2026-09-30 17:29:48 +10:00
7 changed files with 485 additions and 8 deletions
--- a/.claude/skills/system-management/tasks/tuning-checks.md
+++ b/.claude/skills/system-management/tasks/tuning-checks.md
@ -37,8 +37,20 @@ Read the newest entries:
 Test system (2026-09-30): common memory 665.6 MB, free 665.3 MB; queues empty; 3 lock
 collisions in total.
 ## Live values from the interactive debuggers (read-only)
 The debuggers ask for a code; pipe the answers in and end with `-1` (exit). Use only the
 read-only codes listed in the manual summaries:
 | Command | Shows | Reference |
 |---|---|---|
 | `printf '2\n-1\n' \| itmdbg` | item common size/free, number of items, integration granule, update counters | `knowledge/manuals/IM36K10L36-01EN.md` §4 |
 | `printf '1\n-1\n' \| eqpdbg 0 <EQP process>` | equipment manager: lines attached, scan tick, slave count, line load % | `knowledge/manuals/IM36K10L40-01EN.md` §3 |
 Verified 2026-09-30 (bash). Other codes change the running system (delete items, unlock,
 update scan status); do not use them without the user's approval.
 ## Not yet practiced
-Debug launchers (`jwuipoi_debug`, `jhmiset_debug`, …), interactive debuggers (`itmdbg`,
+Debug launchers (`jwuipoi_debug`, `jhmiset_debug`, …), other debuggers (`opcdbg`, `ithdbg`,
-`opcdbg`, `eqpdbg`, …), and per-process debug settings; see
+…), and per-process debug settings; see `knowledge/manuals/IM36K10J10-01EN.md` §5.5.2.
 `knowledge/manuals/IM36K10J10-01EN.md` §5.5.2.
--- a/knowledge/issues.md
+++ b/knowledge/issues.md
@ -24,7 +24,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
 | ISS-004 | 2026-09-30 | ITEM (`itmval`) | `itmval -g -a <1..5>` returns `ITM-E-WRONG_ATT` on `AID.WRPS.*` items, so reading limits is unproven. | closed | Closed 2026-09-30 (confirmed by user). On `CI-Eng-Sample.TANK1.LEVEL` (limits set) `-a 1..5` returned deadband 0, low 20, high 80, low-low 10, high-high 90. The error only occurs on items without limits. | `.claude/skills/system-management/tasks/read-write-item.md` (limits section); `knowledge/progress.md` row "Read an item with `itmval -g`" |
 | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
-| ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
+| ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. 2026-09-30 (phase 5): IM 36K10L35 §1.3/§5 explains the first part: event storage picks the unit by time stamp, never older than 60 units, and within the storage process's `gap_time` (ITHEEX/ITHEIX 2880 min) and, for EVENT/ITEM, `max_sample_delay` (ITHEIX 14400 min); older data needs earlier unit files (`hisdbg`, `hisrecover`, `isfrename`), `ithrecover <group> -p` and a restart. Practice in phase 9. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
 | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
 | ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill |
 | ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
@ -40,3 +40,6 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-018 | 2026-09-30 | Authorization (`dssana.sup`) | IM 36K10C10 §2.2 says the *No* login method applies the user profile `FT_NO_LOGIN`; the installed `dssana.sup` names `CI_NO_LOGIN` (and `CI_NO_LOGIN_OPCUAS` for anonymous OPC UA) as the no-login profile. `USER_DF` on the test system has `CI_NO_LOGIN_OPCUAS` but no `CI_NO_LOGIN`. | open | Installed software is the reference: use `CI_NO_LOGIN`. Still to check: behaviour of a *No* login when that user does not exist (manual: no profile applied). Covered again in phase 13 (IM 36K10J40). | `knowledge/manuals/IM36K10C10-01EN.md` §2 |
 | ISS-019 | 2026-09-30 | ITEM (string items) | Maximum string item length differs by source: IM 36K10C10 §3.3.4 says default 80, max 100; the Tutorial summary says up to 168 without audit; the data dictionary (`dssqld -f`) gives `ITEM_DF.STRING_LENGTH` range 1–200, default 80. | closed | Tested 2026-09-30 on CI-Eng-Sample (`dssqld -i`, `itmval -p/-g`, non-elevated): `STRING_LENGTH` 100, 168 and 200 load with or without `AUDIT_INFO`; 201 fails with `DSS-E-VAL_RANGE`. An item holds **length − 1** characters: a 99-character value in a length-100 item is stored with status 9 NORMAL; longer values are cut to length − 1 with status **12 OVERRANGED** (100 → 99, 200 → 199, 201 → 199). So the data dictionary (1–200) is right. Test items removed. Closed 2026-09-30 (confirmed by user). | `knowledge/manuals/IM36K10C10-01EN.md` §3; `knowledge/manuals/IM36K10G10-01EN.md` (items); `.claude/skills/item-engineering/SKILL.md` |
