Omron Host Link RS-485 Protocol Commands, Wiring & PC Integration

Overview

Omron's Host Link protocol is the legacy serial command set used with the C-series, CV-series, CQM1, CQM1H, CPM1A/CPM2A, SRM1, and CP1L/CP1E families. It rides on RS-232 or RS-485 at default 9600 7,E,2 and uses a simple ASCII request/response frame that is straightforward to implement on a Linux industrial PC without going through CX-Programmer or a Windows OPC server. This reference covers the Host Link C-mode frame, the RR/WR/RD/WD/SC/MS commands required for I/O and mode control, the ADAM-4520 RS-232↔RS-485 wiring rules, the CX-Programmer settings to enable Host Link on a port, and the monitor-mode vs program-mode behavior that decides whether writes are accepted.

Protocol Identification

Before sending traffic, confirm which serial protocol the PLC actually supports on the peripheral or RS-232C port:

On the CQM1H-CPU21, the DIP switch block on the front of the CPU selects the unit number and serial mode. SW1-2 are unused on the CPU21; SW3 selects the port protocol and SW4-SW6 select the host link unit number for 1:N multi-drop. The most common arrangement for a single-drop RS-485 link is SW3=ON (Host Link), unit number 00, 9600 7,E,2.

Host Link C-Mode Frame Format

A Host Link request is an ASCII string terminated by CR (0x0D). For a 1:1 connection, the header and terminator are stripped:

@  [unit]  [command]  [text]  FCS  *  CR

For 1:N multi-drop on RS-485, an explicit header is required:

@  [unit]  [command]  [text]  FCS  *  CR
@  [unit]  FA  [text]  FCS  *  CR    (response from unit)

The FCS (Frame Check Sequence) is the 8-bit two's complement of the ASCII sum of every byte from @ through the last text byte, expressed as two uppercase hex characters. A worked example for the read-IR request to unit 0 reading IR001 starting at CIO 0:

Command:  RR 000 00001
Full:    @00RR00000001<FCS>*\r

Sum the ASCII bytes @ 0 0 R R 0 0 0 0 0 0 0 1 = 0x73 + 0x30 + 0x30 + 0x52 + 0x52 + 0x30 + 0x30 + 0x30 + 0x30 + 0x30 + 0x30 + 0x30 + 0x31. Take the low byte, invert, encode as two hex digits. The Omron Host Link Manual (W342) contains the full algorithm and a worked walk-through.

Core Command Set

The minimum command subset for a Linux polling host:

Word addresses are four-digit BCD. CIO 0 = 0000, CIO 1 = 0001, DM 0 = DM0000 or bank 10 with offset. Refer to the per-family address mapping in the Host Link manual for exact area codes.

Mode Change with the SC Command

The SC command requires a four-digit BCD argument: 02 = Monitor, 03 = Run, 04 = Program. The PLC replies with a status byte describing the previous mode. Many C-series CPUs refuse SC unless the key switch is in the correct position – typically Remote or Monitor. Without that physical switch position, the host receives 00 01 (mode-change error) even though the request was syntactically perfect.

RS-485 Wiring with the ADAM-4520

The Advantech ADAM-4520 is an isolated RS-232 ↔ RS-485 converter widely used to bridge a PC COM port to multi-drop PLC links. Pin-out and wiring rules:

• Use twisted pair, ideally shielded, with the shield bonded to ground at one end only.
• Place a 120 Ω termination resistor across DATA+/DATA- at each physical end of the bus.
• The ADAM-4520 ships with built-in 4.7 kΩ bias resistors on its RS-485 side; do not add external bias – it will distort the idle state.
• Maximum recommended cable length is 1200 m at ≤ 19.2 kbps; Host Link at 9600 baud is comfortably within that envelope.
• Set the ADAM-4520 DIP switch for echo off (SW1-2 = OFF) on multi-drop so the converter does not retransmit what it received.

CX-Programmer Configuration

To place the PLC port into Host Link, the PLC Setup area must match the physical layer. In CX-Programmer:

1. Open the project → PLC → Edit → Set the active CPU (online).
2. Open Settings → Host Link on the relevant serial port.
3. Set Mode = Host Link, Baud = 9600, Data = 7 bits, Parity = Even, Stop = 2.
4. Set the unit number in the link area. Use 00 for 1:1, or assign 01–31 for multi-drop.
5. For RS-485 1:N, ensure the option board's TERMINATOR switch is ON at the last node.
6. Transfer the Setup to the PLC and cycle power (CQM1/CPM1 require power-cycle for new serial settings).

Reference: CP1L Host Link Setup Manual (W462), CS/CJ Serial Communications Manual (W336).

