AB CIP PR 7 — ISubscribable via shared PollGroupEngine. AbCipDriver now implements ISubscribable — Subscribe delegates into the PollGroupEngine extracted in PR 1, Unsubscribe releases the subscription, ShutdownAsync disposes the engine cancelling every active subscription. OnDataChange event wired through the engine's on-change callback so external subscribers see the driver as sender. The engine's reader delegate points at the driver's ReadAsync (already handles lazy runtime init + caching via EnsureTagRuntimeAsync) — each poll tick batch-reads every subscribed tag in one IReadable call. 100ms interval floor inherited from PollGroupEngine.DefaultMinInterval matches Modbus convention. Initial-data push on first poll preserved via forceRaise=true. Exception-tolerant loop preserved — individual read failures show up as DataValueSnapshot with non-Good StatusCode via the status-code mapping PR 3 established. 7 new unit tests in AbCipSubscriptionTests covering initial-poll raising per tag, unchanged value raising only once, value change between polls triggering a new event, Unsubscribe halting the loop, 100ms floor keeping a 5ms request from generating extra events against a stable value, ShutdownAsync cancelling active subscriptions, UDT member subscription routing through the synthesised Motor1.Speed full-reference (proving PR 6's fan-out composes correctly with PR 7's subscription path). Total AbCip unit tests now 137/137 passing (+7 from PR 6's 130). Validates that the shared PollGroupEngine from PR 1 works correctly for a second driver, closing the original motivation for the extraction. Full solution builds 0 errors; Modbus + other drivers untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ZB.MOM.WW.OtOpcUa.slnx

@@ -10,6 +10,7 @@
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj"/>
+        <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.CLI/ZB.MOM.WW.OtOpcUa.Client.CLI.csproj"/>
@@ -29,6 +30,8 @@
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests.csproj"/>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDataType.cs

@@ -0,0 +1,61 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Logix atomic + string data types, plus a <see cref="Structure"/> marker used when a tag
+///     references a UDT / predefined structure (Timer, Counter, Control). The concrete UDT
+///     shape is resolved via the CIP Template Object at discovery time (PR 5 / PR 6).
+/// </summary>
+/// <remarks>
+///     Mirrors the shape of <c>ModbusDataType</c>. Atomic Logix names (BOOL / SINT / INT / DINT /
+///     LINT / REAL / LREAL / STRING / DT) map one-to-one; BIT + BOOL-in-DINT collapse into
+///     <see cref="Bool"/> with the <c>.N</c> bit-index carried on the <see cref="AbCipTagPath"/>
+///     rather than the data type itself.
+/// </remarks>
+public enum AbCipDataType
+{
+    Bool,
+    SInt,   // signed 8-bit
+    Int,    // signed 16-bit
+    DInt,   // signed 32-bit
+    LInt,   // signed 64-bit
+    USInt,  // unsigned 8-bit (Logix 5000 post-V21)
+    UInt,   // unsigned 16-bit
+    UDInt,  // unsigned 32-bit
+    ULInt,  // unsigned 64-bit
+    Real,   // 32-bit IEEE-754
+    LReal,  // 64-bit IEEE-754
+    String, // Logix STRING (DINT Length + SINT[82] DATA — flattened to .NET string by libplctag)
+    Dt,     // Date/Time — Logix DT == DINT representing seconds-since-epoch per Rockwell conventions
+    /// <summary>
+    ///     UDT / Predefined Structure (Timer / Counter / Control / Message / Axis). Shape is
+    ///     resolved at discovery time; reads + writes fan out to member Variables unless the
+    ///     caller has explicitly opted into whole-UDT decode.
+    /// </summary>
+    Structure,
+}
+
+/// <summary>Map a Logix atomic type to the driver-surface <see cref="DriverDataType"/>.</summary>
+public static class AbCipDataTypeExtensions
+{
+    /// <summary>
+    ///     Map to the driver-agnostic type the server's address-space builder consumes. Unsigned
+    ///     Logix types widen into signed equivalents until <c>DriverDataType</c> picks up unsigned
+    ///     + 64-bit variants (Modbus has the same gap — see <c>ModbusDriver.MapDataType</c>
+    ///     comment re: PR 25).
+    /// </summary>
+    public static DriverDataType ToDriverDataType(this AbCipDataType t) => t switch
+    {
+        AbCipDataType.Bool => DriverDataType.Boolean,
+        AbCipDataType.SInt or AbCipDataType.Int or AbCipDataType.DInt => DriverDataType.Int32,
+        AbCipDataType.USInt or AbCipDataType.UInt or AbCipDataType.UDInt => DriverDataType.Int32,
+        AbCipDataType.LInt or AbCipDataType.ULInt => DriverDataType.Int32, // TODO: Int64 — matches Modbus gap
+        AbCipDataType.Real => DriverDataType.Float32,
+        AbCipDataType.LReal => DriverDataType.Float64,
+        AbCipDataType.String => DriverDataType.String,
+        AbCipDataType.Dt => DriverDataType.Int32, // epoch-seconds DINT
+        AbCipDataType.Structure => DriverDataType.String, // placeholder until UDT PR 6 introduces a structured kind
+        _ => DriverDataType.Int32,
+    };
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -0,0 +1,478 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Allen-Bradley CIP / EtherNet-IP driver for ControlLogix / CompactLogix / Micro800 /
+///     GuardLogix families. Implements <see cref="IDriver"/> only for now — read/write/
+///     subscribe/discover capabilities ship in subsequent PRs (3–8) and family-specific quirk
+///     profiles ship in PRs 9–12.
+/// </summary>
+/// <remarks>
+///     <para>Wire layer is libplctag 1.6.x (plan decision #11). Per-device host addresses use
+///     the <c>ab://gateway[:port]/cip-path</c> canonical form parsed via
+///     <see cref="AbCipHostAddress.TryParse"/>; those strings become the <c>hostName</c> key
+///     for Polly bulkhead + circuit-breaker isolation per plan decision #144.</para>
+///
+///     <para>Tier A per plan decisions #143–145 — in-process, shares server lifetime, no
+///     sidecar. <see cref="ReinitializeAsync"/> is the Tier-B escape hatch for recovering
+///     from native-heap growth that the CLR allocator can't see; it tears down every
+///     <see cref="PlcTagHandle"/> and reconnects each device.</para>
+/// </remarks>
+public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable, IDisposable, IAsyncDisposable
+{
+    private readonly AbCipDriverOptions _options;
+    private readonly string _driverInstanceId;
+    private readonly IAbCipTagFactory _tagFactory;
+    private readonly IAbCipTagEnumeratorFactory _enumeratorFactory;
+    private readonly AbCipTemplateCache _templateCache = new();
+    private readonly PollGroupEngine _poll;
+    private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, AbCipTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
+    private DriverHealth _health = new(DriverState.Unknown, null, null);
+
+    public event EventHandler<DataChangeEventArgs>? OnDataChange;
+
+    public AbCipDriver(AbCipDriverOptions options, string driverInstanceId,
+        IAbCipTagFactory? tagFactory = null,
+        IAbCipTagEnumeratorFactory? enumeratorFactory = null)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        _options = options;
+        _driverInstanceId = driverInstanceId;
+        _tagFactory = tagFactory ?? new LibplctagTagFactory();
+        _enumeratorFactory = enumeratorFactory ?? new EmptyAbCipTagEnumeratorFactory();
+        _poll = new PollGroupEngine(
+            reader: ReadAsync,
+            onChange: (handle, tagRef, snapshot) =>
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+    }
+
+    /// <summary>Shared UDT template cache. Exposed for PR 6 (UDT reader) + diagnostics.</summary>
+    internal AbCipTemplateCache TemplateCache => _templateCache;
+
+    public string DriverInstanceId => _driverInstanceId;
+    public string DriverType => "AbCip";
+
+    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        _health = new DriverHealth(DriverState.Initializing, null, null);
+        try
+        {
+            foreach (var device in _options.Devices)
+            {
+                var addr = AbCipHostAddress.TryParse(device.HostAddress)
+                    ?? throw new InvalidOperationException(
+                        $"AbCip device has invalid HostAddress '{device.HostAddress}' — expected 'ab://gateway[:port]/cip-path'.");
+                var profile = AbCipPlcFamilyProfile.ForFamily(device.PlcFamily);
+                _devices[device.HostAddress] = new DeviceState(addr, device, profile);
+            }
+            foreach (var tag in _options.Tags)
+            {
+                // UDT tags with declared Members fan out into synthetic member-tag entries addressable
+                // by composed full-reference. Parent structure tag also stored so discovery can emit a
+                // folder for it.
+                _tagsByName[tag.Name] = tag;
+                if (tag.DataType == AbCipDataType.Structure && tag.Members is { Count: > 0 })
+                {
+                    foreach (var member in tag.Members)
+                    {
+                        var memberTag = new AbCipTagDefinition(
+                            Name: $"{tag.Name}.{member.Name}",
+                            DeviceHostAddress: tag.DeviceHostAddress,
+                            TagPath: $"{tag.TagPath}.{member.Name}",
+                            DataType: member.DataType,
+                            Writable: member.Writable,
+                            WriteIdempotent: member.WriteIdempotent);
+                        _tagsByName[memberTag.Name] = memberTag;
+                    }
+                }
+            }
+            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+        }
+        catch (Exception ex)
+        {
+            _health = new DriverHealth(DriverState.Faulted, null, ex.Message);
+            throw;
+        }
+        return Task.CompletedTask;
+    }
+
+    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
+        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        await _poll.DisposeAsync().ConfigureAwait(false);
+        foreach (var state in _devices.Values)
+            state.DisposeHandles();
+        _devices.Clear();
+        _tagsByName.Clear();
+        _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+    }
+
+    // ---- ISubscribable (polling overlay via shared engine) ----
+
+    public Task<ISubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken) =>
+        Task.FromResult(_poll.Subscribe(fullReferences, publishingInterval));
+
+    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        _poll.Unsubscribe(handle);
+        return Task.CompletedTask;
+    }
+
+    // ---- IReadable ----
+
+    /// <summary>
+    ///     Read each <c>fullReference</c> in order. Unknown tags surface as
+    ///     <c>BadNodeIdUnknown</c>; libplctag-layer failures map through
+    ///     <see cref="AbCipStatusMapper.MapLibplctagStatus"/>; any other exception becomes
+    ///     <c>BadCommunicationError</c>. The driver health surface is updated per-call so the
+    ///     Admin UI sees a tight feedback loop between read failures + the driver's state.
+    /// </summary>
+    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(fullReferences);
+        var now = DateTime.UtcNow;
+        var results = new DataValueSnapshot[fullReferences.Count];
+
+        for (var i = 0; i < fullReferences.Count; i++)
+        {
+            var reference = fullReferences[i];
+            if (!_tagsByName.TryGetValue(reference, out var def))
+            {
+                results[i] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+
+            try
+            {
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                await runtime.ReadAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                if (status != 0)
+                {
+                    results[i] = new DataValueSnapshot(null,
+                        AbCipStatusMapper.MapLibplctagStatus(status), null, now);
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"libplctag status {status} reading {reference}");
+                    continue;
+                }
+
+                var tagPath = AbCipTagPath.TryParse(def.TagPath);
+                var bitIndex = tagPath?.BitIndex;
+                var value = runtime.DecodeValue(def.DataType, bitIndex);
+                results[i] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+                _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            catch (OperationCanceledException)
+            {
+                throw;
+            }
+            catch (Exception ex)
+            {
+                results[i] = new DataValueSnapshot(null,
+                    AbCipStatusMapper.BadCommunicationError, null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- IWritable ----
+
+    /// <summary>
+    ///     Write each request in order. Writes are NOT auto-retried by the driver — per plan
+    ///     decisions #44, #45, #143 the caller opts in via <see cref="AbCipTagDefinition.WriteIdempotent"/>
+    ///     and the resilience pipeline (layered above the driver) decides whether to replay.
+    ///     Non-writable configurations surface as <c>BadNotWritable</c>; type-conversion failures
+    ///     as <c>BadTypeMismatch</c>; transport errors as <c>BadCommunicationError</c>.
+    /// </summary>
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(writes);
+        var results = new WriteResult[writes.Count];
+        var now = DateTime.UtcNow;
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            try
+            {
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                var tagPath = AbCipTagPath.TryParse(def.TagPath);
+                runtime.EncodeValue(def.DataType, tagPath?.BitIndex, w.Value);
+                await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                results[i] = new WriteResult(status == 0
+                    ? AbCipStatusMapper.Good
+                    : AbCipStatusMapper.MapLibplctagStatus(status));
+                if (status == 0) _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            catch (OperationCanceledException)
+            {
+                throw;
+            }
+            catch (NotSupportedException nse)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotSupported);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            }
+            catch (FormatException fe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, fe.Message);
+            }
+            catch (InvalidCastException ice)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ice.Message);
+            }
+            catch (OverflowException oe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadOutOfRange);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, oe.Message);
+            }
+            catch (Exception ex)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadCommunicationError);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    ///     Idempotently materialise the runtime handle for a tag definition. First call creates
+    ///     + initialises the libplctag Tag; subsequent calls reuse the cached handle for the
+    ///     lifetime of the device.
+    /// </summary>
+    private async Task<IAbCipTagRuntime> EnsureTagRuntimeAsync(
+        DeviceState device, AbCipTagDefinition def, CancellationToken ct)
+    {
+        if (device.Runtimes.TryGetValue(def.Name, out var existing)) return existing;
+
+        var parsed = AbCipTagPath.TryParse(def.TagPath)
+            ?? throw new InvalidOperationException(
+                $"AbCip tag '{def.Name}' has malformed TagPath '{def.TagPath}'.");
+
+        var runtime = _tagFactory.Create(new AbCipTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parsed.ToLibplctagName(),
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.Runtimes[def.Name] = runtime;
+        return runtime;
+    }
+
+    public DriverHealth GetHealth() => _health;
+
+    /// <summary>
+    ///     CLR-visible allocation footprint only — libplctag's native heap is invisible to the
+    ///     GC. driver-specs.md §3 flags this: operators must watch whole-process RSS for the
+    ///     full picture, and <see cref="ReinitializeAsync"/> is the Tier-B remediation.
+    /// </summary>
+    public long GetMemoryFootprint() => 0;
+
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken)
+    {
+        _templateCache.Clear();
+        return Task.CompletedTask;
+    }
+
+    // ---- ITagDiscovery ----
+
+    /// <summary>
+    ///     Stream the driver's tag set into the builder. Pre-declared tags from
+    ///     <see cref="AbCipDriverOptions.Tags"/> emit first; optionally, the
+    ///     <see cref="IAbCipTagEnumerator"/> walks each device's symbol table and adds
+    ///     controller-discovered tags under a <c>Discovered/</c> sub-folder. System / module /
+    ///     routine / task tags are hidden via <see cref="AbCipSystemTagFilter"/>.
+    /// </summary>
+    public async Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var root = builder.Folder("AbCip", "AbCip");
+
+        foreach (var device in _options.Devices)
+        {
+            var deviceLabel = device.DeviceName ?? device.HostAddress;
+            var deviceFolder = root.Folder(device.HostAddress, deviceLabel);
+
+            // Pre-declared tags — always emitted; the primary config path. UDT tags with declared
+            // Members fan out into a sub-folder + one Variable per member instead of a single
+            // Structure Variable (Structure has no useful scalar value + member-addressable paths
+            // are what downstream consumers actually want).
+            var preDeclared = _options.Tags.Where(t =>
+                string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
+            foreach (var tag in preDeclared)
+            {
+                if (AbCipSystemTagFilter.IsSystemTag(tag.Name)) continue;
+
+                if (tag.DataType == AbCipDataType.Structure && tag.Members is { Count: > 0 })
+                {
+                    var udtFolder = deviceFolder.Folder(tag.Name, tag.Name);
+                    foreach (var member in tag.Members)
+                    {
+                        var memberFullName = $"{tag.Name}.{member.Name}";
+                        udtFolder.Variable(member.Name, member.Name, new DriverAttributeInfo(
+                            FullName: memberFullName,
+                            DriverDataType: member.DataType.ToDriverDataType(),
+                            IsArray: false,
+                            ArrayDim: null,
+                            SecurityClass: member.Writable
+                                ? SecurityClassification.Operate
+                                : SecurityClassification.ViewOnly,
+                            IsHistorized: false,
+                            IsAlarm: false,
+                            WriteIdempotent: member.WriteIdempotent));
+                    }
+                    continue;
+                }
+
+                deviceFolder.Variable(tag.Name, tag.Name, ToAttributeInfo(tag));
+            }
+
+            // Controller-discovered tags — optional. Default enumerator returns an empty sequence;
+            // tests + the follow-up real @tags walker plug in via the ctor parameter.
+            if (_devices.TryGetValue(device.HostAddress, out var state))
+            {
+                using var enumerator = _enumeratorFactory.Create();
+                var deviceParams = new AbCipTagCreateParams(
+                    Gateway: state.ParsedAddress.Gateway,
+                    Port: state.ParsedAddress.Port,
+                    CipPath: state.ParsedAddress.CipPath,
+                    LibplctagPlcAttribute: state.Profile.LibplctagPlcAttribute,
+                    TagName: "@tags",
+                    Timeout: _options.Timeout);
+
+                IAddressSpaceBuilder? discoveredFolder = null;
+                await foreach (var discovered in enumerator.EnumerateAsync(deviceParams, cancellationToken)
+                    .ConfigureAwait(false))
+                {
+                    if (discovered.IsSystemTag) continue;
+                    if (AbCipSystemTagFilter.IsSystemTag(discovered.Name)) continue;
+
+                    discoveredFolder ??= deviceFolder.Folder("Discovered", "Discovered");
+                    var fullName = discovered.ProgramScope is null
+                        ? discovered.Name
+                        : $"Program:{discovered.ProgramScope}.{discovered.Name}";
+                    discoveredFolder.Variable(fullName, discovered.Name, new DriverAttributeInfo(
+                        FullName: fullName,
+                        DriverDataType: discovered.DataType.ToDriverDataType(),
+                        IsArray: false,
+                        ArrayDim: null,
+                        SecurityClass: discovered.ReadOnly
+                            ? SecurityClassification.ViewOnly
+                            : SecurityClassification.Operate,
+                        IsHistorized: false,
+                        IsAlarm: false,
+                        WriteIdempotent: false));
+                }
+            }
+        }
+    }
+
+    private static DriverAttributeInfo ToAttributeInfo(AbCipTagDefinition tag) => new(
+        FullName: tag.Name,
+        DriverDataType: tag.DataType.ToDriverDataType(),
+        IsArray: false,
+        ArrayDim: null,
+        SecurityClass: tag.Writable
+            ? SecurityClassification.Operate
+            : SecurityClassification.ViewOnly,
+        IsHistorized: false,
+        IsAlarm: false,
+        WriteIdempotent: tag.WriteIdempotent);
+
+    /// <summary>Count of registered devices — exposed for diagnostics + tests.</summary>
+    internal int DeviceCount => _devices.Count;
+
+    /// <summary>Looked-up device state for the given host address. Tests + later-PR capabilities hit this.</summary>
+    internal DeviceState? GetDeviceState(string hostAddress) =>
+        _devices.TryGetValue(hostAddress, out var s) ? s : null;
+
+    public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
+
+    public async ValueTask DisposeAsync()
+    {
+        await ShutdownAsync(CancellationToken.None).ConfigureAwait(false);
+    }
+
+    /// <summary>
+    ///     Per-device runtime state. Holds the parsed host address, family profile, and the
+    ///     live <see cref="PlcTagHandle"/> cache keyed by tag path. PRs 3–8 populate + consume
+    ///     this dict via libplctag.
+    /// </summary>
+    internal sealed class DeviceState(
+        AbCipHostAddress parsedAddress,
+        AbCipDeviceOptions options,
+        AbCipPlcFamilyProfile profile)
+    {
+        public AbCipHostAddress ParsedAddress { get; } = parsedAddress;
+        public AbCipDeviceOptions Options { get; } = options;
+        public AbCipPlcFamilyProfile Profile { get; } = profile;
+
+        public Dictionary<string, PlcTagHandle> TagHandles { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>
+        ///     Per-tag runtime handles owned by this device. One entry per configured tag is
+        ///     created lazily on first read (see <see cref="AbCipDriver.EnsureTagRuntimeAsync"/>).
+        /// </summary>
+        public Dictionary<string, IAbCipTagRuntime> Runtimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        public void DisposeHandles()
+        {
+            foreach (var h in TagHandles.Values) h.Dispose();
+            TagHandles.Clear();
+            foreach (var r in Runtimes.Values) r.Dispose();
+            Runtimes.Clear();
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverOptions.cs

