Merge pull request '[ablegacy] AbLegacy — Indirect/indexed addressing parser' (#324) from auto/ablegacy/4 into auto/driver-gaps

Closes #247

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipArrayReadPlanner.cs

@@ -0,0 +1,94 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     PR abcip-1.3 — issues one libplctag tag-create with <c>ElementCount=N</c> per Rockwell
+///     array-slice tag (<c>Tag[0..N]</c> in <see cref="AbCipTagPath"/>), then decodes the
+///     contiguous buffer at element stride into <c>N</c> typed values. Mirrors the whole-UDT
+///     planner pattern (<see cref="AbCipUdtReadPlanner"/>): pure shape — the planner never
+///     touches the runtime + never reads the PLC, the driver wires the runtime in.
+/// </summary>
+/// <remarks>
+///     <para>Stride is the natural Logix size of the element type (DInt = 4, Real = 4, LInt = 8).
+///     Bool / String / Structure slices aren't supported here — Logix packs BOOLs into a host
+///     byte (no fixed stride), STRING members carry a Length+DATA pair that's not a flat array,
+///     and structure arrays need the CIP Template Object reader (PR-tracked separately).</para>
+///
+///     <para>Output is a single <c>object[]</c> snapshot value containing the N decoded
+///     elements at indices 0..Count-1. Pairing with one slice tag = one snapshot keeps the
+///     <c>ReadAsync</c> 1:1 contract (one fullReference -> one snapshot) intact.</para>
+/// </remarks>
+public static class AbCipArrayReadPlanner
+{
+    /// <summary>
+    ///     Build the libplctag create-params + decode descriptor for a slice tag. Returns
+    ///     <c>null</c> when the slice element type isn't supported under this declaration-only
+    ///     decoder (Bool / String / Structure / unrecognised) — the driver falls back to the
+    ///     scalar read path so the operator gets a clean per-element result instead.
+    /// </summary>
+    public static AbCipArrayReadPlan? TryBuild(
+        AbCipTagDefinition definition,
+        AbCipTagPath parsedPath,
+        AbCipTagCreateParams baseParams)
+    {
+        ArgumentNullException.ThrowIfNull(definition);
+        ArgumentNullException.ThrowIfNull(parsedPath);
+        ArgumentNullException.ThrowIfNull(baseParams);
+        if (parsedPath.Slice is null) return null;
+
+        if (!TryGetStride(definition.DataType, out var stride)) return null;
+
+        var slice = parsedPath.Slice;
+        var createParams = baseParams with
+        {
+            TagName = parsedPath.ToLibplctagSliceArrayName(),
+            ElementCount = slice.Count,
+        };
+
+        return new AbCipArrayReadPlan(definition.DataType, slice, stride, createParams);
+    }
+
+    /// <summary>
+    ///     Decode <paramref name="plan"/>.Count elements from <paramref name="runtime"/> at
+    ///     element stride. Caller has already invoked <see cref="IAbCipTagRuntime.ReadAsync"/>
+    ///     and confirmed <see cref="IAbCipTagRuntime.GetStatus"/> == 0.
+    /// </summary>
+    public static object?[] Decode(AbCipArrayReadPlan plan, IAbCipTagRuntime runtime)
+    {
+        ArgumentNullException.ThrowIfNull(plan);
+        ArgumentNullException.ThrowIfNull(runtime);
+
+        var values = new object?[plan.Slice.Count];
+        for (var i = 0; i < plan.Slice.Count; i++)
+            values[i] = runtime.DecodeValueAt(plan.ElementType, i * plan.Stride, bitIndex: null);
+        return values;
+    }
+
+    private static bool TryGetStride(AbCipDataType type, out int stride)
+    {
+        switch (type)
+        {
+            case AbCipDataType.SInt: case AbCipDataType.USInt:
+                stride = 1; return true;
+            case AbCipDataType.Int: case AbCipDataType.UInt:
+                stride = 2; return true;
+            case AbCipDataType.DInt: case AbCipDataType.UDInt:
+            case AbCipDataType.Real: case AbCipDataType.Dt:
+                stride = 4; return true;
+            case AbCipDataType.LInt: case AbCipDataType.ULInt:
+            case AbCipDataType.LReal:
+                stride = 8; return true;
+            default:
+                stride = 0; return false;
+        }
+    }
+}
+
+/// <summary>
+///     Plan output: the libplctag create-params for the single array-read tag plus the
+///     element-type / stride / slice metadata the decoder needs.
+/// </summary>
+public sealed record AbCipArrayReadPlan(
+    AbCipDataType ElementType,
+    AbCipTagPathSlice Slice,
+    int Stride,
+    AbCipTagCreateParams CreateParams);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDataType.cs

@@ -50,11 +50,12 @@ public static class AbCipDataTypeExtensions
         AbCipDataType.Bool => DriverDataType.Boolean,
         AbCipDataType.SInt or AbCipDataType.Int or AbCipDataType.DInt => DriverDataType.Int32,
         AbCipDataType.USInt or AbCipDataType.UInt or AbCipDataType.UDInt => DriverDataType.Int32,
-        AbCipDataType.LInt or AbCipDataType.ULInt => DriverDataType.Int32, // TODO: Int64 — matches Modbus gap
+        AbCipDataType.LInt => DriverDataType.Int64,
+        AbCipDataType.ULInt => DriverDataType.UInt64,
         AbCipDataType.Real => DriverDataType.Float32,
         AbCipDataType.LReal => DriverDataType.Float64,
         AbCipDataType.String => DriverDataType.String,
-        AbCipDataType.Dt => DriverDataType.Int32, // epoch-seconds DINT
+        AbCipDataType.Dt => DriverDataType.Int64, // Logix v32+ DT == LINT epoch-millis
         AbCipDataType.Structure => DriverDataType.String, // placeholder until UDT PR 6 introduces a structured kind
         _ => DriverDataType.Int32,
     };

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -134,7 +134,8 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
                             TagPath: $"{tag.TagPath}.{member.Name}",
                             DataType: member.DataType,
                             Writable: member.Writable,
-                            WriteIdempotent: member.WriteIdempotent);
+                            WriteIdempotent: member.WriteIdempotent,
+                            StringLength: member.StringLength);
                         _tagsByName[memberTag.Name] = memberTag;
                     }
                 }
@@ -357,6 +358,17 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
             return;
         }
 
+        // PR abcip-1.3 — array-slice path. A tag whose TagPath ends in [N..M] dispatches to
+        // AbCipArrayReadPlanner: one libplctag tag-create with ElementCount=N issues one
+        // Rockwell array read; the contiguous buffer is decoded at element stride into a
+        // single snapshot whose Value is an object[] of the N elements.
+        var parsedPath = AbCipTagPath.TryParse(def.TagPath);
+        if (parsedPath?.Slice is not null)
+        {
+            await ReadSliceAsync(fb, def, parsedPath, device, results, now, ct).ConfigureAwait(false);
+            return;
+        }
+
         try
         {
             var runtime = await EnsureTagRuntimeAsync(device, def, ct).ConfigureAwait(false);
@@ -372,8 +384,7 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
                 return;
             }
 
-            var tagPath = AbCipTagPath.TryParse(def.TagPath);
-            var bitIndex = tagPath?.BitIndex;
+            var bitIndex = parsedPath?.BitIndex;
             var value = runtime.DecodeValue(def.DataType, bitIndex);
             results[fb.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
             _health = new DriverHealth(DriverState.Healthy, now, null);
@@ -390,6 +401,89 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         }
     }
 
+    /// <summary>
+    ///     PR abcip-1.3 — slice read path. Builds an <see cref="AbCipArrayReadPlan"/> from the
+    ///     parsed slice path, materialises a per-tag runtime keyed by the tag's full name (so
+    ///     repeat reads reuse the same libplctag handle), issues one PLC array read, and
+    ///     decodes the contiguous buffer into <c>object?[]</c> at element stride. Unsupported
+    ///     element types fall back to <see cref="AbCipStatusMapper.BadNotSupported"/>.
+    /// </summary>
+    private async Task ReadSliceAsync(
+        AbCipUdtReadFallback fb, AbCipTagDefinition def, AbCipTagPath parsedPath,
+        DeviceState device, DataValueSnapshot[] results, DateTime now, CancellationToken ct)
+    {
+        var baseParams = new AbCipTagCreateParams(
+            Gateway: device.ParsedAddress.Gateway,
+            Port: device.ParsedAddress.Port,
+            CipPath: device.ParsedAddress.CipPath,
+            LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
+            TagName: parsedPath.ToLibplctagName(),
+            Timeout: _options.Timeout);
+
+        var plan = AbCipArrayReadPlanner.TryBuild(def, parsedPath, baseParams);
+        if (plan is null)
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                AbCipStatusMapper.BadNotSupported, null, now);
+            return;
+        }
+
+        try
+        {
+            var runtime = await EnsureSliceRuntimeAsync(device, def.Name, plan.CreateParams, ct)
+                .ConfigureAwait(false);
+            await runtime.ReadAsync(ct).ConfigureAwait(false);
+
+            var status = runtime.GetStatus();
+            if (status != 0)
+            {
+                results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                    AbCipStatusMapper.MapLibplctagStatus(status), null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                    $"libplctag status {status} reading slice {def.Name}");
+                return;
+            }
+
+            var values = AbCipArrayReadPlanner.Decode(plan, runtime);
+            results[fb.OriginalIndex] = new DataValueSnapshot(values, AbCipStatusMapper.Good, now, now);
+            _health = new DriverHealth(DriverState.Healthy, now, null);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                AbCipStatusMapper.BadCommunicationError, null, now);
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     Idempotently materialise a slice-read runtime. Slice runtimes share the device's
+    ///     <see cref="DeviceState.Runtimes"/> dict keyed by the tag's full name so repeated
+    ///     reads reuse the same libplctag handle without re-creating the native tag every poll.
+    /// </summary>
+    private async Task<IAbCipTagRuntime> EnsureSliceRuntimeAsync(
+        DeviceState device, string tagName, AbCipTagCreateParams createParams, CancellationToken ct)
+    {
+        if (device.Runtimes.TryGetValue(tagName, out var existing)) return existing;
+
+        var runtime = _tagFactory.Create(createParams);
+        try
+        {
+            await runtime.InitializeAsync(ct).ConfigureAwait(false);
+        }
+        catch
+        {
+            runtime.Dispose();
+            throw;
+        }
+        device.Runtimes[tagName] = runtime;
+        return runtime;
+    }
+
     /// <summary>
     ///     Task #194 — perform one whole-UDT read on the parent tag, then decode each
     ///     grouped member from the runtime's buffer at its computed byte offset. A per-group
@@ -451,65 +545,103 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
     // ---- IWritable ----
 
     /// <summary>
-    ///     Write each request in order. Writes are NOT auto-retried by the driver — per plan
-    ///     decisions #44, #45, #143 the caller opts in via <see cref="AbCipTagDefinition.WriteIdempotent"/>
-    ///     and the resilience pipeline (layered above the driver) decides whether to replay.
-    ///     Non-writable configurations surface as <c>BadNotWritable</c>; type-conversion failures
-    ///     as <c>BadTypeMismatch</c>; transport errors as <c>BadCommunicationError</c>.
+    ///     Write each request in the batch. Writes are NOT auto-retried by the driver — per
+    ///     plan decisions #44, #45, #143 the caller opts in via
+    ///     <see cref="AbCipTagDefinition.WriteIdempotent"/> and the resilience pipeline (layered
+    ///     above the driver) decides whether to replay. Non-writable configurations surface as
+    ///     <c>BadNotWritable</c>; type-conversion failures as <c>BadTypeMismatch</c>; transport
+    ///     errors as <c>BadCommunicationError</c>.
     /// </summary>
+    /// <remarks>
+    ///     PR abcip-1.4 — multi-tag write packing. Writes are grouped by device via
+    ///     <see cref="AbCipMultiWritePlanner"/>. Devices whose family
+    ///     <see cref="AbCipPlcFamilyProfile.SupportsRequestPacking"/> is <c>true</c> dispatch
+    ///     their packable writes concurrently so libplctag's native scheduler can coalesce them
+    ///     onto one CIP Multi-Service Packet (0x0A) per round-trip; Micro800 (no packing) still
+    ///     issues writes one-at-a-time. BOOL-within-DINT writes always go through the RMW path
+    ///     under a per-parent semaphore, regardless of the family flag, because two concurrent
+    ///     RMWs on the same DINT could lose one another's update. Per-tag StatusCodes are
+    ///     preserved in the caller's input order on partial failures.
+    /// </remarks>
     public async Task<IReadOnlyList<WriteResult>> WriteAsync(
         IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(writes);
         var results = new WriteResult[writes.Count];
+
+        var plans = AbCipMultiWritePlanner.Build(
+            writes, _tagsByName, _devices,
+            reportPreflight: (idx, code) => results[idx] = new WriteResult(code));
+
+        foreach (var plan in plans)
+        {
+            if (!_devices.TryGetValue(plan.DeviceHostAddress, out var device))
+            {
+                foreach (var e in plan.Packable) results[e.OriginalIndex] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                foreach (var e in plan.BitRmw) results[e.OriginalIndex] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            // Bit-RMW writes always serialise per-parent — never packed.
+            foreach (var entry in plan.BitRmw)
+                results[entry.OriginalIndex] = new WriteResult(
+                    await ExecuteBitRmwWriteAsync(device, entry, cancellationToken).ConfigureAwait(false));
+
+            if (plan.Packable.Count == 0) continue;
+
+            if (plan.Profile.SupportsRequestPacking && plan.Packable.Count > 1)
+            {
+                // Concurrent dispatch — libplctag's native scheduler packs same-connection writes
+                // into one Multi-Service Packet when the family supports it.
+                var tasks = new Task<(int idx, uint code)>[plan.Packable.Count];
+                for (var i = 0; i < plan.Packable.Count; i++)
+                {
+                    var entry = plan.Packable[i];
+                    tasks[i] = ExecutePackableWriteAsync(device, entry, cancellationToken);
+                }
+                var outcomes = await Task.WhenAll(tasks).ConfigureAwait(false);
+                foreach (var (idx, code) in outcomes)
+                    results[idx] = new WriteResult(code);
+            }
+            else
+            {
+                // Single-write groups + Micro800 (SupportsRequestPacking=false) — sequential.
+                foreach (var entry in plan.Packable)
+                {
+                    var code = await ExecutePackableWriteAsync(device, entry, cancellationToken)
+                        .ConfigureAwait(false);
+                    results[entry.OriginalIndex] = new WriteResult(code.code);
+                }
+            }
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    ///     Execute one packable write — encode the value into the per-tag runtime, flush, and
+    ///     map the resulting libplctag status. Exception-to-StatusCode mapping mirrors the
+    ///     pre-1.4 per-tag loop so callers see no behaviour change for individual writes.
+    /// </summary>
+    private async Task<(int idx, uint code)> ExecutePackableWriteAsync(
+        DeviceState device, AbCipMultiWritePlanner.ClassifiedWrite entry, CancellationToken ct)
+    {
+        var def = entry.Definition;
+        var w = entry.Request;
         var now = DateTime.UtcNow;
-
-        for (var i = 0; i < writes.Count; i++)
-        {
-            var w = writes[i];
-            if (!_tagsByName.TryGetValue(w.FullReference, out var def))
-            {
-                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
-                continue;
-            }
-            if (!def.Writable || def.SafetyTag)
-            {
-                results[i] = new WriteResult(AbCipStatusMapper.BadNotWritable);
-                continue;
-            }
-            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
-            {
-                results[i] = new WriteResult(AbCipStatusMapper.BadNodeIdUnknown);
-                continue;
-            }
-
         try
         {
-                var parsedPath = AbCipTagPath.TryParse(def.TagPath);
-
-                // BOOL-within-DINT writes — per task #181, RMW against a parallel parent-DINT
-                // runtime. Dispatching here keeps the normal EncodeValue path clean; the
-                // per-parent lock prevents two concurrent bit writes to the same DINT from
-                // losing one another's update.
-                if (def.DataType == AbCipDataType.Bool && parsedPath?.BitIndex is int bit)
-                {
-                    results[i] = new WriteResult(
-                        await WriteBitInDIntAsync(device, parsedPath, bit, w.Value, cancellationToken)
-                            .ConfigureAwait(false));
-                    if (results[i].StatusCode == AbCipStatusMapper.Good)
-                        _health = new DriverHealth(DriverState.Healthy, now, null);
-                    continue;
-                }
-
-                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
-                runtime.EncodeValue(def.DataType, parsedPath?.BitIndex, w.Value);
-                await runtime.WriteAsync(cancellationToken).ConfigureAwait(false);
+            var runtime = await EnsureTagRuntimeAsync(device, def, ct).ConfigureAwait(false);
+            runtime.EncodeValue(def.DataType, entry.ParsedPath?.BitIndex, w.Value);
+            await runtime.WriteAsync(ct).ConfigureAwait(false);
 
