Omron NJ/NX CIP 符号寻址——技术总结（实测）

来源：2026-08-12 Omron CIP 协议会话（真实 NJ/NX PLC 192.168.8.8:44818 联调验证）

实测覆盖范围

能力	用法	结果
基本类型 7 个	`read/write <IP> <标签名> <类型> <值>`，类型 BOOL/INT/UINT/DINT/UDINT/REAL/LINT/ULINT/LREAL	✅ 读写全通
STRING(256)	同上，类型 STRING（字符串加引号即可，中文 OK）	✅ 读写含中文通过
结构体	`结构体名.成员名`（如 `stuTest1.int16Test`），按 `.` 分段编码	✅ 成员读写 + 整读（连续内存）
一维数组	单元素 `数组名[索引]`；整读 `数组名[0] <元素数>`	✅ INT/REAL/BOOL 数组读写及整读 16 元素通过；STRING 数组不支持多元素读
二维数组	`数组名[行,列]`（整体符号名）；整读一行 `[0,0] <列数>`	✅ 读写全通，行主序连续
实时性	改值后下次读立即返回新值	✅

报文结构总览

封装层（每次请求都带，EtherNet/IP）

封装头(24B): [Command(2)][Length(2)][SessionHandle(4)][Status(4)=0][SenderContext(8)=0][Options(4)=0]
   Command: 0x0065=RegisterSession / 0x0066=UnRegisterSession / 0x006F=SendRRData
请求体(0x6F): [InterfaceHandle(4)=0][Timeout(2)=0][ItemCount(2)=2]
   Address Item:        [TypeID 0x0000(2)][Len 8(2)][8字节零]
   Unconnected Data:    [TypeID 0x00B2(2)][Len N(2)][CIP消息 N字节]

CIP 消息（0xB2 数据项内容，直接放 Read/Write Symbol，不套 0x52）

读(0x4C): [Service 0x4C][路径字数(1)][0x91 符号段...][元素数(2 小端)]
写(0x4D): [Service 0x4D][路径字数(1)][0x91 符号段...][类型码(2)][元素数(2)=01 00][值(小端)]
符号段:   [0x91][名字原始字节数(1)][名字 UTF-8][奇数字节补 0x00]
  - 长度字段=原始字节数，不是补零后长度（关键坑）
  - 结构体按 `.` 分段，每段一个 0x91；`[索引]` 不拆段，整体作为名字

响应（0x6F 响应体，同样在 0xB2 数据项内）

CIP响应: [Service][Reserved=0][GeneralStatus][AdditionalStatusSize][AdditionalStatus...][数据]
  Service: 0xCC=读响应(0x4C|0x80) / 0xCD=写响应(0x4D|0x80)
  GeneralStatus: 0=成功；4=路径未知(标签不存在/名字编码错)；5=路径段错误(位访问等)；
                  13=数据太多(0x52 包装)；31=服务错误(BOOL 写 1 字节)；32=目标不可达(整读裸数组名/STRING 数组多元素)
  读数据: [类型码(2 小端)][值]；写数据: 无

数据类型码

类型	码	值字节数	类型	码	值字节数
BOOL	0xC1	2(单元素读/结构体)/1(数组整读)	USINT	0xC6	1
BYTE	0xC2	1	UINT	0xC7	2
INT	0xC3	2	UDINT	0xC8	4
DINT	0xC4	4	ULINT	0xC9	8
LINT	0xC5	8	REAL	0xCA	4
LREAL	0xCB	8	STRING	0xD0	长度前缀(2)+内容
结构体	0x02A0(672) 等	成员连续内存

各类型读写报文示例（[SH]=运行时 SessionHandle，每请求前需 RegisterSession 握手）

读 BOOL（boolTest）

内嵌消息（0xB2 数据项，14 字节）：

4C 05 91 08 62 6F 6F 6C 54 65 73 74 01 00

完整请求（62 字节）：

6F 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 0E 00
4C 05 91 08 62 6F 6F 6C 54 65 73 74 01 00

