OMRON CP1E Memory Addressing D100, H10, &10 in Test Fixture

Overview: Reading a Legacy CP1E PCB Programming Fixture

The OMRON CP1E is a compact PLC frequently used as the controller inside test fixtures, end-of-line programmers, and small bench-top automation cells. A common CP1E application is a PCB programming fixture: an operator loads a printed circuit board assembly (PCBA) onto a pogo-pin nest, closes a safety lid, presses Start, and the PLC orchestrates an RS-232 handshake with a host PC that flashes new firmware onto the board via a serial bootloader.

When inheriting a working CP1E program and trying to add features, the first obstacle is the memory map. CP1E addresses look different from what a controls engineer trained on Allen-Bradley, Siemens, or Mitsubishi expects. This reference decodes every address style encountered in a typical CP1E PCB-programmer ladder: data memory (D), holding relays (H), and decimal constants (&). It then walks through the compare-and-move rung pattern that drives the sequencer, and finishes with the RS-232 ASCII protocol implementation.

The reference material used throughout is the official SYSMAC CP Series CP1E CPU Unit Software User's Manual (W480) and the CP1E/CP2E CPU Unit Instructions Reference Manual (W483). Memory areas, instruction mnemonics, and port specifications are taken from those documents.

CP1E Memory Map Used in a PCB Test Fixture

A CP1E-N20DR-A or CP1E-N40DR-A CPU exposes the following memory areas relevant to the type of program described in the field report. The full area map is documented in W480 section 6 "Memory Areas."

Three address styles appear repeatedly in a CP1E sequencer program: D100, H10, and &10. Each means something completely different, and confusing them is the most common reason a new programmer misreads a legacy rung.

D100 - Data Memory Word

D100 is word 100 in the Data Memory area. Data memory is the general-purpose 16-bit word storage on the CP1E and is retentive across power cycles. The full D area runs from D0 to D32767 on an N-type CP1E; the smaller E-type stops at D8191. According to W480 section 6-4, data memory is the default scratch area for:

• Sequencer step numbers
• Counter set values and current values
• ASCII string data (one character per byte packed in a 16-bit word)
• Math results, scaling constants, and recipe values
• RS-232 TX/RX buffer staging

To force a data memory word back to zero on program start, the convention is to use a one-shot of the first-scan flag or a rising-edge contact driving MOV &0 D100:

| P_First_Cycle ||--[MOV &0  D100]--|

CP1E data memory is word only; you cannot index D100.05 as a bit on a CP1E. If the documentation lists D-area bit access, it is referring to the CP2E series, which added that capability. Treat CP1E D-words as 16-bit containers only.

H10 - Holding Relay Word

H10 is word 10 in the Holding Relay area. The H area is retentive bit memory; H0 through H511 gives 512 individual bits organised as 32 words. Unlike data memory, every H word can be addressed at bit level using a dot suffix:

OMRON uses the IEC bit-numbering convention: bit .00 is the least significant bit (LSB), bit .15 is the most significant bit (MSB). In a PCB-programming fixture, the H area is the standard place to latch handshake flags from the host PC:

• H10.00 - SM message received from host (status message handshake)
• H10.01 - RD message received (host ready)
• H10.02 - SP message received (start programming request)
• H10.03 - OK message received
• H10.04 - NG message received (fail)

Because the H area is retentive, these latches survive a power dip, so the fixture can restart where it left off after an E-stop or brown-out. That is the design intent: "This area is also memory retentive and is really useful if power fails and you wish to restart where you were."

&10 - Decimal Constant

The & prefix denotes a decimal integer constant. &10 is the number 10 base 10, not hexadecimal 0x10 (which would be 16 decimal). OMRON's constant prefix system is:

Therefore &10 written to D100 means "store decimal 10." When that word is later compared with the =(300) instruction against D100, the test is "does D100 currently equal 10?" Constant style is fully covered in W483 section 2-2 "Instruction Formats."