 | ISS-020 | 2026-09-30 | DATABASE (`dssqld`) | `dssqld -i "<long absolute path>\user.qli"` failed with `CRL-E-ENOENT` / `DSSQ-E-QLD_FILOPN`: the path in the message was cut after 79 characters (`…\73b3559a-12.`). A relative file name from the same folder works. Similar to the `intspawn` path limit (ISS-007). | open | Find the exact limit (79/80 characters?) and whether `-l` and `-e` paths are also cut. Until then: `cd` to the folder and use short relative names. | `.claude/skills/system-management/tasks/load-remove-records.md`; `.claude/skills/system-management/tasks/export-dataset.md` |
 | ISS-021 | 2026-09-30 | EQUIPMENT (`eqpiostat`) | IM 36K10L40 §2 says `eqpiostat` stores hourly I/O statistics per station line in "history group STATION_STAT". On the test system `eqpiostat` runs (started by `equipment_start.cmd` on the host node) and `STATION_STAT` is a dataset, but `dssqld -e` returned 0 records, also with filters on `TIME_STAMP` and `STATION` (AID Modbus stations, which send requests). | open | Check whether records appear after a full hour with a communicating station, or whether the dataset is read another way (e.g. Engineering Module, report). | `knowledge/manuals/IM36K10L40-01EN.md` §2 |
 | ISS-022 | 2026-09-30 | ITEM (`itmval -f`) | `itmval -f <file> vs -n CI-Eng-Sample.TANK1.LEVEL` (IM 36K10L36 §1.4, write a restore command) crashes with a segmentation fault (bash) / access violation 0xC0000005 (PowerShell) and writes no file; also with `-l`. The manual's space-separated form `-n <inst> <unit> <tag>` is rejected with `FSL-E-NARG_ALL`. `itmval -g`/`-p` work. | open | Workaround: build restore lines from `itmval -g` output. Report to Yokogawa support if needed. | `knowledge/manuals/IM36K10L36-01EN.md` §3; `.claude/skills/system-management/tasks/read-write-item.md` |
 | ISS-023 | 2026-09-30 | ITEM / ITH (manual vs install) | Installed ITEM Service differs from IM 36K10L35/L36: `item_start.cmd` starts `itheix` (EVENT/ITEM storage, not described), aggregation `ithsag`/`ithrag`, two instances of each retrieve process, and `itmtim 100 1000 1 200 1` (five arguments, three documented); `itm.sup` item pool is 650000 KB (manual default 50000) and has `not_regained` (not described); `itheix.sup` has `max_sample_delay`, `max_samples_queued`, `max_open_files`. | closed | Closed 2026-09-30 (user decision: the installed software is the reference). Summaries describe the installed values. | `knowledge/manuals/IM36K10L35-01EN.md`; `knowledge/manuals/IM36K10L36-01EN.md` |
--- a/knowledge/manuals/IM36K10L35-01EN.md
+++ b/knowledge/manuals/IM36K10L35-01EN.md
@ -0,0 +1,103 @@
 ---
 manual: IM 36K10L35-01EN
 title: ITEM Service Engineering - ITH
 edition: 3rd Edition, Sep. 2023
 version: R1.03
 status: from docs; installed ITH processes (item_start.cmd), setup files itheex.sup and itheix.sup checked read-only on the test system (2026-09-30); ithloahis practiced in phase 1
 ---
 # ITEM Service Engineering - ITH (R1.03)
 ITH is the item-history part of ITEM Service: it gathers item values from ITM and stores and
 retrieves them for the storage (history) groups that HISTORY Service manages. Section numbers
 refer to the manual. Storage groups themselves: phase 9 (IM 36K10L20, C40).
 ## 1. Processes and data (§1)
 - **Collection/storage types** and their processes:
 | Group type (collection/storage) | Store process | Retrieve process |
 |---|---|---|
 | SCAN / TIME | `ITHSTX` (more: `ITHST2`…, setup key `task`) | `ITHRTT` |
 | SCAN / ITEM | `ITHSIX` | `ITHRTI` |
 | EVENT / EVENT | `ITHEEX` | `ITHRTE` |
 | EVENT / ITEM | `ITHEIX` (not described in the manual; used by CI-Eng-Sample `CIENG_EVENT`) | `ITHREI` |
 | DIRECT / EVENT (values from applications, e.g. an equipment manager reading history from the field) | `ITHSDE` | `ITHRDE` |
 | DIRECT / ITEM | `ITHSDI` | `ITHRDI` |
 - `ITHSER`: one per node (normally the host). Group definition (with HIS) and retrieval:
  finds the item's groups, picks the **highest-priority** group, finds the first unit in the
  time window and hands the request to a retrieve process. Keeps the item directory.
 - `ITHDBG` debugger, `ITHRECOVER` repair.
 - Start/stop lists: `tls\com\item_start.cmd` / `item_stop.cmd`; processes for unused types can
  be removed there. **Installed R1.03 start list**: `ithser`, `itheex`, `itheix`, `ithstx`,
  `ithsde`, aggregation `ithsag` and retrieve processes in **two instances each**
  (`ithrte00/01`, `ithrei00/01`, `ithrag00/01`, `ithrtt00/01`, `ithrde00/01`). Not started:
  `ithsix`, `ithrti`, `ithsdi`, `ithrdi`.