             var status = runtime.GetStatus();
-                results[i] = new WriteResult(status == 0
-                    ? AbCipStatusMapper.Good
-                    : AbCipStatusMapper.MapLibplctagStatus(status));
-                if (status == 0) _health = new DriverHealth(DriverState.Healthy, now, null);
+            if (status == 0)
+            {
+                _health = new DriverHealth(DriverState.Healthy, now, null);
+                return (entry.OriginalIndex, AbCipStatusMapper.Good);
+            }
+            return (entry.OriginalIndex, AbCipStatusMapper.MapLibplctagStatus(status));
         }
         catch (OperationCanceledException)
         {
@@ -517,32 +649,78 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         }
         catch (NotSupportedException nse)
         {
-                results[i] = new WriteResult(AbCipStatusMapper.BadNotSupported);
             _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            return (entry.OriginalIndex, AbCipStatusMapper.BadNotSupported);
         }
         catch (FormatException fe)
         {
-                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
             _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, fe.Message);
+            return (entry.OriginalIndex, AbCipStatusMapper.BadTypeMismatch);
         }
         catch (InvalidCastException ice)
         {
-                results[i] = new WriteResult(AbCipStatusMapper.BadTypeMismatch);
             _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ice.Message);
+            return (entry.OriginalIndex, AbCipStatusMapper.BadTypeMismatch);
         }
         catch (OverflowException oe)
         {
-                results[i] = new WriteResult(AbCipStatusMapper.BadOutOfRange);
             _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, oe.Message);
+            return (entry.OriginalIndex, AbCipStatusMapper.BadOutOfRange);
         }
         catch (Exception ex)
         {
-                results[i] = new WriteResult(AbCipStatusMapper.BadCommunicationError);
             _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            return (entry.OriginalIndex, AbCipStatusMapper.BadCommunicationError);
         }
     }
 
-        return results;
+    /// <summary>
+    ///     Execute one BOOL-within-DINT write through <see cref="WriteBitInDIntAsync"/>, with
+    ///     the same exception-mapping fan-out as the pre-1.4 per-tag loop. Bit RMWs cannot be
+    ///     packed because two concurrent writes against the same parent DINT would race their
+    ///     read-modify-write windows.
+    /// </summary>
+    private async Task<uint> ExecuteBitRmwWriteAsync(
+        DeviceState device, AbCipMultiWritePlanner.ClassifiedWrite entry, CancellationToken ct)
+    {
+        try
+        {
+            var bit = entry.ParsedPath!.BitIndex!.Value;
+            var code = await WriteBitInDIntAsync(device, entry.ParsedPath, bit, entry.Request.Value, ct)
+                .ConfigureAwait(false);
+            if (code == AbCipStatusMapper.Good)
+                _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+            return code;
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (NotSupportedException nse)
+        {
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, nse.Message);
+            return AbCipStatusMapper.BadNotSupported;
+        }
+        catch (FormatException fe)
+        {
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, fe.Message);
+            return AbCipStatusMapper.BadTypeMismatch;
+        }
+        catch (InvalidCastException ice)
+        {
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ice.Message);
+            return AbCipStatusMapper.BadTypeMismatch;
+        }
+        catch (OverflowException oe)
+        {
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, oe.Message);
+            return AbCipStatusMapper.BadOutOfRange;
+        }
+        catch (Exception ex)
+        {
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+            return AbCipStatusMapper.BadCommunicationError;
+        }
     }
 
     /// <summary>
@@ -633,7 +811,8 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
             CipPath: device.ParsedAddress.CipPath,
             LibplctagPlcAttribute: device.Profile.LibplctagPlcAttribute,
             TagName: parsed.ToLibplctagName(),
-            Timeout: _options.Timeout));
+            Timeout: _options.Timeout,
+            StringMaxCapacity: def.DataType == AbCipDataType.String ? def.StringLength : null));
         try
         {
             await runtime.InitializeAsync(ct).ConfigureAwait(false);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverOptions.cs

@@ -92,6 +92,13 @@ public sealed record AbCipDeviceOptions(
 ///     GuardLogix controller; non-safety writes violate the safety-partition isolation and are
 ///     rejected by the PLC anyway. Surfaces the intent explicitly instead of relying on the
 ///     write attempt failing at runtime.</param>
+/// <param name="StringLength">Capacity of the DATA character array on a Logix STRING / STRINGnn
+///     UDT — 82 for the stock <c>STRING</c>, 20/40/80/etc for user-defined <c>STRING_20</c>,
+///     <c>STRING_40</c>, <c>STRING_80</c> variants. Threads through libplctag's
+///     <c>str_max_capacity</c> attribute so the wrapper allocates the correct backing buffer
+///     and <c>GetString</c> / <c>SetString</c> truncate at the right boundary. <c>null</c>
+///     keeps libplctag's default 82-byte STRING behaviour for back-compat. Ignored for
+///     non-<see cref="AbCipDataType.String"/> types.</param>
 public sealed record AbCipTagDefinition(
     string Name,
     string DeviceHostAddress,
@@ -100,7 +107,8 @@ public sealed record AbCipTagDefinition(
     bool Writable = true,
     bool WriteIdempotent = false,
     IReadOnlyList<AbCipStructureMember>? Members = null,
-    bool SafetyTag = false);
+    bool SafetyTag = false,
+    int? StringLength = null);
 
 /// <summary>
 ///     One declared member of a UDT tag. Name is the member identifier on the PLC (e.g. <c>Speed</c>,
@@ -112,7 +120,8 @@ public sealed record AbCipStructureMember(
     string Name,
     AbCipDataType DataType,
     bool Writable = true,
-    bool WriteIdempotent = false);
+    bool WriteIdempotent = false,
+    int? StringLength = null);
 
 /// <summary>Which AB PLC family the device is — selects the profile applied to connection params.</summary>
 public enum AbCipPlcFamily

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipMultiWritePlanner.cs

@@ -0,0 +1,112 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     PR abcip-1.4 — multi-tag write planner. Groups a batch of <see cref="WriteRequest"/>s by
+///     device so the driver can submit one round of writes per device instead of looping
+///     strictly serially across the whole batch. Honours the per-family
+///     <see cref="AbCipPlcFamilyProfile.SupportsRequestPacking"/> flag: families that support
+///     CIP request packing (ControlLogix / CompactLogix / GuardLogix) issue their writes in
+///     parallel so libplctag's internal scheduler can coalesce them onto one Multi-Service
+///     Packet (0x0A); Micro800 (no request packing) falls back to per-tag sequential writes.
+/// </summary>
+/// <remarks>
+///     <para>The libplctag .NET wrapper exposes one CIP service per <c>Tag</c> instance and does
+///     not surface Multi-Service Packet construction at the API surface — but the underlying
+///     native library packs concurrent operations against the same connection automatically
+///     when the family's protocol supports it. Issuing the writes concurrently per device
+///     therefore gives us the round-trip reduction described in #228 without having to drop to
+///     raw CIP, while still letting us short-circuit packing on Micro800 where it would be
+///     unsafe.</para>
+///
+///     <para>Bit-RMW writes (BOOL-with-bitIndex against a DINT parent) are excluded from
+///     packing here because they need a serialised read-modify-write under the per-parent
+///     <c>SemaphoreSlim</c> in <see cref="AbCipDriver.WriteBitInDIntAsync"/>. Packing two RMWs
+///     on the same DINT would risk losing one another's update.</para>
+/// </remarks>
+internal static class AbCipMultiWritePlanner
+{
+    /// <summary>
+    ///     One classified entry in the input batch. <see cref="OriginalIndex"/> preserves the
+    ///     caller's ordering so per-tag <c>StatusCode</c> fan-out lands at the right slot in
+    ///     the result array. <see cref="IsBitRmw"/> routes the entry through the RMW path even
+    ///     when the device supports packing.
+    /// </summary>
+    internal readonly record struct ClassifiedWrite(
+        int OriginalIndex,
+        WriteRequest Request,
+        AbCipTagDefinition Definition,
+        AbCipTagPath? ParsedPath,
+        bool IsBitRmw);
+
+    /// <summary>
+    ///     One device's plan slice. <see cref="Packable"/> entries can be issued concurrently;
+    ///     <see cref="BitRmw"/> entries must go through the RMW path one-at-a-time per parent
+    ///     DINT.
+    /// </summary>
+    internal sealed class DevicePlan
+    {
+        public required string DeviceHostAddress { get; init; }
+        public required AbCipPlcFamilyProfile Profile { get; init; }
+        public List<ClassifiedWrite> Packable { get; } = new();
+        public List<ClassifiedWrite> BitRmw { get; } = new();
+    }
+
+    /// <summary>
+    ///     Build the per-device plan list. Entries are visited in input order so the resulting
+    ///     plan's traversal preserves caller ordering within each device. Entries that fail
+    ///     resolution (unknown reference, non-writable tag, unknown device) are reported via
+    ///     <paramref name="reportPreflight"/> with the appropriate StatusCode and excluded from
+    ///     the plan.
+    /// </summary>
+    public static IReadOnlyList<DevicePlan> Build(
+        IReadOnlyList<WriteRequest> writes,
+        IReadOnlyDictionary<string, AbCipTagDefinition> tagsByName,
+        IReadOnlyDictionary<string, AbCipDriver.DeviceState> devices,
+        Action<int, uint> reportPreflight)
+    {
+        var plans = new Dictionary<string, DevicePlan>(StringComparer.OrdinalIgnoreCase);
+        var order = new List<DevicePlan>();
+
+        for (var i = 0; i < writes.Count; i++)
+        {
+            var w = writes[i];
+            if (!tagsByName.TryGetValue(w.FullReference, out var def))
+            {
+                reportPreflight(i, AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+            if (!def.Writable || def.SafetyTag)
+            {
+                reportPreflight(i, AbCipStatusMapper.BadNotWritable);
+                continue;
+            }
+            if (!devices.TryGetValue(def.DeviceHostAddress, out var device))
+            {
+                reportPreflight(i, AbCipStatusMapper.BadNodeIdUnknown);
+                continue;
+            }
+
+            if (!plans.TryGetValue(def.DeviceHostAddress, out var plan))
+            {
+                plan = new DevicePlan
+                {
+                    DeviceHostAddress = def.DeviceHostAddress,
+                    Profile = device.Profile,
+                };
+                plans[def.DeviceHostAddress] = plan;
+                order.Add(plan);
+            }
+
+            var parsed = AbCipTagPath.TryParse(def.TagPath);
+            var isBitRmw = def.DataType == AbCipDataType.Bool && parsed?.BitIndex is int;
+            var entry = new ClassifiedWrite(i, w, def, parsed, isBitRmw);
+            if (isBitRmw) plan.BitRmw.Add(entry);
+            else plan.Packable.Add(entry);
+        }
+
+        return order;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipTagPath.cs

@@ -20,7 +20,8 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 public sealed record AbCipTagPath(
     string? ProgramScope,
     IReadOnlyList<AbCipTagPathSegment> Segments,
-    int? BitIndex)
+    int? BitIndex,
+    AbCipTagPathSlice? Slice = null)
 {
     /// <summary>Rebuild the canonical Logix tag string.</summary>
     public string ToLibplctagName()
@@ -37,10 +38,39 @@ public sealed record AbCipTagPath(
             if (seg.Subscripts.Count > 0)
                 buf.Append('[').Append(string.Join(",", seg.Subscripts)).Append(']');
         }
+        if (Slice is not null) buf.Append('[').Append(Slice.Start).Append("..").Append(Slice.End).Append(']');
         if (BitIndex is not null) buf.Append('.').Append(BitIndex.Value);
         return buf.ToString();
     }
 