Decoding the Sequencer Rung

A PCB-programming fixture typically uses an incremental sequencer: a single data-memory word holds the current step number, and the program is a long series of compare rungs of the form:

|--(D100 = &10)--|   (compare: is the current step 10?)
|                   |
|                   +---[ action 1: turn on output, set bit, etc. ]
|                   +---[ action 2: load timer preset, move data, etc. ]
|                   +---[MOV &20 D100]  (advance to step 20)

The compare instruction in CP1E ladder is = (mnemonic =(300)); the move instruction is MOV (mnemonic MOV(021)). Both are documented in W483.

Why the Original Programmer Used Step Increments of 10

When a sequence is built around &10, &20, &30, &40 ... instead of &1, &2, &3 ..., the author is leaving room for sub-steps and recovery branches:

• &10 - Main step "idle, waiting for start"
• &11, &12, &13 - Sub-states within idle (e.g. door closed, lid locked, fixture homed)
• &20 - Main step "request programming"
• &21 - Sub-state "waiting for RD"
• &22 - Sub-state "waiting for SM"
• &30 - Main step "verify pass"

This convention is widely used on OMRON CP1E/CP2E/CJ2 because it lets the engineer insert diagnostic sub-states between major steps without renumbering the rest of the sequence. The field report explicitly notes: "The previous programmer used increments of &10 on purpose to make calling them easier. Saying that he has &1, &2 and I can't seem to find what he has stored in them." That is the design signature of a multi-level sequencer.

Why an OR Branch Exists on the Rung

The source question "Why is there an OR command in this step? What if the OR was not there?" has a precise ladder-logic answer. In a CP1E ladder diagram, instructions in series are logically AND-ed; instructions in parallel (OR branches) are logically OR-ed. The rung in question looks conceptually like:

       +--[=(300) D100 &10]--[MOV &20 D100]--+
       |                                        |
( bus )+----------------------------------------+
       |                                        |
       +--[H10.00]--------------[MOV &2  D0]---+

Two parallel branches exist because the original programmer wanted to advance the sequencer on either:

1. The natural step transition (D100 == 10) - the "happy path" branch, OR
2. An unsolicited SM message arriving on the serial port (H10.00) - the "host override" branch.

Removing the OR would force the rung to evaluate as an AND: the MOV would only execute when both the sequencer step matched 10 and an SM message was present. That is rarely the desired behaviour in a host-driven test cell; the host's SM should be able to jump the sequence forward independently. The OR branch gives the rung two independent triggers for the same writes.

Key CP1E Instructions Used in the Fixture Program

MOV (021) - Move

MOV  S  D

Copies a 16-bit word from source S to destination D. Used to:

• Initialise D100 to &0 on first scan.
• Overwrite D100 with the next step number (MOV &20 D100).
• Write the ASCII code of a character to the TX buffer word before TXD.

For 32-bit moves use MOVL(498).

=(300) - Equal Compare

=  S1  S2

The input condition is ON when S1 equals S2. Companion instructions are <>(305), <(310), <=(311), >(320), >=(325). All are documented in W483 section 3 "Sequence I/O Instructions." The result is a single-bit condition that can drive a contact, a coil, or another instruction's enable input.

OR / OR NOT / OR LD - Boolean Wiring

These are not strictly "instructions" but rung-wire operations in CX-Programmer. In the ladder editor you draw a vertical branch by clicking the OR toolbar button; the compiler emits an OR or OR LD mnemonic. Semantically:

TXD (236) and RXD (235) - Serial Send/Receive

TXD  D  C  N
RXD  D  C  N

Where D is the first source/destination word, C is the control word (port, protocol), and N is the byte count (0-256). For an RS-232 ASCII handshake against a host PC, set control word for 8 data bits, no parity, 1 stop bit, no protocol, baud matched to the host. TXD triggers from the CP1E to the PC; RXD captures incoming ASCII into the buffer starting at D. Full parameter list is in W483 section 5 "Communication Instructions."

