Reading K3HB-VLC PV via CompoWay/F and Modbus on CPM2A and CJ1M

Overview

The Omron K3HB series digital panel meters expose a single serial option slot that accepts either the FLK1A (RS-232C) or the FLK1B (RS-485) communications board. Combined with the base unit model, the ordering code reads K3HB-□FLK1B. For process-variable (PV) readout, the K3HB-VLC1 is the linear-signal DC input variant (voltage/current with scaling) and is the most common match for analog sensor readout in a PLC panel.

The K3HB supports only two serial protocols:

• CompoWay/F - Omron's proprietary master/slave protocol, ASCII framed, 1:1 or 1:N multi-drop on RS-485.
• Modbus RTU - third-party standard, 1:1 or 1:N multi-drop.

There is no host-mode (initiator) capability in the K3HB itself - the device is always a slave. The PLC must be the master. This article documents both protocol paths and the hardware/script ladder required to read PV when the CPU is a CPM2A (no CX-Protocol) or a CJ1M (with SCU/SCB + CX-Protocol).

Reference documentation:

• K3HB Communications User's Manual (N129-E1-03)
• K3HB-Series Datasheet (N135)
• K3HB-R Pulse Input Series Datasheet (CSM262)

K3HB Communication Options Matrix

All four families share the same serial command set, so the ladder logic below applies identically to VLC, R, S, and H units once the communications option board is fitted.

Master/Slave Role and Single-PLC Rule

Hardware and DIP Switch Setup on the FLK Board

Before ladder work, the FLK1A/FLK1B board on the K3HB must be configured. There are two banks of DIP switches behind the front bezel; both must match the master port parameters.

SW1 - Protocol / Terminator

Baud Rate Selection (SW1-5, SW1-6)

Node Number (RS-485 multi-drop)

For RS-485, the unit number is set on SW1-7, SW1-8 plus an extended bit on SW2-1 (giving 0-31). The K3HB-VLC1 you are querying must have its node number written down - it appears in the response frame as a 2-digit BCD value (00-31). CompoWay/F unit numbers run 00-99 in the 2-digit field; only the low 5 bits are used on the K3HB hardware.

For RS-232C (FLK1A) point-to-point the node number is ignored by the master, but the K3HB still echoes whatever is set on the DIP switch. Set it to 00 for clarity.

CompoWay/F Frame Structure for the K3HB

CompoWay/F is an ASCII command/response protocol. Each frame ends with a 2-character Frame Check Sequence (FCS) calculated as the 8-bit two's complement of the XOR of every byte from the unit number through the ETX inclusive.

Read PV (process variable) request sent to the K3HB:

STX  NodeNo  SubAddr  SID  Command  Data         ETX
0x02 "00"    "00"     "00" "00"     "0000"       0x03  FCS

Concrete ASCII bytes sent to a K3HB-VLC1 with node 00, reading variable area 0x0000 (PV):

02 30 30 30 30 30 30 30 30 30 30 30 03 46 43

• 02 - STX
• 30 30 - node "00"
• 30 30 - sub-address "00" (always 00 on K3HB)
• 30 30 - SID "00" (service ID, free for master tracking)
• 30 30 - command "00" (Read Variable Area)
• 30 30 30 30 - data "0000" (start address 0000 = PV)
• 03 - ETX
• 46 43 - FCS (computed)

FCS Calculation (pseudo-code)

fcs := 0x00
for each byte b from NodeNo[0] through ETX:
    fcs := fcs XOR b
fcs := (-fcs) AND 0xFF           // two's complement, mask to 8 bits
emit as 2 uppercase ASCII hex chars

Read PV Response (success)

02 "00" "00" "00" "00" "0000xxxx" "0000" 03 FCS

Where xxxx is the 4-hex-digit BCD/hex value of the PV in the engineering unit set on the K3HB (e.g. 0198 for 19.8 with the second decimal place configured). The read data is returned as ASCII hex digits; the master must convert to integer before any scaling.

Read PV Response (error)

02 "00" "00" "00" "0F" "0F00" 03 FCS

Command 0x0F in the response means command error; the 4-digit error code in the data field maps to the K3HB communications error dictionary (Section 6 of N129).

Modbus RTU Register Map for the K3HB-VLC

When SW1-1 is ON, the K3HB speaks Modbus RTU on the same FLK port. Function codes supported are 03 (read holding registers), 06 (write single register), and 16 (write multiple registers). The register map is fixed for all K3HB base units:

Read PV frame (Modbus RTU) for node 1:

Tx: 01 03 00 00 00 01 [CRC-Lo] [CRC-Hi]
Rx: 01 03 02 [PV-Lo] [PV-Hi] [CRC-Lo] [CRC-Hi]

CRC is the standard Modbus CRC-16 (polynomial 0xA001, init 0xFFFF), sent low byte first. Be careful with byte order: the K3HB returns the register in Modbus-spec order (low byte first inside the data field), not big-endian.

CPM2A Ladder Implementation (No CX-Protocol)

The CPM2A has one RS-232C port (port 1) configured from the CX-Programmer Settings - Host Link / Peripheral tab. Switch the port to Custom Protocol (no Host Link framing) using the PLC Setup area DM6645/DM6646:

DM6645 = 0000  (RS-232C port: standard, no Host Link)
DM6646 = 0306  (9600 baud, 7 data, 2 stop, even parity - CompoWay/F)
        or 0303 (9600, 8, 1, none - Modbus RTU)

Build a CompoWay/F Read-PV Request String in DM

Write the request frame into a contiguous DM block. The following ladder fragment shows the read-PV command for node 00. Convert each ASCII byte to its two-digit hex representation in DM (the TXD instruction transmits raw bytes, so pre-build the byte string):

Use TXD(236) to emit the block D0100-D0114 (15 bytes) and RXD(235) to capture the 17-byte response into D0200-D0216. A ladder state machine then:

1. Verifies STX at D0200 == 0x02 and ETX at D0214 == 0x03.
2. Recomputes FCS over bytes D0201-D0214 and compares to D0215-D0216. If they differ, increment a comm-error counter and resend.
3. Converts the 4 ASCII hex digits of the PV (D0209-D0212) into a 16-bit integer using a HEX-to-INT ladder routine (subtract 0x30, mask nibbles, OR together).
4. Applies the engineering-unit scaling and stores the result in D0300.

