Merge pull request (#129) - Bit RMW pass 2 (AbCip+AbLegacy)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ZB.MOM.WW.OtOpcUa.slnx

@@ -13,6 +13,7 @@
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.csproj"/>
+        <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.CLI/ZB.MOM.WW.OtOpcUa.Client.CLI.csproj"/>
@@ -35,6 +36,7 @@
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.csproj"/>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -329,9 +329,24 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
 
             try
             {
+                var parsedPath = AbCipTagPath.TryParse(def.TagPath);
+
+                // BOOL-within-DINT writes — per task #181, RMW against a parallel parent-DINT
+                // runtime. Dispatching here keeps the normal EncodeValue path clean; the
+                // per-parent lock prevents two concurrent bit writes to the same DINT from
+                // losing one another's update.
+                if (def.DataType == AbCipDataType.Bool && parsedPath?.BitIndex is int bit)
+                {
+                    results[i] = new WriteResult(
+                        await WriteBitInDIntAsync(device, parsedPath, bit, w.Value, cancellationToken)
+                            .ConfigureAwait(false));
+                    if (results[i].StatusCode == AbCipStatusMapper.Good)
+                        _health = new DriverHealth(DriverState.Healthy, now, null);
+                    continue;
+                }
+
                 var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
-                var tagPath = AbCipTagPath.TryParse(def.TagPath);
-                runtime.EncodeValue(def.DataType, tagPath?.BitIndex, w.Value);
+                runtime.EncodeValue(def.DataType, parsedPath?.BitIndex, w.Value);
                 await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
 
                 var status = runtime.GetStatus();
@@ -374,6 +389,74 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         return results;
     }
 
+    /// <summary>
+    ///     Read-modify-write one bit within a DINT parent. Creates / reuses a parallel
+    ///     parent-DINT runtime (distinct from the bit-selector handle) + serialises concurrent
+    ///     writers against the same parent via a per-parent <see cref="SemaphoreSlim"/>.
+    ///     Matches the Modbus BitInRegister + FOCAS PMC Bit pattern shipped in pass 1 of task #181.
+    /// </summary>
+    private async Task<uint> WriteBitInDIntAsync(
+        DeviceState device, AbCipTagPath bitPath, int bit, object? value, CancellationToken ct)
+    {
+        var parentPath = bitPath with { BitIndex = null };
+        var parentName = parentPath.ToLibplctagName();
+
+        var rmwLock = device.GetRmwLock(parentName);
+        await rmwLock.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            var parentRuntime = await EnsureParentRuntimeAsync(device, parentName, ct).ConfigureAwait(false);
+            await parentRuntime.ReadAsync(ct).ConfigureAwait(false);
+            var readStatus = parentRuntime.GetStatus();
+            if (readStatus != 0) return AbCipStatusMapper.MapLibplctagStatus(readStatus);
+
+            var current = Convert.ToInt32(parentRuntime.DecodeValue(AbCipDataType.DInt, bitIndex: null) ?? 0);
+            var updated = Convert.ToBoolean(value)
+                ? current | (1 << bit)
+                : current & ~(1 << bit);
+
+            parentRuntime.EncodeValue(AbCipDataType.DInt, bitIndex: null, updated);
+            await parentRuntime.WriteAsync(ct).ConfigureAwait(false);
+            var writeStatus = parentRuntime.GetStatus();
+            return writeStatus == 0
+                ? AbCipStatusMapper.Good
+                : AbCipStatusMapper.MapLibplctagStatus(writeStatus);
+        }
+        finally
+        {
+            rmwLock.Release();
+        }
+    }
+
+    /// <summary>
+    ///     Get or lazily create a parent-DINT runtime for a parent tag path, cached per-device
+    ///     so repeated bit writes against the same DINT share one handle.
+    /// </summary>
+    private async Task<IAbCipTagRuntime> EnsureParentRuntimeAsync(
+        DeviceState device, string parentTagName, CancellationToken ct)
+    {
+        if (device.ParentRuntimes.TryGetValue(parentTagName, out var existing)) return existing;
+
+        var runtime = _tagFactory.Create(new AbCipTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parentTagName,
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.ParentRuntimes[parentTagName] = runtime;
+        return runtime;
+    }
+
     /// <summary>
     ///     Idempotently materialise the runtime handle for a tag definition. First call creates
     ///     + initialises the libplctag Tag; subsequent calls reuse the cached handle for the
@@ -572,12 +655,28 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         public Dictionary<string, IAbCipTagRuntime> Runtimes { get; } =
             new(StringComparer.OrdinalIgnoreCase);
 
+        /// <summary>
+        ///     Parent-DINT runtimes created on-demand by <see cref="AbCipDriver.EnsureParentRuntimeAsync"/>
+        ///     for BOOL-within-DINT RMW writes. Separate from <see cref="Runtimes"/> because a
+        ///     bit-selector tag name ("Motor.Flags.3") needs a distinct handle from the DINT
+        ///     parent ("Motor.Flags") used to do the read + write.
+        /// </summary>
+        public Dictionary<string, IAbCipTagRuntime> ParentRuntimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        private readonly System.Collections.Concurrent.ConcurrentDictionary<string, SemaphoreSlim> _rmwLocks = new();
+
+        public SemaphoreSlim GetRmwLock(string parentTagName) =>
+            _rmwLocks.GetOrAdd(parentTagName, _ => new SemaphoreSlim(1, 1));
+
         public void DisposeHandles()
         {
             foreach (var h in TagHandles.Values) h.Dispose();
             TagHandles.Clear();
             foreach (var r in Runtimes.Values) r.Dispose();
             Runtimes.Clear();
+            foreach (var r in ParentRuntimes.Values) r.Dispose();
+            ParentRuntimes.Clear();
         }
     }
 }

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -58,13 +58,14 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
         switch (type)
         {
             case AbCipDataType.Bool:
-                if (bitIndex is int bit)
+                if (bitIndex is int)
                 {
-                    // BOOL-within-DINT writes require read-modify-write on the parent DINT.
-                    // Deferred to a follow-up PR — matches the Modbus BitInRegister pattern at
-                    // ModbusDriver.cs:640.
+                    // BOOL-within-DINT writes are routed at the driver level (AbCipDriver.
+                    // WriteBitInDIntAsync) via a parallel parent-DINT runtime so the RMW stays
+                    // serialised. If one reaches here it means the driver dispatch was bypassed —
+                    // throw so the error surfaces loudly rather than clobbering the whole DINT.
                     throw new NotSupportedException(
-                        "BOOL-within-DINT writes require read-modify-write; not implemented in PR 4.");
+                        "BOOL-with-bitIndex writes must go through AbCipDriver.WriteBitInDIntAsync, not LibplctagTagRuntime.");
                 }
                 _tag.SetInt8(0, Convert.ToBoolean(value) ? (sbyte)1 : (sbyte)0);
                 break;

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriver.cs

@@ -186,8 +186,21 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
 
             try
             {
-                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
                 var parsed = AbLegacyAddress.TryParse(def.Address);
+
+                // PCCC bit-within-word writes — task #181 pass 2. RMW against a parallel
+                // parent-word runtime (strip the /N bit suffix). Per-parent-word lock serialises
+                // concurrent bit writers. Applies to N-file bit-in-word (N7:0/3) + B-file bits
+                // (B3:0/0). T/C/R sub-elements don't hit this path because they're not Bit typed.
+                if (def.DataType == AbLegacyDataType.Bit && parsed?.BitIndex is int bit
+                    && parsed.FileLetter is not "B" and not "I" and not "O")
+                {
+                    results[i] = new WriteResult(
+                        await WriteBitInWordAsync(device, parsed, bit, w.Value, cancellationToken).ConfigureAwait(false));
+                    continue;
+                }
+
+                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
                 runtime.EncodeValue(def.DataType, parsed?.BitIndex, w.Value);
                 await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
 
@@ -331,6 +344,70 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
         return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
     }
 
+    /// <summary>
+    ///     Read-modify-write one bit within a PCCC N-file word. Strips the /N bit suffix to
+    ///     form the parent-word address (N7:0/3 → N7:0), creates / reuses a parent-word runtime
+    ///     typed as Int16, serialises concurrent bit writers against the same parent via a
+    ///     per-parent <see cref="SemaphoreSlim"/>.
+    /// </summary>
+    private async Task<uint> WriteBitInWordAsync(
+        AbLegacyDriver.DeviceState device, AbLegacyAddress bitAddress, int bit, object? value, CancellationToken ct)
+    {
+        var parentAddress = bitAddress with { BitIndex = null };
+        var parentName = parentAddress.ToLibplctagName();
+
+        var rmwLock = device.GetRmwLock(parentName);
+        await rmwLock.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            var parentRuntime = await EnsureParentRuntimeAsync(device, parentName, ct).ConfigureAwait(false);
+            await parentRuntime.ReadAsync(ct).ConfigureAwait(false);
+            var readStatus = parentRuntime.GetStatus();
+            if (readStatus != 0) return AbLegacyStatusMapper.MapLibplctagStatus(readStatus);
+
+            var current = Convert.ToInt32(parentRuntime.DecodeValue(AbLegacyDataType.Int, bitIndex: null) ?? 0);
+            var updated = Convert.ToBoolean(value)
+                ? current | (1 << bit)
+                : current & ~(1 << bit);
+
+            parentRuntime.EncodeValue(AbLegacyDataType.Int, bitIndex: null, (short)updated);
+            await parentRuntime.WriteAsync(ct).ConfigureAwait(false);
+            var writeStatus = parentRuntime.GetStatus();
+            return writeStatus == 0
+                ? AbLegacyStatusMapper.Good
+                : AbLegacyStatusMapper.MapLibplctagStatus(writeStatus);
+        }
+        finally
+        {
+            rmwLock.Release();
+        }
+    }
+
+    private async Task<IAbLegacyTagRuntime> EnsureParentRuntimeAsync(
+        AbLegacyDriver.DeviceState device, string parentName, CancellationToken ct)
+    {
+        if (device.ParentRuntimes.TryGetValue(parentName, out var existing)) return existing;
+
+        var runtime = _tagFactory.Create(new AbLegacyTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parentName,
+            Timeout: _options.Timeout));
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.ParentRuntimes[parentName] = runtime;
+        return runtime;
+    }
+
     private async Task<IAbLegacyTagRuntime> EnsureTagRuntimeAsync(
         DeviceState device, AbLegacyTagDefinition def, CancellationToken ct)
     {
@@ -374,6 +451,19 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
         public Dictionary<string, IAbLegacyTagRuntime> Runtimes { get; } =
             new(StringComparer.OrdinalIgnoreCase);
 
+        /// <summary>
+        ///     Parent-word runtimes for bit-within-word RMW writes (task #181). Keyed by the
+        ///     parent address (bit suffix stripped) — e.g. writes to N7:0/3 + N7:0/5 share a
+        ///     single parent runtime for N7:0.
+        /// </summary>
+        public Dictionary<string, IAbLegacyTagRuntime> ParentRuntimes { get; } =
+            new(StringComparer.OrdinalIgnoreCase);
+
+        private readonly System.Collections.Concurrent.ConcurrentDictionary<string, SemaphoreSlim> _rmwLocks = new();
+
+        public SemaphoreSlim GetRmwLock(string parentName) =>
+            _rmwLocks.GetOrAdd(parentName, _ => new SemaphoreSlim(1, 1));
+
         public object ProbeLock { get; } = new();
         public HostState HostState { get; set; } = HostState.Unknown;
         public DateTime HostStateChangedUtc { get; set; } = DateTime.UtcNow;
@@ -384,6 +474,8 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
         {
             foreach (var r in Runtimes.Values) r.Dispose();
             Runtimes.Clear();
+            foreach (var r in ParentRuntimes.Values) r.Dispose();
+            ParentRuntimes.Clear();
         }
     }
 }

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/LibplctagLegacyTagRuntime.cs

@@ -51,8 +51,12 @@ internal sealed class LibplctagLegacyTagRuntime : IAbLegacyTagRuntime
         {
             case AbLegacyDataType.Bit:
                 if (bitIndex is int)
+                    // Bit-within-word writes are routed at the driver level
+                    // (AbLegacyDriver.WriteBitInWordAsync) via a parallel parent-word runtime —
+                    // this branch only fires if dispatch was bypassed. Throw loudly rather than
+                    // silently clobbering the whole word.
                     throw new NotSupportedException(
-                        "Bit-within-word writes require read-modify-write; tracked in task #181.");
+                        "Bit-with-bitIndex writes must go through AbLegacyDriver.WriteBitInWordAsync.");
                 _tag.SetInt8(0, Convert.ToBoolean(value) ? (sbyte)1 : (sbyte)0);
                 break;
             case AbLegacyDataType.Int:

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasAddress.cs

@@ -0,0 +1,95 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Parsed FOCAS address covering the three addressing spaces a driver touches:
+///     <see cref="FocasAreaKind.Pmc"/> (letter + byte + optional bit — <c>X0.0</c>, <c>R100</c>,
+///     <c>F20.3</c>), <see cref="FocasAreaKind.Parameter"/> (CNC parameter number —
+///     <c>PARAM:1020</c>, <c>PARAM:1815/0</c> for bit 0), and <see cref="FocasAreaKind.Macro"/>
+///     (macro variable number — <c>MACRO:100</c>, <c>MACRO:500</c>).
+/// </summary>
+/// <remarks>
+///     PMC letters: <c>X/Y</c> (IO), <c>F/G</c> (signals between PMC + CNC), <c>R</c> (internal
+///     relay), <c>D</c> (data table), <c>C</c> (counter), <c>K</c> (keep relay), <c>A</c>
+///     (message display), <c>E</c> (extended relay), <c>T</c> (timer). Byte numbering is 0-based;
+///     bit index when present is 0–7 and uses <c>.N</c> for PMC or <c>/N</c> for parameters.
+/// </remarks>
+public sealed record FocasAddress(
+    FocasAreaKind Kind,
+    string? PmcLetter,
+    int Number,
+    int? BitIndex)
+{
+    public string Canonical => Kind switch
+    {
+        FocasAreaKind.Pmc => BitIndex is null
+            ? $"{PmcLetter}{Number}"
+            : $"{PmcLetter}{Number}.{BitIndex}",
+        FocasAreaKind.Parameter => BitIndex is null
+            ? $"PARAM:{Number}"
+            : $"PARAM:{Number}/{BitIndex}",
+        FocasAreaKind.Macro => $"MACRO:{Number}",
+        _ => $"?{Number}",
+    };
+
+    public static FocasAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        var src = value.Trim();
+
+        if (src.StartsWith("PARAM:", StringComparison.OrdinalIgnoreCase))
+            return ParseScoped(src["PARAM:".Length..], FocasAreaKind.Parameter, bitSeparator: '/');
+
+        if (src.StartsWith("MACRO:", StringComparison.OrdinalIgnoreCase))
+            return ParseScoped(src["MACRO:".Length..], FocasAreaKind.Macro, bitSeparator: null);
+
+        // PMC path: letter + digits + optional .bit
+        if (src.Length < 2 || !char.IsLetter(src[0])) return null;
+        var letter = src[0..1].ToUpperInvariant();
+        if (!IsValidPmcLetter(letter)) return null;
+
+        var remainder = src[1..];
+        int? bit = null;
+        var dotIdx = remainder.IndexOf('.');
+        if (dotIdx >= 0)
+        {
+            if (!int.TryParse(remainder[(dotIdx + 1)..], out var bitValue) || bitValue is < 0 or > 7)
+                return null;
+            bit = bitValue;
+            remainder = remainder[..dotIdx];
+        }
+        if (!int.TryParse(remainder, out var number) || number < 0) return null;
+        return new FocasAddress(FocasAreaKind.Pmc, letter, number, bit);
+    }
+
+    private static FocasAddress? ParseScoped(string body, FocasAreaKind kind, char? bitSeparator)
+    {
+        int? bit = null;
+        if (bitSeparator is char sep)
+        {
+            var slashIdx = body.IndexOf(sep);
+            if (slashIdx >= 0)
+            {
+                if (!int.TryParse(body[(slashIdx + 1)..], out var bitValue) || bitValue is < 0 or > 31)
+                    return null;
+                bit = bitValue;
+                body = body[..slashIdx];
+            }
+        }
+        if (!int.TryParse(body, out var number) || number < 0) return null;
+        return new FocasAddress(kind, PmcLetter: null, number, bit);
+    }
+
+    private static bool IsValidPmcLetter(string letter) => letter switch
+    {
+        "X" or "Y" or "F" or "G" or "R" or "D" or "C" or "K" or "A" or "E" or "T" => true,
+        _ => false,
+    };
+}
+
+/// <summary>Addressing-space kinds the driver understands.</summary>
+public enum FocasAreaKind
+{
+    Pmc,
+    Parameter,
+    Macro,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDataType.cs

