What is MELSEC?
MELSEC is the family of programmable logic controllers (PLCs) from Mitsubishi Electric, comprising compact, modular, safety, process and motion CPUs that control machines and plants in industrial automation and process automation. The family ranges from the compact FX series (iQ-F) to the modular high-end iQ-R platform, and is programmed with GX Works. MELSEC is strongly represented in machine building, automotive and semiconductor manufacturing, especially in Asia, but also in European OEM machines. For OT managers this means that many installations run on MELSEC for twenty years or more, with all the consequences for maintenance, migration and cybersecurity.
🧠 Which MELSEC series exist?
Mitsubishi launched the compact MELSEC-F series in 1981, the forerunner of today’s FX line. That compact line passed ten million units sold around 2010. Alongside it, modular series emerged for larger installations. The overview below shows the series you will meet in practice.
| Series | Type | Position | Engineering |
|---|---|---|---|
| MELSEC A / QnA | Modular | Old generation, found only in legacy installations | GX Developer |
| MELSEC-F / FX (FX1, FX2N, FX3) | Compact | Small machines, now succeeded by iQ-F | GX Works2 (oldest types also GX Developer) |
| MELSEC-Q | Modular on a base unit | Medium to large; being phased out in favour of iQ-R | GX Works2 |
| MELSEC-L | Compact modular, no base unit | Mid-range | GX Works2 |
| MELSEC iQ-F (FX5U, FX5UC, FX5UJ, FX5S) | Compact | Successor to FX3, built-in Ethernet | GX Works3 |
| MELSEC iQ-R | Modular | High end: standard, process, safety and motion CPUs | GX Works3 |
Mitsubishi announced the iQ-R series on 30 June 2014 with 64 models. According to Mitsubishi, processing is about forty times faster than on the Q series, thanks to a newly developed high-speed system bus. Q-series programs and I/O modules are largely reusable, which simplifies migration. For new projects Mitsubishi also positions the MELSEC MX controllers as a successor for applications where PLC and motion functions come together.
🔧 How is a MELSEC system built?
A modular MELSEC system (Q or iQ-R) consists of a base unit with a power supply, one or more CPUs and I/O, network, analogue and motion modules. In a multi-CPU configuration up to four CPUs work together on one base unit, for example a standard CPU for the machine logic and a motion CPU for the servo axes. A compact FX or iQ-F PLC combines power supply, CPU and I/O in a single housing and is expanded with modules on the side.
Within iQ-R there are specialised CPU types:
- Standard CPUs - the R00 to R120 for machine and line control
- Process CPUs - with PID function blocks and support for redundant configurations in which modules can be replaced online
- Safety CPUs - for emergency stops, door monitoring and safe speeds, see Safety PLC
- Motion CPUs - the R16MTCPU to R64MTCPU act as a motion controller for synchronised servo axes over SSCNET III/H; for servos on CC-Link IE TSN there are motion modules such as the RD78G
- SIL 2 process CPUs - since October 2017 a process CPU that can be configured redundantly and complies with SIL 2 according to IEC 61508
For process safety under IEC 61511, process companies often choose a separate safety instrumented system. For machine safety, the machine builder justifies the safety functions with ISO 13849 or IEC 62061.
⚙️ How does the MELSEC device memory model work?
Classic MELSEC programs address memory through devices: a letter plus a number. This differs from the tag or symbol model of, for example, Allen-Bradley or Siemens.
| Device | Meaning | Example |
|---|---|---|
| X | Physical input | X0 = start button |
| Y | Physical output | Y0 = motor relay |
| M | Internal relay (bit) | M100 = machine ready |
| L | Latch relay, keeps its value after power loss | L10 |
| D | Data register (16-bit) | D100 = actual temperature |
| T / C | Timer / counter | T0, C5 |
| B / W | Link relay / link register for network data | B0, W100 |
| SM / SD | Special system relays and registers | Diagnostics, clock pulses |
On the FX series, X and Y are numbered in octal (X0 to X7, then X10); on Q and iQ-R in hexadecimal. GX Works3 makes labels the default: symbolic names with data types instead of bare addresses. Programming is done in ladder logic, FBD, ST and SFC. Ladder still dominates, because machine building has traditionally worked with it.
The CPU works cyclically: read inputs, execute the program, write outputs, start again. Depending on program size and CPU, the scan time is usually between about 1 and 20 ms. For time-critical tasks, iQ-R and iQ-F offer fixed-cycle and interrupt programs, because motion control needs a low and predictable latency.
🌐 Which networks and protocols does MELSEC use?
Mitsubishi’s own network is CC-Link. Mitsubishi developed CC-Link in 1996 and opened it up in 2000, when the CC-Link Partner Association (CLPA) was founded. CC-Link IE (gigabit Ethernet) followed in 2007 and CC-Link IE TSN in 2018, which adds Time-Sensitive Networking. CC-Link and CC-Link IE are included in IEC 61158 and IEC 61784.
| Protocol | Role | Typical use |
|---|---|---|
| CC-Link IE TSN / Field | Real-time I/O, drives and motion | Machine and line network |
| MC protocol / SLMP | Reading and writing devices over Ethernet (TCP / UDP) | Connecting SCADA, HMIs and third parties |
| Modbus TCP | Open connection to other brands | Built into iQ-F; on other series depending on CPU or Ethernet module |
| OPC UA | Structured data to IT | OPC UA server module (iQ-R) or FX5-OPC module (iQ-F) |
| MQTT | Publish/subscribe to IIoT platforms | Via edge gateway or module |
| HTTP | Web server for diagnostics | Built into iQ-F CPUs, among others |
Through OPC UA and MQTT, MELSEC data flows to MES, Historian and Unified Namespace architectures. This enables predictive maintenance, edge analytics and Industrial AI, and, with simulation in GX Works, virtual commissioning against a digital twin.
