Environment check: platform, pyads/router, local AMS NetId, XAE ProgIDs in the registry, running XAE shells, project root, safety mode, whether a confirmation prompt can reach the user in this session (elicitation: the negotiated MCP revision and the client's declared capability). Run this first. Starts with a one-line summary; verbose=true adds the full loaded configuration.

Current safety mode (and where it came from), ceiling, allow/deny lists, pending confirmation tokens.

Switch safety mode: readonly | guarded | full. Lowering is free. Escalating (guarded→full, readonly→guarded) is capped at max_mode AND needs a confirmation (prompt or confirm_token) — an agent must not be able to widen its own permissions silently.

Add (or remove) a write allow-list pattern for THIS session only — the in-session alternative to editing twincat_mcp.toml and reconnecting. fnmatch, case-insensitive: 'GVL_Test.*', 'MAIN.fbDispense.rSetpoint'. Control-class: needs a confirmation (prompt or confirm_token from tc_request_confirmation(action='tc_allow_write', target=''), or target='-' to remove). The deny list still wins; the change is audited and lost at the next server start.

Re-read twincat_mcp.toml (and TCMCP_* env) without a restart. Applies: safety allow/deny lists, confirm_destructive, confirm_ttl_s, docs settings, naming prefixes, dialog rules, tcunit result path. Reports — but does not apply — changes that need a restart: ads target/port, solution path, project root, mode/max_mode (use tc_set_mode).

Knowledge base (layout and rules: docs/KNOWLEDGE_BASE.md): where it is (or the question to ask the user if no folder was chosen yet), the project folders indexed for kb_search, the ESI index for hw_lookup — and under docs the documentation indexes the infosys_* tools and the twincat-docs skill read: index\infosys-.db (the one Infosys index) and index\manuals.db (PDF manuals, with the PDFs not in it yet), the SOPs, and the command that runs the skill's script on this folder. Each index: complete, or rebuild_needed / outdated (in use as it is until the user approves kb_rebuild), or a build running / interrupted. layout lists files the plugin no longer reads (never deleted by it) with their size.

Rebuild one index of the knowledge folder from its source on this PC — ONLY with the user's approval (docs/KNOWLEDGE_BASE.md rule 6: the user is asked, or pass the confirm_token of tc_request_confirmation(action='kb_rebuild', args={'index': …})). index: 'infosys' (the Help Viewer package, the plugin's extractor, in its own process — minutes; the current index stays in use until the new one is complete and then replaces it), 'manuals' (the PDFs in manuals, in its own process), 'esi' (the ESI files in manuals\ and TwinCAT's ESI folders → index\esi.db, in its own process — minutes; the current index stays in use until the new one is complete). Without force an index that is complete and current is left as it is. Nothing is deleted. kb_status / tc_doctor show the progress.

Choose the folder for the knowledge database — ONLY with a path the user gave you (or use_fallback=true once the user agreed to D:\TwinCAT-MCP\knowledge; not both). The folder is checked: a folder (not a file, not a drive root) on a local fixed drive (no network share / mapped drive / USB), not inside OneDrive/Dropbox/Google Drive/iCloud/Box, not inside the plugin folder, writable, >= 1 GB free — a failing condition is named and nothing is changed. An existing database is never moved or deleted. Without arguments it returns the current location (and changes nothing). A change is refused in readonly mode and audited, as every EDIT tool (N127).

Index a project folder for kb_search (cross-project pattern search) — ONLY a folder the user named. Reads .TcPOU/.TcDUT/.TcGVL/.TcIO beneath it into the knowledge database; nothing is indexed by default. Refused: the plugin's folders, the knowledge folder, a folder inside or around one already indexed (its units would be there twice). The answer names the files that could not be read (parse_errors) and the files no PLC project compiles (not_in_project). Refused in readonly mode; audited (N127).

Remove a project folder from the knowledge base (index entries only; the files are untouched). Refused in readonly mode; audited (N127).

Re-index one project folder (or every changed one) after edits. Refused in readonly mode; audited (N127).

Search the code of the project folders the user added ("alarm handler", "FB_Valve", "CONCAT"): unit, kind, file and the matching declaration/code excerpts, best first. Names and identifiers count as their words (FB_AlarmList: alarm, list). Units with EVERY word first, then every word as a prefix ('CounterMod' finds FB_CounterModule); a unit whose code holds the words before one that has them only in comments (match_in='comments'); only when none has them all, units with some words (match='some words', with the words each unit holds; words on no unit or on most units are not used and are listed). A unit that declares the name (variable, constant, member, enum value, its own name) comes first (declares). Stop words ('how', 'to', 'the') and, in a query of several words, single characters are not searched; a query of stop words only is refused. There are no query operators: OR / AND / NOT / NEAR, '-', '^', '*' are not read as such (operators_note). A copy name (PRG_X_9) that no unit has falls back to the name it was copied from. "quoted text" is a phrase; tokens joined by punctuation ('STRING(40)', 'fbTimer(IN:=') are searched as one sequence (searched_as_sequence), a qualified name ('GVL_X.nY') as its names. A unit whose own name holds the words comes before its members. kinds (checked): PROGRAM, FUNCTION_BLOCK/FB, FUNCTION, POU (= those three), METHOD, PROPERTY, ACTION, INTERFACE, STRUCT, ENUM, GVL, DUT (= every data type) …; with kinds, a member is answered as its owner of those kinds (via_member: 'Execute' kinds=[INTERFACE] → I_Module); no hit names the units of other kinds that have the words. words_not_in_code: the words a hit has only in comments / string literals. project = the folder (any spelling) or its label; limit 1–200. stale: folders changed, renamed or deleted since they were indexed — their hits are those of the last indexing (kb_reindex); changed_files / added_files / removed_files name them. An error message — a code in a notation that says so (ADSError 1861, pyads' 'ADSError: … (1861)', ADS error 1861, error 1861, nErrId := 1861, 0x98110745, ADSERR_CLIENT_SYNCTIMEOUT), a compiler message (C0046: …), or a 0x number alone; not the word 'error', a decimal / 16# literal alone, a hex number anywhere or an ERR_… identifier of the code — gets the plugin's note in known_error (ADS return codes 6, 7, 1793, 1796, 1797, 1799, 1808, 1861 with code and symbol, license, XAE busy / dialog / disconnected, logged in, compiler: identifier not defined, cannot convert type, unknown type; null + known_errors_covered when it has none) and is searched only for the names of the code it holds (quoted, or identifiers such as fbCounter, FB_Valve, MAIN.fbX). Beckhoff documentation is not here: the twincat-docs skill.