 **Files** (in the history/data folders; do not delete):
 - `ith_itmdir.dat` item directory (item, id, time window, group, priority).
 - Group description `hnnggg000000.dat`, unit descriptions `hnnggguuu000.dat` (a new one on
  every group change, so old compositions stay readable), unit data `hnnggguuuddd.dat` (a new
  one at each start/rollover). `nn` node, `ggg` group, `uuu` unit, `ddd` data sequence.
 - Record layouts: time-based (one scan of many items per record, split into file groups),
  item-based (many scans of one item), event-based (one event per record). **Events older
  than 60 units cannot be stored.**
 ## 2. Setup files (§2)
 Each process reads `<process name>.sup` (missing → error in `umhlog`).
 - `ithser.sup`: `agg_hour_method` (hourly aggregate labelled by start or end of hour, default
  start), `his` (HIS address), `con_timeout` (group configuration lock, default 8 min),
  `his_path`, `sh_path` (default history and shadow paths), `his_mod` (allow modifying
  `ITEM_HISTORY` data via the API).
 - `ithstx.sup` / `ithsix.sup`: `his`, `task`, `run_interval` (heartbeat, ≤ 1/10 of the
  shortest scan interval), `max_recsize`, `itms_a_rscan`/`itms_a_dscan` (items per ITM
  lock, ~50), `itms_a_rrun`/`itms_a_drun` (items per heartbeat, limits CPU peaks),
  overheads; ITHSIX also `max_total_buf`, `max_grp_buf` (memory in 28-byte blocks).
 - `itheex.sup` (test system values): `run_interval = 600` s, `buffer_size = 10` events,
  `event_timeout = 1` s, **`gap_time = 2880` min**, `queue_size = 750` KB, optional
  `overflow_item` (counts/toggles on queue overflow).
 - `itheix.sup` (not in the manual; test system): `run_interval = 60`, `buffer_size = 20`,
  `event_timeout = 1`, **`gap_time = 2880` min**, **`max_sample_delay = 14400` min**,
  `max_samples_queued = 25` (million), `max_open_files = 10`, `queue_size = 2000`.
 - `ithsde.sup` / `ithsdi.sup`: `his`, `task`, `max_open_files` (10), `max_recsize` (4000),
  `gap_time` (60 min).
 ## 3. `ithrecover` (§3)
 `ithrecover <group | "*"> [-v] [-p]` repairs the relations between item definitions, group
 descriptions, the item-in-use list and the item directory (trusting item definitions and group
 descriptions). Needs HISTORY Service and ITHSER running, no group configuration in progress.
 `-p` extends the item directory into the past for history migration (advanced; with product
 support).
 ## 4. `ithdbg` (§4)
 Menu: 1 group contents, 2 item directory, 3 unit data file dump, 4–18 global/group info of
 each ITH process, 20 retrieve history, 80 stop a process, 90 log to file, −1 exit. Group names
 are case-sensitive.
 ## 5. `ithloahis` item history loader (§5)
 `ithloahis -f <file> [-v] [-l] [-i] [-s <section>] [-t GMT|LST|LCT]` loads CSV history into
 EVENT/EVENT and EVENT/ITEM groups (not SCAN). Groups and items must exist. `-i` also writes
 the value to the item (e.g. to trigger alarms). Formats: `SCAN, item1, item2` header then
 `time, v1, v2` rows (blank = no sample), or `EVENT` header then `time, item, value` rows.
 Time as `29-Apr-14 11:48:17.452`, `29-04-2014 11:48:18.452` or UTC seconds. Practiced: skill
 `system-management`, task `load-history.md`.
 **Loading older history (migration)**:
 1. Raise `gap_time` in `itheex.sup` (EVENT/EVENT) or `gap_time` and `max_sample_delay` in
   `itheix.sup` (EVENT/ITEM) beyond the age of the oldest sample (5 years ≈ 2,628,000 min);
   note the old values; restart CI Server.
 2. Create the group, add all items, start it immediately.
 3. Create earlier unit files: `hisdbg` option 3 for unit info; copy unit files to
   `%TLS_HIS_PATH%\has`, delete the unit (`hisdbg` 4), copy back, set times with
   `hisrecover <unit>.his "<start LCT>" "<end LCT>"`, create the next with `isfrename`,
   repeat until the original second unit's start time.
 4. `ithrecover <group> -p`, restart CI Core.
 5. `ithloahis -f <file>`.
 6. Restore the setup values and restart.
 This explains why samples older than the current unit were not stored in phase 1
 (`knowledge/issues.md` ISS-006). From an older CI Server version use `ITHIMPORT` instead.
--- a/knowledge/manuals/IM36K10L36-01EN.md
+++ b/knowledge/manuals/IM36K10L36-01EN.md
@ -0,0 +1,81 @@
 ---
 manual: IM 36K10L36-01EN
 title: ITEM Service Engineering - ITM
 edition: 3rd Edition, Sep. 2023
 version: R1.03
 status: from docs; itm.sup, item_start.cmd and itmdbg statistics checked on the test system (2026-09-30); itmval -g/-p verified in phase 1; itmval -f crashes (ISS-022)
 ---
 # ITEM Service Engineering - ITM (R1.03)
 ITM is the real-time item database (item common, shared memory). Section numbers refer to the
 manual.
