Resolving CJ1W-CIF21 Write Failures on Multi-Drop RS-485 Networks

The Omron CJ1W-CIF21 "Simple Communications Unit" is a serial option board that converts a CJ-series CPU's peripheral port or RS-232C port into an RS-422/485 port. It is widely used to multiplex low-cost Modbus RTU and Host Link slaves — most commonly temperature controllers, inverters, and panel meters — over a single twisted pair. In field deployments, the most common failure mode is asymmetric: the PLC reads from every node without error, but writes either never arrive at the target or are silently dropped. This article dissects the root cause cluster behind that symptom on a CJ1M + CJ1W-CIF21 network polling 17–21 temperature controllers, and provides a step-by-step recovery procedure grounded in the official operation manual (document W400-E1, CJ1W-CIF21 Simple Communications Unit Operation Manual).

1. Problem Definition: Read-OK / Write-Fail on an Expanded Network

The fault pattern reported in the field looks like this:

• Controller: Omron CJ1M-CPU with a single CJ1W-CIF21 mounted on the peripheral or RS-232C option slot.
• Slave count: 21 temperature controllers (TCs) on a 4-wire RS-422 daisy chain (or 2-wire RS-485).
• Original program: 17 TCs in operation; 4 TCs added later by replicating the existing ladder for read/write blocks.
• Wiring: confirmed correct, terminating resistors in place, shield grounded at one end only, remote/local parameter on the TCs set to remote enabled.
• Symptom: Reads return valid present value (PV), setpoint (SV), hysteresis, and run/stop status from all 21 TCs. The DM area holding the outbound setpoint is being updated by the HMI or the ladder, but the TC never latches the new setpoint, and a subsequent read returns the old SV.

Read works, write does not. The PLC, the cabling, the TC address scheme, and the ladder read-block are all proved correct. The failure is therefore in either the write-block construction, the protocol timing envelope, the unit-quantity setting, or the DM ↔ serial port mapping on the CIF21 itself.

2. CJ1W-CIF21 Hardware Reference

The CJ1W-CIF21 is not a "dumb" level converter. It contains a small protocol engine and a finite-length message buffer. Misunderstanding its role leads directly to the symptom above.

2.1 Physical and Electrical Specification

2.2 Architecture and Message Flow

The CIF21 emulates an Omron Host Link master. On each execution of TXDU(256) in the CPU task, the CPU hands one command frame to the CIF21; the CIF21 transmits the frame on the RS-485 bus, captures the slave's response, and posts the result into a DM area that the ladder reads back. The CPU does not directly drive the RS-485 transceiver — every byte passes through the CIF21's internal protocol engine.

This indirection has two consequences that are central to the read-OK / write-fail symptom:

1. DM-side write protection. The DM area that receives the response from a read is not the same area that sends the request payload. The CIF21 expects a specific DM layout that the programmer must mirror exactly. If the DM offsets used for read responses are reused for write payload, the protocol engine sees an invalid frame and drops it silently.
2. Number-of-units parameter. The CIF21 keeps an internal table of expected slaves. A write to a slave not in the table is rejected by the engine before it ever leaves the board, even if the read from the same address succeeded earlier (reads may be issued speculatively).

3. Protocol Configuration: Host Link C-Mode Frames

All CJ1W-CIF21 traffic is Host Link (C-mode) on the wire. A typical write of one word to a TC's setpoint register is built as:

@ 0 1 WD 0001 02 00 64 FCS CR
|  | |  |    |   |  |  |   |  |
|  | |  |    |   |  |  |   |  carriage return
|  | |  |    |   |  |  |   2-char FCS (XOR sum)
|  | |  |    |   |  |  write data = 0x0064 (SV = 100.0 °C)
|  | |  |    |   |  1 word written
|  | |  |    |   command = Word Write
|  | |  |    TC unit # = 01
|  | |  header code WD
|  | node # 01
|  start of text

A read of present value and setpoint is:

@ 0 1 RD 0000 0004 FCS CR
|  | |  |    |    |   |  |
|  | |  |    |    |   |  carriage return
|  | |  |    |    |   2-char FCS
|  | |  |    |    4 words from word 0000
|  | |  |    start address 0000
|  | |  command = Word Read
|  | node # 01
@  start of text

4. Root Cause Cluster: Why Writes Fail While Reads Succeed

Five distinct failure modes produce the identical "reads work, writes don't" symptom on a CJ1W-CIF21 network. Diagnose in the order listed — each step rules out a layer before you touch the next.

4.1 DM Layout Mismatch (most common)

Per W400 §4-2 "Setting the Number of Connected Units and DM Allocation," the CIF21 expects a contiguous DM block whose length is a function of the declared number of units. The layout is:

The block is per transaction, not per slave. When the original program was written for 17 TCs, the engineer likely carved out 17 separate DM blocks. Adding TCs 18–21 means carving out another four blocks. If the new blocks overlap an existing read block, the CIF21's read response and the new write request collide — the read appears to succeed (because it overwrote the colliding write's DM area between scans) and the write never lands.

