.claude/skills/authorization/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: authorization
+description: >-
+  CI Server R1.03 users, authorization groups, login and schemes. Use when the user wants to
+  create, list or remove CI Server users or authorization groups, choose authorization actions
+  (ITEM_READ, ITEM_MODIFY_VALUE, …), set process areas, logoff timeout or initial display for
+  a user, change how users log in (dssana.sup login method: Automatic, Manual CI Server,
+  Manual OS, No, SSO, Deny), or hide Engineering Module features with a scheme.
+  Sources IM 36K10C10-01EN §2; Active Directory and single sign-on follow in phase 13 (IM 36K10J40).
+---
+
+# Authorization (R1.03)
+
+Background: `knowledge/manuals/IM36K10C10-01EN.md` §2 (login methods, actions, user tabs,
+schemes). Login settings are in `dssana.sup` on CI Core (skill `portal-setup` for reading
+and changing setup files).
+
+Rules:
+- Run the `system-check` skill first; follow the user's chosen way of working.
+- Users are login accounts. Claude prepares user quick load files but the user loads them
+  and sets any password; never put real passwords in repo files.
+- Remove users before the authorization group they belong to.
+
+| Task | File | Status |
+|---|---|---|
+| Create, check and remove authorization groups and users (quick load) | `tasks/users-groups.md` | verified |
+| Login methods per client and user interface (`dssana.sup`, tab *Login control*) | C10 summary §2 | from docs (installed values read) |
+| Schemes (hide Engineering Module features) | C10 summary §2 | from docs |
+| Active Directory, single sign-on, password rules | phase 13 | not covered |

.claude/skills/authorization/tasks/users-groups.md

@@ -0,0 +1,86 @@
+---
+task: Create, check and remove authorization groups and users with quick load
+version: R1.03
+source: IM 36K10C10-01EN §2.4, §2.5; data dictionary (`dssqld -f`); practiced on the test system 2026-09-30
+status: verified
+---
+
+# Authorization groups and users (quick load)
+
+Engineering Module equivalent: *Authorization → Authorization groups / User → Add*.
+Datasets: `AUTH_GROUP_DF` (groups), `AUTH_ACTION_DF` (allowed action names), `USER_DF`
+(users). Works from a normal prompt while CI Server is running. Use short relative file
+names (`cd` to the folder first): long absolute paths are cut (ISS-020).
+
+## List what exists
+
+```
+dssqld -e groups.qli -d AUTH_GROUP_DF -c -l groups.lst
+dssqld -e users.qli -d USER_DF -c -l users.lst
+dssqld -e actions.qli -d AUTH_ACTION_DF -c -l actions.lst
+```
+
+Installed on R1.03: groups `SYSTEM_MANAGER`, `ENGINEER`, `OPERATOR`, `GUEST`; users `ADMIN`,
+`ADMINE`, `OPER`, `CI_NO_LOGIN_OPCUAS`. Passwords export as `****`.
+
+## Group
+
+Required: `NAME`. Actions go in `ACTION_NAME_1`, `ACTION_NAME_2`, … and must be names from
+`AUTH_ACTION_DF` (e.g. `ITEM_READ`, `ITEM_MODIFY_VALUE`, `SECTION_BLOCK_UNBLOCK`,
+`ALARM_CURRENT_ACK`). Example (`examples/CI-Eng-Sample/08_auth_group_df.qli`):
+
+```
+@FIELDS
+NAME,DESCRIPTION,ACTION_NAME_1,ACTION_NAME_2,ACTION_NAME_3,ACTION_NAME_4
+
+@AUTH_GROUP_DF
+"CIENG_VIEWER","CI-Eng-Sample read-only viewer","ITEM_READ","SECTION_READ","ALARM_CURRENT_READ","ALARM_CHRONO_READ"
+```
+
+## User
+
+Required: `NAME` (≤ 32) and `AUTH_GROUP` (an existing group). Optional: `DESCRIPTION`,
+`PROCESS_AREAS` (e.g. `"1-999"`), `LOGOFF_TIMEOUT` (minutes, 0–999), `INITIAL_DISPLAY`,
+`LOCALE`, `ENTERPRISE`, playback fields. A password is **not** required on import; set it in
+the Engineering Module (the user does this, not Claude). Template:
+
+```
+@FIELDS
+NAME,DESCRIPTION,AUTH_GROUP,PROCESS_AREAS,LOGOFF_TIMEOUT
+
+@USER_DF
+"<USER>","<description>","CIENG_VIEWER","1-999",15
+```
+
+Defaults filled in on import (seen): display authorization level 999, language *System*,
+playback *HMI Client dependent* / *No*, merge priority 1. Changes take effect at the user's
+next login.
+
+## Check and remove
+
+Filtered export (`@SELECT`, see `system-management` task `export-dataset.md`):
+
+```
+@SELECT
+'NAME = "<USER>"'
+@USER_DF
+```
+
+Remove users first, then the group, in one `NAME`-only file (`dssqld -r`):
+
+```
+@FIELDS
+NAME
+
+@USER_DF
+"<USER>"
+
+@AUTH_GROUP_DF
+"CIENG_VIEWER"
+```
+
+## Test system (2026-09-30)
+
+Group `CIENG_VIEWER` and user `CIENG_TEST` (no password, logoff 15 min) loaded with 0 errors,
+exported back as defined, then removed (1 + 1 removed, 0 errors). The group is part of
+CI-Eng-Sample; the sample creates no users.

