PortDock

PortDock PLC Simulator Guide

MC protocol (SLMP) server simulator for testing without a PLC

About this program

PortDock PLC Simulator makes the PC answer MC protocol (SLMP) requests like a PLC's Ethernet port. Use it to build and test HMI, data-collection or host software without a PLC.

Choose 3E or 4E frames, binary or ASCII code, and a TCP server or UDP. Batch read/write, random read/write and loopback requests are answered from device tables (D, W, R, ZR, M, X, Y, B, L …).

Block read/write, monitor entry/execute, remote RUN/STOP/PAUSE/latch clear/reset and Read Type Name are answered too, and «Condition rules» mimic handshakes such as «when the request bit turns on, turn the done bit on a moment later».

Implemented from Mitsubishi Electric's public manuals (SLMP/MC) — not affiliated; behaviour may differ from a real PLC. No ladder program runs: values change only when you edit them, a client writes them, or «Simulation» changes them.

Delays, no response and error end codes can be injected to test the client's error handling.

Getting started

  • 1. On the left, match «Transport» (TCP server, UDP), «Frame» (3E, 4E), «Data code» (binary, ASCII) and «Port» with the client. Port 5000 is this program's default — the manuals do not fix a port number; it is set on the PLC side.
  • 2. «Bind address» defaults to 127.0.0.1 — only programs on this PC can connect. To connect an HMI on another PC, turn on «Allow other PCs to connect (0.0.0.0)» (a firewall note appears).
  • 3. Pick a device at the top (e.g. D) and enter values. You can do this before starting. For 32-bit, float or names open «Cell settings» with ⋯ (or right-click).
  • 4. «Start» (F4) — requests are answered as they arrive. Traffic and its decode («0401 Read (words) D100 ×3», «End 0000 OK · 6 bytes») appear in «Traffic» below.
  • On first run this checklist appears as a card in the empty «Traffic» area. «Fill example» puts 1–8 in D0–D7 (D0 «Status», D1 «Setpoint»), F32 23.5 (CDAB, «Temperature») in D8–D9 and 1/0 in M0–M7 (asks first if values are already there). «Don't show again» hides it.

Screen layout

  • Left: transport, frame, data code, bind address, port, «Own station requests only», «Start»/«Stop», status and the connected client list (TCP: ✕ disconnects one). «Fault injection (testing)» and «Statistics» below are folded; click the title to open (remembered).
  • Top centre: device buttons (bits X Y M L F B SM · words D W R ZR SD · timers/counters TS TC TN CS CC CN), «Rules», «Fill…», «Save», «Load». Below: «Start», «Count», «Size (points)», for bit devices «Bits»/«Words (16 points)», for words «Format» (U16, S16, HEX, BIN, ASCII, bytes), and a grey «Answered range: D0–D12287».
  • Left, «Simulated PLC state» (folded): RUN/STOP/PAUSE buttons and the simulated Read Type Name values. A yellow line stays below when it is not RUN.
  • Centre: device cells (number · name · value · type · ◷ · ⋯). Cells changed by a client flash briefly.
  • Bottom: «Traffic» (RX ◀ request, TX ▶ reply, EV event) with find/filter, «Log to file», «Clear», and a one-line note (implemented from public manuals — not affiliated).
  • Drag the bar between the table and the traffic to resize the traffic; it is remembered.
  • 📌 in the header: always on top — keeps this window above others (same as «Always on top» in Settings).
  • The window title shows the current state (e.g. «COM3 115200 8N1 · Connected ● REC — PortDock Serial»), so you can tell windows apart on the taskbar.
  • At 900 px wide or less (e.g. half-screen snap) the left panel folds away and a summary line with «⚙ Connection» (Port Inspector: «⚙ Ports», Net Scan: «⚙ Scan settings», Hardware Tester: «⚙ Checks») and the connect button appears. The language, 📌, !, AI, ? and ⚙ buttons move to the right end of that line. «⚙ …» opens the panel; ✕ or clicking outside closes it.
  • AI in the header: Copy for asking AI — builds text for an AI chat with a question template («list likely causes and the order to check them»): program, version, connection settings, errors in this session and recent traffic (HEX, text and note lines; check results in Port Inspector and Hardware Tester, found devices in Net Scan). The template fits the app: device and wiring for the communication apps, PC and wireless setup for Hardware Tester, finding network devices for Net Scan, ports and drivers for Port Inspector. Review the preview and «Copy» — it only goes to the clipboard. Above 8,000 characters the oldest traffic lines are removed and the count is noted. User folders, default Windows PC names (DESKTOP-… etc.), the last 3 bytes of MAC addresses and public IPs are hidden; private IPs are kept by default because causes such as different subnets need them («Hide private IPs too» hides them).
  • Whatever you paste goes to that AI service. Check device and company details before pasting.
  • Text size: Ctrl+mouse wheel or Ctrl+= / Ctrl+- makes it larger or smaller, and Ctrl+0 returns to the default (13 px). It is the same value as «Font size» in Settings, so it is kept next time.