@@ -0,0 +1,39 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     FOCAS atomic data types. Narrower than Logix/IEC — FANUC CNCs expose mostly integer +
+///     floating-point data with no UDT concept; macro variables are double-precision floats
+///     and PMC reads return byte / signed word / signed dword.
+/// </summary>
+public enum FocasDataType
+{
+    /// <summary>Single bit (PMC bit, or bit within a CNC parameter).</summary>
+    Bit,
+    /// <summary>8-bit signed byte (PMC 1-byte read).</summary>
+    Byte,
+    /// <summary>16-bit signed word (PMC 2-byte read, or CNC parameter as short).</summary>
+    Int16,
+    /// <summary>32-bit signed int (PMC 4-byte read, or CNC parameter as int).</summary>
+    Int32,
+    /// <summary>32-bit IEEE-754 float (rare; some CNC macro variables).</summary>
+    Float32,
+    /// <summary>64-bit IEEE-754 double (most macro variables are double-precision).</summary>
+    Float64,
+    /// <summary>ASCII string (alarm text, parameter names, some PMC string areas).</summary>
+    String,
+}
+
+public static class FocasDataTypeExtensions
+{
+    public static DriverDataType ToDriverDataType(this FocasDataType t) => t switch
+    {
+        FocasDataType.Bit => DriverDataType.Boolean,
+        FocasDataType.Byte or FocasDataType.Int16 or FocasDataType.Int32 => DriverDataType.Int32,
+        FocasDataType.Float32 => DriverDataType.Float32,
+        FocasDataType.Float64 => DriverDataType.Float64,
+        FocasDataType.String => DriverDataType.String,
+        _ => DriverDataType.Int32,
+    };
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriver.cs

@@ -0,0 +1,344 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     FOCAS driver for Fanuc CNC controllers (FS 0i / 16i / 18i / 21i / 30i / 31i / 32i / Series
+///     35i / Power Mate i). Talks to the CNC via the Fanuc FOCAS/2 FWLIB protocol through an
+///     <see cref="IFocasClient"/> the deployment supplies — FWLIB itself is Fanuc-proprietary
+///     and cannot be redistributed.
+/// </summary>
+/// <remarks>
+///     PR 1 ships <see cref="IDriver"/> only; read / write / discover / subscribe / probe / host-
+///     resolver capabilities land in PRs 2 and 3. The <see cref="IFocasClient"/> abstraction
+///     shipped here lets PR 2 onward stay license-clean — all tests run against a fake client
+///     + the default <see cref="UnimplementedFocasClientFactory"/> makes misconfigured servers
+///     fail fast.
+/// </remarks>
+public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
+    IHostConnectivityProbe, IPerCallHostResolver, IDisposable, IAsyncDisposable
+{
+    private readonly FocasDriverOptions _options;
+    private readonly string _driverInstanceId;
+    private readonly IFocasClientFactory _clientFactory;
+    private readonly PollGroupEngine _poll;
+    private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, FocasTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
+    private DriverHealth _health = new(DriverState.Unknown, null, null);
+
+    public event EventHandler<DataChangeEventArgs>? OnDataChange;
+    public event EventHandler<HostStatusChangedEventArgs>? OnHostStatusChanged;
+
+    public FocasDriver(FocasDriverOptions options, string driverInstanceId,
+        IFocasClientFactory? clientFactory = null)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        _options = options;
+        _driverInstanceId = driverInstanceId;
+        _clientFactory = clientFactory ?? new FwlibFocasClientFactory();
+        _poll = new PollGroupEngine(
+            reader: ReadAsync,
+            onChange: (handle, tagRef, snapshot) =>
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+    }
+
+    public string DriverInstanceId => _driverInstanceId;
+    public string DriverType => "FOCAS";
+
+    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        _health = new DriverHealth(DriverState.Initializing, null, null);
+        try
+        {
+            foreach (var device in _options.Devices)
+            {
+                var addr = FocasHostAddress.TryParse(device.HostAddress)
+                    ?? throw new InvalidOperationException(
+                        $"FOCAS device has invalid HostAddress '{device.HostAddress}' — expected 'focas://{{ip}}[:{{port}}]'.");
+                _devices[device.HostAddress] = new DeviceState(addr, device);
+            }
+            foreach (var tag in _options.Tags) _tagsByName[tag.Name] = tag;
+
+            if (_options.Probe.Enabled)
+            {
+                foreach (var state in _devices.Values)
+                {
+                    state.ProbeCts = new CancellationTokenSource();
+                    var ct = state.ProbeCts.Token;
+                    _ = Task.Run(() => ProbeLoopAsync(state, ct), ct);
+                }
+            }
+            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+        }
+        catch (Exception ex)
+        {
+            _health = new DriverHealth(DriverState.Faulted, null, ex.Message);
+            throw;
+        }
+        return Task.CompletedTask;
+    }
+
+    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
+        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        await _poll.DisposeAsync().ConfigureAwait(false);
+        foreach (var state in _devices.Values)
+        {
+            try { state.ProbeCts?.Cancel(); } catch { }
+            state.ProbeCts?.Dispose();
+            state.ProbeCts = null;
+            state.DisposeClient();
+        }
+        _devices.Clear();
+        _tagsByName.Clear();
+        _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+    }
+
+    public DriverHealth GetHealth() => _health;
+    public long GetMemoryFootprint() => 0;
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+    internal int DeviceCount => _devices.Count;
+    internal DeviceState? GetDeviceState(string hostAddress) =>
+        _devices.TryGetValue(hostAddress, out var s) ? s : null;
+
+    // ---- IReadable ----
+
+    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(fullReferences);
+        var now = DateTime.UtcNow;
+        var results = new DataValueSnapshot[fullReferences.Count];
+
+        for (var i = 0; i < fullReferences.Count; i++)
+        {
+            var reference = fullReferences[i];
+            if (!_tagsByName.TryGetValue(reference, out var def))
+            {
+                results[i] = new DataValueSnapshot(null, FocasStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new DataValueSnapshot(null, FocasStatusMapper.BadNodeIdUnknown, null, now);
+                continue;
+            }
+
+            try
+            {
+                var client = await EnsureConnectedAsync(device, cancellationToken).ConfigureAwait(false);
+                var parsed = FocasAddress.TryParse(def.Address)
+                    ?? throw new InvalidOperationException($"FOCAS tag '{def.Name}' has malformed Address '{def.Address}'.");
+                var (value, status) = await client.ReadAsync(parsed, def.DataType, cancellationToken).ConfigureAwait(false);
+
+                results[i] = new DataValueSnapshot(value, status, now, now);
+                if (status == FocasStatusMapper.Good)
+                    _health = new DriverHealth(DriverState.Healthy, now, null);
+                else
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                        $"FOCAS status 0x{status:X8} reading {reference}");
+            }
+            catch (OperationCanceledException) { throw; }
+            catch (Exception ex)
+            {
+                results[i] = new DataValueSnapshot(null, FocasStatusMapper.BadCommunicationError, null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- IWritable ----
+
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(writes);
+        var results = new WriteResult[writes.Count];
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            try
+            {
+                var client = await EnsureConnectedAsync(device, cancellationToken).ConfigureAwait(false);
+                var parsed = FocasAddress.TryParse(def.Address)
+                    ?? throw new InvalidOperationException($"FOCAS tag '{def.Name}' has malformed Address '{def.Address}'.");
+                var status = await client.WriteAsync(parsed, def.DataType, w.Value, cancellationToken).ConfigureAwait(false);
+                results[i] = new WriteResult(status);
+            }
+            catch (OperationCanceledException) { throw; }
+            catch (NotSupportedException nse)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadNotSupported);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            }
+            catch (Exception ex) when (ex is FormatException or InvalidCastException)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadTypeMismatch);
+            }
+            catch (OverflowException)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadOutOfRange);
+            }
+            catch (Exception ex)
+            {
+                results[i] = new WriteResult(FocasStatusMapper.BadCommunicationError);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            }
+        }
+
+        return results;
+    }
+
+    // ---- ITagDiscovery ----
+
+    public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var root = builder.Folder("FOCAS", "FOCAS");
+        foreach (var device in _options.Devices)
+        {
+            var label = device.DeviceName ?? device.HostAddress;
+            var deviceFolder = root.Folder(device.HostAddress, label);
+            var tagsForDevice = _options.Tags.Where(t =>
+                string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
+            foreach (var tag in tagsForDevice)
+            {
+                deviceFolder.Variable(tag.Name, tag.Name, new DriverAttributeInfo(
+                    FullName: tag.Name,
+                    DriverDataType: tag.DataType.ToDriverDataType(),
+                    IsArray: false,
+                    ArrayDim: null,
+                    SecurityClass: tag.Writable
+                        ? SecurityClassification.Operate
+                        : SecurityClassification.ViewOnly,
+                    IsHistorized: false,
+                    IsAlarm: false,
+                    WriteIdempotent: tag.WriteIdempotent));
+            }
+        }
+        return Task.CompletedTask;
+    }
+
+    // ---- ISubscribable (polling overlay via shared engine) ----
+
+    public Task<ISubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken) =>
+        Task.FromResult(_poll.Subscribe(fullReferences, publishingInterval));
+
+    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        _poll.Unsubscribe(handle);
+        return Task.CompletedTask;
+    }
+
+    // ---- IHostConnectivityProbe ----
+
+    public IReadOnlyList<HostConnectivityStatus> GetHostStatuses() =>
+        [.. _devices.Values.Select(s => new HostConnectivityStatus(s.Options.HostAddress, s.HostState, s.HostStateChangedUtc))];
+
+    private async Task ProbeLoopAsync(DeviceState state, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            var success = false;
+            try
+            {
+                var client = await EnsureConnectedAsync(state, ct).ConfigureAwait(false);
+                success = await client.ProbeAsync(ct).ConfigureAwait(false);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch { /* connect-failure path already disposed + cleared the client */ }
+
+            TransitionDeviceState(state, success ? HostState.Running : HostState.Stopped);
+
+            try { await Task.Delay(_options.Probe.Interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+    }
+
+    private void TransitionDeviceState(DeviceState state, HostState newState)
+    {
+        HostState old;
+        lock (state.ProbeLock)
+        {
+            old = state.HostState;
+            if (old == newState) return;
+            state.HostState = newState;
+            state.HostStateChangedUtc = DateTime.UtcNow;
+        }
+        OnHostStatusChanged?.Invoke(this,
+            new HostStatusChangedEventArgs(state.Options.HostAddress, old, newState));
+    }
+
+    // ---- IPerCallHostResolver ----
+
+    public string ResolveHost(string fullReference)
+    {
+        if (_tagsByName.TryGetValue(fullReference, out var def))
+            return def.DeviceHostAddress;
+        return _options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId;
+    }
+
+    private async Task<IFocasClient> EnsureConnectedAsync(DeviceState device, CancellationToken ct)
+    {
+        if (device.Client is { IsConnected: true } c) return c;
+        device.Client ??= _clientFactory.Create();
+        try
+        {
+            await device.Client.ConnectAsync(device.ParsedAddress, _options.Timeout, ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            device.Client.Dispose();
+            device.Client = null;
+            throw;
+        }
+        return device.Client;
+    }
+
+    public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
+    public async ValueTask DisposeAsync() => await ShutdownAsync(CancellationToken.None).ConfigureAwait(false);
+
+    internal sealed class DeviceState(FocasHostAddress parsedAddress, FocasDeviceOptions options)
+    {
+        public FocasHostAddress ParsedAddress { get; } = parsedAddress;
+        public FocasDeviceOptions Options { get; } = options;
+        public IFocasClient? Client { get; set; }
+
+        public object ProbeLock { get; } = new();
+        public HostState HostState { get; set; } = HostState.Unknown;
+        public DateTime HostStateChangedUtc { get; set; } = DateTime.UtcNow;
+        public CancellationTokenSource? ProbeCts { get; set; }
+
+        public void DisposeClient()
+        {
+            Client?.Dispose();
+            Client = null;
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriverOptions.cs

@@ -0,0 +1,38 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     FOCAS driver configuration. One instance supports N CNC devices. Per plan decision #144
+///     each device gets its own <c>(DriverInstanceId, HostAddress)</c> bulkhead key at the
+///     Phase 6.1 resilience layer.
+/// </summary>
+public sealed class FocasDriverOptions
+{
+    public IReadOnlyList<FocasDeviceOptions> Devices { get; init; } = [];
+    public IReadOnlyList<FocasTagDefinition> Tags { get; init; } = [];
+    public FocasProbeOptions Probe { get; init; } = new();
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+}
+
+public sealed record FocasDeviceOptions(
+    string HostAddress,
+    string? DeviceName = null);
+
+/// <summary>
+///     One FOCAS-backed OPC UA variable. <paramref name="Address"/> is the canonical FOCAS
+///     address string that parses via <see cref="FocasAddress.TryParse"/> —
+///     <c>X0.0</c> / <c>R100</c> / <c>PARAM:1815/0</c> / <c>MACRO:500</c>.
+/// </summary>
+public sealed record FocasTagDefinition(
+    string Name,
+    string DeviceHostAddress,
+    string Address,
+    FocasDataType DataType,
+    bool Writable = true,
+    bool WriteIdempotent = false);
+
+public sealed class FocasProbeOptions
+{
+    public bool Enabled { get; init; } = true;
+    public TimeSpan Interval { get; init; } = TimeSpan.FromSeconds(5);
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasHostAddress.cs

@@ -0,0 +1,41 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Parsed FOCAS target address — IP + TCP port. Canonical <c>focas://{ip}[:{port}]</c>.
+///     Default port 8193 (Fanuc-reserved FOCAS Ethernet port).
+/// </summary>
+public sealed record FocasHostAddress(string Host, int Port)
+{
+    /// <summary>Fanuc-reserved TCP port for FOCAS Ethernet.</summary>
+    public const int DefaultPort = 8193;
+
+    public override string ToString() => Port == DefaultPort
+        ? $"focas://{Host}"
+        : $"focas://{Host}:{Port}";
+
+    public static FocasHostAddress? TryParse(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value)) return null;
+        const string prefix = "focas://";
+        if (!value.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) return null;
+
+        var body = value[prefix.Length..];
+        if (string.IsNullOrEmpty(body)) return null;
+
+        var colonIdx = body.LastIndexOf(':');
+        string host;
+        var port = DefaultPort;
+        if (colonIdx >= 0)
+        {
+            host = body[..colonIdx];
+            if (!int.TryParse(body[(colonIdx + 1)..], out port) || port is <= 0 or > 65535)
+                return null;
+        }
+        else
+        {
+            host = body;
+        }
+        if (string.IsNullOrEmpty(host)) return null;
+        return new FocasHostAddress(host, port);
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasStatusMapper.cs

@@ -0,0 +1,48 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Maps FOCAS / FWLIB return codes to OPC UA StatusCodes. The FWLIB C API uses an
+///     <c>EW_*</c> constant family per the Fanuc FOCAS/1 and FOCAS/2 documentation
+///     (<c>EW_OK = 0</c>, <c>EW_NUMBER</c>, <c>EW_SOCKET</c>, etc.). Mirrors the shape of the
+///     AbCip / TwinCAT mappers so Admin UI status displays stay uniform across drivers.
+/// </summary>
+public static class FocasStatusMapper
+{
+    public const uint Good = 0u;
+    public const uint BadInternalError = 0x80020000u;
+    public const uint BadNodeIdUnknown = 0x80340000u;
+    public const uint BadNotWritable = 0x803B0000u;
+    public const uint BadOutOfRange = 0x803C0000u;
+    public const uint BadNotSupported = 0x803D0000u;
+    public const uint BadDeviceFailure = 0x80550000u;
+    public const uint BadCommunicationError = 0x80050000u;
+    public const uint BadTimeout = 0x800A0000u;
+    public const uint BadTypeMismatch = 0x80730000u;
+
+    /// <summary>
+    ///     Map common FWLIB <c>EW_*</c> return codes. The values below match Fanuc's published
+    ///     numeric conventions (EW_OK=0, EW_FUNC=1, EW_NUMBER=3, EW_LENGTH=4, EW_ATTRIB=7,
+    ///     EW_DATA=8, EW_NOOPT=6, EW_PROT=5, EW_OVRFLOW=2, EW_PARITY=9, EW_PASSWD=11,
+    ///     EW_BUSY=-1, EW_HANDLE=-8, EW_VERSION=-9, EW_UNEXP=-10, EW_SOCKET=-16).
+    /// </summary>
+    public static uint MapFocasReturn(int ret) => ret switch
+    {
+        0 => Good,
+        1 => BadNotSupported,          // EW_FUNC — CNC does not support this function
+        2 => BadOutOfRange,            // EW_OVRFLOW
+        3 => BadOutOfRange,            // EW_NUMBER
+        4 => BadOutOfRange,            // EW_LENGTH
+        5 => BadNotWritable,           // EW_PROT
+        6 => BadNotSupported,          // EW_NOOPT — optional CNC feature missing
+        7 => BadTypeMismatch,          // EW_ATTRIB
+        8 => BadNodeIdUnknown,         // EW_DATA — invalid data address
+        9 => BadCommunicationError,    // EW_PARITY
+        11 => BadNotWritable,          // EW_PASSWD
+        -1 => BadDeviceFailure,        // EW_BUSY
+        -8 => BadInternalError,        // EW_HANDLE — CNC handle not available
+        -9 => BadNotSupported,         // EW_VERSION — FWLIB vs CNC version mismatch
+        -10 => BadCommunicationError,  // EW_UNEXP
+        -16 => BadCommunicationError,  // EW_SOCKET
+        _ => BadCommunicationError,
+    };
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FwlibFocasClient.cs

