ads.h File Reference

Beckhoff ADS / AMS protocol codec (DETWS_ENABLE_ADS) - zero-heap request builders + response parsers for TwinCAT PLCs over TCP 48898 (the PC-based-control protocol). More...

#include "ServerConfig.h"

Go to the source code of this file.

Detailed Description

Beckhoff ADS / AMS protocol codec (DETWS_ENABLE_ADS) - zero-heap request builders + response parsers for TwinCAT PLCs over TCP 48898 (the PC-based-control protocol).

ADS (Automation Device Specification) rides on AMS (Automation Message Specification). Every multi-octet field is LITTLE-endian. A frame is an AMS/TCP header (6 octets) + an AMS header (32 octets) + the command payload:

AMS/TCP header (6)
  00 00              reserved
  LL LL LL LL        length of everything after this field (AMS header + payload)
AMS header (32)
  target net id (6)  e.g. 5.18....1.1  (AMSNetId, six octets in order)
  target port  (2)   e.g. 851 = the first TwinCAT 3 PLC runtime
  source net id (6)
  source port  (2)
  cmd id       (2)   1 ReadDeviceInfo 2 Read 3 Write 4 ReadState 5 WriteControl
                     6 AddNotification 7 DeleteNotification 8 Notification 9 ReadWrite
  state flags  (2)   0x0004 request, 0x0005 response (bit0 = response, bit2 = ADS command)
  data length  (4)   cbData - octets of payload that follow the AMS header
  error code   (4)   AMS error (0 = success)
  invoke id    (4)   caller-chosen, echoed in the response to correlate it
payload (cbData)     command-specific (see the per-command builders/parsers below)

AMS header field order (target-before-source), command ids, and state flags verified against the Beckhoff InfoSys AMS/ADS specification; payload layouts cross-checked with Beckhoff's own open-source ADS library, pyads, and Apache PLC4X. Pure codec, host-tested - the caller owns the TCP connection (det_client_*) and the AMS route registration on the target router.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file ads.h.