@@ -0,0 +1,109 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     AB CIP / EtherNet-IP driver configuration, bound from the driver's <c>DriverConfig</c>
+///     JSON at <c>DriverHost.RegisterAsync</c>. One instance supports N devices (PLCs) behind
+///     the same driver; per-device routing is keyed on <see cref="AbCipDeviceOptions.HostAddress"/>
+///     via <c>IPerCallHostResolver</c>.
+/// </summary>
+/// <remarks>
+///     Per v2 plan decisions #11 (libplctag), #41 (AbCip vs AbLegacy split), #143–144 (per-call
+///     host resolver + resilience keys), #144 (bulkhead keyed on <c>(DriverInstanceId, HostName)</c>).
+/// </remarks>
+public sealed class AbCipDriverOptions
+{
+    /// <summary>
+    ///     PLCs this driver instance talks to. Each device contributes its own <see cref="AbCipHostAddress"/>
+    ///     string as the <c>hostName</c> key used by resilience pipelines and the Admin UI.
+    /// </summary>
+    public IReadOnlyList<AbCipDeviceOptions> Devices { get; init; } = [];
+
+    /// <summary>Pre-declared tag map across all devices — AB discovery lands in PR 5.</summary>
+    public IReadOnlyList<AbCipTagDefinition> Tags { get; init; } = [];
+
+    /// <summary>Per-device probe settings. Falls back to defaults when omitted.</summary>
+    public AbCipProbeOptions Probe { get; init; } = new();
+
+    /// <summary>
+    ///     Default libplctag call timeout applied to reads/writes/discovery when the caller does
+    ///     not pass a more specific value. Matches the Modbus driver's 2-second default.
+    /// </summary>
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+}
+
+/// <summary>
+///     One PLC endpoint. <see cref="HostAddress"/> must parse via
+///     <see cref="AbCipHostAddress.TryParse"/>; misconfigured devices fail driver
+///     initialization rather than silently connecting to nothing.
+/// </summary>
+/// <param name="HostAddress">Canonical <c>ab://gateway[:port]/cip-path</c> string.</param>
+/// <param name="PlcFamily">Which per-family profile to apply. Determines ConnectionSize,
+///     request-packing support, unconnected-only hint, and other quirks.</param>
+/// <param name="DeviceName">Optional display label for Admin UI. Falls back to <see cref="HostAddress"/>.</param>
+public sealed record AbCipDeviceOptions(
+    string HostAddress,
+    AbCipPlcFamily PlcFamily = AbCipPlcFamily.ControlLogix,
+    string? DeviceName = null);
+
+/// <summary>
+///     One AB-backed OPC UA variable. Mirrors the <c>ModbusTagDefinition</c> shape.
+/// </summary>
+/// <param name="Name">Tag name; becomes the OPC UA browse name and full reference.</param>
+/// <param name="DeviceHostAddress">Which device (<see cref="AbCipDeviceOptions.HostAddress"/>) this tag lives on.</param>
+/// <param name="TagPath">Logix symbolic path (controller or program scope).</param>
+/// <param name="DataType">Logix atomic type, or <see cref="AbCipDataType.Structure"/> for UDT-typed tags.</param>
+/// <param name="Writable">When <c>true</c> and the tag's ExternalAccess permits writes, IWritable routes writes here.</param>
+/// <param name="WriteIdempotent">Per plan decisions #44–#45, #143 — safe to replay on write timeout. Default <c>false</c>.</param>
+/// <param name="Members">For <see cref="AbCipDataType.Structure"/>-typed tags, the declared UDT
+///     member layout. When supplied, discovery fans out the UDT into a folder + one Variable per
+///     member (member TagPath = <c>{tag.TagPath}.{member.Name}</c>). When <c>null</c> on a Structure
+///     tag, the driver treats it as a black-box and relies on downstream configuration to address
+///     members individually via dotted <see cref="AbCipTagPath"/> syntax. Ignored for atomic types.</param>
+public sealed record AbCipTagDefinition(
+    string Name,
+    string DeviceHostAddress,
+    string TagPath,
+    AbCipDataType DataType,
+    bool Writable = true,
+    bool WriteIdempotent = false,
+    IReadOnlyList<AbCipStructureMember>? Members = null);
+
+/// <summary>
+///     One declared member of a UDT tag. Name is the member identifier on the PLC (e.g. <c>Speed</c>,
+///     <c>Status</c>), DataType is the atomic Logix type, Writable/WriteIdempotent mirror
+///     <see cref="AbCipTagDefinition"/>. Declaration-driven — the real CIP Template Object reader
+///     (class 0x6C) that would auto-discover member layouts lands as a follow-up PR.
+/// </summary>
+public sealed record AbCipStructureMember(
+    string Name,
+    AbCipDataType DataType,
+    bool Writable = true,
+    bool WriteIdempotent = false);
+
+/// <summary>Which AB PLC family the device is — selects the profile applied to connection params.</summary>
+public enum AbCipPlcFamily
+{
+    ControlLogix,
+    CompactLogix,
+    Micro800,
+    GuardLogix,
+}
+
+/// <summary>
+///     Background connectivity-probe settings. Enabled by default; the probe reads a cheap tag
+///     on the PLC at the configured interval to drive <see cref="Core.Abstractions.IHostConnectivityProbe"/>
+///     state transitions + Admin UI health status.
+/// </summary>
+public sealed class AbCipProbeOptions
+{
+    public bool Enabled { get; init; } = true;
+    public TimeSpan Interval { get; init; } = TimeSpan.FromSeconds(5);
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+
+    /// <summary>
+    ///     Tag path used for the probe. If null, the driver attempts to read a default
+    ///     system tag (PR 8 wires this up — the choice is family-dependent, e.g.
+    ///     <c>@raw_cpu_type</c> on ControlLogix or a user-configured probe tag on Micro800).
+    /// </summary>
+    public string? ProbeTagPath { get; init; }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipHostAddress.cs