4.2 Number-of-Connected-Units Setting Not Updated

W400 §4-2 also documents the "number of connected units" parameter that is set in the CPU's DM area (typically DM 32000 or DM 32010 depending on CX-Programmer version and CIF21 port selection). The CIF21 will only attempt to communicate with node numbers in the range 1 to N, where N is the configured unit count. If the program was cloned for 17 TCs and 4 more were added, but the unit-count word still says 17, the CIF21 silently discards any write destined for nodes 18–21. Read operations often "work" because the engineer may have used a separate broadcast or wildcard read path, or because the read was issued with an open node number that the slave still answered.

4.3 Insufficient Inter-Frame Time for an Expanded Chain

With 21 nodes on a 4-wire RS-422 bus, the round-trip time is the dominant latency component. A Host Link request/response at 9,600 bps takes approximately 8–12 ms per node for a 4-word read. Twenty-one nodes polled every cycle therefore needs ≥ 200 ms of free time inside the scan. If the CPU scan is faster than the bus can drain the buffer, the CIF21's transmit FIFO overflows and the last writes (typically the new TCs at the end of the polling table) are the first to be dropped.

Field check: open CX-Programmer's I/O Table / CX-Integrator and watch the CIF21 error counter (DM area depends on slot). Any non-zero value confirms buffer starvation.

4.4 Direction Control Timing on RS-485

On a 2-wire RS-485 bus, the CIF21 must assert the transmit enable (T/R) line, wait for the transceiver to turn around (typically 1–2 ms depending on the RS-485 chip on the TC's receiver card), transmit the frame, release T/R, and wait again before listening for the response. W400 §3-4 specifies a send/receive switching time parameter, default 0 ms, which is acceptable for 4-wire RS-422 but produces framing errors on long 2-wire RS-485 runs. The symptom is identical: reads work because they leave more time for the slave to be ready, writes fail because the slave's receiver was still in transmit-hold-off when the CIF21 sent.

4.5 Slave-Side Write-Enable Register

Most low-cost temperature controllers (and all Omron E5CN/E5EN-class units in Host Link mode) require bit W1.01 (the "write enable" or "AT enable" coil, depending on the controller family) to be set to 1 before the ladder writes the setpoint register. The read path returns present value regardless. If the original 17 TCs had this bit set in their startup sequence and the 4 new TCs were never issued the write-enable bit, the read will succeed and the write will be NAK'd by the slave with completion code 0x0E (write protected) — which the CIF21 returns to the DM area but the ladder typically does not check.

5. Diagnostic Procedure: From Symptom to Root Cause

Run the following in order. Each step produces a binary pass/fail that points to the section of W400 to re-read.

5.1 Step 1 — Confirm the CIF21 Is Recognized

1. In CX-Programmer, double-click the CJ1M in the project tree.
2. Select the CPU Rack tab. The CJ1W-CIF21 should appear in the option slot where it is physically mounted.
3. Right-click the CIF21 and choose Unit Setup. Verify that the serial port mode is set to Host Link, not No-protocol or Peripheral Bus.
4. Verify that the baud rate matches the TC's configured baud (default 9,600, 7-E-1 for most Omron TCs).
5. Save and go online. Cycle power to the PLC after a CIF21 baud change; the parameter is held in non-volatile memory on the CIF21 itself, but the CPU-side port setting is re-read on power-up.

5.2 Step 2 — Verify the Number of Connected Units

1. Open DM Area in the CX-Programmer watch window.
2. Locate the DM word that the CIF21 is using as the unit-count source (W400 §4-2 lists the slot-dependent offset; on a CJ1M peripheral port it is typically D32000 for the first port and D32010 for the second).
3. Confirm that the value is 21 (or higher) and not 17.
4. If the value is wrong, correct it, and confirm that the change persists across a power cycle.

5.3 Step 3 — Map the DM Areas for Each New TC

1. Print or list the existing DM blocks for TCs 1–17. Each block should be a contiguous set of words as described in §4.1 above.
2. Compute the size of each block: 5 + N words for a read of N words, or 5 + N words for a write of N words (the same minimum layout applies because the CIF21 needs the completion-code word at offset 4+N).
3. Allocate four new non-overlapping DM blocks for TCs 18–21. Do not reuse the words previously used by TCs 1–17 for any purpose, even as scratch.
4. Update the ladder so that every TXDU(256) block references the new base address for the corresponding TC.

