Resolving CJ1M to Citect SCADA Sysmac-Way Write Failures

Problem Summary

An integrator wires a CJ1M-CPU11 plus three I/O modules to a PC running Citect (now AVEVA Plant SCADA) over RS-232C Sysmac-Way (Host Link C-mode) and the Citect driver reports a working link: the yellow SD/RD LED on the CPU flashes at 9600 baud, the analog meter on the HMI tracks CIO 2001 in real time, and digital input transitions from the CJ1W-ID201 module are correctly mirrored on Citect tags. The fault is one-directional. Pressing the Citect "Start" button never energises CIO 1.00 and the lamp driven by the CJ1W-OC201 contact output stays dark. The Citect kernel reports no comms error and the variable tag for the start command updates to "1" inside the Citect tag database, but the bit never makes it into the PLC. This is the classic CJ1M-to-Citect write problem and it has two independent root causes, both of which must be eliminated before the link becomes bidirectional.

System Reference Configuration

The hardware and software stack used to reproduce and resolve the fault is shown below. Use it as a baseline when you work with adjacent CJ1M variants (CPU12, CPU13, CPU21/22/23) — the memory map, Host Link behaviour, and Citect address syntax do not change across the family because CS1 and CJ1 share the same instruction set and address layout.

Root Cause 1 — PLC Is in Run Mode, Not Monitor Mode

Omron PLCs reject external writes that would alter program-controlled I/O while the CPU is in Run mode. The Host Link command W@ (bit write) or WR (word write) sent from Citect is accepted by the serial stack and the CPU replies with the correct acknowledgement frame, but the bit is written to I/O memory and either:

• immediately overwritten by the next scan if the rung resets it, or
• silently discarded by the CPU's write-protect logic because the operating mode is not Monitor or Program.

Citect does not flag this as a comms error; the ACK frame looks identical to a successful write, which is why the operator believes the command was sent. The diagnostic signature is unmistakable: every Citect write completes in 50–80 ms with no error logged, but the Citect tag and the actual PLC bit never agree because Citect reads back what it last wrote, not what the PLC currently holds. The only reliable check is to read the bit back from the PLC into a second Citect tag and compare.

The CPU startup mode is configured in CX-Programmer under PLC > Operating Mode > Startup Mode. The default is Run. Change it to Monitor and transfer the PLC Setup to the CPU. After a power cycle the CPU will boot into Monitor instead of Run and the Host Link master will then be able to force bits in scan program memory.

Root Cause 2 — Citect Tag Overwrites a Physical Input Word

The integrator configured the Citect variable tag start as a digital tag at address 00001, which is CIO 0.01. Bit 01 of CIO 0 is the second physical input on the CJ1W-ID201 module. Writing to that bit in the host link is therefore a write to a real input. The CPU ignores the write because the input refresh at the start of the next scan overwrites it with the real field input value, and even if it did honour the write the safety implication of forcing a physical input is severe.

The correct pattern is to keep Citect commands on a separate work address and then copy the work bit into the start logic of the ladder program. The integrator's stop button (0.00) and the start button (0.01) on the ID201 are physical inputs; the Citect start and stop must occupy unused bits in the W area, e.g. W0.00 and W0.01. The ladder then OR's the physical start button with the SCADA start bit and feeds the seal-in circuit, so neither the operator nor the SCADA can lock the other out.

Memory-area map used by Citect on a CJ1M

Corrected tag database

Step-by-Step Fix

Step 1 — Reconfigure the Citect variable tags

1. Open Citect Explorer and select I/O Server > Variable Tags.
2. Delete or repurpose the tags that were pointing into CIO 0.
3. Create scada_start with data type DIGITAL and address W00000.
4. Create scada_stop with data type DIGITAL and address W00001.
5. For the analog level, create level_raw with data type INT and address 02001 (word 2001 of CIO).
6. Create level_pct with data type REAL and a Citect expression of level_raw / 40.0.
7. Recompile the project and cycle the Citect I/O Server.

Step 2 — Patch the ladder program in CX-Programmer

1. Open the project in CX-Programmer and go online with the CPU.
2. Change the operating mode to Monitor (PLC → Operating Mode → Monitor).
3. Edit the start/stop rung so it OR's the physical start button and the SCADA start bit, and seals in around the motor contact, as shown in the snippet below.
4. Transfer the new program to the CPU.

Rung 1 — motor seal-in (3-wire start/stop):

  stop_phys  scada_stop
|--|/|--------|/|----------------( motor_run )--|
|                                              |
|  start_phys  scada_stop                      |
|--[ ]--------|/|----------+                   |
|                        |                    |
|  scada_start scada_stop|                    |
|--[ ]--------|/|--------+                    |
|                                              |
|--( motor_run )---< seal-in branch >----------+

Both stop sources (the physical NC button and the SCADA stop bit) are wired as NC contacts in series. Either one breaks the seal. Both start sources (the physical NO button and the SCADA start bit) are wired as NO contacts in parallel, with the seal-in contact on motor_run latching the output after the start pulse is released.