@@ -0,0 +1,68 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Parsed <c>ab://gateway[:port]/cip-path</c> host-address string used by the AbCip driver
+///     as the <c>hostName</c> key across <see cref="Core.Abstractions.IHostConnectivityProbe"/>,
+///     <see cref="Core.Abstractions.IPerCallHostResolver"/>, and the Polly bulkhead key
+///     <c>(DriverInstanceId, hostName)</c> per v2 plan decision #144.
+/// </summary>
+/// <remarks>
+///     <para>Format matches what libplctag's <c>gateway=...</c> + <c>path=...</c> attributes
+///     consume, so no translation is needed at the wire layer — the parsed <see cref="CipPath"/>
+///     is handed to the native library verbatim.</para>
+///     <list type="bullet">
+///         <item><c>ab://10.0.0.5/1,0</c> — single-chassis ControlLogix, CPU in slot 0.</item>
+///         <item><c>ab://10.0.0.5/1,4</c> — CPU in slot 4.</item>
+///         <item><c>ab://10.0.0.5/1,2,2,192.168.50.20,1,0</c> — bridged ControlLogix.</item>
+///         <item><c>ab://10.0.0.5/</c> (empty path) — Micro800 / MicroLogix without backplane routing.</item>
+///         <item><c>ab://10.0.0.5:44818/1,0</c> — explicit EIP port (default 44818).</item>
+///     </list>
+///     <para>Opaque to the rest of the stack: Admin UI, telemetry, and logs display the full
+///     string so an incident ticket can be matched to the exact gateway + CIP route.</para>
+/// </remarks>
+public sealed record AbCipHostAddress(string Gateway, int Port, string CipPath)
+{
+    /// <summary>Default EtherNet/IP TCP port — spec-reserved.</summary>
+    public const int DefaultEipPort = 44818;
+
+    /// <summary>Recompose the canonical <c>ab://...</c> form.</summary>
+    public override string ToString() => Port == DefaultEipPort
+        ? $"ab://{Gateway}/{CipPath}"
+        : $"ab://{Gateway}:{Port}/{CipPath}";
+
+    /// <summary>
+    ///     Parse <paramref name="value"/>. Returns <c>null</c> on any malformed input — callers
+    ///     should treat a null return as a config-validation failure rather than catching.
+    /// </summary>
+    public static AbCipHostAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        const string prefix = "ab://";
+        if (!value.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) return null;
+
+        var remainder = value[prefix.Length..];
+        var slashIdx = remainder.IndexOf('/');
+        if (slashIdx < 0) return null;
+
+        var authority = remainder[..slashIdx];
+        var cipPath = remainder[(slashIdx + 1)..];
+        if (string.IsNullOrEmpty(authority)) return null;
+
+        var port = DefaultEipPort;
+        var colonIdx = authority.LastIndexOf(':');
+        string gateway;
+        if (colonIdx >= 0)
+        {
+            gateway = authority[..colonIdx];
+            if (!int.TryParse(authority[(colonIdx + 1)..], out port) || port <= 0 || port > 65535)
+                return null;
+        }
+        else
+        {
+            gateway = authority;
+        }
+        if (string.IsNullOrEmpty(gateway)) return null;
+
+        return new AbCipHostAddress(gateway, port, cipPath);
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipStatusMapper.cs

@@ -0,0 +1,79 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Maps libplctag / CIP General Status codes to OPC UA StatusCodes. Mirrors the shape of
+///     <c>ModbusDriver.MapModbusExceptionToStatus</c> so Admin UI status displays stay
+///     uniform across drivers.
+/// </summary>
+/// <remarks>
+///     <para>Coverage: the CIP general-status values an AB PLC actually returns during normal
+///     driver operation. Full CIP Volume 1 Appendix B lists 50+ codes; the ones here are the
+///     ones that move the driver's status needle:</para>
+///     <list type="bullet">
+///         <item>0x00 success — OPC UA <c>Good (0)</c>.</item>
+///         <item>0x04 path segment error / 0x05 path destination unknown — <c>BadNodeIdUnknown</c>
+///             (tag doesn't exist).</item>
+///         <item>0x06 partial data transfer — <c>GoodMoreData</c> (fragmented read underway).</item>
+///         <item>0x08 service not supported — <c>BadNotSupported</c> (e.g. write on a safety
+///             partition tag from a non-safety task).</item>
+///         <item>0x0A / 0x13 attribute-list error / insufficient data — <c>BadOutOfRange</c>
+///             (type mismatch or truncated buffer).</item>
+///         <item>0x0B already in requested mode — benign, treated as <c>Good</c>.</item>
+///         <item>0x0E attribute not settable — <c>BadNotWritable</c>.</item>
+///         <item>0x10 device state conflict — <c>BadDeviceFailure</c> (program-mode protected
+///             writes during download / test-mode transitions).</item>
+///         <item>0x16 object does not exist — <c>BadNodeIdUnknown</c>.</item>
+///         <item>0x1E embedded service error — unwrap to the extended status when possible.</item>
+///         <item>any libplctag <c>PLCTAG_STATUS_*</c> below zero — wrapped as
+///             <c>BadCommunicationError</c> until fine-grained mapping lands (PR 3).</item>
+///     </list>
+/// </remarks>
+public static class AbCipStatusMapper
+{
+    public const uint Good = 0u;
+    public const uint GoodMoreData = 0x00A70000u;
+    public const uint BadInternalError = 0x80020000u;
+    public const uint BadNodeIdUnknown = 0x80340000u;
+    public const uint BadNotWritable = 0x803B0000u;
+    public const uint BadOutOfRange = 0x803C0000u;
+    public const uint BadNotSupported = 0x803D0000u;
+    public const uint BadDeviceFailure = 0x80550000u;
+    public const uint BadCommunicationError = 0x80050000u;
+    public const uint BadTimeout = 0x800A0000u;
+    public const uint BadTypeMismatch = 0x80730000u;
+
+    /// <summary>Map a CIP general-status byte to an OPC UA StatusCode.</summary>
+    public static uint MapCipGeneralStatus(byte status) => status switch
+    {
+        0x00 => Good,
+        0x04 or 0x05 => BadNodeIdUnknown,
+        0x06 => GoodMoreData,
+        0x08 => BadNotSupported,
+        0x0A or 0x13 => BadOutOfRange,
+        0x0B => Good,
+        0x0E => BadNotWritable,
+        0x10 => BadDeviceFailure,
+        0x16 => BadNodeIdUnknown,
+        _ => BadInternalError,
+    };
+
+    /// <summary>
+    ///     Map a libplctag return/status code (<c>PLCTAG_STATUS_*</c>) to an OPC UA StatusCode.
+    ///     libplctag uses <c>0 = PLCTAG_STATUS_OK</c>, positive values for pending, negative
+    ///     values for errors.
+    /// </summary>
+    public static uint MapLibplctagStatus(int status)
+    {
+        if (status == 0) return Good;
+        if (status > 0) return GoodMoreData; // PLCTAG_STATUS_PENDING
+        return status switch
+        {
+            -5 => BadTimeout,              // PLCTAG_ERR_TIMEOUT
+            -7 => BadCommunicationError,   // PLCTAG_ERR_BAD_CONNECTION
+            -14 => BadNodeIdUnknown,       // PLCTAG_ERR_NOT_FOUND
+            -16 => BadNotWritable,         // PLCTAG_ERR_NOT_ALLOWED / read-only tag
+            -17 => BadOutOfRange,          // PLCTAG_ERR_OUT_OF_BOUNDS
+            _ => BadCommunicationError,
+        };
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipSystemTagFilter.cs

@@ -0,0 +1,49 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Filters system / infrastructure tags out of discovered tag sets. A Logix controller's
+///     symbol table exposes user tags alongside module-config objects, routine pointers, task
+///     pointers, and <c>__DEFVAL_*</c> stubs that are noise for the OPC UA address space.
+/// </summary>
+/// <remarks>
+///     Lifted from the filter conventions documented across Rockwell Knowledgebase article
+///     IC-12345 and the Logix 5000 Controllers General Instructions Reference. The list is
+///     conservative — when in doubt, a tag is surfaced rather than hidden so operators can
+///     see it and the config flow can explicitly hide it via UnsArea ACL.
+/// </remarks>
+public static class AbCipSystemTagFilter
+{
+    /// <summary>
+    ///     <c>true</c> when the tag name matches a well-known system-tag pattern the driver
+    ///     should hide from the default address space. Case-sensitive — Logix symbols are
+    ///     always preserved case and the system-tag prefixes are uppercase by convention.
+    /// </summary>
+    public static bool IsSystemTag(string tagName)
+    {
+        if (string.IsNullOrWhiteSpace(tagName)) return true;
+
+        // Internal backing store for tag defaults — never user-meaningful.
+        if (tagName.StartsWith("__DEFVAL_", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("__DEFAULT_", StringComparison.Ordinal)) return true;
+
+        // Routine and Task pointer pseudo-tags.
+        if (tagName.StartsWith("Routine:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Task:", StringComparison.Ordinal)) return true;
+
+        // Logix module-config auto-generated names — Local:1:I, Local:1:O, etc. Module data is
+        // exposed separately via the dedicated hardware mapping; the auto-generated symbol-table
+        // entries duplicate that.
+        if (tagName.StartsWith("Local:", StringComparison.Ordinal) && tagName.Contains(':')) return true;
+
+        // Map / Mapped IO alias tags (MainProgram.MapName pattern — dot-separated but prefixed
+        // with a reserved colon-carrying prefix to avoid false positives on user member access).
+        if (tagName.StartsWith("Map:", StringComparison.Ordinal)) return true;
+
+        // Axis / Cam / Motion-Group predefined structures — exposed separately through motion API.
+        if (tagName.StartsWith("Axis:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Cam:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("MotionGroup:", StringComparison.Ordinal)) return true;
+
+        return false;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipTagPath.cs

@@ -0,0 +1,132 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Parsed Logix-symbolic tag path. Handles controller-scope (<c>Motor1_Speed</c>),
+///     program-scope (<c>Program:MainProgram.StepIndex</c>), structured member access
+///     (<c>Motor1.Speed.Setpoint</c>), array subscripts (<c>Array[0]</c>, <c>Matrix[1,2]</c>),
+///     and bit-within-DINT access (<c>Flags.3</c>). Reassembles the canonical Logix syntax via
+///     <see cref="ToLibplctagName"/>, which is the exact string libplctag's <c>name=...</c>
+///     attribute consumes.
+/// </summary>
+/// <remarks>
+///     Scope + members + subscripts are captured structurally so PR 6 (UDT support) can walk
+///     the path against a cached template without re-parsing. <see cref="BitIndex"/> is
+///     non-null only when the trailing segment is a decimal integer between 0 and 31 that
+///     parses as a bit-selector — this is the <c>.N</c> syntax documented in the Logix 5000
+///     General Instructions Reference §Tags, and it applies only to DINT-typed parents. The
+///     parser does not validate the parent type (requires live template data) — it accepts the
+///     shape and defers type-correctness to the runtime.
+/// </remarks>
+public sealed record AbCipTagPath(
+    string? ProgramScope,
+    IReadOnlyList<AbCipTagPathSegment> Segments,
+    int? BitIndex)
+{
+    /// <summary>Rebuild the canonical Logix tag string.</summary>
+    public string ToLibplctagName()
+    {
+        var buf = new System.Text.StringBuilder();
+        if (ProgramScope is not null)
+            buf.Append("Program:").Append(ProgramScope).Append('.');
+
+        for (var i = 0; i < Segments.Count; i++)
+        {
+            if (i > 0) buf.Append('.');
+            var seg = Segments[i];
+            buf.Append(seg.Name);
+            if (seg.Subscripts.Count > 0)
+                buf.Append('[').Append(string.Join(",", seg.Subscripts)).Append(']');
+        }
+        if (BitIndex is not null) buf.Append('.').Append(BitIndex.Value);
+        return buf.ToString();
+    }
+
+    /// <summary>
+    ///     Parse a Logix-symbolic tag reference. Returns <c>null</c> on a shape the parser
+    ///     doesn't support — the driver surfaces that as a config-validation error rather than
+    ///     attempting a best-effort translation.
+    /// </summary>
+    public static AbCipTagPath? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        var src = value.Trim();
+
+        string? programScope = null;
+        const string programPrefix = "Program:";
+        if (src.StartsWith(programPrefix, StringComparison.OrdinalIgnoreCase))
+        {
+            var afterPrefix = src[programPrefix.Length..];
+            var dotIdx = afterPrefix.IndexOf('.');
+            if (dotIdx <= 0) return null;
+            programScope = afterPrefix[..dotIdx];
+            src = afterPrefix[(dotIdx + 1)..];
+            if (string.IsNullOrEmpty(src)) return null;
+        }
+
+        // Split on dots, but preserve any [i,j] subscript runs that contain only digits + commas.
+        var parts = new List<string>();
+        var depth = 0;
+        var start = 0;
+        for (var i = 0; i < src.Length; i++)
+        {
+            var c = src[i];
+            if (c == '[') depth++;
+            else if (c == ']') depth--;
+            else if (c == '.' && depth == 0)
+            {
+                parts.Add(src[start..i]);
+                start = i + 1;
+            }
+        }
+        parts.Add(src[start..]);
+        if (depth != 0 || parts.Any(string.IsNullOrEmpty)) return null;
+
+        int? bitIndex = null;
+        if (parts.Count >= 2 && int.TryParse(parts[^1], out var maybeBit)
+            && maybeBit is >= 0 and <= 31
+            && !parts[^1].Contains('['))
+        {
+            bitIndex = maybeBit;
+            parts.RemoveAt(parts.Count - 1);
+        }
+
+        var segments = new List<AbCipTagPathSegment>(parts.Count);
+        foreach (var part in parts)
+        {
+            var bracketIdx = part.IndexOf('[');
+            if (bracketIdx < 0)
+            {
+                if (!IsValidIdent(part)) return null;
+                segments.Add(new AbCipTagPathSegment(part, []));
+                continue;
+            }
+            if (!part.EndsWith(']')) return null;
+            var name = part[..bracketIdx];
+            if (!IsValidIdent(name)) return null;
+            var inner = part[(bracketIdx + 1)..^1];
+            var subs = new List<int>();
+            foreach (var tok in inner.Split(','))
+            {
+                if (!int.TryParse(tok, out var n) || n < 0) return null;
+                subs.Add(n);
+            }
+            if (subs.Count == 0) return null;
+            segments.Add(new AbCipTagPathSegment(name, subs));
+        }
+        if (segments.Count == 0) return null;
+
+        return new AbCipTagPath(programScope, segments, bitIndex);
+    }
+
+    private static bool IsValidIdent(string s)
+    {
+        if (string.IsNullOrEmpty(s)) return false;
+        if (!char.IsLetter(s[0]) && s[0] != '_') return false;
+        for (var i = 1; i < s.Length; i++)
+            if (!char.IsLetterOrDigit(s[i]) && s[i] != '_') return false;
+        return true;
+    }
+}
+
+/// <summary>One path segment: a member name plus any numeric subscripts.</summary>
+public sealed record AbCipTagPathSegment(string Name, IReadOnlyList<int> Subscripts);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipTemplateCache.cs

