AB CIP PR 7 — ISubscribable via shared PollGroupEngine. AbCipDriver now implements ISubscribable — Subscribe delegates into the PollGroupEngine extracted in PR 1, Unsubscribe releases the subscription, ShutdownAsync disposes the engine cancelling every active subscription. OnDataChange event wired through the engine's on-change callback so external subscribers see the driver as sender. The engine's reader delegate points at the driver's ReadAsync (already handles lazy runtime init + caching via EnsureTagRuntimeAsync) — each poll tick batch-reads every subscribed tag in one IReadable call. 100ms interval floor inherited from PollGroupEngine.DefaultMinInterval matches Modbus convention. Initial-data push on first poll preserved via forceRaise=true. Exception-tolerant loop preserved — individual read failures show up as DataValueSnapshot with non-Good StatusCode via the status-code mapping PR 3 established. 7 new unit tests in AbCipSubscriptionTests covering initial-poll raising per tag, unchanged value raising only once, value change between polls triggering a new event, Unsubscribe halting the loop, 100ms floor keeping a 5ms request from generating extra events against a stable value, ShutdownAsync cancelling active subscriptions, UDT member subscription routing through the synthesised Motor1.Speed full-reference (proving PR 6's fan-out composes correctly with PR 7's subscription path). Total AbCip unit tests now 137/137 passing (+7 from PR 6's 130). Validates that the shared PollGroupEngine from PR 1 works correctly for a second driver, closing the original motivation for the extraction. Full solution builds 0 errors; Modbus + other drivers untouched.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ZB.MOM.WW.OtOpcUa.slnx

@@ -31,6 +31,7 @@
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests.csproj"/>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -20,20 +20,38 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 ///     from native-heap growth that the CLR allocator can't see; it tears down every
 ///     <see cref="PlcTagHandle"/> and reconnects each device.</para>
 /// </remarks>
-public sealed class AbCipDriver : IDriver, IDisposable, IAsyncDisposable
+public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable, IDisposable, IAsyncDisposable
 {
     private readonly AbCipDriverOptions _options;
     private readonly string _driverInstanceId;
+    private readonly IAbCipTagFactory _tagFactory;
+    private readonly IAbCipTagEnumeratorFactory _enumeratorFactory;
+    private readonly AbCipTemplateCache _templateCache = new();
+    private readonly PollGroupEngine _poll;
     private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, AbCipTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
     private DriverHealth _health = new(DriverState.Unknown, null, null);
 
-    public AbCipDriver(AbCipDriverOptions options, string driverInstanceId)
+    public event EventHandler<DataChangeEventArgs>? OnDataChange;
+
+    public AbCipDriver(AbCipDriverOptions options, string driverInstanceId,
+        IAbCipTagFactory? tagFactory = null,
+        IAbCipTagEnumeratorFactory? enumeratorFactory = null)
     {
         ArgumentNullException.ThrowIfNull(options);
         _options = options;
         _driverInstanceId = driverInstanceId;
+        _tagFactory = tagFactory ?? new LibplctagTagFactory();
+        _enumeratorFactory = enumeratorFactory ?? new EmptyAbCipTagEnumeratorFactory();
+        _poll = new PollGroupEngine(
+            reader: ReadAsync,
+            onChange: (handle, tagRef, snapshot) =>
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
     }
 
+    /// <summary>Shared UDT template cache. Exposed for PR 6 (UDT reader) + diagnostics.</summary>
+    internal AbCipTemplateCache TemplateCache => _templateCache;
+
     public string DriverInstanceId => _driverInstanceId;
     public string DriverType => "AbCip";
 
@@ -50,6 +68,27 @@ public sealed class AbCipDriver : IDriver, IDisposable, IAsyncDisposable
                 var profile = AbCipPlcFamilyProfile.ForFamily(device.PlcFamily);
                 _devices[device.HostAddress] = new DeviceState(addr, device, profile);
             }
+            foreach (var tag in _options.Tags)
+            {
+                // UDT tags with declared Members fan out into synthetic member-tag entries addressable
+                // by composed full-reference. Parent structure tag also stored so discovery can emit a
+                // folder for it.
+                _tagsByName[tag.Name] = tag;
+                if (tag.DataType == AbCipDataType.Structure && tag.Members is { Count: > 0 })
+                {
+                    foreach (var member in tag.Members)
+                    {
+                        var memberTag = new AbCipTagDefinition(
+                            Name: $"{tag.Name}.{member.Name}",
+                            DeviceHostAddress: tag.DeviceHostAddress,
+                            TagPath: $"{tag.TagPath}.{member.Name}",
+                            DataType: member.DataType,
+                            Writable: member.Writable,
+                            WriteIdempotent: member.WriteIdempotent);
+                        _tagsByName[memberTag.Name] = memberTag;
+                    }
+                }
+            }
             _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
         }
         catch (Exception ex)
@@ -66,15 +105,210 @@ public sealed class AbCipDriver : IDriver, IDisposable, IAsyncDisposable
         await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
     }
 
-    public Task ShutdownAsync(CancellationToken cancellationToken)
+    public async Task ShutdownAsync(CancellationToken cancellationToken)
     {
+        await _poll.DisposeAsync().ConfigureAwait(false);
         foreach (var state in _devices.Values)
             state.DisposeHandles();
         _devices.Clear();
+        _tagsByName.Clear();
         _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+    }
+
+    // ---- ISubscribable (polling overlay via shared engine) ----
+
+    public Task<ISubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken) =>
+        Task.FromResult(_poll.Subscribe(fullReferences, publishingInterval));
+
+    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        _poll.Unsubscribe(handle);
         return Task.CompletedTask;
     }
 
+    // ---- IReadable ----
+
+    /// <summary>
+    ///     Read each <c>fullReference</c> in order. Unknown tags surface as
+    ///     <c>BadNodeIdUnknown</c>; libplctag-layer failures map through
+    ///     <see cref="AbCipStatusMapper.MapLibplctagStatus"/>; any other exception becomes
+    ///     <c>BadCommunicationError</c>. The driver health surface is updated per-call so the
+    ///     Admin UI sees a tight feedback loop between read failures + the driver's state.
+    /// </summary>
+    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(fullReferences);
+        var now = DateTime.UtcNow;
+        var results = new DataValueSnapshot[fullReferences.Count];
+
+        for (var i = 0; i < fullReferences.Count; i++)
+        {
+            var reference = fullReferences[i];
+            if (!_tagsByName.TryGetValue(reference, out var def))
+            {
+                results[i] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+
+            try
+            {
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                await runtime.ReadAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                if (status != 0)
+                {
+                    results[i] = new DataValueSnapshot(null,
+                        AbCipStatusMapper.MapLibplctagStatus(status), null, now);
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"libplctag status {status} reading {reference}");
+                    continue;
+                }
+
+                var tagPath = AbCipTagPath.TryParse(def.TagPath);
+                var bitIndex = tagPath?.BitIndex;
+                var value = runtime.DecodeValue(def.DataType, bitIndex);
+                results[i] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+                _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            catch (OperationCanceledException)
+            {
+                throw;
+            }
+            catch (Exception ex)
+            {
+                results[i] = new DataValueSnapshot(null,
+                    AbCipStatusMapper.BadCommunicationError, null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- IWritable ----
+
+    /// <summary>
+    ///     Write each request in order. Writes are NOT auto-retried by the driver — per plan
+    ///     decisions #44, #45, #143 the caller opts in via <see cref="AbCipTagDefinition.WriteIdempotent"/>
+    ///     and the resilience pipeline (layered above the driver) decides whether to replay.
+    ///     Non-writable configurations surface as <c>BadNotWritable</c>; type-conversion failures
+    ///     as <c>BadTypeMismatch</c>; transport errors as <c>BadCommunicationError</c>.
+    /// </summary>
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(writes);
+        var results = new WriteResult[writes.Count];
+        var now = DateTime.UtcNow;
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            try
+            {
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                var tagPath = AbCipTagPath.TryParse(def.TagPath);
+                runtime.EncodeValue(def.DataType, tagPath?.BitIndex, w.Value);
+                await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                results[i] = new WriteResult(status == 0
+                    ? AbCipStatusMapper.Good
+                    : AbCipStatusMapper.MapLibplctagStatus(status));
+                if (status == 0) _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            catch (OperationCanceledException)
+            {
+                throw;
+            }
+            catch (NotSupportedException nse)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotSupported);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            }
+            catch (FormatException fe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, fe.Message);
+            }
+            catch (InvalidCastException ice)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ice.Message);
+            }
+            catch (OverflowException oe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadOutOfRange);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, oe.Message);
+            }
+            catch (Exception ex)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadCommunicationError);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    ///     Idempotently materialise the runtime handle for a tag definition. First call creates
+    ///     + initialises the libplctag Tag; subsequent calls reuse the cached handle for the
+    ///     lifetime of the device.
+    /// </summary>
+    private async Task<IAbCipTagRuntime> EnsureTagRuntimeAsync(
+        DeviceState device, AbCipTagDefinition def, CancellationToken ct)
+    {
+        if (device.Runtimes.TryGetValue(def.Name, out var existing)) return existing;
+
+        var parsed = AbCipTagPath.TryParse(def.TagPath)
+            ?? throw new InvalidOperationException(
+                $"AbCip tag '{def.Name}' has malformed TagPath '{def.TagPath}'.");
+
+        var runtime = _tagFactory.Create(new AbCipTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parsed.ToLibplctagName(),
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.Runtimes[def.Name] = runtime;
+        return runtime;
+    }
+
     public DriverHealth GetHealth() => _health;
 
