Omron PLC Serial Communication: SysmacWay and Toolbus Protocol

1. Overview

Omron's small-format PLCs (CPM2A, CP1L, CP1H, CJ1M, CQM1H, SRM1) historically expose two distinct serial protocols over the same physical RS-232 / RS-422 hardware: Host Link (also branded SYSMAC WAY) and Toolbus. The protocol selection is not always obvious because both protocols share the same electrical interface, the same default baud rate (9 600 bps), the same data format (7 data bits, Even parity, 2 stop bits), and in many cases the same peripheral port. Field experience shows that a CPM2A purchased today will accept either protocol on its peripheral port without any DIP-switch reconfiguration, while a CP1L with a CP1W-CIF01 option board behaves identically once the port is enabled in the PLC Setup area.

This reference consolidates the protocol differences, the cable pinouts, the CX-Programmer / CX-One project settings, and the most common failure modes observed when connecting modern PCs (which no longer ship with native DB-9) to legacy Omron CPUs.

2. Protocol Fundamentals: SysmacWay vs Toolbus

SysmacWay is a subset of Omron's older Host Link command set (C-mode), exposed in CX-Programmer under the SYSMAC WAY driver. The protocol is human-readable: a typical read request for DM0000 takes the form @00RD0000000050FCS*CR where @ starts the frame, 00 is the unit number, RD is the read-DM command, 00000000 is the start address, 50 is the word count (BCD, 50 = 50 dec = 0x32, equivalent to 50 decimal words), and FCS*CR is the 2-character Frame Check Sequence plus terminator. Toolbus replaces all of those ASCII characters with compact binary control bytes and a CRC-16, which is why the same physical link can be 2-3× faster for project transfers.

3. CPM2A Communication Architecture

The CPM2A ships with one fixed peripheral port (4-pin mini-DIN, top of the CPU) and one RS-232C port (DB-9, bottom of the CPU) on 30- and 40-point models; 20-point models expose only the peripheral port and require a CPM1-CIF01 adapter to add DB-9 connectivity.

• Peripheral port: Carries Toolbus by default, but can be re-mapped in DM6650-DM6653 (PLC Setup area 1) to Host Link at any standard baud rate from 1 200 to 19 200 bps. The DIP switches on the front of the unit (SW1, SW2) only select the communication parameters (baud, format), not the protocol.
• RS-232C port: Default is Host Link / SysmacWay at 9 600 / 7-E-2. Re-mappable through DM6645-DM6648 (PLC Setup area 0) to Toolbus for the CJ1M/CJ2M family, but not on the CPM2A itself: the CPM2A RS-232 port is hard-wired to Host Link only.

Field practice: connect CX-Programmer to the peripheral port and let it auto-detect; the programmer will negotiate Toolbus because that is the port's default. Connect an HMI to the DB-9 port and select SysmacWay because that is the only protocol available there.

4. CP1L Serial Port Configuration

The CP1L base unit has no built-in serial port. Serial communication requires one of:

Once the CIF01 is installed, the port mode is set in the PLC Setup → Serial Port 1/2 tab in CX-Programmer (or in CX-Configurator / Network Configurator for FINS routing). For Host Link the relevant fields are:

• Port Mode: Host Link
• Unit Number: 0-31 (default 0, must match CX-Programmer driver settings)
• Baud Rate: 9 600 default, supported 1 200 / 2 400 / 4 800 / 9 600 / 19 200 / 38 400 / 57 600 / 115 200
• Data Format: 7,E,2 standard; 7,N,2 only if the SCU/option board is set to Non-Standard mode

5. Cable Pinouts and Wiring

5.1 PC DB-9 ↔ Omron PLC DB-9 (CIF01 / CP1L built-in option)

This is a straight-through crossover of only 2-3 signal lines plus ground. No hardware handshaking is required because Omron PLCs do not assert RTS/CTS for Host Link or Toolbus sessions. If you build a generic "serial extension" cable you will get a "disconnected" or "timeout" error from CX-Programmer — that is almost always a missing SG on pin 9 (Omron uses pin 9 for signal ground, not pin 5 as the rest of the world does).