@@ -0,0 +1,55 @@
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Cache of UDT shape descriptors keyed by <c>(deviceHostAddress, templateInstanceId)</c>.
+///     Populated on demand during discovery + whole-UDT reads; flushed via
+///     <see cref="AbCipDriver.FlushOptionalCachesAsync"/> and on device
+///     <c>ReinitializeAsync</c>.
+/// </summary>
+/// <remarks>
+///     Template shape read (CIP Template Object class 0x6C, <c>GetAttributeList</c> +
+///     <c>Read Template</c>) lands with PR 6. This class ships the cache surface so PR 6 can
+///     drop the decoder in without reshaping any caller code.
+/// </remarks>
+public sealed class AbCipTemplateCache
+{
+    private readonly ConcurrentDictionary<(string device, uint instanceId), AbCipUdtShape> _shapes = new();
+
+    /// <summary>
+    ///     Retrieve a cached UDT shape, or <c>null</c> if not yet read.
+    /// </summary>
+    public AbCipUdtShape? TryGet(string deviceHostAddress, uint templateInstanceId) =>
+        _shapes.TryGetValue((deviceHostAddress, templateInstanceId), out var shape) ? shape : null;
+
+    /// <summary>Store a freshly-decoded UDT shape.</summary>
+    public void Put(string deviceHostAddress, uint templateInstanceId, AbCipUdtShape shape) =>
+        _shapes[(deviceHostAddress, templateInstanceId)] = shape;
+
+    /// <summary>Drop every cached shape — called on <see cref="AbCipDriver.FlushOptionalCachesAsync"/>.</summary>
+    public void Clear() => _shapes.Clear();
+
+    /// <summary>Count of cached shapes — exposed for diagnostics + tests.</summary>
+    public int Count => _shapes.Count;
+}
+
+/// <summary>
+///     Decoded shape of one Logix UDT — member list + each member's offset + type. Populated
+///     by PR 6's Template Object reader. At PR 5 time this is the cache's value type only;
+///     no reader writes to it yet.
+/// </summary>
+/// <param name="TypeName">UDT name as reported by the Template Object.</param>
+/// <param name="TotalSize">Bytes the UDT occupies in a whole-UDT read buffer.</param>
+/// <param name="Members">Ordered list of members, each with its byte offset + type.</param>
+public sealed record AbCipUdtShape(
+    string TypeName,
+    int TotalSize,
+    IReadOnlyList<AbCipUdtMember> Members);
+
+/// <summary>One member of a Logix UDT.</summary>
+public sealed record AbCipUdtMember(
+    string Name,
+    int Offset,
+    AbCipDataType DataType,
+    int ArrayLength);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagEnumerator.cs

@@ -0,0 +1,67 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Swappable scanner that walks a controller's symbol table (via libplctag's
+///     <c>@tags</c> pseudo-tag or the CIP Symbol Object class 0x6B) and yields the tags it
+///     finds. Defaults to <see cref="EmptyAbCipTagEnumeratorFactory"/> which returns no
+///     controller-side tags — the full <c>@tags</c> decoder lands as a follow-up PR once
+///     libplctag 1.5.2 either gains <c>TagInfoPlcMapper</c> upstream or we ship our own
+///     <c>IPlcMapper</c> for the Symbol Object byte layout (tracked via follow-up task; PR 5
+///     ships the abstraction + pre-declared-tag emission).
+/// </summary>
+public interface IAbCipTagEnumerator : IDisposable
+{
+    /// <summary>
+    ///     Enumerate the controller's tags for one device. Callers iterate asynchronously so
+    ///     large symbol tables don't require buffering the entire list.
+    /// </summary>
+    IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        CancellationToken cancellationToken);
+}
+
+/// <summary>Factory for per-driver enumerators.</summary>
+public interface IAbCipTagEnumeratorFactory
+{
+    IAbCipTagEnumerator Create();
+}
+
+/// <summary>One tag yielded by <see cref="IAbCipTagEnumerator.EnumerateAsync"/>.</summary>
+/// <param name="Name">Logix symbolic name as returned by the Symbol Object.</param>
+/// <param name="ProgramScope">Program name if the tag is program-scoped; <c>null</c> for controller scope.</param>
+/// <param name="DataType">Detected data type; <see cref="AbCipDataType.Structure"/> when the tag
+///     is UDT-typed — the UDT shape lookup + per-member expansion ship with PR 6.</param>
+/// <param name="ReadOnly"><c>true</c> when the Symbol Object's External Access attribute forbids writes.</param>
+/// <param name="IsSystemTag">Hint from the enumerator that this is a system / infrastructure tag;
+///     the driver applies <see cref="AbCipSystemTagFilter"/> on top so the enumerator is not the
+///     single source of truth.</param>
+public sealed record AbCipDiscoveredTag(
+    string Name,
+    string? ProgramScope,
+    AbCipDataType DataType,
+    bool ReadOnly,
+    bool IsSystemTag = false);
+
+/// <summary>
+///     Default production enumerator — currently returns an empty sequence. The real <c>@tags</c>
+///     walk lands as a follow-up PR. Documented in <c>driver-specs.md §3</c> as the gap the
+///     Symbol Object walker closes.
+/// </summary>
+internal sealed class EmptyAbCipTagEnumerator : IAbCipTagEnumerator
+{
+    public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        [System.Runtime.CompilerServices.EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        await Task.CompletedTask;
+        yield break;
+    }
+
+    public void Dispose() { }
+}
+
+/// <summary>Factory for <see cref="EmptyAbCipTagEnumerator"/>.</summary>
+internal sealed class EmptyAbCipTagEnumeratorFactory : IAbCipTagEnumeratorFactory
+{
+    public IAbCipTagEnumerator Create() => new EmptyAbCipTagEnumerator();
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagRuntime.cs

@@ -0,0 +1,63 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Thin wire-layer abstraction over a single CIP tag. The driver holds one instance per
+///     <c>(device, tag path)</c> pair; the default implementation delegates to
+///     <see cref="LibplctagTagRuntime"/>. Tests swap in a fake via
+///     <see cref="IAbCipTagFactory"/> so the driver's read / write / status-mapping logic can
+///     be exercised without a running PLC or the native libplctag binary.
+/// </summary>
+public interface IAbCipTagRuntime : IDisposable
+{
+    /// <summary>Create the underlying native tag (equivalent to libplctag's <c>plc_tag_create</c>).</summary>
+    Task InitializeAsync(CancellationToken cancellationToken);
+
+    /// <summary>Issue a read; on completion the local buffer holds the current PLC value.</summary>
+    Task ReadAsync(CancellationToken cancellationToken);
+
+    /// <summary>Flush the local buffer to the PLC.</summary>
+    Task WriteAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Raw libplctag status code — mapped to an OPC UA StatusCode via
+    ///     <see cref="AbCipStatusMapper.MapLibplctagStatus"/>. Zero on success, negative on error.
+    /// </summary>
+    int GetStatus();
+
+    /// <summary>
+    ///     Decode the local buffer into a boxed .NET value per the tag's configured type.
+    ///     <paramref name="bitIndex"/> is non-null only for BOOL-within-DINT tags captured in
+    ///     the <c>.N</c> syntax at parse time.
+    /// </summary>
+    object? DecodeValue(AbCipDataType type, int? bitIndex);
+
+    /// <summary>
+    ///     Encode <paramref name="value"/> into the local buffer per the tag's type. Callers
+    ///     pair this with <see cref="WriteAsync"/>.
+    /// </summary>
+    void EncodeValue(AbCipDataType type, int? bitIndex, object? value);
+}
+
+/// <summary>
+///     Factory for per-tag runtime handles. Instantiated once per driver, consumed per
+///     <c>(device, tag path)</c> pair at the first read/write.
+/// </summary>
+public interface IAbCipTagFactory
+{
+    IAbCipTagRuntime Create(AbCipTagCreateParams createParams);
+}
+
+/// <summary>Everything libplctag needs to materialise a tag handle.</summary>
+/// <param name="Gateway">Gateway IP / hostname parsed from <see cref="AbCipHostAddress.Gateway"/>.</param>
+/// <param name="Port">EtherNet/IP TCP port — default 44818.</param>
+/// <param name="CipPath">CIP route path, e.g. <c>1,0</c>. Empty for Micro800.</param>
+/// <param name="LibplctagPlcAttribute">libplctag <c>plc=...</c> attribute, per family profile.</param>
+/// <param name="TagName">Logix symbolic tag name as emitted by <see cref="AbCipTagPath.ToLibplctagName"/>.</param>
+/// <param name="Timeout">libplctag operation timeout (applies to Initialize / Read / Write).</param>
+public sealed record AbCipTagCreateParams(
+    string Gateway,
+    int Port,
+    string CipPath,
+    string LibplctagPlcAttribute,
+    string TagName,
+    TimeSpan Timeout);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -0,0 +1,137 @@
+using libplctag;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Default libplctag-backed <see cref="IAbCipTagRuntime"/>. Wraps a <see cref="Tag"/>
+///     instance + translates our <see cref="AbCipDataType"/> enum into the
+///     <c>GetInt32</c> / <c>GetFloat32</c> / <c>GetString</c> / <c>GetBit</c> calls libplctag
+///     exposes. One runtime instance per <c>(device, tag path)</c>; lifetime is owned by the
+///     driver's per-device state dict.
+/// </summary>
+internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
+{
+    private readonly Tag _tag;
+
+    public LibplctagTagRuntime(AbCipTagCreateParams p)
+    {
+        _tag = new Tag
+        {
+            Gateway = p.Gateway,
+            Path = p.CipPath,
+            PlcType = MapPlcType(p.LibplctagPlcAttribute),
+            Protocol = Protocol.ab_eip,
+            Name = p.TagName,
+            Timeout = p.Timeout,
+        };
+    }
+
+    public Task InitializeAsync(CancellationToken cancellationToken) => _tag.InitializeAsync(cancellationToken);
+    public Task ReadAsync(CancellationToken cancellationToken) => _tag.ReadAsync(cancellationToken);
+    public Task WriteAsync(CancellationToken cancellationToken) => _tag.WriteAsync(cancellationToken);
+
+    public int GetStatus() => (int)_tag.GetStatus();
+
+    public object? DecodeValue(AbCipDataType type, int? bitIndex) => type switch
+    {
+        AbCipDataType.Bool => bitIndex is int bit
+            ? _tag.GetBit(bit)
+            : _tag.GetInt8(0) != 0,
+        AbCipDataType.SInt => (int)(sbyte)_tag.GetInt8(0),
+        AbCipDataType.USInt => (int)_tag.GetUInt8(0),
+        AbCipDataType.Int => (int)_tag.GetInt16(0),
+        AbCipDataType.UInt => (int)_tag.GetUInt16(0),
+        AbCipDataType.DInt => _tag.GetInt32(0),
+        AbCipDataType.UDInt => (int)_tag.GetUInt32(0),
+        AbCipDataType.LInt => _tag.GetInt64(0),
+        AbCipDataType.ULInt => (long)_tag.GetUInt64(0),
+        AbCipDataType.Real => _tag.GetFloat32(0),
+        AbCipDataType.LReal => _tag.GetFloat64(0),
+        AbCipDataType.String => _tag.GetString(0),
+        AbCipDataType.Dt => _tag.GetInt32(0), // seconds-since-epoch DINT; consumer widens as needed
+        AbCipDataType.Structure => null,       // UDT whole-tag decode lands in PR 6
+        _ => null,
+    };
+
+    public void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+    {
+        switch (type)
+        {
+            case AbCipDataType.Bool:
+                if (bitIndex is int bit)
+                {
+                    // BOOL-within-DINT writes require read-modify-write on the parent DINT.
+                    // Deferred to a follow-up PR — matches the Modbus BitInRegister pattern at
+                    // ModbusDriver.cs:640.
+                    throw new NotSupportedException(
+                        "BOOL-within-DINT writes require read-modify-write; not implemented in PR 4.");
+                }
+                _tag.SetInt8(0, Convert.ToBoolean(value) ? (sbyte)1 : (sbyte)0);
+                break;
+            case AbCipDataType.SInt:
+                _tag.SetInt8(0, Convert.ToSByte(value));
+                break;
+            case AbCipDataType.USInt:
+                _tag.SetUInt8(0, Convert.ToByte(value));
+                break;
+            case AbCipDataType.Int:
+                _tag.SetInt16(0, Convert.ToInt16(value));
+                break;
+            case AbCipDataType.UInt:
+                _tag.SetUInt16(0, Convert.ToUInt16(value));
+                break;
+            case AbCipDataType.DInt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.UDInt:
+                _tag.SetUInt32(0, Convert.ToUInt32(value));
+                break;
+            case AbCipDataType.LInt:
+                _tag.SetInt64(0, Convert.ToInt64(value));
+                break;
+            case AbCipDataType.ULInt:
+                _tag.SetUInt64(0, Convert.ToUInt64(value));
+                break;
+            case AbCipDataType.Real:
+                _tag.SetFloat32(0, Convert.ToSingle(value));
+                break;
+            case AbCipDataType.LReal:
+                _tag.SetFloat64(0, Convert.ToDouble(value));
+                break;
+            case AbCipDataType.String:
+                _tag.SetString(0, Convert.ToString(value) ?? string.Empty);
+                break;
+            case AbCipDataType.Dt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.Structure:
+                throw new NotSupportedException("Whole-UDT writes land in PR 6.");
+            default:
+                throw new NotSupportedException($"AbCipDataType {type} not writable.");
+        }
+    }
+
+    public void Dispose() => _tag.Dispose();
+
+    private static PlcType MapPlcType(string attribute) => attribute switch
+    {
+        "controllogix" => PlcType.ControlLogix,
+        "compactlogix" => PlcType.ControlLogix, // libplctag treats CompactLogix under ControlLogix family
+        "micro800" => PlcType.Micro800,
+        "micrologix" => PlcType.MicroLogix,
+        "slc500" => PlcType.Slc500,
+        "plc5" => PlcType.Plc5,
+        "omron-njnx" => PlcType.Omron,
+        _ => PlcType.ControlLogix,
+    };
+}
+
+/// <summary>
+///     Default <see cref="IAbCipTagFactory"/> — creates a fresh <see cref="LibplctagTagRuntime"/>
+///     per call. Stateless; safe to share across devices.
+/// </summary>
+internal sealed class LibplctagTagFactory : IAbCipTagFactory
+{
+    public IAbCipTagRuntime Create(AbCipTagCreateParams createParams) =>
+        new LibplctagTagRuntime(createParams);
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/PlcFamilies/AbCipPlcFamilyProfile.cs

