Rockwell EtherNet/IP
Connect Allen-Bradley Logix controllers over EtherNet/IP (CIP) - controller tag names, byte offsets, atomic CIP types and network discovery.
The Rockwell EtherNet/IP driver talks to Allen-Bradley / Rockwell Logix controllers (ControlLogix, CompactLogix) over EtherNet/IP with CIP tag addressing. You address values by the controller tag name declared in the Logix project — no register map involved. Add a device under the Rockwell EtherNet/IP driver in the Connector; the panel shows only the fields this protocol uses.
Connection
| Field | Meaning | Default |
|---|---|---|
| Host | IP address or host name of the controller's Ethernet port. | empty |
| Slot | Which position of the chassis the controller is seated in, counted from 0. | 0 |
| Poll interval (ms) | Device-wide read period for tags that do not override it. | 1,000 |
There is no port field: EtherNet/IP uses its standard TCP port 44818. The CIP
route is the backplane plus the Slot, so a controller seated anywhere in
the chassis is reachable; a discovered controller starts at slot 0 and the
field is where you correct it. There is no rack field: a CIP route carries no
rack number. Requests time out after 10 seconds. The device header shows the
assembled endpoint, for example eip://192.168.0.10:0, where the number after
the address is the slot.
Each tag may set its own Poll interval (ms); a tag value of 0 falls back to the device interval.
Addressing
A Rockwell tag is addressed by two fields in the tag's Source card:
| Field | Meaning | Accepted values | Default |
|---|---|---|---|
| Controller tag | The tag name as declared in the controller. Required. | free text | empty |
| Offset in tag (bytes, bits for BOOL) | Where inside that tag's data the value sits: a byte offset, or a bit offset for Boolean tags. | 0–255 | 0 |
The driver opens the named controller tag and picks the value out of its data buffer at the offset. For a plain atomic tag the offset stays 0. The offset is what lets one controller tag serve several channels: a DINT at the start of a structure is offset 0, the REAL four bytes later is offset 4, and for a Boolean tag the offset counts bits instead of bytes.
| To read | Controller tag | Offset | Data type |
|---|---|---|---|
A controller-scope DINT Counter |
Counter |
0 | Int32 |
A program-scope DINT in Main |
Program:Main.Counter |
0 | Int32 |
A REAL array element Temps[2] |
Temps[2] |
0 | Float |
The second DINT inside structure Recipe |
Recipe |
4 | Int32 |
Bit 3 of the data in Flags |
Flags |
3 | Boolean |
The name reaches the controller whole, periods included, and a read and a
write of the same tag land in the same place. That is what makes a
program-scoped name such as Program:Main.Counter work. A dotted member path
(MyUdt.Member) is resolved by the controller when the controller publishes
that member by name; where it does not, name the base controller-scope tag and
reach inside it with the byte offset instead, which always works. The Source
card's read-only Source address (wire) line shows the assembled address as
you edit.
Data types
Every atomic CIP type is available as a tag Data type:
| Data type | CIP type | Size |
|---|---|---|
| Boolean | BOOL | 1 bit at the bit offset |
| SByte | SINT | 1 byte |
| Byte | USINT | 1 byte |
| Int16 | INT | 2 bytes |
| UInt16 | UINT | 2 bytes |
| Int32 | DINT | 4 bytes |
| UInt32 | UDINT | 4 bytes |
| Int64 | LINT | 8 bytes |
| UInt64 | ULINT | 8 bytes |
| Float | REAL | 4 bytes |
| Double | LREAL | 8 bytes |
Structures and UDTs are not supported: only the atomic types above can be read or written, which is why the byte offset exists to reach members inside them. String is deliberately absent from the picker — a Logix STRING is not an atomic type but a structure of a length and an 82-byte array, and the driver can neither read nor write one. Byte order on the wire is CIP's own little-endian and is handled automatically; there is no byte-order option.
Writes
Tags whose Access is Read and write or Write only can be written. A write reads the controller tag, changes the addressed bytes (or the addressed bit for Boolean), and writes it back. A new tag starts as Read only.
Discovery
The Connector's Discover button broadcasts a CIP List Identity request on every network this computer is on and keeps listening until 10 seconds pass with no new answer. The scan names those networks while it runs, so a result of zero says where the question actually went: a station with virtual adapters for machines, WSL or a VPN often has more networks than the operator expects, and candidates may arrive from one of them.
Interfaces that cannot carry the request are skipped: anything not up, loopback
and tunnel adapters, and an address the interface gave itself because nothing
answered DHCP (169.254.x.x). Only a reply that is a controller's own identity
answer becomes a candidate device, named eip:// plus its address; anything
else answering on the EtherNet/IP port is ignored and said so in the journal.
For each candidate the scan then reads the controller-scope tag list and offers
its atomic tags as candidate channels, each with offset 0.
Discovery discards what the driver cannot poll: structure and UDT tags
(Logix STRINGs included) are dropped, and Program:, Task: and Map:
entries are skipped. A controller on a network this computer is not on does not
answer the broadcast; add it by hand.
Good to know
- Every request to the controller times out after 10 seconds, and the discovery listen window closes after 10 seconds of silence.
- The driver opens each controller tag once and keeps it open while the device is connected, so a controller with dozens of tags is read over the sessions it already has instead of opening and closing one per reading. A reading that fails lets its tag go, and the next one opens it again by name.
- Renaming a tag in the Logix project silently breaks the channel; the tag then reads as bad quality until the configured name matches again.