Omron NS5 HMI Migration: Serial Host Link to Ethernet (HOST3)

1. Overview

When an Omron NS-series HMI (NS5, NS8, NS10, NS12, or NS15) originally programmed for Host Link serial communication must be moved to Ethernet because of a customer requirement, plant network standardization, or physical distance constraints, the conversion is more involved than a simple cable swap. Two distinct address spaces coexist in the CX-Designer project: the SERIALA (port A) and/or SERIALB (port B) host descriptors that point at a Host Link (C-mode or FINS) connection on RS-232C/RS-422, and the HOST1...HOSTn descriptors that point at FINS/UDP nodes over Ethernet. Re-pointing tags in the project from SERIALA to HOST3 is only part of the migration. A residual serial variable set inside the NS HMI's compiled symbol table (the database that gets downloaded together with the .ipp file) will continue to request polling on the serial host, which causes the HMI to refuse to bring up the Ethernet host and to raise a host-fault (Error Code A0 / A1 / A2 depending on host slot) on power-up.

This reference documents the full migration procedure: tag rewriting, symbol-table cleanup via the underlying Access MDB, CX-Integrator routing table generation, Ethernet unit parameter setup on the CJ1W-ETN21 or CJ2-CPU3x built-in ETN21, project transfer, and verification. The procedure was developed against an NS5-SQ10B connected to a CJ1G-CPU43H with CJ1W-ETN21, and validated on the same HMI against a CJ2M-CPU34 with its built-in ETN21 port. The same procedure applies to NS8, NS10, NS12 and NS15 hardware; NS3 and NSJ controllers use a different tool flow and are out of scope here.

2. Prerequisites

Verify the HMI system program version before starting. With the NS unpowered, hold the top-left and top-right corners of the touch screen while applying power to enter Maintenance mode. The system program version appears under PT - System Information. Versions below v6.2 do not support multi-host Ethernet and require a separate firmware update from CX-Designer. Refer to the Omron NS-series product page for the latest firmware revisions per model.

3. Communication Architecture: Serial vs Ethernet

The NS HMI supports up to three concurrent host links (Host Slot 1, Host Slot 2, Host Slot 3 in CX-Designer terminology, displayed as "HOST1", "HOST2", "HOST3" inside address strings). Each host slot binds to a physical communication channel plus a protocol layer. Migration is therefore a host-slot remapping problem, not a global protocol change.

*EtherNet/IP is supported only on NSJ controllers and on NS5 v8.4+ firmware running against CJ2 or NJ-series PLCs. Classic NS5 SQ/TQ hardware supports FINS/UDP and FINS/TCP only.

The shortened form HOST3DM0100 works only when the project-level default FINS routing fields (Local Network Number, Local Node Number) are populated correctly. If you need explicit inter-network routing, use the long form HOST3:RemoteNet:RemoteNode:LocalNet:LocalNode:DM0100. When migrating, leaving Local Network = 0 and Local Node = 0 forces the HMI to broadcast, which can pollute the network and slow the host fault response.

4. NS5 Ethernet Port Details and Pinout

The NS5-SQ10B/-SQ11B/-TQ10B/-TQ11B ships with a single 10/100BASE-TX RJ45 port on the bottom of the unit. The port is auto-MDI/MDIX and will negotiate polarity automatically; however, in a known case of field commissioning on a 2011 NS5-SQ10B running system program v6.2, the auto-MDIX logic did not engage when the partner was an older Cisco 2950 set to 10BASE-T fixed, and a green Link LED came on without any traffic. Always use a known-good CAT5e cable and force the partner switch port to 100BASE-TX full duplex if possible.

By contrast, the SERIALA port A is a male DB9 with the standard Omron XW2Z pinout (2-TXD, 3-RXD, 4-RTS, 5-CTS, 7-SG, 8-CD). When migrating, the serial cable can be retained for backup or removed entirely; it does not need to be physically removed from the enclosure, but it must be electrically quiet so that the residual SERIALA host-fault does not appear in the system log.

5. Pre-Migration Inventory

Before touching the project, capture the following parameters so that the new Ethernet configuration can be matched to the existing tag space.