Server settings

  • «Transport»: TCP server — several clients can connect at once and each is answered (up to 64). A request split over several TCP segments, or two requests in one, are cut by the header's «request data length». UDP — one datagram is one request; the reply goes to the sender.
  • «Frame»: 3E has subheader 5000 (binary 50 00); 4E has 5400 + serial number + 0000, and the 4E reply carries the request's serial number. Frames of the other kind are not answered and leave an «IGNORED» line.
  • «Data code»: binary sends numbers low byte first; ASCII sends hex characters high digit first (SLMP chapter 4). Must match the client.
  • «Bind address»: 127.0.0.1 by default (this PC only). «Allow other PCs to connect (0.0.0.0)» listens on all adapters — the first start may show a Windows Firewall prompt (administrator rights needed). Do not run it on a plant network with the same IP and port as a real PLC; it would answer in its place.
  • «Port»: 5000 by default. 0 lets Windows pick a free port; the status shows the real address. A port in use fails with «Port already in use». Successful «address:port» pairs stay in the «▾» recent list.
  • «Own station requests only»: when on, only requests addressed to the connected station itself (network 00, station FF, I/O 03FF, multidrop 00) are processed; others get end code C05F. When off (default) any station's request is answered from these tables and the reply header echoes the request's station fields. Can change while started.
  • The monitoring timer is read but not used (this simulator answers immediately).

Implemented commands

  • 0401 Read · 1401 Write: subcommand 0001 (bits, 1 point each) and 0000 (words — 16 points of a bit device make 1 word); 0003/0002 do the same with 4-byte device numbers and 2-byte codes (ASCII: 4-character code, 8-digit number). Points: words 1–960, bits 1–7168 binary or 1–3584 ASCII.
  • 0403 Read Random: subcommands 0000/0002. Mixes word points and double-word points (the lower-numbered word is the low part). Total 1–192 points (0002: 1–96).
  • 1402 Write Random: bits (subcommand 0001: 1–188 points, 0003: 1–94 — ON/OFF as 01/00, binary 0003 as 01 00/00 00), words/double words (0000: words×12 + double words×14 ≤ 1920, 0002: ≤ 960).
  • 0619 Loopback: returns the received data (1–960 bytes) unchanged.
  • 0406 Read Block · 1406 Write Block: subcommands 0000/0002. Several word blocks (word devices) and bit blocks (bit devices, 1 point = one 16-bit word) — 1–120 blocks (0002: 1–60), total points ≤ 960; writes need «blocks × 4 (0002: × 9) + total points ≤ 960». A bit device in a word block (or the reverse) gets C05B; exceeding the limits gets C051.
  • 0801 Entry Monitor Device · 0802 Execute Monitor: 0801 has the 0403 layout (word and double-word points) and only registers the devices (timer/counter contacts and coils TS TC CS CC get C05B); 0802 returns their values in the 0403 reply layout. 0802 before any registration gets C05D. There is one registration per server, not per connection, and it is cleared when you press «Start» again or a remote reset arrives (a simplification of this simulator).
  • 1001 Remote Run (mode 0001/0003, clear mode 00/01/02) · 1002 Remote Stop · 1003 Remote Pause (mode 0001/0003) · 1005 Remote Latch Clear · 1006 Remote Reset (subcommand 0000): change the «Simulated PLC state» and leave an event line such as «REMOTE STOP · RUN → STOP». With no ladder, read/write requests are still answered as usual in STOP/PAUSE; only condition rules pause. The clear mode is read but no values are cleared; latch clear sets only L (latch relays) to 0. Reset sends no reply, as in the manual, and returns to RUN (the TCP connection is not closed). The «forced execution» mode, the order of remote operations between several clients and refusing latch clear/reset outside STOP are not simulated — a real PLC may differ.
  • 0101 Read Type Name: answers with the model name (16 characters, padded with spaces) and model code under «Simulated PLC state». The defaults «PORTDOCK-SIM» and 0000 are not a real model — enter the values your client expects if it checks the code.
  • Writes are applied only after the whole range is checked — if anything is out of range nothing is written and C056 is returned.
  • Other commands (buffer memory, labels, files, remote password …) and extension subcommands (0080 …) are not implemented — they get C059.
  • The message formats follow SLMP Reference Manual SH(NA)-080956ENG chapters 4, 5.2, 5.6 and 5.9 (https://dl.mitsubishielectric.com/dl/fa/document/manual/plc/sh080956eng/sh080956engl.pdf) and MELSEC Communication Protocol Reference Manual SH-080008 chapter 5 (https://dl.mitsubishielectric.com/dl/fa/document/manual/plc/sh080008/sh080008ab.pdf).

