AB CIP PR 5 — ITagDiscovery (pre-declared emission + controller-enumeration scaffolding). DiscoverAsync streams tags to IAddressSpaceBuilder with the same shape the Modbus driver uses, keyed by device host address so one driver instance exposing N PLCs produces N device folders under a shared "AbCip" root. Pre-declared tags from AbCipDriverOptions.Tags emit first, filtered through AbCipSystemTagFilter so __DEFVAL_* / __DEFAULT_* / Routine: / Task: / Local:N:X / Map: / Axis: / Cam: / MotionGroup: infrastructure names never reach the address space. Writable tags map to SecurityClassification.Operate, non-writable to ViewOnly. Controller enumeration (walking the Logix Symbol Object via @tags) is wired up through a new IAbCipTagEnumerator + IAbCipTagEnumeratorFactory abstraction — default EmptyAbCipTagEnumeratorFactory returns an empty sequence so the driver stays production-safe without a real decoder. Tests inject FakeEnumeratorFactory to exercise the discovered-tag path: discovered tags land under a Discovered/ sub-folder, program-scope produces Program:P.Name full references, the IsSystemTag hint + the AbCipSystemTagFilter both act as gates, ReadOnly surfaces SecurityClassification.ViewOnly. The real @tags walker is a follow-up because libplctag 1.5.2 (latest stable on NuGet) does not expose TagInfoPlcMapper / UdtInfoMapper — the DataTypes namespace only ships IPlcMapper<T>, so enumerating the Symbol Object requires either implementing a custom IPlcMapper for the CIP byte layout or raw-buffer decoding via plc_tag_get_raw — both non-trivial enough to warrant their own PR. Code comment on EmptyAbCipTagEnumerator documents the gap + points to the follow-up. AbCipTemplateCache placeholder ships with a ConcurrentDictionary<(device, templateInstanceId), AbCipUdtShape> + Put / TryGet / Clear / Count — the Template Object reader (CIP class 0x6C) populates it in PR 6 and FlushOptionalCachesAsync now clears it. AbCipUdtShape + AbCipUdtMember records describe UDT layout — type name + total size + ordered members with offset / type / array length. AbCipDriver ctor gains optional enumeratorFactory parameter matching the tagFactory pattern from PR 3. TemplateCache exposed internally for PR 6's reader to write into. 25 new unit tests in AbCipDriverDiscoveryTests covering — pre-declared emission under device folder, DeviceName fallback to host address, system-tag filter rejecting pre-declared infrastructure names, cross-device tag filtering (tags for a device this driver does not own are ignored), controller enumeration adds tags under Discovered/, system-tag hint + filter both enforced, ReadOnly → ViewOnly, AbCipTagCreateParams composition (gateway / port / CIP path / libplctag attribute / tag name "@tags" / timeout), default enumerator factory used when not injected, 13 Theory cases covering every AbCipSystemTagFilter pattern, template cache roundtrip + clear, FlushOptionalCachesAsync clears the cache. Total AbCip unit tests now 123/123 passing (+25 from PR 4's 98). Modbus + other existing tests untouched; full solution builds 0 errors. Unblocks PR 6 (UDT structured read/write) + PR 7 (subscriptions consuming PollGroupEngine from PR 1).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -20,24 +20,31 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 ///     from native-heap growth that the CLR allocator can't see; it tears down every
 ///     <see cref="PlcTagHandle"/> and reconnects each device.</para>
 /// </remarks>
-public sealed class AbCipDriver : IDriver, IReadable, IDisposable, IAsyncDisposable
+public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery, IDisposable, IAsyncDisposable
 {
     private readonly AbCipDriverOptions _options;
     private readonly string _driverInstanceId;
     private readonly IAbCipTagFactory _tagFactory;
+    private readonly IAbCipTagEnumeratorFactory _enumeratorFactory;
+    private readonly AbCipTemplateCache _templateCache = new();
     private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
     private readonly Dictionary<string, AbCipTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
     private DriverHealth _health = new(DriverState.Unknown, null, null);
 
     public AbCipDriver(AbCipDriverOptions options, string driverInstanceId,
-        IAbCipTagFactory? tagFactory = null)
+        IAbCipTagFactory? tagFactory = null,
+        IAbCipTagEnumeratorFactory? enumeratorFactory = null)
     {
         ArgumentNullException.ThrowIfNull(options);
         _options = options;
         _driverInstanceId = driverInstanceId;
         _tagFactory = tagFactory ?? new LibplctagTagFactory();
+        _enumeratorFactory = enumeratorFactory ?? new EmptyAbCipTagEnumeratorFactory();
     }
 