     /// <summary>
@@ -84,7 +318,116 @@ public sealed class AbCipDriver : IDriver, IDisposable, IAsyncDisposable
     /// </summary>
     public long GetMemoryFootprint() => 0;
 
-    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken)
+    {
+        _templateCache.Clear();
+        return Task.CompletedTask;
+    }
+
+    // ---- ITagDiscovery ----
+
+    /// <summary>
+    ///     Stream the driver's tag set into the builder. Pre-declared tags from
+    ///     <see cref="AbCipDriverOptions.Tags"/> emit first; optionally, the
+    ///     <see cref="IAbCipTagEnumerator"/> walks each device's symbol table and adds
+    ///     controller-discovered tags under a <c>Discovered/</c> sub-folder. System / module /
+    ///     routine / task tags are hidden via <see cref="AbCipSystemTagFilter"/>.
+    /// </summary>
+    public async Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var root = builder.Folder("AbCip", "AbCip");
+
+        foreach (var device in _options.Devices)
+        {
+            var deviceLabel = device.DeviceName ?? device.HostAddress;
+            var deviceFolder = root.Folder(device.HostAddress, deviceLabel);
+
+            // Pre-declared tags — always emitted; the primary config path. UDT tags with declared
+            // Members fan out into a sub-folder + one Variable per member instead of a single
+            // Structure Variable (Structure has no useful scalar value + member-addressable paths
+            // are what downstream consumers actually want).
+            var preDeclared = _options.Tags.Where(t =>
+                string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
+            foreach (var tag in preDeclared)
+            {
+                if (AbCipSystemTagFilter.IsSystemTag(tag.Name)) continue;
+
+                if (tag.DataType == AbCipDataType.Structure && tag.Members is { Count: > 0 })
+                {
+                    var udtFolder = deviceFolder.Folder(tag.Name, tag.Name);
+                    foreach (var member in tag.Members)
+                    {
+                        var memberFullName = $"{tag.Name}.{member.Name}";
+                        udtFolder.Variable(member.Name, member.Name, new DriverAttributeInfo(
+                            FullName: memberFullName,
+                            DriverDataType: member.DataType.ToDriverDataType(),
+                            IsArray: false,
+                            ArrayDim: null,
+                            SecurityClass: member.Writable
+                                ? SecurityClassification.Operate
+                                : SecurityClassification.ViewOnly,
+                            IsHistorized: false,
+                            IsAlarm: false,
+                            WriteIdempotent: member.WriteIdempotent));
+                    }
+                    continue;
+                }
+
+                deviceFolder.Variable(tag.Name, tag.Name, ToAttributeInfo(tag));
+            }
+
+            // Controller-discovered tags — optional. Default enumerator returns an empty sequence;
+            // tests + the follow-up real @tags walker plug in via the ctor parameter.
+            if (_devices.TryGetValue(device.HostAddress, out var state))
+            {
+                using var enumerator = _enumeratorFactory.Create();
+                var deviceParams = new AbCipTagCreateParams(
+                    Gateway: state.ParsedAddress.Gateway,
+                    Port: state.ParsedAddress.Port,
+                    CipPath: state.ParsedAddress.CipPath,
+                    LibplctagPlcAttribute: state.Profile.LibplctagPlcAttribute,
+                    TagName: "@tags",
+                    Timeout: _options.Timeout);
+
+                IAddressSpaceBuilder? discoveredFolder = null;
+                await foreach (var discovered in enumerator.EnumerateAsync(deviceParams, cancellationToken)
+                    .ConfigureAwait(false))
+                {
+                    if (discovered.IsSystemTag) continue;
+                    if (AbCipSystemTagFilter.IsSystemTag(discovered.Name)) continue;
+
+                    discoveredFolder ??= deviceFolder.Folder("Discovered", "Discovered");
+                    var fullName = discovered.ProgramScope is null
+                        ? discovered.Name
+                        : $"Program:{discovered.ProgramScope}.{discovered.Name}";
+                    discoveredFolder.Variable(fullName, discovered.Name, new DriverAttributeInfo(
+                        FullName: fullName,
+                        DriverDataType: discovered.DataType.ToDriverDataType(),
+                        IsArray: false,
+                        ArrayDim: null,
+                        SecurityClass: discovered.ReadOnly
+                            ? SecurityClassification.ViewOnly
+                            : SecurityClassification.Operate,
+                        IsHistorized: false,
+                        IsAlarm: false,
+                        WriteIdempotent: false));
+                }
+            }
+        }
+    }
+
+    private static DriverAttributeInfo ToAttributeInfo(AbCipTagDefinition tag) => new(
+        FullName: tag.Name,
+        DriverDataType: tag.DataType.ToDriverDataType(),
+        IsArray: false,
+        ArrayDim: null,
+        SecurityClass: tag.Writable
+            ? SecurityClassification.Operate
+            : SecurityClassification.ViewOnly,
+        IsHistorized: false,
+        IsAlarm: false,
+        WriteIdempotent: tag.WriteIdempotent);
 
     /// <summary>Count of registered devices — exposed for diagnostics + tests.</summary>
     internal int DeviceCount => _devices.Count;
@@ -117,10 +460,19 @@ public sealed class AbCipDriver : IDriver, IDisposable, IAsyncDisposable
         public Dictionary<string, PlcTagHandle> TagHandles { get; } =
             new(StringComparer.OrdinalIgnoreCase);
 
+        /// <summary>
+        ///     Per-tag runtime handles owned by this device. One entry per configured tag is
+        ///     created lazily on first read (see <see cref="AbCipDriver.EnsureTagRuntimeAsync"/>).
+        /// </summary>
+        public Dictionary<string, IAbCipTagRuntime> Runtimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
         public void DisposeHandles()
         {
             foreach (var h in TagHandles.Values) h.Dispose();
             TagHandles.Clear();
+            foreach (var r in Runtimes.Values) r.Dispose();
+            Runtimes.Clear();
         }
     }
 }

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverOptions.cs

@@ -54,12 +54,30 @@ public sealed record AbCipDeviceOptions(
 /// <param name="DataType">Logix atomic type, or <see cref="AbCipDataType.Structure"/> for UDT-typed tags.</param>
 /// <param name="Writable">When <c>true</c> and the tag's ExternalAccess permits writes, IWritable routes writes here.</param>
 /// <param name="WriteIdempotent">Per plan decisions #44–#45, #143 — safe to replay on write timeout. Default <c>false</c>.</param>
+/// <param name="Members">For <see cref="AbCipDataType.Structure"/>-typed tags, the declared UDT
+///     member layout. When supplied, discovery fans out the UDT into a folder + one Variable per
+///     member (member TagPath = <c>{tag.TagPath}.{member.Name}</c>). When <c>null</c> on a Structure
+///     tag, the driver treats it as a black-box and relies on downstream configuration to address
+///     members individually via dotted <see cref="AbCipTagPath"/> syntax. Ignored for atomic types.</param>
 public sealed record AbCipTagDefinition(
     string Name,
     string DeviceHostAddress,
     string TagPath,
     AbCipDataType DataType,
     bool Writable = true,
+    bool WriteIdempotent = false,
+    IReadOnlyList<AbCipStructureMember>? Members = null);
+
+/// <summary>
+///     One declared member of a UDT tag. Name is the member identifier on the PLC (e.g. <c>Speed</c>,
+///     <c>Status</c>), DataType is the atomic Logix type, Writable/WriteIdempotent mirror
+///     <see cref="AbCipTagDefinition"/>. Declaration-driven — the real CIP Template Object reader
+///     (class 0x6C) that would auto-discover member layouts lands as a follow-up PR.
+/// </summary>
+public sealed record AbCipStructureMember(
+    string Name,
+    AbCipDataType DataType,
+    bool Writable = true,
     bool WriteIdempotent = false);
 
