Omron Host Link to Modbus Gateway: DSP and SCU Card Configuration

Overview of the Omron Host Link to Modbus Conversion Problem

Legacy Omron PLC families — C200H, C500, CQM1, SRM1, and pre-firmware CJ1/CS1 racks without an Ethernet module — communicate on the serial backplane using the proprietary Omron Host Link protocol. Host Link is a master/slave command/response protocol riding on RS-232C, RS-422, or RS-485, but its frame structure, FCS checksum, and operand codes are not Modbus-compatible. When a downstream device (a Yokogawa DCS, an ABB Advant controller, a Schneider M340, or a SCADA server) only exposes Modbus RTU registers, an in-line protocol converter is mandatory.

Two production-grade paths exist:

1. Invasive path: Install an Omron serial option card (C200H-ASC02, CJ1W-SCU21, CJ1W-SCU31, CJ1W-SCU41, CS1W-SCU21, CS1W-SCU31, CS1W-SCU41) on the CPU rack, configure it for Host Link slave or Modbus RTU master, and route Modbus directly to the ABB/Yokogawa side.
2. Non-invasive path: Place an external protocol gateway — typically a Red Lion Data Station Plus (DSP) — between the existing Host Link port and the Modbus network. The DSP speaks Host Link on one serial port and Modbus RTU/TCP on the other, preserving the original PLC program untouched.

Omron Host Link Protocol Frame Structure

Host Link frames are ASCII, terminated with a carriage return (0x0D), and protected by a two-character FCS (Frame Check Sequence) computed as the ones-complement of the 8-bit XOR of every ASCII byte between the @ header and the final character of the data block.

Example read of three IR words from node 01 starting at IR 0100:

@01RR01000003 6A*\r

Where 6A is the FCS for the bytes 01RR01000003. Slave response on success:

@01RR030012340056AB78C*\r

The first 03 in the response is the word-count echo, followed by four hex characters per word. Modbus has no concept of a Host Link header code, no FCS byte, and no IR/HR/LR/DM area prefix — a gateway must translate both the addressing scheme and the transport encoding.

Hardware Inventory for the Conversion

Omron Serial Option Cards

The -SCU31 and -SCU41 variants are the most common choice for a Host Link-to-Modbus bridge because they natively support both protocols in firmware — no ladder protocol macro is needed. Dip-switch SW1 selects the protocol class; the CX-Programmer Port Settings tab confirms whether a given port is in Host Link, Toolbus, NT Link 1:1 / 1:N, Serial Gateway, or Modbus-RTU Slave mode.

External Gateways

Method 1 — Non-Invasive Red Lion Data Station Plus Gateway

This is the recommended path when the PLC program cannot be modified.

Prerequisites

• Red Lion Data Station Plus with Crimson 3 (version 3.0 or later, build 3116+ recommended for stable Host Link parsing).
• XCDC-HOST cable or equivalent Omron pin-out adapter (DB-9 female to Omron peripheral-port mini-DIN).
• RS-485 tap (Phoenix Contact SUBCON-PLUS or equivalent) for multi-drop Host Link networks.
• Modbus master/scanner (Yokogawa DCS, ABB AC800M, M340 BMXNOC0401, or any SCADA).
• Static IP plan for the DSP Ethernet side and a node-number plan on the Host Link side.

Step-by-Step Configuration

1. Wire the Host Link segment. If the existing segment is RS-232C one-to-one, connect the DSP port 1 to the Omron CPU peripheral port via the XCDC-HOST cable. If multi-drop RS-422 exists, tap into the trunk with proper termination (220 Ω across RDA/RDB at both ends).
2. Configure DSP port 1 as a Host Link slave. In Crimson 3: Communications → Port 1 → Driver = Omron Host Link. Set Node Address to a free unit number (typically 01 for a single-PLC network, 02–31 if multiple slaves exist). Set baud rate, parity, and stop bits to match the PLC default (9600, 7-E-2 for legacy C200H, 9600/19200/38400 7-E-2 for CQM1/CJ1).
3. Configure DSP port 2 (or Ethernet) as Modbus RTU/TCP. Communications → Port 2 → Driver = Modbus RTU Master for an RS-485 trunk to the DCS, or add a Modbus TCP server on the LAN interface. Enable Gateway Mode in Crimson 3 so that tags defined in the Host Link driver are exposed to the Modbus driver on a one-to-one mapping.
4. Map the tags. In the Crimson 3 Database, create tags that pull from the Host Link address space. Use the conventions in the table below; Crimson 3 Host Link driver syntax: IR:0100, DM:0200, HR:0010, LR:0000, AR:0015, CH:0010.
5. Export tags to Modbus. In Modbus Master → Tag Mapping, declare the same tags as 16-bit holding registers starting at offset 0 (4x00001). Crimson automatically repacks 32-bit floats across two consecutive 4x registers with configurable byte/word order — critical for cross-vendor data exchange.
6. Write the configuration to the DSP. File → Write to Device. Reboot the DSP; the new mappings take effect on power-up.
7. Verify from the Modbus side. Issue a Modbus function code 03 (Read Holding Registers) from the DCS or a Modbus poll utility. Confirm the values match the contents of the original IR/DM/HR words.

Address Translation Matrix (Host Link → Modbus)

Verification Procedure

1. From a laptop running Crimson 3, open Diagnostics → Live Data and confirm each declared Host Link tag is updating at the configured poll rate (default 100 ms).
2. From a Modbus poll utility (Modbus Poll, CAS Modbus Scanner, or the DCS test client), read 4x00001 through 4x00010. The raw words must match the live PLC values byte-for-byte when viewed with the same endian convention.
3. Write a test value to a non-critical DM word (e.g., D0200) from the Modbus side; read it back through the DSP and confirm on the PLC programming console (CX-Programmer Online Edit).
4. Force a Host Link timeout by unplugging the DB-9; the DSP should set the corresponding tag to Invalid and the Modbus master should report an exception 0x0B (gateway target device failed to respond).