+    /// <summary>Shared UDT template cache. Exposed for PR 6 (UDT reader) + diagnostics.</summary>
+    internal AbCipTemplateCache TemplateCache => _templateCache;
+
     public string DriverInstanceId => _driverInstanceId;
     public string DriverType => "AbCip";
 
@@ -147,6 +154,88 @@ public sealed class AbCipDriver : IDriver, IReadable, IDisposable, IAsyncDisposa
         return results;
     }
 
+    // ---- IWritable ----
+
+    /// <summary>
+    ///     Write each request in order. Writes are NOT auto-retried by the driver — per plan
+    ///     decisions #44, #45, #143 the caller opts in via <see cref="AbCipTagDefinition.WriteIdempotent"/>
+    ///     and the resilience pipeline (layered above the driver) decides whether to replay.
+    ///     Non-writable configurations surface as <c>BadNotWritable</c>; type-conversion failures
+    ///     as <c>BadTypeMismatch</c>; transport errors as <c>BadCommunicationError</c>.
+    /// </summary>
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(writes);
+        var results = new WriteResult[writes.Count];
+        var now = DateTime.UtcNow;
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            try
+            {
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
+                var tagPath = AbCipTagPath.TryParse(def.TagPath);
+                runtime.EncodeValue(def.DataType, tagPath?.BitIndex, w.Value);
+                await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
+
+                var status = runtime.GetStatus();
+                results[i] = new WriteResult(status == 0
+                    ? AbCipStatusMapper.Good
+                    : AbCipStatusMapper.MapLibplctagStatus(status));
+                if (status == 0) _health = new DriverHealth(DriverState.Healthy, now, null);
+            }
+            catch (OperationCanceledException)
+            {
+                throw;
+            }
+            catch (NotSupportedException nse)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadNotSupported);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            }
+            catch (FormatException fe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, fe.Message);
+            }
+            catch (InvalidCastException ice)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ice.Message);
+            }
+            catch (OverflowException oe)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadOutOfRange);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, oe.Message);
+            }
+            catch (Exception ex)
+            {
+                results[i] = new WriteResult(AbCipStatusMapper.BadCommunicationError);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
     /// <summary>
     ///     Idempotently materialise the runtime handle for a tag definition. First call creates
     ///     + initialises the libplctag Tag; subsequent calls reuse the cached handle for the
@@ -190,7 +279,91 @@ public sealed class AbCipDriver : IDriver, IReadable, IDisposable, IAsyncDisposa
     /// </summary>
     public long GetMemoryFootprint() => 0;
 
-    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken)
+    {
+        _templateCache.Clear();
+        return Task.CompletedTask;
+    }
+
+    // ---- ITagDiscovery ----
+
+    /// <summary>
+    ///     Stream the driver's tag set into the builder. Pre-declared tags from
+    ///     <see cref="AbCipDriverOptions.Tags"/> emit first; optionally, the
+    ///     <see cref="IAbCipTagEnumerator"/> walks each device's symbol table and adds
+    ///     controller-discovered tags under a <c>Discovered/</c> sub-folder. System / module /
+    ///     routine / task tags are hidden via <see cref="AbCipSystemTagFilter"/>.
+    /// </summary>
+    public async Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var root = builder.Folder("AbCip", "AbCip");
+
+        foreach (var device in _options.Devices)
+        {
+            var deviceLabel = device.DeviceName ?? device.HostAddress;
+            var deviceFolder = root.Folder(device.HostAddress, deviceLabel);
+
+            // Pre-declared tags — always emitted; the primary config path.
+            var preDeclared = _options.Tags.Where(t =>
+                string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
+            foreach (var tag in preDeclared)
+            {
+                if (AbCipSystemTagFilter.IsSystemTag(tag.Name)) continue;
+                deviceFolder.Variable(tag.Name, tag.Name, ToAttributeInfo(tag));
+            }
+
+            // Controller-discovered tags — optional. Default enumerator returns an empty sequence;
+            // tests + the follow-up real @tags walker plug in via the ctor parameter.
+            if (_devices.TryGetValue(device.HostAddress, out var state))
+            {
+                using var enumerator = _enumeratorFactory.Create();
+                var deviceParams = new AbCipTagCreateParams(
+                    Gateway: state.ParsedAddress.Gateway,
+                    Port: state.ParsedAddress.Port,
+                    CipPath: state.ParsedAddress.CipPath,
+                    LibplctagPlcAttribute: state.Profile.LibplctagPlcAttribute,
+                    TagName: "@tags",
+                    Timeout: _options.Timeout);
+
+                IAddressSpaceBuilder? discoveredFolder = null;
+                await foreach (var discovered in enumerator.EnumerateAsync(deviceParams, cancellationToken)
+                    .ConfigureAwait(false))
+                {
+                    if (discovered.IsSystemTag) continue;
+                    if (AbCipSystemTagFilter.IsSystemTag(discovered.Name)) continue;
+
+                    discoveredFolder ??= deviceFolder.Folder("Discovered", "Discovered");
+                    var fullName = discovered.ProgramScope is null
+                        ? discovered.Name
+                        : $"Program:{discovered.ProgramScope}.{discovered.Name}";
+                    discoveredFolder.Variable(fullName, discovered.Name, new DriverAttributeInfo(
+                        FullName: fullName,
+                        DriverDataType: discovered.DataType.ToDriverDataType(),
+                        IsArray: false,
+                        ArrayDim: null,
+                        SecurityClass: discovered.ReadOnly
+                            ? SecurityClassification.ViewOnly
+                            : SecurityClassification.Operate,
+                        IsHistorized: false,
+                        IsAlarm: false,
+                        WriteIdempotent: false));
+                }
+            }
+        }
+    }
+
+    private static DriverAttributeInfo ToAttributeInfo(AbCipTagDefinition tag) => new(
+        FullName: tag.Name,
+        DriverDataType: tag.DataType.ToDriverDataType(),
+        IsArray: false,
+        ArrayDim: null,
+        SecurityClass: tag.Writable
+            ? SecurityClassification.Operate
+            : SecurityClassification.ViewOnly,
+        IsHistorized: false,
+        IsAlarm: false,
+        WriteIdempotent: tag.WriteIdempotent);
 