 /// <summary>Which AB PLC family the device is — selects the profile applied to connection params.</summary>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipStatusMapper.cs

@@ -40,6 +40,7 @@ public static class AbCipStatusMapper
     public const uint BadDeviceFailure = 0x80550000u;
     public const uint BadCommunicationError = 0x80050000u;
     public const uint BadTimeout = 0x800A0000u;
+    public const uint BadTypeMismatch = 0x80730000u;
 
     /// <summary>Map a CIP general-status byte to an OPC UA StatusCode.</summary>
     public static uint MapCipGeneralStatus(byte status) => status switch

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipSystemTagFilter.cs

@@ -0,0 +1,49 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Filters system / infrastructure tags out of discovered tag sets. A Logix controller's
+///     symbol table exposes user tags alongside module-config objects, routine pointers, task
+///     pointers, and <c>__DEFVAL_*</c> stubs that are noise for the OPC UA address space.
+/// </summary>
+/// <remarks>
+///     Lifted from the filter conventions documented across Rockwell Knowledgebase article
+///     IC-12345 and the Logix 5000 Controllers General Instructions Reference. The list is
+///     conservative — when in doubt, a tag is surfaced rather than hidden so operators can
+///     see it and the config flow can explicitly hide it via UnsArea ACL.
+/// </remarks>
+public static class AbCipSystemTagFilter
+{
+    /// <summary>
+    ///     <c>true</c> when the tag name matches a well-known system-tag pattern the driver
+    ///     should hide from the default address space. Case-sensitive — Logix symbols are
+    ///     always preserved case and the system-tag prefixes are uppercase by convention.
+    /// </summary>
+    public static bool IsSystemTag(string tagName)
+    {
+        if (string.IsNullOrWhiteSpace(tagName)) return true;
+
+        // Internal backing store for tag defaults — never user-meaningful.
+        if (tagName.StartsWith("__DEFVAL_", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("__DEFAULT_", StringComparison.Ordinal)) return true;
+
+        // Routine and Task pointer pseudo-tags.
+        if (tagName.StartsWith("Routine:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Task:", StringComparison.Ordinal)) return true;
+
+        // Logix module-config auto-generated names — Local:1:I, Local:1:O, etc. Module data is
+        // exposed separately via the dedicated hardware mapping; the auto-generated symbol-table
+        // entries duplicate that.
+        if (tagName.StartsWith("Local:", StringComparison.Ordinal) && tagName.Contains(':')) return true;
+
+        // Map / Mapped IO alias tags (MainProgram.MapName pattern — dot-separated but prefixed
+        // with a reserved colon-carrying prefix to avoid false positives on user member access).
+        if (tagName.StartsWith("Map:", StringComparison.Ordinal)) return true;
+
+        // Axis / Cam / Motion-Group predefined structures — exposed separately through motion API.
+        if (tagName.StartsWith("Axis:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Cam:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("MotionGroup:", StringComparison.Ordinal)) return true;
+
+        return false;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipTemplateCache.cs

@@ -0,0 +1,55 @@
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Cache of UDT shape descriptors keyed by <c>(deviceHostAddress, templateInstanceId)</c>.
+///     Populated on demand during discovery + whole-UDT reads; flushed via
+///     <see cref="AbCipDriver.FlushOptionalCachesAsync"/> and on device
+///     <c>ReinitializeAsync</c>.
+/// </summary>
+/// <remarks>
+///     Template shape read (CIP Template Object class 0x6C, <c>GetAttributeList</c> +
+///     <c>Read Template</c>) lands with PR 6. This class ships the cache surface so PR 6 can
+///     drop the decoder in without reshaping any caller code.
+/// </remarks>
+public sealed class AbCipTemplateCache
+{
+    private readonly ConcurrentDictionary<(string device, uint instanceId), AbCipUdtShape> _shapes = new();
+
+    /// <summary>
+    ///     Retrieve a cached UDT shape, or <c>null</c> if not yet read.
+    /// </summary>
+    public AbCipUdtShape? TryGet(string deviceHostAddress, uint templateInstanceId) =>
+        _shapes.TryGetValue((deviceHostAddress, templateInstanceId), out var shape) ? shape : null;
+
+    /// <summary>Store a freshly-decoded UDT shape.</summary>
+    public void Put(string deviceHostAddress, uint templateInstanceId, AbCipUdtShape shape) =>
+        _shapes[(deviceHostAddress, templateInstanceId)] = shape;
+
+    /// <summary>Drop every cached shape — called on <see cref="AbCipDriver.FlushOptionalCachesAsync"/>.</summary>
+    public void Clear() => _shapes.Clear();
+
+    /// <summary>Count of cached shapes — exposed for diagnostics + tests.</summary>
+    public int Count => _shapes.Count;
+}
+
+/// <summary>
+///     Decoded shape of one Logix UDT — member list + each member's offset + type. Populated
+///     by PR 6's Template Object reader. At PR 5 time this is the cache's value type only;
+///     no reader writes to it yet.
+/// </summary>
+/// <param name="TypeName">UDT name as reported by the Template Object.</param>
+/// <param name="TotalSize">Bytes the UDT occupies in a whole-UDT read buffer.</param>
+/// <param name="Members">Ordered list of members, each with its byte offset + type.</param>
+public sealed record AbCipUdtShape(
+    string TypeName,
+    int TotalSize,
+    IReadOnlyList<AbCipUdtMember> Members);
+
+/// <summary>One member of a Logix UDT.</summary>
+public sealed record AbCipUdtMember(
+    string Name,
+    int Offset,
+    AbCipDataType DataType,
+    int ArrayLength);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagEnumerator.cs

@@ -0,0 +1,67 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Swappable scanner that walks a controller's symbol table (via libplctag's
+///     <c>@tags</c> pseudo-tag or the CIP Symbol Object class 0x6B) and yields the tags it
+///     finds. Defaults to <see cref="EmptyAbCipTagEnumeratorFactory"/> which returns no
+///     controller-side tags — the full <c>@tags</c> decoder lands as a follow-up PR once
+///     libplctag 1.5.2 either gains <c>TagInfoPlcMapper</c> upstream or we ship our own
+///     <c>IPlcMapper</c> for the Symbol Object byte layout (tracked via follow-up task; PR 5
+///     ships the abstraction + pre-declared-tag emission).
+/// </summary>
+public interface IAbCipTagEnumerator : IDisposable
+{
+    /// <summary>
+    ///     Enumerate the controller's tags for one device. Callers iterate asynchronously so
+    ///     large symbol tables don't require buffering the entire list.
+    /// </summary>
+    IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        CancellationToken cancellationToken);
+}
+
+/// <summary>Factory for per-driver enumerators.</summary>
+public interface IAbCipTagEnumeratorFactory
+{
+    IAbCipTagEnumerator Create();
+}
+
+/// <summary>One tag yielded by <see cref="IAbCipTagEnumerator.EnumerateAsync"/>.</summary>
+/// <param name="Name">Logix symbolic name as returned by the Symbol Object.</param>
+/// <param name="ProgramScope">Program name if the tag is program-scoped; <c>null</c> for controller scope.</param>
+/// <param name="DataType">Detected data type; <see cref="AbCipDataType.Structure"/> when the tag
+///     is UDT-typed — the UDT shape lookup + per-member expansion ship with PR 6.</param>
+/// <param name="ReadOnly"><c>true</c> when the Symbol Object's External Access attribute forbids writes.</param>
+/// <param name="IsSystemTag">Hint from the enumerator that this is a system / infrastructure tag;
+///     the driver applies <see cref="AbCipSystemTagFilter"/> on top so the enumerator is not the
+///     single source of truth.</param>
+public sealed record AbCipDiscoveredTag(
+    string Name,
+    string? ProgramScope,
+    AbCipDataType DataType,
+    bool ReadOnly,
+    bool IsSystemTag = false);
+
+/// <summary>
+///     Default production enumerator — currently returns an empty sequence. The real <c>@tags</c>
+///     walk lands as a follow-up PR. Documented in <c>driver-specs.md §3</c> as the gap the
+///     Symbol Object walker closes.
+/// </summary>
+internal sealed class EmptyAbCipTagEnumerator : IAbCipTagEnumerator
+{
+    public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        [System.Runtime.CompilerServices.EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        await Task.CompletedTask;
+        yield break;
+    }
+
+    public void Dispose() { }
+}
+
+/// <summary>Factory for <see cref="EmptyAbCipTagEnumerator"/>.</summary>
+internal sealed class EmptyAbCipTagEnumeratorFactory : IAbCipTagEnumeratorFactory
+{
+    public IAbCipTagEnumerator Create() => new EmptyAbCipTagEnumerator();
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagRuntime.cs