5.4 Step 4 — Add a Completion-Code Check

For every write block, add a comparison that examines the DM word at offset 4 + N (the completion code) after the CIF21 has had time to return. Fail if the code is non-zero. Common values:

5.5 Step 5 — Insert an Inter-Frame Delay

1. Add a timer (e.g., TIM 0000 with a 10 ms preset) between successive TXDU(256) invocations.
2. If the bus was running with no delay, start at 10 ms and reduce until symptoms recur — that defines the floor of the bus's round-trip time.
3. For 2-wire RS-485, the CIF21's send/receive switch time parameter (W400 §3-4) should be increased from the default 0 to at least 1 unit (≈ 1 ms) to allow receiver turn-on at the far end.

5.6 Step 6 — Verify the Write-Enable Coil on Each New TC

1. For the four new TCs, issue a single SET (bit write) to the write-enable register documented in the TC's Host Link manual. For E5CN/E5EN units the coil is W1.01; for E5CC/E5EC it is W1.01 as well; for third-party controllers consult the device manual.
2. Wait at least one full scan, then read the same coil back. A returned 1 confirms the slave accepted the bit write; a 0 confirms the slave rejected it (which means the slave is in local mode or the address is wrong).
3. Once the coil reads back as 1, re-issue the setpoint write. It should now complete with code 0x00.

6. Verification

After the corrective actions above, perform the following four checks before returning the line to production:

1. Loop-back write/read test. From the HMI, write SV = 200 °C to TC 18. Within 2 seconds, the same HMI should display TC 18's SV as 200 °C. Repeat for TCs 19, 20, 21.
2. Long-run stability. Force the PLC to issue the full 21-node read/write sequence at the maximum production rate. Monitor the CIF21 error counter for 8 hours. A clean run is zero errors.
3. Boundary checks. Write SV = 0 °C and SV = max-range °C. Verify the TC clamps to the configured range and the read returns the clamped value (proves the write actually landed in the TC's non-volatile register, not in the CIF21's transmit buffer).
4. Power-cycle persistence. Power down the PLC and the TCs, restore, and confirm the last setpoints are still in effect. This proves the TC acknowledged the write to its non-volatile memory.

7. Configuration Reference: CX-Programmer Settings

Use this table as a quick checklist when commissioning a new CJ1W-CIF21 network:

8. Common Pitfalls on Expanded Networks

When the slave count grows past the original design point (the 17 → 21 case in the source problem), three issues appear with reproducible frequency:

8.1 DM Block Reuse

When TCs are added by cloning existing logic, the engineer often copies the TXDU(256) block and edits the source/destination DM offsets. If the offsets are edited to point to the same DM area as the read block, the CIF21's read response overwrites the write payload between scans. The read appears to win because the read is the last transaction in the cycle. Fix: allocate four fresh DM blocks for TCs 18–21 and do not overlap them with anything.

8.2 Hidden Cap on the Number of Polled Nodes

CX-Programmer's Host Link Component wizard auto-generates the unit count from the number of entries you add to the table. If the engineer added the four new TCs by hand-editing the ladder rather than re-running the wizard, the unit count DM may still reflect the wizard's original number. Fix: re-run the wizard, or manually edit the unit count DM and confirm persistence.

8.3 Write-Enable Bit Forgotten on New Slaves

Most field engineers configure write-enable on the TCs they touch in person, and forget that the bit must be set on every new TC. The symptom is identical to a bad protocol frame. Fix: add a one-shot SET rung to the write-enable coil for every TC at startup, gated by a "first scan" flag.

9. Compatibility Matrix

10. Field Commissioning Script

For a brand-new CJ1W-CIF21 network with N slaves, use this sequence at first power-up:

1. Power the PLC with the CIF21 mounted but no slaves connected. Confirm the CIF21 is recognized in the I/O table.
2. Configure the CIF21 (Host Link, baud, format, unit count = N) via CX-Programmer.
3. Connect a single TC at address 1. From the HMI, write SV = 100 °C. Verify on the TC's local display.
4. Add TC 2, repeat. Continue one at a time, in order. After each addition, run a full read/write cycle from the HMI.
5. After all N TCs are present, run a 24-hour soak test. Monitor the CIF21 error counter.
6. Save the CX-Programmer project and the CIF21 setup to a version-controlled location. Note the unit-count DM value in the comment field of the rung that owns it.

Adding TCs one at a time is slower than cloning the program, but it localizes any new failure to a single known-good bus. Cloning is acceptable for the ladder; it is not acceptable for the bus itself.

11. Related Documentation

• W400 — CJ1W-CIF21 Simple Communications Unit Operation Manual (Omron, current revision). Sections 3-1 through 4-2 cover protocol setup, send/recv switch time, and DM allocation.
• CX-Programmer online help, section "Host Link Component Setup."
• The specific temperature controller's Host Link manual — required to confirm the write-enable coil address and the register map for SV / PV / hysteresis / run status.

12. FAQ