Troubleshooting CJ1M PLC Modem Hostlink Communication Failures

Problem Overview

A CJ1M PLC communicates correctly with a host PC over a direct RS-232C serial cable running the Omron Hostlink (C-mode) protocol, but the same Hostlink traffic fails when a dial-up modem pair is inserted between the PC and the PLC. Symptoms are repeatable:

• Direct RS-232C cable: Hostlink commands are sent and responses are received normally.
• Modem-to-modem link (PC ⇔ local modem ⇔ PSTN ⇔ remote modem ⇔ PLC): ATD dialing succeeds, carrier is established, but the PLC never returns a Hostlink response.
• Probing the remote PLC serial port with a third PC shows only garbled, non-printable characters (frames, squares, or random ASCII above 0x7F).
• Writing a configuration string such as AT&F or AT&W to the remote modem with HyperTerminal before the call is placed, then redialing, makes Hostlink traffic flow correctly without resetting the modem.

The failure is not a Java class problem, not a Hostlink framing problem, and not a cable problem on the PC side. The fault lies in how the remote modem negotiates the asynchronous data link, and in what bytes it is or is not stripping or re-injecting on the PLC side of the link.

Root Cause Analysis

Hostlink (C-mode) is a 7-bit ASCII master/slave protocol. The default Omron settings for a CJ1M Serial Communications Board/Unit (e.g. CJ1W-SCU21, CJ1W-SCU31) on port 1 / port 2 are:

The CJ1M Hostlink port is a DTE that expects a DCE peer wired straight through. When you insert a modem, the modem on the PLC side becomes the DCE. Three things must be true for the link to work:

1. The PLC port and the remote modem's DTE-side DCE interface must agree on baud, parity, data, and stop bits (default 9600/7-E-2).
2. The remote modem must auto-answer the ring (ATA) without renegotiating its serial parameters on the PLC port.
3. The remote modem must not be in command-echo / result-code mode once the carrier is up; it must pass the 9600 bps Hostlink frames transparently.

The reason "a HyperTerminal AT poke fixes it" is that the configuration string forces the remote modem into a known state, disables local echo (ATE0), disables result codes (ATQ1), turns off any MNP/V.42/LAPM error correction and V.42bis/MNP5 compression, and stores that profile so subsequent calls boot into it.

Why the Garbled Frames Appear

If the remote modem is still in command mode, the Hostlink bytes (@00RD00000000...) are interpreted as AT-prefixed commands. Modems that fall back to "command mode after disconnect" or that have &D0 / &D2 set incorrectly will treat the first few Hostlink bytes as configuration input, return OK or ERROR, and only then pass through the residual data. The squares that show up at the test PC are the ASCII art of the modem's result codes (OK\r\n, CONNECT 9600\r\n, etc.) interleaved with the data stream.

Other common offenders:

• MNP/V.42 negotiated on the remote link. The PLC side has no error-correction stack; result is re-framed blocks that look like noise.
• Data compression (V.42bis or MNP5). Slightly higher bandwidth on small Hostlink frames, but if the PLC's UART is not handling the resulting 8-bit clean stream, you get parity errors. The PLC is set to 7-E-2; an 8-bit compressed byte that drops the parity slot will trip the host's framing error.
• Speed buffering / autobaud retrain. Some modems retrain mid-stream and pause DTR/RTS, which the CJ1M treats as a frame break.
• DTR/DSR not forced high on the modem. A DTE that drops DTR will hang up; the CJ1M does not drive DTR unless the Hostlink port is configured for RS-232C with full modem control. Most Hostlink deployments use a 3-wire (TX/RX/SG) connection, in which case the modem must be strapped to ignore DTR (&D0) and not require DSR (&C0 on the CD line).

Required Modem Configuration (AT String)

Program the remote modem once and store the profile in non-volatile memory. For a typical industrial dial-up modem (USR Courier, MultiTech MT5634SMI, Westermo TD-32, Siemens TC35, or any Hayes-compatible), the following string is a working baseline for CJ1M Hostlink at 9600/7-E-2:

AT&F              ; factory profile
ATE0              ; disable local echo
ATQ1              ; suppress result codes
ATV0              ; numeric result codes (in case any leak)
AT&C1             ; CD follows remote carrier
AT&D0             ; ignore DTR transitions
AT&K0             ; no flow control, no MNP/V.42
AT\N0             ; disable LAPM/MNP error correction (raw mode)
ATS0=1            ; auto-answer on first ring
ATS2=128          ; escape character disabled (no +++ break)
AT&W0             ; write profile 0 to NVRAM
AT&Y0             ; on power-up, load profile 0

Recommended Hardware: Industrial Modems with DIP Configuration

For permanent installations, prefer an industrial modem that exposes the configuration as DIP switches rather than AT commands. This eliminates the "I forgot to load the profile" failure mode.