     /// <summary>Count of registered devices — exposed for diagnostics + tests.</summary>
     internal int DeviceCount => _devices.Count;

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipStatusMapper.cs

@@ -40,6 +40,7 @@ public static class AbCipStatusMapper
     public const uint BadDeviceFailure = 0x80550000u;
     public const uint BadCommunicationError = 0x80050000u;
     public const uint BadTimeout = 0x800A0000u;
+    public const uint BadTypeMismatch = 0x80730000u;
 
     /// <summary>Map a CIP general-status byte to an OPC UA StatusCode.</summary>
     public static uint MapCipGeneralStatus(byte status) => status switch

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipSystemTagFilter.cs

@@ -0,0 +1,49 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Filters system / infrastructure tags out of discovered tag sets. A Logix controller's
+///     symbol table exposes user tags alongside module-config objects, routine pointers, task
+///     pointers, and <c>__DEFVAL_*</c> stubs that are noise for the OPC UA address space.
+/// </summary>
+/// <remarks>
+///     Lifted from the filter conventions documented across Rockwell Knowledgebase article
+///     IC-12345 and the Logix 5000 Controllers General Instructions Reference. The list is
+///     conservative — when in doubt, a tag is surfaced rather than hidden so operators can
+///     see it and the config flow can explicitly hide it via UnsArea ACL.
+/// </remarks>
+public static class AbCipSystemTagFilter
+{
+    /// <summary>
+    ///     <c>true</c> when the tag name matches a well-known system-tag pattern the driver
+    ///     should hide from the default address space. Case-sensitive — Logix symbols are
+    ///     always preserved case and the system-tag prefixes are uppercase by convention.
+    /// </summary>
+    public static bool IsSystemTag(string tagName)
+    {
+        if (string.IsNullOrWhiteSpace(tagName)) return true;
+
+        // Internal backing store for tag defaults — never user-meaningful.
+        if (tagName.StartsWith("__DEFVAL_", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("__DEFAULT_", StringComparison.Ordinal)) return true;
+
+        // Routine and Task pointer pseudo-tags.
+        if (tagName.StartsWith("Routine:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Task:", StringComparison.Ordinal)) return true;
+
+        // Logix module-config auto-generated names — Local:1:I, Local:1:O, etc. Module data is
+        // exposed separately via the dedicated hardware mapping; the auto-generated symbol-table
+        // entries duplicate that.
+        if (tagName.StartsWith("Local:", StringComparison.Ordinal) && tagName.Contains(':')) return true;
+
+        // Map / Mapped IO alias tags (MainProgram.MapName pattern — dot-separated but prefixed
+        // with a reserved colon-carrying prefix to avoid false positives on user member access).
+        if (tagName.StartsWith("Map:", StringComparison.Ordinal)) return true;
+
+        // Axis / Cam / Motion-Group predefined structures — exposed separately through motion API.
+        if (tagName.StartsWith("Axis:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("Cam:", StringComparison.Ordinal)) return true;
+        if (tagName.StartsWith("MotionGroup:", StringComparison.Ordinal)) return true;
+
+        return false;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipTemplateCache.cs