@@ -0,0 +1,328 @@
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     <see cref="IFocasClient"/> implementation backed by Fanuc's licensed
+///     <c>Fwlib32.dll</c> via <see cref="FwlibNative"/> P/Invoke. The DLL is NOT shipped with
+///     OtOpcUa; the deployment places it next to the server executable or on <c>PATH</c>
+///     (per Fanuc licensing — see <c>docs/v2/focas-deployment.md</c>).
+/// </summary>
+/// <remarks>
+///     <para>Construction is licence-safe — .NET P/Invoke is lazy, so instantiating this class
+///     does NOT load <c>Fwlib32.dll</c>. The DLL only loads on the first wire call (Connect /
+///     Read / Write / Probe). When missing, those calls throw <see cref="DllNotFoundException"/>
+///     which the driver surfaces as <c>BadCommunicationError</c> through the normal exception
+///     mapping.</para>
+///
+///     <para>Session-scoped handle — <c>cnc_allclibhndl3</c> opens one FWLIB handle per CNC;
+///     all PMC / parameter / macro reads on that device go through the same handle. Dispose
+///     calls <c>cnc_freelibhndl</c>.</para>
+/// </remarks>
+internal sealed class FwlibFocasClient : IFocasClient
+{
+    private ushort _handle;
+    private bool _connected;
+
+    // Per-PMC-byte RMW lock registry. Bit writes to the same byte get serialised so two
+    // concurrent bit updates don't lose one another's modification. Key = "{addrType}:{byteAddr}".
+    private readonly ConcurrentDictionary<string, SemaphoreSlim> _rmwLocks = new();
+
+    private SemaphoreSlim GetRmwLock(short addrType, int byteAddr) =>
+        _rmwLocks.GetOrAdd($"{addrType}:{byteAddr}", _ => new SemaphoreSlim(1, 1));
+
+    public bool IsConnected => _connected;
+
+    public Task ConnectAsync(FocasHostAddress address, TimeSpan timeout, CancellationToken cancellationToken)
+    {
+        if (_connected) return Task.CompletedTask;
+
+        var timeoutMs = (int)Math.Max(1, timeout.TotalMilliseconds);
+        var ret = FwlibNative.AllcLibHndl3(address.Host, (ushort)address.Port, timeoutMs, out var handle);
+        if (ret != 0)
+            throw new InvalidOperationException(
+                $"FWLIB cnc_allclibhndl3 failed with EW_{ret} connecting to {address}.");
+        _handle = handle;
+        _connected = true;
+        return Task.CompletedTask;
+    }
+
+    public Task<(object? value, uint status)> ReadAsync(
+        FocasAddress address, FocasDataType type, CancellationToken cancellationToken)
+    {
+        if (!_connected) return Task.FromResult<(object?, uint)>((null, FocasStatusMapper.BadCommunicationError));
+        cancellationToken.ThrowIfCancellationRequested();
+
+        return address.Kind switch
+        {
+            FocasAreaKind.Pmc => Task.FromResult(ReadPmc(address, type)),
+            FocasAreaKind.Parameter => Task.FromResult(ReadParameter(address, type)),
+            FocasAreaKind.Macro => Task.FromResult(ReadMacro(address)),
+            _ => Task.FromResult<(object?, uint)>((null, FocasStatusMapper.BadNotSupported)),
+        };
+    }
+
+    public async Task<uint> WriteAsync(
+        FocasAddress address, FocasDataType type, object? value, CancellationToken cancellationToken)
+    {
+        if (!_connected) return FocasStatusMapper.BadCommunicationError;
+        cancellationToken.ThrowIfCancellationRequested();
+
+        return address.Kind switch
+        {
+            FocasAreaKind.Pmc when type == FocasDataType.Bit && address.BitIndex is int =>
+                await WritePmcBitAsync(address, Convert.ToBoolean(value), cancellationToken).ConfigureAwait(false),
+            FocasAreaKind.Pmc => WritePmc(address, type, value),
+            FocasAreaKind.Parameter => WriteParameter(address, type, value),
+            FocasAreaKind.Macro => WriteMacro(address, value),
+            _ => FocasStatusMapper.BadNotSupported,
+        };
+    }
+
+    /// <summary>
+    ///     Read-modify-write one bit within a PMC byte. Acquires a per-byte semaphore so
+    ///     concurrent bit writes against the same byte serialise and neither loses its update.
+    /// </summary>
+    private async Task<uint> WritePmcBitAsync(
+        FocasAddress address, bool newValue, CancellationToken cancellationToken)
+    {
+        var addrType = FocasPmcAddrType.FromLetter(address.PmcLetter ?? "") ?? (short)0;
+        var bit = address.BitIndex ?? 0;
+        if (bit is < 0 or > 7)
+            throw new InvalidOperationException(
+                $"PMC bit index {bit} out of range (0-7) for {address.Canonical}.");
+
+        var rmwLock = GetRmwLock(addrType, address.Number);
+        await rmwLock.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            // Read the parent byte.
+            var readBuf = new FwlibNative.IODBPMC { Data = new byte[40] };
+            var readRet = FwlibNative.PmcRdPmcRng(
+                _handle, addrType, FocasPmcDataType.Byte,
+                (ushort)address.Number, (ushort)address.Number, 8 + 1, ref readBuf);
+            if (readRet != 0) return FocasStatusMapper.MapFocasReturn(readRet);
+
+            var current = readBuf.Data[0];
+            var updated = newValue
+                ? (byte)(current | (1 << bit))
+                : (byte)(current & ~(1 << bit));
+
+            // Write the updated byte.
+            var writeBuf = new FwlibNative.IODBPMC
+            {
+                TypeA = addrType,
+                TypeD = FocasPmcDataType.Byte,
+                DatanoS = (ushort)address.Number,
+                DatanoE = (ushort)address.Number,
+                Data = new byte[40],
+            };
+            writeBuf.Data[0] = updated;
+
+            var writeRet = FwlibNative.PmcWrPmcRng(_handle, 8 + 1, ref writeBuf);
+            return writeRet == 0 ? FocasStatusMapper.Good : FocasStatusMapper.MapFocasReturn(writeRet);
+        }
+        finally
+        {
+            rmwLock.Release();
+        }
+    }
+
+    public Task<bool> ProbeAsync(CancellationToken cancellationToken)
+    {
+        if (!_connected) return Task.FromResult(false);
+        var buf = new FwlibNative.ODBST();
+        var ret = FwlibNative.StatInfo(_handle, ref buf);
+        return Task.FromResult(ret == 0);
+    }
+
+    // ---- PMC ----
+
+    private (object? value, uint status) ReadPmc(FocasAddress address, FocasDataType type)
+    {
+        var addrType = FocasPmcAddrType.FromLetter(address.PmcLetter ?? "")
+            ?? throw new InvalidOperationException($"Unknown PMC letter '{address.PmcLetter}'.");
+        var dataType = FocasPmcDataType.FromFocasDataType(type);
+        var length = PmcReadLength(type);
+
+        var buf = new FwlibNative.IODBPMC { Data = new byte[40] };
+        var ret = FwlibNative.PmcRdPmcRng(
+            _handle, addrType, dataType,
+            (ushort)address.Number, (ushort)address.Number, (ushort)length, ref buf);
+        if (ret != 0) return (null, FocasStatusMapper.MapFocasReturn(ret));
+
+        var value = type switch
+        {
+            FocasDataType.Bit => ExtractBit(buf.Data[0], address.BitIndex ?? 0),
+            FocasDataType.Byte => (object)(sbyte)buf.Data[0],
+            FocasDataType.Int16 => (object)BinaryPrimitives.ReadInt16LittleEndian(buf.Data),
+            FocasDataType.Int32 => (object)BinaryPrimitives.ReadInt32LittleEndian(buf.Data),
+            FocasDataType.Float32 => (object)BinaryPrimitives.ReadSingleLittleEndian(buf.Data),
+            FocasDataType.Float64 => (object)BinaryPrimitives.ReadDoubleLittleEndian(buf.Data),
+            _ => (object)buf.Data[0],
+        };
+        return (value, FocasStatusMapper.Good);
+    }
+
+    private uint WritePmc(FocasAddress address, FocasDataType type, object? value)
+    {
+        var addrType = FocasPmcAddrType.FromLetter(address.PmcLetter ?? "") ?? (short)0;
+        var dataType = FocasPmcDataType.FromFocasDataType(type);
+        var length = PmcWriteLength(type);
+
+        var buf = new FwlibNative.IODBPMC
+        {
+            TypeA = addrType,
+            TypeD = dataType,
+            DatanoS = (ushort)address.Number,
+            DatanoE = (ushort)address.Number,
+            Data = new byte[40],
+        };
+        EncodePmcValue(buf.Data, type, value, address.BitIndex);
+
+        var ret = FwlibNative.PmcWrPmcRng(_handle, (ushort)length, ref buf);
+        return ret == 0 ? FocasStatusMapper.Good : FocasStatusMapper.MapFocasReturn(ret);
+    }
+
+    private (object? value, uint status) ReadParameter(FocasAddress address, FocasDataType type)
+    {
+        var buf = new FwlibNative.IODBPSD { Data = new byte[32] };
+        var length = ParamReadLength(type);
+        var ret = FwlibNative.RdParam(_handle, (ushort)address.Number, axis: 0, (short)length, ref buf);
+        if (ret != 0) return (null, FocasStatusMapper.MapFocasReturn(ret));
+
+        var value = type switch
+        {
+            FocasDataType.Bit when address.BitIndex is int bit => ExtractBit(buf.Data[0], bit),
+            FocasDataType.Byte => (object)(sbyte)buf.Data[0],
+            FocasDataType.Int16 => (object)BinaryPrimitives.ReadInt16LittleEndian(buf.Data),
+            FocasDataType.Int32 => (object)BinaryPrimitives.ReadInt32LittleEndian(buf.Data),
+            _ => (object)BinaryPrimitives.ReadInt32LittleEndian(buf.Data),
+        };
+        return (value, FocasStatusMapper.Good);
+    }
+
+    private uint WriteParameter(FocasAddress address, FocasDataType type, object? value)
+    {
+        var buf = new FwlibNative.IODBPSD
+        {
+            Datano = (short)address.Number,
+            Type = 0,
+            Data = new byte[32],
+        };
+        var length = ParamReadLength(type);
+        EncodeParamValue(buf.Data, type, value);
+        var ret = FwlibNative.WrParam(_handle, (short)length, ref buf);
+        return ret == 0 ? FocasStatusMapper.Good : FocasStatusMapper.MapFocasReturn(ret);
+    }
+
+    private (object? value, uint status) ReadMacro(FocasAddress address)
+    {
+        var buf = new FwlibNative.ODBM();
+        var ret = FwlibNative.RdMacro(_handle, (short)address.Number, length: 8, ref buf);
+        if (ret != 0) return (null, FocasStatusMapper.MapFocasReturn(ret));
+
+        // Macro value = mcr_val / 10^dec_val. Convert to double so callers get the correct
+        // scaled value regardless of the decimal-point count the CNC reports.
+        var scaled = buf.McrVal / Math.Pow(10.0, buf.DecVal);
+        return (scaled, FocasStatusMapper.Good);
+    }
+
+    private uint WriteMacro(FocasAddress address, object? value)
+    {
+        // Write as integer + 0 decimal places — callers that need decimal precision can extend
+        // this via a future WriteMacroScaled overload. Consistent with what most HMIs do today.
+        var intValue = Convert.ToInt32(value);
+        var ret = FwlibNative.WrMacro(_handle, (short)address.Number, length: 8, intValue, decimalPointCount: 0);
+        return ret == 0 ? FocasStatusMapper.Good : FocasStatusMapper.MapFocasReturn(ret);
+    }
+
+    public void Dispose()
+    {
+        if (_connected)
+        {
+            try { FwlibNative.FreeLibHndl(_handle); } catch { }
+            _connected = false;
+        }
+    }
+
+    // ---- helpers ----
+
+    private static int PmcReadLength(FocasDataType type) => type switch
+    {
+        FocasDataType.Bit or FocasDataType.Byte => 8 + 1,    // 8-byte header + 1 byte payload
+        FocasDataType.Int16 => 8 + 2,
+        FocasDataType.Int32 => 8 + 4,
+        FocasDataType.Float32 => 8 + 4,
+        FocasDataType.Float64 => 8 + 8,
+        _ => 8 + 1,
+    };
+
+    private static int PmcWriteLength(FocasDataType type) => PmcReadLength(type);
+    private static int ParamReadLength(FocasDataType type) => type switch
+    {
+        FocasDataType.Bit or FocasDataType.Byte => 4 + 1,
+        FocasDataType.Int16 => 4 + 2,
+        FocasDataType.Int32 => 4 + 4,
+        _ => 4 + 4,
+    };
+
+    private static bool ExtractBit(byte word, int bit) => (word & (1 << bit)) != 0;
+
+    internal static void EncodePmcValue(byte[] data, FocasDataType type, object? value, int? bitIndex)
+    {
+        switch (type)
+        {
+            case FocasDataType.Bit:
+                // PMC Bit writes with a non-null bitIndex go through WritePmcBitAsync's RMW path
+                // upstream. This branch only fires when a caller passes Bit with no bitIndex —
+                // treat the value as a whole-byte boolean (non-zero / zero).
+                data[0] = Convert.ToBoolean(value) ? (byte)1 : (byte)0;
+                break;
+            case FocasDataType.Byte:
+                data[0] = (byte)(sbyte)Convert.ToSByte(value);
+                break;
+            case FocasDataType.Int16:
+                BinaryPrimitives.WriteInt16LittleEndian(data, Convert.ToInt16(value));
+                break;
+            case FocasDataType.Int32:
+                BinaryPrimitives.WriteInt32LittleEndian(data, Convert.ToInt32(value));
+                break;
+            case FocasDataType.Float32:
+                BinaryPrimitives.WriteSingleLittleEndian(data, Convert.ToSingle(value));
+                break;
+            case FocasDataType.Float64:
+                BinaryPrimitives.WriteDoubleLittleEndian(data, Convert.ToDouble(value));
+                break;
+            default:
+                throw new NotSupportedException($"FocasDataType {type} not writable via PMC.");
+        }
+        _ = bitIndex; // bit-in-byte handled above
+    }
+
+    internal static void EncodeParamValue(byte[] data, FocasDataType type, object? value)
+    {
+        switch (type)
+        {
+            case FocasDataType.Byte:
+                data[0] = (byte)(sbyte)Convert.ToSByte(value);
+                break;
+            case FocasDataType.Int16:
+                BinaryPrimitives.WriteInt16LittleEndian(data, Convert.ToInt16(value));
+                break;
+            case FocasDataType.Int32:
+                BinaryPrimitives.WriteInt32LittleEndian(data, Convert.ToInt32(value));
+                break;
+            default:
+                BinaryPrimitives.WriteInt32LittleEndian(data, Convert.ToInt32(value));
+                break;
+        }
+    }
+}
+
+/// <summary>Default <see cref="IFocasClientFactory"/> — produces a fresh <see cref="FwlibFocasClient"/> per device.</summary>
+public sealed class FwlibFocasClientFactory : IFocasClientFactory
+{
+    public IFocasClient Create() => new FwlibFocasClient();
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FwlibNative.cs