 ## 1. Processes (§1.1–1.2)
 | Process | Role |
 |---|---|
 | `ITM` | item handler, message interface |
 | `ITMTIM` | sends buffered item events; recalculates integrators |
 | `ITMCPM` / `ITMCPS` | item copy master / slave for distributed items between nodes (buffered, compressed; after a lost MDUR link it rescans all or only changed master items in limited batches). Restart `ITMCPM` after deleting a distributed group. |
 | `ITMLIMUPD` | copies limit/deadband changes to other nodes |
 | `ITMREM` | cleans up event requests of processes that disappeared |
 | `itmval` | command-line get/put |
 `itmtim [<period ms, default 100>] [<integration step ms, default 1000>] [<save count>]`:
 save count = integrators saved to disk per recalculation. **Installed** `item_start.cmd`
 starts `itmtim 100 1000 1 200 1` (five arguments; the last two are not documented). Also
 started: `itmaah`, `intitmini`, `itmlimupd`, `itmrem`.
 ## 2. `itm.sup` (§1.3)
 | Setting (keyword) | Manual default | Test system |
 |---|---|---|
 | Queue size (`queue_size`) | 200 KB | 200 |
 | Save items (`item_save`): ITEM_BASE (per item's *remember last value*), ALWAYS, NEVER | ITEM_BASE | ITEM_BASE |
 | Max item groups (`max_groups`) | 255 | 255 |
 | Max items per group (`max_number`) | 65534 (255 × 65534 = 16,711,170 items) | 65534 |
 | Max application info per item (`max_appl_info`) | ≤ 20 bytes always fits | 0 |
 | Max update info per item (`max_upd_info`) | 512 | 512 |
 | Item pool size (`pool_kbytes`), guide `0.07 × groups × items + appl KB × groups × items + 10` | **50000 KB** | **650000** |
 | Integration granule (`itm_int_secs`), system-wide integrator time unit | 1 s | 1 (60 tested, ISS-010) |
 | Lock timeout (`lock_timeout_secs`) | 60 s | 60 |
 | Save to disk (`disk_save`) | YES | yes |
 | Not regained (`not_regained`): after start, mark possibly stale values until the first update; hidden in trends | not described | no (default block) |
 ## 3. `itmval` (§1.4)
 ```
 itmval -g [-l] -n <item>
 itmval -p [-l] -n <item> [-v <value>] [-s <status>] [-q <quality>] [-o] [-t [<date>] <time> [GMT|LST]]
 itmval -f <file> <vsqo> [-l] -n <item>
 ```
 `-l` = use this node instead of the host; `-o` = overwrite a blocked item; `-t` = update time
 (default local time). `-f` should append an `itmval -p …` restore line with the chosen parts
 (value, status, quality, options) to a command file, but on the test system it **crashes**
 (segmentation fault / access violation) and writes nothing (ISS-022). The manual's
 space-separated name form (`-n <inst> <unit> <tag>`) is rejected ("no (extra) command line
 arguments allowed"); use the dotted full name. Practiced: skill `system-management`, task
 `read-write-item.md`.
 ## 4. `itmdbg` (§2)
 Start `itmdbg`, then a code; answers can be piped, e.g. read-only statistics:
 `printf '2\n-1\n' | itmdbg`.
 | Code | Shows / does |
 |---|---|
 | 1 | main info (root pointers, criterion and event request bits) |
 | 2 | statistics: common size/free/fragments, configured limits, **nr of items**, integration secs, save mode, counters (item/sub-item updates, gets, buffered events, automatic saves, flow control) since system start and since debugger start |
 | 3 / 4 | item / sub-item info by group and sequence number (value, status, options, limits, update times, name) |
 | 5–11 | action blocks, main actions, task table (event requesters), event buffers, mask info (criterion bits: 1 FIRST, 2 EACH, 4 VAL, 8 STA, 10 DEL, …), item pointers, last update |
 | 12 | unlock item data area (after a killed process; if pointers were being changed, restart ITEM Service) |
 | 13 | save all item info to disk (before a shutdown, for a clean warm restart) |
 | 14, 15, 17, 18 | flow control, integrator list, locked items, group–node relation |
 | 16 | **delete item** from the in-core database (test/repair only) |
 | 19 / 20 | most frequently updated items (10–1000) / reset those counters |
 Test system (`itmdbg` code 2): common 665,600,000 bytes, free 665,307,508, 203 items,
 integration 1 s, save mode item base. The same numbers appear in the automatic snapshots
 `smd_*_itmdbg_all.log` (skill `system-management`, task `tuning-checks.md`).
--- a/knowledge/manuals/IM36K10L40-01EN.md
+++ b/knowledge/manuals/IM36K10L40-01EN.md
@ -0,0 +1,85 @@
 ---
 manual: IM 36K10L40-01EN
 title: EQUIPMENT Service Engineering - Utilities
 edition: 3rd Edition, Sep. 2023
 version: R1.03
 status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the test system (2026-09-30)
 ---
 # EQUIPMENT Service Engineering - Utilities (R1.03)
 Three utilities of the EQUIPMENT Service (the equipment managers `eqp<type>` that talk to
 stations). Section numbers refer to the manual.