+    /// <summary>
+    ///     Logix-symbol form for issuing a single libplctag tag-create that reads the slice as a
+    ///     contiguous buffer — i.e. the bare array name (with the start subscript) without the
+    ///     <c>..End</c> suffix. The driver pairs this with <see cref="AbCipTagCreateParams.ElementCount"/>
+    ///     = <see cref="AbCipTagPathSlice.Count"/> to issue a single Rockwell array read.
+    /// </summary>
+    public string ToLibplctagSliceArrayName()
+    {
+        if (Slice is null) return ToLibplctagName();
+        var buf = new System.Text.StringBuilder();
+        if (ProgramScope is not null)
+            buf.Append("Program:").Append(ProgramScope).Append('.');
+
+        for (var i = 0; i < Segments.Count; i++)
+        {
+            if (i > 0) buf.Append('.');
+            var seg = Segments[i];
+            buf.Append(seg.Name);
+            if (seg.Subscripts.Count > 0)
+                buf.Append('[').Append(string.Join(",", seg.Subscripts)).Append(']');
+        }
+        // Anchor the read at the slice start; libplctag treats Name=Tag[0] + ElementCount=N as
+        // "read N consecutive elements starting at index 0", which is the exact Rockwell
+        // array-read semantic this PR is wiring up.
+        buf.Append('[').Append(Slice.Start).Append(']');
+        return buf.ToString();
+    }
+
     /// <summary>
     ///     Parse a Logix-symbolic tag reference. Returns <c>null</c> on a shape the parser
     ///     doesn't support — the driver surfaces that as a config-validation error rather than
@@ -91,8 +121,10 @@ public sealed record AbCipTagPath(
         }
 
         var segments = new List<AbCipTagPathSegment>(parts.Count);
-        foreach (var part in parts)
+        AbCipTagPathSlice? slice = null;
+        for (var partIdx = 0; partIdx < parts.Count; partIdx++)
         {
+            var part = parts[partIdx];
             var bracketIdx = part.IndexOf('[');
             if (bracketIdx < 0)
             {
@@ -104,6 +136,25 @@ public sealed record AbCipTagPath(
             var name = part[..bracketIdx];
             if (!IsValidIdent(name)) return null;
             var inner = part[(bracketIdx + 1)..^1];
+
+            // Slice syntax `[N..M]` — only allowed on the LAST segment, must not coexist with
+            // multi-dim subscripts, must not be combined with bit-index, and requires M >= N.
+            // Any other shape is rejected so callers see a config-validation error rather than
+            // the driver attempting a best-effort scalar read.
+            if (inner.Contains(".."))
+            {
+                if (partIdx != parts.Count - 1) return null;          // slice + sub-element
+                if (bitIndex is not null) return null;                // slice + bit index
+                if (inner.Contains(',')) return null;                 // slice cannot be multi-dim
+                var parts2 = inner.Split("..", 2, StringSplitOptions.None);
+                if (parts2.Length != 2) return null;
+                if (!int.TryParse(parts2[0], out var sliceStart) || sliceStart < 0) return null;
+                if (!int.TryParse(parts2[1], out var sliceEnd) || sliceEnd < sliceStart) return null;
+                slice = new AbCipTagPathSlice(sliceStart, sliceEnd);
+                segments.Add(new AbCipTagPathSegment(name, []));
+                continue;
+            }
+
             var subs = new List<int>();
             foreach (var tok in inner.Split(','))
             {
@@ -115,7 +166,7 @@ public sealed record AbCipTagPath(
         }
         if (segments.Count == 0) return null;
 
-        return new AbCipTagPath(programScope, segments, bitIndex);
+        return new AbCipTagPath(programScope, segments, bitIndex, slice);
     }
 
     private static bool IsValidIdent(string s)
@@ -130,3 +181,15 @@ public sealed record AbCipTagPath(
 
 /// <summary>One path segment: a member name plus any numeric subscripts.</summary>
 public sealed record AbCipTagPathSegment(string Name, IReadOnlyList<int> Subscripts);
+
+/// <summary>
+///     Inclusive-on-both-ends array slice carried on the trailing segment of an
+///     <see cref="AbCipTagPath"/>. <c>Tag[0..15]</c> parses to <c>Start=0, End=15</c>; the
+///     planner pairs this with libplctag's <c>ElementCount</c> attribute to issue a single
+///     Rockwell array read covering <c>End - Start + 1</c> elements.
+/// </summary>
+public sealed record AbCipTagPathSlice(int Start, int End)
+{
+    /// <summary>Total element count covered by the slice (inclusive both ends).</summary>
+    public int Count => End - Start + 1;
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagRuntime.cs

@@ -65,10 +65,20 @@ public interface IAbCipTagFactory
 /// <param name="LibplctagPlcAttribute">libplctag <c>plc=...</c> attribute, per family profile.</param>
 /// <param name="TagName">Logix symbolic tag name as emitted by <see cref="AbCipTagPath.ToLibplctagName"/>.</param>
 /// <param name="Timeout">libplctag operation timeout (applies to Initialize / Read / Write).</param>
+/// <param name="StringMaxCapacity">Optional Logix STRINGnn DATA-array capacity (e.g. 20 / 40 / 80
+///     for <c>STRING_20</c> / <c>STRING_40</c> / <c>STRING_80</c> UDTs). Threads through libplctag's
+///     <c>str_max_capacity</c> attribute. <c>null</c> keeps libplctag's default 82-byte STRING
+///     behaviour for back-compat.</param>
+/// <param name="ElementCount">Optional libplctag <c>ElementCount</c> override — set to <c>N</c>
+///     to issue a Rockwell array read covering <c>N</c> consecutive elements starting at the
+///     subscripted index in <see cref="TagName"/>. Drives PR abcip-1.3 array-slice support;
+///     <c>null</c> leaves libplctag's default scalar-element behaviour for back-compat.</param>
 public sealed record AbCipTagCreateParams(
     string Gateway,
     int Port,
     string CipPath,
     string LibplctagPlcAttribute,
     string TagName,
-    TimeSpan Timeout);
+    TimeSpan Timeout,
+    int? StringMaxCapacity = null,
+    int? ElementCount = null);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -24,6 +24,17 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
             Name = p.TagName,
             Timeout = p.Timeout,
         };
+        // PR abcip-1.2 — Logix STRINGnn variant decoding. When the caller pins a non-default
+        // DATA-array capacity (STRING_20 / STRING_40 / STRING_80 etc.), forward it to libplctag
+        // via the StringMaxCapacity attribute so GetString / SetString truncate at the right
+        // boundary. Null leaves libplctag at its default 82-byte STRING for back-compat.
+        if (p.StringMaxCapacity is int cap && cap > 0)
+            _tag.StringMaxCapacity = (uint)cap;
+        // PR abcip-1.3 — slice reads. Setting ElementCount tells libplctag to allocate a buffer
+        // covering N consecutive elements; the array-read planner pairs this with TagName=Tag[N]
+        // to issue one Rockwell array read for a [N..M] slice.
+        if (p.ElementCount is int n && n > 0)
+            _tag.ElementCount = n;
     }
 
     public Task InitializeAsync(CancellationToken cancellationToken) => _tag.InitializeAsync(cancellationToken);
@@ -50,7 +61,7 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
         AbCipDataType.Real => _tag.GetFloat32(offset),
         AbCipDataType.LReal => _tag.GetFloat64(offset),
         AbCipDataType.String => _tag.GetString(offset),
-        AbCipDataType.Dt => _tag.GetInt32(offset),
+        AbCipDataType.Dt => _tag.GetInt64(offset),
         AbCipDataType.Structure => null,
         _ => null,
     };
@@ -105,7 +116,7 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
                 _tag.SetString(0, Convert.ToString(value) ?? string.Empty);
                 break;
             case AbCipDataType.Dt:
-                _tag.SetInt32(0, Convert.ToInt32(value));
+                _tag.SetInt64(0, Convert.ToInt64(value));
                 break;
             case AbCipDataType.Structure:
                 throw new NotSupportedException("Whole-UDT writes land in PR 6.");

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyAddress.cs

@@ -1,3 +1,5 @@
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+
 namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
 
 /// <summary>
@@ -30,35 +32,87 @@ public sealed record AbLegacyAddress(
     int? FileNumber,
     int WordNumber,
     int? BitIndex,
-    string? SubElement)
+    string? SubElement,
+    AbLegacyAddress? IndirectFileSource = null,
+    AbLegacyAddress? IndirectWordSource = null)
 {
+    /// <summary>
+    ///     True when either the file number or the word number is sourced from another PCCC
+    ///     address evaluated at runtime (PLC-5 / SLC indirect addressing — <c>N7:[N7:0]</c> or
+    ///     <c>N[N7:0]:5</c>). libplctag PCCC does not natively decode bracket-form indirection,
+    ///     so the runtime layer must resolve the inner address first and rewrite the tag name
+    ///     before issuing the actual read/write. See <see cref="ToLibplctagName"/>.
+    /// </summary>
+    public bool IsIndirect => IndirectFileSource is not null || IndirectWordSource is not null;
+
     public string ToLibplctagName()
     {
-        var file = FileNumber is null ? FileLetter : $"{FileLetter}{FileNumber}";
-        var wordPart = $"{file}:{WordNumber}";
+        // Re-emit using bracket form when indirect. libplctag's PCCC text decoder does not
+        // accept the bracket form directly — callers that need a libplctag-ready name must
+        // resolve the inner addresses first and substitute concrete numbers. Driver runtime
+        // path (TODO: resolve-then-read) is gated on IsIndirect.
+        string filePart;
+        if (IndirectFileSource is not null)
+        {
+            filePart = $"{FileLetter}[{IndirectFileSource.ToLibplctagName()}]";
+        }
+        else
+        {
+            filePart = FileNumber is null ? FileLetter : $"{FileLetter}{FileNumber}";
+        }
+
+        string wordSegment = IndirectWordSource is not null
+            ? $"[{IndirectWordSource.ToLibplctagName()}]"
+            : WordNumber.ToString();
+
+        var wordPart = $"{filePart}:{wordSegment}";
         if (SubElement is not null) wordPart += $".{SubElement}";
         if (BitIndex is not null) wordPart += $"/{BitIndex}";
         return wordPart;
     }
 
-    public static AbLegacyAddress? TryParse(string? value)
+    public static AbLegacyAddress? TryParse(string? value) => TryParse(value, family: null);
+
+    /// <summary>
+    ///     Family-aware parser. PLC-5 (RSLogix 5) displays the word + bit indices on
+    ///     <c>I:</c>/<c>O:</c> file references as octal — <c>I:001/17</c> is rack 1, bit 15.
+    ///     Pass the device's family so the parser can interpret those digits as octal when the
+    ///     family's <see cref="AbLegacyPlcFamilyProfile.OctalIoAddressing"/> is true. The parsed
+    ///     record stores decimal values; <see cref="ToLibplctagName"/> emits decimal too, which
+    ///     is what libplctag's PCCC layer expects.
+    /// </summary>
+    /// <remarks>
+    ///     Also accepts indirect / indexed forms (Issue #247): <c>N7:[N7:0]</c> reads file 7,
+    ///     word=value-of(N7:0); <c>N[N7:0]:5</c> reads file=value-of(N7:0), word 5. Recursion
+    ///     depth is capped at 1 — the inner address must be a plain direct PCCC address.
+    /// </remarks>
+    public static AbLegacyAddress? TryParse(string? value, AbLegacyPlcFamily? family)
     {
         if (string.IsNullOrWhiteSpace(value)) return null;
         var src = value.Trim();
 
-        // BitIndex: trailing /N
-        int? bitIndex = null;
-        var slashIdx = src.IndexOf('/');
-        if (slashIdx >= 0)
+        var profile = family is null ? null : AbLegacyPlcFamilyProfile.ForFamily(family.Value);
+
+        // BitIndex: trailing /N. Defer numeric parsing until the file letter is known — PLC-5
+        // I:/O: bit indices are octal in RSLogix 5, everything else is decimal.
+        string? bitText = null;
+        var slashIdx = src.LastIndexOf('/');
+        if (slashIdx >= 0 && slashIdx > src.LastIndexOf(']'))
         {
-            if (!int.TryParse(src[(slashIdx + 1)..], out var bit) || bit < 0 || bit > 31) return null;
-            bitIndex = bit;
+            bitText = src[(slashIdx + 1)..];
             src = src[..slashIdx];
         }
 
+        return ParseTail(src, bitText, profile, allowIndirect: true);
+    }
+
+    private static AbLegacyAddress? ParseTail(string src, string? bitText, AbLegacyPlcFamilyProfile? profile, bool allowIndirect)
+    {
         // SubElement: trailing .NAME (ACC / PRE / EN / DN / TT / CU / CD / FD / etc.)
+        // Only consider dots OUTSIDE of any bracketed inner address — the inner address may
+        // itself contain a sub-element dot (e.g. N[T4:0.ACC]:5).
         string? subElement = null;
-        var dotIdx = src.LastIndexOf('.');
+        var dotIdx = LastIndexOfTopLevel(src, '.');
         if (dotIdx >= 0)
         {
             var candidate = src[(dotIdx + 1)..];
@@ -69,29 +123,139 @@ public sealed record AbLegacyAddress(
             }
         }
 
-        var colonIdx = src.IndexOf(':');
+        var colonIdx = IndexOfTopLevel(src, ':');
         if (colonIdx <= 0) return null;
         var filePart = src[..colonIdx];
         var wordPart = src[(colonIdx + 1)..];
-        if (!int.TryParse(wordPart, out var word) || word < 0) return null;
 
-        // File letter + optional file number (single letter for I/O/S, letter+number otherwise).
+        // File letter (always literal) + optional file number — either decimal digits or a
+        // bracketed indirect address like N[N7:0].
         if (filePart.Length == 0 || !char.IsLetter(filePart[0])) return null;
         var letterEnd = 1;
         while (letterEnd < filePart.Length && char.IsLetter(filePart[letterEnd])) letterEnd++;
 
         var letter = filePart[..letterEnd].ToUpperInvariant();
         int? fileNumber = null;
+        AbLegacyAddress? indirectFile = null;
         if (letterEnd < filePart.Length)
         {
-            if (!int.TryParse(filePart[letterEnd..], out var fn) || fn < 0) return null;
+            var fileTail = filePart[letterEnd..];
+            if (fileTail.Length >= 2 && fileTail[0] == '[' && fileTail[^1] == ']')
+            {
+                if (!allowIndirect) return null;
+                var inner = fileTail[1..^1];
+                indirectFile = ParseInner(inner, profile);
+                if (indirectFile is null) return null;
+            }
+            else
+            {
+                if (!int.TryParse(fileTail, out var fn) || fn < 0) return null;
                 fileNumber = fn;
             }
+        }
 
         // Reject unknown file letters — these cover SLC/ML/PLC-5 canonical families.
-        if (!IsKnownFileLetter(letter)) return null;
+        // Function-file letters (RTC/HSC/DLS/MMI/PTO/PWM/STI/EII/IOS/BHI) are MicroLogix-only.
+        if (!IsKnownFileLetter(letter))
+        {
+            if (!IsFunctionFileLetter(letter) || profile?.SupportsFunctionFiles != true) return null;
+        }
 
