What is GX Works?
GX Works is the engineering software from Mitsubishi Electric that you use to configure, program, test, diagnose and maintain MELSEC PLCs. The package comes in two generations: GX Works2 for the MELSEC Q, L and FX series, and GX Works3 for the MELSEC iQ-R and iQ-F series. Machine builders and end users in industrial automation and process automation rely on GX Works for machine control, motion control, network configuration and safety logic. Because a laptop running GX Works can write programs straight into a PLC, it is also a key concern for OT security.
🧠 What does GX Works do and where does it fit in MELSOFT?
GX Works belongs to MELSOFT, Mitsubishi Electric’s software family for factory automation. It is sold on its own and as part of the MELSOFT iQ Works suite, alongside tools such as GT Designer3 for HMIs (GOT panels) and MT Works2 for motion controllers. GX Works runs on the engineering workstation: the Windows PC or laptop of the PLC programmer.
| Function | What you do with it |
|---|---|
| Hardware configuration | Select and parameterise the CPU, I/O cards and communication modules, in GX Works3 by dragging them from a parts library |
| Programming | Write logic in languages that follow IEC 61131-3 |
| Network configuration | Set up CC-Link IE, Ethernet and fieldbuses |
| Online monitoring | Watch live values, force devices and make online changes |
| Diagnostics | Read error codes, error history and signal traces |
| Simulation | Test programs without a physical PLC, including motion |
| Security | Configure project passwords, the security key and access restrictions on the CPU |
🔄 What is the difference between GX Developer, GX Works2 and GX Works3?
Over the years Mitsubishi has released three generations of programming software. GX Developer was the standard tool for a long time; sales ended on 31 August 2023 and Mitsubishi names GX Works2 as its successor.
| Feature | GX Developer | GX Works2 | GX Works3 |
|---|---|---|---|
| Status | Sales ended (2023) | Active, for existing series | Current generation |
| PLC series | A, QnA, Q, FX (older) | Q, L, FX (up to FX3) | iQ-R, iQ-F (FX5) |
| Project types | With or without labels | Simple project and Structured project | One project type with labels as the basis |
| Languages | Mainly ladder, SFC | Ladder, SFC, ST, structured ladder/FBD | Ladder, ST, FBD/LD, SFC |
| Migration | Opens as a Simple project in GX Works2 | Q projects can be converted to GX Works3 | - |
In GX Works2 the Simple project is the equivalent of a GX Developer project without labels: classic ladder logic on devices. The Structured project works with program organisation units (POUs) and tasks. A Structured project can no longer be opened in GX Developer, so make that choice deliberately during a migration.
GX Works3 was designed around the iQ-R series and later extended to the compact iQ-F (FX5U, FX5UC, FX5UJ, FX5S). Existing MELSEC Q programs from GX Works2 can be opened and converted in GX Works3; separate conversion tools exist for the old A series.
🔧 Which programming languages and memory models does GX Works use?
GX Works follows the languages of IEC 61131-3. Mitsubishi has historically been strong in ladder, because machine builders have traditionally worked with it.
| Language | Typical use |
|---|---|
| Ladder Logic | Discrete logic, interlocks, machine control |
| FBD | Control loops and reusable function blocks |
| ST | Calculations, data handling and complex algorithms |
| SFC | Step-by-step processes and sequences |
Devices and labels
Classic MELSEC programs address memory through devices: a letter followed by a number. On the FX series, inputs and outputs are numbered in octal (X0 to X7, then X10); on Q and iQ-R they are hexadecimal.
| Device | Meaning | Example |
|---|---|---|
| X / Y | Input / output | X0 = start button, Y0 = motor output |
| M / L | Internal bit / retentive (latch) bit | M100 = internal status bit |
| B / W | Link relay / link register for network data | W0 = value from CC-Link IE |
| D | Data register (16 bit) | D200 = setpoint |
| T / C | Timer / counter | T0 = 5 s delay |
| SM / SD | Special relays and registers of the CPU | SM400 = always on (Q series) |
GX Works3 makes labels the default: symbolic names such as Motor_Conveyor_01.Start instead of M100, with data types and structures. That makes
programs easier to read and reuse, and GX Works3 can turn repeated ladder circuits into function blocks
that you store in a library.
