marked as Retained DM in CX-Programmer IO Setup or (b) copied to the EM bank under power-on sequencing. The Modbus master can then poll from EM using register offsets (capacity permitting) by reconfiguring the Modbus-RTU Slave map—see CX-Programmer parameter table for the EM-attach configuration.

7. Frame Structure, CRC-16, and Inter-Frame Timing

A Modbus-RTU frame in the slave response direction looks like this for a Read Holding Registers request:

The CRC-16/Modbus polynomial is 0xA001 (reflected representation of 0x8005), with initial value 0xFFFF and the low byte appended first. Most master libraries compute the CRC transparently. If you must validate by hand, the algorithm is:

CRC = 0xFFFF
for byte in frame_without_crc:
    CRC ^= byte
    for _ in range(8):
        if CRC & 1:
            CRC = (CRC >> 1) ^ 0xA001
        else:
            CRC >>= 1
append byte(CRC & 0xFF)         # low byte first
append byte((CRC >> 8) & 0xFF)

Inter-Frame Timing

RTU mode requires a 3.5 character silence to delimit frames. The character time at baud B with 11 bits/char (1 start, 8 data, 1 parity, 1 stop) is:

t_char = 11 / B            # seconds
t_frame_gap = 3.5 * t_char # minimum inter-frame silence

8. Step-by-Step Integration Procedure

The following procedure moves a CJ2M-CPU31 from factory-default Host Link mode to a verified Modbus-RTU slave on RS-485 with a host running a Python pymodbus or Node-RED modbus-flex-getter master.

1. Power down the backplane. Fit CP1W-CIF12 to the option slot of the CPU. Verify the option board retainer clicks into place.
2. Power up. Confirm the POWER and RDY LEDs on the CPU go green within 5 s.
3. In CX-Programmer connect via USB or Ethernet. Confirm the option board shows in the IO table.
4. Open PLC > Settings > Serial Port 2 (Option) and set Mode to Modbus-RTU Slave, Unit Number to 01, Data 8 / None / 1, Baud 9600, Send Delay 0 ms (initial value, raised later if the master requires).
5. Transfer setup to the CPU, then choose PLC > Restart to commit.
6. Wire the RS-485 trunk: data A from host to data A on the CIF12 terminal block; data B likewise. Tie the shield to panel PE at the master cabinet only.
7. Set the DIP switches: SW1=ON (RS-485), SW4=ON (no handshaking), SW3=ON at both ends of the trunk.
8. Load a latching program that copies the first ten CIO words (CIO100–CIO109) into D100–D109.
9. On the host run a Python loop:

from pymodbus.client import ModbusSerialClient

client = ModbusSerialClient(
    method='rtu', port='/dev/ttyUSB0',
    baudrate=9600, parity='N', stopbits=1, bytesize=8)
client.connect()
result = client.read_holding_registers(address=100, count=10, slave=1)
print(result.registers)
client.close()

A successful register read verifies the CRC, framing, baud rate, and address mapping all in a single pass. If any value is unexpected, drop into the debug sequence below before touching the ladder logic.

9. Debug Node Approach for Serial Request Verification

When the master flow in Node-RED (or a generic serial library) is built from raw serial request + buffer-parser nodes rather than from a pre-built Modbus master, the first debugging step is to confirm exactly what bytes arrive from the CJ2M port. Place a debug node on the output of the serial request node and toggle it to display complete msg object. The output buffer pattern reveals the failure domain:

• Empty or 1-byte buffer: Request never reached the CPU. Check unit number, baud rate, RS-485 terminators, and cable polarity.
• FINS 0x40 0x00 prefix: PLC is still in Host Link mode. Revisit the PLC Setup Mode parameter for port 2.
• Clean 0x01 0x03 ... response of 25–28 bytes: Valid Modbus reply. The buffer-parser schema is the failing block — go to Section 10.
• Duplicate or echoed bytes: RS-485 turn-around has not settled. Increase Send Delay in PLC Setup to 30 ms; ensure master waits for the full response before transmitting the next request.
• Truncated buffer: The serial-request node closed its read window before all bytes arrived. Switch from until-idle mode to until-byte-count mode, or insert a node-red-contrib-buffer-parser stream configuration with the known frame length.