RS-232 ASCII Protocol: SP, RD, SM, OK, NG

The host PC and the CP1E exchange short ASCII command frames terminated by <CR> (carriage return, 0x0D). A typical PCB-programmer sequence is:

On the CP1E, the receive buffer is staged in a contiguous block of data memory; on a CP1E-N20DR-A the typical staging area is D200 through D215. The RXD instruction places the bytes there, then a string-compare ladder block (often built from successive =(300) compares of each byte) decodes the message. For "SM", the decode is:

SM Compare Rung
+--[=(300) D200 &'S']--+--[=(300) D201 &'M']--+--[SET H10.00]--+
|                       |                       |
| (bus)                 |                       +--[TXD D300 C0 &3]----+
+-----------------------+                                             (transmit SM<CR> back)

Where D200 = 'S' is verified by =(300) D200 #53 (hex 53 is ASCII 'S'). On CP1E, writing the literal ASCII code as #53 is more memory-efficient than passing 'S' as a string.

Recommended PLC Port and DIP-Switch Settings

The CP1E-N and CP1E-S CPUs ship with two onboard serial ports. The wiring diagram below summarises which port is used for what in a typical PCB-programmer fixture.

DIP switch SW1 on a CP1E-N controls the standard peripheral bus / serial gateway mode for the option board slot. SW2 controls the use of the standard peripheral bus on the CPU. Refer to W480 section 2-2 "Switches" before changing either.

PLC Setup Register Words

Serial port parameters are set in the PLC Setup area (data memory D0 to D255, but used as setup rather than application memory). For the host-link port configured as free ASCII protocol:

For 3-wire RS-232 (TX, RX, GND only, no hardware handshaking) use control word bits that disable CTS/RTS. For full DTR/DSR handshaking use the 9-pin version.

Step-by-Step: Documenting an Inherited CP1E Program

1. Save the project offline. In CX-Programmer, File > Save As and create a working copy named with today's date. Never edit the production file directly.
2. Open the cross-reference report. View > Cross-Reference Report. Sort by address. This shows every use of D100, H10.00, W3.05 across the entire ladder.
3. Map every D word used. Create a spreadsheet with columns: address, decimal value, ASCII meaning (if any), written-by which rung, read-by which rungs.
4. Map every H bit used. Same spreadsheet for the H area. Flag every coil with KEEP(011) or SET/RESET because those are latches that survive power loss.
5. Find every MOV and MOVL. Those are the lines that change sequencer step numbers. They reveal the flow of the state machine.
6. Find every TXD and RXD. Those are the comms lines. Identify which D block is the receive buffer and which is the transmit buffer.
7. Draw the state diagram. From the MOV targets of D100, draw boxes for &0, &10, &20, &30.... Annotate each arrow with the trigger condition (which contact is in series) and the side effects (TXD, output set, etc.).
8. Mark any undocumented steps. If &1 and &2 are stored but no compare rung ever matches them, they are likely sub-step residuals or disabled diagnostic code.

Verification Checklist Before Powering Up a Modified Program

1. Compile with the simulator. CX-Programmer's simulator can run the ladder offline; step through D100 as it advances from 10 to 20 to 30.
2. Watch D100 live. In Online > Monitor mode, pin D100 in the watch window. Press Start with no PC connected and confirm the sequencer halts at the "waiting for SP" state.
3. Loopback the RS-232 port. Fit a TX-to-RX jumper at the PLC end and confirm the PLC receives its own echoed commands. If H10.00 latches, the comms are wired correctly.
4. Validate ASCII framing. Use a serial-line monitor (e.g. a laptop running a free COM-port sniffer) to confirm <CR> (0x0D) and not <CR><LF> is being sent. The PLC's PLC Setup word 151 controls this.
5. Confirm retentive bits latch correctly. After a power cycle, confirm H10.xx retains the last state. If not, check PLC Setup word 99 / 100 (H area retention is normally on by default).
6. Cycle ten PCBs end to end. Track yield and average cycle time. A new MOV target that goes to the wrong step is the most common regression.

Common Pitfalls When Migrating CP1E Code to a CP2E or CJ2

If a fixture is being upgraded from a CP1E to a CP2E-N30 or CJ2M-CPU33, retain the same step-increment-of-10 convention and the same H-bit flag layout. That keeps the diagnostic documentation forward-compatible.

Quick Reference: Address-to-Meaning Glossary

FAQ