@@ -0,0 +1,55 @@
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Cache of UDT shape descriptors keyed by <c>(deviceHostAddress, templateInstanceId)</c>.
+///     Populated on demand during discovery + whole-UDT reads; flushed via
+///     <see cref="AbCipDriver.FlushOptionalCachesAsync"/> and on device
+///     <c>ReinitializeAsync</c>.
+/// </summary>
+/// <remarks>
+///     Template shape read (CIP Template Object class 0x6C, <c>GetAttributeList</c> +
+///     <c>Read Template</c>) lands with PR 6. This class ships the cache surface so PR 6 can
+///     drop the decoder in without reshaping any caller code.
+/// </remarks>
+public sealed class AbCipTemplateCache
+{
+    private readonly ConcurrentDictionary<(string device, uint instanceId), AbCipUdtShape> _shapes = new();
+
+    /// <summary>
+    ///     Retrieve a cached UDT shape, or <c>null</c> if not yet read.
+    /// </summary>
+    public AbCipUdtShape? TryGet(string deviceHostAddress, uint templateInstanceId) =>
+        _shapes.TryGetValue((deviceHostAddress, templateInstanceId), out var shape) ? shape : null;
+
+    /// <summary>Store a freshly-decoded UDT shape.</summary>
+    public void Put(string deviceHostAddress, uint templateInstanceId, AbCipUdtShape shape) =>
+        _shapes[(deviceHostAddress, templateInstanceId)] = shape;
+
+    /// <summary>Drop every cached shape — called on <see cref="AbCipDriver.FlushOptionalCachesAsync"/>.</summary>
+    public void Clear() => _shapes.Clear();
+
+    /// <summary>Count of cached shapes — exposed for diagnostics + tests.</summary>
+    public int Count => _shapes.Count;
+}
+
+/// <summary>
+///     Decoded shape of one Logix UDT — member list + each member's offset + type. Populated
+///     by PR 6's Template Object reader. At PR 5 time this is the cache's value type only;
+///     no reader writes to it yet.
+/// </summary>
+/// <param name="TypeName">UDT name as reported by the Template Object.</param>
+/// <param name="TotalSize">Bytes the UDT occupies in a whole-UDT read buffer.</param>
+/// <param name="Members">Ordered list of members, each with its byte offset + type.</param>
+public sealed record AbCipUdtShape(
+    string TypeName,
+    int TotalSize,
+    IReadOnlyList<AbCipUdtMember> Members);
+
+/// <summary>One member of a Logix UDT.</summary>
+public sealed record AbCipUdtMember(
+    string Name,
+    int Offset,
+    AbCipDataType DataType,
+    int ArrayLength);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagEnumerator.cs

@@ -0,0 +1,67 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Swappable scanner that walks a controller's symbol table (via libplctag's
+///     <c>@tags</c> pseudo-tag or the CIP Symbol Object class 0x6B) and yields the tags it
+///     finds. Defaults to <see cref="EmptyAbCipTagEnumeratorFactory"/> which returns no
+///     controller-side tags — the full <c>@tags</c> decoder lands as a follow-up PR once
+///     libplctag 1.5.2 either gains <c>TagInfoPlcMapper</c> upstream or we ship our own
+///     <c>IPlcMapper</c> for the Symbol Object byte layout (tracked via follow-up task; PR 5
+///     ships the abstraction + pre-declared-tag emission).
+/// </summary>
+public interface IAbCipTagEnumerator : IDisposable
+{
+    /// <summary>
+    ///     Enumerate the controller's tags for one device. Callers iterate asynchronously so
+    ///     large symbol tables don't require buffering the entire list.
+    /// </summary>
+    IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        CancellationToken cancellationToken);
+}
+
+/// <summary>Factory for per-driver enumerators.</summary>
+public interface IAbCipTagEnumeratorFactory
+{
+    IAbCipTagEnumerator Create();
+}
+
+/// <summary>One tag yielded by <see cref="IAbCipTagEnumerator.EnumerateAsync"/>.</summary>
+/// <param name="Name">Logix symbolic name as returned by the Symbol Object.</param>
+/// <param name="ProgramScope">Program name if the tag is program-scoped; <c>null</c> for controller scope.</param>
+/// <param name="DataType">Detected data type; <see cref="AbCipDataType.Structure"/> when the tag
+///     is UDT-typed — the UDT shape lookup + per-member expansion ship with PR 6.</param>
+/// <param name="ReadOnly"><c>true</c> when the Symbol Object's External Access attribute forbids writes.</param>
+/// <param name="IsSystemTag">Hint from the enumerator that this is a system / infrastructure tag;
+///     the driver applies <see cref="AbCipSystemTagFilter"/> on top so the enumerator is not the
+///     single source of truth.</param>
+public sealed record AbCipDiscoveredTag(
+    string Name,
+    string? ProgramScope,
+    AbCipDataType DataType,
+    bool ReadOnly,
+    bool IsSystemTag = false);
+
+/// <summary>
+///     Default production enumerator — currently returns an empty sequence. The real <c>@tags</c>
+///     walk lands as a follow-up PR. Documented in <c>driver-specs.md §3</c> as the gap the
+///     Symbol Object walker closes.
+/// </summary>
+internal sealed class EmptyAbCipTagEnumerator : IAbCipTagEnumerator
+{
+    public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+        AbCipTagCreateParams deviceParams,
+        [System.Runtime.CompilerServices.EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        await Task.CompletedTask;
+        yield break;
+    }
+
+    public void Dispose() { }
+}
+
+/// <summary>Factory for <see cref="EmptyAbCipTagEnumerator"/>.</summary>
+internal sealed class EmptyAbCipTagEnumeratorFactory : IAbCipTagEnumeratorFactory
+{
+    public IAbCipTagEnumerator Create() => new EmptyAbCipTagEnumerator();
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -55,12 +55,60 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
 
