Files

Joseph Doherty 1d3544f18e S7 integration fixture — python-snap7 server closes the wire-level coverage gap (#216 ) + per-driver fixture coverage docs for every driver in the fleet. Closes #216 . Two shipments in one PR because the docs landed as I surveyed each driver's fixture + the S7 work is the first wire-level-gap closer pulled from that survey.

S7 integration — AbCip/Modbus already have real-simulator integration suites; S7 had zero wire-level coverage despite being a Tier-A driver (all unit tests mocked IS7Client). Picked python-snap7's `snap7.server.Server` over raw Snap7 C library because `pip install` beats per-OS binary-pin maintenance, the package ships a Python __main__ shim that mirrors our existing pymodbus serve.ps1 + *.json pattern structurally, and the python-snap7 project is actively maintained. New project `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/` with four moving parts: (a) `Snap7ServerFixture` — collection-scoped TCP probe on `localhost:1102` that sets `SkipReason` when the simulator's not running, matching the `ModbusSimulatorFixture` shape one directory over (same S7_SIM_ENDPOINT env var override convention for pointing at a real S7 CPU on port 102); (b) `PythonSnap7/` — `serve.ps1` wrapper + `server.py` shim + `s7_1500.json` seed profile + `README.md` documenting install / run / known limitations; (c) `S7_1500/S7_1500Profile.cs` — driver-side `S7DriverOptions` whose tag addresses map 1:1 to the JSON profile's seed offsets (DB1.DBW0 u16, DB1.DBW10 i16, DB1.DBD20 i32, DB1.DBD30 f32, DB1.DBX50.3 bool, DB1.DBW100 scratch); (d) `S7_1500SmokeTests` — three tests proving typed reads + write-then-read round-trip work through real S7netplus + real ISO-on-TCP + real snap7 server. Picked port 1102 default instead of S7-standard 102 because 102 is privileged on Linux + triggers Windows Firewall prompt; S7netplus 0.20 has a 5-arg `Plc(CpuType, host, port, rack, slot)` ctor that lets the driver honour `S7DriverOptions.Port`, but the existing driver code called the 4-arg overload + silently hardcoded 102. One-line driver fix (S7Driver.cs:87) threads `_options.Port` through — the S7 unit suite (58/58) still passes unchanged because every unit test uses a fake IS7Client that never sees the real ctor. Server seed-type matrix in `server.py` covers u8 / i8 / u16 / i16 / u32 / i32 / f32 / bool-with-bit / ascii (S7 STRING with max_len header). register_area takes the SrvArea enum value, not the string name — a 15-minute debug after the first test run caught that; documented inline.

Per-driver test-fixture coverage docs — eight new files in `docs/drivers/` laying out what each driver's harness actually benchmarks vs. what's trusted from field deployments. Pattern mirrors the AbServer-Test-Fixture.md doc that shipped earlier in this arc: TL;DR → What the fixture is → What it actually covers → What it does NOT cover → When-to-trust table → Follow-up candidates → Key files. Ugly truth the survey made visible: Galaxy + Modbus + (now) S7 + AB CIP have real wire-level coverage; AB Legacy / TwinCAT / FOCAS / OpcUaClient are still contract-only because their libraries ship no fake + no open-source simulator exists (AB Legacy PCCC), no public simulator exists (FOCAS), the vendor SDK has no in-process fake (TwinCAT/ADS.NET), or the test wiring just hasn't happened yet (OpcUaClient could trivially loopback against this repo's own server — flagged as #215). Each doc names the specific follow-up route: Snap7 server for S7 (done), TwinCAT 3 developer-runtime auto-restart for TwinCAT, Tier-C out-of-process Host for FOCAS, lab rigs for AB Legacy + hardware-gated bits of the others. `docs/drivers/README.md` gains a coverage-map section linking all eight. Tracking tasks #215-#222 filed for each PR-able follow-up.

Build clean (driver + integration project + docs); S7.Tests 58/58 (unchanged); S7.IntegrationTests 3/3 (new, verified end-to-end against a live python-snap7 server: `driver_reads_seeded_u16_through_real_S7comm`, `driver_reads_seeded_typed_batch`, `driver_write_then_read_round_trip_on_scratch_word`). Next fixture follow-up is #215 (OpcUaClient loopback against own server) — highest ROI of the remaining set, zero external deps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-20 11:29:15 -04:00

6.5 KiB

Raw Blame History

ab_server test fixture

Coverage map + gap inventory for the AB CIP integration fixture backed by libplctag's ab_server simulator.

TL;DR: ab_server is a connectivity + atomic-read smoke harness for the AB CIP driver. It does not benchmark UDTs, alarms, or any family-specific quirk. UDT / alarm / quirk behavior is verified only by unit tests with FakeAbCipTagRuntime.

What the fixture is

Binary: ab_server / ab_server.exe from libplctag (libplctag/libplctag + kyle-github/ab_server, MIT). Resolved off PATH by AbServerFixture.LocateBinary; tests skip via [AbServerFact] / [AbServerTheory] when missing.
Lifecycle: AbServerFixture (tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerFixture.cs) starts the simulator with a profile-specific --plc arg + --tag seeds, waits ~500 ms, kills on DisposeAsync.
Profiles: KnownProfiles.{ControlLogix, CompactLogix, Micro800, GuardLogix} in AbServerProfile.cs. Each composes a CLI arg list + seed-tag set; their own Notes fields document the quirks called out below.
Tests: one smoke, AbCipReadSmokeTests.Driver_reads_seeded_DInt_from_ab_server, parametrized over all four profiles.