EtherCAT device data from the ESI index (index\esi.db: the ESI files in the knowledge folder's manuals
and TwinCAT's ESI folders): name, product code, revisions, E-bus current, mailbox, DC modes, sync managers, PDOs with every entry (index, subindex, bit length, type; gaps marked), the predefined PDO assignments, slots of modular devices with their modules, the CoE object list, the diagnosis catalogue size, the ESI file(s). query = type / order code ('EL3356-0010'), part of a name, or a product code ('#x07D83052', '0x07D83052'; a number is read as a decimal product code and as digits of a type or name — read_as). revision: '#x…' as shown, '0x…' or decimal. detail: 'newest' (default) = all of that for the newest revision of each type (or of revision), other revisions as one line each; 'summary' = counts only; 'full' = everything for every revision. Nothing found: note says what is not there — a revision of an indexed device (revisions_available), or the device (then: add its ESI file). One CoE object with sub-indices, defaults and enum texts: hw_object; full-text: hw_search; a diagnosis text id: hw_diag. The index's first build starts by itself (minutes); until it is there the answer says so. source: the index the answer came from (state, built; state_note when it is not current). manuals names the indexed PDF manuals that mention the product, with pages (the twincat-docs skill reads them).

Full-text search of the ESI index: devices (names, PDOs and their entries, PDO assignments), CoE objects (names, descriptions, sub-index names), diagnosis messages (text, description, causes, remedies) and modules. kinds: any of 'device', 'object', 'diag', 'module' (default all; a module is found by its own name and PDOs and by the devices whose slots take it — type, name, group). FTS5 syntax (words ANDed, "phrase", prefix*); other text is searched as one phrase. Hits with the same title (revisions of one type, one text in several catalogues) are one item with variants; objects and messages name the device types that have them. Pages: total items, offset / next_offset; a limit above 100 is used as 100 (clamped).

One CoE object of a device from its ESI (newest revision unless revision): every sub-index with type, bit size and offset, access, PDO mapping, backup/setting flags, the default (decoded from DefaultData, enum text when there is one), min/max, unit code, enumeration texts; array elements one by one. index: '#x8000' or '0x8000' (4 hex digits alone are read as hex); one sub-index in CoE notation '8000:11' (the sub-index in hex, as Beckhoff's manuals write it: 8000:11 = sub-index 17) → sub and subitems with just that one. device: the exact type ('EL3356-0010').

A diagnosis message by its text id as the diagnosis history shows it (object 0x10F3; '#x4101', '0x4101'): message text, description, causes and remedies, class, reaction, reset — from the device's own catalogue when device is given, else every distinct message with that id and the device types / modules that use it.

A module of a modular device (AX8000, EP/EL with slots, TSC …) by its ModuleIdent as hw_lookup's slots give it: PDOs, CoE objects, diagnosis messages. With device, the module that device's slot means (hw_lookup's rule: the device's own file, then the module file paired with it by name, then the only one), else every module with that ident.

Issue a single-use confirm_token for a control/destructive tool: action = the tool's exact name. Easiest: pass the tool's own arguments as args (e.g. action='xae_plc', args={'action': 'login', 'plc_project_path': 'TIPC^Plc^Plc Project'}) — the server computes the target the tool will check, the same way the tool does. A target given by hand must equal it (a partial one — 'login', 'PLC.Login' — is completed); the error names the right one. Targets: xae_deploy / xae_restart_twincat / xae_activate_configuration / tcunit_run: the XAE target NetId; xae_plc: ':@'; xae_command: '@'; xae_boot_project: the plc_project_path (with '@' when activate_after_generate); xae_tree_delete: '<parent_path>^'; xae_library_add: ':'; xae_library_remove: ':' + ' ()' and ', ' when given; xae_placeholder_add: ':'; xae_placeholder_resolve: ':=' + ', ' when given; xae_placeholder_freeze: ':' ('*' for all); xae_link: ' -> ' (paths as normalised: '^', TIID) + ' [offsets /, bit]' for a part; xae_unlink: ' -> ', or ' -> (all )'; xae_links_import: ':<sha256 of the XML text, 16 hex> over <sha256 of the table now, 16 hex> (+ -)' — the dry run's confirm_target; xae_target: the new NetId; xae_dialog_resolve: ':'; ads_plc_state / ads_system_mode: the action (run, stop, reset / run, config); ads_connect: the NetId, or 'local'; ads_add_route_to_plc: the PLC's IP address; ipc_write_file / ipc_delete_file / ipc_start_process: the remote path; ipc_eventlog: the log name; ipc_reboot: the literal 'target'; rec_delete: the recording id; tc_set_mode: the mode; tc_allow_write: the pattern ('-pattern' to remove); exp_run: the experiment name; kb_rebuild: the index: 'infosys', 'manuals' or 'esi'.

Last n audit records (mutating calls, confirmations, mode changes).

(Re)connect to a target. ams_net_id like '5.12.34.56.1.1', 'local' for this PC, None = keep current; port 851 = PLC runtime 1. Re-targeting to a NetId other than the configured one is control-class (it changes which machine every later write hits).

Composite status: connection, PLC runtime state, TwinCAT system mode (RUN/CONFIG), device name/version. With port=N returns only the ADS state of that port (852 PLC2, 500 NC, 10000 system service, 65535 EtherCAT master 1).

Browse the runtime symbol table. pattern is fnmatch ('MAIN.', 'valve'; bare text is wrapped in ''). type_filter substring-matches the type ('ST_', 'BOOL', 'FB_'). flag filters by symbol flag: PERSISTENT, READONLY, STATIC, ATTRIBUTES … compact=true returns 'name : type' strings only (one fifth of the tokens).

Type, size, index group/offset, flags (READONLY, PERSISTENT …) and comment of one symbol.

Read one symbol with type-aware decoding. Structs/FB instances/arrays of structs decode into a nested tree (datatype table); TIME/DATE/DT/TOD get readable text; enums get names. Trees larger than max_chars are summarised (member names + sizes) — use ads_leaves or ads_dump for the full content.

Read several symbols in one ADS sum-command. Returns {name: value | {error}}.

Write a symbol on the running PLC. Accepts JSON scalars, lists for arrays, and literals like 'T#1s500ms', 'D#2026-10-15', '16#FF'. Returns before/after. Gated: readonly=never; guarded=write_allowlist; full=denylist only.

Write several symbols ({name: value}) together. Every symbol is gated (allow/deny list) and pre-checked (type, range, enum name, array/string length, CONSTANT, pointer/interface) BEFORE anything is written — one refusal → nothing is written and every problem is listed. Then ONE ADS sum-write: the runtime applies all values between the same two task cycles (method says if it had to fall back to one-by-one). Per-item before/written/read_back; applied/failed/not_attempted if the PLC rejects one.

Raw process image of the PLC: area 'I' (%IB inputs) or 'Q' (%QB outputs) at a byte offset — what the task actually sees/wrote, independent of symbol names (link checks).

Raw ADS read by index group/offset on any port (hex + little-endian uint).

Raw ADS write by index group/offset — PLC runtime ports (851-859) only. Every symbol whose memory overlaps the written range is checked against the write allow/deny lists; the raw target itself is 'raw://'.