Devices

  • Bits: X input (9C) · Y output (9D) · M internal relay (90) · L latch relay (92) · F annunciator (93) · B link relay (A0) · SM special relay (91) · TS/TC timer contact/coil (C1/C0) · CS/CC counter contact/coil (C4/C3). Binary device codes in brackets.
  • Words: D data register (A8) · W link register (B4) · R file register (AF) · ZR file register, serial numbers (B0) · SD special register (A9) · TN timer current value (C2) · CN counter current value (C5).
  • X, Y, B, W and ZR are numbered in hexadecimal (X1F; W100 is the 256th). The «Start» box reads hex for them too (X1F, 1F and 0x1F all work). Others are decimal.
  • «Size (points)»: 1–65536 per device. The defaults (D 12288, M 8192, X/Y 8192 (0–1FFF), R 32768, ZR 65536 …) are small test values and do not claim to match any model's limit. Requests beyond the size get C056.
  • Bit devices can be viewed as «Bits» (checkboxes) or «Words (16 points)» (16 points per word — the lowest number is bit 0, the same value a client reads in word units).
  • 32-bit values: the lower-numbered word holds the low part (e.g. D200 = low 16 bits, D201 = high 16 bits), so the default order in «Cell settings» is CDAB. Floats (F32) work the same way.
  • Other devices (long timers/counters, index registers, link direct devices …) are not available — their codes get C05B.

End codes

  • An «end code» of 0000 means completed; anything else is an error followed by error information (the request's network, station, I/O, multidrop, command and subcommand) (SLMP 4.2).
  • Codes this simulator uses — meanings shortened from MELSEC iQ-R Ethernet User's Manual (Application) SH-081257ENG 3.5 «List of Error Codes»; which condition gets which code was chosen by this program (a real PLC or module may differ):
  • C050 characters that cannot be converted from ASCII (non-hex characters, A–F in a decimal device number) · C051 word points out of range · C052 bit points out of range · C053 random bit points out of range · C054 random word/double-word points out of range · C056 number beyond the device size
  • C057 header request data length differs from the actual length · C059 unknown command/subcommand · C05B unknown device code, or a word device in bit units · C05C loopback data count out of range, or a wrong mode value in a remote operation · C05D Execute Monitor (0802) before Entry Monitor Device (0801) · C05F request for another station («Own station requests only» on) · C060 bit value other than 0/1 · C061 command data shorter or longer than the point count
  • Source: https://dl.mitsubishielectric.com/dl/fa/document/manual/plc/sh081257eng/sh081257engaf.pdf (3.5). The manuals are not included in the repository.

