Connect to Rockwell PLCs by Tag Name
TheALLEN_BRADLEY connector connects Coreflux to Rockwell Automation PLCs using symbolic tag names over EtherNet/IP. Define an ALLEN_BRADLEY_CONFIG block, add TAGs with PLC tag addresses, and publish each data point to its own MQTT topic — with optional scaling, units, deadband, and bidirectional writes.
For explicit CIP paths (
4.100.3.0), use the EtherNet/IP connector instead. This connector is for symbolic tag-name access; EtherNet/IP is for Class/Instance/Attribute addressing.Connector and config aliases
Key capabilities
- Symbolic tag names — controller-scoped, program-scoped, UDT members, and arrays
- Multiple PLC families — ControlLogix, CompactLogix, Micro800, MicroLogix, PLC5, SLC500
- TAG-based polling — per-point MQTT topics with configurable intervals
- Bidirectional writes —
WRITABLEtags withDESTINATION_TOPIC - Engineering units —
SCALING,OFFSET,UNIT,DECIMAL_PLACES, min/max clamping - Publish modes —
VALUE_ONLY(default) orJSONwith quality metadata
Quick Start
- Poll a controller tag
- Read and write
- Micro800
Read a controller-scoped DINT counter every second:
Connection Configuration
ALLEN_BRADLEY_CONFIG Parameters
The config block may be declared as
ADD ALLEN_BRADLEY_CONFIG or ADD AB_CONFIG — both are equivalent.The connector reports Connected only after the PLC answers. With at least one tag, it opens one tag using the same settings a read uses. With no tags, it checks the EtherNet/IP session. If the controller later drops, the route moves to Reconnecting and recovers on its own.Each read or write opens the tag and then reads or writes it, and each step has its own
TIMEOUT. The route waits 2 × TIMEOUT plus a margin, at least 1 s, before it gives up. That’s about 5 s at TIMEOUT 2000. So a dead PLC is detected later than TIMEOUT alone suggests, and the first read after a reconnect can take up to twice as long. A write that times out publishes "success": false with "outcome": "unknown", because the PLC may still apply it. See Write results. Publish -checkConnectorConnection <name> to $SYS/Coreflux/Command to run that same test.Device Family Codes
Connection Examples
- ControlLogix / CompactLogix
- MicroLogix
- Through backplane
- Micro800
Standard backplane path to CPU in slot 0:
Tag Addressing
Allen-Bradley PLCs use tag-based addressing (not register numbers). Tag names are case-sensitive.Tag naming rules
- Letters, numbers, and underscore only
- Must start with a letter or underscore
- Case-sensitive
- No spaces
Data Types
DATE, TOD, and WCHAR publish in these forms on every Allen-Bradley family. Measured on a Micro850: 1790553600 seconds publishes 2026-09-28, and 65535 ms publishes 00:01:05.535. Connected Components Workbench has no creatable CHAR, WCHAR, or TOD variable on Micro800, so those types apply to Logix families.STRING encoding
Writes include the CIP length prefix. The layout depends onDEVICE_FAMILY.
- ControlLogix / CompactLogix (default): fixed 88-byte CIP
STRING— a 4-byte DINT length prefix plus up to 82 ASCII characters. NeitherLENGTHnorSTRING_SIZEresizes this layout.STRING_SIZEis accepted as an alias for the same field and has the same limitation. - Micro800: a 1-byte length prefix plus the characters. A write can be longer than the value currently stored in the tag. The broker sizes the tag so the new string fits, up to the String Size configured for that tag in Connected Components Workbench (for example, 80 characters). A longer string is rejected with an error instead of being truncated.
TIME encoding
Raw value is a signed 32-bit millisecond count. MQTT publishes Allen-Bradley-style duration strings (for exampleT#1h1m1s1ms).
Write value formats
Publish a payload toDESTINATION_TOPIC on a tag with WRITABLE "true". Multi-byte values are written little-endian, the byte order CIP expects.
An on-demand
ADD EVENT write accepts T# durations and sends the STRING length prefix. For WORD, DWORD, LWORD, and DATE, put the decimal or seconds form in the event value field. The 16# / 0x and yyyy-MM-dd forms apply to writable-tag payloads.
TAG Configuration
Every polled data point is anADD TAG inside an ADD MAPPING block.
