A lot of equipment on a plant floor doesn’t have a CNC style control at all, a packaging line, a conveyor, a press, an injection molding cell, and the data source there isn’t a machine tool API, it’s the CompactLogix or ControlLogix PLC running the line. Rockwell’s EtherNet/IP protocol reads by tag name straight out of the running program, no separate SDK, no third party OPC server. This guide covers connecting one, and the one decision that actually determines how much work it takes: whether the program uses named tags or bare numeric ones.
Before you start You’ll need the PLC’s IP address, either RSLinx, Studio 5000, or a tag browse to confirm which tag names you’re after, an Ethernet drop, a fixed IP, and the Spall gateway on the same network. The gateway reads only. It never writes to the controller.
1. The one thing that decides your setup cost
CompactLogix and ControlLogix (the Logix5000 family) support real symbolic tags, meaning the program itself gives its data human readable names: Line1.Status.Running, Program:MainProgram.Motor1_Speed. If your program was written that way, Spall reads those names directly. Point the connection at the PLC, browse the tag list, pick the ones you want, done. That’s the common case, and there’s no extra cost for it.
The other case is a program that never got named tags, an older project migrated forward, or one written against bare addressing out of habit. In that world you’re looking at raw numeric references instead of anything self describing. Reading those still works, EtherNet/IP doesn’t care, but somebody has to map what each one actually means before it’s useful, which is named, quoted work rather than a five minute browse. This is the single most common piece of paid setup work in this entire connection list, common enough that it’s worth knowing which situation you’re in before you quote a timeline internally.
2. Confirm the controller answers
EtherNet/IP explicit messaging listens on the industry standard port 44818. From a PC on the same network:
nc -vz 10.0.4.12 44818
-> Connection to 10.0.4.12 44818 succeeded!A refused connection here usually means a firewall or VLAN boundary between the machine network and the gateway, or the PLC’s Ethernet port is on a different subnet than expected, not a Spall problem, this test doesn’t touch Spall yet.
3. Confirm the tag names, or flag that you can’t
Open the project in Studio 5000, or browse tags with RSLinx if you don’t have the project file, and check whether the values you want (run status, cycle complete, part count, fault code) show up as real names. If they do, write them down exactly as shown, tag names are case sensitive and a UDT member path (Line1.Status.Running) has to be typed exactly. If what you’re looking at is bare addressing (N7:, B3:, F8:), that’s the PLC-5/SLC 500 style PCCC addressing, a different protocol entirely, covered by a separate connection path, not this one, flag it for us before the pilot call so we quote the right thing.
4. Add the source in Spall
In Spall, add the machine, choose Allen-Bradley (EtherNet/IP) as the source, and enter the PLC’s address:
10.0.4.12Assign the Spall gateway on that network and save.
5. Add a tag per value
For every point you want, add a tag with its exact symbolic name. An array or UDT member path (Line1.Status.Running) is entered the same way it appears in the project. If a name maps to a bare numeric tag instead, that’s the mapping work from Step 1, quoted before anyone starts, not a surprise on the invoice.
What Spall does with this data
Availability. A tag mapped to run status splits every hour into running, idle, and down, the same as a native CNC control’s run state.
Downtime and reasons. Each stop is caught the instant the mapped signal changes. Operators tag the reason, ranked into a Pareto the same way described in the downtime reason codes guide, whatever the connection method underneath.
Production. A tag mapped to part count drives target-vs-actual by shift and job.
Quality and OEE. Availability, performance, and quality still roll into one OEE view, dollar-ranked, whatever’s feeding it. See what OEE is and how it’s calculated for how those three numbers become the one that gets tracked.
One thing worth repeating Spall issues EtherNet/IP read requests only. It never writes a tag back to the controller, not a setpoint, not a reset bit, nothing. The gateway reads on your network and sends what it reads outbound over encrypted MQTT. No inbound port opens on your firewall, no VPN, no changes to the running program.
Quick recap
- Symbolic tags read directly, no extra cost. Bare numeric tags need mapping first, named work at the published day rate
- Confirm which situation you’re in before quoting a timeline, it’s the single biggest cost variable on this protocol
- Port 44818 is the standard EtherNet/IP port, confirm it answers before touching Spall’s side
- Add the PLC’s address, then a tag per symbolic name, exact case, exact path
- Every new tag lands in the Signal inbox unclassified until someone tells Spall what it means
If a program’s tag naming is a mess, or you’re not sure which situation you’re looking at, bring a screenshot of the tag browser to a pilot call. We’ll tell you which one it is before you’re stuck guessing.