If you are using the Westermo TD-32B, the typical DIP settings for Hostlink on a CJ1M are:

• S1-1 .. S1-3: DTE baud rate select (DIP positions for 9600 bps)
• S1-4: 7 data bits
• S1-5: even parity
• S1-6: 2 stop bits
• S2-1 .. S2-2: handshake = none
• S2-3: auto-answer on ring 1
• S2-4: command-mode echo off

Always refer to the Westermo product documentation for the exact DIP map of the specific TD-32 revision you have on the bench, since the S1/S2 numbering has changed between -32, -32B, and -36 hardware revisions.

RS-232C Cable: Modem to CJ1M

The CJ1M Serial Communications Unit is a DTE. The Westermo TD-32B modem is a DCE. Use a straight-through RS-232C cable, not a null-modem. The minimum signals to wire are TXD, RXD, and Signal Ground. For deployments that include DTR/DSR/CD handshaking, wire them as well.

Step-by-Step Recovery Procedure

1. Disconnect the telephone line from the remote modem.
2. Connect a service PC running HyperTerminal or minicom directly to the remote modem's RS-232C port at 9600/8-N-1 (this is the modem's AT side, not the PLC side).
3. Type AT and confirm OK is returned. If not, try 115200/8-N-1 to capture autobaud.
4. Send the configuration string shown above. Confirm OK is returned after each line.
5. Type AT&V to verify the active profile; confirm the stored S0 register is 1 (auto-answer) and that error correction / compression is disabled.
6. Reconnect the telephone line. Power-cycle the remote modem so the stored profile is loaded fresh.
7. From the host PC, dial the remote site with the local modem using ATD<number> and wait for CONNECT 9600.
8. Send a Hostlink read command, e.g. @00RD0000000158\r (reads CIO 0x0158, the CIO word at channel 0x158). The PLC should respond with @00RD0000000158xxxx*\r within the protocol timeout.
9. Verify the frame checksum using the Omron Hostlink FCS algorithm if the response appears truncated.

Verification Checklist

Lightning and Surge Protection

Field experience shows that a single lightning strike terminating on the PSTN drop will destroy the modem, the CJ1M serial port, and the host PC's serial port in one event. The telephone line is a long, unbalanced conductor that acts as an efficient antenna for induced transients, and the surge propagates straight into the modem's line-side transformer and onward to the RS-232C drivers.

Recommended protection chain:

1. PSTN primary protector at the building entry point (gas-discharge tube + thermal fuse, e.g. Citel B180-24V, DEHN DGA BNC).
2. Modem-side secondary protector in series with the line, e.g. Westermo Surge Arrester modules or a PolyPhaser IS-PLD series.
3. Optically isolated RS-232C between the modem and the CJ1M, e.g. B&B Electronics 9PFLST, or an Omron-recommended isolation device.
4. UPS / battery backup on both ends so a power blip does not drop the call mid-Hostlink transaction and leave the modem in an unknown state.

Common Gotchas

• Baud mismatch: the most common cause. The PC-to-local-modem side, modem-to-modem link, and modem-to-PLC side must all be 9600 bps. If your PC's serial port is at 115200 and you assume the modem's autobaud catches up, the first AT command can fail silently and the modem never leaves command mode.
• Local echo still on: if ATE1 is the default, every Hostlink command the PLC sees is doubled, and the PLC's Hostlink parser rejects doubled frames.
• S0=0: means "do not auto-answer." S0 must be ≥1 for the remote modem to pick up incoming calls.
• +++ break during the call: the default escape character sequence +++ followed by a 1-second guard time will drop the link back into AT command mode. If your Java class ever pauses 1 second between Hostlink writes, you can hit this. Disable the escape character with ATS2=128 or raise the guard time to ATS12=100.
• DTR/DSR handshaking mismatch: the CJ1W-SCU21 has DTR/DSR pins but most Hostlink deployments leave them floating. Configure the modem to ignore DTR with &D0 so the PLC's floating DTR does not hang up the link.

Alternative: Skip Modems and Use a Cellular or Ethernet Gateway

If the dial-up PSTN path is unstable in your area, an industrial cellular gateway (Sierra Wireless RV50, Westermo MRD-315, or any device that exposes a transparent RS-232C-to-IP serial tunnel) is a more reliable option. On the PC side, run a virtual COM port (e.g. com0com or a vendor-supplied COM port redirector) so your existing Java class does not need to change. On the gateway side, configure the serial port to match the CJ1M Hostlink defaults exactly: 9600, 7 data bits, even parity, 2 stop bits, no flow control.

Related Omron Documentation

For definitive configuration of the CJ1M serial port, refer to the Omron SYSMAC CJ Series Serial Communications Boards and Units Operation Manual (Cat. No. W336-E1) and the CS/CJ Series Host Link Command Reference Manual. The Hostlink Frame Check Sequence (FCS) is a 2-character XOR checksum of all ASCII characters between the @ and the last data character, expressed in two uppercase hex characters. Always validate the FCS in your Java class because noise-induced character corruption on a modem link is not a question of "if" but "when."