     public void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
     {
-        // Writes land in PR 4 — Encode is declared here so the interface surface is stable;
-        // PR 4 fills in the switch.
-        _ = type;
-        _ = bitIndex;
-        _ = value;
-        throw new NotSupportedException("AbCip writes land in PR 4.");
+        switch (type)
+        {
+            case AbCipDataType.Bool:
+                if (bitIndex is int bit)
+                {
+                    // BOOL-within-DINT writes require read-modify-write on the parent DINT.
+                    // Deferred to a follow-up PR — matches the Modbus BitInRegister pattern at
+                    // ModbusDriver.cs:640.
+                    throw new NotSupportedException(
+                        "BOOL-within-DINT writes require read-modify-write; not implemented in PR 4.");
+                }
+                _tag.SetInt8(0, Convert.ToBoolean(value) ? (sbyte)1 : (sbyte)0);
+                break;
+            case AbCipDataType.SInt:
+                _tag.SetInt8(0, Convert.ToSByte(value));
+                break;
+            case AbCipDataType.USInt:
+                _tag.SetUInt8(0, Convert.ToByte(value));
+                break;
+            case AbCipDataType.Int:
+                _tag.SetInt16(0, Convert.ToInt16(value));
+                break;
+            case AbCipDataType.UInt:
+                _tag.SetUInt16(0, Convert.ToUInt16(value));
+                break;
+            case AbCipDataType.DInt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.UDInt:
+                _tag.SetUInt32(0, Convert.ToUInt32(value));
+                break;
+            case AbCipDataType.LInt:
+                _tag.SetInt64(0, Convert.ToInt64(value));
+                break;
+            case AbCipDataType.ULInt:
+                _tag.SetUInt64(0, Convert.ToUInt64(value));
+                break;
+            case AbCipDataType.Real:
+                _tag.SetFloat32(0, Convert.ToSingle(value));
+                break;
+            case AbCipDataType.LReal:
+                _tag.SetFloat64(0, Convert.ToDouble(value));
+                break;
+            case AbCipDataType.String:
+                _tag.SetString(0, Convert.ToString(value) ?? string.Empty);
+                break;
+            case AbCipDataType.Dt:
+                _tag.SetInt32(0, Convert.ToInt32(value));
+                break;
+            case AbCipDataType.Structure:
+                throw new NotSupportedException("Whole-UDT writes land in PR 6.");
+            default:
+                throw new NotSupportedException($"AbCipDataType {type} not writable.");
+        }
     }
 
     public void Dispose() => _tag.Dispose();

