# Mitsubishi MC

> Connect Mitsubishi MELSEC PLCs over the MC protocol (3E frame) - device codes, decimal and hexadecimal numbering, and read lengths.

The **Mitsubishi MC** driver talks to Mitsubishi MELSEC PLCs over the MC
protocol, using the binary 3E frame over TCP, the frame the Q, L and iQ
series speak. You address values with the familiar MELSEC device notation:
a device code plus a number, like `D100` or `M50`. Add a device under the
Mitsubishi MC driver in the [Connector](connector); the panel shows only the
fields this protocol uses.

## Connection {#connection}

| Field | Meaning | Default |
| --- | --- | --- |
| **Host** | IP address or host name of the PLC's Ethernet interface. | empty |
| **Port** | TCP port of the MC-protocol connection, 1 to 65535. An empty box shows 5007 in grey and the device is dialed on it, which is also how a device saved with 0 reads. | 5007 |

The device header shows the assembled endpoint, for example
`mcp://192.168.0.20:5007`. There are no poll-interval fields for this driver:
its tags are read once per second. The PLC side needs an MC protocol (SLMP)
connection, TCP and binary, on the chosen port: [Prepare the PLC](#prepare-the-plc)
says where it is made.

## Prepare the PLC {#prepare-the-plc}

A MELSEC CPU serves the MC protocol only on a connection its project creates,
and refuses a write while it is in RUN unless its Ethernet port allows it. The
settings are made in the engineering tool and written to the CPU with its
parameters (**Online > Write to PLC**); the CPU reads them when it starts, so
reset it or switch it off and on afterwards.

| Setting | GX Works3 (iQ-R, iQ-F) | GX Works2 (Q, L) | Without it |
| --- | --- | --- | --- |
| An MC connection, TCP, on the device's **Port** | **Module Parameter > Ethernet Port > Basic Settings > External Device Configuration**: drag an **SLMP Connection Module** into the table, with Protocol TCP and **Port No.** the device's port. | **PLC Parameter > Built-in Ethernet Port Setting > Open Setting**: a line with Protocol TCP, **Open System** MC Protocol and **Host Station Port No.** the device's port. | The CPU refuses the connection on that port, and the device stays offline. |
| **Communication Data Code** set to binary | **Module Parameter > Ethernet Port > Basic Settings**: **Binary**. | **PLC Parameter > Built-in Ethernet Port Setting**: **Binary Code**. | The CPU answers in ASCII characters, or not at all, and no tag reads. |
| Writing in RUN allowed | iQ-R: **Module Parameter > Ethernet Port > Basic Settings**, **Enable/Disable Online Change** set to **Enable All (SLMP)**. | **PLC Parameter > Built-in Ethernet Port Setting**, **Enable online change (FTP, MC Protocol)** ticked. | The CPU reads normally and refuses every write while it is in RUN, with end code 0x0055. |

A Q or L CPU keeps the ports 5000 to 5009 for itself, so its MC connection
cannot take 5007, the device's default: give it another port, 5010 for example,
and type that one in the device's **Port**. GX Works2 may show **Host Station
Port No.** in hexadecimal, where 5010 is 1392. The communication data code is
one for the whole Ethernet port: another program that talks to the CPU in ASCII
on that port has to be switched to binary too.

When the CPU refuses the port, answers in ASCII or refuses a write in RUN, the
device's page says which setting, with these steps and the port the device
dials, in a notice that goes away by itself once the CPU accepts. For a write
refused in RUN it names the tags whose writes were refused. The journal and the
agent read the same steps.

## Addressing {#addressing}

A Mitsubishi tag is addressed by two fields in the tag's Source card:

| Field | Meaning | Accepted values | Default |
| --- | --- | --- | --- |
| **Device address** | MELSEC device code plus number, e.g. `D100`. Required. | free text | empty |
| **Read length (bytes, blank = auto)** | How many bytes to transfer per read. Blank sizes the read from the data type. | 1 and up, blank | blank |