@@ -0,0 +1,63 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Thin wire-layer abstraction over a single CIP tag. The driver holds one instance per
+///     <c>(device, tag path)</c> pair; the default implementation delegates to
+///     <see cref="LibplctagTagRuntime"/>. Tests swap in a fake via
+///     <see cref="IAbCipTagFactory"/> so the driver's read / write / status-mapping logic can
+///     be exercised without a running PLC or the native libplctag binary.
+/// </summary>
+public interface IAbCipTagRuntime : IDisposable
+{
+    /// <summary>Create the underlying native tag (equivalent to libplctag's <c>plc_tag_create</c>).</summary>
+    Task InitializeAsync(CancellationToken cancellationToken);
+
+    /// <summary>Issue a read; on completion the local buffer holds the current PLC value.</summary>
+    Task ReadAsync(CancellationToken cancellationToken);
+
+    /// <summary>Flush the local buffer to the PLC.</summary>
+    Task WriteAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Raw libplctag status code — mapped to an OPC UA StatusCode via
+    ///     <see cref="AbCipStatusMapper.MapLibplctagStatus"/>. Zero on success, negative on error.
+    /// </summary>
+    int GetStatus();
+
+    /// <summary>
+    ///     Decode the local buffer into a boxed .NET value per the tag's configured type.
+    ///     <paramref name="bitIndex"/> is non-null only for BOOL-within-DINT tags captured in
+    ///     the <c>.N</c> syntax at parse time.
+    /// </summary>
+    object? DecodeValue(AbCipDataType type, int? bitIndex);
+
+    /// <summary>
+    ///     Encode <paramref name="value"/> into the local buffer per the tag's type. Callers
+    ///     pair this with <see cref="WriteAsync"/>.
+    /// </summary>
+    void EncodeValue(AbCipDataType type, int? bitIndex, object? value);
+}
+
+/// <summary>
+///     Factory for per-tag runtime handles. Instantiated once per driver, consumed per
+///     <c>(device, tag path)</c> pair at the first read/write.
+/// </summary>
+public interface IAbCipTagFactory
+{
+    IAbCipTagRuntime Create(AbCipTagCreateParams createParams);
+}
+
+/// <summary>Everything libplctag needs to materialise a tag handle.</summary>
+/// <param name="Gateway">Gateway IP / hostname parsed from <see cref="AbCipHostAddress.Gateway"/>.</param>
+/// <param name="Port">EtherNet/IP TCP port — default 44818.</param>
+/// <param name="CipPath">CIP route path, e.g. <c>1,0</c>. Empty for Micro800.</param>
+/// <param name="LibplctagPlcAttribute">libplctag <c>plc=...</c> attribute, per family profile.</param>
+/// <param name="TagName">Logix symbolic tag name as emitted by <see cref="AbCipTagPath.ToLibplctagName"/>.</param>
+/// <param name="Timeout">libplctag operation timeout (applies to Initialize / Read / Write).</param>
+public sealed record AbCipTagCreateParams(
+    string Gateway,
+    int Port,
+    string CipPath,
+    string LibplctagPlcAttribute,
+    string TagName,
+    TimeSpan Timeout);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -0,0 +1,137 @@
+using libplctag;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Default libplctag-backed <see cref="IAbCipTagRuntime"/>. Wraps a <see cref="Tag"/>
+///     instance + translates our <see cref="AbCipDataType"/> enum into the
+///     <c>GetInt32</c> / <c>GetFloat32</c> / <c>GetString</c> / <c>GetBit</c> calls libplctag
+///     exposes. One runtime instance per <c>(device, tag path)</c>; lifetime is owned by the
+///     driver's per-device state dict.
+/// </summary>
+internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
+{
+    private readonly Tag _tag;
+
+    public LibplctagTagRuntime(AbCipTagCreateParams p)
+    {
+        _tag = new Tag
+        {
+            Gateway = p.Gateway,
+            Path = p.CipPath,
+            PlcType = MapPlcType(p.LibplctagPlcAttribute),
+            Protocol = Protocol.ab_eip,
+            Name = p.TagName,
+            Timeout = p.Timeout,
+        };
+    }
+
+    public Task InitializeAsync(CancellationToken cancellationToken) => _tag.InitializeAsync(cancellationToken);
+    public Task ReadAsync(CancellationToken cancellationToken) => _tag.ReadAsync(cancellationToken);
+    public Task WriteAsync(CancellationToken cancellationToken) => _tag.WriteAsync(cancellationToken);
+
+    public int GetStatus() => (int)_tag.GetStatus();
+
+    public object? DecodeValue(AbCipDataType type, int? bitIndex) => type switch
+    {
+        AbCipDataType.Bool => bitIndex is int bit
+            ? _tag.GetBit(bit)
+            : _tag.GetInt8(0) != 0,
+        AbCipDataType.SInt => (int)(sbyte)_tag.GetInt8(0),
+        AbCipDataType.USInt => (int)_tag.GetUInt8(0),
+        AbCipDataType.Int => (int)_tag.GetInt16(0),
+        AbCipDataType.UInt => (int)_tag.GetUInt16(0),
+        AbCipDataType.DInt => _tag.GetInt32(0),
+        AbCipDataType.UDInt => (int)_tag.GetUInt32(0),
+        AbCipDataType.LInt => _tag.GetInt64(0),
+        AbCipDataType.ULInt => (long)_tag.GetUInt64(0),
+        AbCipDataType.Real => _tag.GetFloat32(0),
+        AbCipDataType.LReal => _tag.GetFloat64(0),
+        AbCipDataType.String => _tag.GetString(0),
+        AbCipDataType.Dt => _tag.GetInt32(0), // seconds-since-epoch DINT; consumer widens as needed
+        AbCipDataType.Structure => null,       // UDT whole-tag decode lands in PR 6
+        _ => null,
+    };
+
+    public void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+    {
+        switch (type)
+        {
+            case AbCipDataType.Bool:
+                if (bitIndex is int bit)
+                {
+                    // BOOL-within-DINT writes require read-modify-write on the parent DINT.
+                    // Deferred to a follow-up PR — matches the Modbus BitInRegister pattern at
+                    // ModbusDriver.cs:640.
+                    throw new NotSupportedException(
+                        "BOOL-within-DINT writes require read-modify-write; not implemented in PR 4.");
+                }
+                _tag.SetInt8(0, Convert.ToBoolean(value) ? (sbyte)1 : (sbyte)0);
+                break;
+            case AbCipDataType.SInt:
+                _tag.SetInt8(0, Convert.ToSByte(value));
+                break;
+            case AbCipDataType.USInt:
+                _tag.SetUInt8(0, Convert.ToByte(value));
+                break;
+            case AbCipDataType.Int:
+                _tag.SetInt16(0, Convert.ToInt16(value));
+                break;
+            case AbCipDataType.UInt:
+                _tag.SetUInt16(0, Convert.ToUInt16(value));
+                break;
+            case AbCipDataType.DInt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.UDInt:
+                _tag.SetUInt32(0, Convert.ToUInt32(value));
+                break;
+            case AbCipDataType.LInt:
+                _tag.SetInt64(0, Convert.ToInt64(value));
+                break;
+            case AbCipDataType.ULInt:
+                _tag.SetUInt64(0, Convert.ToUInt64(value));
+                break;
+            case AbCipDataType.Real:
+                _tag.SetFloat32(0, Convert.ToSingle(value));
+                break;
+            case AbCipDataType.LReal:
+                _tag.SetFloat64(0, Convert.ToDouble(value));
+                break;
+            case AbCipDataType.String:
+                _tag.SetString(0, Convert.ToString(value) ?? string.Empty);
+                break;
+            case AbCipDataType.Dt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.Structure:
+                throw new NotSupportedException("Whole-UDT writes land in PR 6.");
+            default:
+                throw new NotSupportedException($"AbCipDataType {type} not writable.");
+        }
+    }
+
+    public void Dispose() => _tag.Dispose();
+
+    private static PlcType MapPlcType(string attribute) => attribute switch
+    {
+        "controllogix" => PlcType.ControlLogix,
+        "compactlogix" => PlcType.ControlLogix, // libplctag treats CompactLogix under ControlLogix family
+        "micro800" => PlcType.Micro800,
+        "micrologix" => PlcType.MicroLogix,
+        "slc500" => PlcType.Slc500,
+        "plc5" => PlcType.Plc5,
+        "omron-njnx" => PlcType.Omron,
+        _ => PlcType.ControlLogix,
+    };
+}
+
+/// <summary>
+///     Default <see cref="IAbCipTagFactory"/> — creates a fresh <see cref="LibplctagTagRuntime"/>
+///     per call. Stateless; safe to share across devices.
+/// </summary>
+internal sealed class LibplctagTagFactory : IAbCipTagFactory
+{
+    public IAbCipTagRuntime Create(AbCipTagCreateParams createParams) =>
+        new LibplctagTagRuntime(createParams);
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbCipReadSmokeTests.cs