Modbus RTU Variant on the CPM2A

Switch port to 8/N/1 and write the 8-byte request to DM:

D0100 = 01      (node 1)
D0101 = 03      (read holding)
D0102 = 00      (start addr high)
D0103 = 00      (start addr low)
D0104 = 00      (qty high)
D0105 = 01      (qty low = 1 register)
D0106 = CRC-Lo
D0107 = CRC-Hi

Add a 4-ms transmit-receive turnaround timer before RXD(235) starts; the K3HB's Modbus response latency is typically 2-8 ms at 9600 baud. Wait for the RXD completion flag (SR 283.05 on CPM2A port 1) or poll the byte count in AR. Once 7 bytes have arrived, validate the response by re-computing the CRC and confirming it equals 0x0000 (the running-CRC trick).

CJ1M Implementation Using CX-Protocol and SCU

On a CJ1M, the recommended path is to add a CJ1W-SCU31-V1 (RS-422/485) or CJ1W-SCU21-V1 (RS-232C x2) serial communication unit and use the CX-Protocol tool to download a CompoWay/F or Modbus-RTU master protocol macro.

Step-by-Step

1. In CX-Programmer, add the SCU to the I/O table. Right-click the SCU and set the port to Protocol Macro in the Unit Setup.
2. Launch CX-Protocol (separate install). Create a new project bound to the SCU's CPU port number.
3. Use the built-in CompoWay/F Master template (or import the Modbus-RTU Master from the Omron download center: search the Omron KB for Modbus RTU Master Sample for CX-Protocol).
4. Configure the sequence:

Step 0  Send: <node>00 00 00 00 0000 03 +FCS   ; Read variable 0000 (PV)
Step 1  Receive: <node>00 00 00 00 ???????? 03 +FCS
Step 2  PMCR(260) with control word 0100 (channel 1, sequence 0)

5. The wildcard ???? in the receive step tells CX-Protocol to store the matched response into a destination word you specify. The PV is delivered as ASCII hex in the destination DM; add an HEXASCII->BIN conversion step or do it in ladder after the PMCR completes.

If you do not have CX-Protocol, the CJ1M still has a fallback: the CPU unit's built-in RS-232C port supports the same CompoWay/F standard system protocol as the CS/CJ serial boards, and you can call it with PMCR(260) against the built-in serial port (port 1 = built-in RS-232C, port 2 = built-in RS-422/485 on CJ1M-CPU2□). The protocol number for CompoWay/F is 700; for Modbus-RTU master (with the free library add-in) it is 730.

RS-485 Multi-Drop Wiring

For RS-485 (FLK1B), wire the four terminals on the K3HB option board to the SCU or to a third-party RS-485 tap:

K3HB FLK1B       SCU RS-485 (or CPM2A CJ1W-CIF21)
  RDA  ----------- SDA  (data A, inverting)
  RDB  ----------- SDB  (data B, non-inverting)
  SDA  --------------- tie to RDA on far-end (internal jumper to RX)
  SDB  --------------- tie to RDB on far-end
  SG   ----------- SG   (signal ground)
  TERM (120 ohm) ON at both physical ends only

The K3HB ships with internal 120-ohm termination accessible via the SW2-2 switch; enable it on the end-of-line units only, never on mid-span units, or the bus voltage swings collapse.

Verification Procedure

1. Power the K3HB with its option board fitted. Enter the Communications menu (hold the < and > keys for 3 s) and confirm the displayed unit number matches the DIP switch.
2. Connect a laptop running a Modbus/CompoWay/F master tool (e.g. Modbus Poll for RTU, or a generic ASCII send/receive terminal for CompoWay/F) to the same RS-232C/RS-485 port the PLC will use.
3. Send the read-PV request. Verify that the K3HB responds with valid ASCII hex and a correct FCS / valid Modbus CRC. The PV should match the value shown on the K3HB display to within the configured decimal point.
4. Reconnect the PLC. Trigger one PMCR (CJ1M) or one TXD/RXD cycle (CPM2A) from a one-shot pulse. Watch the destination word - the PV should appear within 20-40 ms at 19200 baud.
5. Toggle the K3HB input (e.g. short the 4-20 mA loop with a calibrator) and confirm the PLC value follows in real time.

Troubleshooting Matrix

Field-Commissioning Notes

• The K3HB power-on default for SW1-1 is OFF (CompoWay/F). If you switch to Modbus RTU, cycle power - the K3HB only reads the DIP switches at boot.
• For Modbus RTU, set the PLC port to RS-485 half-duplex, not full-duplex. The FLK1B does not echo its own transmissions; full-duplex drivers on the master will desync the bus.
• The K3HB's PV in Modbus register 400001 is the engineering-scaled value (e.g. for a 0-200.0 degC range with 1-decimal display, register 400001 returns 0-2000 in steps of 1 = 0.1 degC). The decimal position is set in the K3HB's display menu, not on the wire.
• If you are running CX-Protocol and the SCU's ERR LED stays on, the most common cause is the protocol-macro project not being transferred to the SCU flash. CX-Protocol writes the project to the SCU; Transfer to PLC only writes the sequence invocation ladder, not the macro itself.