The address is case-insensitive and the longest matching code wins, so
`SD100` is special register 100, not step relay `S`. The number
is **hexadecimal** for the devices Mitsubishi numbers in hex (X, Y, B, W,
SB, SW, DX, DY) and decimal for everything else (`X1F` is input 0x1F).
Accepted device codes:

| Code | Device | Numbering |
| --- | --- | --- |
| `M` | internal relay | decimal |
| `SM` | special relay | decimal |
| `L` | latch relay | decimal |
| `F` | annunciator | decimal |
| `V` | edge relay | decimal |
| `S` | step relay | decimal |
| `X` | input | hexadecimal |
| `Y` | output | hexadecimal |
| `B` | link relay | hexadecimal |
| `SB` | special link relay | hexadecimal |
| `DX` | direct input | hexadecimal |
| `DY` | direct output | hexadecimal |
| `D` | data register | decimal |
| `SD` | special register | decimal |
| `R` | file register | decimal |
| `ZR` | extended file register | decimal |
| `W` | link register | hexadecimal |
| `SW` | special link register | hexadecimal |
| `Z` | index register | decimal |
| `TC` / `TS` / `TN` | timer coil / contact / current value | decimal |
| `SC` / `SS` / `SN` | retentive timer coil / contact / current value | decimal |
| `CC` / `CS` / `CN` | counter coil / contact / current value | decimal |

The underlying MC library also accepts the codes `TT`, `TM`, `CT`, `CM` and
`A`. The Source card's read-only **Source address (wire)** line shows the
assembled address as you edit.

## Data types {#data-types}

The **Data type** picker offers the four types the driver marshals:

| Data type | Auto read length | Notes |
| --- | --- | --- |
| Boolean | 1 byte | on a bit device the single relay named; on a word device any non-zero word |
| Int32 | 4 bytes | two consecutive 16-bit words, e.g. `D100`+`D101` |
| Float | 4 bytes | two consecutive words holding an IEEE single |
| String | 16 bytes | text up to the first NUL of the read buffer |

Word data arrives in the MELSEC-native little-endian order and is decoded
automatically; there is no byte-order option. A 32-bit value spans two
consecutive word devices. For a String longer than 16 characters, raise
**Read length** to cover the stored text. **Read length** is a byte count and
the protocol transfers whole 16-bit words, so an odd length is rounded up to
the word that carries its last byte.

The bit devices, the ones the driver reads one relay at a time, are `X`, `Y`,
`M`, `L`, `F`, `V`, `B`, `S`, `TS`, `TC`, `SS`, `SC`, `CS`, `CC`, `SB`, `DX`
and `DY`. A Boolean tag there answers for the address you typed and for
nothing else. Every other code is a word device, the current value of a timer
or a counter (`TN`, `SN`, `CN`) and the link registers (`W`, `SW`) included,
and there the whole word decides: `D100` holding `0x0100` reads as true.

A read the PLC refuses, such as an address past the end of its range, leaves
that tag without a value, and its error names the end code and what the manual
says it means, for example
`end code 0xC056 (the request goes past the last address of the device)`. Every
other tag of the device keeps reading.

## Writes {#writes}

Tags whose **Access** is Read and write or Write only can be written, to the
same device address the read uses. A Boolean write on a bit device sets or
clears the single relay named and touches none of its neighbours. Everything
else is written as whole 16-bit words: two words for Int32 and Float, one word
for a Boolean on a word device, and for String the tag's whole **Read length**,
the UTF-8 bytes of the text at the front and zeros behind them, rounded up to
the last word. A shorter text written over a longer one therefore replaces the
whole value and nothing of the old one survives. A text that does not fit the
declared length is refused with the length named in the journal, never cut down
to size. A new tag starts as Read only.

A write the PLC refuses comes back refused, and names the end code and its
meaning the same way. A write refused because the CPU is in RUN (end code
0x0055) is also said on the device's page, with the setting that allows it (see
[Prepare the PLC](#prepare-the-plc)).

## Discovery {#discovery}

The MC protocol has no broadcast discovery in this driver, so the Connector
shows no Discover button. Add the device and its addresses by hand.

## Good to know {#good-to-know}

- Polling is fixed at one second for every tag on this driver; the usual poll
  interval fields are not shown.
- The driver speaks the binary 3E frame only, never ASCII: a connection set to
  ASCII code reads nothing (see [Prepare the PLC](#prepare-the-plc)).
- An unreachable PLC costs nothing at startup: the device keeps retrying in
  the background and its tags read as bad quality until the connection lands.
- The TCP connection is given 5 seconds to open, and each request 10 seconds to
  be answered. A PLC that takes the connection and does not answer in time is
  disconnected and retried like an unreachable one; its error names the port and
  the two usual reasons: a Q or L CPU whose port is set to ASCII code, which
  answers nothing to a binary request, or equipment that does not speak the MC
  protocol on that port.