@@ -0,0 +1,44 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
+
+/// <summary>
+///     End-to-end smoke tests that exercise the real libplctag stack against a running
+///     <c>ab_server</c>. Skipped when the binary isn't on PATH (<see cref="AbServerFactAttribute"/>).
+/// </summary>
+/// <remarks>
+///     Intentionally minimal — per-family + per-capability coverage ships in PRs 9–12 once the
+///     integration harness is CI-ready. This file exists at PR 3 time to prove the wire path
+///     works end-to-end on developer boxes that have <c>ab_server</c>.
+/// </remarks>
+[Trait("Category", "Integration")]
+[Trait("Requires", "AbServer")]
+public sealed class AbCipReadSmokeTests : IAsyncLifetime
+{
+    private readonly AbServerFixture _fixture = new();
+
+    public async ValueTask InitializeAsync() => await _fixture.InitializeAsync();
+    public async ValueTask DisposeAsync() => await _fixture.DisposeAsync();
+
+    [AbServerFact]
+    public async Task Driver_reads_DInt_from_ab_server()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions($"ab://127.0.0.1:{_fixture.Port}/1,0", AbCipPlcFamily.ControlLogix)],
+            Tags = [new AbCipTagDefinition("Counter", $"ab://127.0.0.1:{_fixture.Port}/1,0", "TestDINT", AbCipDataType.DInt)],
+            Timeout = TimeSpan.FromSeconds(5),
+        }, "drv-smoke");
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        var snapshots = await drv.ReadAsync(["Counter"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        drv.GetHealth().State.ShouldBe(DriverState.Healthy);
+
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerFixture.cs

@@ -0,0 +1,109 @@
+using System.Diagnostics;
+using Xunit;
+using Xunit.Sdk;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
+
+/// <summary>
+///     Shared fixture that starts libplctag's <c>ab_server</c> simulator in the background for
+///     the duration of an integration test collection. Binary is expected on PATH; the per-test
+///     JSON profile is passed via <c>--config</c>.
+/// </summary>
+/// <remarks>
+///     <para><c>ab_server</c> is a C binary shipped in the same repo as libplctag (see
+///     <c>test-data-sources.md</c> §2 and plan decision #99). On a developer workstation it's
+///     built once from source and placed on PATH; in CI we intend to publish a prebuilt Windows
+///     x64 binary as a GitHub release asset in a follow-up PR so the fixture can download +
+///     extract it at setup time. Until then every test in this project is skipped when
+///     <c>ab_server</c> is not locatable.</para>
+///
+///     <para>Per-family JSON profiles (ControlLogix / CompactLogix / Micro800 / GuardLogix)
+///     ship under <c>Profiles/</c> and drive the simulator's tag shape — this is where the
+///     UDT + Program-scope coverage gap will be filled by the hand-rolled stub in PR 6.</para>
+/// </remarks>
+public sealed class AbServerFixture : IAsyncLifetime
+{
+    private Process? _proc;
+    public int Port { get; } = 44818;
+
+    public bool IsAvailable { get; private set; }
+
+    public ValueTask InitializeAsync() => InitializeAsync(default);
+    public ValueTask DisposeAsync() => DisposeAsync(default);
+
+    public async ValueTask InitializeAsync(CancellationToken cancellationToken)
+    {
+        if (LocateBinary() is not string binary)
+        {
+            IsAvailable = false;
+            return;
+        }
+        IsAvailable = true;
+
+        _proc = new Process
+        {
+            StartInfo = new ProcessStartInfo
+            {
+                FileName = binary,
+                Arguments = $"--port {Port} --plc controllogix",
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+                UseShellExecute = false,
+                CreateNoWindow = true,
+            },
+        };
+        _proc.Start();
+
+        // Give the server a moment to accept its listen socket before tests try to connect.
+        await Task.Delay(500, cancellationToken).ConfigureAwait(false);
+    }
+
+    public ValueTask DisposeAsync(CancellationToken cancellationToken)
+    {
+        try
+        {
+            if (_proc is { HasExited: false })
+            {
+                _proc.Kill(entireProcessTree: true);
+                _proc.WaitForExit(5_000);
+            }
+        }
+        catch { /* best-effort cleanup */ }
+        _proc?.Dispose();
+        return ValueTask.CompletedTask;
+    }
+
+    /// <summary>
+    ///     Locate <c>ab_server</c> on PATH. Returns <c>null</c> when missing — tests that
+    ///     depend on it should use <see cref="AbServerFact"/> so CI runs without the binary
+    ///     simply skip rather than fail.
+    /// </summary>
+    public static string? LocateBinary()
+    {
+        var names = new[] { "ab_server.exe", "ab_server" };
+        var path = Environment.GetEnvironmentVariable("PATH") ?? "";
+        foreach (var dir in path.Split(Path.PathSeparator))
+        {
+            foreach (var name in names)
+            {
+                var candidate = Path.Combine(dir, name);
+                if (File.Exists(candidate)) return candidate;
+            }
+        }
+        return null;
+    }
+}
+
+/// <summary>
+///     <c>[Fact]</c>-equivalent that skips when <c>ab_server</c> is not available on PATH.
+///     Integration tests use this instead of <c>[Fact]</c> so a developer box without
+///     <c>ab_server</c> installed still gets a green run.
+/// </summary>
+public sealed class AbServerFactAttribute : FactAttribute
+{
+    public AbServerFactAttribute()
+    {
+        if (AbServerFixture.LocateBinary() is null)
+            Skip = "ab_server not on PATH; install libplctag test binaries to run.";
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.AbCip\ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverDiscoveryTests.cs

