Resolving BCD Counter Overflow on Omron CQM1 HSC Inputs

Problem Definition and Operational Impact

An Omron CQM1-CPU43-V1 station equipped with an ID212 24 VDC input module is tasked with counting incoming pulses to a target of 65,000 (and, in an extended requirement, 100,000). The technician observes that the counter value always appears as BCD digits in CX-Programmer and is effectively limited to 9,999. This is the dominant symptom when a legacy CNT(47) instruction is used in place of a high-speed counter, because CNT(47) stores its Present Value (PV) in 4-digit BCD format.

The root constraint is encoding, not speed. CNT(47) runs at the scan rate and cannot keep up with encoder or pulse-train inputs above a few hundred hertz; it also stores the PV in packed BCD (0000–9999). The visible four-digit value in the monitor is simply CNT doing its job, but on the wrong task. The correct fix on a CQM1 platform is to deploy a built-in High-Speed Counter (HSC) with binary 16-bit (or extended 32-bit) storage in the Special I/O area, accessed through the CQM1 Operation Manual (W195) and configured in CX-Programmer (the official CX-Programmer programming suite).

Hardware Identification and HSC Channel Allocation

The CQM1-CPU43-V1 is a member of the CQM1H/CQM1 compact modular family. It exposes 16 built-in DC inputs on IR 000 (bits 00.00 through 00.15) and 16 built-in transistor outputs. The first six bits of IR 000 are reserved for HSC use when the HSC function is enabled in the PLC Setup:

The CQM1-CPU43-V1 stores each HSC PV as a 16-bit binary word in the Special I/O area:

• IR 230 – HSC 0 PV (low word)
• IR 231 – HSC 0 PV (high word; for 32-bit modes)
• IR 232 – HSC 1 PV (low word)
• IR 233 – HSC 1 PV (high word)
• IR 234 – HSC 2 PV (low word)

Root Cause: BCD Encoding in CNT(47) vs Binary in HSC

Omron's classic counter/timer family (TIM, TIMH, CNT, CNTR) stores its PV in packed BCD because these were originally designed for direct display on a 4-digit 7-segment panel. A single 16-bit word holds four BCD digits (0–9), so the maximum is 9,999. Even when the value is read into CX-Programmer, the monitor renders the BCD digits rather than the underlying bits. If a single bit within the word is set, the displayed value becomes nonsense, which is the typical "always BCD" symptom.

The HSC, in contrast, stores its PV as straight binary and supports a 16-bit (0–65,535) or 32-bit (0–4,294,967,295) range depending on the PLC Setup. For a 65,000 target, a 16-bit HSC is sufficient; for 100,000 the HSC must run in 32-bit mode or the application must be migrated to a CS1/CJ1 CPU (the CJ1-CPU1x supports a 32-bit binary counter with a 0–16,777,215 range in BCD mode or 0–4,294,967,295 in binary mode).

PLC Setup: DM6640–DM6644 HSC Configuration

On a CQM1, HSC behavior is governed by the PLC Setup words DM 6640 through DM 6644. The default factory values disable the HSC. The relevant fields for an up-counter on HSC 0 with software reset and a 32-bit PV are summarized below.

Always download the PLC Setup to the CPU after a power cycle; the CQM1 latches the values in flash and applies them at next scan start. The CQM1 Operation Manual lists the full bit-map; on a -V1 (or later) CPU, fields 8–11 of DM 6640 enable 32-bit linear mode, which is mandatory when the target exceeds 65,535.

Reading HSC PV with PRV(62) and Direct IR Access

There are two equally valid ways to consume the HSC PV. The first uses the dedicated read instruction PRV(62):

LD    W0.00       ; Trigger (e.g. PB READ)
@PRV(62)
  C:  #0000       ; C = 0000 selects HSC 0 current PV
  D:  DM0100      ; Destination: lower word
  D+1: DM0101     ; Upper word for 32-bit

For 32-bit PV, set the upper-word destination one word above the lower-word destination. Control word 0000 reads binary; 0100 reads BCD. Always request binary when the destination is consumed by arithmetic or by a host computer.