Trace symbols for duration_ms. Uses ADS notifications (PLC-timestamped, every change the runtime sees at its task cycle — not 50 ms polling from this PC): change_only=true records changes, false one sample per interval_ms. Falls back to polling when notifications are unavailable (method field says which). Caps: 60 s, 5000 rows. The wait happens off the ADS workers, so writes issued concurrently land during the watch — a client that sends calls one after another still sees them after it; for stimulus→response use test_response, or rec_start + the write + rec_stop.

Block until symbol value (==, !=, >, >=, <, <=) or timeout. Uses an ADS change notification, so it returns as soon as the runtime sees the condition (met_at_plc_ms = PLC-relative timestamp of that sample); falls back to polling every interval_ms when notifications are unavailable. Returns met/value/elapsed.

PLC runtime control via ADS: run | stop | reset. 'reset' is a cold reset (all non-persistent data lost). Control-class: confirmation in guarded mode.

Switch TwinCAT on the target between 'run' and 'config' mode (restarts the runtime, I/O goes down). Destructive-class. Waits (≤20 s) until the target reports the requested mode and returns before/after; reached=false when it did not get there (license / configuration error).

EtherCAT master state (INIT/PREOP/SAFEOP/OP) and slave count via the master's ADS port (default 65535 for the first master; see Device → ADS tab in XAE).

Local static ADS routes (parsed from StaticRoutes.xml on this PC).

Create the PLC-side route back to this PC (UDP discovery protocol, needs the target's Windows/TC-BSD credentials). Control-class.

Start a continuous real-time recording of online PLC variables (runs in the background until rec_stop, duration_s, max_events or stop_when). Select by explicit symbols (an FB or struct instance expands to all its leaves), prefix ('MAIN.fbFill', 'GVL_Sim.aCh[1]' → every leaf under it) or pattern — the same leaves rec_scan lists for it: ''/'?' wildcards, '[ ]' literal ('GVL_Sim.aCh[1].'), a leaf is recorded when it or one of its parents matches ('*bOpen' → every bOpen). mode: 'cycle' = one PLC-timestamped sample per symbol per cycle_ms (ADS notification, cycle-accurate); 'change' = PLC-timestamped sample only when the value changes (checked every cycle_ms); 'poll' = sum-read every cycle_ms from this PC. Triggers: start_when='MAIN.bStart == TRUE' with pre_trigger_ms keeps the events before the trigger (scope-style); stop_when='MAIN.fbFill.bDone == TRUE'. Events stream to a JSONL file. duration_s is PLC time from the first sample (also while waiting for start_when); post_trigger_s ends the recording that long after the start_when trigger fired (scope-style post-trigger window). Timestamps (cycle/change) are the TwinCAT runtime's own, stored exactly with the raw bytes it sent; neighbouring variables share ONE notification (a block), which is what keeps 1 ms recordings lossless — select whole FBs, structs or arrays rather than hundreds of scattered globals. Any notification that cannot be registered fails the start (allow_partial=true records the rest and lists unsubscribed_symbols). max_delay_ms > 0 lets the runtime batch samples (fewer ADS frames; each sample keeps its own timestamp). cycle mode also records a per-cycle counter as ground truth (cycle_counter='auto' = the matching task's _TaskInfo[n].CycleCount, or your own e.g. 'MAIN.nCycleCount', or null for none) and the header carries a manifest of what was recorded from (AppTimestamp, OnlineChangeCnt, tasks, TwinCAT build, symbol version). A recording is of one program: a download / online change while it runs ends it at the last sample verified against the symbol version (program_changed); nothing sampled from the new program is written. Conditions are levels: a start_when that already holds fires at once — edge_triggers=true fires only when it BECOMES true. A condition may name one element of an array recorded as a whole (GVL_Test.aCounter[1] when GVL_Test.aCounter is recorded). engine (cycle mode): 'native' = the C++ capture service (Beckhoff AdsLib on TcAdsDll: ADS callback → ring → file, no Python on the data path), 'python' = the in-process recorder, None = recorder.engine from the config (default 'auto': native when installed). The response says which engine ran and why. After stopping: rec_verify. also_scope: also run the TwinCAT Scope configuration open in XAE (scope = its name when several are open) — StartRecord now; at rec_stop StopRecord and SaveSVD into /Scope Recordings/.svdx, the CSV .scope.csv exported from that file with Beckhoff's export tool (XAE's ExportCSV only without it, flagged), XAE's ExportCSV of what Scope holds in memory beside it (.scope.xae.csv) with both row counts compared (cross_check — a saved .svdx shorter than memory, or the reverse, is a warning), a signed link file, and the Scope View log's new ERROR / FATAL lines (scope_view_log). A .svdx still being written 15 s after SaveSVD is not exported. What Scope records (channels, sample time) is set in that configuration. With recorder.also_scope = 'ask' (default) and a Scope configuration open, leaving also_scope unset asks the user (prompt, or an error that tells you to ask and call again with true/false). After a recording Scope holds its data until it is disconnected: a recording with Scope then asks to disconnect it first — scope_disconnect=true / false is the user's answer (false: this recording without Scope).

Enumerate the variables that could be recorded and what each would cost. source='runtime' walks the live symbol/datatype tables (every scalar leaf under prefix, or all programs/GVLs); source='project' walks the source declarations (works offline). pattern selects leaves exactly as rec_start does: '*'/'?' wildcards, '[ ]' literal, a leaf matches when it or a parent matches. Returns counts by type and by group (program.instance) with bytes/s estimates at cycle_ms, a suggested mode per leaf, and — when checklist='' — writes ~/.twincat_mcp/profiles/.checklist.csv with a 'select' column to mark (preselect = patterns already marked). Then rec_profile_save(name, from_checklist=name).

Save a named capture profile. Sources combine: explicit symbols (mode='auto' picks cycle for REAL/TIME, change for BOOL/INT/enum, poll for strings — or give cycle|change|poll), a marked checklist (path, or the name given to rec_scan), and/or {attribute 'tcmcp.record' := 'cycle'} pragmas in the source (from_attributes=true; scope limits to one program). Triggers and the default cycle are stored with the profile. rec_profile_start(name) replays it.

Saved capture profiles (name, symbol count, modes, source).

One profile in full: every symbol with its mode and cycle, triggers, per-group cost estimate.

Delete a profile and its checklist file.

Start recording a saved profile: one recording per (mode, cycle_ms) group, all named '/@'. Triggers given here override the profile's. Returns the recording ids; rec_profile_stop(name) stops them together, rec_stats/rec_export work per id. align (default, several groups, no start_when): every group starts on the same PLC cycle — a shared start trigger on the task's cycle counter a moment ahead — and duration_s then counts from that cycle, so all files cover the same window (D29: groups started ≈ 160 ms apart).

Stop every live recording started from this profile; returns per-recording status + stats.

Recordings of this session (compact status) and recording files on disk, newest first (paged: limit/offset; on_disk_total says how many exist); a recording with Scope: its scope state.