The reference CompoWay/F RS-485 connection guide documents the same option board in master mode for E5xC digital temperature controllers and is an authoritative companion if your scope later expands from a single CJ2M Modbus-RTU slave to a CJ2M Modbus-RTU master polling field instruments:

CompoWay/F RS-485 Connection Guide (P704-E5)

10. Buffer Parser Configuration and Typical Errors

The Node-RED buffer-parser node converts a binary buffer into a structured JavaScript object using a schema array. A representative Modbus response schema for a 4-register Read Holding Registers request (read in Node-RED as readHoldingRegisters via the modbus-flex-getter or hand-rolled equivalent):

[
    {"name":"unit",   "length":1, "offset":0, "dataType":"uint8"},
    {"name":"fc",     "length":1, "offset":1, "dataType":"uint8"},
    {"name":"bytes",  "length":1, "offset":2, "dataType":"uint8"},
    {"name":"d0",     "length":2, "offset":3, "dataType":"uint16be"},
    {"name":"d1",     "length":2, "offset":5, "dataType":"uint16be"},
    {"name":"d2",     "length":2, "offset":7, "dataType":"uint16be"},
    {"name":"d3",     "length":2, "offset":9, "dataType":"uint16be"},
    {"name":"crc",    "length":2, "offset":11, "dataType":"uint16le"}
]

The “buffer parser is also showing an error” symptom from debug logs typically reduces to one of these root causes:

Beyond the buffer-parser, validate the CRC in the master (most libraries expose this) before iterating on schema layouts. A valid CRC narrows troubleshooting to framing rather than configuration.

11. Verification: Loopback Test and Register Polling

Always run a loopback test before connecting real field devices. Recommended bench sequence:

1. Host the master on a known-working PC with a USB/RS-485 dongle (FTDI FT4232H-based units are widely accepted; bus-powered units can violate common-mode).
2. Connect the master to a Modbus-RTU simulator running on a second PC (e.g., diagslave or modpoll in slave mode). Confirm all parameters before connecting the CJ2M.
3. Replace the simulator with the CJ2M slave. Poll the first ten DM registers from the master and compare against CX-Programmer > Reference > Online values.
4. Force a DM value from the master (function code 0x06) and confirm CX-Programmer shows the same value within one scan.

Pass criteria:

• 10/10 register values match CX-Programmer reference values within one CPU scan.
• CRCs validate from the master-side library.
• Round-trip latency < 50 ms at 9600 baud for a 10-register poll.
• Logs show no TimeoutError from the master under steady-state load of 1 Hz polls for 1 hour.

12. Performance, Tuning, and Troubleshooting Matrix

At 9600 baud, a CJ2M serial port can sustain approximately 25 register polls per second including inter-frame silence and request-response turn-around. To sustain deterministic latency on a higher-load polling loop, prefer the EtherNet/IP path; FINS/TCP can sustain hundreds of polls per second when the CPU has a dedicated session.

13. Cross-Vendor Notes and Migration Paths

If the project later migrates to a different supplier, the same RS-485 trunk can host multi-vendor slaves. Notes from the field:

• Schneider M340 with BMX NOM 0200 / NOM 0100 supports Modbus-RTU slave on the same physical layer; default registers map to %MW starting at 0, which is the same convention as CJ2M DM. No adapter required.
• Allen-Bradley CompactLogix / MicroLogix uses different register offset conventions (typically N7:0 or 400001). When migrating, re-validate the master block.
• Wago 750-352 / WAGO-I/O-System presents Modbus natively and can be a Modbus-RTU slave on the same trunk.

When transitioning from the CJ2M RS-485 path to the CJ2M-CPU3x EtherNet/IP path with FINS/TCP, the address-to-symbol mapping improves but the request rate drops by 30–40% on every leg of the connection storm under 0.5 s of jitter. Use RS-485 only when multi-vendor Modbus polling is required.

14. Safety, EMC, and Field Reliability

RS-485 in a heavy-industrial environment is a frequently mis-wired interface. Engineering safeguards to enforce:

• Terminate only at the ends: The 120 Ω resistors must exist at exactly two nodes. Three terminators loads the bus below TIA-485 requirements; one terminator produces ringing.
• Ground the shield at one point: Ground loops couple 50 Hz/60 Hz common-mode onto A/B; optocouplers on industrial gateways protect upstream UARTs but not always the protection diodes on the CJ2M option board.
• Keep cable clear of VFD outputs: Routing the RS-485 trunk within 200 mm of an unfiltered VFD output cable produces common-mode that exceeds the input common-mode range of the option board.
• Enable Modbus broadcast discipline: Avoid broadcast messages (slave address 0) unless every slave is on a unique register layout; write broadcast is a single-strike action.
• Plan for CPU fault state: When the CJ2M transitions to fatal (ERR LED solid), the serial port stops responding. Master should treat timeout-and-retry with back-off rather than master crash-restart.

15. Frequently Asked Questions