The second, simpler approach is to read the Special I/O area directly:

LD    W0.00
@MOV(21)  IR230  DM0200   ; copy HSC 0 PV (low word) to DM 0200
@MOV(21)  IR231  DM0201   ; copy HSC 0 PV (high word) to DM 0201

This bypasses the instruction overhead entirely and is the approach most often shown in factory code. Treat IR 230/IR 231 as a read-only pair; never write to them from the user program — the HSC controller will overwrite the value on the next input edge.

Software Counter Using ADDL(54) and SUBL(55) for Double-Word Counting

If the HSC channels are already assigned to other tasks, a 32-bit software counter can be implemented using ADDL(54) (Double Add) and SUBL(55) (Double Subtract). The technique is a CPU-side emulation of an HSC, valid for input rates at or below the scan time, and the PV is binary by construction.

; --- 32-bit up-counter on bit W0.01 (single input edge) ---
LD     W0.01
AND    %TRIG_DONE_INV
OUT    TR0
@ADDL(54)
  Au : DM0300        ; low word of the double-word PV
  Ad : DM0301        ; high word
  R  : #0001         ; addend (low) = 1
     : #0000         ; addend (high) = 0
  R+1: DM0300        ; result destination
     : DM0301
LDN    W0.01
OUT    %TRIG_DONE_INV

Reset is done with DIST(11) (Single Word Distribute) writing 0000 to both halves of the double word:

LD     W0.02       ; reset pushbutton
@DIST(11)
  S  : #0000       ; source constant
  C  : DM0300      ; base = lower word
  D  : DM0301      ; offset = high word index

For 100,000 pulses, this 32-bit binary counter easily holds 0–4,294,967,295 and avoids the 65,535 wall of a single 16-bit word. The trade-off is that the maximum count rate is the inverse of the scan time (typically 5–10 ms for a CQM1 ladder, so 100–200 Hz in practice).

Counting Range: 65,535 vs 100,000 and the 16-Bit Wall

The first user target — 65,000 — fits inside a 16-bit unsigned integer (0–65,535) and can be implemented with a single 16-bit HSC channel. The follow-up target — 100,000 — does not. Three options exist:

1. 32-bit HSC mode on the same CQM1: set DM 6640 bits 8–11 to 1, read both IR 230 and IR 231. Range 0–4,294,967,295.
2. 32-bit software counter using ADDL(54)/SUBL(55). Range identical to option 1 but bound by scan time.
3. Prescale the input: a binary divider on the input pulse train reduces the count frequency by a factor of N. The application then multiplies the displayed PV by N in the host. This is rarely the right answer because the overflow signal must still be wired, but it is acceptable for slow, low-resolution applications.

For a 100,000 pulse target, option 1 is preferred when the pulse frequency exceeds the scan rate; option 2 is fine for encoder or limit-switch inputs well below 100 Hz.

Software and Z-Phase Reset Strategy

HSC reset on a CQM1 is configurable. The PLC Setup value in DM 6640 bits 4–7 selects the active reset source:

• 0 – software reset only (turn SR 252.00 ON for one scan to clear HSC 0 to zero).
• 1 – Z-phase reset only (input 00.02 for HSC 0 in differential mode).
• 2 – software OR Z-phase (any of the above).
• 3 – software AND Z-phase (both must occur simultaneously).

The field report mentions "the 253.00 bit to reset". In Omron addressing, SR 253.00 is the Always ON flag (one of the system bits, always 1); it is not a software-reset trigger. The correct bit for HSC 0 software reset is SR 252.00. HSC 1 is SR 252.01, HSC 2 is SR 252.02. Treat the 253.00 reference in the source as a typographical error for 252.00.