-        return new AbLegacyAddress(letter, fileNumber, word, bitIndex, subElement);
+        var octalForIo = profile?.OctalIoAddressing == true && (letter == "I" || letter == "O");
+
+        // Word part: either a numeric literal (octal-aware for PLC-5 I:/O:) or a bracketed
+        // indirect address.
+        int word = 0;
+        AbLegacyAddress? indirectWord = null;
+        if (wordPart.Length >= 2 && wordPart[0] == '[' && wordPart[^1] == ']')
+        {
+            if (!allowIndirect) return null;
+            var inner = wordPart[1..^1];
+            indirectWord = ParseInner(inner, profile);
+            if (indirectWord is null) return null;
+        }
+        else
+        {
+            if (!TryParseIndex(wordPart, octalForIo, out word) || word < 0) return null;
+        }
+
+        int? bitIndex = null;
+        if (bitText is not null)
+        {
+            if (!TryParseIndex(bitText, octalForIo, out var bit) || bit < 0 || bit > 31) return null;
+            bitIndex = bit;
+        }
+
+        return new AbLegacyAddress(letter, fileNumber, word, bitIndex, subElement, indirectFile, indirectWord);
+    }
+
+    /// <summary>
+    ///     Parse an inner (bracketed) PCCC address with depth-1 cap. The inner address itself
+    ///     must NOT be indirect — nesting beyond one level is rejected.
+    /// </summary>
+    private static AbLegacyAddress? ParseInner(string inner, AbLegacyPlcFamilyProfile? profile)
+    {
+        if (string.IsNullOrWhiteSpace(inner)) return null;
+        var src = inner.Trim();
+        // Reject any further bracket — depth cap at 1.
+        if (src.IndexOf('[') >= 0 || src.IndexOf(']') >= 0) return null;
+
+        string? bitText = null;
+        var slashIdx = src.LastIndexOf('/');
+        if (slashIdx >= 0)
+        {
+            bitText = src[(slashIdx + 1)..];
+            src = src[..slashIdx];
+        }
+        return ParseTail(src, bitText, profile, allowIndirect: false);
+    }
+
+    private static int IndexOfTopLevel(string s, char c)
+    {
+        var depth = 0;
+        for (var i = 0; i < s.Length; i++)
+        {
+            if (s[i] == '[') depth++;
+            else if (s[i] == ']') depth--;
+            else if (depth == 0 && s[i] == c) return i;
+        }
+        return -1;
+    }
+
+    private static int LastIndexOfTopLevel(string s, char c)
+    {
+        var depth = 0;
+        var last = -1;
+        for (var i = 0; i < s.Length; i++)
+        {
+            if (s[i] == '[') depth++;
+            else if (s[i] == ']') depth--;
+            else if (depth == 0 && s[i] == c) last = i;
+        }
+        return last;
+    }
+
+    private static bool TryParseIndex(string text, bool octal, out int value)
+    {
+        if (octal)
+        {
+            // Octal accepts only digits 0-7. Reject 8/9 explicitly.
+            if (text.Length == 0) { value = 0; return false; }
+            var start = 0;
+            var sign = 1;
+            if (text[0] == '-') { sign = -1; start = 1; }
+            if (start >= text.Length) { value = 0; return false; }
+            var acc = 0;
+            for (var i = start; i < text.Length; i++)
+            {
+                var c = text[i];
+                if (c < '0' || c > '7') { value = 0; return false; }
+                acc = (acc * 8) + (c - '0');
+            }
+            value = sign * acc;
+            return true;
+        }
+        return int.TryParse(text, out value);
     }
 
     private static bool IsKnownFileLetter(string letter) => letter switch
@@ -99,4 +263,14 @@ public sealed record AbLegacyAddress(
         "N" or "F" or "B" or "L" or "ST" or "T" or "C" or "R" or "I" or "O" or "S" or "A" => true,
         _ => false,
     };
+
+    /// <summary>
+    ///     MicroLogix 1100/1400 function-file prefixes. Each maps to a single fixed instance with a
+    ///     known sub-element catalogue (see <see cref="AbLegacyDataType"/>).
+    /// </summary>
+    internal static bool IsFunctionFileLetter(string letter) => letter switch
+    {
+        "RTC" or "HSC" or "DLS" or "MMI" or "PTO" or "PWM" or "STI" or "EII" or "IOS" or "BHI" => true,
+        _ => false,
+    };
 }

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDataType.cs

@@ -26,6 +26,72 @@ public enum AbLegacyDataType
     CounterElement,
     /// <summary>Control sub-element — caller addresses <c>.LEN</c>, <c>.POS</c>, <c>.EN</c>, <c>.DN</c>, <c>.ER</c>.</summary>
     ControlElement,
+    /// <summary>
+    ///     MicroLogix 1100/1400 function-file sub-element (RTC/HSC/DLS/MMI/PTO/PWM/STI/EII/IOS/BHI).
+    ///     Sub-element catalogue lives in <see cref="AbLegacyFunctionFile.SubElementType"/>.
+    /// </summary>
+    MicroLogixFunctionFile,
+}
+
+/// <summary>
+///     MicroLogix function-file sub-element catalogue. Covers the most-commonly-addressed members
+///     per file — not exhaustive (Rockwell defines 30+ on RTC alone). Unknown sub-elements fall
+///     back to <see cref="DriverDataType.Int32"/> at the <see cref="AbLegacyDataTypeExtensions"/>
+///     boundary so the driver never refuses a tag the customer happens to know about.
+/// </summary>
+public static class AbLegacyFunctionFile
+{
+    /// <summary>
+    ///     Driver-surface type for <paramref name="fileLetter"/>.<paramref name="subElement"/>.
+    ///     Returns <see cref="DriverDataType.Int32"/> if the sub-element is unrecognised — keeps
+    ///     the driver permissive without forcing every quirk into the catalogue.
+    /// </summary>
+    public static DriverDataType SubElementType(string fileLetter, string? subElement)
+    {
+        if (subElement is null) return DriverDataType.Int32;
+        var key = (fileLetter.ToUpperInvariant(), subElement.ToUpperInvariant());
+        return key switch
+        {
+            // Real-time clock — all stored as Int16 (year is 4-digit Int16).
+            ("RTC", "HR") or ("RTC", "MIN") or ("RTC", "SEC") or
+            ("RTC", "MON") or ("RTC", "DAY") or ("RTC", "YR") or ("RTC", "DOW") => DriverDataType.Int32,
+            ("RTC", "DS") or ("RTC", "BL") or ("RTC", "EN") => DriverDataType.Boolean,
+
+            // High-speed counter — accumulator/preset are Int32, status flags are bits.
+            ("HSC", "ACC") or ("HSC", "PRE") or ("HSC", "OVF") or ("HSC", "UNF") => DriverDataType.Int32,
+            ("HSC", "EN") or ("HSC", "UF") or ("HSC", "IF") or
+            ("HSC", "IN") or ("HSC", "IH") or ("HSC", "IL") or
+            ("HSC", "DN") or ("HSC", "CD") or ("HSC", "CU") => DriverDataType.Boolean,
+
+            // Daylight saving + memory module info.
+            ("DLS", "STR") or ("DLS", "STD") => DriverDataType.Int32,
+            ("DLS", "EN") => DriverDataType.Boolean,
+            ("MMI", "FT") or ("MMI", "LBN") => DriverDataType.Int32,
+            ("MMI", "MP") or ("MMI", "MCP") => DriverDataType.Boolean,
+
+            // Pulse-train / PWM output blocks.
+            ("PTO", "ACC") or ("PTO", "OF") or ("PTO", "IDA") or ("PTO", "ODA") => DriverDataType.Int32,
+            ("PTO", "EN") or ("PTO", "DN") or ("PTO", "EH") or ("PTO", "ED") or
+            ("PTO", "RP") or ("PTO", "OUT") => DriverDataType.Boolean,
+            ("PWM", "ACC") or ("PWM", "OF") or ("PWM", "PE") or ("PWM", "PD") => DriverDataType.Int32,
+            ("PWM", "EN") or ("PWM", "DN") or ("PWM", "EH") or ("PWM", "ED") or
+            ("PWM", "RP") or ("PWM", "OUT") => DriverDataType.Boolean,
+
+            // Selectable timed interrupt + event input interrupt.
+            ("STI", "SPM") or ("STI", "ER") or ("STI", "PFN") => DriverDataType.Int32,
+            ("STI", "EN") or ("STI", "TIE") or ("STI", "DN") or
+            ("STI", "PS") or ("STI", "ED") => DriverDataType.Boolean,
+            ("EII", "PFN") or ("EII", "ER") => DriverDataType.Int32,
+            ("EII", "EN") or ("EII", "TIE") or ("EII", "PE") or
+            ("EII", "ES") or ("EII", "ED") => DriverDataType.Boolean,
+
+            // I/O status + base hardware info — mostly status flags + a few counters.
+            ("IOS", "ID") or ("IOS", "TYP") => DriverDataType.Int32,
+            ("BHI", "OS") or ("BHI", "FRN") or ("BHI", "BSN") or ("BHI", "CC") => DriverDataType.Int32,
+
+            _ => DriverDataType.Int32,
+        };
+    }
 }
 
 /// <summary>Map a PCCC data type to the driver-surface <see cref="DriverDataType"/>.</summary>
@@ -40,6 +106,106 @@ public static class AbLegacyDataTypeExtensions
         AbLegacyDataType.String => DriverDataType.String,
         AbLegacyDataType.TimerElement or AbLegacyDataType.CounterElement
             or AbLegacyDataType.ControlElement => DriverDataType.Int32,
+        AbLegacyDataType.MicroLogixFunctionFile => DriverDataType.Int32,
         _ => DriverDataType.Int32,
     };
+
+    /// <summary>
+    ///     Sub-element-aware driver type. Timer/Counter/Control elements expose Boolean status
+    ///     bits (<c>.DN</c>, <c>.EN</c>, <c>.TT</c>, <c>.CU</c>, <c>.CD</c>, <c>.OV</c>,
+    ///     <c>.UN</c>, <c>.ER</c>, etc.) and Int32 word members (<c>.PRE</c>, <c>.ACC</c>,
+    ///     <c>.LEN</c>, <c>.POS</c>). Unknown sub-elements fall back to
+    ///     <see cref="ToDriverDataType"/> so the driver remains permissive.
+    /// </summary>
+    public static DriverDataType EffectiveDriverDataType(AbLegacyDataType t, string? subElement)
+    {
+        if (subElement is null) return t.ToDriverDataType();
+        var key = subElement.ToUpperInvariant();
+        return t switch
+        {
+            AbLegacyDataType.TimerElement => key switch
+            {
+                "EN" or "TT" or "DN" => DriverDataType.Boolean,
+                "PRE" or "ACC" => DriverDataType.Int32,
+                _ => t.ToDriverDataType(),
+            },
+            AbLegacyDataType.CounterElement => key switch
+            {
+                "CU" or "CD" or "DN" or "OV" or "UN" => DriverDataType.Boolean,
+                "PRE" or "ACC" => DriverDataType.Int32,
+                _ => t.ToDriverDataType(),
+            },
+            AbLegacyDataType.ControlElement => key switch
+            {
+                "EN" or "EU" or "DN" or "EM" or "ER" or "UL" or "IN" or "FD" => DriverDataType.Boolean,
+                "LEN" or "POS" => DriverDataType.Int32,
+                _ => t.ToDriverDataType(),
+            },
+            _ => t.ToDriverDataType(),
+        };
+    }
+
+    /// <summary>
+    ///     Bit position within the parent control word for Timer/Counter/Control status bits.
+    ///     Returns <c>null</c> if the sub-element is not a known bit member of the given element
+    ///     type. Bit numbering follows Rockwell DTAM / PCCC documentation.
+    /// </summary>
+    public static int? StatusBitIndex(AbLegacyDataType t, string? subElement)
+    {
+        if (subElement is null) return null;
+        var key = subElement.ToUpperInvariant();
+        return t switch
+        {
+            // T4 element word 0: bit 13=DN, 14=TT, 15=EN.
+            AbLegacyDataType.TimerElement => key switch
+            {
+                "DN" => 13,
+                "TT" => 14,
+                "EN" => 15,
+                _ => null,
+            },
+            // C5 element word 0: bit 10=UN, 11=OV, 12=DN, 13=CD, 14=CU.
+            AbLegacyDataType.CounterElement => key switch
+            {
+                "UN" => 10,
+                "OV" => 11,
+                "DN" => 12,
+                "CD" => 13,
+                "CU" => 14,
+                _ => null,
+            },
+            // R6 element word 0: bit 8=FD, 9=IN, 10=UL, 11=ER, 12=EM, 13=DN, 14=EU, 15=EN.
+            AbLegacyDataType.ControlElement => key switch
+            {
+                "FD" => 8,
+                "IN" => 9,
+                "UL" => 10,
+                "ER" => 11,
+                "EM" => 12,
+                "DN" => 13,
+                "EU" => 14,
+                "EN" => 15,
+                _ => null,
+            },
+            _ => null,
+        };
+    }
+
+    /// <summary>
+    ///     PLC-set status bits — read-only from the OPC UA side. Operator-controllable bits
+    ///     (e.g. <c>.EN</c> on a timer/counter, <c>.CU</c>/<c>.CD</c> rung-driven inputs) are
+    ///     omitted so they keep default writable behaviour.
+    /// </summary>
+    public static bool IsPlcSetStatusBit(AbLegacyDataType t, string? subElement)
+    {
+        if (subElement is null) return false;
+        var key = subElement.ToUpperInvariant();
+        return t switch
+        {
+            AbLegacyDataType.TimerElement => key is "DN" or "TT",
+            AbLegacyDataType.CounterElement => key is "DN" or "OV" or "UN",
+            AbLegacyDataType.ControlElement => key is "DN" or "EM" or "ER" or "FD" or "UL" or "IN",
+            _ => false,
+        };
+    }
 }

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriver.cs

@@ -140,8 +140,13 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
                     continue;
                 }
 
-                var parsed = AbLegacyAddress.TryParse(def.Address);
-                var value = runtime.DecodeValue(def.DataType, parsed?.BitIndex);
+                var parsed = AbLegacyAddress.TryParse(def.Address, device.Options.PlcFamily);
+                // Timer/Counter/Control status bits route through GetBit at the parent-word
+                // address — translate the .DN/.EN/etc. sub-element to its standard bit position
+                // and pass it down to the runtime as a synthetic bitIndex.
+                var decodeBit = parsed?.BitIndex
+                    ?? AbLegacyDataTypeExtensions.StatusBitIndex(def.DataType, parsed?.SubElement);
+                var value = runtime.DecodeValue(def.DataType, decodeBit);
                 results[i] = new DataValueSnapshot(value, AbLegacyStatusMapper.Good, now, now);
                 _health = new DriverHealth(DriverState.Healthy, now, null);
             }
@@ -186,7 +191,16 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
 
             try
             {
-                var parsed = AbLegacyAddress.TryParse(def.Address);
+                var parsed = AbLegacyAddress.TryParse(def.Address, device.Options.PlcFamily);
+
+                // Timer/Counter/Control PLC-set status bits (DN, TT, OV, UN, FD, ER, EM, UL,
+                // IN) are read-only — the PLC sets them; any client write would be silently
+                // overwritten on the next scan. Reject up front with BadNotWritable.
+                if (AbLegacyDataTypeExtensions.IsPlcSetStatusBit(def.DataType, parsed?.SubElement))
+                {
+                    results[i] = new WriteResult(AbLegacyStatusMapper.BadNotWritable);
+                    continue;
+                }
 