5.2 USB ↔ Omron PLC (Modern PC without DB-9)

Three paths exist, in order of reliability:

1. Omron CS1W-CIF31 USB-Serial converter, the only USB converter officially validated for CX-Programmer. Driver: OMRON SYSMAC USB CDC ACM (VID 0x0590, PID 0x0044). Auto-installs on Windows 10/11; on Windows 7 use the omron-virtual-com-port INF from CX-One DVD 4.x.
2. FTDI FT232R-based converters (FTDI TTL-232R, etc.) with the standard FTDI VCP driver 2.12.x. Set latency timer to 1 ms in Device Manager → Port (COMx) → Properties → Port Settings → Advanced; the default 16 ms latency will cause CX-Programmer to time out during program upload.
3. CH340 / HL-340 / PL2303 clones: not recommended. The CH340 has been observed to corrupt Toolbus frames above 19 200 bps and to drop the DTR signal the CPM2A uses for auto-detect. If you must use one, lock the baud rate in the CX-Programmer driver to 9 600 and explicitly select SYSMAC WAY rather than Auto-detect.

6. Communication Parameters and PLC Setup

Default Host Link parameters across the CPM/CQM/CP1/CJ1 family:

7. CX-Programmer / CX-One Driver Configuration

In CX-Programmer, configure the connection in Change PLC → Network Type → SYSMAC WAY for Host Link, or Network Type → Toolbus for programming. The relevant fields:

• Network Type: SYSMAC WAY / Toolbus / Ethernet / Controller Link / Toolbus-via-Ethernet (FINS/TCP)
• COM Port: COM1-COM256, match Device Manager
• Baud Rate: must match PLC (default 9 600)
• Data Bits: 7 (Host Link) or 8 (Toolbus auto-detected)
• Parity: Even (Host Link) or None (Toolbus)
• Stop Bits: 2
• Unit Number: 0 by default; the CPM2A peripheral port ignores unit number, the DB-9 port uses 0-31

Use Online → Auto Online → Direct Online to let CX-Programmer cycle through every available driver on every COM port at 1 200 / 2 400 / 4 800 / 9 600 / 19 200 bps. This is the recommended first step when you do not know which protocol the port is currently locked to.

8. SysmacWay Frame Example (Read 10 words from DM0000)

Request (PC → PLC, ASCII):
  40 30 30 52 44 30 30 30 30 30 30 30 30 31 30 46 43 53 2A 0D
  @  0  0  R  D  0  0  0  0  0  0  0  0  1  0  F  C  S  * CR
  ^start    unit=00  cmd=RD  start_addr=0000  count=10(BCD "0010")  FCS  ^end

Response (PLC → PC, ASCII, normal completion):
  40 30 30 52 44 30 30 46 41 31 30 30 30 30 30 31 30 30 32 ... F  C  S  *  CR
  @  0  0  R  D  0  0  F  A  1  0  00 00 01 00 02 ... FCS  *  CR
  ^start    unit=00  cmd=RD  end_code=00(FA = OK)  data[20 hex chars / 2 = 10 words]  FCS  ^end

If the response starts with @00RD00FA and the data field is present, the read succeeded. If the response is @00RD?? with an end code other than 00 or simply absent, refer to the Omron Host Link error code table:

9. Toolbus Frame Example (Read 100 words from DM0000)

Toolbus frames are binary and use a 4-byte header: [0xCF] [length] [command] [sub-command] [data...] [CRC-16 lo] [CRC-16 hi]. The response mirrors the request with a status byte (00 = OK, 0x0B = address over range, 0x0F = FCS error). Toolbus auto-negotiates baud rate and parity on the very first frame, which is why the PC can usually talk to a CPM2A peripheral port without knowing what the DIP switches are set to — the negotiation sequence begins at 9 600 / 7-E-2 by default and steps up to 115 200 if both sides support it.

10. Troubleshooting Matrix

11. Verification Procedure

1. Power up the PLC and observe the PWR and RUN LEDs. Solid green on PWR, flashing green on RUN = CPU is healthy. Solid red on ERR/ALM = fault that will not affect serial comms but will block program upload.
2. From a terminal emulator (Tera Term 4.x recommended over PuTTY for COM port support), open the COM port assigned to the USB-Serial converter at 9 600 / 7-E-2 / No flow control.
3. Type @00RD0000000005 followed by Enter. A working Host Link connection returns @00RD00FA... with 10 hex characters (5 words × 2 hex chars per word). A broken connection returns nothing, returns the same string echoed, or returns ? characters.
4. In CX-Programmer, go to Online → Auto Online → Direct Online. The "Searching..." dialog should report "1 PLC found" within 5-10 seconds. Confirm the detected CPU type matches the actual label on the front of the unit.
5. Transfer the program to disk: File → Save As with the project name matching the physical asset tag. Compare the saved project against the most recent backup on the plant historian.

12. Frequently Asked Questions