@@ -0,0 +1,278 @@
+using System.Runtime.CompilerServices;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverDiscoveryTests
+{
+    [Fact]
+    public async Task PreDeclared_tags_emit_as_variables_under_device_folder()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0", DeviceName: "Line1-PLC")],
+            Tags =
+            [
+                new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt),
+                new AbCipTagDefinition("Temperature", "ab://10.0.0.5/1,0", "T", AbCipDataType.Real, Writable: false),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "AbCip");
+        builder.Folders.ShouldContain(f => f.BrowseName == "ab://10.0.0.5/1,0" && f.DisplayName == "Line1-PLC");
+        builder.Variables.Count.ShouldBe(2);
+        builder.Variables.Single(v => v.BrowseName == "Speed").Info.SecurityClass.ShouldBe(SecurityClassification.Operate);
+        builder.Variables.Single(v => v.BrowseName == "Temperature").Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    [Fact]
+    public async Task Device_folder_displayname_falls_back_to_host_address()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")], // no DeviceName
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "ab://10.0.0.5/1,0"
+            && f.DisplayName == "ab://10.0.0.5/1,0");
+    }
+
+    [Fact]
+    public async Task PreDeclared_system_tags_are_filtered_out()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("__DEFVAL_X", "ab://10.0.0.5/1,0", "__DEFVAL_X", AbCipDataType.DInt),
+                new AbCipTagDefinition("Routine:SomeRoutine", "ab://10.0.0.5/1,0", "R", AbCipDataType.DInt),
+                new AbCipTagDefinition("UserTag", "ab://10.0.0.5/1,0", "U", AbCipDataType.DInt),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.BrowseName).ShouldBe(["UserTag"]);
+    }
+
+    [Fact]
+    public async Task Tags_for_mismatched_device_are_ignored()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Orphan", "ab://10.0.0.99/1,0", "O", AbCipDataType.DInt)],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_adds_tags_under_Discovered_folder()
+    {
+        var builder = new RecordingBuilder();
+        var enumeratorFactory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("Pressure", null, AbCipDataType.Real, ReadOnly: false),
+            new AbCipDiscoveredTag("StepIndex", ProgramScope: "MainProgram", AbCipDataType.DInt, ReadOnly: false));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: enumeratorFactory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "Discovered");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("Pressure");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("Program:MainProgram.StepIndex");
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_honours_system_tag_hint_and_filter()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("HiddenByHint", null, AbCipDataType.DInt, ReadOnly: false, IsSystemTag: true),
+            new AbCipDiscoveredTag("Routine:Foo", null, AbCipDataType.DInt, ReadOnly: false, IsSystemTag: false),
+            new AbCipDiscoveredTag("KeepMe", null, AbCipDataType.DInt, ReadOnly: false));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.Info.FullName).ShouldBe(["KeepMe"]);
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_ReadOnly_surfaces_ViewOnly_classification()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("SafetyTag", null, AbCipDataType.DInt, ReadOnly: true));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Single().Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_receives_correct_device_params()
+    {
+        var factory = new FakeEnumeratorFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5:44818/1,2,3", AbCipPlcFamily.ControlLogix)],
+            Timeout = TimeSpan.FromSeconds(7),
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(new RecordingBuilder(), CancellationToken.None);
+
+        var capturedParams = factory.LastDeviceParams.ShouldNotBeNull();
+        capturedParams.Gateway.ShouldBe("10.0.0.5");
+        capturedParams.Port.ShouldBe(44818);
+        capturedParams.CipPath.ShouldBe("1,2,3");
+        capturedParams.LibplctagPlcAttribute.ShouldBe("controllogix");
+        capturedParams.TagName.ShouldBe("@tags");
+        capturedParams.Timeout.ShouldBe(TimeSpan.FromSeconds(7));
+    }
+
+    [Fact]
+    public void Default_enumerator_factory_is_used_when_not_injected()
+    {
+        // Sanity — absent enumerator factory does not crash discovery + uses EmptyAbCipTagEnumerator
+        // (covered by the other tests which instantiate without injecting a factory).
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1");
+        drv.ShouldNotBeNull();
+    }
+
+    [Theory]
+    [InlineData("__DEFVAL_X", true)]
+    [InlineData("__DEFAULT_Y", true)]
+    [InlineData("Routine:Main", true)]
+    [InlineData("Task:MainTask", true)]
+    [InlineData("Local:1:I", true)]
+    [InlineData("Map:Alias", true)]
+    [InlineData("Axis:MoveX", true)]
+    [InlineData("Cam:Profile1", true)]
+    [InlineData("MotionGroup:MG0", true)]
+    [InlineData("Motor1", false)]
+    [InlineData("Program:Main.Step", false)]
+    [InlineData("Recipe_2", false)]
+    [InlineData("", true)]
+    [InlineData("   ", true)]
+    public void SystemTagFilter_rejects_infrastructure_names(string name, bool expected)
+    {
+        AbCipSystemTagFilter.IsSystemTag(name).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void TemplateCache_roundtrip_put_get()
+    {
+        var cache = new AbCipTemplateCache();
+        var shape = new AbCipUdtShape("MyUdt", 32,
+        [
+            new AbCipUdtMember("A", 0, AbCipDataType.DInt, ArrayLength: 1),
+            new AbCipUdtMember("B", 4, AbCipDataType.Real, ArrayLength: 1),
+        ]);
+        cache.Put("ab://10.0.0.5/1,0", 42, shape);
+
+        cache.TryGet("ab://10.0.0.5/1,0", 42).ShouldBe(shape);
+        cache.TryGet("ab://10.0.0.5/1,0", 99).ShouldBeNull();
+        cache.Count.ShouldBe(1);
+
+        cache.Clear();
+        cache.Count.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task FlushOptionalCachesAsync_clears_template_cache()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions(), "drv-1");
+        drv.TemplateCache.Put("dev", 1, new AbCipUdtShape("T", 4, []));
+        drv.TemplateCache.Count.ShouldBe(1);
+
+        await drv.FlushOptionalCachesAsync(CancellationToken.None);
+        drv.TemplateCache.Count.ShouldBe(0);
+    }
+
+    // ---- helpers ----
+
+    private sealed class RecordingBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, string DisplayName)> Folders { get; } = new();
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = new();
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName)
+        { Folders.Add((browseName, displayName)); return this; }
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        { Variables.Add((browseName, info)); return new Handle(info.FullName); }
+
+        public void AddProperty(string _, DriverDataType __, object? ___) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+        private sealed class NullSink : IAlarmConditionSink
+        {
+            public void OnTransition(AlarmEventArgs args) { }
+        }
+    }
+
+    private sealed class FakeEnumeratorFactory : IAbCipTagEnumeratorFactory
+    {
+        private readonly AbCipDiscoveredTag[] _tags;
+        public AbCipTagCreateParams? LastDeviceParams { get; private set; }
+        public FakeEnumeratorFactory(params AbCipDiscoveredTag[] tags) => _tags = tags;
+        public IAbCipTagEnumerator Create() => new FakeEnumerator(this);
+
+        private sealed class FakeEnumerator(FakeEnumeratorFactory outer) : IAbCipTagEnumerator
+        {
+            public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+                AbCipTagCreateParams deviceParams,
+                [EnumeratorCancellation] CancellationToken cancellationToken)
+            {
+                outer.LastDeviceParams = deviceParams;
+                await Task.CompletedTask;
+                foreach (var t in outer._tags) yield return t;
+            }
+            public void Dispose() { }
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverReadTests.cs

@@ -0,0 +1,214 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverReadTests
+{
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    [Fact]
+    public async Task Unknown_reference_maps_to_BadNodeIdUnknown()
+    {
+        var (drv, _) = NewDriver();
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["does-not-exist"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        snapshots.Single().Value.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task Tag_on_unknown_device_maps_to_BadNodeIdUnknown()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Orphan", "ab://10.0.0.99/1,0", "Tag1", AbCipDataType.DInt)],
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["Orphan"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Successful_DInt_read_returns_Good_with_value()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        // Customise the fake before the first read so the tag returns 4200.
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 4200 };
+
+        var snapshots = await drv.ReadAsync(["Speed"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        snapshots.Single().Value.ShouldBe(4200);
+        factory.Tags["Motor1.Speed"].InitializeCount.ShouldBe(1);
+        factory.Tags["Motor1.Speed"].ReadCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Repeat_read_reuses_runtime_without_reinitialise()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+
+        await drv.ReadAsync(["Speed"], CancellationToken.None);
+        await drv.ReadAsync(["Speed"], CancellationToken.None);
+        await drv.ReadAsync(["Speed"], CancellationToken.None);
+
+        factory.Tags["Motor1.Speed"].InitializeCount.ShouldBe(1); // lazy init happens once
+        factory.Tags["Motor1.Speed"].ReadCount.ShouldBe(3);
+    }
+
+    [Fact]
+    public async Task NonZero_libplctag_status_maps_via_AbCipStatusMapper()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Ghost", "ab://10.0.0.5/1,0", "Missing.Tag", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Status = -14 /* PLCTAG_ERR_NOT_FOUND */ };
+
+        var snapshots = await drv.ReadAsync(["Ghost"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        snapshots.Single().Value.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task Exception_during_read_surfaces_BadCommunicationError()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.Real));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { ThrowOnRead = true };
+
+        var snapshots = await drv.ReadAsync(["Broken"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
+        snapshots.Single().Value.ShouldBeNull();
+        drv.GetHealth().State.ShouldBe(DriverState.Degraded);
+    }
+
+    [Fact]
+    public async Task Batched_reads_preserve_order_and_per_tag_status()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+            new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.Real),
+            new AbCipTagDefinition("C", "ab://10.0.0.5/1,0", "C", AbCipDataType.String));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => p.TagName switch
+        {
+            "A" => new FakeAbCipTag(p) { Value = 42 },
+            "B" => new FakeAbCipTag(p) { Value = 3.14f },
+            _ => new FakeAbCipTag(p) { Value = "hello" },
+        };
+
+        var snapshots = await drv.ReadAsync(["A", "B", "C"], CancellationToken.None);
+
+        snapshots.Count.ShouldBe(3);
+        snapshots[0].Value.ShouldBe(42);
+        snapshots[1].Value.ShouldBe(3.14f);
+        snapshots[2].Value.ShouldBe("hello");
+        snapshots.ShouldAllBe(s => s.StatusCode == AbCipStatusMapper.Good);
+    }
+
+    [Fact]
+    public async Task Successful_read_marks_health_Healthy()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Pressure", "ab://10.0.0.5/1,0", "PT_101", AbCipDataType.Real));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 14.7f };
+
+        await drv.ReadAsync(["Pressure"], CancellationToken.None);
+        drv.GetHealth().State.ShouldBe(DriverState.Healthy);
+        drv.GetHealth().LastSuccessfulRead.ShouldNotBeNull();
+    }
+
+    [Fact]
+    public async Task TagCreateParams_are_built_from_device_and_profile()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Counter", "ab://10.0.0.5/1,0", "Program:P.Counter", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.ReadAsync(["Counter"], CancellationToken.None);
+
+        var p = factory.Tags["Program:P.Counter"].CreationParams;
+        p.Gateway.ShouldBe("10.0.0.5");
+        p.Port.ShouldBe(44818);
+        p.CipPath.ShouldBe("1,0");
+        p.LibplctagPlcAttribute.ShouldBe("controllogix");
+        p.TagName.ShouldBe("Program:P.Counter");
+    }
+
+    [Fact]
+    public async Task Cancellation_propagates_from_read()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Slow", "ab://10.0.0.5/1,0", "Slow", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p)
+        {
+            ThrowOnRead = true,
+            Exception = new OperationCanceledException(),
+        };
+
+        using var cts = new CancellationTokenSource();
+        await Should.ThrowAsync<OperationCanceledException>(
+            () => drv.ReadAsync(["Slow"], cts.Token));
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_disposes_each_tag_runtime()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+            new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+        await drv.ReadAsync(["A", "B"], CancellationToken.None);
+
+        await drv.ShutdownAsync(CancellationToken.None);
+
+        factory.Tags["A"].Disposed.ShouldBeTrue();
+        factory.Tags["B"].Disposed.ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task Initialize_failure_disposes_tag_and_surfaces_communication_error()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("DoomedTag", "ab://10.0.0.5/1,0", "Nope", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { ThrowOnInitialize = true };
+
+        var snapshots = await drv.ReadAsync(["DoomedTag"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
+        factory.Tags["Nope"].Disposed.ShouldBeTrue();
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverWriteTests.cs