                 // PCCC bit-within-word writes — task #181 pass 2. RMW against a parallel
                 // parent-word runtime (strip the /N bit suffix). Per-parent-word lock serialises
@@ -247,12 +261,19 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
                 string.Equals(t.DeviceHostAddress, device.HostAddress, StringComparison.OrdinalIgnoreCase));
             foreach (var tag in tagsForDevice)
             {
+                var parsed = AbLegacyAddress.TryParse(tag.Address, device.PlcFamily);
+                // Timer/Counter/Control sub-elements (.DN/.EN/.TT/.PRE/.ACC/etc.) refine the
+                // base element's Int32 to Boolean for status bits and Int32 for word members.
+                var effectiveType = AbLegacyDataTypeExtensions.EffectiveDriverDataType(
+                    tag.DataType, parsed?.SubElement);
+                var plcSetBit = AbLegacyDataTypeExtensions.IsPlcSetStatusBit(
+                    tag.DataType, parsed?.SubElement);
                 deviceFolder.Variable(tag.Name, tag.Name, new DriverAttributeInfo(
                     FullName: tag.Name,
-                    DriverDataType: tag.DataType.ToDriverDataType(),
+                    DriverDataType: effectiveType,
                     IsArray: false,
                     ArrayDim: null,
-                    SecurityClass: tag.Writable
+                    SecurityClass: tag.Writable && !plcSetBit
                         ? SecurityClassification.Operate
                         : SecurityClassification.ViewOnly,
                     IsHistorized: false,
@@ -413,10 +434,19 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
     {
         if (device.Runtimes.TryGetValue(def.Name, out var existing)) return existing;
 
-        var parsed = AbLegacyAddress.TryParse(def.Address)
+        var parsed = AbLegacyAddress.TryParse(def.Address, device.Options.PlcFamily)
             ?? throw new InvalidOperationException(
                 $"AbLegacy tag '{def.Name}' has malformed Address '{def.Address}'.");
 
+        // TODO(#247): libplctag's PCCC text decoder does not natively accept the bracket-form
+        // indirect address. Resolving N7:[N7:0] requires reading the inner address first, then
+        // rewriting the tag name with the resolved word number, then issuing the actual read.
+        // For now we surface a clear runtime error rather than letting libplctag fail with an
+        // opaque parser error.
+        if (parsed.IsIndirect)
+            throw new NotSupportedException(
+                $"AbLegacy tag '{def.Name}' uses indirect addressing ('{def.Address}'); runtime resolution is not yet implemented.");
+
         var runtime = _tagFactory.Create(new AbLegacyTagCreateParams(
             Gateway: device.ParsedAddress.Gateway,
             Port: device.ParsedAddress.Port,

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriverOptions.cs

@@ -23,7 +23,7 @@ public sealed record AbLegacyDeviceOptions(
 
 /// <summary>
 ///     One PCCC-backed OPC UA variable. <paramref name="Address"/> is the canonical PCCC
-///     file-address string that parses via <see cref="AbLegacyAddress.TryParse"/>.
+///     file-address string that parses via <see cref="AbLegacyAddress.TryParse(string?)"/>.
 /// </summary>
 public sealed record AbLegacyTagDefinition(
     string Name,

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/LibplctagLegacyTagRuntime.cs

@@ -40,8 +40,14 @@ internal sealed class LibplctagLegacyTagRuntime : IAbLegacyTagRuntime
         AbLegacyDataType.Long => _tag.GetInt32(0),
         AbLegacyDataType.Float => _tag.GetFloat32(0),
         AbLegacyDataType.String => _tag.GetString(0),
+        // Timer/Counter/Control sub-elements: bitIndex is the status bit position within the
+        // parent control word (encoded by AbLegacyDriver from the .DN / .EN / etc. sub-element
+        // name). Word members (.PRE / .ACC / .LEN / .POS) come through with bitIndex=null and
+        // decode as Int32 like before.
         AbLegacyDataType.TimerElement or AbLegacyDataType.CounterElement
-            or AbLegacyDataType.ControlElement => _tag.GetInt32(0),
+            or AbLegacyDataType.ControlElement => bitIndex is int statusBit
+                ? _tag.GetBit(statusBit)
+                : _tag.GetInt32(0),
         _ => null,
     };
 

src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/PlcFamilies/AbLegacyPlcFamilyProfile.cs

@@ -9,7 +9,9 @@ public sealed record AbLegacyPlcFamilyProfile(
     string DefaultCipPath,
     int MaxTagBytes,
     bool SupportsStringFile,
-    bool SupportsLongFile)
+    bool SupportsLongFile,
+    bool OctalIoAddressing,
+    bool SupportsFunctionFiles)
 {
     public static AbLegacyPlcFamilyProfile ForFamily(AbLegacyPlcFamily family) => family switch
     {
@@ -25,21 +27,27 @@ public sealed record AbLegacyPlcFamilyProfile(
         DefaultCipPath: "1,0",
         MaxTagBytes: 240,           // SLC 5/05 PCCC max packet data
         SupportsStringFile: true,   // ST file available SLC 5/04+
-        SupportsLongFile: true);    // L file available SLC 5/05+
+        SupportsLongFile: true,     // L file available SLC 5/05+
+        OctalIoAddressing: false,   // SLC500 I:/O: indices are decimal in RSLogix 500
+        SupportsFunctionFiles: false); // SLC500 has no function files
 
     public static readonly AbLegacyPlcFamilyProfile MicroLogix = new(
         LibplctagPlcAttribute: "micrologix",
         DefaultCipPath: "",         // MicroLogix 1100/1400 use direct EIP, no backplane path
         MaxTagBytes: 232,
         SupportsStringFile: true,
-        SupportsLongFile: false);   // ML 1100/1200/1400 don't ship L files
+        SupportsLongFile: false,    // ML 1100/1200/1400 don't ship L files
+        OctalIoAddressing: false,   // MicroLogix follows SLC-style decimal I/O addressing
+        SupportsFunctionFiles: true); // ML 1100/1400 expose RTC/HSC/DLS/MMI/PTO/PWM/STI/EII/IOS/BHI
 
     public static readonly AbLegacyPlcFamilyProfile Plc5 = new(
         LibplctagPlcAttribute: "plc5",
         DefaultCipPath: "1,0",
         MaxTagBytes: 240,           // DF1 full-duplex packet limit at 264 bytes, PCCC-over-EIP caps lower
         SupportsStringFile: true,
-        SupportsLongFile: false);   // PLC-5 predates L files
+        SupportsLongFile: false,    // PLC-5 predates L files
+        OctalIoAddressing: true,    // RSLogix 5 displays I:/O: word + bit indices as octal
+        SupportsFunctionFiles: false);
 
     /// <summary>
     ///     Logix ControlLogix / CompactLogix accessed through the legacy PCCC compatibility layer.
@@ -51,7 +59,9 @@ public sealed record AbLegacyPlcFamilyProfile(
         DefaultCipPath: "1,0",
         MaxTagBytes: 240,
         SupportsStringFile: true,
-        SupportsLongFile: true);
+        SupportsLongFile: true,
+        OctalIoAddressing: false,   // Logix natively uses decimal arrays even via the PCCC bridge
+        SupportsFunctionFiles: false);
 }
 
 /// <summary>Which PCCC PLC family the device is.</summary>

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipArrayReadPlannerTests.cs

@@ -0,0 +1,110 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipArrayReadPlannerTests
+{
+    private const string Device = "ab://10.0.0.5/1,0";
+
+    private static AbCipTagCreateParams BaseParams(string tagName) => new(
+        Gateway: "10.0.0.5",
+        Port: 44818,
+        CipPath: "1,0",
+        LibplctagPlcAttribute: "controllogix",
+        TagName: tagName,
+        Timeout: TimeSpan.FromSeconds(5));
+
+    [Fact]
+    public void TryBuild_emits_single_tag_create_with_element_count()
+    {
+        var def = new AbCipTagDefinition("DataSlice", Device, "Data[0..15]", AbCipDataType.DInt);
+        var parsed = AbCipTagPath.TryParse(def.TagPath)!;
+
+        var plan = AbCipArrayReadPlanner.TryBuild(def, parsed, BaseParams("Data[0..15]"));
+
+        plan.ShouldNotBeNull();
+        plan.ElementType.ShouldBe(AbCipDataType.DInt);
+        plan.Stride.ShouldBe(4);
+        plan.Slice.Count.ShouldBe(16);
+        plan.CreateParams.ElementCount.ShouldBe(16);
+        // Anchored at the slice start; libplctag reads N consecutive elements from there.
+        plan.CreateParams.TagName.ShouldBe("Data[0]");
+    }
+
+    [Fact]
+    public void TryBuild_returns_null_when_path_has_no_slice()
+    {
+        var def = new AbCipTagDefinition("Plain", Device, "Data[3]", AbCipDataType.DInt);
+        var parsed = AbCipTagPath.TryParse(def.TagPath)!;
+
+        AbCipArrayReadPlanner.TryBuild(def, parsed, BaseParams("Data[3]")).ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData(AbCipDataType.Bool)]
+    [InlineData(AbCipDataType.String)]
+    [InlineData(AbCipDataType.Structure)]
+    public void TryBuild_returns_null_for_unsupported_element_types(AbCipDataType type)
+    {
+        var def = new AbCipTagDefinition("Slice", Device, "Data[0..3]", type);
+        var parsed = AbCipTagPath.TryParse(def.TagPath)!;
+
+        AbCipArrayReadPlanner.TryBuild(def, parsed, BaseParams("Data[0..3]")).ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData(AbCipDataType.SInt, 1)]
+    [InlineData(AbCipDataType.Int, 2)]
+    [InlineData(AbCipDataType.DInt, 4)]
+    [InlineData(AbCipDataType.Real, 4)]
+    [InlineData(AbCipDataType.LInt, 8)]
+    [InlineData(AbCipDataType.LReal, 8)]
+    public void TryBuild_uses_natural_stride_per_element_type(AbCipDataType type, int expectedStride)
+    {
+        var def = new AbCipTagDefinition("Slice", Device, "Data[0..3]", type);
+        var parsed = AbCipTagPath.TryParse(def.TagPath)!;
+
+        var plan = AbCipArrayReadPlanner.TryBuild(def, parsed, BaseParams("Data[0..3]"))!;
+        plan.Stride.ShouldBe(expectedStride);
+    }
+
+    [Fact]
+    public void Decode_walks_buffer_at_element_stride()
+    {
+        var def = new AbCipTagDefinition("DataSlice", Device, "Data[0..3]", AbCipDataType.DInt);
+        var parsed = AbCipTagPath.TryParse(def.TagPath)!;
+        var plan = AbCipArrayReadPlanner.TryBuild(def, parsed, BaseParams("Data[0..3]"))!;
+
+        var fake = new FakeAbCipTag(plan.CreateParams);
+        // Stride == 4 for DInt, so offsets 0/4/8/12 hold the four element values.
+        fake.ValuesByOffset[0] = 100;
+        fake.ValuesByOffset[4] = 200;
+        fake.ValuesByOffset[8] = 300;
+        fake.ValuesByOffset[12] = 400;
+
+        var decoded = AbCipArrayReadPlanner.Decode(plan, fake);
+
+        decoded.Length.ShouldBe(4);
+        decoded.ShouldBe(new object?[] { 100, 200, 300, 400 });
+    }
+
+    [Fact]
+    public void Decode_preserves_slice_count_for_real_arrays()
+    {
+        var def = new AbCipTagDefinition("FloatSlice", Device, "Floats[2..5]", AbCipDataType.Real);
+        var parsed = AbCipTagPath.TryParse(def.TagPath)!;
+        var plan = AbCipArrayReadPlanner.TryBuild(def, parsed, BaseParams("Floats[2]"))!;
+
+        var fake = new FakeAbCipTag(plan.CreateParams);
+        fake.ValuesByOffset[0] = 1.5f;
+        fake.ValuesByOffset[4] = 2.5f;
+        fake.ValuesByOffset[8] = 3.5f;
+        fake.ValuesByOffset[12] = 4.5f;
+
+        var decoded = AbCipArrayReadPlanner.Decode(plan, fake);
+
+        decoded.ShouldBe(new object?[] { 1.5f, 2.5f, 3.5f, 4.5f });
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverReadTests.cs

@@ -165,6 +165,55 @@ public sealed class AbCipDriverReadTests
         p.TagName.ShouldBe("Program:P.Counter");
     }
 
