Mitsubishi MC

Connect Mitsubishi MELSEC PLCs over the MC protocol (3E frame) - device codes, decimal and hexadecimal numbering, and read lengths.

The Mitsubishi MC driver talks to Mitsubishi MELSEC PLCs over the MC protocol, using the binary 3E frame over TCP, the frame the Q, L and iQ series speak. You address values with the familiar MELSEC device notation: a device code plus a number, like D100 or M50. Add a device under the Mitsubishi MC driver in the Connector; the panel shows only the fields this protocol uses.

Connection

The device header shows the assembled endpoint, for example mcp://192.168.0.20:5007. There are no poll-interval fields for this driver: its tags are read once per second. The PLC side needs an MC protocol (SLMP) connection, TCP and binary, on the chosen port: Prepare the PLC says where it is made.

Prepare the PLC

A MELSEC CPU serves the MC protocol only on a connection its project creates, and refuses a write while it is in RUN unless its Ethernet port allows it. The settings are made in the engineering tool and written to the CPU with its parameters (Online > Write to PLC); the CPU reads them when it starts, so reset it or switch it off and on afterwards.

A Q or L CPU keeps the ports 5000 to 5009 for itself, so its MC connection cannot take 5007, the device's default: give it another port, 5010 for example, and type that one in the device's Port. GX Works2 may show Host Station Port No. in hexadecimal, where 5010 is 1392. The communication data code is one for the whole Ethernet port: another program that talks to the CPU in ASCII on that port has to be switched to binary too.

When the CPU refuses the port, answers in ASCII or refuses a write in RUN, the device's page says which setting, with these steps and the port the device dials, in a notice that goes away by itself once the CPU accepts. For a write refused in RUN it names the tags whose writes were refused. The journal and the agent read the same steps.

Addressing

A Mitsubishi tag is addressed by two fields in the tag's Source card:

The address is case-insensitive and the longest matching code wins, so SD100 is special register 100, not step relay S. The number is hexadecimal for the devices Mitsubishi numbers in hex (X, Y, B, W, SB, SW, DX, DY) and decimal for everything else (X1F is input 0x1F). Accepted device codes:

The underlying MC library also accepts the codes TT, TM, CT, CM and A. The Source card's read-only Source address (wire) line shows the assembled address as you edit.

Data types

The Data type picker offers the four types the driver marshals:

Word data arrives in the MELSEC-native little-endian order and is decoded automatically; there is no byte-order option. A 32-bit value spans two consecutive word devices. For a String longer than 16 characters, raise Read length to cover the stored text. Read length is a byte count and the protocol transfers whole 16-bit words, so an odd length is rounded up to the word that carries its last byte.

The bit devices, the ones the driver reads one relay at a time, are X, Y, M, L, F, V, B, S, TS, TC, SS, SC, CS, CC, SB, DX and DY. A Boolean tag there answers for the address you typed and for nothing else. Every other code is a word device, the current value of a timer or a counter (TN, SN, CN) and the link registers (W, SW) included, and there the whole word decides: D100 holding 0x0100 reads as true.

A read the PLC refuses, such as an address past the end of its range, leaves that tag without a value, and its error names the end code and what the manual says it means, for example end code 0xC056 (the request goes past the last address of the device). Every other tag of the device keeps reading.

Writes

Tags whose Access is Read and write or Write only can be written, to the same device address the read uses. A Boolean write on a bit device sets or clears the single relay named and touches none of its neighbours. Everything else is written as whole 16-bit words: two words for Int32 and Float, one word for a Boolean on a word device, and for String the tag's whole Read length, the UTF-8 bytes of the text at the front and zeros behind them, rounded up to the last word. A shorter text written over a longer one therefore replaces the whole value and nothing of the old one survives. A text that does not fit the declared length is refused with the length named in the journal, never cut down to size. A new tag starts as Read only.

A write the PLC refuses comes back refused, and names the end code and its meaning the same way. A write refused because the CPU is in RUN (end code 0x0055) is also said on the device's page, with the setting that allows it (see Prepare the PLC).

Discovery

The MC protocol has no broadcast discovery in this driver, so the Connector shows no Discover button. Add the device and its addresses by hand.

Good to know

• Polling is fixed at one second for every tag on this driver; the usual poll interval fields are not shown.
• The driver speaks the binary 3E frame only, never ASCII: a connection set to ASCII code reads nothing (see Prepare the PLC).
• An unreachable PLC costs nothing at startup: the device keeps retrying in the background and its tags read as bad quality until the connection lands.
• The TCP connection is given 5 seconds to open, and each request 10 seconds to be answered. A PLC that takes the connection and does not answer in time is disconnected and retried like an unreachable one; its error names the port and the two usual reasons: a Q or L CPU whose port is set to ASCII code, which answers nothing to a binary request, or equipment that does not speak the MC protocol on that port.