Traffic

  • RX ◀ is a received request, TX ▶ a sent reply, EV an event (listen, client connect/disconnect, IGNORED, END, DELAY). Each line carries the client address.
  • With «Decode» on, request lines show «command name · first device · points» (random: «W words D double words»), «NW ST IO MD» for another station, «#serial» for 4E; reply lines show «end code · meaning · data length». Error replies are red.
  • Requests answered with an error leave an EV line such as «END C056 address out of range — 0401» and are counted under «Per end code».
  • Remote operations leave «REMOTE STOP · RUN → STOP», and condition rules that ran leave «RULE #1 Request → done: M101=ON». Rules run right after a client write are attached to that request's event line and also go to the file log; rule lines run after a delay or periodically are shown on screen only.
  • Follow: new lines are followed only while you are at the bottom. Scroll up to pause (the view stays put) — «↓ Jump to latest (n new)» appears at the bottom right. Click it, press End or scroll to the bottom to follow again. The «Auto-scroll» checkbox shows whether it is following.
  • Selecting: click a line, Shift+click for a range, Ctrl+click to add or remove one. Clicking does not stop following.
  • Right-click menu: Copy lines · Copy HEX · Copy ASCII · Copy HEX + ASCII · Copy as C array ({0x01, 0x03}) · Find this. Data copies (HEX, ASCII, C array) skip event lines (EV), one frame per line.

Fault injection (testing)

  • «Response delay (ms)»: sends each reply this much later. TCP waits per connection, so other connections are still answered during a delay.
  • «Do not respond»: the request is processed as usual (writes are applied) but no reply is sent — tests the client's timeout and retries.
  • «Reply with end code»: replies with the chosen end code (from the list or «Custom…» hex). Writes are not applied then.
  • «Choose targets»: «Max delay» (a random delay between the delay and the max for each request, logged as DELAY), «Commands» (0401, 1401 …), «Devices» (D, M …), «Every Nth», «Probability (%)». Empty means every request.
  • Fault injection always starts off. When any fault is on the title becomes «⚠ Fault injection on» and a warning line stays below.

Cell settings and simulation

  • ⋯ on a cell or right-click: name, type (U16, S16, U32, S32, F32, F64, string), word/byte order and simulation (increment, decrement, random, sine, ramp, toggle). Bit devices have a name and toggle/random only.
  • Simulation runs in the backend, so it continues while the window is minimized. «Change on every client read» changes the value on each request that reads it (0401, 0403) instead of on a timer.
  • A value written by a client stays until the next change; increment/decrement continue from it.
  • Value cells: Enter/↓ next cell, ↑/Shift+Enter previous, Esc cancels the edit. Pasting several values from Excel etc. fills consecutive cells at once.
  • In the bit view, clicking anywhere in a cell toggles ON/OFF (the checkbox still works).
  • «Format» ASCII (2 chars) shows a word as two characters — low byte first (PLC string order), invisible bytes as «\x0D», zero as «\0». «Bytes (high low)» shows the high and low byte in decimal («18 52» = 1234h). Input uses the same forms.
  • «Fill…»: «Fill with numbers» (start, count, value, step — words wrap within 0–65535, «Count down» subtracts; bits use one 0/1), «Write a string» (two characters per word from the start, choose the character order and an ending 0, \xNN works — word devices only), «Write a number list» («100, 200 0x10 -1»; bits take 0/1). A preview line shows e.g. «5 cells at D100–D104»; nothing is written past the device size. If cells in the range already hold non-zero values, it says how many and writes only after you press «Overwrite» once more — there is no undo.

Condition rules

Open with «Rules» at the top. One rule = condition → delay → actions. It is not a ladder program — it mimics the short PLC-side responses (done bits, result values) a PC program waits for. This behaviour is defined by this program, not by the protocol.