Scan cycle
A MELSEC CPU reads its inputs, executes the program, writes its outputs and starts again. Depending on program size and CPU, the scan time is usually somewhere between about 1 and 20 ms. For fast tasks, iQ-R and iQ-F offer fixed-cycle and interrupt programs. Motion control needs low and predictable latency. It therefore runs through a separate motion controller, a motion CPU or a Simple Motion module, which drives the servo amplifiers over the SSCNET III/H servo network or over CC-Link IE TSN.
🌐 How does a GX Works project communicate with networks, SCADA and MES?
GX Works configures the PLC’s networks, but not every connection is set up in GX Works itself. The distinction matters when you design industrial Ethernet and the link to higher levels.
| Connection | Role | Where it is configured |
|---|---|---|
| CC-Link IE (TSN, Field, Control) | Mitsubishi network for I/O, drives and motion | GX Works3 / GX Works2 |
| Ethernet with TCP / UDP | Socket communication, MELSOFT connection, MC protocol | GX Works (CPU or Ethernet module) |
| Modbus TCP | Link to devices from other vendors | GX Works (built into iQ-F, on other series depending on CPU or module) |
| OPC UA | Data to SCADA, MES and Historian | iQ-R: OPC UA server module with MX OPC UA Module Configurator-R; iQ-F: FX5-OPC module, with labels from GX Works3 (1.077F or later) and a separate configuration tool |
| MQTT / HTTP | Cloud and IIoT connections | Edge software or a gateway above the PLC |
For the IIoT, Industry 4.0 and Industrial AI, PLC data is usually exposed through OPC UA or an edge layer. This keeps control separate from cloud applications, in line with network segmentation following the zones and conduits model of IEC 62443.
🏭 Where is GX Works used in practice?
GX Works is common in packaging machines, automotive production lines, semiconductor manufacturing, food and beverage, logistics and pump control. Mitsubishi is strong in Asia, but also widely present in European machine building. Three applications stand out:
- Motion control - positioning, synchronisation, electronic gearing and cam profiles for servo motors, together with MT Works2 or the motion settings of GX Works3.
- Functional safety - with a safety CPU (iQ-R safety, formerly QS) you program emergency stops, door monitoring and safe speeds. Machine safety is usually justified with ISO 13849 or IEC 62061, both of which build on IEC 61508. For process safety under IEC 61511, process plants more often choose a dedicated safety instrumented system.
- Simulation - the built-in simulator lets you test logic and motion without hardware. That supports a FAT and virtual commissioning with a digital twin of the machine.
🔐 What cybersecurity risks come with GX Works?
An engineering workstation with GX Works can read, change and download programs. Whoever controls that workstation or the project files effectively controls the machine. Mitsubishi and CISA have published several advisories about GX Works:
| Advisory | Essence | Severity | Mitigation |
|---|---|---|---|
| ICSA-22-333-05 (Dec 2022, Mitsubishi 2022-015) | Ten CVEs: hard-coded passwords and keys, insecurely stored credentials, mainly in GX Works3; GX Works2 and GX Developer are partly affected | Highest CVSS 9.1 | GX Works3 1.096A or later, project security version 2, security key in secure mode |
| Same advisory, safety CPU (Nozomi Networks) | A safety CPU project file can reveal access to the CPU itself | CVSS up to 7.5 | Different credentials for project and CPU, encrypt project files |
| ICSA-23-269-03 (Sep 2023, Mitsubishi 2023-010) | CVE-2023-4088: incorrect default permissions on the installation folder of many MELSOFT tools | CVSS 9.3, local exploitation only | GX Works2 1.595V or GX Works3 1.065T or later, keep the default installation folder, write access for administrators only |
On top of that come the classic risks of engineering software: unauthorised downloads, malware on a shared service laptop, legacy protocols without authentication, and insiders.
