An MC protocol (SLMP) 3E frame starts with «subheader + station fields + data length». A request then carries the monitoring timer, command, subcommand and command data; a reply carries the end code and response data. Binary code sends any number of two or more bytes low byte first (little-endian). Below is a request that reads three words from D100, and its reply.
Request: batch read D100–D102
50 00 00 FF FF 03 00 0C 00 10 00 01 04 00 00 64 00 00 A8 03 00
| Bytes | Field | Meaning |
|---|---|---|
| 50 00 | Subheader | 3E request |
| 00 | Network No. | 00 |
| FF | PC No. | FF |
| FF 03 | Request destination module I/O No. | 03FF (low byte first) |
| 00 | Request destination module station No. | 00 — 00, FF, 03FF, 00 together mean the connected station itself |
| 0C 00 | Request data length | 12 bytes — from the monitoring timer to the end |
| 10 00 | Monitoring timer | 0x0010 = 16 × 0.25 s = 4 s |
| 01 04 | Command | 0401 Read (batch) |
| 00 00 | Subcommand | 0000 word units |
| 64 00 00 | Head device number | 100 (3 bytes) |
| A8 | Device code | D data register |
| 03 00 | Number of device points | 3 words |
The length of 12 is timer 2 + command 2 + subcommand 2 + device 4 + points 2 bytes. If it does not match, the receiver cannot cut the frame correctly, and PortDock PLC Simulator answers C057.
Reply: values 0x1995, 0x1202, 0x1130
D0 00 00 FF FF 03 00 08 00 00 00 95 19 02 12 30 11
| Bytes | Field | Meaning |
|---|---|---|
| D0 00 | Subheader | 3E reply |
| 00 FF FF 03 00 | Station fields | echoed from the request |
| 08 00 | Response data length | 8 bytes — from the end code to the end |
| 00 00 | End code | 0000 completed |
| 95 19 | D100 | 0x1995 = 6549 |
| 02 12 | D101 | 0x1202 = 4610 |
| 30 11 | D102 | 0x1130 = 4400 |
The reply carries no device numbers; which device each value belongs to comes from the matching request.
Error reply
D0 00 00 FF FF 03 00 0B 00 59 C0 00 FF FF 03 00 01 01 00 00
End code «59 C0» is C059. The next 9 bytes are error information: the request's network, PC, I/O and station numbers (00 FF FF 03 00), command «01 01» (0101) and subcommand «00 00». Length 0B 00 = end code 2 + error information 9. A program that sends several requests can tell from these fields which one was refused. «MC protocol end codes: what to check» goes through each code.
Reading in bit units (subcommand 0001)
Reading the 8 points M100–M107 in bit units uses command data «01 04 01 00 64 00 00 90 08 00», and the reply data is «00 01 00 11». Each point takes 4 bits and the earlier point sits in the upper 4 bits, so M100=0, M101=0, M102=0, M103=1, M104=0, M105=0, M106=1, M107=1. With an odd number of points the lower 4 bits of the last byte are 0.
Bit devices in word units (subcommand 0000)
Reading 2 words from M100 in word units returns M100–M131, 32 points. One word holds 16 points, and the lowest number is bit 0. The reply «34 12 02 00» means M100–M115 = 0x1234 and M116–M131 = 0x0002; the set bits 2, 4, 5, 9 and 12 of 0x1234 mean M102, M104, M105, M109 and M112 are ON.
How 4E and ASCII differ
- 4E: the subheader is «54 00 + 2-byte serial number + 00 00», and the reply starts «D4 00 + the same serial number + 00 00». In «54 00 34 12 00 00 00 FF FF 03 00 0C 00 …» the serial number is 1234. It is used to pair replies with requests. Everything else is as in 3E.
- ASCII: the same fields as hex characters, high digit first. The request above becomes «500000FF03FF000018001004010000D*0001000003» — the I/O number stays «03FF», length 0018 is 24 characters, and the device is code «D*» plus the 6-digit number «000100».
- Subcommands 0002/0003 specify the device with a 4-byte number and a 2-byte code (ASCII: 4-character code, 8-digit number). Example: «64 00 00 00 A8 00» = D100.
- Over TCP one request may arrive in several pieces, or two requests may arrive together. The receiver cuts frames using the length field.
To decode bytes you received, paste them into the web tool «MC Protocol (SLMP) Frame Decoder». Add the matching request with a reply and each value is labelled with its device.
This guide is based on Mitsubishi Electric's public manuals (SLMP and MC protocol); it is not affiliated with Mitsubishi Electric.
Sources
- SLMP Reference Manual SH(NA)-080956ENG — chapter 4 message format (header, length, end code, error information), 5.2 device codes and 0401/1401/0403/1402, 5.9 loopback
- MELSEC Communication Protocol Reference Manual SH-080008 — chapter 5 Ethernet messages (3E and 4E frames)
- MELSEC iQ-R Ethernet User's Manual (Application) SH-081257ENG — 3.5 List of Error Codes — meanings of C050–C061
Published 2026-10-29