Live status of one recording: samples, events, rate, missing_samples (holes in the PLC timeline, cycle mode), completeness, dropped (lost on this PC), backlog, stats_coverage, per-block report, warnings, armed/triggered, last value per symbol; with Scope: scope {state recording | finishing | finished | stop_unknown} (N182; recording with stop_refused: XAE refused StopRecord, rec_stop asks again).

Most recent events of a running (or finished) recording — the live tail.

Per-symbol statistics over the whole recording so far: count, first/last, min/max/mean, change count, BOOL rising/falling edges with timestamps, and value runs (state timeline with dwell times). Live (incremental) while complete; recomputed from the file when the ingest had to skip statistics under load, for recordings of earlier sessions, or with exact=true.

One call for "record X for N s and give me the stats": starts a recording, waits (≤ 60 s), stops, and returns per-symbol statistics, completeness and the rec_verify verdict (integrity + PLC timeline, plus the optional per-cycle counter) with the file path. For longer or triggered captures use rec_start.

Prove a finished recording. integrity: the file is byte-for-byte what the recorder wrote (sha256 of every line, signed with this install's key) — 'MODIFIED' if anything was edited. timeline (cycle mode): per notification block, holes between the PLC's own sample timestamps. counter (optional): a PLC variable that increments every cycle and was recorded with the rest (your nCycleCount, or TwinCAT_SystemInfoVarList._TaskInfo[1].CycleCount) must step by exactly step per sample — ground truth for 'no sample lost'. verdict PASS only if all checks hold; INCONCLUSIVE when the file is intact but its completeness cannot be shown (a change / poll recording without counter=, or a stop from an older version whose blocks ended apart); FAIL on any loss, a block that never delivered, or symbols not subscribed.

Read a time window of a recording from its file. wide=true: one row per PLC timestamp with one column per selected symbol; a cell is null when that symbol has no sample at that time — nothing is invented (R4). fill=true repeats the last known value into those cells and lists them per row under "_filled" (handy for 'what else was true when X happened', but a filled cell is not a sample). Works on finished recordings from earlier sessions too.

Stop a recording, release the ADS notifications, finalize the file; returns status + stats. With Scope: its part is finished, and Scope (it now holds this recording) is closed, starts a new recording, or keeps the data (pause) — the user is asked (scope_next).

TwinCAT Scope on this PC: where TC3ScopeExportTool.exe is (TE130x Scope View / TF3300 Scope Server) and the default export folder.

Export a saved TwinCAT Scope recording (.svdx / .svd) to CSV with Beckhoff's TC3ScopeExportTool.exe (command line "svd=<file>" target=<csv> silent; CSV needs no extra licence). Default target: /Scope Recordings/.csv ([scope] export_dir). The CSV is Beckhoff's output, unchanged — channels, time column and alignment of channels with different sample times follow the Scope project's export settings. A signed .provenance.json records the source file and SHA-256, the tool and its SHA-256, and the command. A read-only source (rec_stop seals its .svdx) is exported from a byte-identical writable copy. scope_view_log: the ERROR lines the Scope View logs (TcScopeView.log and its numbered siblings, TcScopeView_1.log …) got during the export.

TwinCAT Scope configurations in the solution open in XAE (TwinCAT Measurement projects). Their channels, sample time and record time are what scope_record / rec_start(also_scope=true) record.

Drive a Scope configuration open in XAE (Automation Interface IMeasurementScope): action = start | stop | disconnect (Scope discards what it holds and is back in Config — needed before it records again; asks for the user's confirmation unless what it holds is a recording the plugin saved) | new (disconnect, then start) | save (SaveSVD → /Scope Recordings/-.svdx, or path=.svdx; the .csv exported from that file with Beckhoff's export tool — XAE's ExportCSV only without it, flagged, and never over an existing CSV; XAE's ExportCSV of the in-memory data beside it, .xae.csv, row counts compared in cross_check; the Scope View log's new ERROR / FATAL lines). scope = its name when several are open. Affects only the Scope recording, not the PLC. One Scope, one owner (N189): while a recording's Scope part has Scope, its rec_stop / rec_delete stop and save it — start / stop / save / disconnect / new here are refused; a Scope recording started here owns Scope until action='stop'.

Export a recording to CSV. csv_wide: one row per PLC sample time, one column per variable and per array element (name[i]); an empty cell means no sample of that variable at that time (fill=true forward-fills — handy for charts, but a cell then no longer means "sampled now"). csv_long: t_ms,symbol,value. Both include plc_filetime (the PLC's own sample timestamp) when available. Default path next to the JSONL. An out_path must be in a folder this server writes to ([server] output_dirs adds more). An existing file — also an earlier export at the default path with other symbols/fill, or of a recording that has grown since — is only replaced with overwrite=true; an identical re-export (same source bytes and parameters) is not refused.

Stop (if running) and delete a recording and its exports from disk. Destructive-class (field report R11): a recording is evidence — guarded mode needs tc_request_confirmation(action='rec_delete', target=); the audit keeps the deleted file's size and SHA-256 so its content stays identifiable.

Assert conditions on live values. checks: [{symbol, op, value, tolerance?}], op ∈ == != > >= < <= ~= (relative/abs tolerance) in between. within_ms>0 waits until all hold. Returns pass/fail per check with the time each one was met.

Assert a value does not move more than tolerance for duration_ms (settle check for a weight, pressure, PID output, state).

Write a stimulus ({symbol: value}) and measure the PLC-timestamped latency until response ('MAIN.fbValve.bOpen == TRUE') holds — how fast does the FB react? Writes are gated per symbol; originals are restored afterwards unless restore=false.

Scripted FB test against the live PLC with a recording in parallel. spec = {name, record:{symbols|prefix|pattern, mode, cycle_ms}, steps:[{at_ms?, write:{sym:val}} | {expect:[checks], within_ms} | {wait_ms} | {wait_until:{symbol,op,value,timeout_ms}} | {stable:{symbol,duration_ms,tolerance}}], final_expect:[checks], timeout_ms, restore, stop_on_fail}. Every written symbol is gated before the run starts; written values are restored at the end. Returns per-step results, overall pass, and the recording id.

PLC application info (TwinCAT_SystemInfoVarList._AppInfo): project/app name, online change count, boot data loaded, task count, logged-in flag, app timestamp.

PLC task timing (TwinCAT_SystemInfoVarList._TaskInfo[n]): cycle time, last/min/max/mean execution time over samples, load %, cycle-time-exceeded counter delta — the FB's cost on the real-time task.

ADS round-trip time statistics to the target (router/route/network health).

Invoke an FB method on the running PLC via ADS RPC. The method must carry {attribute 'TcRpcEnable'}. inputs: [{type:'LREAL', value: 12.5}, …] in VAR_INPUT order (use base types: INT not E_Enum); outputs: ['BOOL', …] in VAR_OUTPUT order. Write-class.