🧭 How do you secure and manage a GX Works environment step by step?
- Take inventory - record in your asset inventory which PLCs, firmware versions and GX Works versions you have, and which laptops run GX Works.
- Patch - include Mitsubishi advisories in patch management and update GX Works to the version named in the latest advisory.
- Separate - place engineering workstations in their own zone and let third parties work only through a jump server with MFA.
- Harden the workstation - use application whitelisting, no local admin rights for daily work, and no email or browsing on the engineering PC.
- Secure the CPU - on iQ-R and iQ-F, set a security key, IP filter and remote password, and put file passwords on projects.
- Manage versions - keep projects in version control, tie downloads to change management and make a backup of every PLC after a change.
- Monitor - keep logging of engineering sessions and have network monitoring alert on unexpected program downloads.
In the Netherlands this is no longer optional. Organisations that fall under the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, must take appropriate measures for their OT, including engineering workstations. Under the Cyber Resilience Act, Mitsubishi itself must report actively exploited vulnerabilities from 11 September 2026; the full requirements apply from 11 December 2027.
Long service life is part of lifecycle management: MELSEC installations often run for twenty years or more. Plan the migration of GX Developer and Q series projects to GX Works3 and iQ-R in good time, and keep the right software version available for older installations.
⚖️ What are the strengths and limitations of GX Works?
| Strengths | Limitations |
|---|---|
| Deep integration of PLC, motion, HMI and CC-Link IE | Vendor lock-in: only for Mitsubishi hardware |
| Built-in simulator, also for motion | Old device-based projects are hard to maintain |
| Labels and function block libraries in GX Works3 | Migration from GX Developer and GX Works2 takes effort |
| Long support for hardware series | Less open ecosystem than CODESYS |
Compared with Siemens TIA Portal and Rockwell Automation’s Studio 5000, GX Works is similar in concept. Its particular strength lies in compact machines (FX and iQ-F) and close integration with Mitsubishi servos and motion.
❓ Frequently asked questions
Is GX Works free?
GX Works is commercial software from Mitsubishi Electric that you buy with a licence, either on its own or as part of MELSOFT iQ Works. Mitsubishi does offer trial versions. For production use you need a valid licence.
Which GX Works version do I need for my PLC?
For MELSEC iQ-R and iQ-F (FX5) you use GX Works3. For MELSEC Q, L and the older FX series (up to FX3) you use GX Works2. Very old A and QnA series controllers still require GX Developer.
Can GX Works3 open GX Works2 projects?
Yes, GX Works3 can open MELSEC Q projects from GX Works2 and convert them to the iQ-R series. Always check addressing, parameters and function blocks after conversion. A conversion does not replace testing on the real machine.
How secure is GX Works?
GX Works has had several vulnerabilities, including hard-coded keys (CVSS up to 9.1) and incorrect installation permissions (CVSS 9.3). With a current version, project security version 2, a security key and a well-protected engineering workstation, the risk is manageable.
Can I test a PLC program without hardware?
Yes, GX Works has a built-in simulator that lets you test logic, and in GX Works3 also motion, without a physical PLC. That is useful for programming, training and virtual commissioning. Timing and I/O behaviour can still differ on the real machine.
What is the difference between devices and labels in GX Works?
Devices are fixed memory addresses such as X0, M100 or D200. Labels are symbolic names with a data type, which GX Works assigns to memory itself. GX Works3 uses labels as the default, which makes programs easier to read and reuse.
📌 In summary
GX Works is the engineering software you use to program and manage Mitsubishi MELSEC PLCs: GX Works2 for Q, L and FX, GX Works3 for iQ-R and iQ-F. It combines IEC 61131-3 programming, CC-Link IE configuration, motion, safety and simulation. Because the engineering workstation has direct power over the machine, current versions, strong credentials, segmentation and version control always belong with it.