Complete TAG Example
TAG Parameters
Address and data type
Address and data type
string
required
PLC tag name — controller-scoped (
MainCounter), program-scoped (Program:MainProgram.Counter), UDT member (Valve1.Status), or array (Temps[0]).string
SYMBOL (default) or PATH.string
required
Logix data type:
BOOL, SINT, INT, DINT, LINT, USINT, UINT, UDINT, ULINT, REAL, LREAL, STRING, TIME, etc. It must match the PLC tag’s actual type. A mismatch publishes no value, marks the tag BAD, and route health goes Yellow. See Data Types.Value transformation
Value transformation
Filtering
Filtering
Publishing and writes
Publishing and writes
string
required
MQTT topic where polled values are published.
string
VALUE_ONLY (default) or JSON (value, unit, quality, timestamp, description).boolean
When
"true", subscribe to DESTINATION_TOPIC and write incoming MQTT values to the PLC.string
MQTT topic to receive write commands. Required when
WRITABLE is "true".string
Human-readable description (included in JSON publish mode).
Publish Modes
VALUE_ONLY (default) — publishes just the scaled value:Event-Based Operations
For on-demand tag reads and writes (not continuous polling), add anADD EVENT block. Publish any message to SOURCE_TOPIC to trigger the operation; results appear on DESTINATION_TOPIC.
Query Parameters
Read Example
Write Example
Examples
- Multiple data types
- UDT members
- Array elements
- Control loop
- Scaled analog
Monitor BOOL, DINT, and REAL tags in one mapping:
Best Practices
Choose the correct device family
Choose the correct device family
Use
DEVICE_FAMILY 0 for ControlLogix and CompactLogix (most common), 4 for Micro800, and 5 for MicroLogix. Legacy PLC5/SLC500 families (1/2) only for existing installations.Program scope
Program scope
Controller-scoped tags use the name alone (
GlobalCounter). Program-scoped tags need the full prefix: Program:MainProgram.LocalCounter.PATH vs SLOT
PATH vs SLOT
Set the CPU slot in
PATH ("1,0" for backplane 1, slot 0). SLOT is kept for legacy parity, but routing is resolved from PATH. Micro800 (DEVICE_FAMILY 4) has no backplane: omit PATH. A PATH on a Micro800 route is ignored and logged as a warning.Deadbands and polling
Deadbands and polling
Use
DEADBAND on noisy analog values. Match EVERY to how fast the value changes — 500 ms for critical data, 1–5 s for slow status.Troubleshooting
Connection failed
Connection failed
- Verify IP with
ping - Confirm the EtherNet/IP port is open (default
44818, or thePORTyou set) - Ensure PLC is powered on and in RUN mode
- Check
DEVICE_FAMILYmatches your controller type - Increase
TIMEOUTon slow networks - Publish
-checkConnectorConnection <name>to test the connection: with tags, the broker opens one tag the way a read does; with no tags, it checks the EtherNet/IP session
Tag not found
Tag not found
- Tag names are case-sensitive — match Studio 5000 exactly
- Program-scoped tags need
Program:ProgramName.TagName(notProgramName:Tag) - Verify the tag exists in Controller Tags or Program Tags in Studio 5000
- For UDTs, include the member:
Valve1.StatusnotValve1 - For arrays, include the index:
Temps[0]notTemps
Path errors
Path errors
- Use
PATH "1,0"for standard backplane routing (backplane, slot) - For Micro800, omit
PATH. If you set one, the broker ignores it and logs a warning - Multi-hop paths use comma-separated segments:
"1,2,2,1"through bridge modules
Micro800 issues
Micro800 issues
- Set
DEVICE_FAMILY 4 - Omit
PATH. Micro800 has no backplane; aPATHon this family is ignored and logged as a warning - Use Micro800 I/O tag names (
_IO_EM_DI_00,_IO_EM_AI_00) - STRING uses a 1-byte length prefix (not the ControlLogix 4-byte format). A write can grow up to the tag’s String Size in Connected Components Workbench; a longer string is rejected
Write operations fail
Write operations fail
- Set
WRITABLE "true"and provideDESTINATION_TOPIC - PLC must be in Remote Run mode
- Verify
DATA_TYPEmatches the PLC tag definition - Check value is within
MIN_VALUE/MAX_VALUEif set - For
TOD, publish milliseconds since midnight. The read formhh:mm:ss.fffis not a write payload
No value published, route Yellow
No value published, route Yellow
DATA_TYPEmust match the PLC tag’s actual type. On a mismatch the tag is refused: no value is published, the tag goes BAD, the log names both types, and route health leaves Green and goes Yellow- The check is strict. A PLC
INTdeclared asDINTis refused too. That case used to read correctly by luck - Match PLC types exactly: DINT →
DINT, REAL →REAL, BOOL →BOOL TIMEtags publish asT#...duration strings on MQTTDATEpublishes asyyyy-MM-dd.TODpublishes ashh:mm:ss.fff- For now, one failing tag can back off its whole mapping
Next Steps
EtherNet/IP Connector
Explicit CIP Class/Instance/Attribute addressing for assembly objects and legacy devices.
Industrial Connectors Overview
Compare OT connectors and choose the right protocol for your devices.