 ## 1. Forced scan: `eqpfrcscn` (§1)
 Temporarily scans a group of points faster when a **trigger item** changes, e.g. a tuning tag
 normally read hourly.
 1. Create `%TLS_ROOT_PATH%\tls\com\eqpfrcscn_start.cmd` that starts
   `%TLS_ROOT_PATH%\tls\exe\eqpfrcscn -n EQPFRCSCN`, and `eqpfrcscn_stop.cmd` that stops it
   with `durstp.exe -msk -t 10 -p EQPFRCSCN`. (The manual's example start line uses
   `-n eqpfrcsrn`, a typo.) On the test system `equipment_start.cmd` calls **every
   `eqp*start.cmd`** in `tls\com`, so the start file makes it start with CI Server.
 2. Define the trigger item; any value change starts a forced scan.
 3. Give the points to be forced a scan type (e.g. 60000 ms) and link them to items.
 4. In `eqpfrcscn.sup` (Setup File Editor; description "Force scanning equipment"):
   - Tab *General*, keyword `FORCE = <trigger item>, <EQP node>, <EQP process name>,
     <slave number>, <I/O type number>, <scan rate number>, <scan period s>, <scan duration s>`
     (repeatable), plus `queue_size` (KB, default 20).
   - Tab *Special events*, keyword `FCX_EVENT = <trigger item>, <node>, <process>, <slave>,
     <period>, <duration>` for STARDOM, DNP3 and IEC101 events.
   - EQP process name = *Equipment process name* of the line; slave number = *Internal
     station id* (or `eqpdbg` "Get slave info").
   - I/O type numbers include 100/101/103/104/106 Modbus (Modicon) reads, 293 Siemens 3964R,
     580 BK8100, 644 STARDOM FCX (-1 slow, -2 fast, -3 medium), 772/774 ProSafe-COM,
     836 FA-M3, 996 AB PLC5, 1028 DNP3, 1092 Siemens S7, 1156 DAQSTATION, 1188 AB CIP,
     1220 Fisher ROC, 1316 HexRepeater, 1636 IEC 61850.
   - Scan rate number: the points' scan interval in ms, or the driver's internal rate number.
 5. Restart CI Server (or the `EQPFRCSCN` process).
 Example: a change of the trigger item makes 60 s points scan every 10 s for 600 s.
 Long scan intervals can let an RTU close its TCP socket; keep at least one faster item or
 lengthen the RTU's socket timeout.
 ## 2. Hourly I/O statistics: `eqpiostat` (§2)
 Stores the I/O statistics per station line every hour (no record when nothing was sent).
 No setup file, no parameters. On the test system `equipment_start.cmd` starts it
 automatically on the host node, and it was running. The manual calls the target a history
 group; it is the dataset **`STATION_STAT`** (fields: time stamp, station, line, time span,
 sends, good answers, bad return code, timeouts, frame errors, bad CRC, retries, line bad).
 An export returned no records on the test system (ISS-021).
 ## 3. Debugger: `eqpdbg` (§3)
 `eqpdbg [<node> <process>]` then an action number; node 0 = this node, process default `EQP`
 (use the line's equipment process name, e.g. `EQPMDC` for Modbus). Answers can be piped in,
 e.g. read-only main info:
 ```
 printf '1\n-1\n' | eqpdbg 0 EQPMDC
 ```
 | No. | Action | Changes anything? |
 |---|---|---|
 | 1 | Get main info: lines attached, scan interval (tick), scan status, slave count, scans done, line load % | no |
 | 3 | Get slave info: type, name, wanted path, scan status, recover count, scan preset, output method, address gap / max size, per-line status items and message statistics | no |
 | 8, 9, 10, 11, 13, 17, 18, 23 | I/O type, scan rate, item pointer, timing statistics, item, item by id, slave-specific, item ids | no |
 | 4, 5 | Update slave scan status / address gap and max size | **yes**, makes EQP differ from the database |
 | 6, 12 | Delete slave / item signal (EQP only; repair with `dsschk`) | **yes** |
 | 7 | Reset statistics (optionally enable I/O timing) | yes (counters) |
 | 14 | Save all info on disk (optionally stop the EQP process) | yes |
 | 15, 16, 20, 21 | Total scan, force item update, force re-init, general request | triggers I/O |
 | 19 | Logging file size (MB, 0 = off): `<process>.xml` / `_old.xml` in the list folder | yes |
 | -2 | Dump memory (a wrong address crashes EQP) | risky |
 | -1 | Exit | — |
 Test system: `eqpdbg 0 EQPMDC` main info showed line type 107, both lines attached, 100 ms
 scan interval, 2 slaves, 2 % line load.