Save a named snapshot of live values (expanded like rec_start) for regression comparison — parameters, recipes, whole FB instances before/after a change.

Diff snapshot a against b (another snapshot or 'live'), numeric tolerance applies.

Saved snapshots.

Pulse / dwell analysis of one recorded symbol: for BOOL → pulse count, high/low widths, period, frequency, duty (fine-dosing valve pulses); for other types → state timeline with dwell times.

Edge-to-edge latency in a recording: from each time from_symbol from_op from_value becomes true to the next time to_symbol to_op to_value becomes true (PLC timestamps). E.g. bOpenCmd == TRUE → rFlow > 0.5.

Library versions (K3): every library reference of each PLC project — the version it asks for, the version it effectively resolves to on this PC ('*' = newest installed) and what is installed in TwinCAT's library repository. Flags a pinned version that is not installed. Reads the .plcproj and folder names only.

Public interface of an FB/program: inputs/outputs/in-out with types and comments, methods (access, signature), properties (get/set), actions, extends/implements.

Static checks over one object or the whole project: unused locals, naming prefixes (override map via prefixes), undocumented VAR_INPUT/OUTPUT, TODO markers, REAL compared with =, VAR_INPUT assigned inside an FB, empty methods, GVL/ENUM without qualified_only, magic numbers, FB_init/FB_exit without SUPER^; OOP/safety: interface_contract (every member of each IMPLEMENTS interface present with matching signature — info, not error, when the interface or a base lives in a library), extends_cycle, abstract_instantiation, shadowed_member (method input/local hides an FB member), unsigned_loop (BY -1 or TO n-1 on an unsigned counter), new_delete (__NEW without __DELETE, target lacking enable_dynamic_creation). Deterministic and offline; the compiler (xae_build + xae_diagnostics) stays the authority. rules= subset to run.

Call graph from a program/FB: FB instances it invokes, functions and methods it calls, recursively to depth (what runs when this POU runs).

Generate _Tests.TcPOU (TcUnit.FB_TestSuite) with Test_InitialState and one test method per public method, arranged from the FB interface, and register it in the .plcproj. Assertions are left as TODO stubs.

Read EVERY variable on the PLC (all top-level symbols, fully expanded through the datatype table — structs, FB instances, arrays of structs) in one pass and write a flat CSV (path,type,value,note) and a nested JSON tree built from the same values, so the two files never disagree. pattern limits the roots ('MAIN.', 'GVL_'); system symbols excluded unless include_system. With a project configured its own programs and GVLs come first; without one the order is alphabetical (origin unknown). POINTER TO / REFERENCE TO / INTERFACE values are addresses (NULL = 0x0000…0000) — the target is never expanded. An array beyond 4096 elements or a value beyond 64 KiB is not expanded: both files show the same {not_expanded, bytes, elements, head_hex}. Big symbols are read in 256 KiB pieces. max_leaves bounds CSV and JSON together; max_total_mb (MiB) bounds the CSV + JSON on disk (written_mib; the bytes read from the PLC are not counted): a row is written only when it, the root's JSON with it and the ending still to be written (the footer naming what is left out) fit — nothing is estimated. complete=false names every root that is missing or cut (skipped_roots) and every root that could not be read (failed_roots, also in the CSV note column and the JSON footer). not_on_target names the programs/GVLs of the source that have no symbol on the target, with the cause (not linked, or another program on the target). Returns counts, largest_roots, file paths and a 50-leaf preview.

Enumerate every scalar leaf under a symbol with byte offsets (datatype table): 'MAIN' → all program variables, 'MAIN.arrSteps' → arrSteps[1].nId … With values=true each leaf is decoded from the symbol's bytes, read in bounded pieces (a value that is not expanded: its head only); value_note says why a value is missing or partial.

Runtime datatype table: describe one type (members with offsets/sizes, array bounds, enum literals, attributes) or list types matching a pattern.

Every variable the project source declares, flattened to runtime instance paths by walking programs and GVLs through FB/STRUCT definitions (MAIN.fbFill.fbValve.bOpen …). scope = one program/GVL/FB to walk instead of all. Library-typed variables stay as one item with their type. A name declared in several PLC projects is walked in the PLC project on the connected ADS port (the .tsproj's AmsPort); pin another with '@'.

Cross-check the source against the running PLC: variables declared in the project but not present online (not compiled / not activated / optimised away) and online variables under the same programs/GVLs that the source does not declare (stale boot project, library internals); roots_not_on_target names a program/GVL of which the target has no symbol at all, with the cause (a GVL nothing references is not linked). Use after a deploy to prove the target runs this source.

One-call debugging dossier for a variable: live value, declaring file:line chain, the statements that write it, code excerpts around them, and a short change watch.

Profile an FB instance for duration_s: records every leaf (change mode), samples task timing in parallel, then reports most-active symbols, boolean pulse rates, state dwell timelines, silent symbols and the FB's cost on the task. Read-only on the PLC.

Go/no-go before a deploy: git changes, build result, lint, source-vs-runtime, TcUnit result on the target, task health. Writes nothing to the PLC.

Orientation in one call: index summary, programs with call trees, FBs with interfaces, GVLs/DUTs, lint summary, git state.

Before/after comparison of two recordings: per-symbol stat deltas (count, min, max, mean, changes, edges) and pulse width/period deltas for BOOLs — timing regression after a code change.

Modal dialogs currently open in the attached XAE shell (title, class, text, buttons), the watchdog's auto-answer rules and its recent log. A pending dialog blocks every COM call. Any window that holds the shell modal (its main window disabled) is listed, whatever its class (WPF About / Options, WinForms): its buttons read through UI Automation, or buttons null + buttons_note when they cannot be read; unidentified when the shell is modal but no window could be named.

Click a button on an open XAE dialog ('OK', 'Yes', 'No', 'Cancel'…). remember=true adds an auto-answer rule for that title (never for machine-affecting prompts). Control-class; machine-affecting prompts (activate/run/download/login/delete/safety) are destructive-class. A window that is not a standard dialog is pressed through UI Automation; one whose buttons cannot be read is refused (close it in XAE) — never closed by the tool.

Set/clear the Disabled flag on I/O devices under TIID (all, or the named ones) so a configuration activates without the hardware present — TcUnit on a PC, dry runs.

Variable links of the PLC instance: every AT %I*/%Q* variable (from the instance's XML) with its link targets (the project's mapping table, ProduceMappingInfo); lists the unlinked ones — array elements too, the usual reason an output never moves — and links whose variable is gone. plc_project_path: plc_path, iec_project_path or instance_path. What could not be read is said (unlinked_count null), never counted as 0. not_restored: links the saved project keeps but XAE could not restore (RestoreInfo in the .tsproj / .xti, e.g. ANotFound after a variable moved) — ProduceMappingInfo does not list them.