+    [Fact]
+    public async Task Slice_tag_reads_one_array_and_decodes_n_elements()
+    {
+        // PR abcip-1.3 — `Data[0..3]` slice routes through AbCipArrayReadPlanner: one libplctag
+        // tag-create at TagName="Data[0]" with ElementCount=4, single PLC read, contiguous
+        // buffer decoded at element stride into one snapshot whose Value is an object?[].
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("DataSlice", "ab://10.0.0.5/1,0", "Data[0..3]", AbCipDataType.DInt));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p =>
+        {
+            var t = new FakeAbCipTag(p);
+            t.ValuesByOffset[0] = 10;
+            t.ValuesByOffset[4] = 20;
+            t.ValuesByOffset[8] = 30;
+            t.ValuesByOffset[12] = 40;
+            return t;
+        };
+
+        var snapshots = await drv.ReadAsync(["DataSlice"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        var values = snapshots.Single().Value.ShouldBeOfType<object?[]>();
+        values.ShouldBe(new object?[] { 10, 20, 30, 40 });
+
+        // Exactly ONE libplctag tag was created — anchored at the slice start with
+        // ElementCount=4. Without the planner this would have been four scalar reads.
+        factory.Tags.Count.ShouldBe(1);
+        factory.Tags.ShouldContainKey("Data[0]");
+        factory.Tags["Data[0]"].CreationParams.ElementCount.ShouldBe(4);
+        factory.Tags["Data[0]"].ReadCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Slice_tag_with_unsupported_element_type_returns_BadNotSupported()
+    {
+        // BOOL slices can't be laid out from the declaration alone (Logix packs BOOLs into a
+        // hidden host byte). The planner refuses; the driver surfaces BadNotSupported instead
+        // of attempting a best-effort decode.
+        var (drv, _) = NewDriver(
+            new AbCipTagDefinition("BoolSlice", "ab://10.0.0.5/1,0", "Flags[0..7]", AbCipDataType.Bool));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["BoolSlice"], CancellationToken.None);
+
+        snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadNotSupported);
+        snapshots.Single().Value.ShouldBeNull();
+    }
+
     [Fact]
     public async Task Cancellation_propagates_from_read()
     {
@@ -211,4 +260,79 @@ public sealed class AbCipDriverReadTests
         snapshots.Single().StatusCode.ShouldBe(AbCipStatusMapper.BadCommunicationError);
         factory.Tags["Nope"].Disposed.ShouldBeTrue();
     }
+
+    // PR abcip-1.2 — STRINGnn variant decoding. Threading <see cref="AbCipTagDefinition.StringLength"/>
+    // through libplctag's StringMaxCapacity attribute lets STRING_20 / STRING_40 / STRING_80 UDTs
+    // decode against the right DATA-array size; null preserves the default 82-byte STRING.
+
+    [Fact]
+    public async Task StringLength_threads_into_TagCreateParams_StringMaxCapacity()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Banner", "ab://10.0.0.5/1,0", "Banner", AbCipDataType.String,
+                StringLength: 40));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = "hello" };
+
+        await drv.ReadAsync(["Banner"], CancellationToken.None);
+
+        factory.Tags["Banner"].CreationParams.StringMaxCapacity.ShouldBe(40);
+    }
+
+    [Fact]
+    public async Task StringLength_null_leaves_StringMaxCapacity_null_for_back_compat()
+    {
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("LegacyStr", "ab://10.0.0.5/1,0", "LegacyStr", AbCipDataType.String));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = "world" };
+
+        await drv.ReadAsync(["LegacyStr"], CancellationToken.None);
+
+        factory.Tags["LegacyStr"].CreationParams.StringMaxCapacity.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task StringLength_ignored_for_non_String_data_types()
+    {
+        // StringLength on a DINT-typed tag must not flow into StringMaxCapacity — libplctag would
+        // otherwise re-shape the buffer and corrupt the read. EnsureTagRuntimeAsync gates on the
+        // declared DataType.
+        var (drv, factory) = NewDriver(
+            new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt,
+                StringLength: 80));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = 7 };
+
+        await drv.ReadAsync(["Speed"], CancellationToken.None);
+
+        factory.Tags["Speed"].CreationParams.StringMaxCapacity.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task UDT_member_StringLength_threads_through_to_member_runtime()
+    {
+        // STRINGnn members of a UDT — declaration-driven fan-out copies StringLength from
+        // AbCipStructureMember onto the synthesised member AbCipTagDefinition; the per-member
+        // runtime then receives the right StringMaxCapacity.
+        var udt = new AbCipTagDefinition(
+            Name: "Recipe",
+            DeviceHostAddress: "ab://10.0.0.5/1,0",
+            TagPath: "Recipe",
+            DataType: AbCipDataType.Structure,
+            Members: [
+                new AbCipStructureMember("Name", AbCipDataType.String, StringLength: 20),
+                new AbCipStructureMember("Description", AbCipDataType.String, StringLength: 80),
+                new AbCipStructureMember("Code", AbCipDataType.DInt),
+            ]);
+        var (drv, factory) = NewDriver(udt);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbCipTag(p) { Value = "x" };
+
+        await drv.ReadAsync(["Recipe.Name", "Recipe.Description", "Recipe.Code"], CancellationToken.None);
+
+        factory.Tags["Recipe.Name"].CreationParams.StringMaxCapacity.ShouldBe(20);
+        factory.Tags["Recipe.Description"].CreationParams.StringMaxCapacity.ShouldBe(80);
+        factory.Tags["Recipe.Code"].CreationParams.StringMaxCapacity.ShouldBeNull();
+    }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverTests.cs

@@ -124,8 +124,11 @@ public sealed class AbCipDriverTests
     {
         AbCipDataType.Bool.ToDriverDataType().ShouldBe(DriverDataType.Boolean);
         AbCipDataType.DInt.ToDriverDataType().ShouldBe(DriverDataType.Int32);
+        AbCipDataType.LInt.ToDriverDataType().ShouldBe(DriverDataType.Int64);
+        AbCipDataType.ULInt.ToDriverDataType().ShouldBe(DriverDataType.UInt64);
         AbCipDataType.Real.ToDriverDataType().ShouldBe(DriverDataType.Float32);
         AbCipDataType.LReal.ToDriverDataType().ShouldBe(DriverDataType.Float64);
         AbCipDataType.String.ToDriverDataType().ShouldBe(DriverDataType.String);
+        AbCipDataType.Dt.ToDriverDataType().ShouldBe(DriverDataType.Int64);
     }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipMultiWritePackingTests.cs

@@ -0,0 +1,283 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+/// <summary>
+///     PR abcip-1.4 — multi-tag write packing. Validates that <see cref="AbCipDriver.WriteAsync"/>
+///     groups writes by device, dispatches packable writes for request-packing-capable
+///     families concurrently, falls back to sequential writes on Micro800, keeps BOOL-RMW
+///     writes on the per-parent semaphore path, and fans per-tag StatusCodes out to the
+///     correct positions on partial failures.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class AbCipMultiWritePackingTests
+{
+    [Fact]
+    public async Task Writes_get_grouped_by_device()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices =
+            [
+                new AbCipDeviceOptions("ab://10.0.0.5/1,0"),
+                new AbCipDeviceOptions("ab://10.0.0.6/1,0"),
+            ],
+            Tags =
+            [
+                new AbCipTagDefinition("A1", "ab://10.0.0.5/1,0", "A1", AbCipDataType.DInt),
+                new AbCipTagDefinition("A2", "ab://10.0.0.5/1,0", "A2", AbCipDataType.DInt),
+                new AbCipTagDefinition("B1", "ab://10.0.0.6/1,0", "B1", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("A1", 1),
+            new WriteRequest("B1", 100),
+            new WriteRequest("A2", 2),
+        ], CancellationToken.None);
+
+        results.Count.ShouldBe(3);
+        results[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[2].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        // Per-device handles materialised — A1/A2 share device A, B1 lives on device B.
+        factory.Tags["A1"].CreationParams.Gateway.ShouldBe("10.0.0.5");
+        factory.Tags["A2"].CreationParams.Gateway.ShouldBe("10.0.0.5");
+        factory.Tags["B1"].CreationParams.Gateway.ShouldBe("10.0.0.6");
+        factory.Tags["A1"].WriteCount.ShouldBe(1);
+        factory.Tags["A2"].WriteCount.ShouldBe(1);
+        factory.Tags["B1"].WriteCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task ControlLogix_packs_concurrently_within_a_device()
+    {
+        // ControlLogix has SupportsRequestPacking=true → a multi-write batch is dispatched in
+        // parallel. The fake's WriteAsync gates on a TaskCompletionSource so we can prove that
+        // both writes are in flight at the same time before either completes.
+        var gate = new TaskCompletionSource<int>(TaskCreationOptions.RunContinuationsAsynchronously);
+        var inFlight = 0;
+        var maxInFlight = 0;
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new GatedWriteFake(p, gate, () =>
+            {
+                var current = Interlocked.Increment(ref inFlight);
+                var observed = maxInFlight;
+                while (current > observed
+                    && Interlocked.CompareExchange(ref maxInFlight, current, observed) != observed)
+                    observed = maxInFlight;
+            }, () => Interlocked.Decrement(ref inFlight)),
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0", AbCipPlcFamily.ControlLogix)],
+            Tags =
+            [
+                new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.DInt),
+                new AbCipTagDefinition("C", "ab://10.0.0.5/1,0", "C", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var writeTask = drv.WriteAsync(
+        [
+            new WriteRequest("A", 1),
+            new WriteRequest("B", 2),
+            new WriteRequest("C", 3),
+        ], CancellationToken.None);
+
+        // Wait until all three writes have entered WriteAsync simultaneously, then release.
+        await WaitForAsync(() => Volatile.Read(ref inFlight) >= 3, TimeSpan.FromSeconds(2));
+        gate.SetResult(0);
+
+        var results = await writeTask;
+        results.Count.ShouldBe(3);
+        results[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[2].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        maxInFlight.ShouldBeGreaterThanOrEqualTo(2,
+            "ControlLogix supports request packing — packable writes should run concurrently within the device.");
+    }
+
+    [Fact]
+    public async Task Micro800_falls_back_to_sequential_writes()
+    {
+        // Micro800 has SupportsRequestPacking=false → writes go one-at-a-time; the gated fake
+        // never sees more than one in-flight at a time.
+        var gate = new TaskCompletionSource<int>(TaskCreationOptions.RunContinuationsAsynchronously);
+        gate.SetResult(0); // No need to gate — we just observe concurrency.
+        var inFlight = 0;
+        var maxInFlight = 0;
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => new GatedWriteFake(p, gate, () =>
+            {
+                var current = Interlocked.Increment(ref inFlight);
+                var observed = maxInFlight;
+                while (current > observed
+                    && Interlocked.CompareExchange(ref maxInFlight, current, observed) != observed)
+                    observed = maxInFlight;
+            }, () => Interlocked.Decrement(ref inFlight)),
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/", AbCipPlcFamily.Micro800)],
+            Tags =
+            [
+                new AbCipTagDefinition("A", "ab://10.0.0.5/", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("B", "ab://10.0.0.5/", "B", AbCipDataType.DInt),
+                new AbCipTagDefinition("C", "ab://10.0.0.5/", "C", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("A", 1),
+            new WriteRequest("B", 2),
+            new WriteRequest("C", 3),
+        ], CancellationToken.None);
+
+        results.Count.ShouldBe(3);
+        results.ShouldAllBe(r => r.StatusCode == AbCipStatusMapper.Good);
+        maxInFlight.ShouldBe(1,
+            "Micro800 disables request packing — writes must execute sequentially.");
+    }
+
+    [Fact]
+    public async Task Bit_in_dint_writes_still_route_through_RMW_path()
+    {
+        // BOOL-with-bitIndex must hit the per-parent RMW semaphore — it must NOT go through
+        // the packable per-tag runtime path. We prove this by checking that:
+        //   (a) the per-tag "bit-selector" runtime is never created (it would throw via
+        //       LibplctagTagRuntime's NotSupportedException had the bypass happened);
+        //   (b) the parent-DINT runtime got both a Read and a Write.
+        var factory = new FakeAbCipTagFactory();
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions("ab://10.0.0.5/1,0")],
+            Tags =
+            [
+                new AbCipTagDefinition("Flag3", "ab://10.0.0.5/1,0", "Flags.3", AbCipDataType.Bool),
+                new AbCipTagDefinition("Speed", "ab://10.0.0.5/1,0", "Speed", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("Flag3", true),
+            new WriteRequest("Speed", 99),
+        ], CancellationToken.None);
+
+        results.Count.ShouldBe(2);
+        results[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+
+        // Parent runtime created lazily for Flags (no .3 suffix) — drove the RMW.
+        factory.Tags.ShouldContainKey("Flags");
+        factory.Tags["Flags"].ReadCount.ShouldBe(1);
+        factory.Tags["Flags"].WriteCount.ShouldBe(1);
+        // Speed went through the packable path.
+        factory.Tags["Speed"].WriteCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Per_tag_status_code_fan_out_works_on_partial_failure()
+    {
+        // Mix Good + BadTimeout + BadNotWritable + BadNodeIdUnknown across two devices to
+        // exercise the original-index preservation through the per-device plan + concurrent
+        // dispatch.
+        var factory = new FakeAbCipTagFactory
+        {
+            Customise = p => p.TagName == "B"
+                ? new FakeAbCipTag(p) { Status = -5 /* timeout */ }
+                : new FakeAbCipTag(p),
+        };
+        var drv = new AbCipDriver(new AbCipDriverOptions
+        {
+            Devices =
+            [
+                new AbCipDeviceOptions("ab://10.0.0.5/1,0"),
+                new AbCipDeviceOptions("ab://10.0.0.6/1,0"),
+            ],
+            Tags =
+            [
+                new AbCipTagDefinition("A", "ab://10.0.0.5/1,0", "A", AbCipDataType.DInt),
+                new AbCipTagDefinition("B", "ab://10.0.0.5/1,0", "B", AbCipDataType.DInt),
+                new AbCipTagDefinition("RO", "ab://10.0.0.5/1,0", "RO", AbCipDataType.DInt, Writable: false),
+                new AbCipTagDefinition("C", "ab://10.0.0.6/1,0", "C", AbCipDataType.DInt),
+            ],
+        }, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+        [
+            new WriteRequest("A", 1),
+            new WriteRequest("B", 2),
+            new WriteRequest("RO", 3),
+            new WriteRequest("UnknownTag", 4),
+            new WriteRequest("C", 5),
+        ], CancellationToken.None);
+
+        results.Count.ShouldBe(5);
+        results[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        results[1].StatusCode.ShouldBe(AbCipStatusMapper.BadTimeout);
+        results[2].StatusCode.ShouldBe(AbCipStatusMapper.BadNotWritable);
+        results[3].StatusCode.ShouldBe(AbCipStatusMapper.BadNodeIdUnknown);
+        results[4].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+    }
+
+    private static async Task WaitForAsync(Func<bool> predicate, TimeSpan timeout)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (!predicate())
+        {
+            if (DateTime.UtcNow >= deadline)
+                throw new TimeoutException("predicate did not become true within timeout");
+            await Task.Delay(10).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>
+    ///     Test fake whose <see cref="WriteAsync"/> blocks on a shared
+    ///     <see cref="TaskCompletionSource"/> so the test can observe how many writes are
+    ///     simultaneously in flight inside the driver.
+    /// </summary>
+    private sealed class GatedWriteFake : FakeAbCipTag
+    {
+        private readonly TaskCompletionSource<int> _gate;
+        private readonly Action _onEnter;
+        private readonly Action _onExit;
+
+        public GatedWriteFake(AbCipTagCreateParams p, TaskCompletionSource<int> gate,
+            Action onEnter, Action onExit) : base(p)
+        {
+            _gate = gate;
+            _onEnter = onEnter;
+            _onExit = onExit;
+        }
+
+        public override async Task WriteAsync(CancellationToken ct)
+        {
+            _onEnter();
+            try
+            {
+                await _gate.Task.ConfigureAwait(false);
+                await base.WriteAsync(ct).ConfigureAwait(false);
+            }
+            finally
+            {
+                _onExit();
+            }
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipTagPathTests.cs