@@ -0,0 +1,230 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverWriteTests
+{
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+        }, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    [Fact]
+    public async Task Unknown_reference_maps_to_BadNodeIdUnknown()
+    {
+        var (drv, _) = NewDriver();
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("does-not-exist", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Non_writable_tag_maps_to_BadNotWritable()
+    {
+        var (drv, _) = NewDriver(
+            new AbCipTagDefinition("ReadOnly", "ab://10.0.0.5/1,0", "RO", AbCipDataType.DInt, Writable: false));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("ReadOnly", 7)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+    }
+
+    [Fact]
+    public async Task Successful_DInt_write_encodes_and_flushes()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Speed", 4200)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        factory.Tags["Motor1.Speed"].Value.ShouldBe(4200);
+        factory.Tags["Motor1.Speed"].WriteCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Bit_in_dint_write_returns_BadNotSupported()
+    {
+        var factory = new FakeAbCipTagFactory { Customise = p => new ThrowingBoolBitFake(p) };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Flag3", "ab://10.0.0.5/1,0", "Flags.3", AbCipDataType.Bool)],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Flag3", true)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotSupported);
+    }
+
+    [Fact]
+    public async Task Non_zero_libplctag_status_after_write_maps_via_AbCipStatusMapper()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Status = -5 /* timeout */ };
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Broken", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadTimeout);
+    }
+
+    [Fact]
+    public async Task Type_mismatch_surfaces_BadTypeMismatch()
+    {
+        var (drv, _) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        // Force a FormatException inside Convert.ToInt32 via a runtime that forwards to real Convert.
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new RealConvertFake(p),
+        };
+        var drv2 = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt)],
+        }, "drv-2", factory);
+        await drv2.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv2.WriteAsync(
+            [new WriteRequest("Speed", "not-a-number")], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadTypeMismatch);
+    }
+
+    [Fact]
+    public async Task Overflow_surfaces_BadOutOfRange()
+    {
+        var factory = new FakeAbCipTagFactory { Customise = p => new RealConvertFake(p) };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Narrow", "ab://10.0.0.5/1,0", "N", AbCipDataType.Int)],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Narrow", 1_000_000)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadOutOfRange);
+    }
+
+    [Fact]
+    public async Task Exception_during_write_surfaces_BadCommunicationError()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new ThrowOnWriteFake(p);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Broken", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
+        drv.GetHealth().State.ShouldBe(DriverState.Degraded);
+    }
+
+    [Fact]
+    public async Task Batch_preserves_order_across_success_and_failure()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.DInt, Writable: false),
+                new AbCipTagDefinition("C", "ab://10.0.0.5/1,0", "C", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("A", 1),
+            new WriteRequest("B", 2),
+            new WriteRequest("UnknownTag", 3),
+            new WriteRequest("C", 4),
+        ], CancellationToken.None);
+
+        results.Count.ShouldBe(4);
+        results[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+        results[2].StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        results[3].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+    }
+
+    [Fact]
+    public async Task Cancellation_propagates_from_write()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Slow", "ab://10.0.0.5/1,0", "Slow", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new CancelOnWriteFake(p);
+
+        await Should.ThrowAsync<OperationCanceledException>(
+            () => drv.WriteAsync([new WriteRequest("Slow", 1)], CancellationToken.None));
+    }
+
+    // ---- test-fake variants that exercise the real type / error handling ----
+
+    private sealed class RealConvertFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+        {
+            switch (type)
+            {
+                case AbCipDataType.Int: _ = Convert.ToInt16(value); break;
+                case AbCipDataType.DInt: _ = Convert.ToInt32(value); break;
+                default: _ = Convert.ToInt32(value); break;
+            }
+            Value = value;
+        }
+    }
+
+    private sealed class ThrowingBoolBitFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+        {
+            if (type == AbCipDataType.Bool && bitIndex is not null)
+                throw new NotSupportedException("bit-in-DINT deferred");
+            Value = value;
+        }
+    }
+
+    private sealed class ThrowOnWriteFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override Task WriteAsync(CancellationToken ct) =>
+            Task.FromException(new InvalidOperationException("wire dropped"));
+    }
+
+    private sealed class CancelOnWriteFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override Task WriteAsync(CancellationToken ct) =>
+            Task.FromException(new OperationCanceledException());
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipSubscriptionTests.cs

@@ -0,0 +1,184 @@
+using System.Collections.Concurrent;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipSubscriptionTests
+{
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+        }, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    [Fact]
+    public async Task Initial_poll_raises_OnDataChange_for_every_tag()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt),
+            new AbCipTagDefinition("Temp", "ab://10.0.0.5/1,0", "Temp", AbCipDataType.Real));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => p.TagName switch
+        {
+            "Speed" => new FakeAbCipTag(p) { Value = 1800 },
+            "Temp" => new FakeAbCipTag(p) { Value = 72.5f },
+            _ => new FakeAbCipTag(p),
+        };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed", "Temp"], TimeSpan.FromMilliseconds(200), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 2, TimeSpan.FromSeconds(2));
+
+        events.Select(e => e.FullReference).ShouldContain("Speed");
+        events.Select(e => e.FullReference).ShouldContain("Temp");
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task Unchanged_value_raises_only_once()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1800 };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await Task.Delay(500);
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+
+        events.Count.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Value_change_between_polls_raises_OnDataChange()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        var tagRef = new FakeAbCipTag(new AbCipTagCreateParams("10.0.0.5", 44818, "1,0", "controllogix", "Speed", TimeSpan.FromSeconds(2))) { Value = 100 };
+        factory.Customise = _ => tagRef;
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(1));
+        tagRef.Value = 200; // simulate PLC change
+        await WaitForAsync(() => events.Count >= 2, TimeSpan.FromSeconds(2));
+
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+        events.Count.ShouldBeGreaterThanOrEqualTo(2);
+        events.Last().Snapshot.Value.ShouldBe(200);
+    }
+
+    [Fact]
+    public async Task Unsubscribe_halts_polling()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        var tagRef = new FakeAbCipTag(new AbCipTagCreateParams("10.0.0.5", 44818, "1,0", "controllogix", "Speed", TimeSpan.FromSeconds(2))) { Value = 1 };
+        factory.Customise = _ => tagRef;
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(1));
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+
+        var afterUnsub = events.Count;
+        tagRef.Value = 999;
+        await Task.Delay(400);
+        events.Count.ShouldBe(afterUnsub);
+    }
+
+    [Fact]
+    public async Task Interval_below_100ms_is_floored()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(5), CancellationToken.None);
+        await Task.Delay(300);
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+
+        // Value is stable → only the initial-data push fires; the 100 ms floor keeps polls sparse enough
+        // that no extra event is produced against a stable value.
+        events.Count.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_cancels_active_subscriptions()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 1 };
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        _ = await drv.SubscribeAsync(["Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(1));
+        await drv.ShutdownAsync(CancellationToken.None);
+
+        var afterShutdown = events.Count;
+        await Task.Delay(300);
+        events.Count.ShouldBe(afterShutdown);
+    }
+
+    [Fact]
+    public async Task Subscription_on_UDT_member_uses_synthesised_full_reference()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members: [new AbCipStructureMember("Speed", AbCipDataType.DInt)]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => p.TagName == "Motor1.Speed"
+            ? new FakeAbCipTag(p) { Value = 77 }
+            : new FakeAbCipTag(p);
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["Motor1.Speed"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(2));
+
+        events.First().Snapshot.Value.ShouldBe(77);
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+    }
+
+    private static async Task WaitForAsync(Func<bool> condition, TimeSpan timeout)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (!condition() && DateTime.UtcNow < deadline)
+            await Task.Delay(20);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipUdtMemberTests.cs