1. Open the SERIAL-based .ipp project in CX-Designer.
2. From Project - Properties - Communications, record each host slot currently in use (SERIALA = Slot 1, SERIALB = Slot 2 by default).
3. Run Tools - Address Cross Reference and export to CSV. This produces the complete list of PLC address references that need rewriting.
4. Open PT - System Information in the project tree and capture: PT model, system program version, project size (KB), number of pages, number of alarms, Memory Link buffer size if used, and the number of parts (overlapped objects share a single tag, so the part count is much higher than the tag count in projects with many indicators).
5. From the PLC side, in CX-Programmer open the PLC's I/O table and note whether the Ethernet unit (e.g., CJ1W-ETN21) is mounted and at what rack/slot position. For CJ2 with built-in Ethernet, note the CPU model (CPU31, CPU32, CPU33, CPU34, CPU35, CPU65) and unit version.
6. Physically inspect the existing RS-232C cable. The NS5-SQ port A is a male DB9 with the standard Omron XW2Z pinout. The CJ1W-CIF11 cable from the PLC peripheral port and the CS1W-CN118 from the CJ2 tool port have different pinouts; do not reuse the same cable for Ethernet.
7. Capture the existing PLC DM area layout. The SERIALA Host Link C-mode address space is the same as the Ethernet FINS address space, so the DM/CIO/WR/HR addresses themselves do not change; only the host descriptor in front of them changes.

6. Step-by-Step: HMI Project Tag Conversion (SERIALA → HOST3)

The fastest path is a project-wide find-and-replace of the host descriptor, followed by manual verification of any tag using routing prefixes. The recommended pattern is to migrate SERIALA to HOST3 and SERIALB to HOST1 (or another free slot) so that the new Ethernet hosts occupy the higher slots and any leftover serial references show up clearly during the address cross-reference review.

1. Make a working copy of the .ipp file. Open the working copy in CX-Designer.
2. Open Edit - Find and Replace. Set Search Scope to "Whole Project". In the Find field enter SERIALA. In the Replace field enter HOST3. Execute Replace All. CX-Designer reports the number of replacements; expect 200-2000 hits for a typical 50-page application.
3. Repeat for SERIALB → HOST1 if SERIALB was in use. If SERIALB is unused, skip this step.
4. Manually inspect any tag whose original form included a routing prefix such as SERIALA1:0:0:2. In CX-Designer address notation the routing is included as <host><localNode>:<localNet>:<remoteNet>:<address>. The Host Link "1" between the host name and the colons is the destination FINS node (in Host Link C-mode it represents the PLC station number). For Ethernet, this must be replaced with the FINS node number assigned to the CJ1W-ETN21 in CX-Integrator. The default CJ1W-ETN21 IP is 192.168.250.1 and FINS node is 1; on a customer LAN these values will differ.
5. Open Project - Properties - Host. The Hosts table must define Host Slot 3 with the correct protocol (FINS/UDP recommended), target IP address, and target FINS node number. Set Local Network Number to match the network the HMI sits on. Set Local Node Number to a value unique on that network; 240 (0xF0) is a common choice for an HMI gateway node.
6. Save the project under a new filename reflecting the migration (e.g., MachineA_NS5_ETH.ipp) so the SERIAL original remains as a fallback.

7. Step-by-Step: Symbol Table Cleanup (MS Access)

The reason SERIAL-host references cannot be disabled from within CX-Designer's host configuration dialog is that residual SERIALA / SERIALB variable records remain in the compiled symbol table that gets downloaded to the NS. The NS HMI polls every symbol in this table on its corresponding host slot. If SERIALA is still in the host list and there are symbol entries pointing at SERIALA, the NS repeatedly times out trying to read RS-232C characters that never arrive, and the Ethernet host slot is marked in error. The only way to scrub these records cleanly is to edit the underlying MDB.