 ## Installed on the test system
 Many drivers `tls\exe\eqp<type>.exe` (e.g. `eqpmdc` Modbus, `eqpfcx` STARDOM, `eqpfam3` FA-M3,
 `eqp850` IEC 61850, `eqpdnp` DNP3); setup files `eqp*.sup` (e.g. `eqpmdc.sup`, `eqpmqtt.sup`,
 `eqpfrcscn.sup`); start scripts `eqpmdc_start.cmd`, `eqpmqtt_start.cmd`. Running managers:
 `eqpmdc`, `eqpmqtt`, `eqpiostat`.
--- a/knowledge/manuals/IM36K10L41-01EN.md
+++ b/knowledge/manuals/IM36K10L41-01EN.md
@ -0,0 +1,193 @@
 ---
 manual: IM 36K10L41-01EN
 title: EQUIPMENT Service Engineering - Configuration
 edition: 3rd Edition, Sep. 2023
 version: R1.03
 status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)
 ---
 # EQUIPMENT Service Engineering - Configuration (R1.03)
 How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
 points and conversion types, then one chapter per protocol. Section numbers refer to the
 manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.
 ## 1–2. Architecture
 - Needs BUS, DATABASE and ITEM Services running; USER Service to define stations, items and
  scan types.
 - One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
  master), its setup file, shared libraries and datasets for line, station, scan type and point.
 - **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
  an equipment manager instance. The name is free but must start with `eqp`.
 - Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
  (lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
  the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
  `eqpmdc_item.sav` plus `.d01`/`.k01` files.)
 ## 3.1 Line types
 | Type | Addresses | Main parameters |
 |---|---|---|
 | Serial | `LINE_1_DEVICE` / `LINE_2_DEVICE` = `com1:` (`\\.\com10` from COM10) | baud rate, 7/8 bits, parity, stop bits, XON |
 | TCP/IP | `<IP>[:<port>]`, can be overruled per station | `DEAD_TIME` (s without data → reconnect, default 30), `REPEAT_CONNECTION_DELAY` (default 30 s), recover script, source address, splitter, switch time, carrier on/off delay for radios |
 | DUR | `[<node>:]<process>` (other CI Server processes) | timeout rounded to seconds, default 3000 ms |
 | UDP | `<IP>[:<port>]` | — |
 Common to all: `HEART_BEAT` (manager cycle, ms; must be ≤ fastest scan; ~100 ms typical),
 `PERIODIC_TIME` (s; re-checks BURST LIM filters for event-based inputs), `TIMEOUT` (ms; for
 terminal servers include both network and serial times). Line 2 is the optional backup line.
 ## 3.2 Common station parameters
 Name, description, station id (0 = assigned automatically), on scan, line, redundant line,
 suppress outputs, output method (*On change* / *On change and connect*), preferred line
 (None, Line 1, Line 2), and status items:
 - `STATUS_ITEM`: 1 = station reachable, 0 = not (status OFFSCAN when off-scan);
 - `LINE_1_ITEM`, `LINE_2_ITEM`: per line 1/0;
 - `SELECT_ITEM`: line number in use.
 Typeless sub-items on these show sub-line states (Modbus over TCP/IP only; values 0–3, see
 C10 summary §4). **Dynamic scanning** (e.g. STARDOM FCX): a normal and a fast rate, fast
 while a tag is on an open display; may need a larger manager queue.
 ## 3.3 Standard conversion types (field value ↔ item)
 | Type | Field signal | Key parameters / behaviour |
 |---|---|---|
 | Digital | 1 bit | `INVERS`, `NO_ZERO` (never send 0), `AVE_UPD_INTERVAL` + `BURST_LIMIT` (too many changes → status BURST LIM for limit × interval s) |
 | Binary | integer, no scaling | `BITS`, `HAS_SIGN`, `SWAP_BYTES`, `SWAP_WORDS` |
 | Linear | integer, scaled | `ELEC_LOW/HIGH` → `PHYS_LOW/HIGH` (extrapolated; outside electrical range → UNDERRANGED/OVERRANGED), `DELTA_LIMIT` (→ DELTA), `AVE_UPD_INTERVAL` + `MAX_INSENS` (adaptive change filter), bits/sign/swaps |
 | Dual-bit | 2 bits | value 0–3, status DB NONE/RIGHT/LEFT/BOTH; `TMO_NONE`/`TMO_BOTH` → DB NONE T / DB BOTH T |
 | Unary | bit array, one bit set | value = lowest set bit (−1 if none); none/several → BAD VALUE |
 | Float | 32/64-bit float | `FLOAT_TYPE` Intel, Motorola, Tandem, Dec; `STEP`, `OFFSET` (item = field × step + offset); swaps |
 | String | ASCIIZ ≤ 80 incl. `\0` | `CHARS`; longer output is truncated without `\0` |
 | Linear-BCD | 1–8 BCD digits | `DIGITS`, `STEP`, `OFFSET`, `OVERFL_DET` (counts roll-overs) |
 | Time | 7-byte IEC or 32-bit POSIX | `TIME_ZONE` (LCT, LST, GMT, relative), `TIME_REPRES` |
 Stations may force status/quality codes on top of these.
