An MC protocol (SLMP) request names a device as «device code + number», but the number base depends on the device. X, Y, B, W and ZR are numbered in hexadecimal; M, L, F, SM, D, R, SD and the timers and counters in decimal. Miss this and values are read from the wrong place, or you get C050 or C056.
How the same «100» goes into a frame
| Notation | Number (decimal) | Binary number, 3 bytes | ASCII code + 6-digit number |
|---|---|---|---|
| D100 | 100 | 64 00 00 | D*000100 |
| W100 | 256 | 00 01 00 | W*000100 |
| X1F | 31 | 1F 00 00 | X*00001F |
| X20 | 32 | 20 00 00 | X*000020 |
| ZR10 | 16 | 10 00 00 | ZR000010 |
ASCII writes the number in the device's own base — «000100» is number 100 for D but 256 for W. Binary sends the number's value as 3 bytes (low byte first), so D100 is 64 00 00 and W100 is 00 01 00. A–F in the number of a decimal device makes PortDock PLC Simulator answer C050. Leading zeros in an ASCII number may also be spaces («D 7»).
Counting X/Y in decimal or octal
- X10 is not the 10th input; counting from X0 it is the 17th (hex 10 = 16).
- Because it is hex, X17 is followed by X18, X19, X1A … X1F and then X20. Count it like octal (X17 → X20) and you skip the 8 points X18–X1F; count it like decimal and you miss X1A–X1F.
- When your program turns text such as «X20» into a number, parsing it as decimal gives 20 instead of 32. Parse each device in its own base.
- Some PLC series and programming tools write X/Y in octal. Check your PLC's manual for how X/Y are numbered and how they are specified in communication. This guide and PortDock PLC Simulator follow the hex notation of the SLMP device table.
Bit devices read as words — 16 points
Reading a bit device with subcommand 0000 (word units) packs 16 points into one word, with the lowest number as bit 0. One word from X20 is X20–X2F; one word from M100 is M100–M115 — M is decimal, so the end number works out differently. Two words bring 32 points, which easily runs past the end of a device near its last number (C056).
32-bit values — the lower-numbered word is the low part
A 32-bit value in D200 and D201 keeps the low 16 bits in D200 and the high 16 bits in D201. A random read (0403) double-word point D1500 reads D1500–D1501, and the binary reply «4E 4F 54 4C» is 0x4C544F4E. In Modbus word-order terms that is CDAB, which is also the default order in PortDock PLC Simulator's «Cell settings».
Timers and counters
Timers split into TS (contact), TC (coil) and TN (current value); counters into CS, CC and CN. Contacts and coils are bit devices and current values are word devices, so reading TN or CN in bit units gives C05B.
Device codes (the 18 PortDock PLC Simulator handles)
| Device | Binary code | ASCII code | Numbering | Type |
|---|---|---|---|---|
| X input | 9C | X* | hex | bit |
| Y output | 9D | Y* | hex | bit |
| M internal relay | 90 | M* | decimal | bit |
| L latch relay | 92 | L* | decimal | bit |
| F annunciator | 93 | F* | decimal | bit |
| B link relay | A0 | B* | hex | bit |
| SM special relay | 91 | SM | decimal | bit |
| D data register | A8 | D* | decimal | word |
| W link register | B4 | W* | hex | word |
| R file register | AF | R* | decimal | word |
| ZR file register (serial numbers) | B0 | ZR | hex | word |
| SD special register | A9 | SD | decimal | word |
| TS/TC/TN timer contact, coil, current value | C1/C0/C2 | TS/TC/TN | decimal | bit/bit/word |
| CS/CC/CN counter contact, coil, current value | C4/C3/C5 | CS/CC/CN | decimal | bit/bit/word |
With subcommands 0002/0003 the binary code takes 2 bytes (e.g. A8 00), the ASCII code 4 characters (e.g. «D***») and the number 8 digits. Devices not in the table (long timers, index registers …) get C05B from PortDock PLC Simulator. Number ranges per device depend on the model; see your PLC's manual.
This guide is based on Mitsubishi Electric's public manuals (SLMP and MC protocol); it is not affiliated with Mitsubishi Electric.
Sources
- SLMP Reference Manual SH(NA)-080956ENG — chapter 4 message format (header, length, end code, error information), 5.2 device codes and 0401/1401/0403/1402, 5.9 loopback
- MELSEC Communication Protocol Reference Manual SH-080008 — chapter 5 Ethernet messages (3E and 4E frames)
- MELSEC iQ-R Ethernet User's Manual (Application) SH-081257ENG — 3.5 List of Error Codes — meanings of C050–C061
Published 2026-10-29