Step 3 — Set PLC startup mode to Monitor

1. In CX-Programmer, double-click PLC > Settings in the project tree.
2. Open the Startup tab.
3. Set Startup Mode to Monitor.
4. Click Transfer to PLC and confirm. The setting is written to the CPU's flash and survives a power cycle.

Step 4 — Verify the Citect I/O device

1. In Citect Explorer, open the I/O Devices folder and confirm the board is configured as CS1 [SysmacWay] (not "Omron [Hostlink]" — both exist and only the CS1 driver is correct for a CJ1M in Citect 2016+).
2. Set the port to 9600, 7, E, 2 and unit number 00.
3. On the same dialog, tick Special > Use Long Addresses if you are reading any address above CIO 999.
4. Recompile and watch the kernel log: the line CS1: connect to unit 00 OK confirms the link is up.

Host Link Frame Reference (Sysmac-Way, 9600/7-E-2)

Use the table below when you need to manually prove the link with a terminal emulator such as PuTTY. Every Host Link frame starts with @ (0x40) and ends with a two-character FCS (Frame Check Sequence, longitudinal XOR of all bytes between the unit number and the * terminator) followed by * (0x2A) and CR (0x0D). The maximum command body length is 131 characters including the FCS.

CJ1W-AD041 Analog Scaling for the Level Tag

The integrator stored the raw AD041 word in D100, which is correct. The scaling from counts to engineering units depends on the DIP-switch resolution of the CJ1W-AD041 module.

If the user has Citect perform the scaling in a derived tag, the formula is level_pct = (level_raw / 40.0) * 100.0 for normal resolution. Citect will complain about a division by zero on a dead input; use level_raw / 40.0 and let the SCADA clamp the result to 0 on the display. For a tank-level display calibrated in litres, use level_L = level_raw * 25.0 / 1000.0 (25 L per percent on a 2500 L tank) or whatever the tank calibration dictates.

Verification Procedure

1. In CX-Programmer, with the program in Monitor, force W0.00 = 1. The lamp should energise. Clear W0.00 and the lamp should drop out.
2. On the Citect page, click Start. The Citect tag scada_start should read 1 and the lamp should energise. The Citect kernel log should contain CS1: write W0.00 OK.
3. Click Stop. The lamp should drop out.
4. Power cycle the PLC. The CPU should come back in Monitor (CX-Programmer shows "Monitor" in the status bar). Pressing Start in Citect should still drive the lamp.
5. Confirm the Citect meter on the HMI tracks the analog input in real time. Use a 4–20 mA calibrator on the field side; the meter should swing from 0 to 100 % as the current goes from 4 to 20 mA.
6. Perform a Host Link MS from PuTTY and confirm byte 3 returns 02 (Monitor), not 04 (Run).

Signal Flow Diagram

The corrected end-to-end flow is shown below. The SCADA command lives in the work area, the ladder OR's the two start sources and seal-in holds the motor, and the physical output is driven only by the ladder, never by a Host Link write.

Diagnostic Matrix

Migration to FinsGateway on Ethernet

Once the serial link is stable, the long-term recommendation is to retire Sysmac-Way and switch to FinsGateway (FGW) over TCP. CJ1M-CPU21/22/23 have Ethernet built in; for the CJ1M-CPU11/12/13 used here, add a CJ1W-ETN21 Ethernet unit to the rack. The Citect driver changes from CS1 [SysmacWay] to CS1 [TCP], the same memory map applies, the FCS and the parity overhead disappear, and polling can run at 100 ms instead of 250 ms. The Omron knowledge base article Citect to Omron PLC Serial Setup Guide covers the FinsGateway path as the recommended option for new projects and includes the FGW unit IP setup and routing table.

AVEVA Plant SCADA Notes

Citect was rebranded AVEVA Plant SCADA in 2018. The driver is now distributed under Plant SCADA 2020 / 2023 / 2024 / 2025; the same CS1 [SysmacWay] I/O device is shipped in the driver pack and the tag address syntax above has not changed. AVEVA documents the Omron driver and its high-availability mode in the AVEVA Plant SCADA driver reference, Communicating with Omron PLCs page. If you are commissioning on a Plant SCADA 2024+ install, select the Omron CS1 (Serial) driver in the Communications dialog and the rest of the procedure is identical. AVEVA also ships an OPC UA bridge that can talk to a CJ2/CJ1M Ethernet unit; this is the preferred path on greenfield sites where the plant has been migrated to OPC UA as the fieldbus standard.

Cross-References to Adjacent Modules

The same work-bit pattern applies if the CJ1M is paired with a CJ1W-OD231 (transistor output) or a CJ1W-OC211 (relay output with different contact rating). The CJ1W-ID211 (high-density 32-pt input module) allocates CIO 0 and CIO 1 in the same way as the ID201, so the address collision case described above is identical. If the integrator is later adding a CJ1W-DA041 analog output module, the four output words occupy CIO 2004–2007, and the SCADA setpoint should be written to the work area and then moved into the output word by the ladder, never directly to CIO 2004. The pattern is the same: SCADA writes a work bit or work word, the ladder copies it into the program-controlled I/O, the CPU scan executes it.

FAQ