  • Conditions: «Bit turns ON» / «Bit turns OFF» (scheduled once when they become true; cancelled if they stop holding before the delay ends), «Rising/Falling edge» (only at the change), «Word value comparison» (=, ≠, >, <, 0–65535 — once when it becomes true), «No condition (periodic)» (repeats every delay, 50 ms or more).
  • Addresses: M100, X1F (X, Y, B, W and ZR are hexadecimal), D100; a bit within a word is «D100.3» (0–F). ON/OFF/edges need a bit (or a bit within a word); comparisons need a word.
  • Delay: fixed ms, or set «Max» above the delay for a random time in between (chosen when scheduled). 0 runs right where the client write is processed — the next read already sees the change.
  • Actions (up to 16, in order): bit ON, OFF, Toggle; word «Write value», «Add» (negative subtracts, wraps within 0–65535).
  • When rules are checked: right after a client write, right after you change a value on screen, and every 20 ms in the backend. ON/OFF/comparison conditions that already hold when a rule is turned on run once. Zero-delay rules that keep triggering each other stop after 8 rounds per check.
  • Rules run only while «Simulated PLC state» is RUN. Switching to STOP/PAUSE drops pending delays; back in RUN the conditions are checked from scratch.
  • «Add example (handshake)»: «Request → done» (when M100 turns ON, M101 turns ON 300 ms later) and «Request OFF → done OFF» (when M100 turns OFF, M101 turns OFF). Turn M100 on from the client and read M101.
  • «Make several»: enter a count and number step and save to create that many rules with condition and action numbers shifted (e.g. count 3, step 2 → M100→M101, M102→M103, M104→M105).
  • List: checkbox to enable/disable, ✎ edit, ⧉ duplicate, ✕ delete. On the right: run count and last run time (⏳ = waiting for the delay), «Clear counts».
  • Rules come back next time and are included in «Save» files («Load» replaces them). Actions on numbers outside the device size are skipped.

Save and load

  • «Save»: writes every device's size (if changed), non-zero values, cell settings and simulations to one JSON file — to move a prepared test state to another PC or the next test. Condition rules are included too; older files without rules still load.
  • «Load»: reads such a file and replaces sizes, values and cell settings (values not in the file become 0). Files from other programs are refused; invalid entries are skipped and counted. Loading while started asks first.
  • Even without saving, values, cell settings and sizes come back next time (fault injection does not).

Settings (⚙)

  • «Language», «Theme» (follow Windows, light, dark), «Font size», «Log timestamp» format, «Lines kept on screen», «Auto-scroll on new lines».
  • «Start file logging on connect»: with an «Auto-log folder» chosen, each «Start» logs to «portdock-plc-simulator-date-time.log».
  • «Text and file log»: file log format (HEX, ASCII, HEX + ASCII, CSV), split by size or time («name-002.log»), «New file when the date changes» («name-20261031.log»), «Delete old logs (days)» — when logging starts and at each new file, files in the same folder from the same name family (same extension, only «-digits» added to the name) last modified more than that many days ago are deleted with a «LOG CLEAN» event line (0 = never). Applies from the next file log you start.
  • «Ask before closing while connected or logging» (also while started), «Export/Import settings», «Reset to defaults».
  • «Always on top»: keeps this window above other windows (same as 📌 in the header).
  • «Expand all (expert view)»: shows the groups that are normally collapsed (advanced connection, receive settings, fault injection, statistics, scan options, triggers, auto-reply …) open. Folding one while it is on lasts only for this run. Turning it off returns each group to its remembered state.
  • «Send usage statistics» (off by default): when on, the program sends an anonymous summary to Aptabase (EU) once, as you close the window — how many times each feature was used (connect, send, read … — counts only), minutes open, program/Windows version, display language and installed/portable edition. Traffic, IP addresses, ports, COM names, file paths and PC/user/device names are never sent. You're asked once on first run (closing the prompt without choosing means no), and you can turn it off here at any time. If you're offline or sending fails, the data is dropped. Builds without this option never send statistics.
  • Once you answer the usage-statistics question in one PortDock app (the prompt or this option), other PortDock apps on this PC that have not asked yet use that answer as their starting value instead of asking again (portable copies: those in the same folder). Each app can still change it here, and an imported settings file never turns it on. Only «asked» and your choice are stored (installed: %LOCALAPPDATA%\dev.portdock\shared-consent.json, portable: portdock-data\shared-consent.json).
  • «Check for new versions (once a day)» (off by default): when on, the program asks GitHub (api.github.com) once a day for PortDock's latest release only. If a newer version exists, a notice bar with a «Release page» button appears at the bottom of the window. No data is sent and nothing is downloaded or installed. «Don't remind me about this version» silences that version. The «Check for updates» button under «About» still just opens the release page.
  • «Keep the PC awake while connected or logging» (off by default): keeps the PC from going to sleep while connected (or running) or logging to a file, so a USB adapter does not vanish during an overnight log. The screen may still turn off. Released when you disconnect or close the window; power settings are not changed.
  • «Reopen the last connection at startup» (off by default): at startup, connects (starts) with the settings of the last successful connection. Stops quietly if that port or device is missing. Turn it off for devices that reset when the port opens (Arduino, …). The «--auto» command-line option does the same.
  • Command-line «--auto»: starts right away with the settings of the last successful start (e.g. «PortDock PLC-Simulator.exe --auto»). Other arguments are reported as «Ignored command-line arguments».