响应 CIP 数据（0xB2 项，8 字节）：

CC 00 00 00 C1 00 00 00

完整响应（56 字节）：

6F 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 08 00
CC 00 00 00 C1 00 00 00

boolTest=false → 响应值 2 字节 00 00；类型码 0xC1=BOOL。单元素读 BOOL 返回 2 字节（值+padding）。

读 INT（int16Test）

内嵌消息（0xB2 数据项，16 字节）：

4C 06 91 09 69 6E 74 31 36 54 65 73 74 00 01 00

完整请求（64 字节）：

6F 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 10 00
4C 06 91 09 69 6E 74 31 36 54 65 73 74 00 01 00

响应 CIP 数据（0xB2 项，8 字节）：

CC 00 00 00 C3 00 DA E9

完整响应（56 字节）：

6F 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 08 00
CC 00 00 00 C3 00 DA E9

int16Test=-5670 → DA E9（小端 0xE9DA=-5670）；类型码 0xC3=INT。奇数长度名字（9B）必须补 0，且长度字段填 9。

读 UINT（uint16Test）

内嵌消息（0xB2 数据项，16 字节）：

4C 06 91 0A 75 69 6E 74 31 36 54 65 73 74 01 00

完整请求（64 字节）：

6F 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 10 00
4C 06 91 0A 75 69 6E 74 31 36 54 65 73 74 01 00

响应 CIP 数据（0xB2 项，8 字节）：

CC 00 00 00 C7 00 01 B0

完整响应（56 字节）：

6F 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 08 00
CC 00 00 00 C7 00 01 B0

uint16Test=45057 → 01 B0（小端 0xB001=45057）；类型码 0xC7=UINT。

读 REAL（realTest）

内嵌消息（0xB2 数据项，14 字节）：

4C 05 91 08 72 65 61 6C 54 65 73 74 01 00

完整请求（62 字节）：

6F 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 0E 00
4C 05 91 08 72 65 61 6C 54 65 73 74 01 00

响应 CIP 数据（0xB2 项，10 字节）：

CC 00 00 00 CA 00 00 00 48 41

完整响应（58 字节）：

6F 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 0A 00
CC 00 00 00 CA 00 00 00 48 41

realTest=12.5 → IEEE754 0x41480000 小端 00 00 48 41；类型码 0xCA=REAL。

读 DINT（dint32Test）

内嵌消息（0xB2 数据项，16 字节）：

4C 06 91 0A 64 69 6E 74 33 32 54 65 73 74 01 00

完整请求（64 字节）：

6F 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 10 00
4C 06 91 0A 64 69 6E 74 33 32 54 65 73 74 01 00

响应 CIP 数据（0xB2 项，10 字节）：

CC 00 00 00 C4 00 00 00 00 00

完整响应（58 字节）：

6F 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 0A 00
CC 00 00 00 C4 00 00 00 00 00

dint32Test=0 → 4 字节小端；类型码 0xC4=DINT。

读 LREAL（lrealTest）

内嵌消息（0xB2 数据项，16 字节）：

4C 06 91 09 6C 72 65 61 6C 54 65 73 74 00 01 00

完整请求（64 字节）：

6F 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 10 00
4C 06 91 09 6C 72 65 61 6C 54 65 73 74 00 01 00

响应 CIP 数据（0xB2 项，14 字节）：

CC 00 00 00 CB 00 C9 76 BE 9F 1A 2F D5 3F

完整响应（62 字节）：

6F 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 0E 00
CC 00 00 00 CB 00 C9 76 BE 9F 1A 2F D5 3F

lrealTest=0.331 → 8 字节 IEEE754 双精度小端 C9 76 BE 9F 1A 2F D5 3F（实测）；类型码 0xCB=LREAL。

读 STRING（strTest）

内嵌消息（0xB2 数据项，14 字节）：

4C 05 91 07 73 74 72 54 65 73 74 00 01 00

完整请求（62 字节）：

6F 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 0E 00
4C 05 91 07 73 74 72 54 65 73 74 00 01 00

响应 CIP 数据（0xB2 项，24 字节）：

CC 00 00 00 D0 00 10 00 61 73 64 66 76 7A 64 73
66 61 2D 61 33 33 32 61

完整响应（72 字节）：

6F 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 18 00
CC 00 00 00 D0 00 10 00 61 73 64 66 76 7A 64 73
66 61 2D 61 33 33 32 61

strTest="asdfvzdsfa-a332a" → 响应值=长度前缀(2B 小端) 10 00 + UTF-8 内容 16 字节；类型码 0xD0=STRING。

