Mitsubishi Electric MELSEC Communication Protocol: how the protocol works

Specification

1 source

Transports	serial, tcp, udp
Architecture	request response
Encoding	mixed

Study notes

MC protocol uses request messages sent by an external device and response messages returned by the supported device; communication is half-duplex except for C24 on-demand operation, which can use full-duplex communication.
Serial communication modules use 4C, 3C, 2C, and 1C frames; Ethernet interface modules use 4E, 3E, and 1E frames.
Serial message formats 1 to 4 use ASCII code; format 5 uses binary code. 4C frame supports formats 1 to 5, 3C frame supports formats 1 to 4, and 2C frame is a dedicated simplified frame.
Ethernet frames 4E, 3E, and 1E support both ASCII code and binary code.
The protocol can access connected stations and other stations over Ethernet, CC-Link IE Controller Network, CC-Link IE Field Network, MELSECNET/H, and MELSECNET/10.
Up to 8 connection targets (relay stations: 7 stations) can be accessed.
MC protocol commands cover device access, label access for MELSEC iQ-R series, buffer memory access, remote control, file control, remote password, loopback test, and serial communication module dedicated functions.
Device access can be specified in bit units, word units, or double word units; for bit devices, a word is 16 points and a double word is 32 points.
A C24 serial communication module can be set to modes including MC protocol formats 1 to 5, nonprocedural protocol, bidirectional protocol, predefined protocol, MODBUS slave (RTU), MODBUS slave (ASCII), and MELSOFT/GX Developer connection.
The on-demand function sends data from the CPU module to an external device and can only be used for C24 connected on a 1:1 basis; it cannot be used via network or multidrop 1:n/m:n connections.

Safety

When connecting an external device to a running programmable controller to modify data, configure an interlock circuit in the program so the entire system operates safely; otherwise improper operation may damage machines or cause accidents.
When a remote programmable controller is controlled by an external device, a communication failure can prevent immediate action; configure an interlock circuit and define corrective actions between the external device and CPU module.
Do not write data to the system area or write-protect area of module buffer memory, and do not use use-prohibited signals as output signals; doing so may cause programmable controller system malfunction.
To maintain security against unauthorized access, denial-of-service attacks, computer viruses, and other cyberattacks, take measures such as firewalls, VPNs, and antivirus solutions.
If an incorrect remote password is entered several times, the password is locked out and cannot be cleared for a while.
Remote RUN and remote PAUSE can be executed only when the access target module switch is RUN; in STOP, the command completes normally but the CPU does not enter RUN or PAUSE.
When the access target module system protection is enabled, remote operation cannot be performed and an error response is returned; disable system protection before remote operation.
Remote latch clear must be executed after changing the access target module to STOP; it cannot be performed when the CPU is in remote STOP or remote PAUSE by other devices.
Remote RESET may not be performed due to a hardware error of the access target device, and the response message may not be returned because the CPU is reset.
Deleting files while a programmable controller system is in operation may stop the system; determine file deletion timing for the entire system.
Prohibited applications include nuclear power plants, railway or public service, aircraft or aerospace, medical applications, train equipment, elevators and escalators, incineration and fuel devices, vehicles, manned transportation, recreation and amusement equipment, safety devices, nuclear or hazardous materials, and mining and drilling.