Link a variable to its I/O counterpart (ITcSysManager::LinkVariables), both as full tree paths: variable='TIPC^^ Instance^PlcTask Inputs^GVL_IO.bIn', target='TIID^Device 1 (EtherCAT)^Term 1 (EK1100)^Term 2 (EL1004)^Channel 1^Input' (xae_links gives the instance's variables, xae_tree_get the terminals'). offs_* / size_bits for a part (bits; 0 = the smaller of the two). XAE checks that both exist, are variables and fit. A whole link is refused when the two are linked already (a part may be linked besides others). Runs once; the result has what changed in the mapping table and what else the target is linked to. In XAE only — not saved, not activated. TwinSAFE ends are refused. guarded: tc_request_confirmation(action='xae_link', target=' -> ' + ' [offsets /, bit]' for a part).

Remove a link (ITcSysManager::UnlinkVariables): the one between variable and target, or — target left out — every link of the variable. Full tree paths as the mapping table names them (xae_links). Refused when there is no such link, or when a link to be removed has a TwinSAFE end. Runs once; the result has what changed. In XAE only — not saved, not activated. Destructive-class: tc_request_confirmation(action='xae_unlink', target=' -> ' or ' -> (all )', n = the links it has now).

Import a mapping table (, as ProduceMappingInfo writes it) through ConsumeMappingInfo, which replaces ALL links of the project. mode='add': its links are added to the table as it is (nothing removed); 'replace': it is the whole new table. dry_run (default): what would be added / removed / changed — nothing done; its confirm_target is the token target the apply needs. dry_run=false: the table as it is goes to a new backup file first (~/.twincat_mcp/backups/links/), then ConsumeMappingInfo once, then the table is read again and compared; a failure says what the table holds then and how to restore it. xml text or file (on this PC, UTF-8 or UTF-16). Refused while the table has a link with a TwinSAFE end (ConsumeMappingInfo rewrites every link). Destructive-class: tc_request_confirmation(action='xae_links_import', args={xml|file, mode}) — the target is the dry run's confirm_target, ': over (+ -)' (a table changed since: refused).

The library references of a PLC project as XAE holds them now (TE1000 ITcPlcLibraryManager): libraries (name, version, distributor) and placeholders (default and effective resolution — '*' and what it resolves to). Flags a library referenced twice and a version that is not installed (ScanLibraries; check_installed=false skips it), and the references and requested versions that differ from the saved .plcproj (unsaved changes; an unsaved resolve / freeze cannot be seen). plc_project_path: plc_path, iec_project_path or instance_path — needed when the solution has more than one PLC project.

The libraries installed in the repositories XAE uses (ScanLibraries): name, version, distributor — every version of a library. name filters (part of the name, any case).

The library repositories XAE uses, in priority order (name, folder). Where this XAE's Automation Interface does not give them, it says so — nothing is guessed.

Add a library reference (AddLibrary): library by name, version ('' = '*', the newest installed) and distributor, or by display name 'Tc2_Math, * (Beckhoff Automation GmbH)'. XAE refuses a bare name: a missing distributor / version is completed from the installed libraries (ScanLibraries) — refused when the library is not installed, is installed from several distributors and none is given, or a pinned version is not installed. Refused when it is already referenced. Runs once; the result has the references before / after, XAE's messages, and build_required — it never builds. guarded: confirmation tc_request_confirmation(action='xae_library_add', target=':').

Remove a library or placeholder reference (RemoveReference). A name referenced more than once (a library and a placeholder of the same name, two versions) is refused until kind ('library' / 'placeholder') or version says which ('#X' = the placeholder X). RemoveReference itself takes a name (and a library's version): which of a placeholder and a library of one name XAE removes is checked afterwards and said. Code that uses it does not build any more — said, nothing in the code is changed. Destructive-class: tc_request_confirmation(action='xae_library_remove', target=':' + ' ()' and ', ' when given).

Add a placeholder (AddPlaceholder) with its default library (library '' = the device's placeholder of that name; a library's missing distributor / version is completed as in xae_library_add). target=':'.

Set what a placeholder resolves to (SetEffectiveResolution): library, version ('' or '*' = newest), distributor (completed from the installed libraries when not given). The result checks the effective resolution after it. target=':=' + ', ' when given.

Freeze a placeholder (all when placeholder is left out) at the version it resolves to now (FreezePlaceholder): '' no longer follows newer installed versions. target=':' ('' for all).

Broadcast search for TwinCAT targets on the local network (UDP 48899): NetId, host name, TwinCAT version, IP — the same thing XAE's 'Broadcast Search' does.

Index HMI symbol bindings: TE2000 .view/.content/.usercontrol/.json (%s%PLC1.X%/s%) and TF1800 .TcVIS (VisualElemMember paths -> kind 'tcvis'; ST input-action assignments -> kind 'tcvis_write'). root defaults to project.hmi_root, else the project root (which is where .TcVIS files live).

Which HMI files/controls bind a PLC symbol (fnmatch on the symbol path).

Broken HMI bindings: symbols bound in the HMI that do not exist on the running PLC (and, with check_source, whether the source declares them), plus declared variables with no HMI.

A complete example experiment spec to edit (YAML text + the same as JSON): factors × levels, runs per level, preconditions, start/done conditions, measures (last/latency/pulses/settle/ dwell/edges/expr…), metrics (mean/std/cpk/p95), criteria, writes_allowed. kind: dosing_fill.

Validate a spec (YAML/JSON text, a dict, or a saved experiment by name): structure, measures, metrics, criteria, writes_allowed vs what the spec writes, the server guard's view of each write, symbol resolution on the connected PLC, planned run count and a duration estimate.

Save an experiment spec (YAML or JSON) under <experiments_dir>//spec.yaml. Runs already recorded for that name are kept; resume picks up where they stopped.

Experiments on disk with run counts, state and whether a report exists.

Spec, status and run summary of one experiment.

Run records: level, status, measures, recording ids, duration, error.

Run an experiment in the background: per level × repetition → preconditions → factor values written → snapshot → capture profile started → stimulus → start acknowledged (done_when must go false) → done_when → settle → stop → measures → runs.jsonl. Factor values are read first and restored at the end or on abort (read back and checked). Every write is re-checked against the server guard, pinned to the machine the experiment started on, and audited with symbol and value; a refusal, a target change or a timed-out write stops the experiment. dry_run resolves every symbol, coerces condition values (enum names → ints) and prints the plan without writing. Starting is control-class: in guarded mode it asks once (elicitation / confirm_token); in full mode it does not. Only one experiment may run at a time.

Live state of a running experiment: planned/done/failed, current level, ETA, last error, live recording ids. For an experiment from an earlier session, the persisted status.

Stop a running experiment after the current step; recordings are closed, factor values restored.

Metrics per level with 95 % CIs and the criteria verdicts (pass / fail / inconclusive with the run count that would settle it). Deterministic from runs.jsonl; rerunnable by anyone.