@@ -0,0 +1,190 @@
+using System.Runtime.InteropServices;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     P/Invoke surface for Fanuc FWLIB (<c>Fwlib32.dll</c>). Declarations extracted from
+///     <c>fwlib32.h</c> in the strangesast/fwlib repo; the licensed DLL itself is NOT shipped
+///     with OtOpcUa — the deployment places <c>Fwlib32.dll</c> next to the server executable
+///     or on <c>PATH</c>.
+/// </summary>
+/// <remarks>
+///     Deliberately narrow — only the calls <see cref="FwlibFocasClient"/> actually makes.
+///     FOCAS has 800+ functions in <c>fwlib32.h</c>; pulling in every one would bloat the
+///     P/Invoke surface + signal more coverage than this driver provides. Expand as capabilities
+///     are added.
+/// </remarks>
+internal static class FwlibNative
+{
+    private const string Library = "Fwlib32.dll";
+
+    // ---- Handle lifetime ----
+
+    /// <summary>Open an Ethernet FWLIB handle. Returns EW_OK (0) on success; handle written out.</summary>
+    [DllImport(Library, EntryPoint = "cnc_allclibhndl3", CharSet = CharSet.Ansi, ExactSpelling = true)]
+    public static extern short AllcLibHndl3(
+        [MarshalAs(UnmanagedType.LPStr)] string ipaddr,
+        ushort port,
+        int timeout,
+        out ushort handle);
+
+    [DllImport(Library, EntryPoint = "cnc_freelibhndl", ExactSpelling = true)]
+    public static extern short FreeLibHndl(ushort handle);
+
+    // ---- PMC ----
+
+    /// <summary>PMC range read. <paramref name="addrType"/> is the ADR_* enum; <paramref name="dataType"/> is 0 byte / 1 word / 2 long.</summary>
+    [DllImport(Library, EntryPoint = "pmc_rdpmcrng", ExactSpelling = true)]
+    public static extern short PmcRdPmcRng(
+        ushort handle,
+        short addrType,
+        short dataType,
+        ushort startNumber,
+        ushort endNumber,
+        ushort length,
+        ref IODBPMC buffer);
+
+    [DllImport(Library, EntryPoint = "pmc_wrpmcrng", ExactSpelling = true)]
+    public static extern short PmcWrPmcRng(
+        ushort handle,
+        ushort length,
+        ref IODBPMC buffer);
+
+    // ---- Parameters ----
+
+    [DllImport(Library, EntryPoint = "cnc_rdparam", ExactSpelling = true)]
+    public static extern short RdParam(
+        ushort handle,
+        ushort number,
+        short axis,
+        short length,
+        ref IODBPSD buffer);
+
+    [DllImport(Library, EntryPoint = "cnc_wrparam", ExactSpelling = true)]
+    public static extern short WrParam(
+        ushort handle,
+        short length,
+        ref IODBPSD buffer);
+
+    // ---- Macro variables ----
+
+    [DllImport(Library, EntryPoint = "cnc_rdmacro", ExactSpelling = true)]
+    public static extern short RdMacro(
+        ushort handle,
+        short number,
+        short length,
+        ref ODBM buffer);
+
+    [DllImport(Library, EntryPoint = "cnc_wrmacro", ExactSpelling = true)]
+    public static extern short WrMacro(
+        ushort handle,
+        short number,
+        short length,
+        int macroValue,
+        short decimalPointCount);
+
+    // ---- Status ----
+
+    [DllImport(Library, EntryPoint = "cnc_statinfo", ExactSpelling = true)]
+    public static extern short StatInfo(ushort handle, ref ODBST buffer);
+
+    // ---- Structs ----
+
+    /// <summary>
+    ///     IODBPMC — PMC range I/O buffer. 8-byte header + 40-byte union. We marshal the union
+    ///     as a fixed byte buffer + interpret per <see cref="FocasDataType"/> on the managed side.
+    /// </summary>
+    [StructLayout(LayoutKind.Sequential, Pack = 1)]
+    public struct IODBPMC
+    {
+        public short TypeA;
+        public short TypeD;
+        public ushort DatanoS;
+        public ushort DatanoE;
+        // 40-byte union: cdata[5] / idata[5] / ldata[5] / fdata[5] / dbdata[5] — dbdata is the widest.
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 40)]
+        public byte[] Data;
+    }
+
+    /// <summary>
+    ///     IODBPSD — CNC parameter I/O buffer. Axis-aware; for non-axis parameters pass axis=0.
+    ///     Union payload is bytes / shorts / longs — we marshal 32 bytes as the widest slot.
+    /// </summary>
+    [StructLayout(LayoutKind.Sequential, Pack = 1)]
+    public struct IODBPSD
+    {
+        public short Datano;
+        public short Type; // axis index (0 for non-axis)
+        [MarshalAs(UnmanagedType.ByValArray, SizeConst = 32)]
+        public byte[] Data;
+    }
+
+    /// <summary>ODBM — macro variable read buffer. Value = <c>McrVal / 10^DecVal</c>.</summary>
+    [StructLayout(LayoutKind.Sequential, Pack = 1)]
+    public struct ODBM
+    {
+        public short Datano;
+        public short Dummy;
+        public int McrVal;      // long in C; 32-bit signed
+        public short DecVal;    // decimal-point count
+    }
+
+    /// <summary>ODBST — CNC status info. Machine state, alarm flags, automatic / edit mode.</summary>
+    [StructLayout(LayoutKind.Sequential, Pack = 1)]
+    public struct ODBST
+    {
+        public short Dummy;
+        public short TmMode;
+        public short Aut;
+        public short Run;
+        public short Motion;
+        public short Mstb;
+        public short Emergency;
+        public short Alarm;
+        public short Edit;
+    }
+}
+
+/// <summary>
+///     PMC address-letter → FOCAS <c>ADR_*</c> numeric code. Per Fanuc FOCAS/2 spec the codes
+///     are: G=0, F=1, Y=2, X=3, A=4, R=5, T=6, K=7, C=8, D=9, E=10. Exposed internally +
+///     tested so the FwlibFocasClient translation is verifiable without the DLL loaded.
+/// </summary>
+internal static class FocasPmcAddrType
+{
+    public static short? FromLetter(string letter) => letter.ToUpperInvariant() switch
+    {
+        "G" => 0,
+        "F" => 1,
+        "Y" => 2,
+        "X" => 3,
+        "A" => 4,
+        "R" => 5,
+        "T" => 6,
+        "K" => 7,
+        "C" => 8,
+        "D" => 9,
+        "E" => 10,
+        _ => null,
+    };
+}
+
+/// <summary>PMC data-type numeric codes per FOCAS/2: 0 = byte, 1 = word, 2 = long, 4 = float, 5 = double.</summary>
+internal static class FocasPmcDataType
+{
+    public const short Byte = 0;
+    public const short Word = 1;
+    public const short Long = 2;
+    public const short Float = 4;
+    public const short Double = 5;
+
+    public static short FromFocasDataType(FocasDataType t) => t switch
+    {
+        FocasDataType.Bit or FocasDataType.Byte => Byte,
+        FocasDataType.Int16 => Word,
+        FocasDataType.Int32 => Long,
+        FocasDataType.Float32 => Float,
+        FocasDataType.Float64 => Double,
+        _ => Byte,
+    };
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/IFocasClient.cs

@@ -0,0 +1,70 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Wire-layer abstraction over one FOCAS session to a CNC. The driver holds one per
+///     configured device; lifetime matches the device.
+/// </summary>
+/// <remarks>
+///     <para><b>No default wire implementation ships with this assembly.</b> FWLIB
+///     (<c>Fwlib32.dll</c>) is Fanuc-proprietary and requires a valid customer license — it
+///     cannot legally be redistributed. The deployment team supplies an
+///     <see cref="IFocasClientFactory"/> that wraps the licensed <c>Fwlib32.dll</c> via
+///     P/Invoke and registers it at server startup.</para>
+///
+///     <para>The default <see cref="UnimplementedFocasClientFactory"/> throws with a pointer at
+///     the deployment docs so misconfigured servers fail fast with a clear error rather than
+///     mysteriously hanging.</para>
+/// </remarks>
+public interface IFocasClient : IDisposable
+{
+    /// <summary>Open the FWLIB handle + TCP session. Idempotent.</summary>
+    Task ConnectAsync(FocasHostAddress address, TimeSpan timeout, CancellationToken cancellationToken);
+
+    /// <summary>True when the FWLIB handle is valid + the socket is up.</summary>
+    bool IsConnected { get; }
+
+    /// <summary>
+    ///     Read the value at <paramref name="address"/> in the requested
+    ///     <paramref name="type"/>. Returns a boxed .NET value + the OPC UA status mapped
+    ///     through <see cref="FocasStatusMapper"/>.
+    /// </summary>
+    Task<(object? value, uint status)> ReadAsync(
+        FocasAddress address,
+        FocasDataType type,
+        CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Write <paramref name="value"/> to <paramref name="address"/>. Returns the mapped
+    ///     OPC UA status (0 = Good).
+    /// </summary>
+    Task<uint> WriteAsync(
+        FocasAddress address,
+        FocasDataType type,
+        object? value,
+        CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Cheap health probe — e.g. <c>cnc_rdcncstat</c>. Returns <c>true</c> when the CNC
+    ///     responds with any valid status.
+    /// </summary>
+    Task<bool> ProbeAsync(CancellationToken cancellationToken);
+}
+
+/// <summary>Factory for <see cref="IFocasClient"/>s. One client per configured device.</summary>
+public interface IFocasClientFactory
+{
+    IFocasClient Create();
+}
+
+/// <summary>
+///     Default factory that throws at construction time — the deployment must register a real
+///     factory. Keeps the driver assembly licence-clean while still allowing the skeleton to
+///     compile + the abstraction tests to run.
+/// </summary>
+public sealed class UnimplementedFocasClientFactory : IFocasClientFactory
+{
+    public IFocasClient Create() => throw new NotSupportedException(
+        "FOCAS driver has no wire client configured. Register a real IFocasClientFactory at " +
+        "server startup wrapping the licensed Fwlib32.dll — see docs/v2/focas-deployment.md. " +
+        "Fanuc licensing forbids shipping Fwlib32.dll in the OtOpcUa package.");
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj

@@ -0,0 +1,32 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.FOCAS</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+    </ItemGroup>
+
+    <!--
+        No NuGet reference to a FOCAS library — FWLIB is Fanuc-proprietary and the licensed
+        Fwlib32.dll cannot be redistributed. The deployment side supplies an IFocasClient
+        implementation that P/Invokes against whatever Fwlib32.dll the customer has licensed.
+        Driver.FOCAS.IntegrationTests in a separate repo can wire in the real binary.
+        Follow-up task #193 tracks the real-client reference implementation that customers may
+        drop in privately.
+    -->
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests"/>
+    </ItemGroup>
+
+</Project>

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs

@@ -264,8 +264,27 @@ public sealed class ModbusDriver
         return results;
     }
 
+    // BitInRegister writes need a read-modify-write against the full holding register. A
+    // per-register lock keeps concurrent bit-write callers from stomping on each other —
+    // Write bit 0 and Write bit 5 targeting the same register can arrive on separate
+    // subscriber threads, and without serialising the RMW the second-to-commit value wins
+    // + the first bit update is lost.
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<ushort, SemaphoreSlim> _rmwLocks = new();
+
+    private SemaphoreSlim GetRmwLock(ushort address) =>
+        _rmwLocks.GetOrAdd(address, _ => new SemaphoreSlim(1, 1));
+
     private async Task WriteOneAsync(IModbusTransport transport, ModbusTagDefinition tag, object? value, CancellationToken ct)
     {
+        // BitInRegister → RMW dispatch ahead of the normal encode path so the lock + read-modify-
+        // write sequence doesn't hit EncodeRegister's defensive throw.
+        if (tag.DataType == ModbusDataType.BitInRegister &&
+            tag.Region is ModbusRegion.HoldingRegisters)
+        {
+            await WriteBitInRegisterAsync(transport, tag, value, ct).ConfigureAwait(false);
+            return;
+        }
+
         switch (tag.Region)
         {
             case ModbusRegion.Coils:
@@ -309,6 +328,44 @@ public sealed class ModbusDriver
         }
     }
 
+    /// <summary>
+    ///     Read-modify-write one bit in a holding register. FC03 → bit-swap → FC06. Serialised
+    ///     against other bit writes targeting the same register via <see cref="GetRmwLock"/>.
+    /// </summary>
+    private async Task WriteBitInRegisterAsync(
+        IModbusTransport transport, ModbusTagDefinition tag, object? value, CancellationToken ct)
+    {
+        var bit = tag.BitIndex;
+        if (bit > 15)
+            throw new InvalidOperationException(
+                $"BitInRegister bit index {bit} out of range (0-15) for tag {tag.Name}.");
+        var on = Convert.ToBoolean(value);
+
+        var rmwLock = GetRmwLock(tag.Address);
+        await rmwLock.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            // FC03 read 1 holding register at tag.Address.
+            var readPdu = new byte[] { 0x03, (byte)(tag.Address >> 8), (byte)(tag.Address & 0xFF), 0x00, 0x01 };
+            var readResp = await transport.SendAsync(_options.UnitId, readPdu, ct).ConfigureAwait(false);
+            // resp = [fc][byte-count=2][hi][lo]
+            var current = (ushort)((readResp[2] << 8) | readResp[3]);
+
+            var updated = on
+                ? (ushort)(current | (1 << bit))
+                : (ushort)(current & ~(1 << bit));
+
+            // FC06 write single holding register.
+            var writePdu = new byte[] { 0x06, (byte)(tag.Address >> 8), (byte)(tag.Address & 0xFF),
+                                        (byte)(updated >> 8), (byte)(updated & 0xFF) };
+            await transport.SendAsync(_options.UnitId, writePdu, ct).ConfigureAwait(false);
+        }
+        finally
+        {
+            rmwLock.Release();
+        }
+    }
+
     // ---- ISubscribable (polling overlay via shared engine) ----
 
     public Task<ISubscriptionHandle> SubscribeAsync(
@@ -575,8 +632,11 @@ public sealed class ModbusDriver
                 return b;
             }
             case ModbusDataType.BitInRegister:
+                // Reached only if BitInRegister is somehow passed outside the HoldingRegisters
+                // path. Normal BitInRegister writes dispatch through WriteBitInRegisterAsync via
+                // the RMW shortcut in WriteOneAsync.
                 throw new InvalidOperationException(
-                    "BitInRegister writes require a read-modify-write; not supported in PR 24 (separate follow-up).");
+                    "BitInRegister writes must go through WriteBitInRegisterAsync (HoldingRegisters region only).");
             default:
                 throw new InvalidOperationException($"Non-register data type {tag.DataType}");
         }

src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/AdsTwinCATClient.cs

@@ -1,5 +1,9 @@
 using System.Collections.Concurrent;
+using System.Runtime.CompilerServices;
+using TwinCAT;
 using TwinCAT.Ads;
+using TwinCAT.Ads.TypeSystem;
+using TwinCAT.TypeSystem;
 
 namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT;
 
@@ -149,6 +153,56 @@ internal sealed class AdsTwinCATClient : ITwinCATClient
         catch { /* best-effort tear-down; target may already be gone */ }
     }
 
+    public async IAsyncEnumerable<TwinCATDiscoveredSymbol> BrowseSymbolsAsync(
+        [EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        // SymbolLoaderFactory downloads the symbol-info blob once then iterates locally — the
+        // async surface on this interface is for our callers, not for the underlying call which
+        // is effectively sync on top of the already-open AdsClient.
+        var settings = new SymbolLoaderSettings(SymbolsLoadMode.Flat);
+        var loader = SymbolLoaderFactory.Create(_client, settings);
+        await Task.Yield(); // honors the async surface; pragmatic given the loader itself is sync
+
+        foreach (ISymbol symbol in loader.Symbols)
+        {
+            if (cancellationToken.IsCancellationRequested) yield break;
+            var mapped = MapSymbolTypeName(symbol.DataType?.Name);
+            var readOnly = !IsSymbolWritable(symbol);
+            yield return new TwinCATDiscoveredSymbol(symbol.InstancePath, mapped, readOnly);
+        }
+    }
+
+    private static TwinCATDataType? MapSymbolTypeName(string? typeName) => typeName switch
+    {
+        "BOOL" or "BIT" => TwinCATDataType.Bool,
+        "SINT" or "BYTE" => TwinCATDataType.SInt,
+        "USINT" => TwinCATDataType.USInt,
+        "INT" or "WORD" => TwinCATDataType.Int,
+        "UINT" => TwinCATDataType.UInt,
+        "DINT" or "DWORD" => TwinCATDataType.DInt,
+        "UDINT" => TwinCATDataType.UDInt,
+        "LINT" or "LWORD" => TwinCATDataType.LInt,
+        "ULINT" => TwinCATDataType.ULInt,
+        "REAL" => TwinCATDataType.Real,
+        "LREAL" => TwinCATDataType.LReal,
+        "STRING" => TwinCATDataType.String,
+        "WSTRING" => TwinCATDataType.WString,
+        "TIME" => TwinCATDataType.Time,
+        "DATE" => TwinCATDataType.Date,
+        "DT" or "DATE_AND_TIME" => TwinCATDataType.DateTime,
+        "TOD" or "TIME_OF_DAY" => TwinCATDataType.TimeOfDay,
+        _ => null, // UDTs / FB instances / arrays / pointers — out of atomic scope
+    };
+
+    private static bool IsSymbolWritable(ISymbol symbol)
+    {
+        // SymbolAccessRights is a flags enum — the Write bit indicates a writable symbol.
+        // When the symbol implementation doesn't surface it, assume writable + let the PLC
+        // return AccessDenied at write time.
+        if (symbol is Symbol s) return (s.AccessRights & SymbolAccessRights.Write) != 0;
+        return true;
+    }
+
     public void Dispose()
     {
         _client.AdsNotificationEx -= OnAdsNotificationEx;

src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/ITwinCATClient.cs

@@ -66,11 +66,33 @@ public interface ITwinCATClient : IDisposable
         TimeSpan cycleTime,
         Action<string, object?> onChange,
         CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Walk the target's symbol table via the TwinCAT <c>SymbolLoaderFactory</c> (flat mode).
+    ///     Yields each top-level symbol the PLC exposes — global variables, program-scope locals,
+    ///     function-block instance fields. Filters for our atomic type surface; structured /
+    ///     UDT / function-block typed symbols surface with <c>DataType = null</c> so callers can
+    ///     decide whether to drill in via their own walker.
+    /// </summary>
+    IAsyncEnumerable<TwinCATDiscoveredSymbol> BrowseSymbolsAsync(CancellationToken cancellationToken);
 }
 