What it actually covers

Read path: driver → libplctag → CIP-over-EtherNet/IP → simulator → back.
Atomic Logix types per seed: DINT, REAL, BOOL, SINT, STRING.
One DINT[16] array tag (ControlLogix profile only).
--plc controllogix and --plc compactlogix mode dispatch.
The skip-on-missing-binary behavior (AbServerFactAttribute) so a fresh clone without the simulator stays green.

What it does NOT cover

Each gap below is either stated explicitly in the profile's Notes field or inferable from the seed-tag set + smoke-test surface.

1. UDTs / CIP Template Object (class 0x6C)

ControlLogix profile Notes: "ab_server lacks full UDT emulation."

Unverified against ab_server:

PR 6 structured read/write (AbCipStructureMember fan-out)
#179 Template Object shape reader (CipTemplateObjectDecoder + FetchUdtShapeAsync)
#194 whole-UDT read optimization (AbCipUdtReadPlanner + AbCipUdtMemberLayout + the ReadGroupAsync path in AbCipDriver)

Unit coverage: AbCipFetchUdtShapeTests, CipTemplateObjectDecoderTests, AbCipUdtMemberLayoutTests, AbCipUdtReadPlannerTests, AbCipDriverWholeUdtReadTests — all with golden Template-Object byte buffers

offset-keyed FakeAbCipTag values.

2. ALMD / ALMA alarm projection (#177)

Depends on the ALMD UDT shape, which ab_server cannot emulate. The OnAlarmEvent raise/clear path + ack-write semantics are not exercised end-to-end.

Unit coverage: AbCipAlarmProjectionTests — fakes feed InFaulted / Severity via ValuesByOffset + assert the emitted AlarmEventArgs.

3. Micro800 unconnected-only path

Micro800 profile Notes: "ab_server has no --plc micro800 — falls back to controllogix emulation."

The empty routing path + unconnected-session requirement (PR 11) is unit-tested but never challenged at the CIP wire level. Real Micro800 (2080-series) on a lab rig would be the authoritative benchmark.

4. GuardLogix safety subsystem

GuardLogix profile Notes: "ab_server doesn't emulate the safety subsystem."

Only the _S-suffix naming classifier (PR 12, SecurityClassification.ViewOnly forced on safety tags) runs. Actual safety-partition write rejection — what happens when a non-safety write lands on a real 1756-L8xS — is not exercised.

5. CompactLogix narrow ConnectionSize cap

CompactLogix profile Notes: "ab_server lacks the narrower limit itself."

Driver-side AbCipPlcFamilyProfile caps ConnectionSize at the CompactLogix value per PR 10, but ab_server accepts whatever the client asks for — the cap's correctness is trusted from its unit test, never stressed against a simulator that rejects oversized requests.

6. BOOL-within-DINT read-modify-write (#181)

The AbCipDriver.WriteBitInDIntAsync RMW path + its per-parent SemaphoreSlim serialization is unit-tested only (AbCipBoolInDIntRmwTests). ab_server seeds a plain TestBOOL tag; the .N bit-within-DINT syntax that triggers the RMW path is not exercised end-to-end.

7. Capability surfaces beyond read

No smoke test for:

IWritable.WriteAsync
ITagDiscovery.DiscoverAsync (@tags walker)
ISubscribable.SubscribeAsync (poll-group engine)
IHostConnectivityProbe state transitions under wire failure
IPerCallHostResolver multi-device routing

The driver implements all of these + they have unit coverage, but the only end-to-end path ab_server validates today is atomic ReadAsync.

When to trust ab_server, when to reach for a rig

Question	ab_server	Unit tests	Lab rig
"Does the driver talk CIP at all?"	yes	-	-
"Is my atomic read path wired correctly?"	yes	yes	yes
"Does whole-UDT grouping work?"	no	yes	yes (required)
"Do ALMD alarms raise + clear?"	no	yes	yes (required)
"Is Micro800 unconnected-only enforced wire-side?"	no (emulated as CLX)	partial	yes (required)
"Does GuardLogix reject non-safety writes on safety tags?"	no	no	yes (required)
"Does CompactLogix refuse oversized ConnectionSize?"	no	partial	yes (required)
"Does BOOL-in-DINT RMW race against concurrent writers?"	no	yes	yes (stress)

Follow-up candidates

If integration-level UDT / alarm / quirk proof becomes a shipping gate, the options are roughly:

Extend ab_server upstream — the project accepts PRs + already carries a CIP framing layer that UDT emulation could plug into.
Swap in a richer simulator — e.g. OpenPLC or pycomm3's test harness, if either exposes UDTs over EtherNet/IP in a way libplctag can consume.
Stand up a lab rig — physical 1756-L7x / 5069-L3x / 2080-LC30 / 1756-L8xS controllers running Rockwell Studio 5000 projects; wire into CI via a self-hosted runner. The only path that covers safety + narrow ConnectionSize + real ALMD execution.

6.5 KiB Raw Blame History