1. Make a backup of the .ipp file as a .cxp or simply duplicate the .ipp folder. The .ipp is a ZIP container; rename to .zip and verify it contains a SymbolTable.mdb (CX-Designer v3.5+) or SYMBOLT.MDB (v3.0) file. The exact internal filename varies between CX-Designer revisions; older projects may embed it as SYMBOLT.MDB in the root of the archive.
2. Extract the .ipp file (e.g., MachineA_NS5_ETH.ipp) to a working folder using 7-Zip or WinRAR.
3. Open the extracted folder and locate the MDB. Copy it to a separate folder for editing so the original is never touched until the cleaned version is verified.
4. Open the copied MDB in Microsoft Access 2003 or 2010 (32-bit; the 64-bit ACE provider does not work with the legacy Symbol Table structure on all versions).
5. The relevant tables are typically named VariableTable, SymbolTable, and HostTable. Open HostTable and inspect. The HostName column will list SERIALA, SERIALB, HOST1, HOST2, HOST3. Record the IDs of any SERIAL host entries.
6. Open VariableTable. Filter on the HostID column for any SERIAL host ID. Select All, Delete. Confirm the deletion when prompted by Access.
7. Open SymbolTable. Repeat the filter-and-delete step for any rows that reference a SERIAL host ID. Some CX-Designer versions use a single combined VariableTable that includes both the human-readable symbol name and the host binding; in that case the HostID column is the only filter needed.
8. Compact and repair the MDB in Access (Database Tools - Compact and Repair). Close Access.
9. Replace the original MDB inside the .ipp folder with the cleaned MDB. Re-zip the folder back into a .ipp using 7-Zip in store mode (no compression). The .ipp container uses a fixed CRC and the CX-Designer Transfer Tool rejects the project if compression has changed the byte alignment of unchanged files.
10. Open the modified .ipp in CX-Designer to verify the project still parses without errors. CX-Designer issues a warning about the MDB version mismatch — this is expected and can be dismissed.

8. Step-by-Step: CX-Integrator Ethernet Network Setup

CX-Integrator (formerly part of SYSMAC Manager) generates the FINS routing tables that must be downloaded to every FINS node on the network. For an NS5-CJ1W-ETN21 setup, both ends need routing tables.

1. Connect the engineering PC to the same Ethernet subnet as the CJ1W-ETN21. Open CX-Integrator.
2. Select File - New Project. In the Network pane, add a new Ethernet network with the correct IP subnet (e.g., 192.168.250.0/255.255.255.0).
3. Right-click the new network and select Add Device - Ethernet Unit. Enter the IP address of the CJ1W-ETN21 (default 192.168.250.1) and the unit's FINS node number (default 1). The unit type selector should display "CS/CJ Ethernet Unit (ETN21)".
4. Add a second device representing the NS5 HMI. The NS appears on Ethernet as an "NS-series PT". Enter the planned NS IP address (e.g., 192.168.250.20) and assign FINS node 240.
5. Right-click the ETN21 device and select Generate Routing Table. This produces a binary FINS routing table that must be transferred to the unit.
6. Connect to the ETN21 using the FINS/UDP Transfer Tool (or directly via the Transfer to Device command in CX-Integrator). On the ETN21, the routing table is stored in the CPU's UM area; transfer takes 2-5 seconds for a typical 8-node table.
7. Right-click the NS device and select Transfer Routing Table to PT. The NS stores its routing table in NV memory; transfer takes 5-10 seconds. The PT display blanks during the write.
8. Verify routing by selecting Diagnostics - PING from the CX-Integrator toolbar, then Diagnostics - FINS Echo Test. Both should return success.

9. PLC Ethernet Unit Configuration

The CJ1W-ETN21 (or the CJ2 built-in ETN21) must be told which FINS nodes are valid on the local network, what its own IP is, and which UDP/TCP ports to listen on.

1. In CX-Programmer, open the PLC project. Go online.
2. Double-click the I/O table entry for the ETN21 to open the Edit Parameters dialog.
3. Set the IP Address, Subnet Mask, and Default Gateway fields. For the migration case where the NS replaces a serial link, keep the same IP that the ETN21 was already using (if it had been used for other Ethernet devices); otherwise pick a free address and document it.
4. On the FINS/UDP tab, set UDP Port Number to 9600 (default). Set FINS Node Number to 1 (or whatever was assigned in CX-Integrator).
5. On the FINS/TCP tab, leave TCP Port Number at 9600. Enable "Auto-allocation of FINS Node Number from IP Address Last Byte" if many devices exist; otherwise leave disabled and assign nodes manually.
6. On the IP Address Table tab, add a row for the NS HMI. Set IP to the NS IP, set FINS Node to 240. This entry is required so that the ETN21 knows to forward FINS frames to the NS.
7. On the Routing Table tab, verify that the auto-generated table matches the one created in CX-Integrator. If CX-Integrator already wrote the routing table directly, no further work is needed.
8. Transfer the new ETN21 parameters to the unit. The unit restarts its Ethernet service (~3 seconds), during which the PLC CPU continues running but FINS traffic is briefly suspended.

