Skip to main content

Connect to Rockwell PLCs by Tag Name

The ALLEN_BRADLEY connector connects Coreflux to Rockwell Automation PLCs using symbolic tag names over EtherNet/IP. Define an ALLEN_BRADLEY_CONFIG block, add TAGs with PLC tag addresses, and publish each data point to its own MQTT topic — with optional scaling, units, deadband, and bidirectional writes.
Like reading labels on a control panel. Instead of numeric register addresses, you use the same tag names you see in Studio 5000 — MainCounter, Program:MainProgram.Temperature, Motor1.Speed.
For explicit CIP paths (4.100.3.0), use the EtherNet/IP connector instead. This connector is for symbolic tag-name access; EtherNet/IP is for Class/Instance/Attribute addressing.

Connector and config aliases

Key capabilities

  • Symbolic tag names — controller-scoped, program-scoped, UDT members, and arrays
  • Multiple PLC families — ControlLogix, CompactLogix, Micro800, MicroLogix, PLC5, SLC500
  • TAG-based polling — per-point MQTT topics with configurable intervals
  • Bidirectional writes — WRITABLE tags with DESTINATION_TOPIC
  • Engineering units — SCALING, OFFSET, UNIT, DECIMAL_PLACES, min/max clamping
  • Publish modes — VALUE_ONLY (default) or JSON with quality metadata

Quick Start

Read a controller-scoped DINT counter every second:

Connection Configuration

ALLEN_BRADLEY_CONFIG Parameters

The config block may be declared as ADD ALLEN_BRADLEY_CONFIG or ADD AB_CONFIG — both are equivalent.
The connector reports Connected only after the PLC answers. With at least one tag, it opens one tag using the same settings a read uses. With no tags, it checks the EtherNet/IP session. If the controller later drops, the route moves to Reconnecting and recovers on its own.Each read or write opens the tag and then reads or writes it, and each step has its own TIMEOUT. The route waits 2 × TIMEOUT plus a margin, at least 1 s, before it gives up. That’s about 5 s at TIMEOUT 2000. So a dead PLC is detected later than TIMEOUT alone suggests, and the first read after a reconnect can take up to twice as long. A write that times out publishes "success": false with "outcome": "unknown", because the PLC may still apply it. See Write results. Publish -checkConnectorConnection <name> to $SYS/Coreflux/Command to run that same test.

Device Family Codes

Connection Examples

Standard backplane path to CPU in slot 0:

Tag Addressing

Allen-Bradley PLCs use tag-based addressing (not register numbers). Tag names are case-sensitive.

Tag naming rules

  • Letters, numbers, and underscore only
  • Must start with a letter or underscore
  • Case-sensitive
  • No spaces

Data Types

DATE, TOD, and WCHAR publish in these forms on every Allen-Bradley family. Measured on a Micro850: 1790553600 seconds publishes 2026-09-28, and 65535 ms publishes 00:01:05.535. Connected Components Workbench has no creatable CHAR, WCHAR, or TOD variable on Micro800, so those types apply to Logix families.
A tag’s DATA_TYPE must match the PLC tag’s actual type. On a mismatch the tag is refused: no value is published, the tag goes BAD, and the log names both types. Route health leaves Green and goes Yellow. The check is strict. A PLC INT declared as DINT is refused too. That case used to read correctly by luck.

STRING encoding

Writes include the CIP length prefix. The layout depends on DEVICE_FAMILY.
  • ControlLogix / CompactLogix (default): fixed 88-byte CIP STRING — a 4-byte DINT length prefix plus up to 82 ASCII characters. Neither LENGTH nor STRING_SIZE resizes this layout. STRING_SIZE is accepted as an alias for the same field and has the same limitation.
  • Micro800: a 1-byte length prefix plus the characters. A write can be longer than the value currently stored in the tag. The broker sizes the tag so the new string fits, up to the String Size configured for that tag in Connected Components Workbench (for example, 80 characters). A longer string is rejected with an error instead of being truncated.

TIME encoding

Raw value is a signed 32-bit millisecond count. MQTT publishes Allen-Bradley-style duration strings (for example T#1h1m1s1ms).

Write value formats

Publish a payload to DESTINATION_TOPIC on a tag with WRITABLE "true". Multi-byte values are written little-endian, the byte order CIP expects. An on-demand ADD EVENT write accepts T# durations and sends the STRING length prefix. For WORD, DWORD, LWORD, and DATE, put the decimal or seconds form in the event value field. The 16# / 0x and yyyy-MM-dd forms apply to writable-tag payloads.

TAG Configuration

Every polled data point is an ADD TAG inside an ADD MAPPING block.