写 INT（int16Test = -12345）

内嵌消息（0xB2 数据项，20 字节）：

4D 06 91 09 69 6E 74 31 36 54 65 73 74 00 C3 00
01 00 C7 CF

完整请求（68 字节）：

6F 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 14 00
4D 06 91 09 69 6E 74 31 36 54 65 73 74 00 C3 00
01 00 C7 CF

响应 CIP 数据（0xB2 项，4 字节）：

CD 00 00 00

完整响应（52 字节）：

6F 00 1C 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 04 00
CD 00 00 00

写响应只有 CD 00 00 00（0xCD=0x4D|0x80），无数据区。写请求数据=类型码 C3 00 + 元素数 01 00 + 值 C7 CF（-12345 小端）。

写结构体 BOOL（stuTest1.boolTest = true）

路径=stuTest1(8B)+boolTest(8B) 两段 0x91

内嵌消息（0xB2 数据项，28 字节）：

4D 0A 91 08 73 74 75 54 65 73 74 31 91 08 62 6F
6F 6C 54 65 73 74 C1 00 01 00 01 00

完整请求（76 字节）：

6F 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 1C 00
4D 0A 91 08 73 74 75 54 65 73 74 31 91 08 62 6F
6F 6C 54 65 73 74 C1 00 01 00 01 00

响应 CIP 数据（0xB2 项，4 字节）：

CD 00 00 00

完整响应（52 字节）：

6F 00 1C 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 04 00
CD 00 00 00

结构体成员路径按 . 分两段编码。BOOL 写必须 2 字节 01 00（只发 1 字节报 GS=31）。

写 STRING（strTest = "hello"）

内嵌消息（0xB2 数据项，23 字节）：

4D 05 91 07 73 74 72 54 65 73 74 00 D0 00 01 00
05 00 68 65 6C 6C 6F

完整请求（71 字节）：

6F 00 2F 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 17 00
4D 05 91 07 73 74 72 54 65 73 74 00 D0 00 01 00
05 00 68 65 6C 6C 6F

响应 CIP 数据（0xB2 项，4 字节）：

CD 00 00 00

完整响应（52 字节）：

6F 00 1C 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 04 00
CD 00 00 00

STRING 写值=长度前缀 05 00 + hello。

读数组元素（aint16Test[3]）

内嵌消息（0xB2 数据项，20 字节）：

4C 08 91 0D 61 69 6E 74 31 36 54 65 73 74 5B 33
5D 00 01 00

完整请求（68 字节）：

6F 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 14 00
4C 08 91 0D 61 69 6E 74 31 36 54 65 73 74 5B 33
5D 00 01 00

响应 CIP 数据（0xB2 项，8 字节）：

CC 00 00 00 C3 00 C8 01

完整响应（56 字节）：

6F 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 08 00
CC 00 00 00 C3 00 C8 01

aint16Test[3]=456 → C8 01。[3] 整体并入符号名（13B 奇数补 0），不拆 Element 段。

读数组整读（aint16Test[0]，16 个元素）

内嵌消息（0xB2 数据项，20 字节）：

4C 08 91 0D 61 69 6E 74 31 36 54 65 73 74 5B 30
5D 00 10 00

完整请求（68 字节）：

6F 00 2C 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 14 00
4C 08 91 0D 61 69 6E 74 31 36 54 65 73 74 5B 30
5D 00 10 00

响应 CIP 数据（0xB2 项，38 字节）：

CC 00 00 00 C3 00 00 00 00 00 2C 00 C8 01 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00

完整响应（86 字节）：

6F 00 3E 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 26 00
CC 00 00 00 C3 00 00 00 00 00 2C 00 C8 01 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00

请求数据区元素数=10 00(16)；响应返回 16×2=32 字节连续 INT 值（第 4 个 456 是之前写入的）。裸数组名不带 [0] 整读会报 GS=32。

读二维数组（aaboolTest[0,1]）

内嵌消息（0xB2 数据项，22 字节）：

4C 09 91 0F 61 61 62 6F 6F 6C 54 65 73 74 5B 30
2C 31 5D 00 01 00

完整请求（70 字节）：

6F 00 2E 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 16 00
4C 09 91 0F 61 61 62 6F 6F 6C 54 65 73 74 5B 30
2C 31 5D 00 01 00