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverDiscoveryTests.cs

@@ -0,0 +1,278 @@
+using System.Runtime.CompilerServices;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverDiscoveryTests
+{
+    [Fact]
+    public async Task PreDeclared_tags_emit_as_variables_under_device_folder()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0", DeviceName: "Line1-PLC")],
+            Tags =
+            [
+                new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt),
+                new AbCipTagDefinition("Temperature", "ab://10.0.0.5/1,0", "T", AbCipDataType.Real, Writable: false),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "AbCip");
+        builder.Folders.ShouldContain(f => f.BrowseName == "ab://10.0.0.5/1,0" && f.DisplayName == "Line1-PLC");
+        builder.Variables.Count.ShouldBe(2);
+        builder.Variables.Single(v => v.BrowseName == "Speed").Info.SecurityClass.ShouldBe(SecurityClassification.Operate);
+        builder.Variables.Single(v => v.BrowseName == "Temperature").Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    [Fact]
+    public async Task Device_folder_displayname_falls_back_to_host_address()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")], // no DeviceName
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "ab://10.0.0.5/1,0"
+            && f.DisplayName == "ab://10.0.0.5/1,0");
+    }
+
+    [Fact]
+    public async Task PreDeclared_system_tags_are_filtered_out()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("__DEFVAL_X", "ab://10.0.0.5/1,0", "__DEFVAL_X", AbCipDataType.DInt),
+                new AbCipTagDefinition("Routine:SomeRoutine", "ab://10.0.0.5/1,0", "R", AbCipDataType.DInt),
+                new AbCipTagDefinition("UserTag", "ab://10.0.0.5/1,0", "U", AbCipDataType.DInt),
+            ],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.BrowseName).ShouldBe(["UserTag"]);
+    }
+
+    [Fact]
+    public async Task Tags_for_mismatched_device_are_ignored()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Orphan", "ab://10.0.0.99/1,0", "O", AbCipDataType.DInt)],
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_adds_tags_under_Discovered_folder()
+    {
+        var builder = new RecordingBuilder();
+        var enumeratorFactory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("Pressure", null, AbCipDataType.Real, ReadOnly: false),
+            new AbCipDiscoveredTag("StepIndex", ProgramScope: "MainProgram", AbCipDataType.DInt, ReadOnly: false));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: enumeratorFactory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "Discovered");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("Pressure");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("Program:MainProgram.StepIndex");
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_honours_system_tag_hint_and_filter()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("HiddenByHint", null, AbCipDataType.DInt, ReadOnly: false, IsSystemTag: true),
+            new AbCipDiscoveredTag("Routine:Foo", null, AbCipDataType.DInt, ReadOnly: false, IsSystemTag: false),
+            new AbCipDiscoveredTag("KeepMe", null, AbCipDataType.DInt, ReadOnly: false));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.Info.FullName).ShouldBe(["KeepMe"]);
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_ReadOnly_surfaces_ViewOnly_classification()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeEnumeratorFactory(
+            new AbCipDiscoveredTag("SafetyTag", null, AbCipDataType.DInt, ReadOnly: true));
+
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Single().Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    [Fact]
+    public async Task Controller_enumeration_receives_correct_device_params()
+    {
+        var factory = new FakeEnumeratorFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5:44818/1,2,3", AbCipPlcFamily.ControlLogix)],
+            Timeout = TimeSpan.FromSeconds(7),
+        }, "drv-1", enumeratorFactory: factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(new RecordingBuilder(), CancellationToken.None);
+
+        var capturedParams = factory.LastDeviceParams.ShouldNotBeNull();
+        capturedParams.Gateway.ShouldBe("10.0.0.5");
+        capturedParams.Port.ShouldBe(44818);
+        capturedParams.CipPath.ShouldBe("1,2,3");
+        capturedParams.LibplctagPlcAttribute.ShouldBe("controllogix");
+        capturedParams.TagName.ShouldBe("@tags");
+        capturedParams.Timeout.ShouldBe(TimeSpan.FromSeconds(7));
+    }
+
+    [Fact]
+    public void Default_enumerator_factory_is_used_when_not_injected()
+    {
+        // Sanity — absent enumerator factory does not crash discovery + uses EmptyAbCipTagEnumerator
+        // (covered by the other tests which instantiate without injecting a factory).
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+        }, "drv-1");
+        drv.ShouldNotBeNull();
+    }
+
+    [Theory]
+    [InlineData("__DEFVAL_X", true)]
+    [InlineData("__DEFAULT_Y", true)]
+    [InlineData("Routine:Main", true)]
+    [InlineData("Task:MainTask", true)]
+    [InlineData("Local:1:I", true)]
+    [InlineData("Map:Alias", true)]
+    [InlineData("Axis:MoveX", true)]
+    [InlineData("Cam:Profile1", true)]
+    [InlineData("MotionGroup:MG0", true)]
+    [InlineData("Motor1", false)]
+    [InlineData("Program:Main.Step", false)]
+    [InlineData("Recipe_2", false)]
+    [InlineData("", true)]
+    [InlineData("   ", true)]
+    public void SystemTagFilter_rejects_infrastructure_names(string name, bool expected)
+    {
+        AbCipSystemTagFilter.IsSystemTag(name).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void TemplateCache_roundtrip_put_get()
+    {
+        var cache = new AbCipTemplateCache();
+        var shape = new AbCipUdtShape("MyUdt", 32,
+        [
+            new AbCipUdtMember("A", 0, AbCipDataType.DInt, ArrayLength: 1),
+            new AbCipUdtMember("B", 4, AbCipDataType.Real, ArrayLength: 1),
+        ]);
+        cache.Put("ab://10.0.0.5/1,0", 42, shape);
+
+        cache.TryGet("ab://10.0.0.5/1,0", 42).ShouldBe(shape);
+        cache.TryGet("ab://10.0.0.5/1,0", 99).ShouldBeNull();
+        cache.Count.ShouldBe(1);
+
+        cache.Clear();
+        cache.Count.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task FlushOptionalCachesAsync_clears_template_cache()
+    {
+        var drv = new AbCipDriver(new AbCipDriverOptions(), "drv-1");
+        drv.TemplateCache.Put("dev", 1, new AbCipUdtShape("T", 4, []));
+        drv.TemplateCache.Count.ShouldBe(1);
+
+        await drv.FlushOptionalCachesAsync(CancellationToken.None);
+        drv.TemplateCache.Count.ShouldBe(0);
+    }
+
+    // ---- helpers ----
+
+    private sealed class RecordingBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, string DisplayName)> Folders { get; } = new();
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = new();
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName)
+        { Folders.Add((browseName, displayName)); return this; }
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        { Variables.Add((browseName, info)); return new Handle(info.FullName); }
+
+        public void AddProperty(string _, DriverDataType __, object? ___) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+        private sealed class NullSink : IAlarmConditionSink
+        {
+            public void OnTransition(AlarmEventArgs args) { }
+        }
+    }
+
+    private sealed class FakeEnumeratorFactory : IAbCipTagEnumeratorFactory
+    {
+        private readonly AbCipDiscoveredTag[] _tags;
+        public AbCipTagCreateParams? LastDeviceParams { get; private set; }
+        public FakeEnumeratorFactory(params AbCipDiscoveredTag[] tags) => _tags = tags;
+        public IAbCipTagEnumerator Create() => new FakeEnumerator(this);
+
+        private sealed class FakeEnumerator(FakeEnumeratorFactory outer) : IAbCipTagEnumerator
+        {
+            public async IAsyncEnumerable<AbCipDiscoveredTag> EnumerateAsync(
+                AbCipTagCreateParams deviceParams,
+                [EnumeratorCancellation] CancellationToken cancellationToken)
+            {
+                outer.LastDeviceParams = deviceParams;
+                await Task.CompletedTask;
+                foreach (var t in outer._tags) yield return t;
+            }
+            public void Dispose() { }
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverWriteTests.cs