@@ -123,6 +123,61 @@ public sealed class AbCipTagPathTests
         AbCipTagPath.TryParse("_private_tag")!.Segments.Single().Name.ShouldBe("_private_tag");
     }
 
+    [Fact]
+    public void Slice_basic_inclusive_range()
+    {
+        var p = AbCipTagPath.TryParse("Data[0..15]");
+        p.ShouldNotBeNull();
+        p.Slice.ShouldNotBeNull();
+        p.Slice!.Start.ShouldBe(0);
+        p.Slice.End.ShouldBe(15);
+        p.Slice.Count.ShouldBe(16);
+        p.BitIndex.ShouldBeNull();
+        p.Segments.Single().Name.ShouldBe("Data");
+        p.Segments.Single().Subscripts.ShouldBeEmpty();
+        p.ToLibplctagName().ShouldBe("Data[0..15]");
+        // Slice array name omits the `..End` so libplctag sees an anchored read at the start
+        // index; pair with ElementCount to cover the whole range.
+        p.ToLibplctagSliceArrayName().ShouldBe("Data[0]");
+    }
+
+    [Fact]
+    public void Slice_with_program_scope_and_member_chain()
+    {
+        var p = AbCipTagPath.TryParse("Program:MainProgram.Motors.Data[3..7]");
+        p.ShouldNotBeNull();
+        p.ProgramScope.ShouldBe("MainProgram");
+        p.Segments.Select(s => s.Name).ShouldBe(["Motors", "Data"]);
+        p.Slice!.Start.ShouldBe(3);
+        p.Slice.End.ShouldBe(7);
+        p.ToLibplctagName().ShouldBe("Program:MainProgram.Motors.Data[3..7]");
+        p.ToLibplctagSliceArrayName().ShouldBe("Program:MainProgram.Motors.Data[3]");
+    }
+
+    [Fact]
+    public void Slice_zero_length_single_element_allowed()
+    {
+        // [5..5] is a one-element slice — degenerate but legal (a single read of one element).
+        var p = AbCipTagPath.TryParse("Data[5..5]");
+        p.ShouldNotBeNull();
+        p.Slice!.Count.ShouldBe(1);
+    }
+
+    [Theory]
+    [InlineData("Data[5..3]")]              // M < N
+    [InlineData("Data[-1..5]")]             // negative start
+    [InlineData("Data[0..15].Member")]      // slice + sub-element
+    [InlineData("Data[0..15].3")]           // slice + bit index
+    [InlineData("Data[0..15,1]")]           // slice cannot be multi-dim
+    [InlineData("Data[0..15,2..3]")]        // multi-dim slice not supported
+    [InlineData("Data[..5]")]               // missing start
+    [InlineData("Data[5..]")]               // missing end
+    [InlineData("Data[a..5]")]              // non-numeric start
+    public void Invalid_slice_shapes_return_null(string input)
+    {
+        AbCipTagPath.TryParse(input).ShouldBeNull();
+    }
+
     [Fact]
     public void ToLibplctagName_recomposes_round_trip()
     {

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/AbLegacyAddressTests.cs

@@ -1,6 +1,7 @@
 using Shouldly;
 using Xunit;
 using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
 
 namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests;
 
@@ -65,4 +66,271 @@ public sealed class AbLegacyAddressTests
         a.ShouldNotBeNull();
         a.ToLibplctagName().ShouldBe(input);
     }
+
+    // ---- PLC-5 octal I:/O: addressing (Issue #244) ----
+    //
+    // RSLogix 5 displays I:/O: word + bit indices as octal. `I:001/17` means rack 1, bit 15
+    // (octal 17). Other PCCC families (SLC500, MicroLogix, LogixPccc) keep decimal indices.
+    // Non-I/O file letters are always decimal regardless of family.
+
+    [Theory]
+    [InlineData("I:001/17", 1, 15)]   // octal 17 → bit 15
+    [InlineData("I:0/0", 0, 0)]       // boundary: octal 0
+    [InlineData("O:1/2", 1, 2)]       // octal 1, 2 happen to match decimal
+    [InlineData("I:010/10", 8, 8)]    // octal 10 → 8 (both word + bit)
+    [InlineData("I:007/7", 7, 7)]     // boundary: largest single octal digit
+    public void TryParse_Plc5_parses_io_indices_as_octal(string input, int expectedWord, int expectedBit)
+    {
+        var a = AbLegacyAddress.TryParse(input, AbLegacyPlcFamily.Plc5);
+        a.ShouldNotBeNull();
+        a.WordNumber.ShouldBe(expectedWord);
+        a.BitIndex.ShouldBe(expectedBit);
+    }
+
+    [Theory]
+    [InlineData("I:8/0")]    // word digit 8 illegal in octal
+    [InlineData("I:0/9")]    // bit digit 9 illegal in octal
+    [InlineData("O:128/0")]  // contains digit 8
+    [InlineData("I:0/18")]   // bit field octal-illegal because of '8'
+    public void TryParse_Plc5_rejects_octal_invalid_io_digits(string input)
+    {
+        AbLegacyAddress.TryParse(input, AbLegacyPlcFamily.Plc5).ShouldBeNull();
+    }
+
+    [Theory]
+    // Non-I/O files stay decimal even on PLC-5 (e.g. N7:8 is integer 7, word 8).
+    [InlineData("N7:8", 7, 8)]
+    [InlineData("F8:9", 8, 9)]
+    public void TryParse_Plc5_keeps_non_io_indices_decimal(string input, int? expectedFile, int expectedWord)
+    {
+        var a = AbLegacyAddress.TryParse(input, AbLegacyPlcFamily.Plc5);
+        a.ShouldNotBeNull();
+        a.FileNumber.ShouldBe(expectedFile);
+        a.WordNumber.ShouldBe(expectedWord);
+    }
+
+    [Fact]
+    public void TryParse_Slc500_keeps_io_indices_decimal_back_compat()
+    {
+        // SLC500 has OctalIoAddressing=false — the digits are decimal as before.
+        var a = AbLegacyAddress.TryParse("I:10/15", AbLegacyPlcFamily.Slc500);
+        a.ShouldNotBeNull();
+        a.WordNumber.ShouldBe(10);
+        a.BitIndex.ShouldBe(15);
+
+        // Decimal '8' that PLC-5 would reject is fine on SLC500.
+        var b = AbLegacyAddress.TryParse("I:8/0", AbLegacyPlcFamily.Slc500);
+        b.ShouldNotBeNull();
+        b.WordNumber.ShouldBe(8);
+    }
+
+    [Fact]
+    public void TryParse_MicroLogix_and_LogixPccc_keep_io_indices_decimal()
+    {
+        AbLegacyAddress.TryParse("I:9/0", AbLegacyPlcFamily.MicroLogix).ShouldNotBeNull();
+        AbLegacyAddress.TryParse("I:9/0", AbLegacyPlcFamily.LogixPccc).ShouldNotBeNull();
+    }
+
+    [Fact]
+    public void Plc5Profile_advertises_octal_io_addressing()
+    {
+        AbLegacyPlcFamilyProfile.Plc5.OctalIoAddressing.ShouldBeTrue();
+        AbLegacyPlcFamilyProfile.Slc500.OctalIoAddressing.ShouldBeFalse();
+        AbLegacyPlcFamilyProfile.MicroLogix.OctalIoAddressing.ShouldBeFalse();
+        AbLegacyPlcFamilyProfile.LogixPccc.OctalIoAddressing.ShouldBeFalse();
+    }
+
+    // ---- MicroLogix function-file letters (Issue #245) ----
+    //
+    // MicroLogix 1100/1400 expose RTC/HSC/DLS/MMI/PTO/PWM/STI/EII/IOS/BHI function files. Other
+    // PCCC families (SLC500 / PLC-5 / LogixPccc) reject those file letters.
+
+    [Theory]
+    [InlineData("RTC:0.HR", "RTC", "HR")]
+    [InlineData("RTC:0.MIN", "RTC", "MIN")]
+    [InlineData("RTC:0.YR", "RTC", "YR")]
+    [InlineData("HSC:0.ACC", "HSC", "ACC")]
+    [InlineData("HSC:0.PRE", "HSC", "PRE")]
+    [InlineData("HSC:0.EN", "HSC", "EN")]
+    [InlineData("DLS:0.STR", "DLS", "STR")]
+    [InlineData("PTO:0.OF", "PTO", "OF")]
+    [InlineData("PWM:0.EN", "PWM", "EN")]
+    [InlineData("STI:0.SPM", "STI", "SPM")]
+    [InlineData("EII:0.PFN", "EII", "PFN")]
+    [InlineData("MMI:0.FT", "MMI", "FT")]
+    [InlineData("BHI:0.OS", "BHI", "OS")]
+    [InlineData("IOS:0.ID", "IOS", "ID")]
+    public void TryParse_MicroLogix_accepts_function_files(string input, string expectedLetter, string expectedSub)
+    {
+        var a = AbLegacyAddress.TryParse(input, AbLegacyPlcFamily.MicroLogix);
+        a.ShouldNotBeNull();
+        a.FileLetter.ShouldBe(expectedLetter);
+        a.SubElement.ShouldBe(expectedSub);
+    }
+
+    [Theory]
+    [InlineData("RTC:0.HR")]
+    [InlineData("HSC:0.ACC")]
+    [InlineData("PTO:0.OF")]
+    [InlineData("BHI:0.OS")]
+    public void TryParse_Slc500_rejects_function_files(string input)
+    {
+        AbLegacyAddress.TryParse(input, AbLegacyPlcFamily.Slc500).ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData("RTC:0.HR")]
+    [InlineData("HSC:0.ACC")]
+    public void TryParse_Plc5_and_LogixPccc_reject_function_files(string input)
+    {
+        AbLegacyAddress.TryParse(input, AbLegacyPlcFamily.Plc5).ShouldBeNull();
+        AbLegacyAddress.TryParse(input, AbLegacyPlcFamily.LogixPccc).ShouldBeNull();
+    }
+
+    [Fact]
+    public void TryParse_Default_overload_rejects_function_files()
+    {
+        // Without a family the parser cannot allow MicroLogix-only letters — back-compat with
+        // the family-less overload from before #244.
+        AbLegacyAddress.TryParse("RTC:0.HR").ShouldBeNull();
+        AbLegacyAddress.TryParse("HSC:0.ACC").ShouldBeNull();
+    }
+
+    [Fact]
+    public void MicroLogixProfile_advertises_function_file_support()
+    {
+        AbLegacyPlcFamilyProfile.MicroLogix.SupportsFunctionFiles.ShouldBeTrue();
+        AbLegacyPlcFamilyProfile.Slc500.SupportsFunctionFiles.ShouldBeFalse();
+        AbLegacyPlcFamilyProfile.Plc5.SupportsFunctionFiles.ShouldBeFalse();
+        AbLegacyPlcFamilyProfile.LogixPccc.SupportsFunctionFiles.ShouldBeFalse();
+    }
+
+    // ---- Indirect / indexed addressing (Issue #247) ----
+    //
+    // PLC-5 / SLC permit `N7:[N7:0]` (word number sourced from another address) and
+    // `N[N7:0]:5` (file number sourced from another address). Recursion is capped at 1 — the
+    // inner address must itself be a plain direct PCCC reference.
+
+    [Fact]
+    public void TryParse_accepts_indirect_word_source()
+    {
+        var a = AbLegacyAddress.TryParse("N7:[N7:0]");
+        a.ShouldNotBeNull();
+        a.FileLetter.ShouldBe("N");
+        a.FileNumber.ShouldBe(7);
+        a.IndirectFileSource.ShouldBeNull();
+        a.IndirectWordSource.ShouldNotBeNull();
+        a.IndirectWordSource!.FileLetter.ShouldBe("N");
+        a.IndirectWordSource.FileNumber.ShouldBe(7);
+        a.IndirectWordSource.WordNumber.ShouldBe(0);
+        a.IsIndirect.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void TryParse_accepts_indirect_file_source()
+    {
+        var a = AbLegacyAddress.TryParse("N[N7:0]:5");
+        a.ShouldNotBeNull();
+        a.FileLetter.ShouldBe("N");
+        a.FileNumber.ShouldBeNull();
+        a.WordNumber.ShouldBe(5);
+        a.IndirectFileSource.ShouldNotBeNull();
+        a.IndirectFileSource!.FileLetter.ShouldBe("N");
+        a.IndirectFileSource.FileNumber.ShouldBe(7);
+        a.IndirectFileSource.WordNumber.ShouldBe(0);
+        a.IndirectWordSource.ShouldBeNull();
+        a.IsIndirect.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void TryParse_accepts_both_indirect_file_and_word()
+    {
+        var a = AbLegacyAddress.TryParse("N[N7:0]:[N7:1]");
+        a.ShouldNotBeNull();
+        a.IndirectFileSource.ShouldNotBeNull();
+        a.IndirectWordSource.ShouldNotBeNull();
+        a.IndirectWordSource!.WordNumber.ShouldBe(1);
+    }
+
+    [Theory]
+    [InlineData("N[N[N7:0]:0]:5")]   // depth-2 file source
+    [InlineData("N7:[N[N7:0]:0]")]   // depth-2 word source
+    [InlineData("N7:[N7:[N7:0]]")]   // depth-2 word source (nested word)
+    public void TryParse_rejects_depth_greater_than_one(string input)
+    {
+        AbLegacyAddress.TryParse(input).ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData("N7:[")]              // unbalanced bracket
+    [InlineData("N7:]")]              // unbalanced bracket
+    [InlineData("N[:5")]              // empty inner file source
+    [InlineData("N7:[]")]             // empty inner word source
+    [InlineData("N[X9:0]:5")]         // unknown file letter inside
+    public void TryParse_rejects_malformed_indirect(string input)
+    {
+        AbLegacyAddress.TryParse(input).ShouldBeNull();
+    }
+
+    [Fact]
+    public void ToLibplctagName_reemits_indirect_word_source()
+    {
+        var a = AbLegacyAddress.TryParse("N7:[N7:0]");
+        a.ShouldNotBeNull();
+        a.ToLibplctagName().ShouldBe("N7:[N7:0]");
+    }
+
+    [Fact]
+    public void ToLibplctagName_reemits_indirect_file_source()
+    {
+        var a = AbLegacyAddress.TryParse("N[N7:0]:5");
+        a.ShouldNotBeNull();
+        a.ToLibplctagName().ShouldBe("N[N7:0]:5");
+    }
+
+    [Fact]
+    public void TryParse_indirect_with_bit_outside_brackets()
+    {
+        // Outer bit applies to the resolved word; inner address is still depth-1.
+        var a = AbLegacyAddress.TryParse("N7:[N7:0]/3");
+        a.ShouldNotBeNull();
+        a.BitIndex.ShouldBe(3);
+        a.IndirectWordSource.ShouldNotBeNull();
+        a.ToLibplctagName().ShouldBe("N7:[N7:0]/3");
+    }
+
+    [Fact]
+    public void TryParse_Plc5_indirect_inner_address_obeys_octal()
+    {
+        // Inner I:/O: indices on PLC-5 must obey octal rules even when nested in brackets.
+        var a = AbLegacyAddress.TryParse("N7:[I:010/10]", AbLegacyPlcFamily.Plc5);
+        a.ShouldNotBeNull();
+        a.IndirectWordSource.ShouldNotBeNull();
+        a.IndirectWordSource!.WordNumber.ShouldBe(8);   // octal 010 → 8
+        a.IndirectWordSource.BitIndex.ShouldBe(8);      // octal 10 → 8
+
+        // Octal-illegal digit '8' inside an inner I: address is rejected on PLC-5.
+        AbLegacyAddress.TryParse("N7:[I:8/0]", AbLegacyPlcFamily.Plc5).ShouldBeNull();
+    }
+
+    [Fact]
+    public void TryParse_indirect_inner_cannot_itself_be_indirect()
+    {
+        AbLegacyAddress.TryParse("N7:[N7:[N7:0]]").ShouldBeNull();
+        AbLegacyAddress.TryParse("N[N[N7:0]:5]:5").ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData("RTC", "HR", ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.Int32)]
+    [InlineData("RTC", "EN", ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.Boolean)]
+    [InlineData("HSC", "ACC", ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.Int32)]
+    [InlineData("HSC", "EN", ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.Boolean)]
+    [InlineData("DLS", "STR", ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.Int32)]
+    [InlineData("DLS", "EN", ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.Boolean)]
+    [InlineData("PWM", "OUT", ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.Boolean)]
+    public void FunctionFile_subelement_catalogue_maps_to_expected_driver_type(
+        string letter, string sub, ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType expected)
+    {
+        AbLegacyFunctionFile.SubElementType(letter, sub).ShouldBe(expected);
+    }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/AbLegacyDriverTests.cs