@@ -0,0 +1,62 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.PlcFamilies;
+
+/// <summary>
+///     Per-family libplctag defaults. Picked up at device-initialization time so each PLC
+///     family gets the correct ConnectionSize, path semantics, and quirks applied without
+///     the caller having to know the protocol-level differences.
+/// </summary>
+/// <remarks>
+///     Mirrors the shape of the Modbus driver's per-family profiles (DL205, Siemens S7,
+///     Mitsubishi MELSEC). ControlLogix is the baseline; each subsequent family is a delta.
+///     Family-specific wire tests ship in PRs 9–12.
+/// </remarks>
+public sealed record AbCipPlcFamilyProfile(
+    string LibplctagPlcAttribute,
+    int DefaultConnectionSize,
+    string DefaultCipPath,
+    bool SupportsRequestPacking,
+    bool SupportsConnectedMessaging,
+    int MaxFragmentBytes)
+{
+    /// <summary>Look up the profile for a configured family.</summary>
+    public static AbCipPlcFamilyProfile ForFamily(AbCipPlcFamily family) => family switch
+    {
+        AbCipPlcFamily.ControlLogix => ControlLogix,
+        AbCipPlcFamily.CompactLogix => CompactLogix,
+        AbCipPlcFamily.Micro800 => Micro800,
+        AbCipPlcFamily.GuardLogix => GuardLogix,
+        _ => ControlLogix,
+    };
+
+    public static readonly AbCipPlcFamilyProfile ControlLogix = new(
+        LibplctagPlcAttribute: "controllogix",
+        DefaultConnectionSize: 4002, // Large Forward Open; FW20+
+        DefaultCipPath: "1,0",
+        SupportsRequestPacking: true,
+        SupportsConnectedMessaging: true,
+        MaxFragmentBytes: 4000);
+
+    public static readonly AbCipPlcFamilyProfile CompactLogix = new(
+        LibplctagPlcAttribute: "compactlogix",
+        DefaultConnectionSize: 504, // 5069-L3x narrower buffer; safe baseline that never over-shoots
+        DefaultCipPath: "1,0",
+        SupportsRequestPacking: true,
+        SupportsConnectedMessaging: true,
+        MaxFragmentBytes: 500);
+
+    public static readonly AbCipPlcFamilyProfile Micro800 = new(
+        LibplctagPlcAttribute: "micro800",
+        DefaultConnectionSize: 488, // Micro800 hard cap
+        DefaultCipPath: "",         // no backplane routing
+        SupportsRequestPacking: false,
+        SupportsConnectedMessaging: false, // unconnected-only on most models
+        MaxFragmentBytes: 484);
+
+    public static readonly AbCipPlcFamilyProfile GuardLogix = new(
+        LibplctagPlcAttribute: "controllogix", // wire protocol identical; safety partition is tag-level
+        DefaultConnectionSize: 4002,
+        DefaultCipPath: "1,0",
+        SupportsRequestPacking: true,
+        SupportsConnectedMessaging: true,
+        MaxFragmentBytes: 4000);
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/PlcTagHandle.cs

@@ -0,0 +1,59 @@
+using System.Runtime.InteropServices;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     <see cref="SafeHandle"/> wrapper around a libplctag native tag handle (an <c>int32</c>
+///     returned from <c>plc_tag_create_ex</c>). Owns lifetime of the native allocation so a
+///     leaked / GC-collected <see cref="PlcTagHandle"/> still calls <c>plc_tag_destroy</c>
+///     during finalization — necessary because native libplctag allocations are opaque to
+///     the driver's <see cref="Core.Abstractions.IDriver.GetMemoryFootprint"/>.
+/// </summary>
+/// <remarks>
+///     <para>Risk documented in driver-specs.md §3 ("Operational Stability Notes"): the CLR
+///     allocation tracker doesn't see libplctag's native heap, only whole-process RSS can.
+///     Every handle leaked past its useful life is a direct contributor to the Tier-B recycle
+///     trigger, so owning lifetime via SafeHandle is non-negotiable.</para>
+///
+///     <para><see cref="IsInvalid"/> is <c>true</c> when the native ID is &lt;= 0 — libplctag
+///     returns negative <c>PLCTAG_ERR_*</c> codes on <c>plc_tag_create_ex</c> failure, which
+///     we surface as an invalid handle rather than a disposable one (destroying a negative
+///     handle would be undefined behavior in the native library).</para>
+///
+///     <para>The actual <c>DllImport</c> for <c>plc_tag_destroy</c> is deferred to PR 3 when
+///     the driver first makes wire calls — PR 2 ships the lifetime scaffold + tests only.
+///     Until the P/Invoke lands, <see cref="ReleaseHandle"/> is a no-op; the finalizer still
+///     runs so the integration is correct as soon as the import is added.</para>
+/// </remarks>
+public sealed class PlcTagHandle : SafeHandle
+{
+    /// <summary>Construct an invalid handle placeholder (use <see cref="FromNative"/> once created).</summary>
+    public PlcTagHandle() : base(invalidHandleValue: IntPtr.Zero, ownsHandle: true) { }
+
+    private PlcTagHandle(int nativeId) : base(invalidHandleValue: IntPtr.Zero, ownsHandle: true)
+    {
+        SetHandle(new IntPtr(nativeId));
+    }
+
+    /// <summary>Handle is invalid when the native ID is zero or negative (libplctag error).</summary>
+    public override bool IsInvalid => handle.ToInt32() <= 0;
+
+    /// <summary>Integer ID libplctag issued on <c>plc_tag_create_ex</c>.</summary>
+    public int NativeId => handle.ToInt32();
+
+    /// <summary>Wrap a native tag ID returned from libplctag.</summary>
+    public static PlcTagHandle FromNative(int nativeId) => new(nativeId);
+
+    /// <summary>
+    ///     Destroy the native tag. No-op for PR 2 (the wire P/Invoke lands in PR 3). The base
+    ///     <see cref="SafeHandle"/> machinery still guarantees this runs exactly once per
+    ///     handle — either during <see cref="SafeHandle.Dispose()"/> or during finalization
+    ///     if the owner was GC'd without explicit Dispose.
+    /// </summary>
+    protected override bool ReleaseHandle()
+    {
+        if (IsInvalid) return true;
+        // PR 3: wire up plc_tag_destroy(handle.ToInt32()) once the DllImport lands.
+        return true;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj

@@ -0,0 +1,30 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbCip</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.AbCip</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <!-- libplctag managed wrapper (pulls in libplctag.NativeImport transitively).
+             Decision #11 — EtherNet/IP + CIP + Logix symbolic against ControlLogix / CompactLogix /
+             Micro800 / SLC500 / PLC-5. -->
+        <PackageReference Include="libplctag" Version="1.5.2"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbCipReadSmokeTests.cs

@@ -0,0 +1,44 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
+
+/// <summary>
+///     End-to-end smoke tests that exercise the real libplctag stack against a running
+///     <c>ab_server</c>. Skipped when the binary isn't on PATH (<see cref="AbServerFactAttribute"/>).
+/// </summary>
+/// <remarks>
+///     Intentionally minimal — per-family + per-capability coverage ships in PRs 9–12 once the
+///     integration harness is CI-ready. This file exists at PR 3 time to prove the wire path
+///     works end-to-end on developer boxes that have <c>ab_server</c>.
+/// </remarks>
+[Trait("Category", "Integration")]
+[Trait("Requires", "AbServer")]
+public sealed class AbCipReadSmokeTests : IAsyncLifetime
+{
+    private readonly AbServerFixture _fixture = new();
+
+    public async ValueTask InitializeAsync() => await _fixture.InitializeAsync();
+    public async ValueTask DisposeAsync() => await _fixture.DisposeAsync();
+
+    [AbServerFact]
+    public async Task Driver_reads_DInt_from_ab_server()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions($"ab://127.0.0.1:{_fixture.Port}/1,0", AbCipPlcFamily.ControlLogix)],
+            Tags = [new AbCipTagDefinition("Counter", $"ab://127.0.0.1:{_fixture.Port}/1,0", "TestDINT", AbCipDataType.DInt)],
+            Timeout = TimeSpan.FromSeconds(5),
+        }, "drv-smoke");
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        var snapshots = await drv.ReadAsync(["Counter"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        drv.GetHealth().State.ShouldBe(DriverState.Healthy);
+
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerFixture.cs

@@ -0,0 +1,109 @@
+using System.Diagnostics;
+using Xunit;
+using Xunit.Sdk;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
+
+/// <summary>
+///     Shared fixture that starts libplctag's <c>ab_server</c> simulator in the background for
+///     the duration of an integration test collection. Binary is expected on PATH; the per-test
+///     JSON profile is passed via <c>--config</c>.
+/// </summary>
+/// <remarks>
+///     <para><c>ab_server</c> is a C binary shipped in the same repo as libplctag (see
+///     <c>test-data-sources.md</c> §2 and plan decision #99). On a developer workstation it's
+///     built once from source and placed on PATH; in CI we intend to publish a prebuilt Windows
+///     x64 binary as a GitHub release asset in a follow-up PR so the fixture can download +
+///     extract it at setup time. Until then every test in this project is skipped when
+///     <c>ab_server</c> is not locatable.</para>
+///
+///     <para>Per-family JSON profiles (ControlLogix / CompactLogix / Micro800 / GuardLogix)
+///     ship under <c>Profiles/</c> and drive the simulator's tag shape — this is where the
+///     UDT + Program-scope coverage gap will be filled by the hand-rolled stub in PR 6.</para>
+/// </remarks>
+public sealed class AbServerFixture : IAsyncLifetime
+{
+    private Process? _proc;
+    public int Port { get; } = 44818;
+
+    public bool IsAvailable { get; private set; }
+
+    public ValueTask InitializeAsync() => InitializeAsync(default);
+    public ValueTask DisposeAsync() => DisposeAsync(default);
+
+    public async ValueTask InitializeAsync(CancellationToken cancellationToken)
+    {
+        if (LocateBinary() is not string binary)
+        {
+            IsAvailable = false;
+            return;
+        }
+        IsAvailable = true;
+
+        _proc = new Process
+        {
+            StartInfo = new ProcessStartInfo
+            {
+                FileName = binary,
+                Arguments = $"--port {Port} --plc controllogix",
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+                CreateNoWindow = true,
+            },
+        };
+        _proc.Start();
+
+        // Give the server a moment to accept its listen socket before tests try to connect.
+        await Task.Delay(500, cancellationToken).ConfigureAwait(false);
+    }
+
+    public ValueTask DisposeAsync(CancellationToken cancellationToken)
+    {
+        try
+        {
+            if (_proc is { HasExited: false })
+            {
+                _proc.Kill(entireProcessTree: true);
+                _proc.WaitForExit(5_000);
+            }
+        }
+        catch { /* best-effort cleanup */ }
+        _proc?.Dispose();
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    ///     Locate <c>ab_server</c> on PATH. Returns <c>null</c> when missing — tests that
+    ///     depend on it should use <see cref="AbServerFact"/> so CI runs without the binary
+    ///     simply skip rather than fail.
+    /// </summary>
+    public static string? LocateBinary()
+    {
+        var names = new[] { "ab_server.exe", "ab_server" };
+        var path = Environment.GetEnvironmentVariable("PATH") ?? "";
+        foreach (var dir in path.Split(Path.PathSeparator))
+        {
+            foreach (var name in names)
+            {
+                var candidate = Path.Combine(dir, name);
+                if (File.Exists(candidate)) return candidate;
+            }
+        }
+        return null;
+    }
+}
+
+/// <summary>
+///     <c>[Fact]</c>-equivalent that skips when <c>ab_server</c> is not available on PATH.
+///     Integration tests use this instead of <c>[Fact]</c> so a developer box without
+///     <c>ab_server</c> installed still gets a green run.
+/// </summary>
+public sealed class AbServerFactAttribute : FactAttribute
+{
+    public AbServerFactAttribute()
+    {
+        if (AbServerFixture.LocateBinary() is null)
+            Skip = "ab_server not on PATH; install libplctag test binaries to run.";
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.AbCip\ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverDiscoveryTests.cs