10. Migration Topology Diagram

11. Project Transfer and Verification

After both the project and the network tables have been updated, transfer the project to the NS and verify communication.

1. Connect the engineering PC to the NS HMI via Ethernet. The NS must be in Transfer mode: from the system menu, select PT - Transfer - Receive, or hold the top two corners during power-up to enter Maintenance mode and select Transfer from the menu.
2. In CX-Designer, select PT - Transfer - Transfer [To PT]. Browse to the cleaned .ipp file. Set the destination IP to the NS. Click Transfer. A typical 4 MB project takes 2-4 minutes over 100BASE-TX.
3. The NS restarts automatically at the end of the transfer. Watch for the standard project title screen to appear within 30 seconds.
4. Open the system menu again and select PT - Status - Communications Status. Each host slot should display either "Normal" or "Error". For the migrated Ethernet host (HOST3), the status must be "Normal". For the now-disabled SERIAL hosts, the status will be "Not Used" or may briefly flash "Error" before timing out — this is acceptable and is the residual effect of any symbol table entries not fully cleaned.
5. Navigate to a page that contains several DM and CIO references. Confirm that the numeric displays update in real time (typical update cycle 200-500 ms). If a display reads "####" or "????", the address is still being polled on a missing host — this indicates an incomplete symbol-table cleanup. Repeat Section 7.
6. Run PT - System Information - Log and clear the log. Operate the machine for 5 minutes. Return and inspect the log for any host-fault entries (codes A0, A1, A2, A3, B0, B1, B2). Code A0 is "host offline" and is acceptable for SERIAL hosts that have no symbol references; it must not appear for HOST3.

12. Troubleshooting Matrix

13. Host-Fault Code Reference

14. Performance Considerations

The NS HMI polls tags in groups; the update cycle is governed by the "Communication Cycle Time" parameter on the project-level Communications tab. The default 200 ms cycle applies to all hosts collectively, not per host. On a heavily-loaded application with 1000+ tags, the cycle can stretch to 500-800 ms even on a clean FINS/UDP network.

15. Security and Plant Network Considerations

Migrating from SERIALA to Ethernet brings the HMI onto the plant network, which has security implications that the serial topology did not.

• Default NS5 Ethernet has no authentication. Any PC on the same subnet can read tags, write tags, change screens, and transfer projects. Enable the NS "Password" function in CX-Designer and restrict project transfer to a specific IP address in the ETN21 IP Address Table.
• The CJ1W-ETN21 IP Address Table functions as an implicit firewall: only IPs in the table receive FINS forwarding. Populate it with the NS IP, the SCADA server IP, and the engineering PC IP; leave all other entries empty.
• If the plant uses VLANs, the HMI should be placed on an operations VLAN (e.g., VLAN 100) and the engineering PC on an IT/OT management VLAN (e.g., VLAN 10). Inter-VLAN routing must traverse a managed switch with ACLs.
• For air-gapped cells that previously used SERIALA and where the customer is now forcing Ethernet, recommend that the customer install a small dedicated Ethernet switch (e.g., Cisco IE-1000 or Stratix 5700) with no uplink to the corporate network. This preserves the air gap while satisfying the "Ethernet" requirement.

16. Migration Decision: Keep SERIAL vs Switch to Ethernet

For greenfield installations, Ethernet is preferred for these reasons:

• Cable distance: 100 m per segment vs ~15 m for RS-232C and ~500 m for RS-422/485.
• Bandwidth: 100 Mbps vs 19.2 kbps for Host Link.
• Multi-drop: any IP-addressable device can be added without changing the HMI program; SERIALA is point-to-point only.
• Diagnostic tools: CX-Integrator FINS echo, Wireshark FINS dissector, and PLC-side ETN21 packet counters vs only an RS-232C line analyzer for serial.
• Convergence with IT networks: the NS HMI can be accessed by the plant MES layer for screen replication and remote diagnostics.

SERIAL remains appropriate when the HMI is co-located with the PLC, the application is safety-rated and must be air-gapped from the IT network, or the customer already has a large installed base of Host Link SCADA nodes and the engineering cost of touching every node outweighs the operational benefit. In practice, for an NS5 in an enclosure within 5 m of the PLC, the migration is not technically justified; the existing SERIALA program should be left in place.

17. FAQ