@@ -0,0 +1,230 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverWriteTests
+{
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+        }, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    [Fact]
+    public async Task Unknown_reference_maps_to_BadNodeIdUnknown()
+    {
+        var (drv, _) = NewDriver();
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("does-not-exist", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Non_writable_tag_maps_to_BadNotWritable()
+    {
+        var (drv, _) = NewDriver(
+            new AbCipTagDefinition("ReadOnly", "ab://10.0.0.5/1,0", "RO", AbCipDataType.DInt, Writable: false));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("ReadOnly", 7)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+    }
+
+    [Fact]
+    public async Task Successful_DInt_write_encodes_and_flushes()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Motor1.Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Speed", 4200)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        factory.Tags["Motor1.Speed"].Value.ShouldBe(4200);
+        factory.Tags["Motor1.Speed"].WriteCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Bit_in_dint_write_returns_BadNotSupported()
+    {
+        var factory = new FakeAbCipTagFactory { Customise = p => new ThrowingBoolBitFake(p) };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Flag3", "ab://10.0.0.5/1,0", "Flags.3", AbCipDataType.Bool)],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Flag3", true)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotSupported);
+    }
+
+    [Fact]
+    public async Task Non_zero_libplctag_status_after_write_maps_via_AbCipStatusMapper()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Status = -5 /* timeout */ };
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Broken", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadTimeout);
+    }
+
+    [Fact]
+    public async Task Type_mismatch_surfaces_BadTypeMismatch()
+    {
+        var (drv, _) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        // Force a FormatException inside Convert.ToInt32 via a runtime that forwards to real Convert.
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new RealConvertFake(p),
+        };
+        var drv2 = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt)],
+        }, "drv-2", factory);
+        await drv2.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv2.WriteAsync(
+            [new WriteRequest("Speed", "not-a-number")], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadTypeMismatch);
+    }
+
+    [Fact]
+    public async Task Overflow_surfaces_BadOutOfRange()
+    {
+        var factory = new FakeAbCipTagFactory { Customise = p => new RealConvertFake(p) };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("Narrow", "ab://10.0.0.5/1,0", "N", AbCipDataType.Int)],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Narrow", 1_000_000)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadOutOfRange);
+    }
+
+    [Fact]
+    public async Task Exception_during_write_surfaces_BadCommunicationError()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Broken", "ab://10.0.0.5/1,0", "Broken", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new ThrowOnWriteFake(p);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Broken", 1)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
+        drv.GetHealth().State.ShouldBe(DriverState.Degraded);
+    }
+
+    [Fact]
+    public async Task Batch_preserves_order_across_success_and_failure()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.DInt, Writable: false),
+                new AbCipTagDefinition("C", "ab://10.0.0.5/1,0", "C", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("A", 1),
+            new WriteRequest("B", 2),
+            new WriteRequest("UnknownTag", 3),
+            new WriteRequest("C", 4),
+        ], CancellationToken.None);
+
+        results.Count.ShouldBe(4);
+        results[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+        results[2].StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        results[3].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+    }
+
+    [Fact]
+    public async Task Cancellation_propagates_from_write()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Slow", "ab://10.0.0.5/1,0", "Slow", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new CancelOnWriteFake(p);
+
+        await Should.ThrowAsync<OperationCanceledException>(
+            () => drv.WriteAsync([new WriteRequest("Slow", 1)], CancellationToken.None));
+    }
+
+    // ---- test-fake variants that exercise the real type / error handling ----
+
+    private sealed class RealConvertFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+        {
+            switch (type)
+            {
+                case AbCipDataType.Int: _ = Convert.ToInt16(value); break;
+                case AbCipDataType.DInt: _ = Convert.ToInt32(value); break;
+                default: _ = Convert.ToInt32(value); break;
+            }
+            Value = value;
+        }
+    }
+
+    private sealed class ThrowingBoolBitFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override void EncodeValue(AbCipDataType type, int? bitIndex, object? value)
+        {
+            if (type == AbCipDataType.Bool && bitIndex is not null)
+                throw new NotSupportedException("bit-in-DINT deferred");
+            Value = value;
+        }
+    }
+
+    private sealed class ThrowOnWriteFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override Task WriteAsync(CancellationToken ct) =>
+            Task.FromException(new InvalidOperationException("wire dropped"));
+    }
+
+    private sealed class CancelOnWriteFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        public override Task WriteAsync(CancellationToken ct) =>
+            Task.FromException(new OperationCanceledException());
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/FakeAbCipTag.cs