@@ -0,0 +1,278 @@
+using System.Runtime.CompilerServices;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverDiscoveryTests
+{
+    [Fact]
+    public async Task PreDeclared_tags_emit_as_variables_under_device_folder()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0", DeviceName: "Line1-PLC")],
+            Tags =
+            [
+                new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt),
+                new AbCipTagDefinition("Temperature", "ab://10.0.0.5/1,0", "T", AbCipDataType.Real, Writable: false),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "AbCip");
+        builder.Folders.ShouldContain(f => f.BrowseName == "ab://10.0.0.5/1,0" && f.DisplayName == "Line1-PLC");
+        builder.Variables.Count.ShouldBe(2);
+        builder.Variables.Single(v => v.BrowseName == "Speed").Info.SecurityClass.ShouldBe(SecurityClassification.Operate);
+        builder.Variables.Single(v => v.BrowseName == "Temperature").Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    [Fact]
+    public async Task Device_folder_displayname_falls_back_to_host_address()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")], // no DeviceName
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "ab://10.0.0.5/1,0"
+            && f.DisplayName == "ab://10.0.0.5/1,0");
+    }
+
+    [Fact]
+    public async Task PreDeclared_system_tags_are_filtered_out()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("__DEFVAL_X", "ab://10.0.0.5/1,0", "__DEFVAL_X", AbCipDataType.DInt),
+                new AbCipTagDefinition("Routine:SomeRoutine", "ab://10.0.0.5/1,0", "R", AbCipDataType.DInt),
+                new AbCipTagDefinition("UserTag", "ab://10.0.0.5/1,0", "U", AbCipDataType.DInt),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.BrowseName).ShouldBe(["UserTag"]);
+    }
+
+    [Fact]
+    public async Task Tags_for_mismatched_device_are_ignored()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Orphan", "ab://10.0.0.99/1,0", "O", AbCipDataType.DInt)],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_adds_tags_under_Discovered_folder()
+    {
+        var builder = new RecordingBuilder();
+        var enumeratorFactory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("Pressure", null, AbCipDataType.Real, ReadOnly: false),
+            new AbCipDiscoveredTag("StepIndex", ProgramScope: "MainProgram", AbCipDataType.DInt, ReadOnly: false));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: enumeratorFactory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "Discovered");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("Pressure");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("Program:MainProgram.StepIndex");
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_honours_system_tag_hint_and_filter()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("HiddenByHint", null, AbCipDataType.DInt, ReadOnly: false, IsSystemTag: true),
+            new AbCipDiscoveredTag("Routine:Foo", null, AbCipDataType.DInt, ReadOnly: false, IsSystemTag: false),
+            new AbCipDiscoveredTag("KeepMe", null, AbCipDataType.DInt, ReadOnly: false));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.Info.FullName).ShouldBe(["KeepMe"]);
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_ReadOnly_surfaces_ViewOnly_classification()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("SafetyTag", null, AbCipDataType.DInt, ReadOnly: true));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Single().Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_receives_correct_device_params()
+    {
+        var factory = new FakeEnumeratorFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5:44818/1,2,3", AbCipPlcFamily.ControlLogix)],
+            Timeout = TimeSpan.FromSeconds(7),
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(new RecordingBuilder(), CancellationToken.None);
+
+        var capturedParams = factory.LastDeviceParams.ShouldNotBeNull();
+        capturedParams.Gateway.ShouldBe("10.0.0.5");
+        capturedParams.Port.ShouldBe(44818);
+        capturedParams.CipPath.ShouldBe("1,2,3");
+        capturedParams.LibplctagPlcAttribute.ShouldBe("controllogix");
+        capturedParams.TagName.ShouldBe("@tags");
+        capturedParams.Timeout.ShouldBe(TimeSpan.FromSeconds(7));
+    }
+
+    [Fact]
+    public void Default_enumerator_factory_is_used_when_not_injected()
+    {
+        // Sanity — absent enumerator factory does not crash discovery + uses EmptyAbCipTagEnumerator
+        // (covered by the other tests which instantiate without injecting a factory).
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1");
+        drv.ShouldNotBeNull();
+    }
+
+    [Theory]
+    [InlineData("__DEFVAL_X", true)]
+    [InlineData("__DEFAULT_Y", true)]
+    [InlineData("Routine:Main", true)]
+    [InlineData("Task:MainTask", true)]
+    [InlineData("Local:1:I", true)]
+    [InlineData("Map:Alias", true)]
+    [InlineData("Axis:MoveX", true)]
+    [InlineData("Cam:Profile1", true)]
+    [InlineData("MotionGroup:MG0", true)]
+    [InlineData("Motor1", false)]
+    [InlineData("Program:Main.Step", false)]
+    [InlineData("Recipe_2", false)]
+    [InlineData("", true)]
+    [InlineData("   ", true)]
+    public void SystemTagFilter_rejects_infrastructure_names(string name, bool expected)
+    {
+        AbCipSystemTagFilter.IsSystemTag(name).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void TemplateCache_roundtrip_put_get()
+    {
+        var cache = new AbCipTemplateCache();
+        var shape = new AbCipUdtShape("MyUdt", 32,
+        [
+            new AbCipUdtMember("A", 0, AbCipDataType.DInt, ArrayLength: 1),
+            new AbCipUdtMember("B", 4, AbCipDataType.Real, ArrayLength: 1),
+        ]);
+        cache.Put("ab://10.0.0.5/1,0", 42, shape);
+
+        cache.TryGet("ab://10.0.0.5/1,0", 42).ShouldBe(shape);
+        cache.TryGet("ab://10.0.0.5/1,0", 99).ShouldBeNull();
+        cache.Count.ShouldBe(1);
+
+        cache.Clear();
+        cache.Count.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task FlushOptionalCachesAsync_clears_template_cache()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions(), "drv-1");
+        drv.TemplateCache.Put("dev", 1, new AbCipUdtShape("T", 4, []));
+        drv.TemplateCache.Count.ShouldBe(1);
+
+        await drv.FlushOptionalCachesAsync(CancellationToken.None);
+        drv.TemplateCache.Count.ShouldBe(0);
+    }
+
+    // ---- helpers ----
+
+    private sealed class RecordingBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, string DisplayName)> Folders { get; } = new();
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = new();
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName)
+        { Folders.Add((browseName, displayName)); return this; }
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        { Variables.Add((browseName, info)); return new Handle(info.FullName); }
+
+        public void AddProperty(string _, DriverDataType __, object? ___) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+        private sealed class NullSink : IAlarmConditionSink
+        {
+            public void OnTransition(AlarmEventArgs args) { }
+        }
+    }
+
+    private sealed class FakeEnumeratorFactory : IAbCipTagEnumeratorFactory
+    {
+        private readonly AbCipDiscoveredTag[] _tags;
+        public AbCipTagCreateParams? LastDeviceParams { get; private set; }
+        public FakeEnumeratorFactory(params AbCipDiscoveredTag[] tags) => _tags = tags;
+        public IAbCipTagEnumerator Create() => new FakeEnumerator(this);
+
+        private sealed class FakeEnumerator(FakeEnumeratorFactory outer) : IAbCipTagEnumerator
+        {
+            public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+                AbCipTagCreateParams deviceParams,
+                [EnumeratorCancellation] CancellationToken cancellationToken)
+            {
+                outer.LastDeviceParams = deviceParams;
+                await Task.CompletedTask;
+                foreach (var t in outer._tags) yield return t;
+            }
+            public void Dispose() { }
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverReadTests.cs

@@ -0,0 +1,214 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverReadTests
+{
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    [Fact]
+    public async Task Unknown_reference_maps_to_BadNodeIdUnknown()
+    {
+        var (drv, _) = NewDriver();
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["does-not-exist"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        snapshots.Single().Value.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task Tag_on_unknown_device_maps_to_BadNodeIdUnknown()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Orphan", "ab://10.0.0.99/1,0", "Tag1", AbCipDataType.DInt)],
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["Orphan"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Successful_DInt_read_returns_Good_with_value()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        // Customise the fake before the first read so the tag returns 4200.
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 4200 };
+
+        var snapshots = await drv.ReadAsync(["Speed"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        snapshots.Single().Value.ShouldBe(4200);
+        factory.Tags["Motor1.Speed"].InitializeCount.ShouldBe(1);
+        factory.Tags["Motor1.Speed"].ReadCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Repeat_read_reuses_runtime_without_reinitialise()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+
+        await drv.ReadAsync(["Speed"], CancellationToken.None);
+        await drv.ReadAsync(["Speed"], CancellationToken.None);
+        await drv.ReadAsync(["Speed"], CancellationToken.None);
+
+        factory.Tags["Motor1.Speed"].InitializeCount.ShouldBe(1); // lazy init happens once
+        factory.Tags["Motor1.Speed"].ReadCount.ShouldBe(3);
+    }
+
+    [Fact]
+    public async Task NonZero_libplctag_status_maps_via_AbCipStatusMapper()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Ghost", "ab://10.0.0.5/1,0", "Missing.Tag", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Status = -14 /* PLCTAG_ERR_NOT_FOUND */ };
+
+        var snapshots = await drv.ReadAsync(["Ghost"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        snapshots.Single().Value.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task Exception_during_read_surfaces_BadCommunicationError()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.Real));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { ThrowOnRead = true };
+
+        var snapshots = await drv.ReadAsync(["Broken"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
+        snapshots.Single().Value.ShouldBeNull();
+        drv.GetHealth().State.ShouldBe(DriverState.Degraded);
+    }
+
+    [Fact]
+    public async Task Batched_reads_preserve_order_and_per_tag_status()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+            new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.Real),
+            new AbCipTagDefinition("C", "ab://10.0.0.5/1,0", "C", AbCipDataType.String));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => p.TagName switch
+        {
+            "A" => new FakeAbCipTag(p) { Value = 42 },
+            "B" => new FakeAbCipTag(p) { Value = 3.14f },
+            _ => new FakeAbCipTag(p) { Value = "hello" },
+        };
+
+        var snapshots = await drv.ReadAsync(["A", "B", "C"], CancellationToken.None);
+
+        snapshots.Count.ShouldBe(3);
+        snapshots[0].Value.ShouldBe(42);
+        snapshots[1].Value.ShouldBe(3.14f);
+        snapshots[2].Value.ShouldBe("hello");
+        snapshots.ShouldAllBe(s => s.StatusCode == AbCipStatusMapper.Good);
+    }
+
+    [Fact]
+    public async Task Successful_read_marks_health_Healthy()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Pressure", "ab://10.0.0.5/1,0", "PT_101", AbCipDataType.Real));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 14.7f };
+
+        await drv.ReadAsync(["Pressure"], CancellationToken.None);
+        drv.GetHealth().State.ShouldBe(DriverState.Healthy);
+        drv.GetHealth().LastSuccessfulRead.ShouldNotBeNull();
+    }
+
+    [Fact]
+    public async Task TagCreateParams_are_built_from_device_and_profile()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Counter", "ab://10.0.0.5/1,0", "Program:P.Counter", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.ReadAsync(["Counter"], CancellationToken.None);
+
+        var p = factory.Tags["Program:P.Counter"].CreationParams;
+        p.Gateway.ShouldBe("10.0.0.5");
+        p.Port.ShouldBe(44818);
+        p.CipPath.ShouldBe("1,0");
+        p.LibplctagPlcAttribute.ShouldBe("controllogix");
+        p.TagName.ShouldBe("Program:P.Counter");
+    }
+
+    [Fact]
+    public async Task Cancellation_propagates_from_read()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Slow", "ab://10.0.0.5/1,0", "Slow", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p)
+        {
+            ThrowOnRead = true,
+            Exception = new OperationCanceledException(),
+        };
+
+        using var cts = new CancellationTokenSource();
+        await Should.ThrowAsync<OperationCanceledException>(
+            () => drv.ReadAsync(["Slow"], cts.Token));
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_disposes_each_tag_runtime()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+            new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+        await drv.ReadAsync(["A", "B"], CancellationToken.None);
+
+        await drv.ShutdownAsync(CancellationToken.None);
+
+        factory.Tags["A"].Disposed.ShouldBeTrue();
+        factory.Tags["B"].Disposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Initialize_failure_disposes_tag_and_surfaces_communication_error()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("DoomedTag", "ab://10.0.0.5/1,0", "Nope", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { ThrowOnInitialize = true };
+
+        var snapshots = await drv.ReadAsync(["DoomedTag"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
+        factory.Tags["Nope"].Disposed.ShouldBeTrue();
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverTests.cs

