Docs / Mitsubishi GX Works3
Mitsubishi GX Works3 audit guide
IEC ST text (.st) and .gx3 / .gxw / .gxws binary projects both audit end-to-end. Binary uploads surface PROGRAM bodies, label-table VAR_GLOBAL tags (including ARRAY and user-defined types), and CpuType controller metadata; ladder routines stored inside ProjectDB.mdb stay binary — use .st text export when ladder-level rules are required.
Supported formats
IEC 61131-3 Structured Text
stable.st
GX Works3 project (binary)
stable.gx3 / .gxw / .gxws
Mitsubishi GX Works3-specific rules
These rules are vendor-gated and only fire on Mitsubishi GX Works3 sources. Vendor-neutral rules (R001–R007, R014, R022, etc.) also apply.
Zero-duration TIME literal (also Siemens)
Known limitations
• Binary .gx3 / .gxw / .gxws uploads run on the partial-decode path. PROGRAM bodies (.wcf), label-table tags (PB1, PB2, etc. from LABELTBL.wcf), and CpuType (e.g. Q02(H)) surface; ladder routines stored in ProjectDB.mdb + the .wpf / .wpg LD record streams stay in binary form. Upload .st text exports when ladder-level rules are required.
• OOP method declarations (METHOD ... END_METHOD) extract method names as synthetic tags but method bodies merge into the FB's main routine — not separately routinised.
• VAR_EXTERNAL imports recognised, but CONFIGURATION-level VAR_GLOBAL declarations in companion files aren't tracked.
• MatieC raw-C injection blocks (`{extern void __Foo();}` / `{{ LogMessage(...) }}`) stripped from the body before tokenization.
• Phase 4c++ Track D — .wpf (PROGRAM LD-reference table) and .wpg (PROGRAM LD body) closed without surfacing. Empirical analysis on the GX Works2 vendor-sample corpus showed .wpf carries name references that are a strict subset of LABELTBL.wcf + .wcf-derived tags (zero new symbols), and .wpg comment regions carry byte-identical vendor compile-stub boilerplate ("This program was generated automatically by the label program. ... even if you directly edit this program.") that is not user-authored documentation. Surfacing either would add zero audit signal, risk Program-locals being mis-promoted to Controller scope, and falsify the documentation-coverage Quality Metric (schema v168) with template noise. LD bytecode dictionary reverse-engineering is also infeasible from 2 vendor samples. Reject path locked via regression tests; revisit when ≥5 real customer .gxw/.gxws workspaces are available.
Workflow
1. Preferred: in GX Works3, switch to IEC mode (View → Switch to IEC) and export programs as .st text. Upload .st files individually for full-coverage analysis.
2. Binary fallback: upload .gx3 / .gxw / .gxws archives directly. Coverage badge surfaces partial-decode; PROGRAM-body rules apply, label-table VAR_GLOBAL tags feed tag-axis rules (R002, R016, R072), and CpuType (e.g. Q02(H)) surfaces as controllerName. Ladder-stored routines remain inside ProjectDB.mdb in binary form.
3. Body-only FB exports (oscat-style files with no VAR sections) automatically skip R005 to avoid false positives on incomplete declaration sets.