Method 2 — SCU Card with Direct Modbus RTU

When the rack is yours and you can add hardware, a CJ1W-SCU41 or CS1W-SCU41 is faster than any gateway. Port 1 stays in Host Link (or is repurposed for CX-Programmer), and Port 2 is configured as a Modbus RTU slave with the ladder issuing PMCR() instructions to read/write as Modbus master.

CX-Programmer Setup

1. Insert the SCU card in the I/O table (CX-Programmer → IO Table and Unit Setup). Double-click the new unit and open the Port 2 Settings tab.
2. Set Serial Communications Mode = Modbus-RTU Slave for direct DCS polling, or Modbus-RTU Master if the SCU must initiate the requests.
3. Configure the port: baud rate up to 115200 (RS-232C) or 38400 (RS-422/485), parity, stop bits, and node address. Default Modbus node is 1, base register 0.
4. For Modbus master: use PMCR(260) with control words in DM area, or Send/Receive via Serial Gateway (CX-Protocol). Allocate DM words for the Modbus command buffers: Send/Receive buffer address, Number of words, Modbus function code, Target node.
5. For Modbus slave: pre-allocate the DM area that will be exposed as 4x registers. The SCU defaults to mapping D00000–D00099 to 4x00001–4x00100; this can be re-pointed to any DM, CIO, HR, AR, or LR area through the Modbus Mapping dialog.

Sample Ladder — Modbus Master Read via PMCR

|      P_On            PMCR(260)              |
|        |              |                     |
|        +-----]/[------+--C1 = 0101----------+--C2 = D00300
|                      +--S  = D00200-------+--D  = D00400

Where:

• C1 = 0101 — Control word pointer in CIO (offset of protocol macro sequence control)
• C2 = D00300 — First DM word of the Modbus send/receive buffer
• S = D00200 — Source control data: function code (03), start address, word count, target node, retry count
• D = D00400 — Destination: receives the Modbus response

Refer to the CJ-series Serial Communications Boards and Serial Communications Units Operation Manual (W494) for the complete PMCR buffer layout.

Method 3 — HMI as Transparent Translator (Last Resort)

When neither a gateway nor a new SCU card is approved, an HMI panel running a Host Link driver and a Modbus gateway protocol can bridge the gap. The AutomationDirect C-more panel configured with the Omron C200/C500 Host Link Adapter driver can poll the PLC and re-publish the tags to a Modbus TCP client. The procedure is documented in the C-more help file:

1. In the C-more project, Setup → Panel Manager → Protocol → PLC Protocol, select Omron C200/C500 Host Link Adapter from the drop-down list.
2. Configure the panel's serial port for Host Link (default 9600 7-E-2) and define tags that reference IR, DM, and HR areas.
3. Add an Ethernet sub-protocol to the same panel selecting Modbus TCP Server; map the same internal tag database to 4x registers.
4. Enable the panel's Pass-through mode only as a debugging aid — it cannot sustain production traffic.

This approach introduces a single point of failure (the HMI), so it should only be used when budget or cabinet space precludes the DSP or SCU card. See the official AutomationDirect setup page for the exact field-level navigation: Omron C200/C500 Host Link Adapter setup in C-more.

SCADA / HMI Driver Interoperability

Major SCADA packages expose the Omron Host Link driver as a native channel so the conversion can sit entirely on the SCADA node without a gateway box:

The full Advantech WebAccess driver matrix (revision V18, August 2024) lists the Omron Host Link software driver alongside the parallel Modbus MB Link module (AFP3492) for FP-series PLCs. The PDF is the authoritative cross-reference for selecting the correct channel in mixed-vendor projects: WebAccess Driver List & Connectivity V18 (PDF).

Wiring Topologies

Pin Reference — Host Link DB-9 to Omron CPU Peripheral Port

Parameter Defaults at a Glance

Troubleshooting Matrix

Selection Checklist

• PLC program owned by your organization? → SCU card (CJ1W-SCU41 / CS1W-SCU41) is cheapest and most reliable.
• Third-party PLC, no source ownership? → Red Lion DSP with Host Link driver, no ladder changes.
• Multiple Omron racks on one trunk? → DSP as a multi-drop gateway with up to 32 Host Link nodes.
• Mix of Host Link and FINS/TCP on same network? → SCU41 in Serial Gateway mode converts FINS frames to Host Link transparently.
• Need to integrate to a Yokogawa DCS or ABB AC800M? → Modbus RTU master on the SCU/DSP side; DCS is slave.
• Need to integrate to a Modbus TCP-only SCADA? → DSP Ethernet side configured as Modbus TCP server.

Safety and Data Integrity Notes

• Always confirm write enable on the host side before pointing a DCS at a live Omron CPU. A misconfigured write that targets DM00000 will overwrite PLC system variables and force a watchdog fault.
• Disable Host Link broadcast (node 00) on any production gateway — broadcast writes bypass the FCS per-command acknowledgement and provide no feedback.
• For 32-bit floating-point exchange, document the byte order explicitly in the project comments. Omron's default is little-endian word (lower word first), but most DCS platforms default to big-endian; mismatches are the single most common commissioning delay.
• Use a dedicated RS-485 repeater (Phoenix Contact SUBCON-PLUS or Advantech ADAM-4510) for trunks longer than 500 m or with more than 16 nodes; the DSP alone does not include bus biasing.

FAQ