@@ -0,0 +1,131 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverTests
+{
+    [Fact]
+    public void DriverType_is_AbCip()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions(), "drv-1");
+        drv.DriverType.ShouldBe("AbCip");
+        drv.DriverInstanceId.ShouldBe("drv-1");
+    }
+
+    [Fact]
+    public async Task InitializeAsync_with_empty_devices_succeeds_and_marks_healthy()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions(), "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        drv.GetHealth().State.ShouldBe(DriverState.Healthy);
+    }
+
+    [Fact]
+    public async Task InitializeAsync_registers_each_device_with_its_family_profile()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices =
+            [
+                new AbCipDeviceOptions("ab://10.0.0.5/1,0", AbCipPlcFamily.ControlLogix),
+                new AbCipDeviceOptions("ab://10.0.0.6/", AbCipPlcFamily.Micro800),
+            ],
+        }, "drv-1");
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        drv.DeviceCount.ShouldBe(2);
+        drv.GetDeviceState("ab://10.0.0.5/1,0")!.Profile.ShouldBe(AbCipPlcFamilyProfile.ControlLogix);
+        drv.GetDeviceState("ab://10.0.0.6/")!.Profile.ShouldBe(AbCipPlcFamilyProfile.Micro800);
+    }
+
+    [Fact]
+    public async Task InitializeAsync_with_malformed_host_address_faults()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("not-a-valid-address")],
+        }, "drv-1");
+
+        await Should.ThrowAsync<InvalidOperationException>(
+            () => drv.InitializeAsync("{}", CancellationToken.None));
+        drv.GetHealth().State.ShouldBe(DriverState.Faulted);
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_clears_devices_and_marks_unknown()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1");
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        drv.DeviceCount.ShouldBe(1);
+
+        await drv.ShutdownAsync(CancellationToken.None);
+        drv.DeviceCount.ShouldBe(0);
+        drv.GetHealth().State.ShouldBe(DriverState.Unknown);
+    }
+
+    [Fact]
+    public async Task ReinitializeAsync_cycles_devices()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1");
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        await drv.ReinitializeAsync("{}", CancellationToken.None);
+
+        drv.DeviceCount.ShouldBe(1);
+        drv.GetHealth().State.ShouldBe(DriverState.Healthy);
+    }
+
+    [Fact]
+    public void Family_profiles_expose_expected_defaults()
+    {
+        AbCipPlcFamilyProfile.ControlLogix.LibplctagPlcAttribute.ShouldBe("controllogix");
+        AbCipPlcFamilyProfile.ControlLogix.DefaultConnectionSize.ShouldBe(4002);
+        AbCipPlcFamilyProfile.ControlLogix.DefaultCipPath.ShouldBe("1,0");
+
+        AbCipPlcFamilyProfile.Micro800.DefaultCipPath.ShouldBe(""); // no backplane routing
+        AbCipPlcFamilyProfile.Micro800.SupportsRequestPacking.ShouldBeFalse();
+        AbCipPlcFamilyProfile.Micro800.SupportsConnectedMessaging.ShouldBeFalse();
+
+        AbCipPlcFamilyProfile.CompactLogix.DefaultConnectionSize.ShouldBe(504);
+        AbCipPlcFamilyProfile.GuardLogix.LibplctagPlcAttribute.ShouldBe("controllogix");
+    }
+
+    [Fact]
+    public void PlcTagHandle_IsInvalid_for_zero_or_negative_native_id()
+    {
+        PlcTagHandle.FromNative(-5).IsInvalid.ShouldBeTrue();
+        PlcTagHandle.FromNative(0).IsInvalid.ShouldBeTrue();
+        PlcTagHandle.FromNative(42).IsInvalid.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void PlcTagHandle_Dispose_is_idempotent()
+    {
+        var h = PlcTagHandle.FromNative(42);
+        h.Dispose();
+        h.Dispose(); // must not throw
+    }
+
+    [Fact]
+    public void AbCipDataType_maps_atomics_to_driver_types()
+    {
+        AbCipDataType.Bool.ToDriverDataType().ShouldBe(DriverDataType.Boolean);
+        AbCipDataType.DInt.ToDriverDataType().ShouldBe(DriverDataType.Int32);
+        AbCipDataType.Real.ToDriverDataType().ShouldBe(DriverDataType.Float32);
+        AbCipDataType.LReal.ToDriverDataType().ShouldBe(DriverDataType.Float64);
+        AbCipDataType.String.ToDriverDataType().ShouldBe(DriverDataType.String);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverWriteTests.cs

@@ -0,0 +1,230 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverWriteTests
+{
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+        }, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    [Fact]
+    public async Task Unknown_reference_maps_to_BadNodeIdUnknown()
+    {
+        var (drv, _) = NewDriver();
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("does-not-exist", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Non_writable_tag_maps_to_BadNotWritable()
+    {
+        var (drv, _) = NewDriver(
+            new AbCipTagDefinition("ReadOnly", "ab://10.0.0.5/1,0", "RO", AbCipDataType.DInt, Writable: false));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("ReadOnly", 7)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+    }
+
+    [Fact]
+    public async Task Successful_DInt_write_encodes_and_flushes()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Speed", 4200)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        factory.Tags["Motor1.Speed"].Value.ShouldBe(4200);
+        factory.Tags["Motor1.Speed"].WriteCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Bit_in_dint_write_returns_BadNotSupported()
+    {
+        var factory = new FakeAbCipTagFactory { Customise = p => new ThrowingBoolBitFake(p) };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Flag3", "ab://10.0.0.5/1,0", "Flags.3", AbCipDataType.Bool)],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Flag3", true)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotSupported);
+    }
+
+    [Fact]
+    public async Task Non_zero_libplctag_status_after_write_maps_via_AbCipStatusMapper()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Status = -5 /* timeout */ };
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Broken", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadTimeout);
+    }
+
+    [Fact]
+    public async Task Type_mismatch_surfaces_BadTypeMismatch()
+    {
+        var (drv, _) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        // Force a FormatException inside Convert.ToInt32 via a runtime that forwards to real Convert.
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new RealConvertFake(p),
+        };
+        var drv2 = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt)],
+        }, "drv-2", factory);
+        await drv2.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv2.WriteAsync(
+            [new WriteRequest("Speed", "not-a-number")], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadTypeMismatch);
+    }
+
+    [Fact]
+    public async Task Overflow_surfaces_BadOutOfRange()
+    {
+        var factory = new FakeAbCipTagFactory { Customise = p => new RealConvertFake(p) };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Narrow", "ab://10.0.0.5/1,0", "N", AbCipDataType.Int)],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Narrow", 1_000_000)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadOutOfRange);
+    }
+
+    [Fact]
+    public async Task Exception_during_write_surfaces_BadCommunicationError()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new ThrowOnWriteFake(p);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Broken", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
+        drv.GetHealth().State.ShouldBe(DriverState.Degraded);
+    }
+
+    [Fact]
+    public async Task Batch_preserves_order_across_success_and_failure()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.DInt, Writable: false),
+                new AbCipTagDefinition("C", "ab://10.0.0.5/1,0", "C", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("A", 1),
+            new WriteRequest("B", 2),
+            new WriteRequest("UnknownTag", 3),
+            new WriteRequest("C", 4),
+        ], CancellationToken.None);
+
+        results.Count.ShouldBe(4);
+        results[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+        results[2].StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        results[3].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+    }
+
+    [Fact]
+    public async Task Cancellation_propagates_from_write()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Slow", "ab://10.0.0.5/1,0", "Slow", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new CancelOnWriteFake(p);
+
+        await Should.ThrowAsync<OperationCanceledException>(
+            () => drv.WriteAsync([new WriteRequest("Slow", 1)], CancellationToken.None));
+    }
+
+    // ---- test-fake variants that exercise the real type / error handling ----
+
+    private sealed class RealConvertFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+        {
+            switch (type)
+            {
+                case AbCipDataType.Int: _ = Convert.ToInt16(value); break;
+                case AbCipDataType.DInt: _ = Convert.ToInt32(value); break;
+                default: _ = Convert.ToInt32(value); break;
+            }
+            Value = value;
+        }
+    }
+
+    private sealed class ThrowingBoolBitFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+        {
+            if (type == AbCipDataType.Bool && bitIndex is not null)
+                throw new NotSupportedException("bit-in-DINT deferred");
+            Value = value;
+        }
+    }
+
+    private sealed class ThrowOnWriteFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override Task WriteAsync(CancellationToken ct) =>
+            Task.FromException(new InvalidOperationException("wire dropped"));
+    }
+
+    private sealed class CancelOnWriteFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override Task WriteAsync(CancellationToken ct) =>
+            Task.FromException(new OperationCanceledException());
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipHostAddressTests.cs

@@ -0,0 +1,65 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipHostAddressTests
+{
+    [Theory]
+    [InlineData("ab://10.0.0.5/1,0", "10.0.0.5", 44818, "1,0")]
+    [InlineData("ab://10.0.0.5/1,4", "10.0.0.5", 44818, "1,4")]
+    [InlineData("ab://10.0.0.5/1,2,2,192.168.50.20,1,0", "10.0.0.5", 44818, "1,2,2,192.168.50.20,1,0")]
+    [InlineData("ab://10.0.0.5/", "10.0.0.5", 44818, "")]
+    [InlineData("ab://plc-01.factory.internal/1,0", "plc-01.factory.internal", 44818, "1,0")]
+    [InlineData("ab://10.0.0.5:44818/1,0", "10.0.0.5", 44818, "1,0")]
+    [InlineData("ab://10.0.0.5:2222/1,0", "10.0.0.5", 2222, "1,0")]
+    [InlineData("AB://10.0.0.5/1,0", "10.0.0.5", 44818, "1,0")] // case-insensitive scheme
+    public void TryParse_accepts_valid_forms(string input, string gateway, int port, string cipPath)
+    {
+        var parsed = AbCipHostAddress.TryParse(input);
+        parsed.ShouldNotBeNull();
+        parsed.Gateway.ShouldBe(gateway);
+        parsed.Port.ShouldBe(port);
+        parsed.CipPath.ShouldBe(cipPath);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("http://10.0.0.5/1,0")]         // wrong scheme
+    [InlineData("ab:10.0.0.5/1,0")]             // missing //
+    [InlineData("ab://10.0.0.5")]               // no path slash
+    [InlineData("ab:///1,0")]                   // no gateway
+    [InlineData("ab://10.0.0.5:0/1,0")]         // invalid port
+    [InlineData("ab://10.0.0.5:65536/1,0")]     // port out of range
+    [InlineData("ab://10.0.0.5:abc/1,0")]       // non-numeric port
+    public void TryParse_rejects_invalid_forms(string? input)
+    {
+        AbCipHostAddress.TryParse(input).ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData("10.0.0.5", 44818, "1,0", "ab://10.0.0.5/1,0")]
+    [InlineData("10.0.0.5", 2222, "1,0", "ab://10.0.0.5:2222/1,0")]
+    [InlineData("10.0.0.5", 44818, "", "ab://10.0.0.5/")]
+    public void ToString_canonicalises(string gateway, int port, string path, string expected)
+    {
+        var addr = new AbCipHostAddress(gateway, port, path);
+        addr.ToString().ShouldBe(expected);
+    }
+
+    [Fact]
+    public void RoundTrip_is_stable()
+    {
+        const string input = "ab://plc-01:44818/1,2,2,10.0.0.10,1,0";
+        var parsed = AbCipHostAddress.TryParse(input)!;
+        // Default port is stripped in canonical form; explicit 44818 → becomes default form.
+        parsed.ToString().ShouldBe("ab://plc-01/1,2,2,10.0.0.10,1,0");
+
+        var parsedAgain = AbCipHostAddress.TryParse(parsed.ToString())!;
+        parsedAgain.ShouldBe(parsed);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipStatusMapperTests.cs

@@ -0,0 +1,41 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipStatusMapperTests
+{
+    [Theory]
+    [InlineData((byte)0x00, AbCipStatusMapper.Good)]
+    [InlineData((byte)0x04, AbCipStatusMapper.BadNodeIdUnknown)]
+    [InlineData((byte)0x05, AbCipStatusMapper.BadNodeIdUnknown)]
+    [InlineData((byte)0x06, AbCipStatusMapper.GoodMoreData)]
+    [InlineData((byte)0x08, AbCipStatusMapper.BadNotSupported)]
+    [InlineData((byte)0x0A, AbCipStatusMapper.BadOutOfRange)]
+    [InlineData((byte)0x13, AbCipStatusMapper.BadOutOfRange)]
+    [InlineData((byte)0x0B, AbCipStatusMapper.Good)]
+    [InlineData((byte)0x0E, AbCipStatusMapper.BadNotWritable)]
+    [InlineData((byte)0x10, AbCipStatusMapper.BadDeviceFailure)]
+    [InlineData((byte)0x16, AbCipStatusMapper.BadNodeIdUnknown)]
+    [InlineData((byte)0xFF, AbCipStatusMapper.BadInternalError)]
+    public void MapCipGeneralStatus_maps_known_codes(byte status, uint expected)
+    {
+        AbCipStatusMapper.MapCipGeneralStatus(status).ShouldBe(expected);
+    }
+
+    [Theory]
+    [InlineData(0, AbCipStatusMapper.Good)]
+    [InlineData(1, AbCipStatusMapper.GoodMoreData)] // PLCTAG_STATUS_PENDING
+    [InlineData(-5, AbCipStatusMapper.BadTimeout)]
+    [InlineData(-7, AbCipStatusMapper.BadCommunicationError)]
+    [InlineData(-14, AbCipStatusMapper.BadNodeIdUnknown)]
+    [InlineData(-16, AbCipStatusMapper.BadNotWritable)]
+    [InlineData(-17, AbCipStatusMapper.BadOutOfRange)]
+    [InlineData(-99, AbCipStatusMapper.BadCommunicationError)] // unknown negative → generic comms failure
+    public void MapLibplctagStatus_maps_known_codes(int status, uint expected)
+    {
+        AbCipStatusMapper.MapLibplctagStatus(status).ShouldBe(expected);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipSubscriptionTests.cs

@@ -0,0 +1,184 @@
+using System.Collections.Concurrent;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipSubscriptionTests
+{
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+        }, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    [Fact]
+    public async Task Initial_poll_raises_OnDataChange_for_every_tag()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt),
+            new AbCipTagDefinition("Temp", "ab://10.0.0.5/1,0", "Temp", AbCipDataType.Real));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => p.TagName switch
+        {
+            "Speed" => new FakeAbCipTag(p) { Value = 1800 },
+            "Temp" => new FakeAbCipTag(p) { Value = 72.5f },
+            _ => new FakeAbCipTag(p),
+        };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed", "Temp"], TimeSpan.FromMilliseconds(200), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 2, TimeSpan.FromSeconds(2));
+
+        events.Select(e => e.FullReference).ShouldContain("Speed");
+        events.Select(e => e.FullReference).ShouldContain("Temp");
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task Unchanged_value_raises_only_once()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1800 };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await Task.Delay(500);
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+
+        events.Count.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Value_change_between_polls_raises_OnDataChange()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        var tagRef = new FakeAbCipTag(new AbCipTagCreateParams("10.0.0.5", 44818, "1,0", "controllogix", "Speed", TimeSpan.FromSeconds(2))) { Value = 100 };
+        factory.Customise = _ => tagRef;
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(1));
+        tagRef.Value = 200; // simulate PLC change
+        await WaitForAsync(() => events.Count >= 2, TimeSpan.FromSeconds(2));
+
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+        events.Count.ShouldBeGreaterThanOrEqualTo(2);
+        events.Last().Snapshot.Value.ShouldBe(200);
+    }
+
+    [Fact]
+    public async Task Unsubscribe_halts_polling()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        var tagRef = new FakeAbCipTag(new AbCipTagCreateParams("10.0.0.5", 44818, "1,0", "controllogix", "Speed", TimeSpan.FromSeconds(2))) { Value = 1 };
+        factory.Customise = _ => tagRef;
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(1));
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+
+        var afterUnsub = events.Count;
+        tagRef.Value = 999;
+        await Task.Delay(400);
+        events.Count.ShouldBe(afterUnsub);
+    }
+
+    [Fact]
+    public async Task Interval_below_100ms_is_floored()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(5), CancellationToken.None);
+        await Task.Delay(300);
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+
+        // Value is stable → only the initial-data push fires; the 100 ms floor keeps polls sparse enough
+        // that no extra event is produced against a stable value.
+        events.Count.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_cancels_active_subscriptions()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        _ = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(1));
+        await drv.ShutdownAsync(CancellationToken.None);
+
+        var afterShutdown = events.Count;
+        await Task.Delay(300);
+        events.Count.ShouldBe(afterShutdown);
+    }
+
+    [Fact]
+    public async Task Subscription_on_UDT_member_uses_synthesised_full_reference()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members: [new AbCipStructureMember("Speed", AbCipDataType.DInt)]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => p.TagName == "Motor1.Speed"
+            ? new FakeAbCipTag(p) { Value = 77 }
+            : new FakeAbCipTag(p);
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Motor1.Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(2));
+
+        events.First().Snapshot.Value.ShouldBe(77);
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+    }
+
+    private static async Task WaitForAsync(Func<bool> condition, TimeSpan timeout)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (!condition() && DateTime.UtcNow < deadline)
+            await Task.Delay(20);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipTagPathTests.cs