; --- One-shot software reset of HSC 0 ---
LD     W0.03       ; reset request (e.g. one-shot PB)
DIFU(13) W0.03_O   ; single-scan pulse
LD     W0.03_O
OUT    SR252.00    ; software-reset HSC 0

For a Z-phase reset, leave SR 252.00 OFF in the user program and let the encoder's Z output pulse clear the HSC PV once per revolution. Z-phase reset is deterministic and immune to scan-time jitter; it is the correct choice for any motion-encoder application.

Host Link (SYSWAY) Integration with Visual Basic

To expose the counter value to a Visual Basic application, the standard protocol on a CQM1 is the Host Link (SYSWAY) serial protocol on the peripheral port (RS-232C) or on an optional CM001 communications module. The relevant commands are:

• RR – read IR/SR/CIO area word(s). For HSC 0 PV, request words 0230 and 0231 to obtain a 32-bit value.
• RW – read TC/DM area word(s). Useful for the mirrored copy in DM 0200/DM 0201.
• MD – read operating mode.
• SC – write status to control word (run/stop).

A minimal VB 6 example using the MSComm control on COM1:

Private Sub cmdReadCounter_Click()
    Dim cmd As String
    Dim fcs As Byte
    Dim resp As String

    ' Frame: @ 00 RR 0230 0002 FCS * CR
    cmd = "@00RR02300002"
    fcs = CalcFCS(cmd)              ' XOR the trailing bytes
    cmd = cmd & Hex(fcs) & "*" & vbCr

    MSComm1.Output = cmd
    ' wait for terminator (vbCr)
    Do: DoEvents: Loop Until InStr(MSComm1.Input, vbCr) > 0
    resp = MSComm1.Input

    ' Parse "@00RR00XXXXYYYYFCS*"
    Dim loWord As Long, hiWord As Long, value32 As Double
    loWord = CLng("&h" & Mid$(resp, 9, 4))
    hiWord = CLng("&h" & Mid$(resp, 13, 4))
    value32 = (hiWord * 65536) + loWord
    lblCounter.Caption = CStr(value32)
End Sub

Private Function CalcFCS(s As String) As Byte
    Dim i As Integer, x As Byte
    x = 0
    For i = 1 To Len(s)
        x = x Xor Asc(Mid$(s, i, 1))
    Next
    CalcFCS = x
End Function

Port settings: 9,600 baud, even parity, 7 data bits, 2 stop bits (E72) is the CQM1 factory default for Host Link. The peripheral port uses unit number 00 by default. The full protocol grammar is in the CQM1 Host Link section of the CQM1 Operation Manual. For a newer system, the same approach works with the C-series replacement CP1E/CP1L via the Modbus-RTU slave functionality exposed on the option port.

Verification and Commissioning Procedure

1. Wire the input pulse source to the integrated CPU terminal (e.g. 00.00 for HSC 0 phase A). Do not wire to the ID212 input module terminals.
2. Open CX-Programmer, go online with the CQM1, and download the corrected DM 6640–DM 6644 block. Cycle power to the PLC to latch the Setup.
3. Force SR 252.00 ON for one scan to clear the HSC PV to 0. Monitor IR 230/IR 231 — both should read 0000.
4. Apply 1,000 pulses from a calibrator. Monitor IR 230 in Binary display mode. The PV should read 03E8 hex (1,000 decimal), not BCD 1000 with the high nibble of IR 230 stuck at F.
5. For the 65,000 target, apply 65,000 pulses and verify IR 230/IR 231 reads 0000FDE8 (or your 32-bit mirror in DM 0200/DM 0201).
6. For the 100,000 target, ensure the HSC is in 32-bit mode and verify that the application math correctly combines IR 230 and IR 231 into a single 32-bit value.
7. From the host (VB), read IR 0230 0002 via Host Link. The terminal should echo the binary value as a hex string (e.g. 00FDE8 for 65,000).

Troubleshooting Matrix

Frequently Asked Questions