@@ -0,0 +1,217 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipUdtMemberTests
+{
+    [Fact]
+    public async Task UDT_with_declared_members_fans_out_to_member_variables()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition(
+                    Name: "Motor1",
+                    DeviceHostAddress: "ab://10.0.0.5/1,0",
+                    TagPath: "Motor1",
+                    DataType: AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Speed", AbCipDataType.DInt),
+                        new AbCipStructureMember("Running", AbCipDataType.Bool, Writable: false),
+                        new AbCipStructureMember("SetPoint", AbCipDataType.Real, WriteIdempotent: true),
+                    ]),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "Motor1");
+        var variables = builder.Variables.Select(v => (v.BrowseName, v.Info.FullName)).ToList();
+        variables.ShouldContain(("Speed", "Motor1.Speed"));
+        variables.ShouldContain(("Running", "Motor1.Running"));
+        variables.ShouldContain(("SetPoint", "Motor1.SetPoint"));
+
+        builder.Variables.Single(v => v.BrowseName == "Running").Info.SecurityClass
+            .ShouldBe(SecurityClassification.ViewOnly);
+        builder.Variables.Single(v => v.BrowseName == "SetPoint").Info.WriteIdempotent
+            .ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task UDT_members_resolvable_for_read_via_synthesised_full_reference()
+    {
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => p.TagName switch
+            {
+                "Motor1.Speed" => new FakeAbCipTag(p) { Value = 1800 },
+                "Motor1.Running" => new FakeAbCipTag(p) { Value = true },
+                _ => new FakeAbCipTag(p),
+            },
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Speed", AbCipDataType.DInt),
+                        new AbCipStructureMember("Running", AbCipDataType.Bool),
+                    ]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["Motor1.Speed", "Motor1.Running"], CancellationToken.None);
+
+        snapshots[0].Value.ShouldBe(1800);
+        snapshots[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        snapshots[1].Value.ShouldBe(true);
+        snapshots[1].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+    }
+
+    [Fact]
+    public async Task UDT_member_write_routes_through_synthesised_tagpath()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("SetPoint", AbCipDataType.Real),
+                    ]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Motor1.SetPoint", 42.5f)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        factory.Tags["Motor1.SetPoint"].Value.ShouldBe(42.5f);
+    }
+
+    [Fact]
+    public async Task UDT_member_read_write_honours_member_Writable_flag()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Status", AbCipDataType.DInt, Writable: false),
+                    ]),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Motor1.Status", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+    }
+
+    [Fact]
+    public async Task Structure_tag_without_members_is_emitted_as_single_variable()
+    {
+        // Fallback path: a Structure tag with no declared Members still appears as a Variable so
+        // downstream configuration can address it manually. This matches the "black box" note in
+        // AbCipTagDefinition's docstring.
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("OpaqueUdt", "ab://10.0.0.5/1,0", "OpaqueUdt", AbCipDataType.Structure)],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.ShouldContain(v => v.BrowseName == "OpaqueUdt");
+        builder.Folders.ShouldNotContain(f => f.BrowseName == "OpaqueUdt");
+    }
+
+    [Fact]
+    public async Task Empty_Members_list_is_treated_like_null()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("EmptyUdt", "ab://10.0.0.5/1,0", "E", AbCipDataType.Structure, Members: [])],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldNotContain(f => f.BrowseName == "EmptyUdt");
+        builder.Variables.ShouldContain(v => v.BrowseName == "EmptyUdt");
+    }
+
+    [Fact]
+    public async Task UDT_members_mixed_with_flat_tags_coexist()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("FlatA", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("Motor1", "ab://10.0.0.5/1,0", "Motor1", AbCipDataType.Structure,
+                    Members:
+                    [
+                        new AbCipStructureMember("Speed", AbCipDataType.DInt),
+                    ]),
+                new AbCipTagDefinition("FlatB", "ab://10.0.0.5/1,0", "B", AbCipDataType.Real),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.BrowseName).ShouldBe(["FlatA", "Speed", "FlatB"], ignoreOrder: true);
+    }
+
+    // ---- helpers ----
+
+    private sealed class RecordingBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, string DisplayName)> Folders { get; } = new();
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = new();
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName)
+        { Folders.Add((browseName, displayName)); return this; }
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        { Variables.Add((browseName, info)); return new Handle(info.FullName); }
+
+        public void AddProperty(string _, DriverDataType __, object? ___) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+        private sealed class NullSink : IAlarmConditionSink { public void OnTransition(AlarmEventArgs args) { } }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/FakeAbCipTag.cs

@@ -0,0 +1,67 @@
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+/// <summary>
+///     Test fake for <see cref="IAbCipTagRuntime"/>. Stores the mock PLC value in
+///     <see cref="Value"/> + returns it from <see cref="DecodeValue"/>. Use
+///     <see cref="Status"/> to simulate libplctag error codes,
+///     <see cref="ThrowOnInitialize"/> / <see cref="ThrowOnRead"/> to simulate exceptions.
+/// </summary>
+internal class FakeAbCipTag : IAbCipTagRuntime
+{
+    public AbCipTagCreateParams CreationParams { get; }
+    public object? Value { get; set; }
+    public int Status { get; set; }
+    public bool ThrowOnInitialize { get; set; }
+    public bool ThrowOnRead { get; set; }
+    public Exception? Exception { get; set; }
+    public int InitializeCount { get; private set; }
+    public int ReadCount { get; private set; }
+    public int WriteCount { get; private set; }
+    public bool Disposed { get; private set; }
+
+    public FakeAbCipTag(AbCipTagCreateParams createParams) => CreationParams = createParams;
+
+    public virtual Task InitializeAsync(CancellationToken cancellationToken)
+    {
+        InitializeCount++;
+        if (ThrowOnInitialize) throw Exception ?? new InvalidOperationException("fake initialize failure");
+        return Task.CompletedTask;
+    }
+
+    public virtual Task ReadAsync(CancellationToken cancellationToken)
+    {
+        ReadCount++;
+        if (ThrowOnRead) throw Exception ?? new InvalidOperationException("fake read failure");
+        return Task.CompletedTask;
+    }
+
+    public virtual Task WriteAsync(CancellationToken cancellationToken)
+    {
+        WriteCount++;
+        return Task.CompletedTask;
+    }
+
+    public virtual int GetStatus() => Status;
+
+    public virtual object? DecodeValue(AbCipDataType type, int? bitIndex) => Value;
+
+    public virtual void EncodeValue(AbCipDataType type, int? bitIndex, object? value) => Value = value;
+
+    public virtual void Dispose() => Disposed = true;
+}
+
+/// <summary>Test factory that produces <see cref="FakeAbCipTag"/>s and indexes them for assertion.</summary>
+internal sealed class FakeAbCipTagFactory : IAbCipTagFactory
+{
+    public Dictionary<string, FakeAbCipTag> Tags { get; } = new(StringComparer.OrdinalIgnoreCase);
+    public Func<AbCipTagCreateParams, FakeAbCipTag>? Customise { get; set; }
+
+    public IAbCipTagRuntime Create(AbCipTagCreateParams createParams)
+    {
+        var fake = Customise?.Invoke(createParams) ?? new FakeAbCipTag(createParams);
+        Tags[createParams.TagName] = fake;
+        return fake;
+    }
+}