 /// <summary>Opaque handle for a registered ADS notification. <see cref="IDisposable.Dispose"/> tears it down.</summary>
 public interface ITwinCATNotificationHandle : IDisposable { }
 
+/// <summary>
+///     One symbol yielded by <see cref="ITwinCATClient.BrowseSymbolsAsync"/> — full instance
+///     path + detected <see cref="TwinCATDataType"/> + read-only flag.
+/// </summary>
+/// <param name="InstancePath">Full dotted symbol path (e.g. <c>MAIN.bStart</c>, <c>GVL.Counter</c>).</param>
+/// <param name="DataType">Mapped <see cref="TwinCATDataType"/>; <c>null</c> when the symbol's type
+///     doesn't map onto our supported atomic surface (UDTs, pointers, function blocks).</param>
+/// <param name="ReadOnly"><c>true</c> when the symbol's AccessRights flag forbids writes.</param>
+public sealed record TwinCATDiscoveredSymbol(
+    string InstancePath,
+    TwinCATDataType? DataType,
+    bool ReadOnly);
+
 /// <summary>Factory for <see cref="ITwinCATClient"/>s. One client per device.</summary>
 public interface ITwinCATClientFactory
 {

src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATDriver.cs

@@ -217,7 +217,7 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
 
     // ---- ITagDiscovery ----
 
-    public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    public async Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(builder);
         var root = builder.Folder("TwinCAT", "TwinCAT");
@@ -225,6 +225,8 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
         {
             var label = device.DeviceName ?? device.HostAddress;
             var deviceFolder = root.Folder(device.HostAddress, label);
+
+            // Pre-declared tags — always emitted as the authoritative config path.
             var tagsForDevice = _options.Tags.Where(t =>
                 string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
             foreach (var tag in tagsForDevice)
@@ -241,8 +243,42 @@ public sealed class TwinCATDriver : IDriver, IReadable, IWritable, ITagDiscovery
                     IsAlarm: false,
                     WriteIdempotent: tag.WriteIdempotent));
             }
+
+            // Controller-side symbol browse — opt-in. Falls back to pre-declared-only on any
+            // client-side error so a flaky symbol-table download doesn't block discovery.
+            if (_options.EnableControllerBrowse && _devices.TryGetValue(device.HostAddress, out var state))
+            {
+                IAddressSpaceBuilder? discoveredFolder = null;
+                try
+                {
+                    var client = await EnsureConnectedAsync(state, cancellationToken).ConfigureAwait(false);
+                    await foreach (var sym in client.BrowseSymbolsAsync(cancellationToken).ConfigureAwait(false))
+                    {
+                        if (TwinCATSystemSymbolFilter.IsSystemSymbol(sym.InstancePath)) continue;
+                        if (sym.DataType is not TwinCATDataType dt) continue; // unsupported type
+
+                        discoveredFolder ??= deviceFolder.Folder("Discovered", "Discovered");
+                        discoveredFolder.Variable(sym.InstancePath, sym.InstancePath, new DriverAttributeInfo(
+                            FullName: sym.InstancePath,
+                            DriverDataType: dt.ToDriverDataType(),
+                            IsArray: false,
+                            ArrayDim: null,
+                            SecurityClass: sym.ReadOnly
+                                ? SecurityClassification.ViewOnly
+                                : SecurityClassification.Operate,
+                            IsHistorized: false,
+                            IsAlarm: false,
+                            WriteIdempotent: false));
+                    }
+                }
+                catch (OperationCanceledException) { throw; }
+                catch
+                {
+                    // Symbol-loader failure is non-fatal to discovery — pre-declared tags already
+                    // shipped + operators see the failure in driver health on next read.
+                }
+            }
         }
-        return Task.CompletedTask;
     }
 
     // ---- ISubscribable (native ADS notifications with poll fallback) ----

src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATDriverOptions.cs

@@ -23,6 +23,15 @@ public sealed class TwinCATDriverOptions
     ///     notification limits you can't raise.
     /// </summary>
     public bool UseNativeNotifications { get; init; } = true;
+
+    /// <summary>
+    ///     When <c>true</c>, <c>DiscoverAsync</c> walks each device's symbol table via the
+    ///     TwinCAT <c>SymbolLoaderFactory</c> (flat mode) + surfaces controller-resident
+    ///     globals / program locals under a <c>Discovered/</c> sub-folder. Pre-declared tags
+    ///     from <see cref="Tags"/> always emit regardless. Default <c>false</c> to preserve
+    ///     the strict-config path for deployments where only declared tags should appear.
+    /// </summary>
+    public bool EnableControllerBrowse { get; init; }
 }
 
 /// <summary>

src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATSystemSymbolFilter.cs

@@ -0,0 +1,32 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT;
+
+/// <summary>
+///     Filter system / infrastructure symbols out of a TwinCAT symbol-loader walk. TC PLC
+///     runtimes export plumbing symbols alongside user-declared ones — <c>TwinCAT_SystemInfoVarList</c>,
+///     constants, IO task images, motion-layer internals — that clutter an OPC UA address space
+///     if exposed.
+/// </summary>
+public static class TwinCATSystemSymbolFilter
+{
+    /// <summary><c>true</c> when the symbol path matches a known system / infrastructure prefix.</summary>
+    public static bool IsSystemSymbol(string instancePath)
+    {
+        if (string.IsNullOrWhiteSpace(instancePath)) return true;
+
+        // Runtime-exported info lists.
+        if (instancePath.StartsWith("TwinCAT_SystemInfoVarList", StringComparison.OrdinalIgnoreCase)) return true;
+        if (instancePath.StartsWith("TwinCAT_", StringComparison.OrdinalIgnoreCase)) return true;
+        if (instancePath.StartsWith("Global_Version", StringComparison.OrdinalIgnoreCase)) return true;
+
+        // Constants pool — read-only, no operator value.
+        if (instancePath.StartsWith("Constants.", StringComparison.OrdinalIgnoreCase)) return true;
+
+        // Anonymous / compiler-generated.
+        if (instancePath.StartsWith("__", StringComparison.Ordinal)) return true;
+
+        // Motion / NC internals routinely surfaced by the symbol loader.
+        if (instancePath.StartsWith("Mc_", StringComparison.OrdinalIgnoreCase)) return true;
+
+        return false;
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipBoolInDIntRmwTests.cs

@@ -0,0 +1,152 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipBoolInDIntRmwTests
+{
+    /// <summary>
+    ///     Fake tag runtime that stores a DINT value + exposes Read/Write/EncodeValue/DecodeValue
+    ///     for DInt. RMW tests use one instance as the "parent" runtime (tag name "Motor.Flags")
+    ///     which the driver's WriteBitInDIntAsync reads + writes.
+    /// </summary>
+    private sealed class ParentDintFake(AbCipTagCreateParams p) : FakeAbCipTag(p)
+    {
+        // Uses the base FakeAbCipTag's Value + ReadCount + WriteCount.
+    }
+
+    [Fact]
+    public async Task Bit_set_reads_parent_ORs_bit_writes_back()
+    {
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new ParentDintFake(p) { Value = 0b0001 },
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Flag3", "ab://10.0.0.5/1,0", "Motor.Flags.3", AbCipDataType.Bool),
+            ],
+            Probe = new AbCipProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Flag3", true)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+
+        // Parent runtime created under name "Motor.Flags" — distinct from the bit-selector tag.
+        factory.Tags.ShouldContainKey("Motor.Flags");
+        factory.Tags["Motor.Flags"].Value.ShouldBe(0b1001); // bit 3 set, bit 0 preserved
+        factory.Tags["Motor.Flags"].ReadCount.ShouldBe(1);
+        factory.Tags["Motor.Flags"].WriteCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Bit_clear_preserves_other_bits()
+    {
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new ParentDintFake(p) { Value = unchecked((int)0xFFFFFFFF) },
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbCipTagDefinition("F", "ab://10.0.0.5/1,0", "Motor.Flags.3", AbCipDataType.Bool)],
+            Probe = new AbCipProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.WriteAsync([new WriteRequest("F", false)], CancellationToken.None);
+
+        var updated = Convert.ToInt32(factory.Tags["Motor.Flags"].Value);
+        (updated & (1 << 3)).ShouldBe(0);                 // bit 3 cleared
+        (updated & ~(1 << 3)).ShouldBe(unchecked((int)0xFFFFFFF7)); // every other bit preserved
+    }
+
+    [Fact]
+    public async Task Concurrent_bit_writes_to_same_parent_compose_correctly()
+    {
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new ParentDintFake(p) { Value = 0 },
+        };
+        var tags = Enumerable.Range(0, 8)
+            .Select(b => new AbCipTagDefinition($"Bit{b}", "ab://10.0.0.5/1,0", $"Flags.{b}", AbCipDataType.Bool))
+            .ToArray();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+            Probe = new AbCipProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await Task.WhenAll(Enumerable.Range(0, 8).Select(b =>
+            drv.WriteAsync([new WriteRequest($"Bit{b}", true)], CancellationToken.None)));
+
+        Convert.ToInt32(factory.Tags["Flags"].Value).ShouldBe(0xFF);
+    }
+
+    [Fact]
+    public async Task Bit_writes_to_different_parents_each_get_own_runtime()
+    {
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new ParentDintFake(p) { Value = 0 },
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "Motor1.Flags.0", AbCipDataType.Bool),
+                new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "Motor2.Flags.0", AbCipDataType.Bool),
+            ],
+            Probe = new AbCipProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.WriteAsync([new WriteRequest("A", true)], CancellationToken.None);
+        await drv.WriteAsync([new WriteRequest("B", true)], CancellationToken.None);
+
+        factory.Tags.ShouldContainKey("Motor1.Flags");
+        factory.Tags.ShouldContainKey("Motor2.Flags");
+    }
+
+    [Fact]
+    public async Task Repeat_bit_writes_reuse_one_parent_runtime()
+    {
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new ParentDintFake(p) { Value = 0 },
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Bit0", "ab://10.0.0.5/1,0", "Flags.0", AbCipDataType.Bool),
+                new AbCipTagDefinition("Bit5", "ab://10.0.0.5/1,0", "Flags.5", AbCipDataType.Bool),
+            ],
+            Probe = new AbCipProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.WriteAsync([new WriteRequest("Bit0", true)], CancellationToken.None);
+        await drv.WriteAsync([new WriteRequest("Bit5", true)], CancellationToken.None);
+
+        // Three factory invocations: two bit-selector tags (never used for writes, but the
+        // driver may create them opportunistically) + one shared parent. Assert the parent was
+        // init'd exactly once + used for both writes.
+        factory.Tags["Flags"].InitializeCount.ShouldBe(1);
+        factory.Tags["Flags"].WriteCount.ShouldBe(2);
+        Convert.ToInt32(factory.Tags["Flags"].Value).ShouldBe(0x21); // bits 0 + 5
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverWriteTests.cs

@@ -60,9 +60,12 @@ public sealed class AbCipDriverWriteTests
     }
 
     [Fact]
-    public async Task Bit_in_dint_write_returns_BadNotSupported()
+    public async Task Bit_in_dint_write_now_succeeds_via_RMW()
     {
-        var factory = new FakeAbCipTagFactory { Customise = p => new ThrowingBoolBitFake(p) };
+        // Task #181 pass 2 lifted this gap — BOOL-within-DINT writes now go through
+        // WriteBitInDIntAsync + a parallel parent-DINT runtime, so the result is Good rather
+        // than BadNotSupported. Full RMW semantics covered by AbCipBoolInDIntRmwTests.
+        var factory = new FakeAbCipTagFactory();
         var drv = new AbCipDriver(new AbCipDriverOptions
         {
             Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
@@ -73,7 +76,7 @@ public sealed class AbCipDriverWriteTests
         var results = await drv.WriteAsync(
             [new WriteRequest("Flag3", true)], CancellationToken.None);
 
-        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotSupported);
+        results.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
     }
 
     [Fact]

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/AbLegacyBitRmwTests.cs

@@ -0,0 +1,104 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbLegacyBitRmwTests
+{
+    [Fact]
+    public async Task Bit_set_reads_parent_word_ORs_bit_writes_back()
+    {
+        var factory = new FakeAbLegacyTagFactory
+        {
+            Customise = p => new FakeAbLegacyTag(p) { Value = (short)0b0001 },
+        };
+        var drv = new AbLegacyDriver(new AbLegacyDriverOptions
+        {
+            Devices = [new AbLegacyDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbLegacyTagDefinition("Flag3", "ab://10.0.0.5/1,0", "N7:0/3", AbLegacyDataType.Bit)],
+            Probe = new AbLegacyProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Flag3", true)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(AbLegacyStatusMapper.Good);
+        factory.Tags.ShouldContainKey("N7:0"); // parent word runtime created
+        Convert.ToInt32(factory.Tags["N7:0"].Value).ShouldBe(0b1001);
+    }
+
+    [Fact]
+    public async Task Bit_clear_preserves_other_bits_in_N_file_word()
+    {
+        var factory = new FakeAbLegacyTagFactory
+        {
+            Customise = p => new FakeAbLegacyTag(p) { Value = unchecked((short)0xFFFF) },
+        };
+        var drv = new AbLegacyDriver(new AbLegacyDriverOptions
+        {
+            Devices = [new AbLegacyDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = [new AbLegacyTagDefinition("F", "ab://10.0.0.5/1,0", "N7:0/3", AbLegacyDataType.Bit)],
+            Probe = new AbLegacyProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.WriteAsync([new WriteRequest("F", false)], CancellationToken.None);
+
+        Convert.ToInt32(factory.Tags["N7:0"].Value).ShouldBe(unchecked((short)0xFFF7));
+    }
+
+    [Fact]
+    public async Task Concurrent_bit_writes_to_same_word_compose_correctly()
+    {
+        var factory = new FakeAbLegacyTagFactory
+        {
+            Customise = p => new FakeAbLegacyTag(p) { Value = (short)0 },
+        };
+        var tags = Enumerable.Range(0, 8)
+            .Select(b => new AbLegacyTagDefinition($"Bit{b}", "ab://10.0.0.5/1,0", $"N7:0/{b}", AbLegacyDataType.Bit))
+            .ToArray();
+        var drv = new AbLegacyDriver(new AbLegacyDriverOptions
+        {
+            Devices = [new AbLegacyDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags = tags,
+            Probe = new AbLegacyProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await Task.WhenAll(Enumerable.Range(0, 8).Select(b =>
+            drv.WriteAsync([new WriteRequest($"Bit{b}", true)], CancellationToken.None)));
+
+        Convert.ToInt32(factory.Tags["N7:0"].Value).ShouldBe(0xFF);
+    }
+
+    [Fact]
+    public async Task Repeat_bit_writes_reuse_parent_runtime()
+    {
+        var factory = new FakeAbLegacyTagFactory
+        {
+            Customise = p => new FakeAbLegacyTag(p) { Value = (short)0 },
+        };
+        var drv = new AbLegacyDriver(new AbLegacyDriverOptions
+        {
+            Devices = [new AbLegacyDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbLegacyTagDefinition("Bit0", "ab://10.0.0.5/1,0", "N7:0/0", AbLegacyDataType.Bit),
+                new AbLegacyTagDefinition("Bit5", "ab://10.0.0.5/1,0", "N7:0/5", AbLegacyDataType.Bit),
+            ],
+            Probe = new AbLegacyProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.WriteAsync([new WriteRequest("Bit0", true)], CancellationToken.None);
+        await drv.WriteAsync([new WriteRequest("Bit5", true)], CancellationToken.None);
+
+        factory.Tags["N7:0"].InitializeCount.ShouldBe(1);
+        factory.Tags["N7:0"].WriteCount.ShouldBe(2);
+        Convert.ToInt32(factory.Tags["N7:0"].Value).ShouldBe(0x21); // bits 0 + 5
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/AbLegacyReadWriteTests.cs

@@ -157,9 +157,12 @@ public sealed class AbLegacyReadWriteTests
     }
 
     [Fact]
-    public async Task Bit_within_word_write_rejected_as_BadNotSupported()
+    public async Task Bit_within_word_write_now_succeeds_via_RMW()
     {
-        var factory = new FakeAbLegacyTagFactory { Customise = p => new RmwThrowingFake(p) };
+        // Task #181 pass 2 lifted this gap — N-file bit writes now go through
+        // WriteBitInWordAsync + a parallel parent-word runtime, so the status is Good rather
+        // than BadNotSupported. Full RMW semantics covered by AbLegacyBitRmwTests.
+        var factory = new FakeAbLegacyTagFactory();
         var drv = new AbLegacyDriver(new AbLegacyDriverOptions
         {
             Devices = [new AbLegacyDeviceOptions("ab://10.0.0.5/1,0")],
@@ -170,7 +173,7 @@ public sealed class AbLegacyReadWriteTests
         var results = await drv.WriteAsync(
             [new WriteRequest("Bit3", true)], CancellationToken.None);
 