响应 CIP 数据（0xB2 项，8 字节）：

CC 00 00 00 C1 00 01 00

完整响应（56 字节）：

6F 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 08 00
CC 00 00 00 C1 00 01 00

aaboolTest[0,1]=true → 01 00。[行,列] 整体并入符号名（15B 奇数补 0），Omron 自行解析。

读结构体成员（stuTest1.int16Test）

内嵌消息（0xB2 数据项，26 字节）：

4C 0B 91 08 73 74 75 54 65 73 74 31 91 09 69 6E
74 31 36 54 65 73 74 00 01 00

完整请求（74 字节）：

6F 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 1A 00
4C 0B 91 08 73 74 75 54 65 73 74 31 91 09 69 6E
74 31 36 54 65 73 74 00 01 00

响应 CIP 数据（0xB2 项，8 字节）：

CC 00 00 00 C3 00 DA E9

完整响应（56 字节）：

6F 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 08 00
CC 00 00 00 C3 00 DA E9

路径=stuTest1(8B)+int16Test(9B 补 0) 两段 0x91，值为 -5670。

读整个结构体（stuTest1）

内嵌消息（0xB2 数据项，14 字节）：

4C 05 91 08 73 74 75 54 65 73 74 31 01 00

完整请求（62 字节）：

6F 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 0E 00
4C 05 91 08 73 74 75 54 65 73 74 31 01 00

响应 CIP 数据（0xB2 项，296 字节）：

CC 00 00 00 A0 02 3A E9 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

完整响应（344 字节）：

6F 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00
00 00 08 00 00 00 00 00 00 00 00 00 B2 00 28 01
CC 00 00 00 A0 02 3A E9 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

响应类型码 672=0x02A0（Omron 自定义结构体码），值=290 字节连续内存。

关键协议要点

不能用 0x52 Unconnected Send 包装：Omron 返回 GeneralStatus=0x13（数据太多）。Read Symbol(0x4C)/Write Symbol(0x4D) 消息必须直接作为 0xB2 Unconnected Data Item 的内容发送（封装层仍用 0x6F SendRRData）。
符号段 0x91 长度字段 = 原始名字字节数，名字数据才补 0x00 到偶数对齐。若长度填了填充后的值，奇数长度标签会被 Omron 把填充字节当名字一部分 → 报 GS=4（路径未知，表面像"标签不存在"）。偶数长度标签不受影响。
数组/索引访问：整个带 [] 的名字直接作为符号段（如 aint16Test[0]、二维 aaboolTest[0,1]），Omron 自行解析索引，无需 Element 段。整读需带起始索引（arr[0]）+ 请求元素数 N，返回 N 个元素连续字节；裸数组名整读报 GS=32 + 附加状态 17-80。
结构体路径按 . 分段：每段一个 0x91 符号段（各自长度+补偶）。整读结构体返回连续内存（Omron 自定义类型码如 672=0x02A0），成员读写用成员类型码。
STRING 格式：读写都是 长度前缀(2字节小端) + UTF-8 内容（如 05 00 68 65 6C 6C 6F=hello），长度不用补偶，中文 UTF-8 正常。
BOOL 按 2 字节存储：结构体成员/单元素读返回 xx-00，写必须发 2 字节（如 01 00），只发 1 字节报 GS=31（0x1F）。BOOL 数组整读每元素 1 字节紧凑排列。
STRING 数组不支持多元素读（GS=32 + 18-80），只能逐个单元素读。
位访问不支持：CIP 通讯层读 字[位号]（如 uint16Test[0]）无论整体符号名还是 Element 段都报 GS=5（路径段错误）；只能整字读回后自行拆位。
不支持枚举符号/结构体成员（Get Symbol Info 0x4E / List Symbols 0x4F 均失败）——只能按名字访问或整读内存。
连接要求：读写都不需要 Forward Open / Connected Message；RegisterSession(0x65) 握手正常，SessionHandle 在封装头 offset 4；封装头 24 字节 Command(2)+Length(2)+SessionHandle(4)+Status(4)+SenderContext(8)+Options(4)。
只读全局变量：只有全局变量表里的变量可访问，程序（POU）局部变量不行。