Linux Implementation Outline

A minimal C or Python Host Link master on a Linux IPC requires only a serial port, a select()/read() loop, and FCS calculation. Recommended stack:

• Driver: standard /dev/ttyS0 or USB-serial /dev/ttyUSB0; stty -F /dev/ttyUSB0 9600 cs7 -cstopb parenb -parodd.
• Polling loop: termios in canonical mode for easy line-buffered ASCII, or raw mode with manual timeout (recommended for >100 ms cycle).
• FCS: compute the 8-bit two's complement of the XOR-summed bytes from @ to end-of-text; see Host Link manual for the reference C routine.
• Transaction: write frame → wait ≤ 1 s → read until *\r → validate FCS → parse response.
• RS-485 direction control: ADAM-4520 handles auto-direction; if using a different converter with RTS-controlled direction, toggle RTS via TIOCM_RTS 5 ms before transmit and clear 5 ms after the last byte.

A reference Python helper for the FCS calculation:

def fcs(payload: bytes) -> bytes:
    s = 0
    for b in payload:
        s = (s + b) & 0xFF
    return bytes([((-s) & 0xFF)])

def frame(unit: int, cmd: str, text: str = "") -> bytes:
    head = f"@{unit:02d}{cmd}{text}".encode()
    chk = fcs(head).hex().upper().encode()
    return head + chk + b"*\r"

Monitor Mode vs Program Mode Writes

A Host Link WD or WR is interpreted by the CPU based on the current operating mode:

If an OPC client or Host Link master reports that a write "did not propagate", the most likely cause is ladder priority: the rung contains OUT CIO 0.01 or SET/RESET instructions that reassert the bit every scan. The correct fixes are:

1. Use an unused auxiliary bit that the ladder does not touch.
2. Replace rung logic with the Host Link write as the source (read back first to confirm).
3. Switch the CPU to Monitor via SC 02 before issuing WD – many firmware versions silently reject CIO writes in Run mode.

OPC vs Raw Host Link

An OPC DA server (for example MatrikonOPC for Omron or OPC Foundation reference) wraps Host Link into a tag-based read/write API. The OPC server handles FCS, retries, and unit numbers, exposing each CIO bit as an addressable tag. This is faster to deploy but introduces a Windows dependency.

A raw Host Link master is preferable when:

• The host OS is Linux or RTOS.
• Deterministic cycle time under 50 ms is required.
• No Windows licensing is acceptable on the floor.
• The system must survive OPC server crashes and still drive the pumps.

Both approaches share the same physical bus and the same PLC Setup, so the wiring work is identical. The decision is purely software architecture.

Verification Procedure

1. From the Linux host, open the serial port at 9600 7,E,2 and confirm the framing with stty -a.
2. Send @00MS<FCS>*\r manually using minicom or echo + cat; expect a status response within 1 second.
3. If no response, swap DATA+/DATA- – RS-485 polarity is a common silent failure.
4. Once MS responds, send @00RD00000005<FCS>*\r and confirm five words come back. Compare against CX-Programmer online values.
5. Issue @00SC02<FCS>*\r to switch to Monitor, then @00WR00050001<FCS>*\r to set an unused bit. Use CX-Programmer in online monitor to confirm the bit latched.
6. If the bit reverts, suspect rung priority or check that the bit is not configured as a forced-clear in the I/O table.
7. Capture the full exchange in Wireshark with the sercos dissector or a simple serial-logger script for first-article verification.

Troubleshooting Matrix

Safety and Program-Storage Notes

A common operational question on legacy Omron sites is whether the ladder program is stored in the CPU or only on the host PC. For CQM1H, C200H, and CP1 families, the user program is stored in flash/EEPROM on the CPU; it remains resident through power loss. The CX-Programmer project file (.cxp) on the PC is an offline copy. Therefore, you can disconnect CX-Programmer permanently and still retain full control via Host Link without risk of program loss, provided the PLC Setup is also retained (typically it is, on these families). For CPM1A and early C-series the PLC Setup may live in volatile DM and require backup.

Field Commissioning Checklist

• Confirm baud, parity, data bits, stop bits match between PLC Setup and Linux host.
• Confirm ADAM-4520 echo switch OFF for multi-drop.
• Confirm terminator at last PLC only.
• Run an MS query at idle; record response time baseline.
• Document the unit number and ladder bits actually used for Host Link control.
• Avoid writing to bits referenced by KEEP or SET instructions unless you intend to clear them in the same transaction.
• Use a watchdog DM word that the Linux host increments every cycle; alert if it freezes.

FAQ