-        results.Single().StatusCode.ShouldBe(AbLegacyStatusMapper.BadNotSupported);
+        results.Single().StatusCode.ShouldBe(AbLegacyStatusMapper.Good);
     }
 
     [Fact]

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FakeFocasClient.cs

@@ -0,0 +1,69 @@
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests;
+
+internal class FakeFocasClient : IFocasClient
+{
+    public bool IsConnected { get; private set; }
+    public int ConnectCount { get; private set; }
+    public int DisposeCount { get; private set; }
+    public bool ThrowOnConnect { get; set; }
+    public bool ThrowOnRead { get; set; }
+    public bool ThrowOnWrite { get; set; }
+    public bool ProbeResult { get; set; } = true;
+    public Exception? Exception { get; set; }
+
+    public Dictionary<string, object?> Values { get; } = new(StringComparer.OrdinalIgnoreCase);
+    public Dictionary<string, uint> ReadStatuses { get; } = new(StringComparer.OrdinalIgnoreCase);
+    public Dictionary<string, uint> WriteStatuses { get; } = new(StringComparer.OrdinalIgnoreCase);
+    public List<(FocasAddress addr, FocasDataType type, object? value)> WriteLog { get; } = new();
+
+    public virtual Task ConnectAsync(FocasHostAddress address, TimeSpan timeout, CancellationToken ct)
+    {
+        ConnectCount++;
+        if (ThrowOnConnect) throw Exception ?? new InvalidOperationException();
+        IsConnected = true;
+        return Task.CompletedTask;
+    }
+
+    public virtual Task<(object? value, uint status)> ReadAsync(
+        FocasAddress address, FocasDataType type, CancellationToken ct)
+    {
+        if (ThrowOnRead) throw Exception ?? new InvalidOperationException();
+        var key = address.Canonical;
+        var status = ReadStatuses.TryGetValue(key, out var s) ? s : FocasStatusMapper.Good;
+        var value = Values.TryGetValue(key, out var v) ? v : null;
+        return Task.FromResult((value, status));
+    }
+
+    public virtual Task<uint> WriteAsync(
+        FocasAddress address, FocasDataType type, object? value, CancellationToken ct)
+    {
+        if (ThrowOnWrite) throw Exception ?? new InvalidOperationException();
+        WriteLog.Add((address, type, value));
+        Values[address.Canonical] = value;
+        var status = WriteStatuses.TryGetValue(address.Canonical, out var s) ? s : FocasStatusMapper.Good;
+        return Task.FromResult(status);
+    }
+
+    public virtual Task<bool> ProbeAsync(CancellationToken ct) => Task.FromResult(ProbeResult);
+
+    public virtual void Dispose()
+    {
+        DisposeCount++;
+        IsConnected = false;
+    }
+}
+
+internal sealed class FakeFocasClientFactory : IFocasClientFactory
+{
+    public List<FakeFocasClient> Clients { get; } = new();
+    public Func<FakeFocasClient>? Customise { get; set; }
+
+    public IFocasClient Create()
+    {
+        var c = Customise?.Invoke() ?? new FakeFocasClient();
+        Clients.Add(c);
+        return c;
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FocasCapabilityTests.cs

@@ -0,0 +1,239 @@
+using System.Collections.Concurrent;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class FocasCapabilityTests
+{
+    // ---- ITagDiscovery ----
+
+    [Fact]
+    public async Task DiscoverAsync_emits_pre_declared_tags()
+    {
+        var builder = new RecordingBuilder();
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193", DeviceName: "Lathe-1")],
+            Tags =
+            [
+                new FocasTagDefinition("Run", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte),
+                new FocasTagDefinition("Alarm", "focas://10.0.0.5:8193", "R200", FocasDataType.Byte, Writable: false),
+            ],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", new FakeFocasClientFactory());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "FOCAS");
+        builder.Folders.ShouldContain(f => f.BrowseName == "focas://10.0.0.5:8193" && f.DisplayName == "Lathe-1");
+        builder.Variables.Single(v => v.BrowseName == "Run").Info.SecurityClass.ShouldBe(SecurityClassification.Operate);
+        builder.Variables.Single(v => v.BrowseName == "Alarm").Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    // ---- ISubscribable ----
+
+    [Fact]
+    public async Task Subscribe_initial_poll_raises_OnDataChange()
+    {
+        var factory = new FakeFocasClientFactory
+        {
+            Customise = () => new FakeFocasClient { Values = { ["R100"] = (sbyte)42 } },
+        };
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Tags = [new FocasTagDefinition("X", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte)],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        var handle = await drv.SubscribeAsync(["X"], TimeSpan.FromMilliseconds(200), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(2));
+
+        events.First().Snapshot.Value.ShouldBe((sbyte)42);
+        await drv.UnsubscribeAsync(handle, CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_cancels_active_subscriptions()
+    {
+        var factory = new FakeFocasClientFactory
+        {
+            Customise = () => new FakeFocasClient { Values = { ["R100"] = (sbyte)1 } },
+        };
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Tags = [new FocasTagDefinition("X", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte)],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var events = new ConcurrentQueue<DataChangeEventArgs>();
+        drv.OnDataChange += (_, e) => events.Enqueue(e);
+
+        _ = await drv.SubscribeAsync(["X"], TimeSpan.FromMilliseconds(100), CancellationToken.None);
+        await WaitForAsync(() => events.Count >= 1, TimeSpan.FromSeconds(1));
+        await drv.ShutdownAsync(CancellationToken.None);
+
+        var afterShutdown = events.Count;
+        await Task.Delay(200);
+        events.Count.ShouldBe(afterShutdown);
+    }
+
+    // ---- IHostConnectivityProbe ----
+
+    [Fact]
+    public async Task GetHostStatuses_returns_entry_per_device()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices =
+            [
+                new FocasDeviceOptions("focas://10.0.0.5:8193"),
+                new FocasDeviceOptions("focas://10.0.0.6:8193"),
+            ],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", new FakeFocasClientFactory());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        drv.GetHostStatuses().Count.ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task Probe_transitions_to_Running_on_success()
+    {
+        var factory = new FakeFocasClientFactory
+        {
+            Customise = () => new FakeFocasClient { ProbeResult = true },
+        };
+        var transitions = new ConcurrentQueue<HostStatusChangedEventArgs>();
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Probe = new FocasProbeOptions
+            {
+                Enabled = true, Interval = TimeSpan.FromMilliseconds(100),
+                Timeout = TimeSpan.FromMilliseconds(50),
+            },
+        }, "drv-1", factory);
+        drv.OnHostStatusChanged += (_, e) => transitions.Enqueue(e);
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        await WaitForAsync(() => transitions.Any(t => t.NewState == HostState.Running), TimeSpan.FromSeconds(2));
+
+        drv.GetHostStatuses().Single().State.ShouldBe(HostState.Running);
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task Probe_transitions_to_Stopped_on_failure()
+    {
+        var factory = new FakeFocasClientFactory
+        {
+            Customise = () => new FakeFocasClient { ProbeResult = false },
+        };
+        var transitions = new ConcurrentQueue<HostStatusChangedEventArgs>();
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Probe = new FocasProbeOptions
+            {
+                Enabled = true, Interval = TimeSpan.FromMilliseconds(100),
+                Timeout = TimeSpan.FromMilliseconds(50),
+            },
+        }, "drv-1", factory);
+        drv.OnHostStatusChanged += (_, e) => transitions.Enqueue(e);
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        await WaitForAsync(() => transitions.Any(t => t.NewState == HostState.Stopped), TimeSpan.FromSeconds(2));
+
+        drv.GetHostStatuses().Single().State.ShouldBe(HostState.Stopped);
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+
+    // ---- IPerCallHostResolver ----
+
+    [Fact]
+    public async Task ResolveHost_returns_declared_device_for_known_tag()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices =
+            [
+                new FocasDeviceOptions("focas://10.0.0.5:8193"),
+                new FocasDeviceOptions("focas://10.0.0.6:8193"),
+            ],
+            Tags =
+            [
+                new FocasTagDefinition("A", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte),
+                new FocasTagDefinition("B", "focas://10.0.0.6:8193", "R100", FocasDataType.Byte),
+            ],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", new FakeFocasClientFactory());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        drv.ResolveHost("A").ShouldBe("focas://10.0.0.5:8193");
+        drv.ResolveHost("B").ShouldBe("focas://10.0.0.6:8193");
+    }
+
+    [Fact]
+    public async Task ResolveHost_falls_back_to_first_device_for_unknown()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", new FakeFocasClientFactory());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        drv.ResolveHost("missing").ShouldBe("focas://10.0.0.5:8193");
+    }
+
+    [Fact]
+    public async Task ResolveHost_falls_back_to_DriverInstanceId_when_no_devices()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions(), "drv-1", new FakeFocasClientFactory());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        drv.ResolveHost("anything").ShouldBe("drv-1");
+    }
+
+    // ---- helpers ----
+
+    private static async Task WaitForAsync(Func<bool> condition, TimeSpan timeout)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (!condition() && DateTime.UtcNow < deadline)
+            await Task.Delay(20);
+    }
+
+    private sealed class RecordingBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, string DisplayName)> Folders { get; } = new();
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = new();
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName)
+        { Folders.Add((browseName, displayName)); return this; }
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        { Variables.Add((browseName, info)); return new Handle(info.FullName); }
+
+        public void AddProperty(string _, DriverDataType __, object? ___) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+        private sealed class NullSink : IAlarmConditionSink { public void OnTransition(AlarmEventArgs args) { } }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FocasPmcBitRmwTests.cs

@@ -0,0 +1,123 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class FocasPmcBitRmwTests
+{
+    /// <summary>
+    ///     Fake client simulating PMC byte storage + exposing it as a sbyte so RMW callers can
+    ///     observe the read-modify-write round-trip. ReadAsync for a Bit with bitIndex surfaces
+    ///     the current bit; WriteAsync stores the full byte the driver issues.
+    /// </summary>
+    private sealed class PmcRmwFake : FakeFocasClient
+    {
+        public byte[] PmcBytes { get; } = new byte[1024];
+
+        public override Task<(object? value, uint status)> ReadAsync(
+            FocasAddress address, FocasDataType type, CancellationToken ct)
+        {
+            if (address.Kind == FocasAreaKind.Pmc && type == FocasDataType.Byte)
+                return Task.FromResult(((object?)(sbyte)PmcBytes[address.Number], FocasStatusMapper.Good));
+            if (address.Kind == FocasAreaKind.Pmc && type == FocasDataType.Bit && address.BitIndex is int bit)
+                return Task.FromResult(((object?)((PmcBytes[address.Number] & (1 << bit)) != 0), FocasStatusMapper.Good));
+            return base.ReadAsync(address, type, ct);
+        }
+
+        public override Task<uint> WriteAsync(
+            FocasAddress address, FocasDataType type, object? value, CancellationToken ct)
+        {
+            // Driver writes the full byte after RMW (type==Byte with full byte value), OR a raw
+            // bit write (type==Bit, bitIndex non-null) — depending on how the driver routes it.
+            if (address.Kind == FocasAreaKind.Pmc && type == FocasDataType.Byte)
+            {
+                PmcBytes[address.Number] = (byte)Convert.ToSByte(value);
+                return Task.FromResult(FocasStatusMapper.Good);
+            }
+            if (address.Kind == FocasAreaKind.Pmc && type == FocasDataType.Bit && address.BitIndex is int bit)
+            {
+                var current = PmcBytes[address.Number];
+                PmcBytes[address.Number] = Convert.ToBoolean(value)
+                    ? (byte)(current | (1 << bit))
+                    : (byte)(current & ~(1 << bit));
+                return Task.FromResult(FocasStatusMapper.Good);
+            }
+            return base.WriteAsync(address, type, value, ct);
+        }
+    }
+
+    private static (FocasDriver drv, PmcRmwFake fake) NewDriver(params FocasTagDefinition[] tags)
+    {
+        var fake = new PmcRmwFake();
+        var factory = new FakeFocasClientFactory { Customise = () => fake };
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Tags = tags,
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        return (drv, fake);
+    }
+
+    [Fact]
+    public async Task Bit_set_surfaces_as_Good_status_and_flips_bit()
+    {
+        var (drv, fake) = NewDriver(
+            new FocasTagDefinition("Run", "focas://10.0.0.5:8193", "R100.3", FocasDataType.Bit));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        fake.PmcBytes[100] = 0b0000_0001;
+
+        var results = await drv.WriteAsync([new WriteRequest("Run", true)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(FocasStatusMapper.Good);
+        fake.PmcBytes[100].ShouldBe((byte)0b0000_1001);
+    }
+
+    [Fact]
+    public async Task Bit_clear_preserves_other_bits()
+    {
+        var (drv, fake) = NewDriver(
+            new FocasTagDefinition("Flag", "focas://10.0.0.5:8193", "R100.3", FocasDataType.Bit));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        fake.PmcBytes[100] = 0xFF;
+
+        await drv.WriteAsync([new WriteRequest("Flag", false)], CancellationToken.None);
+
+        fake.PmcBytes[100].ShouldBe((byte)0b1111_0111);
+    }
+
+    [Fact]
+    public async Task Subsequent_bit_sets_in_same_byte_compose_correctly()
+    {
+        var tags = Enumerable.Range(0, 8)
+            .Select(b => new FocasTagDefinition($"Bit{b}", "focas://10.0.0.5:8193", $"R100.{b}", FocasDataType.Bit))
+            .ToArray();
+        var (drv, fake) = NewDriver(tags);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        fake.PmcBytes[100] = 0;
+
+        for (var b = 0; b < 8; b++)
+            await drv.WriteAsync([new WriteRequest($"Bit{b}", true)], CancellationToken.None);
+
+        fake.PmcBytes[100].ShouldBe((byte)0xFF);
+    }
+
+    [Fact]
+    public async Task Bit_write_to_different_bytes_does_not_contend()
+    {
+        var tags = Enumerable.Range(0, 4)
+            .Select(i => new FocasTagDefinition($"Bit{i}", "focas://10.0.0.5:8193", $"R{50 + i}.0", FocasDataType.Bit))
+            .ToArray();
+        var (drv, fake) = NewDriver(tags);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await Task.WhenAll(Enumerable.Range(0, 4).Select(i =>
+            drv.WriteAsync([new WriteRequest($"Bit{i}", true)], CancellationToken.None)));
+
+        for (var i = 0; i < 4; i++)
+            fake.PmcBytes[50 + i].ShouldBe((byte)0x01);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FocasReadWriteTests.cs