@@ -0,0 +1,146 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipTagPathTests
+{
+    [Fact]
+    public void Controller_scope_single_segment()
+    {
+        var p = AbCipTagPath.TryParse("Motor1_Speed");
+        p.ShouldNotBeNull();
+        p.ProgramScope.ShouldBeNull();
+        p.Segments.Count.ShouldBe(1);
+        p.Segments[0].Name.ShouldBe("Motor1_Speed");
+        p.Segments[0].Subscripts.ShouldBeEmpty();
+        p.BitIndex.ShouldBeNull();
+        p.ToLibplctagName().ShouldBe("Motor1_Speed");
+    }
+
+    [Fact]
+    public void Program_scope_parses()
+    {
+        var p = AbCipTagPath.TryParse("Program:MainProgram.StepIndex");
+        p.ShouldNotBeNull();
+        p.ProgramScope.ShouldBe("MainProgram");
+        p.Segments.Single().Name.ShouldBe("StepIndex");
+        p.ToLibplctagName().ShouldBe("Program:MainProgram.StepIndex");
+    }
+
+    [Fact]
+    public void Structured_member_access_splits_segments()
+    {
+        var p = AbCipTagPath.TryParse("Motor1.Speed.Setpoint");
+        p.ShouldNotBeNull();
+        p.Segments.Select(s => s.Name).ShouldBe(["Motor1", "Speed", "Setpoint"]);
+        p.ToLibplctagName().ShouldBe("Motor1.Speed.Setpoint");
+    }
+
+    [Fact]
+    public void Single_dim_array_subscript()
+    {
+        var p = AbCipTagPath.TryParse("Data[7]");
+        p.ShouldNotBeNull();
+        p.Segments.Single().Name.ShouldBe("Data");
+        p.Segments.Single().Subscripts.ShouldBe([7]);
+        p.ToLibplctagName().ShouldBe("Data[7]");
+    }
+
+    [Fact]
+    public void Multi_dim_array_subscript()
+    {
+        var p = AbCipTagPath.TryParse("Matrix[1,2,3]");
+        p.ShouldNotBeNull();
+        p.Segments.Single().Subscripts.ShouldBe([1, 2, 3]);
+        p.ToLibplctagName().ShouldBe("Matrix[1,2,3]");
+    }
+
+    [Fact]
+    public void Bit_in_dint_captured_as_bit_index()
+    {
+        var p = AbCipTagPath.TryParse("Flags.3");
+        p.ShouldNotBeNull();
+        p.Segments.Single().Name.ShouldBe("Flags");
+        p.BitIndex.ShouldBe(3);
+        p.ToLibplctagName().ShouldBe("Flags.3");
+    }
+
+    [Fact]
+    public void Bit_in_dint_after_member()
+    {
+        var p = AbCipTagPath.TryParse("Motor.Status.12");
+        p.ShouldNotBeNull();
+        p.Segments.Select(s => s.Name).ShouldBe(["Motor", "Status"]);
+        p.BitIndex.ShouldBe(12);
+        p.ToLibplctagName().ShouldBe("Motor.Status.12");
+    }
+
+    [Fact]
+    public void Bit_index_32_rejected_out_of_range()
+    {
+        // 32 exceeds the DINT bit width — treated as a member name rather than bit selector,
+        // which fails ident validation and returns null.
+        AbCipTagPath.TryParse("Flags.32").ShouldBeNull();
+    }
+
+    [Fact]
+    public void Program_scope_with_members_and_subscript_and_bit()
+    {
+        var p = AbCipTagPath.TryParse("Program:MainProgram.Motors[0].Status.5");
+        p.ShouldNotBeNull();
+        p.ProgramScope.ShouldBe("MainProgram");
+        p.Segments.Select(s => s.Name).ShouldBe(["Motors", "Status"]);
+        p.Segments[0].Subscripts.ShouldBe([0]);
+        p.BitIndex.ShouldBe(5);
+        p.ToLibplctagName().ShouldBe("Program:MainProgram.Motors[0].Status.5");
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("Program:")]             // empty scope
+    [InlineData("Program:MP")]            // no body after scope
+    [InlineData("1InvalidStart")]         // ident starts with digit
+    [InlineData("Bad Name")]              // space in ident
+    [InlineData("Motor[]")]               // empty subscript
+    [InlineData("Motor[-1]")]             // negative subscript
+    [InlineData("Motor[a]")]              // non-numeric subscript
+    [InlineData("Motor[")]                // unbalanced bracket
+    [InlineData("Motor.")]                // trailing dot
+    [InlineData(".Motor")]                // leading dot
+    public void Invalid_shapes_return_null(string? input)
+    {
+        AbCipTagPath.TryParse(input).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Ident_with_underscore_accepted()
+    {
+        AbCipTagPath.TryParse("_private_tag")!.Segments.Single().Name.ShouldBe("_private_tag");
+    }
+
+    [Fact]
+    public void ToLibplctagName_recomposes_round_trip()
+    {
+        var cases = new[]
+        {
+            "Motor1_Speed",
+            "Program:Main.Counter",
+            "Array[5]",
+            "Matrix[1,2]",
+            "Obj.Member.Sub",
+            "Flags.0",
+            "Program:P.Obj[2].Flags.15",
+        };
+        foreach (var c in cases)
+        {
+            var parsed = AbCipTagPath.TryParse(c);
+            parsed.ShouldNotBeNull(c);
+            parsed.ToLibplctagName().ShouldBe(c);
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipUdtMemberTests.cs

@@ -0,0 +1,217 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipUdtMemberTests
+{
+    [Fact]
+    public async Task UDT_with_declared_members_fans_out_to_member_variables()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition(
+                    Name: "Motor1",
+                    DeviceHostAddress: "ab://10.0.0.5/1,0",
+                    TagPath: "Motor1",
+                    DataType: AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Speed", AbCipDataType.DInt),
+                        new AbCipStructureMember("Running", AbCipDataType.Bool, Writable: false),
+                        new AbCipStructureMember("SetPoint", AbCipDataType.Real, WriteIdempotent: true),
+                    ]),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "Motor1");
+        var variables = builder.Variables.Select(v => (v.BrowseName, v.Info.FullName)).ToList();
+        variables.ShouldContain(("Speed", "Motor1.Speed"));
+        variables.ShouldContain(("Running", "Motor1.Running"));
+        variables.ShouldContain(("SetPoint", "Motor1.SetPoint"));
+
+        builder.Variables.Single(v => v.BrowseName == "Running").Info.SecurityClass
+            .ShouldBe(SecurityClassification.ViewOnly);
+        builder.Variables.Single(v => v.BrowseName == "SetPoint").Info.WriteIdempotent
+            .ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UDT_members_resolvable_for_read_via_synthesised_full_reference()
+    {
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => p.TagName switch
+            {
+                "Motor1.Speed" => new FakeAbCipTag(p) { Value = 1800 },
+                "Motor1.Running" => new FakeAbCipTag(p) { Value = true },
+                _ => new FakeAbCipTag(p),
+            },
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Speed", AbCipDataType.DInt),
+                        new AbCipStructureMember("Running", AbCipDataType.Bool),
+                    ]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["Motor1.Speed", "Motor1.Running"], CancellationToken.None);
+
+        snapshots[0].Value.ShouldBe(1800);
+        snapshots[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        snapshots[1].Value.ShouldBe(true);
+        snapshots[1].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+    }
+
+    [Fact]
+    public async Task UDT_member_write_routes_through_synthesised_tagpath()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("SetPoint", AbCipDataType.Real),
+                    ]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Motor1.SetPoint", 42.5f)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        factory.Tags["Motor1.SetPoint"].Value.ShouldBe(42.5f);
+    }
+
+    [Fact]
+    public async Task UDT_member_read_write_honours_member_Writable_flag()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Status", AbCipDataType.DInt, Writable: false),
+                    ]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Motor1.Status", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+    }
+
+    [Fact]
+    public async Task Structure_tag_without_members_is_emitted_as_single_variable()
+    {
+        // Fallback path: a Structure tag with no declared Members still appears as a Variable so
+        // downstream configuration can address it manually. This matches the "black box" note in
+        // AbCipTagDefinition's docstring.
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("OpaqueUdt", "ab://10.0.0.5/1,0", "OpaqueUdt", AbCipDataType.Structure)],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.ShouldContain(v => v.BrowseName == "OpaqueUdt");
+        builder.Folders.ShouldNotContain(f => f.BrowseName == "OpaqueUdt");
+    }
+
+    [Fact]
+    public async Task Empty_Members_list_is_treated_like_null()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("EmptyUdt", "ab://10.0.0.5/1,0", "E", AbCipDataType.Structure, Members: [])],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldNotContain(f => f.BrowseName == "EmptyUdt");
+        builder.Variables.ShouldContain(v => v.BrowseName == "EmptyUdt");
+    }
+
+    [Fact]
+    public async Task UDT_members_mixed_with_flat_tags_coexist()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("FlatA", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Speed", AbCipDataType.DInt),
+                    ]),
+                new AbCipTagDefinition("FlatB", "ab://10.0.0.5/1,0", "B", AbCipDataType.Real),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.BrowseName).ShouldBe(["FlatA", "Speed", "FlatB"], ignoreOrder: true);
+    }
+
+    // ---- helpers ----
+
+    private sealed class RecordingBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, string DisplayName)> Folders { get; } = new();
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = new();
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName)
+        { Folders.Add((browseName, displayName)); return this; }
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        { Variables.Add((browseName, info)); return new Handle(info.FullName); }
+
+        public void AddProperty(string _, DriverDataType __, object? ___) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+        private sealed class NullSink : IAlarmConditionSink { public void OnTransition(AlarmEventArgs args) { } }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/FakeAbCipTag.cs

@@ -0,0 +1,67 @@
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+/// <summary>
+///     Test fake for <see cref="IAbCipTagRuntime"/>. Stores the mock PLC value in
+///     <see cref="Value"/> + returns it from <see cref="DecodeValue"/>. Use
+///     <see cref="Status"/> to simulate libplctag error codes,
+///     <see cref="ThrowOnInitialize"/> / <see cref="ThrowOnRead"/> to simulate exceptions.
+/// </summary>
+internal class FakeAbCipTag : IAbCipTagRuntime
+{
+    public AbCipTagCreateParams CreationParams { get; }
+    public object? Value { get; set; }
+    public int Status { get; set; }
+    public bool ThrowOnInitialize { get; set; }
+    public bool ThrowOnRead { get; set; }
+    public Exception? Exception { get; set; }
+    public int InitializeCount { get; private set; }
+    public int ReadCount { get; private set; }
+    public int WriteCount { get; private set; }
+    public bool Disposed { get; private set; }
+
+    public FakeAbCipTag(AbCipTagCreateParams createParams) => CreationParams = createParams;
+
+    public virtual Task InitializeAsync(CancellationToken cancellationToken)
+    {
+        InitializeCount++;
+        if (ThrowOnInitialize) throw Exception ?? new InvalidOperationException("fake initialize failure");
+        return Task.CompletedTask;
+    }
+
+    public virtual Task ReadAsync(CancellationToken cancellationToken)
+    {
+        ReadCount++;
+        if (ThrowOnRead) throw Exception ?? new InvalidOperationException("fake read failure");
+        return Task.CompletedTask;
+    }
+
+    public virtual Task WriteAsync(CancellationToken cancellationToken)
+    {
+        WriteCount++;
+        return Task.CompletedTask;
+    }
+
+    public virtual int GetStatus() => Status;
+
+    public virtual object? DecodeValue(AbCipDataType type, int? bitIndex) => Value;
+
+    public virtual void EncodeValue(AbCipDataType type, int? bitIndex, object? value) => Value = value;
+
+    public virtual void Dispose() => Disposed = true;
+}
+
+/// <summary>Test factory that produces <see cref="FakeAbCipTag"/>s and indexes them for assertion.</summary>
+internal sealed class FakeAbCipTagFactory : IAbCipTagFactory
+{
+    public Dictionary<string, FakeAbCipTag> Tags { get; } = new(StringComparer.OrdinalIgnoreCase);
+    public Func<AbCipTagCreateParams, FakeAbCipTag>? Customise { get; set; }
+
+    public IAbCipTagRuntime Create(AbCipTagCreateParams createParams)
+    {
+        var fake = Customise?.Invoke(createParams) ?? new FakeAbCipTag(createParams);
+        Tags[createParams.TagName] = fake;
+        return fake;
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.AbCip\ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>