🔐 What cybersecurity risks apply to MELSEC?
Older MELSEC protocols were designed for closed networks. Anyone who can reach the MC protocol or Modbus TCP can often read and write devices or stop the CPU. Mitsubishi and CISA therefore publish advisories regularly:
| Vulnerability | Affected | Impact | Severity |
|---|---|---|---|
| CVE-2022-25159 (April 2022) | iQ-F, iQ-R and Q CPUs and Ethernet modules | Login via replay attack, authentication bypassed | CVSS 8.1 |
| CVE-2025-7405 (September 2025) | iQ-F (FX5U, FX5UC, FX5UJ, FX5S) with Modbus TCP enabled | Read and write devices, stop the program without authentication | CVSS 7.3 |
For CVE-2025-7405 no firmware fix was available at publication; network isolation is then the only countermeasure. The engineering workstation running GX Works is also a target, because it can write programs directly to the PLC.
🛡️ How do you secure and manage a MELSEC installation?
A practical approach for an existing installation:
- Inventory - record per PLC the series, CPU type, firmware version and active protocols. A Q CPU from 2008 has different risks from a recent iQ-R.
- Segment - place PLCs in their own zone according to IEC 62443 and only allow SCADA, HMI and the engineering workstation. Network Segmentation is the most important measure against protocols without authentication.
- Disable what you do not use - switch off Modbus TCP, the web server and FTP if they are not needed.
- Use the CPU security functions - on iQ-R and iQ-F, depending on type and firmware, set a security key, IP filter and remote password.
- Secure access - remote maintenance only via a jump server with MFA, and application whitelisting on engineering workstations.
- Patch in a planned way - assess advisories in your patch management process and schedule firmware updates during maintenance stops.
- Back up and log - keep projects, parameters and firmware versions in a backup and send connection events to central logging.
In the Netherlands, organisations covered by the Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, must take appropriate measures for their OT, including PLCs. Under the Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities from 11 September 2026; the full requirements apply from 11 December 2027.
🔄 How do you approach migrating older MELSEC systems?
Many factories still run on A, QnA, FX3 or Q series. Mitsubishi has announced production discontinuation for several Q models and recommends migrating to iQ-R, supported by its own migration guide. Good lifecycle management of legacy systems prevents a failed CPU from stopping a line for weeks.
- Q to iQ-R - GX Works3 opens and converts Q projects; then check addressing, parameters and function blocks and test on the machine.
- FX3 to iQ-F - a similar compact form factor, but different modules and a new engineering environment.
- A and QnA - separate conversion tools and often a complete redesign.
- Spare parts - keep critical CPUs and network modules in stock until the migration is complete.
❓ Frequently asked questions
Is MELSEC the same as a Mitsubishi PLC?
Yes, MELSEC is the brand name of Mitsubishi Electric’s PLC family. Anyone talking about a Mitsubishi PLC almost always means a MELSEC controller, from a compact FX5U to a modular iQ-R.
Which software do you use for MELSEC?
For MELSEC iQ-R and iQ-F you use GX Works3; for Q, L and the older FX series you use GX Works2. Very old A and QnA series still require GX Developer.
What is the difference between MELSEC-Q and MELSEC iQ-R?
MELSEC iQ-R is the successor to MELSEC-Q, announced in 2014 with roughly forty times faster processing and built-in security functions. Q programs and much of the Q I/O can be reused, which allows a step-by-step migration from Q to iQ-R.
Which network does MELSEC use?
MELSEC mainly uses CC-Link IE TSN and CC-Link IE Field for real-time I/O and motion, and the MC protocol or SLMP over Ethernet for connections to SCADA and HMIs. For IT integration, modern MELSEC PLCs also support Modbus TCP, OPC UA and MQTT.
Is it safe to connect MELSEC to a network?
MELSEC PLCs have known vulnerabilities, such as CVE-2022-25159 and CVE-2025-7405, that let attackers read or write data without valid authentication. MELSEC can therefore only be connected safely within a segmented OT network with current firmware, IP filtering and controlled remote access.
Is MELSEC-Q still available?
Mitsubishi is gradually winding down the MELSEC-Q series and has announced production discontinuation for several models. For new projects Mitsubishi recommends MELSEC iQ-R; existing Q installations should arrange a migration plan and spare parts.
📌 In summary
MELSEC is Mitsubishi Electric’s PLC family, from compact iQ-F controllers to the modular iQ-R platform with process, safety and motion CPUs. The device memory model, CC-Link networks and GX Works form its core. Because of long life cycles and protocols without strong authentication, MELSEC installations call for segmentation, current firmware and a migration plan.
MELSEC is Mitsubishi Electric’s PLC family: reliable and strong in machine building and motion, but only secure in a segmented and well-managed OT network.