@@ -0,0 +1,261 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class FocasReadWriteTests
+{
+    private static (FocasDriver drv, FakeFocasClientFactory factory) NewDriver(params FocasTagDefinition[] tags)
+    {
+        var factory = new FakeFocasClientFactory();
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Tags = tags,
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        return (drv, factory);
+    }
+
+    // ---- Read ----
+
+    [Fact]
+    public async Task Unknown_reference_maps_to_BadNodeIdUnknown()
+    {
+        var (drv, _) = NewDriver();
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["missing"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(FocasStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Successful_PMC_read_returns_Good_value()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("Run", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient { Values = { ["R100"] = (sbyte)5 } };
+
+        var snapshots = await drv.ReadAsync(["Run"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(FocasStatusMapper.Good);
+        snapshots.Single().Value.ShouldBe((sbyte)5);
+    }
+
+    [Fact]
+    public async Task Parameter_read_routes_through_FocasAddress_Parameter_kind()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("Accel", "focas://10.0.0.5:8193", "PARAM:1820", FocasDataType.Int32));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient { Values = { ["PARAM:1820"] = 1500 } };
+
+        var snapshots = await drv.ReadAsync(["Accel"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(FocasStatusMapper.Good);
+        snapshots.Single().Value.ShouldBe(1500);
+    }
+
+    [Fact]
+    public async Task Macro_read_routes_through_FocasAddress_Macro_kind()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("CustomVar", "focas://10.0.0.5:8193", "MACRO:500", FocasDataType.Float64));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient { Values = { ["MACRO:500"] = 3.14159 } };
+
+        var snapshots = await drv.ReadAsync(["CustomVar"], CancellationToken.None);
+        snapshots.Single().Value.ShouldBe(3.14159);
+    }
+
+    [Fact]
+    public async Task Repeat_read_reuses_connection()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("X", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient { Values = { ["R100"] = (sbyte)1 } };
+
+        await drv.ReadAsync(["X"], CancellationToken.None);
+        await drv.ReadAsync(["X"], CancellationToken.None);
+
+        factory.Clients.Count.ShouldBe(1);
+        factory.Clients[0].ConnectCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task FOCAS_error_status_maps_via_status_mapper()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("Ghost", "focas://10.0.0.5:8193", "R999", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () =>
+        {
+            var c = new FakeFocasClient();
+            c.ReadStatuses["R999"] = FocasStatusMapper.BadNodeIdUnknown;
+            return c;
+        };
+
+        var snapshots = await drv.ReadAsync(["Ghost"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(FocasStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Read_exception_surfaces_BadCommunicationError()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("X", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient { ThrowOnRead = true };
+
+        var snapshots = await drv.ReadAsync(["X"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(FocasStatusMapper.BadCommunicationError);
+        drv.GetHealth().State.ShouldBe(DriverState.Degraded);
+    }
+
+    [Fact]
+    public async Task Connect_failure_disposes_client_and_surfaces_BadCommunicationError()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("X", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient { ThrowOnConnect = true };
+
+        var snapshots = await drv.ReadAsync(["X"], CancellationToken.None);
+        snapshots.Single().StatusCode.ShouldBe(FocasStatusMapper.BadCommunicationError);
+        factory.Clients[0].DisposeCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Batched_reads_preserve_order_across_areas()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("A", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte),
+            new FocasTagDefinition("B", "focas://10.0.0.5:8193", "PARAM:1820", FocasDataType.Int32),
+            new FocasTagDefinition("C", "focas://10.0.0.5:8193", "MACRO:500", FocasDataType.Float64));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient
+        {
+            Values =
+            {
+                ["R100"] = (sbyte)5,
+                ["PARAM:1820"] = 1500,
+                ["MACRO:500"] = 2.718,
+            },
+        };
+
+        var snapshots = await drv.ReadAsync(["A", "B", "C"], CancellationToken.None);
+        snapshots[0].Value.ShouldBe((sbyte)5);
+        snapshots[1].Value.ShouldBe(1500);
+        snapshots[2].Value.ShouldBe(2.718);
+    }
+
+    // ---- Write ----
+
+    [Fact]
+    public async Task Non_writable_tag_rejected_with_BadNotWritable()
+    {
+        var (drv, _) = NewDriver(
+            new FocasTagDefinition("RO", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte, Writable: false));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("RO", 1)], CancellationToken.None);
+        results.Single().StatusCode.ShouldBe(FocasStatusMapper.BadNotWritable);
+    }
+
+    [Fact]
+    public async Task Successful_write_logs_address_type_value()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("Speed", "focas://10.0.0.5:8193", "R100", FocasDataType.Int16));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Speed", (short)1800)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(FocasStatusMapper.Good);
+        var write = factory.Clients[0].WriteLog.Single();
+        write.addr.Canonical.ShouldBe("R100");
+        write.type.ShouldBe(FocasDataType.Int16);
+        write.value.ShouldBe((short)1800);
+    }
+
+    [Fact]
+    public async Task Write_status_code_maps_via_FocasStatusMapper()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("Protected", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () =>
+        {
+            var c = new FakeFocasClient();
+            c.WriteStatuses["R100"] = FocasStatusMapper.BadNotWritable;
+            return c;
+        };
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("Protected", (sbyte)1)], CancellationToken.None);
+        results.Single().StatusCode.ShouldBe(FocasStatusMapper.BadNotWritable);
+    }
+
+    [Fact]
+    public async Task Batch_write_preserves_order_across_outcomes()
+    {
+        var factory = new FakeFocasClientFactory();
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Tags =
+            [
+                new FocasTagDefinition("A", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte),
+                new FocasTagDefinition("B", "focas://10.0.0.5:8193", "R101", FocasDataType.Byte, Writable: false),
+            ],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("A", (sbyte)1),
+            new WriteRequest("B", (sbyte)2),
+            new WriteRequest("Unknown", (sbyte)3),
+        ], CancellationToken.None);
+
+        results[0].StatusCode.ShouldBe(FocasStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(FocasStatusMapper.BadNotWritable);
+        results[2].StatusCode.ShouldBe(FocasStatusMapper.BadNodeIdUnknown);
+    }
+
+    [Fact]
+    public async Task Cancellation_propagates()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("X", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient
+        {
+            ThrowOnRead = true,
+            Exception = new OperationCanceledException(),
+        };
+
+        await Should.ThrowAsync<OperationCanceledException>(
+            () => drv.ReadAsync(["X"], CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_disposes_client()
+    {
+        var (drv, factory) = NewDriver(
+            new FocasTagDefinition("X", "focas://10.0.0.5:8193", "R100", FocasDataType.Byte));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = () => new FakeFocasClient { Values = { ["R100"] = (sbyte)1 } };
+
+        await drv.ReadAsync(["X"], CancellationToken.None);
+        await drv.ShutdownAsync(CancellationToken.None);
+
+        factory.Clients[0].DisposeCount.ShouldBe(1);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FocasScaffoldingTests.cs

@@ -0,0 +1,229 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class FocasScaffoldingTests
+{
+    // ---- FocasHostAddress ----
+
+    [Theory]
+    [InlineData("focas://10.0.0.5:8193", "10.0.0.5", 8193)]
+    [InlineData("focas://10.0.0.5", "10.0.0.5", 8193)]                         // default port
+    [InlineData("focas://cnc-01.factory.internal:8193", "cnc-01.factory.internal", 8193)]
+    [InlineData("focas://10.0.0.5:12345", "10.0.0.5", 12345)]
+    [InlineData("FOCAS://10.0.0.5:8193", "10.0.0.5", 8193)]                    // case-insensitive scheme
+    public void HostAddress_parses_valid(string input, string host, int port)
+    {
+        var parsed = FocasHostAddress.TryParse(input);
+        parsed.ShouldNotBeNull();
+        parsed.Host.ShouldBe(host);
+        parsed.Port.ShouldBe(port);
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("http://10.0.0.5/")]
+    [InlineData("focas:10.0.0.5:8193")]          // missing //
+    [InlineData("focas://")]                     // empty body
+    [InlineData("focas://10.0.0.5:0")]           // port 0
+    [InlineData("focas://10.0.0.5:65536")]       // port out of range
+    [InlineData("focas://10.0.0.5:abc")]         // non-numeric port
+    public void HostAddress_rejects_invalid(string? input)
+    {
+        FocasHostAddress.TryParse(input).ShouldBeNull();
+    }
+
+    [Fact]
+    public void HostAddress_ToString_strips_default_port()
+    {
+        new FocasHostAddress("10.0.0.5", 8193).ToString().ShouldBe("focas://10.0.0.5");
+        new FocasHostAddress("10.0.0.5", 12345).ToString().ShouldBe("focas://10.0.0.5:12345");
+    }
+
+    // ---- FocasAddress ----
+
+    [Theory]
+    [InlineData("X0.0", FocasAreaKind.Pmc, "X", 0, 0)]
+    [InlineData("X0", FocasAreaKind.Pmc, "X", 0, null)]
+    [InlineData("Y10", FocasAreaKind.Pmc, "Y", 10, null)]
+    [InlineData("F20.3", FocasAreaKind.Pmc, "F", 20, 3)]
+    [InlineData("G54", FocasAreaKind.Pmc, "G", 54, null)]
+    [InlineData("R100", FocasAreaKind.Pmc, "R", 100, null)]
+    [InlineData("D200", FocasAreaKind.Pmc, "D", 200, null)]
+    [InlineData("C300", FocasAreaKind.Pmc, "C", 300, null)]
+    [InlineData("K400", FocasAreaKind.Pmc, "K", 400, null)]
+    [InlineData("A500", FocasAreaKind.Pmc, "A", 500, null)]
+    [InlineData("E600", FocasAreaKind.Pmc, "E", 600, null)]
+    [InlineData("T50.4", FocasAreaKind.Pmc, "T", 50, 4)]
+    public void Address_parses_PMC_forms(string input, FocasAreaKind kind, string letter, int num, int? bit)
+    {
+        var a = FocasAddress.TryParse(input);
+        a.ShouldNotBeNull();
+        a.Kind.ShouldBe(kind);
+        a.PmcLetter.ShouldBe(letter);
+        a.Number.ShouldBe(num);
+        a.BitIndex.ShouldBe(bit);
+    }
+
+    [Theory]
+    [InlineData("PARAM:1020", FocasAreaKind.Parameter, 1020, null)]
+    [InlineData("PARAM:1815/0", FocasAreaKind.Parameter, 1815, 0)]
+    [InlineData("PARAM:1815/31", FocasAreaKind.Parameter, 1815, 31)]
+    public void Address_parses_parameter_forms(string input, FocasAreaKind kind, int num, int? bit)
+    {
+        var a = FocasAddress.TryParse(input);
+        a.ShouldNotBeNull();
+        a.Kind.ShouldBe(kind);
+        a.PmcLetter.ShouldBeNull();
+        a.Number.ShouldBe(num);
+        a.BitIndex.ShouldBe(bit);
+    }
+
+    [Theory]
+    [InlineData("MACRO:100", FocasAreaKind.Macro, 100)]
+    [InlineData("MACRO:500", FocasAreaKind.Macro, 500)]
+    public void Address_parses_macro_forms(string input, FocasAreaKind kind, int num)
+    {
+        var a = FocasAddress.TryParse(input);
+        a.ShouldNotBeNull();
+        a.Kind.ShouldBe(kind);
+        a.Number.ShouldBe(num);
+        a.BitIndex.ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("Z0")]                   // unknown PMC letter
+    [InlineData("X")]                    // missing number
+    [InlineData("X-1")]                  // negative number
+    [InlineData("Xabc")]                 // non-numeric
+    [InlineData("X0.8")]                 // bit out of range (0-7)
+    [InlineData("X0.-1")]                // negative bit
+    [InlineData("PARAM:")]               // missing number
+    [InlineData("PARAM:1815/32")]        // bit out of range (0-31)
+    [InlineData("MACRO:abc")]            // non-numeric
+    public void Address_rejects_invalid_forms(string? input)
+    {
+        FocasAddress.TryParse(input).ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData("X0.0")]
+    [InlineData("R100")]
+    [InlineData("F20.3")]
+    [InlineData("PARAM:1020")]
+    [InlineData("PARAM:1815/0")]
+    [InlineData("MACRO:100")]
+    public void Address_Canonical_roundtrips(string input)
+    {
+        var parsed = FocasAddress.TryParse(input);
+        parsed.ShouldNotBeNull();
+        parsed.Canonical.ShouldBe(input);
+    }
+
+    // ---- FocasDataType ----
+
+    [Fact]
+    public void DataType_mapping_covers_atomic_focas_types()
+    {
+        FocasDataType.Bit.ToDriverDataType().ShouldBe(DriverDataType.Boolean);
+        FocasDataType.Int16.ToDriverDataType().ShouldBe(DriverDataType.Int32);
+        FocasDataType.Int32.ToDriverDataType().ShouldBe(DriverDataType.Int32);
+        FocasDataType.Float32.ToDriverDataType().ShouldBe(DriverDataType.Float32);
+        FocasDataType.Float64.ToDriverDataType().ShouldBe(DriverDataType.Float64);
+        FocasDataType.String.ToDriverDataType().ShouldBe(DriverDataType.String);
+    }
+
+    // ---- FocasStatusMapper ----
+
+    [Theory]
+    [InlineData(0, FocasStatusMapper.Good)]
+    [InlineData(3, FocasStatusMapper.BadOutOfRange)]         // EW_NUMBER
+    [InlineData(4, FocasStatusMapper.BadOutOfRange)]         // EW_LENGTH
+    [InlineData(5, FocasStatusMapper.BadNotWritable)]        // EW_PROT
+    [InlineData(6, FocasStatusMapper.BadNotSupported)]       // EW_NOOPT
+    [InlineData(8, FocasStatusMapper.BadNodeIdUnknown)]      // EW_DATA
+    [InlineData(-1, FocasStatusMapper.BadDeviceFailure)]     // EW_BUSY
+    [InlineData(-8, FocasStatusMapper.BadInternalError)]     // EW_HANDLE
+    [InlineData(-16, FocasStatusMapper.BadCommunicationError)] // EW_SOCKET
+    [InlineData(999, FocasStatusMapper.BadCommunicationError)] // unknown → generic
+    public void StatusMapper_covers_known_focas_returns(int ret, uint expected)
+    {
+        FocasStatusMapper.MapFocasReturn(ret).ShouldBe(expected);
+    }
+
+    // ---- FocasDriver ----
+
+    [Fact]
+    public void DriverType_is_FOCAS()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions(), "drv-1");
+        drv.DriverType.ShouldBe("FOCAS");
+        drv.DriverInstanceId.ShouldBe("drv-1");
+    }
+
+    [Fact]
+    public async Task InitializeAsync_parses_device_addresses()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices =
+            [
+                new FocasDeviceOptions("focas://10.0.0.5:8193"),
+                new FocasDeviceOptions("focas://10.0.0.6:12345", DeviceName: "CNC-2"),
+            ],
+        }, "drv-1");
+
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        drv.DeviceCount.ShouldBe(2);
+        drv.GetDeviceState("focas://10.0.0.5:8193")!.ParsedAddress.Port.ShouldBe(8193);
+        drv.GetDeviceState("focas://10.0.0.6:12345")!.Options.DeviceName.ShouldBe("CNC-2");
+    }
+
+    [Fact]
+    public async Task InitializeAsync_malformed_address_faults()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("not-an-address")],
+        }, "drv-1");
+
+        await Should.ThrowAsync<InvalidOperationException>(
+            () => drv.InitializeAsync("{}", CancellationToken.None));
+        drv.GetHealth().State.ShouldBe(DriverState.Faulted);
+    }
+
+    [Fact]
+    public async Task ShutdownAsync_clears_devices()
+    {
+        var drv = new FocasDriver(new FocasDriverOptions
+        {
+            Devices = [new FocasDeviceOptions("focas://10.0.0.5:8193")],
+            Probe = new FocasProbeOptions { Enabled = false },
+        }, "drv-1");
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.ShutdownAsync(CancellationToken.None);
+        drv.DeviceCount.ShouldBe(0);
+        drv.GetHealth().State.ShouldBe(DriverState.Unknown);
+    }
+
+    // ---- UnimplementedFocasClientFactory ----
+
+    [Fact]
+    public void Default_factory_throws_on_Create_with_deployment_pointer()
+    {
+        var factory = new UnimplementedFocasClientFactory();
+        var ex = Should.Throw<NotSupportedException>(() => factory.Create());
+        ex.Message.ShouldContain("Fwlib32.dll");
+        ex.Message.ShouldContain("licensed");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FwlibNativeHelperTests.cs

@@ -0,0 +1,106 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests;
+
+/// <summary>
+///     Tests for the managed helpers inside FwlibNative + FwlibFocasClient that don't require the
+///     licensed Fwlib32.dll — letter→ADR_* mapping, FocasDataType→data-type mapping, byte encoding.
+///     The actual P/Invoke calls can only run where the DLL is present; field testing covers those.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class FwlibNativeHelperTests
+{
+    [Theory]
+    [InlineData("G", 0)]
+    [InlineData("F", 1)]
+    [InlineData("Y", 2)]
+    [InlineData("X", 3)]
+    [InlineData("A", 4)]
+    [InlineData("R", 5)]
+    [InlineData("T", 6)]
+    [InlineData("K", 7)]
+    [InlineData("C", 8)]
+    [InlineData("D", 9)]
+    [InlineData("E", 10)]
+    [InlineData("g", 0)] // case-insensitive
+    public void PmcAddrType_maps_every_valid_letter(string letter, short expected)
+    {
+        FocasPmcAddrType.FromLetter(letter).ShouldBe(expected);
+    }
+
+    [Theory]
+    [InlineData("Z")]
+    [InlineData("")]
+    [InlineData("XX")]
+    public void PmcAddrType_rejects_unknown_letters(string letter)
+    {
+        FocasPmcAddrType.FromLetter(letter).ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData(FocasDataType.Bit, 0)]   // byte
+    [InlineData(FocasDataType.Byte, 0)]
+    [InlineData(FocasDataType.Int16, 1)]  // word
+    [InlineData(FocasDataType.Int32, 2)]  // long
+    [InlineData(FocasDataType.Float32, 4)]
+    [InlineData(FocasDataType.Float64, 5)]
+    public void PmcDataType_maps_FocasDataType_to_FOCAS_code(FocasDataType input, short expected)
+    {
+        FocasPmcDataType.FromFocasDataType(input).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void EncodePmcValue_Byte_writes_signed_byte_at_offset_0()
+    {
+        var buf = new byte[40];
+        FwlibFocasClient.EncodePmcValue(buf, FocasDataType.Byte, (sbyte)-5, bitIndex: null);
+        ((sbyte)buf[0]).ShouldBe((sbyte)-5);
+    }
+
+    [Fact]
+    public void EncodePmcValue_Int16_writes_little_endian()
+    {
+        var buf = new byte[40];
+        FwlibFocasClient.EncodePmcValue(buf, FocasDataType.Int16, (short)0x1234, bitIndex: null);
+        buf[0].ShouldBe((byte)0x34);
+        buf[1].ShouldBe((byte)0x12);
+    }
+
+    [Fact]
+    public void EncodePmcValue_Int32_writes_little_endian()
+    {
+        var buf = new byte[40];
+        FwlibFocasClient.EncodePmcValue(buf, FocasDataType.Int32, 0x12345678, bitIndex: null);
+        buf[0].ShouldBe((byte)0x78);
+        buf[1].ShouldBe((byte)0x56);
+        buf[2].ShouldBe((byte)0x34);
+        buf[3].ShouldBe((byte)0x12);
+    }
+
+    [Fact]
+    public void EncodePmcValue_Bit_without_bit_index_writes_byte_boolean()
+    {
+        // Task #181 closed the Bit-write gap — PMC Bit with a bitIndex now routes through
+        // WritePmcBitAsync's RMW path upstream, and raw EncodePmcValue only gets the
+        // no-bit-index case (treated as a whole-byte boolean).
+        var buf = new byte[40];
+        FwlibFocasClient.EncodePmcValue(buf, FocasDataType.Bit, true, bitIndex: null);
+        buf[0].ShouldBe((byte)1);
+
+        FwlibFocasClient.EncodePmcValue(buf, FocasDataType.Bit, false, bitIndex: null);
+        buf[0].ShouldBe((byte)0);
+    }
+
+    [Fact]
+    public void EncodeParamValue_Int32_writes_little_endian()
+    {
+        var buf = new byte[32];
+        FwlibFocasClient.EncodeParamValue(buf, FocasDataType.Int32, 0x0A0B0C0D);
+        buf[0].ShouldBe((byte)0x0D);
+        buf[1].ShouldBe((byte)0x0C);
+        buf[2].ShouldBe((byte)0x0B);
+        buf[3].ShouldBe((byte)0x0A);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.FOCAS\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusBitRmwTests.cs