Write <experiments_dir>//report.md and report.html: identity (machine, TwinCAT version, project, git state, safety mode), criteria table, metrics per level, charts (primary measure per run; per-level mean/CI), run table, the spec, the audit log of writes during the run, and the interpretation — stored separately and labelled as not computed. interpretation= saves a new one (author=agent|operator|). firmware_check=true runs proj_vs_runtime first.

Two experiments with the same levels side by side: metric deltas and whether their 95 % CIs separate (the before/after question with error bars).

List the Infosys books (documentation sets) of the Help Viewer package installed with TwinCAT, with page counts — offline, one index of every book. pattern is a glob on the slug ('tcplclib_*', 'json'); category: plc-library | function-tf | engineering-te | twincat-system | hardware | other. TwinCAT 2 books are excluded.

The local Help Viewer index holds every book and is built as a whole (the first time by itself, later only with kb_rebuild(index='infosys') once the user approves) — this tool changes nothing here and says so; kb_status / tc_doctor show the index state.

Find library symbols (function blocks, functions, structs, enums, aliases, interfaces, GVLs) by name fragment in the local Help Viewer index; exact > prefix > contains. kind: FunctionBlock | Function | Program | Method | Property | Action | Enum | Struct | Union | Alias | Interface | GlobalVariable | Library. library: 'Tc2_System' or the book slug. Offline; while the index is still being built the answer says so.

Declaration of a library symbol as data: kind, inputs/outputs/in_out (name, type, default, description from the page's table), struct members, enum values, return type, EXTENDS / IMPLEMENTS, methods (name, definition location, description) and properties (type, access, initial value) of an FB, plus the ST declaration text and the page URL. The thing to call before writing code against an FB you have not used before. A name documented by different pages (two libraries, two methods of one name) is refused as ambiguous with the candidates — pass library=; one page in several books is one answer (same_page_in); also_in names the other libraries. A member as '.' (FB_WG_ComboFilter.Call): the page below that FB in the Help Viewer contents (Beckhoff titles a method page with its bare name); parent names the FB of a member. The twincat-docs skill's docs_declaration resolves names by the same rule.

Full-text search over the local Help Viewer index (FTS5, bm25-ranked, excerpt with [hits]); "quoted phrases" stay together, limit 1..50. Offline — no web search (web_fallback is ignored and said so); results carry the page's doc version and the package date.

Search the code examples of the indexed pages for a fragment — a call pattern, an attribute, a constant (case-insensitive substring of the code as written; non-breaking spaces count as spaces). language: one that occurs in the index (an unknown one is refused with the list), '' / 'none' = samples without a label. limit 1..50; total_matches says how many there are. ignore_spacing=true also matches when only the spacing around punctuation differs. Returns the matching lines with context and the page URL.

A documentation page as Markdown (headings, tables, fenced code), read from the local Help Viewer package — any page in it, indexed or not; doc version + breadcrumb included. ref: full Infosys URL, 'book/pageid', a bare page id, or a symbol name ('ADSREAD'). Offline. Use max_chars to keep it short.

Generate code from the runtime: fmt=csharp (explicit-offset structs + enums for Beckhoff.TwinCAT.Ads ReadAny/WriteAny), typescript (interfaces), json (type descriptions), or csharp_symbols (const symbol paths under prefix). types = struct/enum names; prefix = take the types of every symbol under it.

Write a saved snapshot back to the PLC (recipe / parameter restore). dry_run lists the differences only. Every differing symbol is gated like ads_write.

Structural validation of .TcPOU/.TcDUT/.TcGVL files: XML well-formedness, Name/Id, GUID format + project-wide uniqueness, Declaration/Implementation presence, property accessor VAR blocks, LineIds vs implementation line counts, EOF newline. fix=true applies safe fixes (.bak written); regenerate_lineids rebuilds LineIds blocks.

Windows event log of the target (Windows 7/10/11 IPCs): runs wevtutil on the IPC via the System Service, reads the result back and deletes the temp file. Also lists the event providers registered on the target whose name contains 'TwinCAT' or 'Beckhoff', so a provider that does not exist there (the default name differs between TwinCAT builds) is reported as such instead of an empty result. Not available on Windows CE / TC-BSD targets. Destructive-class because it starts a process on the IPC: confirm with tc_request_confirmation(action='ipc_eventlog', target=).

Markdown handover of this session: mode changes, writes, deploys and other mutating calls from the audit log, recordings, snapshots and dumps produced. Written to ~/.twincat_mcp/reports/.md (or out_path).

Read a file from the target IPC's file system over ADS (no share needed). Binary → base64. Prefer the OS-independent prefixes, which the target resolves itself: 'boot:' (the live TwinCAT boot folder — C:\ProgramData\Beckhoff\TwinCAT\3.1\Boot on 3.1.4026, \Hard Disk\TwinCAT\3.1\Boot on CE7), 'bootprj:', 'bootdata:', 'target:', 'config:', 'install:', 'user1:'..'user9:'. On 4026 the old absolute C:\TwinCAT\3.1\Boot still exists but is a stale legacy copy (e.g. a CurrentConfig.xml from years ago) — do not draw conclusions from it.

List files on the target matching a Win32 pattern. Prefer 'boot:*' (the live boot folder on any target OS; the result names the absolute folder in resolved_pattern) over a hard-coded 'C:\TwinCAT\3.1\Boot*', which is the stale legacy folder on 3.1.4026. Other prefixes: see ipc_read_file.

Write a file on the target IPC (text or base64). Control-class.

Delete a file on the target IPC. Destructive-class.

Start a process on the target IPC (NT_StartProcess equivalent). Destructive-class.

Reboot (or shut down) the target IPC via the System Service. Destructive-class.

Attach to the running XAE shell / Visual Studio (Running Object Table) that has the solution: solution_path when given (from then on every xae_* tool works on it — flagged solution_mismatch when it is not xae.solution_path), else xae.solution_path. A solution no shell has open is never replaced by another one (refused, or launch=true starts a shell with it); several shells with different solutions and none named or configured: refused. If the solution is closed later, every xae_* tool refuses until it is open again (in any shell — they find it by themselves).

Shell version, open solution, projects, TwinCAT project name, target NetId, started flag. Attaches to the shell first if not attached yet (as every xae_* tool does). solution_bound: the solution the xae_* tools work on; solution_mismatch / refused: it is not open (they refuse); reattached: it was found in a shell again.

Open a .sln in the attached shell.

Build the solution. save_first (default) runs File.SaveAll, saves whatever the shell still reports unsaved, and checks that every xae_pou_set / xae_pou_create edit of this session is in the source files — it refuses to build otherwise (an external reload would discard the edits). Returns success, error/warning items with file:line (VS error list, or parsed from the Build output pane) and the output tail. check_all_objects=true runs PLC 'Check all objects' instead (compiles unused POUs). After a build of 0 errors, link_check names the GVLs nothing in the source references (TwinCAT does not link them: no symbol on the target) unless they carry {attribute 'linkalways'}.