@@ -102,4 +102,96 @@ public sealed class AbLegacyDriverTests
         AbLegacyDataType.String.ToDriverDataType().ShouldBe(DriverDataType.String);
         AbLegacyDataType.TimerElement.ToDriverDataType().ShouldBe(DriverDataType.Int32);
     }
+
+    [Theory]
+    [InlineData(AbLegacyDataType.TimerElement, "EN", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.TimerElement, "TT", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.TimerElement, "DN", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.TimerElement, "PRE", DriverDataType.Int32)]
+    [InlineData(AbLegacyDataType.TimerElement, "ACC", DriverDataType.Int32)]
+    [InlineData(AbLegacyDataType.CounterElement, "CU", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.CounterElement, "CD", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.CounterElement, "DN", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.CounterElement, "OV", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.CounterElement, "UN", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.CounterElement, "PRE", DriverDataType.Int32)]
+    [InlineData(AbLegacyDataType.CounterElement, "ACC", DriverDataType.Int32)]
+    [InlineData(AbLegacyDataType.ControlElement, "EN", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "EU", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "DN", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "EM", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "ER", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "UL", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "IN", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "FD", DriverDataType.Boolean)]
+    [InlineData(AbLegacyDataType.ControlElement, "LEN", DriverDataType.Int32)]
+    [InlineData(AbLegacyDataType.ControlElement, "POS", DriverDataType.Int32)]
+    public void EffectiveDriverDataType_resolves_subelements(
+        AbLegacyDataType dataType, string subElement, DriverDataType expected)
+    {
+        AbLegacyDataTypeExtensions.EffectiveDriverDataType(dataType, subElement).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void EffectiveDriverDataType_unknown_subelement_falls_back_to_base()
+    {
+        // Permissive — keeps the driver from refusing tags whose sub-element we don't catalogue.
+        AbLegacyDataTypeExtensions.EffectiveDriverDataType(AbLegacyDataType.TimerElement, "BOGUS")
+            .ShouldBe(DriverDataType.Int32);
+        AbLegacyDataTypeExtensions.EffectiveDriverDataType(AbLegacyDataType.TimerElement, null)
+            .ShouldBe(DriverDataType.Int32);
+        AbLegacyDataTypeExtensions.EffectiveDriverDataType(AbLegacyDataType.Int, "DN")
+            .ShouldBe(DriverDataType.Int32);
+    }
+
+    [Theory]
+    [InlineData(AbLegacyDataType.TimerElement, "DN", 13)]
+    [InlineData(AbLegacyDataType.TimerElement, "TT", 14)]
+    [InlineData(AbLegacyDataType.TimerElement, "EN", 15)]
+    [InlineData(AbLegacyDataType.CounterElement, "UN", 10)]
+    [InlineData(AbLegacyDataType.CounterElement, "OV", 11)]
+    [InlineData(AbLegacyDataType.CounterElement, "DN", 12)]
+    [InlineData(AbLegacyDataType.CounterElement, "CD", 13)]
+    [InlineData(AbLegacyDataType.CounterElement, "CU", 14)]
+    [InlineData(AbLegacyDataType.ControlElement, "FD", 8)]
+    [InlineData(AbLegacyDataType.ControlElement, "IN", 9)]
+    [InlineData(AbLegacyDataType.ControlElement, "UL", 10)]
+    [InlineData(AbLegacyDataType.ControlElement, "ER", 11)]
+    [InlineData(AbLegacyDataType.ControlElement, "EM", 12)]
+    [InlineData(AbLegacyDataType.ControlElement, "DN", 13)]
+    [InlineData(AbLegacyDataType.ControlElement, "EU", 14)]
+    [InlineData(AbLegacyDataType.ControlElement, "EN", 15)]
+    public void StatusBitIndex_maps_to_standard_pccc_positions(
+        AbLegacyDataType dataType, string subElement, int expectedBit)
+    {
+        AbLegacyDataTypeExtensions.StatusBitIndex(dataType, subElement).ShouldBe(expectedBit);
+    }
+
+    [Fact]
+    public void StatusBitIndex_for_word_subelements_is_null()
+    {
+        AbLegacyDataTypeExtensions.StatusBitIndex(AbLegacyDataType.TimerElement, "PRE").ShouldBeNull();
+        AbLegacyDataTypeExtensions.StatusBitIndex(AbLegacyDataType.CounterElement, "ACC").ShouldBeNull();
+        AbLegacyDataTypeExtensions.StatusBitIndex(AbLegacyDataType.ControlElement, "LEN").ShouldBeNull();
+        AbLegacyDataTypeExtensions.StatusBitIndex(AbLegacyDataType.TimerElement, null).ShouldBeNull();
+        AbLegacyDataTypeExtensions.StatusBitIndex(AbLegacyDataType.Int, "DN").ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData(AbLegacyDataType.TimerElement, "DN", true)]
+    [InlineData(AbLegacyDataType.TimerElement, "TT", true)]
+    [InlineData(AbLegacyDataType.TimerElement, "EN", false)] // operator-controllable
+    [InlineData(AbLegacyDataType.CounterElement, "DN", true)]
+    [InlineData(AbLegacyDataType.CounterElement, "OV", true)]
+    [InlineData(AbLegacyDataType.CounterElement, "UN", true)]
+    [InlineData(AbLegacyDataType.CounterElement, "CU", false)]
+    [InlineData(AbLegacyDataType.ControlElement, "DN", true)]
+    [InlineData(AbLegacyDataType.ControlElement, "ER", true)]
+    [InlineData(AbLegacyDataType.ControlElement, "EM", true)]
+    [InlineData(AbLegacyDataType.ControlElement, "EN", false)]
+    public void IsPlcSetStatusBit_classifies_writable_vs_status_bits(
+        AbLegacyDataType dataType, string subElement, bool expected)
+    {
+        AbLegacyDataTypeExtensions.IsPlcSetStatusBit(dataType, subElement).ShouldBe(expected);
+    }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/AbLegacyReadWriteTests.cs

@@ -256,4 +256,113 @@ public sealed class AbLegacyReadWriteTests
             Value = value;
         }
     }
+
+    // ---- Timer / Counter / Control sub-element bit semantics (issue #246) ----
+
+    [Theory]
+    [InlineData("T4:0.DN", 13)]
+    [InlineData("T4:0.TT", 14)]
+    [InlineData("T4:0.EN", 15)]
+    public async Task Timer_status_bit_decodes_correct_position(string address, int bitPos)
+    {
+        var (drv, factory) = NewDriver(
+            new AbLegacyTagDefinition("X", "ab://10.0.0.5/1,0", address, AbLegacyDataType.TimerElement));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        // Seed a parent-word with only the target bit set.
+        factory.Customise = p => new FakeAbLegacyTag(p) { Value = 1 << bitPos };
+
+        var snapshots = await drv.ReadAsync(["X"], CancellationToken.None);
+
+        snapshots.Single().Value.ShouldBe(true);
+        // The driver must have asked the runtime for the right bit position.
+        factory.Tags[address].LastDecodeBitIndex.ShouldBe(bitPos);
+    }
+
+    [Fact]
+    public async Task Timer_PRE_subelement_decodes_as_int_word()
+    {
+        var (drv, factory) = NewDriver(
+            new AbLegacyTagDefinition("Pre", "ab://10.0.0.5/1,0", "T4:0.PRE", AbLegacyDataType.TimerElement));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbLegacyTag(p) { Value = 5000 };
+
+        var snapshots = await drv.ReadAsync(["Pre"], CancellationToken.None);
+
+        snapshots.Single().Value.ShouldBe(5000);
+        factory.Tags["T4:0.PRE"].LastDecodeBitIndex.ShouldBeNull();
+    }
+
+    [Theory]
+    [InlineData("C5:0.UN", 10)]
+    [InlineData("C5:0.OV", 11)]
+    [InlineData("C5:0.DN", 12)]
+    [InlineData("C5:0.CD", 13)]
+    [InlineData("C5:0.CU", 14)]
+    public async Task Counter_status_bit_decodes_correct_position(string address, int bitPos)
+    {
+        var (drv, factory) = NewDriver(
+            new AbLegacyTagDefinition("X", "ab://10.0.0.5/1,0", address, AbLegacyDataType.CounterElement));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbLegacyTag(p) { Value = 1 << bitPos };
+
+        var snapshots = await drv.ReadAsync(["X"], CancellationToken.None);
+        snapshots.Single().Value.ShouldBe(true);
+        factory.Tags[address].LastDecodeBitIndex.ShouldBe(bitPos);
+    }
+
+    [Theory]
+    [InlineData("R6:0.FD", 8)]
+    [InlineData("R6:0.IN", 9)]
+    [InlineData("R6:0.UL", 10)]
+    [InlineData("R6:0.ER", 11)]
+    [InlineData("R6:0.EM", 12)]
+    [InlineData("R6:0.DN", 13)]
+    [InlineData("R6:0.EU", 14)]
+    [InlineData("R6:0.EN", 15)]
+    public async Task Control_status_bit_decodes_correct_position(string address, int bitPos)
+    {
+        var (drv, factory) = NewDriver(
+            new AbLegacyTagDefinition("X", "ab://10.0.0.5/1,0", address, AbLegacyDataType.ControlElement));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        factory.Customise = p => new FakeAbLegacyTag(p) { Value = 1 << bitPos };
+
+        var snapshots = await drv.ReadAsync(["X"], CancellationToken.None);
+        snapshots.Single().Value.ShouldBe(true);
+        factory.Tags[address].LastDecodeBitIndex.ShouldBe(bitPos);
+    }
+
+    [Fact]
+    public async Task Status_bit_returns_false_when_parent_word_bit_is_clear()
+    {
+        var (drv, factory) = NewDriver(
+            new AbLegacyTagDefinition("Done", "ab://10.0.0.5/1,0", "T4:0.DN", AbLegacyDataType.TimerElement));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+        // Bit 14 (TT) set, bit 13 (DN) clear.
+        factory.Customise = p => new FakeAbLegacyTag(p) { Value = 1 << 14 };
+
+        var snapshots = await drv.ReadAsync(["Done"], CancellationToken.None);
+        snapshots.Single().Value.ShouldBe(false);
+    }
+
+    [Theory]
+    [InlineData("T4:0.DN", AbLegacyDataType.TimerElement)]
+    [InlineData("T4:0.TT", AbLegacyDataType.TimerElement)]
+    [InlineData("C5:0.DN", AbLegacyDataType.CounterElement)]
+    [InlineData("C5:0.OV", AbLegacyDataType.CounterElement)]
+    [InlineData("C5:0.UN", AbLegacyDataType.CounterElement)]
+    [InlineData("R6:0.ER", AbLegacyDataType.ControlElement)]
+    [InlineData("R6:0.EM", AbLegacyDataType.ControlElement)]
+    [InlineData("R6:0.DN", AbLegacyDataType.ControlElement)]
+    [InlineData("R6:0.FD", AbLegacyDataType.ControlElement)]
+    public async Task Writes_to_PLC_set_status_bits_return_BadNotWritable(
+        string address, AbLegacyDataType dataType)
+    {
+        var (drv, _) = NewDriver(
+            new AbLegacyTagDefinition("X", "ab://10.0.0.5/1,0", address, dataType));
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var results = await drv.WriteAsync(
+            [new WriteRequest("X", true)], CancellationToken.None);
+        results.Single().StatusCode.ShouldBe(AbLegacyStatusMapper.BadNotWritable);
+    }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/FakeAbLegacyTag.cs

@@ -40,7 +40,25 @@ internal class FakeAbLegacyTag : IAbLegacyTagRuntime
     }
 
     public virtual int GetStatus() => Status;
-    public virtual object? DecodeValue(AbLegacyDataType type, int? bitIndex) => Value;
+    public int? LastDecodeBitIndex { get; private set; }
+    public AbLegacyDataType? LastDecodeType { get; private set; }
+    public virtual object? DecodeValue(AbLegacyDataType type, int? bitIndex)
+    {
+        LastDecodeType = type;
+        LastDecodeBitIndex = bitIndex;
+        // If the test seeded a parent-word value (ushort/short/int) and the driver asked for a
+        // specific status bit, mask it out so we can assert the correct bit reaches the client.
+        if (bitIndex is int bit && Value is not null and not bool)
+        {
+            try
+            {
+                var word = Convert.ToInt32(Value);
+                return ((word >> bit) & 1) != 0;
+            }
+            catch (Exception ex) when (ex is FormatException or InvalidCastException) { }
+        }
+        return Value;
+    }
     public virtual void EncodeValue(AbLegacyDataType type, int? bitIndex, object? value) => Value = value;
     public virtual void Dispose() => Disposed = true;
 }