@@ -0,0 +1,141 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class ModbusBitRmwTests
+{
+    /// <summary>Fake transport capturing each PDU so tests can assert on the read + write sequence.</summary>
+    private sealed class RmwTransport : IModbusTransport
+    {
+        public readonly ushort[] HoldingRegisters = new ushort[256];
+        public readonly List<byte[]> Pdus = new();
+
+        public Task ConnectAsync(CancellationToken ct) => Task.CompletedTask;
+
+        public Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
+        {
+            Pdus.Add(pdu);
+            if (pdu[0] == 0x03)
+            {
+                // FC03 Read Holding Registers.
+                var addr = (ushort)((pdu[1] << 8) | pdu[2]);
+                var qty = (ushort)((pdu[3] << 8) | pdu[4]);
+                var resp = new byte[2 + qty * 2];
+                resp[0] = 0x03;
+                resp[1] = (byte)(qty * 2);
+                for (var i = 0; i < qty; i++)
+                {
+                    resp[2 + i * 2] = (byte)(HoldingRegisters[addr + i] >> 8);
+                    resp[3 + i * 2] = (byte)(HoldingRegisters[addr + i] & 0xFF);
+                }
+                return Task.FromResult(resp);
+            }
+            if (pdu[0] == 0x06)
+            {
+                // FC06 Write Single Register.
+                var addr = (ushort)((pdu[1] << 8) | pdu[2]);
+                var v = (ushort)((pdu[3] << 8) | pdu[4]);
+                HoldingRegisters[addr] = v;
+                return Task.FromResult(new byte[] { 0x06, pdu[1], pdu[2], pdu[3], pdu[4] });
+            }
+            return Task.FromException<byte[]>(new NotSupportedException($"FC 0x{pdu[0]:X2} not supported by fake"));
+        }
+
+        public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+    }
+
+    private static (ModbusDriver drv, RmwTransport fake) NewDriver(params ModbusTagDefinition[] tags)
+    {
+        var fake = new RmwTransport();
+        var opts = new ModbusDriverOptions
+        {
+            Host = "fake",
+            Tags = tags,
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        return (new ModbusDriver(opts, "modbus-1", _ => fake), fake);
+    }
+
+    [Fact]
+    public async Task Bit_set_reads_current_register_ORs_bit_writes_back()
+    {
+        var (drv, fake) = NewDriver(
+            new ModbusTagDefinition("Flag3", ModbusRegion.HoldingRegisters, 10, ModbusDataType.BitInRegister, BitIndex: 3));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        fake.HoldingRegisters[10] = 0b0000_0001; // bit 0 already set
+
+        var results = await drv.WriteAsync([new WriteRequest("Flag3", true)], CancellationToken.None);
+
+        results.Single().StatusCode.ShouldBe(0u);
+        fake.HoldingRegisters[10].ShouldBe((ushort)0b0000_1001); // bit 3 now set, bit 0 preserved
+        // Two PDUs: FC03 read then FC06 write.
+        fake.Pdus.Count.ShouldBe(2);
+        fake.Pdus[0][0].ShouldBe((byte)0x03);
+        fake.Pdus[1][0].ShouldBe((byte)0x06);
+    }
+
+    [Fact]
+    public async Task Bit_clear_reads_current_register_ANDs_bit_off_writes_back()
+    {
+        var (drv, fake) = NewDriver(
+            new ModbusTagDefinition("Flag3", ModbusRegion.HoldingRegisters, 10, ModbusDataType.BitInRegister, BitIndex: 3));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        fake.HoldingRegisters[10] = 0xFFFF; // all bits set
+
+        await drv.WriteAsync([new WriteRequest("Flag3", false)], CancellationToken.None);
+
+        fake.HoldingRegisters[10].ShouldBe((ushort)0b1111_1111_1111_0111); // bit 3 cleared, rest preserved
+    }
+
+    [Fact]
+    public async Task Concurrent_bit_writes_to_same_register_preserve_all_updates()
+    {
+        // Serialization test — 8 writers target different bits in register 20. Without the RMW
+        // lock, concurrent reads interleave + last-to-commit wins so some bits get lost.
+        var tags = Enumerable.Range(0, 8)
+            .Select(b => new ModbusTagDefinition($"Bit{b}", ModbusRegion.HoldingRegisters, 20, ModbusDataType.BitInRegister, BitIndex: (byte)b))
+            .ToArray();
+        var (drv, fake) = NewDriver(tags);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        fake.HoldingRegisters[20] = 0;
+
+        await Task.WhenAll(Enumerable.Range(0, 8).Select(b =>
+            drv.WriteAsync([new WriteRequest($"Bit{b}", true)], CancellationToken.None)));
+
+        fake.HoldingRegisters[20].ShouldBe((ushort)0xFF); // all 8 bits set
+    }
+
+    [Fact]
+    public async Task Bit_write_on_different_registers_proceeds_in_parallel_without_contention()
+    {
+        var tags = Enumerable.Range(0, 4)
+            .Select(i => new ModbusTagDefinition($"Bit{i}", ModbusRegion.HoldingRegisters, (ushort)(50 + i), ModbusDataType.BitInRegister, BitIndex: 0))
+            .ToArray();
+        var (drv, fake) = NewDriver(tags);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await Task.WhenAll(Enumerable.Range(0, 4).Select(i =>
+            drv.WriteAsync([new WriteRequest($"Bit{i}", true)], CancellationToken.None)));
+
+        for (var i = 0; i < 4; i++)
+            fake.HoldingRegisters[50 + i].ShouldBe((ushort)0x01);
+    }
+
+    [Fact]
+    public async Task Bit_write_preserves_other_bits_in_the_same_register()
+    {
+        var (drv, fake) = NewDriver(
+            new ModbusTagDefinition("BitA", ModbusRegion.HoldingRegisters, 30, ModbusDataType.BitInRegister, BitIndex: 5),
+            new ModbusTagDefinition("BitB", ModbusRegion.HoldingRegisters, 30, ModbusDataType.BitInRegister, BitIndex: 10));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.WriteAsync([new WriteRequest("BitA", true)], CancellationToken.None);
+        await drv.WriteAsync([new WriteRequest("BitB", true)], CancellationToken.None);
+
+        fake.HoldingRegisters[30].ShouldBe((ushort)((1 << 5) | (1 << 10)));
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusDataTypeTests.cs

@@ -132,12 +132,15 @@ public sealed class ModbusDataTypeTests
     }
 
     [Fact]
-    public void BitInRegister_write_is_not_supported_in_PR24()
+    public void BitInRegister_EncodeRegister_still_rejects_direct_calls()
     {
+        // BitInRegister writes now go through WriteBitInRegisterAsync's RMW path (task #181).
+        // EncodeRegister should never be reached for this type — if it is, throwing keeps an
+        // unintended caller loud rather than silently clobbering the register.
         var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.BitInRegister,
             BitIndex: 5);
         Should.Throw<InvalidOperationException>(() => ModbusDriver.EncodeRegister(true, tag))
-            .Message.ShouldContain("read-modify-write");
+            .Message.ShouldContain("WriteBitInRegisterAsync");
     }
 
     // --- String ---

tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/FakeTwinCATClient.cs

@@ -1,3 +1,4 @@
+using System.Runtime.CompilerServices;
 using ZB.MOM.WW.OtOpcUa.Driver.TwinCAT;
 
 namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests;
@@ -82,6 +83,23 @@ internal class FakeTwinCATClient : ITwinCATClient
                 n.OnChange(symbolPath, value);
     }
 
+    // ---- symbol browser fake ----
+
+    public List<TwinCATDiscoveredSymbol> BrowseResults { get; } = new();
+    public bool ThrowOnBrowse { get; set; }
+
+    public virtual async IAsyncEnumerable<TwinCATDiscoveredSymbol> BrowseSymbolsAsync(
+        [EnumeratorCancellation] CancellationToken cancellationToken)
+    {
+        if (ThrowOnBrowse) throw Exception ?? new InvalidOperationException("fake browse failure");
+        await Task.CompletedTask;
+        foreach (var sym in BrowseResults)
+        {
+            if (cancellationToken.IsCancellationRequested) yield break;
+            yield return sym;
+        }
+    }
+
     public sealed class FakeNotification(
         string symbolPath, TwinCATDataType type, int? bitIndex,
         Action<string, object?> onChange, FakeTwinCATClient owner) : ITwinCATNotificationHandle

tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/TwinCATSymbolBrowserTests.cs

@@ -0,0 +1,212 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.TwinCAT;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class TwinCATSymbolBrowserTests
+{
+    [Fact]
+    public async Task Discovery_without_EnableControllerBrowse_emits_only_predeclared()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeTwinCATClientFactory
+        {
+            Customise = () =>
+            {
+                var c = new FakeTwinCATClient();
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("MAIN.Hidden", TwinCATDataType.DInt, false));
+                return c;
+            },
+        };
+        var drv = new TwinCATDriver(new TwinCATDriverOptions
+        {
+            Devices = [new TwinCATDeviceOptions("ads://5.23.91.23.1.1:851")],
+            Tags = [new TwinCATTagDefinition("Declared", "ads://5.23.91.23.1.1:851", "MAIN.Declared", TwinCATDataType.DInt)],
+            Probe = new TwinCATProbeOptions { Enabled = false },
+            EnableControllerBrowse = false,
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.BrowseName).ShouldBe(["Declared"]);
+        builder.Folders.ShouldNotContain(f => f.BrowseName == "Discovered");
+    }
+
+    [Fact]
+    public async Task Discovery_with_browse_enabled_adds_controller_symbols_under_Discovered_folder()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeTwinCATClientFactory
+        {
+            Customise = () =>
+            {
+                var c = new FakeTwinCATClient();
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("MAIN.Counter", TwinCATDataType.DInt, ReadOnly: false));
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("GVL.Setpoint", TwinCATDataType.Real, ReadOnly: false));
+                return c;
+            },
+        };
+        var drv = new TwinCATDriver(new TwinCATDriverOptions
+        {
+            Devices = [new TwinCATDeviceOptions("ads://5.23.91.23.1.1:851")],
+            Probe = new TwinCATProbeOptions { Enabled = false },
+            EnableControllerBrowse = true,
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Folders.ShouldContain(f => f.BrowseName == "Discovered");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("MAIN.Counter");
+        builder.Variables.Select(v => v.Info.FullName).ShouldContain("GVL.Setpoint");
+    }
+
+    [Fact]
+    public async Task Browse_filters_system_symbols()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeTwinCATClientFactory
+        {
+            Customise = () =>
+            {
+                var c = new FakeTwinCATClient();
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("TwinCAT_SystemInfoVarList._AppInfo", TwinCATDataType.DInt, false));
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("Constants.PI", TwinCATDataType.LReal, true));
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("Mc_InternalState", TwinCATDataType.DInt, true));
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("__CompilerGen", TwinCATDataType.DInt, true));
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("MAIN.Real", TwinCATDataType.DInt, false));
+                return c;
+            },
+        };
+        var drv = new TwinCATDriver(new TwinCATDriverOptions
+        {
+            Devices = [new TwinCATDeviceOptions("ads://5.23.91.23.1.1:851")],
+            Probe = new TwinCATProbeOptions { Enabled = false },
+            EnableControllerBrowse = true,
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.Info.FullName).ShouldBe(["MAIN.Real"]);
+    }
+
+    [Fact]
+    public async Task Browse_skips_symbols_with_null_datatype()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeTwinCATClientFactory
+        {
+            Customise = () =>
+            {
+                var c = new FakeTwinCATClient();
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("MAIN.Struct", DataType: null, ReadOnly: false));
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("MAIN.Counter", TwinCATDataType.DInt, false));
+                return c;
+            },
+        };
+        var drv = new TwinCATDriver(new TwinCATDriverOptions
+        {
+            Devices = [new TwinCATDeviceOptions("ads://5.23.91.23.1.1:851")],
+            Probe = new TwinCATProbeOptions { Enabled = false },
+            EnableControllerBrowse = true,
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.Info.FullName).ShouldBe(["MAIN.Counter"]);
+    }
+
+    [Fact]
+    public async Task ReadOnly_symbol_surfaces_ViewOnly()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeTwinCATClientFactory
+        {
+            Customise = () =>
+            {
+                var c = new FakeTwinCATClient();
+                c.BrowseResults.Add(new TwinCATDiscoveredSymbol("MAIN.Status", TwinCATDataType.DInt, ReadOnly: true));
+                return c;
+            },
+        };
+        var drv = new TwinCATDriver(new TwinCATDriverOptions
+        {
+            Devices = [new TwinCATDeviceOptions("ads://5.23.91.23.1.1:851")],
+            Probe = new TwinCATProbeOptions { Enabled = false },
+            EnableControllerBrowse = true,
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Single().Info.SecurityClass.ShouldBe(SecurityClassification.ViewOnly);
+    }
+
+    [Fact]
+    public async Task Browse_failure_is_non_fatal_predeclared_still_emits()
+    {
+        var builder = new RecordingBuilder();
+        var factory = new FakeTwinCATClientFactory
+        {
+            Customise = () => new FakeTwinCATClient { ThrowOnBrowse = true },
+        };
+        var drv = new TwinCATDriver(new TwinCATDriverOptions
+        {
+            Devices = [new TwinCATDeviceOptions("ads://5.23.91.23.1.1:851")],
+            Tags = [new TwinCATTagDefinition("Declared", "ads://5.23.91.23.1.1:851", "MAIN.Declared", TwinCATDataType.DInt)],
+            Probe = new TwinCATProbeOptions { Enabled = false },
+            EnableControllerBrowse = true,
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.DiscoverAsync(builder, CancellationToken.None);
+
+        builder.Variables.Select(v => v.BrowseName).ShouldContain("Declared");
+    }
+
+    [Theory]
+    [InlineData("TwinCAT_SystemInfoVarList._AppInfo", true)]
+    [InlineData("TwinCAT_RuntimeInfo.Something", true)]
+    [InlineData("Constants.PI", true)]
+    [InlineData("Mc_AxisState", true)]
+    [InlineData("__hidden", true)]
+    [InlineData("Global_Version", true)]
+    [InlineData("MAIN.UserVar", false)]
+    [InlineData("GVL.Counter", false)]
+    [InlineData("MyFbInstance.State", false)]
+    [InlineData("", true)]
+    [InlineData("   ", true)]
+    public void SystemSymbolFilter_matches_expected_patterns(string path, bool expected)
+    {
+        TwinCATSystemSymbolFilter.IsSystemSymbol(path).ShouldBe(expected);
+    }
+
+    // ---- helpers ----
+
+    private sealed class RecordingBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, string DisplayName)> Folders { get; } = new();
+        public List<(string BrowseName, DriverAttributeInfo Info)> Variables { get; } = new();
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName)
+        { Folders.Add((browseName, displayName)); return this; }
+
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo info)
+        { Variables.Add((browseName, info)); return new Handle(info.FullName); }
+
+        public void AddProperty(string _, DriverDataType __, object? ___) { }
+
+        private sealed class Handle(string fullRef) : IVariableHandle
+        {
+            public string FullReference => fullRef;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NullSink();
+        }
+        private sealed class NullSink : IAlarmConditionSink { public void OnTransition(AlarmEventArgs args) { } }
+    }
+}