Complete TAG Example

TAG Parameters

string
required
PLC tag name — controller-scoped (MainCounter), program-scoped (Program:MainProgram.Counter), UDT member (Valve1.Status), or array (Temps[0]).
string
SYMBOL (default) or PATH.
string
required
Logix data type: BOOL, SINT, INT, DINT, LINT, USINT, UINT, UDINT, ULINT, REAL, LREAL, STRING, TIME, etc. It must match the PLC tag’s actual type. A mismatch publishes no value, marks the tag BAD, and route health goes Yellow. See Data Types.
decimal
Multiply the parsed value after read. Alias: SCALING_FACTOR. Default: 1.0.
decimal
Add after scaling. Default: 0.0.
string
Engineering unit (for example °C, bar, RPM). Included in JSON publish mode.
integer
Rounding precision for float MQTT payloads. Default: 2.
double
Clamp minimum allowed value (especially for writable tags).
double
Clamp maximum allowed value.
double
Suppress MQTT publish when the change is below this threshold. Default: 0.0.
string
required
MQTT topic where polled values are published.
string
VALUE_ONLY (default) or JSON (value, unit, quality, timestamp, description).
boolean
When "true", subscribe to DESTINATION_TOPIC and write incoming MQTT values to the PLC.
string
MQTT topic to receive write commands. Required when WRITABLE is "true".
string
Human-readable description (included in JSON publish mode).

Publish Modes

VALUE_ONLY (default) — publishes just the scaled value:
JSON — metadata wrapper when explicitly set:

Event-Based Operations

For on-demand tag reads and writes (not continuous polling), add an ADD EVENT block. Publish any message to SOURCE_TOPIC to trigger the operation; results appear on DESTINATION_TOPIC.

Query Parameters

Read Example

Write Example


Examples

Monitor BOOL, DINT, and REAL tags in one mapping:

Best Practices

Use DEVICE_FAMILY 0 for ControlLogix and CompactLogix (most common), 4 for Micro800, and 5 for MicroLogix. Legacy PLC5/SLC500 families (1/2) only for existing installations.
Controller-scoped tags use the name alone (GlobalCounter). Program-scoped tags need the full prefix: Program:MainProgram.LocalCounter.
Set the CPU slot in PATH ("1,0" for backplane 1, slot 0). SLOT is kept for legacy parity, but routing is resolved from PATH. Micro800 (DEVICE_FAMILY 4) has no backplane: omit PATH. A PATH on a Micro800 route is ignored and logged as a warning.
Use WRITABLE "true" with MIN_VALUE / MAX_VALUE on setpoints. Publish values in the forms under Write value formats. Ensure the PLC is in Remote Run mode for writes to succeed.
Use DEADBAND on noisy analog values. Match EVERY to how fast the value changes — 500 ms for critical data, 1–5 s for slow status.

Troubleshooting

  • Verify IP with ping
  • Confirm the EtherNet/IP port is open (default 44818, or the PORT you set)
  • Ensure PLC is powered on and in RUN mode
  • Check DEVICE_FAMILY matches your controller type
  • Increase TIMEOUT on slow networks
  • Publish -checkConnectorConnection <name> to test the connection: with tags, the broker opens one tag the way a read does; with no tags, it checks the EtherNet/IP session
  • Tag names are case-sensitive — match Studio 5000 exactly
  • Program-scoped tags need Program:ProgramName.TagName (not ProgramName:Tag)
  • Verify the tag exists in Controller Tags or Program Tags in Studio 5000
  • For UDTs, include the member: Valve1.Status not Valve1
  • For arrays, include the index: Temps[0] not Temps
  • Use PATH "1,0" for standard backplane routing (backplane, slot)
  • For Micro800, omit PATH. If you set one, the broker ignores it and logs a warning
  • Multi-hop paths use comma-separated segments: "1,2,2,1" through bridge modules
  • Set DEVICE_FAMILY 4
  • Omit PATH. Micro800 has no backplane; a PATH on this family is ignored and logged as a warning
  • Use Micro800 I/O tag names (_IO_EM_DI_00, _IO_EM_AI_00)
  • STRING uses a 1-byte length prefix (not the ControlLogix 4-byte format). A write can grow up to the tag’s String Size in Connected Components Workbench; a longer string is rejected
  • Set WRITABLE "true" and provide DESTINATION_TOPIC
  • PLC must be in Remote Run mode
  • Verify DATA_TYPE matches the PLC tag definition
  • Check value is within MIN_VALUE / MAX_VALUE if set
  • For TOD, publish milliseconds since midnight. The read form hh:mm:ss.fff is not a write payload
  • DATA_TYPE must match the PLC tag’s actual type. On a mismatch the tag is refused: no value is published, the tag goes BAD, the log names both types, and route health leaves Green and goes Yellow
  • The check is strict. A PLC INT declared as DINT is refused too. That case used to read correctly by luck
  • Match PLC types exactly: DINT → DINT, REAL → REAL, BOOL → BOOL
  • TIME tags publish as T#... duration strings on MQTT
  • DATE publishes as yyyy-MM-dd. TOD publishes as hh:mm:ss.fff
  • For now, one failing tag can back off its whole mapping

Next Steps

EtherNet/IP Connector

Explicit CIP Class/Instance/Attribute addressing for assembly objects and legacy devices.

Industrial Connectors Overview

Compare OT connectors and choose the right protocol for your devices.
Last modified on October 25, 2026