 ## 3.4 Specific conversion types
 One per protocol where the standard ones do not fit: ProSafe-PLC, BSAP digital/float, TIE
 command, STARDOM FCX (history id, special conversions of alarm/valve/batch/calc/counter/mode
 status words into CI Server statuses such as HIGH, IOP+, MAN, AUT, CAS), Host-host, DNP3,
 VNET, AB-CIP, Fisher ROC, Hex repeater (binary/float/relay), IEC 101/103/104 output, IEC 103
 analog, IEC 61850, AC-Gateway, Wireless, Bachmann, Beckhoff ADS. Details stay in the manual.
 ## 3.5 Common setup-file parameters (`eqp<name>.sup`)
 - *General*: `queue_size` (KB; more for many dynamic tags), `crit` (hex criterion mask for
  output events, default `D` = first + value + status), `logging_size` (MB, protocol log in
  the list folder, 0 = off; up to twice the size used). Installed `eqpmdc.sup` also has
  `start_offline = <Y|N>` (not described).
 - *Behaviour*: `updown = <slave>, <line>` (log station / line up-down messages),
  `timestamp = Y` (use the RTU/manager ms time stamp for alarms and event history instead of
  the item-table second), `offline = <inputs off on loss>, <inputs on at recovery>, <outputs
  off on loss>, <outputs on at recovery>`. Default: inputs go offline on loss and online at
  their next value; outputs stay online.
 Test system `eqpmdc.sup`: `queue_size = 20`, `crit = D`, `updown = Y,N`, `timestamp = Y`,
 `offline = N,N,N,N`.
 ## 3.6 Modbus master (`EQPMDC`)
 Modbus ASCII, RTU (serial, or TCP/IP to a serial converter) or Open Modbus/TCP.
 Steps: line → setup file (created automatically) → stations → scan types → points.
 Datasets (test system, via `dssqld -f`): `MODBUS_LINE_DF`, `MODBUS_STATION_DF`,
 `MODBUS_SCAN_TYPE_DF`, `MODBUS_POINT_DF`; the general views `LINE_DF`, `STATION_DF`,
 `SCAN_TYPE_DF`, `POINT_DF` list all protocols.
 **Station, Options tab**: `PROTOCOL` (Ascii, RTU, Open Modbus/TCP — default), `SUB_STATION_ID`
 (Modbus unit id), `ADDRESS_INCREMENT` (JBUS: addresses on the wire start at 1),
 `RECOVER_TIME` (s between reconnect tries, default 10; a try can block the manager for a
 timeout), `RECOVER_TRIES` (default 2), `WRITE_WAIT` (ms before each write), `SIGNAL_GAP`
 (bytes of unused addresses read to merge requests, default 20), `SIGNALS` (max bytes per
 request, ≤ 240), `FAR_END_CHECK`, `ALIVE_CHECK_METHOD` (function 7 by default; 8 or 1–4),
 `ALIVE_CHECK_REGISTER_START`, `SEQUENCE_CHECK` (Modbus/TCP transaction ids, default on).
 General tab: `LINE_1_DEVICE` / `LINE_2_DEVICE` = `<IP>[:<port>][;<IP2>[:<port>]]`, default
 port 502.
 **Scan types**: name + positive interval (ms), e.g. Fast 1000, Slow 10000.
 **Points** (`IO_ADDRESS`, `EXTERNAL_RELATION` Input / Output / Input+Output, `SCAN_TYPE`,
 `CONV_TYPE`):
 | Address | Element | Function codes | Direction |
 |---|---|---|---|
 | `DO:<n>` | coil 1–65536 | 1, 5 | in/out |
 | `DI:<n>` | input status (give 1… not 10001…) | 2 (15) | in |
 | `RO:<n>[,<bit>]` | holding register (1… not 40001…), bit 0–15 | 3, 6, 16 | in/out |
 | `RI:<n>[,<bit>]` | input register (1… not 30001…) | 4 | in |
 | `ES:<n>` | exception status bit 1–8 | 7 | in |
 | `LO:<n>[,<bit>]` | Daniel 4-byte register 1–32768, bit 0–31 | 3, 6, 16 | in/out |
 Bits in registers are written read-modify-write. Floats are usually Intel, swap words on,
 swap bytes off.
 **Troubleshooting**: *protocol error (function x, error 2)* = RTU refuses part of the address
 range (unused addresses read because of the signal gap, or DI/DO blocks not on 8-bit
 boundaries: start at 1, 9, 17 …) → define the gap registers or set the gap to 0. Slow
 communication: gaps of up to ~15 bytes are cheaper to read than an extra request; use
 `WRITE_WAIT` if the RTU needs time after a reply. TCP/IP: ping first; switch off sequence
 check if the station does not support it. Protocol logging marks errors with `/ERROR`.
 External interface (for programs): send a raw request to an RTU, force a reconnect.
 ## 3.7 Modbus slave (Windows only)
 CI Server can serve third-party Modbus masters through a "mirror":
 - `EQPMDCMEM`: universal slave memory; per station id 64K registers (input and holding
  registers are the same area) and 64K status bits (coils and inputs the same); starts at 0;
  answers function codes 1–7, 15, 16. No setup file.