Shortcuts and tips

  • F4: start / stop (same as the button on the left).
  • Ctrl+L: clear the on-screen log (file logs are kept).
  • Ctrl+S: save view.
  • Ctrl+Shift+L: start / stop logging to file.
  • End: jump to the latest log line and follow again.
  • After clicking the log (focus in the log): ↑/↓ move the selection · Shift+↑/↓ extend it · PageUp/PageDown one screen · Home first line · End last line (and follow again). Moving pauses following.
  • Ctrl+C: copy the selected log lines as «time direction data» (in the current view). Inside a text box it copies normally.
  • Ctrl+F: focus the log find box. In it, Enter next, Shift+Enter previous, Esc clear.
  • F1 or the ? button: this help. Close it with Esc.
  • Number boxes: ↑/↓ by 1, Shift+↑/↓ by 10, PageUp/PageDown by 100, or the mouse wheel once the box is focused. The baud box steps through the listed rates.
  • Shortcuts are ignored while a dialog or the right-click menu is open, or while composing Korean text.
  • Values can be entered before starting; changes while started apply from the next request.

Troubleshooting

  • The client cannot connect: with «0 clients connected», check address and port. From another PC, turn on «Allow other PCs to connect» and allow this program in Windows Firewall. 127.0.0.1 accepts connections from this PC only.
  • RX lines arrive but no reply: an EV «IGNORED» line means the frame (3E/4E) or data code (binary/ASCII) differs from the client. Also check «Do not respond» under fault injection.
  • The client gets an error: look up the «End» code in the traffic in the «End codes» section. For C056 increase «Size (points)»; C059 means a command this program does not implement; C05D means Entry Monitor Device (0801) must be sent first.
  • Condition rules do not run: check that «Simulated PLC state» is RUN (a remote STOP may have arrived), that the rule's checkbox is on, and that the condition actually became true (a bit that stays ON does not run it again). The list's run count and ⏳ show what happened.
  • 32-bit or float values look wrong: match the type and order (CDAB by default) in «Cell settings» with the client.
  • «Port already in use»: another program (or another PortDock window) uses that port.
  • It behaves differently from a real PLC: this program follows only the message formats in the public manuals and has not been compared with real hardware. Error codes, timing, connection limits and per-model device ranges may differ.
  • The program does not open: it needs Microsoft Edge WebView2 (included in Windows 11). Windows 7 is not supported.

Terms

  • MC protocol (SLMP) · 3E: The way to read and write Mitsubishi PLC values over Ethernet. 3E is one of its message formats, with binary or ASCII data codes.
  • Device (X, Y, M, D …): PLC memory names — X inputs, Y outputs, M internal relays, D data registers and so on. Hover a button for bit/word and number base.
  • C05F: An MC protocol end code (error). With «Own station requests only» on, requests for other stations get this code.