MC Protocol (SLMP) Frame Decoder
Paste an MC protocol (SLMP) 3E or 4E frame as HEX or ASCII to decode the header, command, device, points, values and end code. It can build requests too.
FAQ
How does it tell binary from ASCII?
If the text reads as HEX and the first two bytes are 50 00 (3E request), D0 00 (3E reply), 54 00 (4E request) or D4 00 (4E reply), it is binary; if the characters start with 5000, D000, 5400 or D400, it is ASCII. When both fit, as with «500000FF…», it picks the one whose header length field matches what actually follows. An ASCII frame written as HEX (35 30 30 30 …) is decoded as ASCII too.
Why does the reply have no device numbers?
An MC protocol reply carries only the values after the end code. Which device they belong to is in the request, so put the request in «Matching request» to see D100, D101 … next to the values. Without it the data is split into 16-bit words.
In binary 03FF shows up as FF 03
Binary code sends numbers low byte first (little-endian). I/O number 03FF is FF 03, length 12 is 0C 00, command 0401 is 01 04. ASCII code writes hex characters high digit first, so it stays «03FF».
What is «End code PortDock PLC Simulator would return»?
The request checked against PortDock PLC Simulator's handling rules (point limits, device codes, data length). Numbers beyond the device size (C056), «Own station requests only» (C05F) and Execute Monitor before any registration (C05D, from 0.6.0) depend on the app's state and are not checked here. A real PLC may answer differently depending on model and settings.
End codes (described by this decoder)
| Code | Name | When PortDock PLC Simulator answers with it |
|---|---|---|
| C050 | ASCII conversion error | a non-hex character in ASCII code, or A–F in a decimal device number |
| C051 | points out of range (words) | batch read/write word points are 0 or above 960 |
| C052 | points out of range (bits) | batch read/write bit points are 0 or above 7168 (binary) / 3584 (ASCII) |
| C053 | random points out of range (bits) | random write bit points are 0 or above 188 (94 for subcommand 0003) |
| C054 | random points out of range (words) | random read/write word and double-word points are 0 or above the limit |
| C056 | address out of range | a number beyond the device size (points) |
| C057 | request length mismatch | the header's request data length differs from what actually follows |
| C059 | wrong command/subcommand | a command or subcommand that is not implemented |
| C05B | device cannot be accessed | an unknown device code, or a word device in bit units |
| C05C | request data error | loopback data count outside 1–960, or a wrong mode value in a remote operation |
| C05D | monitor not registered | Execute Monitor (0802) before Entry Monitor Device (0801) |
| C05F | wrong access destination | a request for another station («Own station requests only» on) |
| C060 | bit request error | a bit write value other than 0 or 1 |
| C061 | data length mismatch | command data shorter or longer than the point count |
Names are shortened from MELSEC iQ-R Ethernet User's Manual (Application) SH-081257ENG 3.5 «List of Error Codes». Which condition gets which code was chosen by PortDock PLC Simulator; a real PLC or module may differ.
Device codes
| Device | Name | Binary code | Numbering | Type |
|---|---|---|---|---|
| X | Input | 9C | hex | bit |
| Y | Output | 9D | hex | bit |
| M | Internal relay | 90 | decimal | bit |
| L | Latch relay | 92 | decimal | bit |
| F | Annunciator | 93 | decimal | bit |
| B | Link relay | A0 | hex | bit |
| SM | Special relay | 91 | decimal | bit |
| D | Data register | A8 | decimal | word |
| W | Link register | B4 | hex | word |
| R | File register | AF | decimal | word |
| ZR | File register (serial numbers) | B0 | hex | word |
| SD | Special register | A9 | decimal | word |
| TS | Timer contact | C1 | decimal | bit |
| TC | Timer coil | C0 | decimal | bit |
| TN | Timer current value | C2 | decimal | word |
| CS | Counter contact | C4 | decimal | bit |
| CC | Counter coil | C3 | decimal | bit |
| CN | Counter current value | C5 | decimal | word |
References
- SLMP Reference Manual SH(NA)-080956ENG — chapter 4 message format (header, length, end code, error information), 5.2 device codes and 0401/1401/0403/1402, 5.9 loopback
- MELSEC Communication Protocol Reference Manual SH-080008 — chapter 5 Ethernet messages (3E and 4E frames)
- MELSEC iQ-R Ethernet User's Manual (Application) SH-081257ENG — 3.5 List of Error Codes — meanings of C050–C061
Built from Mitsubishi Electric's public manuals (SLMP and MC protocol); not affiliated with Mitsubishi Electric.
For a field-by-field walkthrough see Reading an MC protocol 3E binary frame; for end codes see MC protocol end codes: what to check.
To test your own program's communication without a PLC, use PortDock PLC Simulator — Testing MC protocol communication without a PLC.
To look at a whole Wireshark or pktmon capture (request/response pairs, response times, missing replies) use the Industrial pcap Analyzer. Clicking a row there opens that frame in this decoder.