 - `EQPMDCSLVSER`: serial slave (one per port; setup file copied from `eqpmdcslvser.sup`,
  tabs General, Terminal server, Direct port, Serial line).
 - `EQPMDCSLVTCP`: Modbus RTU over TCP slave, `eqpmdcslvtcp -n <name> [-p <port>]`
  (default 502), several connections per instance, no setup file.
 - Start them from the equipment start sequence; then define a normal **Modbus master line
  and stations in CI Server pointing at the slave's address** (output method *On change and
  connect*). CI Server items then read and write the same registers the third party sees.
 Installed on the test system: `eqpmdcmem.exe`, `eqpmdcslvser.exe`, `eqpmdcslvtcp.exe`; none
 running. On R1.03 `equipment_start.cmd` runs every `tls\com\eqp*start.cmd`, so a separate
 start file is enough (see L40 summary).
 ## 3.8–3.40 Other drivers
 | § | Driver | Connection | Notes |
 |---|---|---|---|
 | 3.8 | MQTT | TCP/IP via a broker | CI Server is an MQTT client |
 | 3.9 | ProSafe-COM (MULCOM/MODCOM) | serial or TCP/IP | extended Modbus |
 | 3.10 | ProSafe-PLC | APACS API (Windows only) | time sync, SOE |
 | 3.11 | STARDOM FCX | TCP/IP | FCX preparation, message interface, SOE, dynamic scanning, history buffer |
 | 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
 | 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
 | 3.14 | FA-M3 | TCP/IP | |
 | 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed |
 | 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
 | 3.17 | Beckhoff BK8100 | serial / terminal server | |
 | 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
 | 3.19 | Allen Bradley CIP | TCP/IP to ControlLogix Ethernet module | connected messaging |
 | 3.20 | Siemens 3964R | serial | |
 | 3.21 | Siemens SAPI-S7 | API software | |
 | 3.22 | Bristol Babcock BSAP | serial / terminal server | RTU preparation, external interface |
 | 3.23 | Fisher ROC | serial / terminal server | FloBoss 100/407/500, ROC300/800, RegFlo |
 | 3.24 | DNP3 | TCP/IP or serial | authentication option |
 | 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
 | 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
 | 3.27 | TIE 870-5 | serial | |
 | 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | |
 | 3.32 | IEC 61850 | TCP/IP | scan reads; direct write and control models |
 | 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
 | 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
 | 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
 | 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
 | 3.38 | Bachmann | M1COM library | |
 | 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
 | 3.40 | Beckhoff ADS | TwinCAT 3 router | |
 ## Test system (read-only, 2026-09-30)
 The author's AID project has line `MODSIM_LINE` (TCP/IP, manager `EQPMDC`, heart beat 100,
 timeout 3000, dead time 30) with Modbus/TCP stations `MODSIM_STATION` (localhost) and
 `WRPS_PLC` (host `dev-ubuntu`), scan type `MOD_SCAN` 500 ms and 69 points (e.g. `RI:01`
 Linear 0–100); nothing listens on port 502, so both stations are down. Line `LINE_MQTT` uses
 `EQPMQTT`.
--- a/knowledge/progress.md
+++ b/knowledge/progress.md
@ -37,10 +37,10 @@ AID is not needed.
 | 4 | IM 36K10R10 | CI Portal Setup | done except separate CI Portal node (needs a second node); skill `portal-setup` ([notes](manuals/IM36K10R10-01EN.md)) |
 | 4 | IM 36K10R20 | Setup File Editor | done; Templates tab and Undo Field not explored ([notes](manuals/IM36K10R20-01EN.md), ISS-016) |
 | 5 | IM 36K10C10 | Engineering Module - I/O Processes | summarized ([notes](manuals/IM36K10C10-01EN.md)); default datasets checked read-only |
-| 5 | IM 36K10L40 | EQUIPMENT Service - Utilities | not started |
+| 5 | IM 36K10L40 | EQUIPMENT Service - Utilities | summarized ([notes](manuals/IM36K10L40-01EN.md)); `eqpdbg` main info run read-only |
-| 5 | IM 36K10L41 | EQUIPMENT Service - Configuration | not started |
+| 5 | IM 36K10L41 | EQUIPMENT Service - Configuration | summarized ([notes](manuals/IM36K10L41-01EN.md)); general + Modbus in detail, other drivers as a table |
-| 5 | IM 36K10L35 | ITEM Service - ITH | not started |
+| 5 | IM 36K10L35 | ITEM Service - ITH | summarized ([notes](manuals/IM36K10L35-01EN.md)); installed processes and setup files checked |
-| 5 | IM 36K10L36 | ITEM Service - ITM | not started |
+| 5 | IM 36K10L36 | ITEM Service - ITM | summarized ([notes](manuals/IM36K10L36-01EN.md)); `itmdbg` statistics run; `itmval -f` crashes (ISS-022) |
 | 6 | IM 36K10L10 | Class/Object Engineering | not started |
 | 6 | IM 36K10P10 | Class Description Language - Traditional | not started |
 | 6 | IM 36K10P11 | Class Description Language - Java | not started |