Current XAE Error List (errors/warnings/messages with file:line — TwinCAT's own entries too, read from the list view when the automation interface reports none; this focuses the Error List window) merged with the Build output pane, plus the pane's tail, without rebuilding. source names where each part came from.

List DTE command names containing a substring (to discover what this shell exposes).

Execute an arbitrary DTE command (e.g. 'PLC.Login'). Control-class; commands whose name contains download/reset/activate/restart/delete/remove/shutdown are destructive-class.

PLC online actions: login | logout | start | stop | reset_cold | reset_origin | download. First the Automation Interface (ConsumeXml online commands on ' Project' — no active project needed; plc_project_path when there are several PLC projects), then the shell's DTE commands (names vary by build). download/reset_cold/reset_origin are destructive-class, the rest control-class.

Get (net_id=None) or set the target AMS NetId of the TwinCAT project. Setting is control-class.

ActivateConfiguration on the current target (overwrites the boot project on the IPC). Destructive-class. Follow with xae_restart_twincat.

StartRestartTwinCAT on the current target (runtime restarts in RUN mode). Destructive-class.

Save → build → (boot project autostart on) → activate → restart, in one call. Stops at the first build error. Destructive-class (one confirmation covers all steps). Refuses when the XAE target and the ADS target of this server differ. Done = the target runs the new configuration: in RUN and a restart proven (steps.verify.transition_by): 'poll' (another state seen after the commands), 'mode_change' (it was not in RUN before the activation), 'witness' (task 1's cycle counter went back, or the PLC application's compile timestamp changed). In RUN without such proof is reported as that, not as 'not in RUN'.

System Manager tree item: properties, children to depth, and ProduceXml when xml=true. Path syntax 'TIPC^Plc^Plc Project^POUs^MAIN' (xae_plc_projects gives the ' Project' path; its children POUs/DUTs/GVLs are walked even though the node itself reports no ChildCount). Roots (ITcSysManager::LookupTreeItem shortcuts): TIIC (I/O Configuration), TIID (its I/O Devices), TIRC (Real-Time Configuration), TIRT (its Additional Tasks), TIRS (its Real-Time Settings), TIRR (its Route Settings), TIPC (PLC Configuration), TINC (NC Configuration).

ConsumeXml on a tree item — the generic write path for any configuration (add I/O boxes, link variables, set task cycle time, add project routes on TIRR …).

Set element texts in a tree item's XML by relative XPath, e.g. {'TaskDef/CycleTime': '10000'} (unit 100 ns).

Generic CreateChild (tree item types/subtypes per Infosys). For PLC objects prefer xae_pou_create.

Delete a tree item (POU, box, task …). Destructive-class; the confirmation names the item: tc_request_confirmation(action='xae_tree_delete', target='<parent_path>^').

PLC projects in the TwinCAT project with their tree paths (needed by PLCopen / boot tools).

Declaration/implementation text of a POU/DUT/GVL/interface tree item and its methods/properties/actions.

Replace declaration and/or implementation text of a POU item inside the live shell (no file round-trip, XAE keeps LineIds consistent). Build afterwards.

Create a PLC object under a folder/POU. kind = program | fb | function | method | property | action | transition | struct | enum | union | alias | gvl | interface | itf_method | itf_property | folder | parameter_list, and accessors on their own: property_get | property_set (under a property) | itf_property_get | itf_property_set (under an interface property). A property / itf_property is created with its accessors (accessors='get,set' default, 'get' or 'set'): without one it does not compile (C0373). return_type: function, method, property; access: PUBLIC | PRIVATE | PROTECTED | INTERNAL. Optional code is set after creation.

Import a PLCopen XML file into a PLC project (path from xae_plc_projects). option: none | rename | replace | skip (conflict handling). replace: the existing object keeps its place (folder) and identity and gets the imported text. TwinCAT's own replace deletes it and re-creates the import at the project root, so the file is imported as renamed copies (PRG_X_1, header renamed too) and the tool finishes the replace: the copy's header is named back, the texts are checked against the XML, written into the existing object, read back, and the declared name must equal the object's name. Only then is the copy — created by this import, it was not in the tree before — deleted (nothing that existed before the import is ever deleted). Anything not proven → nothing written, the copy kept and named in the error. An object that is not at its place after an import is named (removed / moved). Result: replaced, header_renamed, copies_removed, build_required + objects_to_build (build next).

Export PLC objects ('POUs.FB_X', 'DUTs.ST_Y' — folder.object) to a PLCopen XML file.

Boot project settings: set Autostart and/or GenerateBootProject (local, no activate unless activate_after_generate=true, which is then destructive-class).

Index the project tree (.sln/.tsproj/.plcproj/.TcPOU/.TcDUT/.TcGVL/.TcIO). incremental=true re-indexes only files whose mtime changed (fast after XAE saves).

Units whose source differs from a git revision (default: uncommitted work) plus untracked files — 'what did I change?'; pair with proj_vs_runtime for 'is it deployed?'.

List indexed objects. kind: PROGRAM | FUNCTION_BLOCK | FUNCTION | STRUCT | ENUM | UNION | ALIAS | GVL | INTERFACE | METHOD | PROPERTY | ACTION (case-insensitive).

Source of an object ('FB_Valve', 'FB_Valve.Open', 'MAIN'): declaration/implementation with file line numbers, parsed VAR declarations, sub-items.

Map an ADS symbol path (MAIN.fbFill.fbValve.bOpen) to the file:line where each hop is declared, following variable types through FB/STRUCT definitions. Hops inside a library type (Tc2_Standard.CTU.CV) are completed from the runtime's datatype table when the target is reachable. A first name declared in several PLC projects (MAIN in Plc1 and Plc2) is the one of the PLC project on the connected ADS port (AmsPort in the .tsproj).

Regex search over all declarations/implementations → unit, file, line, text.

Where a type/object is instantiated (variables of that type) and mentioned.

Raw text of a project file (relative to project root or absolute).

Write declaration/implementation back into the .TcPOU/.TcDUT/.TcGVL file (keeps the rest of the XML byte-identical, writes a .bak, drops the object's stale ). Use when XAE is closed or for batch edits; otherwise prefer xae_pou_set. Written also while the attached XAE has the project open — the result then says what that means (xae_open).

Parse a TcUnit xUnit result into a pass/fail summary. Source: the file on the target over ADS (default: configured remote path), a local file, or raw XML text.

Full TcUnit cycle: save (checked) → build → boot project autostart+generate → activate → restart → delete old result → wait for the xUnit file on the target → parse. Destructive-class (it activates a configuration on the target): tc_request_confirmation(action='tcunit_run', target=). plc_project_path from xae_plc_projects. TcUnit writes the result file only with its library parameter GVL_Param_TcUnit.xUnitEnablePublish = TRUE (default FALSE): the run is refused before anything is activated when the project source says FALSE, and stops waiting when the PLC reports FALSE (D40).