@@ -8,7 +8,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
 ///     <see cref="Status"/> to simulate libplctag error codes,
 ///     <see cref="ThrowOnInitialize"/> / <see cref="ThrowOnRead"/> to simulate exceptions.
 /// </summary>
-internal sealed class FakeAbCipTag : IAbCipTagRuntime
+internal class FakeAbCipTag : IAbCipTagRuntime
 {
     public AbCipTagCreateParams CreationParams { get; }
     public object? Value { get; set; }
@@ -23,33 +23,33 @@ internal sealed class FakeAbCipTag : IAbCipTagRuntime
 
     public FakeAbCipTag(AbCipTagCreateParams createParams) => CreationParams = createParams;
 
-    public Task InitializeAsync(CancellationToken cancellationToken)
+    public virtual Task InitializeAsync(CancellationToken cancellationToken)
     {
         InitializeCount++;
         if (ThrowOnInitialize) throw Exception ?? new InvalidOperationException("fake initialize failure");
         return Task.CompletedTask;
     }
 
-    public Task ReadAsync(CancellationToken cancellationToken)
+    public virtual Task ReadAsync(CancellationToken cancellationToken)
     {
         ReadCount++;
         if (ThrowOnRead) throw Exception ?? new InvalidOperationException("fake read failure");
         return Task.CompletedTask;
     }
 
-    public Task WriteAsync(CancellationToken cancellationToken)
+    public virtual Task WriteAsync(CancellationToken cancellationToken)
     {
         WriteCount++;
         return Task.CompletedTask;
     }
 
-    public int GetStatus() => Status;
+    public virtual int GetStatus() => Status;
 
-    public object? DecodeValue(AbCipDataType type, int? bitIndex) => Value;
+    public virtual object? DecodeValue(AbCipDataType type, int? bitIndex) => Value;
 
-    public void EncodeValue(AbCipDataType type, int? bitIndex, object? value) => Value = value;
+    public virtual void EncodeValue(AbCipDataType type, int? bitIndex, object? value) => Value = value;
 
-    public void Dispose() => Disposed = true;
+    public virtual void Dispose() => Disposed = true;
 }
 
 /// <summary>Test factory that produces <see cref="FakeAbCipTag"/>s and indexes them for assertion.</summary>