.claude/skills/equipment/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: equipment
+description: >-
+  CI Server R1.03 EQUIPMENT Service: lines, stations, scan types, I/O points and conversion
+  types. Use when the user wants to connect CI Server to a PLC, RTU or other device (Modbus
+  TCP/RTU, STARDOM FCX, FA-M3, DNP3, IEC 60870-5-104, IEC 61850, MQTT, OPC …), define or
+  remove a line, station, scan type or point, connect an item to an I/O address, set a station
+  off-scan or suppress outputs, add a station communication status item, run CI Server as a
+  Modbus slave, force a faster scan (eqpfrcscn), check equipment statistics or use the
+  equipment debugger (eqpdbg). Sources IM 36K10L40-01EN, IM 36K10L41-01EN, IM 36K10C10-01EN §4.1.
+---
+
+# Equipment (R1.03)
+
+Background: `knowledge/manuals/IM36K10L41-01EN.md` (line types, station parameters,
+conversion types, Modbus, driver table), `IM36K10L40-01EN.md` (forced scan, statistics,
+`eqpdbg`), `IM36K10C10-01EN.md` §4.1 (Engineering Module forms).
+
+Rules:
+- Run the `system-check` skill first; follow the user's chosen way of working.
+- Loading a line creates files in `tls\com` and `tls\sup` and starts an equipment manager;
+  removing it stops the manager and deletes them. Only do this on test systems or with the
+  user's approval.
+- Outputs write to real devices: never write to a production station's output points without
+  the user's explicit approval.
+- `eqpdbg`: only the read-only actions (see L40 summary) unless the user approves.
+
+| Task | File | Status |
+|---|---|---|
+| Modbus TCP station by quick load: line, station, scan type, points, connected items; test, off-scan, remove | `tasks/modbus-station.md` | verified |
+| CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) |
+| Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified |
+| Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
+| Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |

.claude/skills/equipment/tasks/modbus-station.md

@@ -0,0 +1,122 @@
+---
+task: Modbus TCP station by quick load (line, station, scan type, points, items)
+version: R1.03
+source: IM 36K10L41-01EN §2, §3.1–3.2, §3.6–3.7; IM 36K10C10-01EN §4.1; practiced on CI-Eng-Sample 2026-09-30
+status: verified
+---
+
+# Modbus TCP station by quick load
+
+Uses the CI-Eng-Sample loopback station `CIENG_PLC` as the worked example (files in
+`examples/CI-Eng-Sample/`: `09_modbus_line_df.qli`, `10_modbus_station_df.qli`,
+`11_item_eqp_df.qli`, removal `80_`–`82_`). For a real device, replace the address, unit id,
+points and conversion settings. Works from a normal prompt while CI Server is running; use
+short relative file names.
+
+## 1. (Test only) CI Server as its own Modbus slave
+
+CI Server ships a Modbus slave "mirror" that needs no hardware:
+- `eqpmdcmem -n EQPMDCMEM`: slave memory (64K registers, 64K bits per unit id; input and
+  holding registers are the same memory, as are coils and input bits). The name must be
+  `EQPMDCMEM`: the TCP slave looks for it.
+- `eqpmdcslvtcp -n EQPMDCSLVTCP -p 5020`: Modbus TCP listener (default port 502).
+
+Started by hand from a normal prompt they run until logoff or CI Server restart. To start
+them with CI Server, an administrator copies `examples/CI-Eng-Sample/equipment/
+eqpciengslv_start.cmd` and `_stop.cmd` to `%TLS_ROOT_PATH%\tls\com`: `equipment_start.cmd`
+runs every `eqp*start.cmd` there.
+
+## 2. Line (`MODBUS_LINE_DF`)
+
+```
+@FIELDS
+NAME,DESCRIPTION,LINE_TYPE,EQUIPMENT_MAN,HEART_BEAT,TIMEOUT,DEAD_TIME,REPEAT_CONNECTION_DELAY
+
+@MODBUS_LINE_DF
+"CIENG_MB_LINE","CI-Eng-Sample Modbus loopback line","TCP/IP","EQPCIENG",100,3000,30,10
+```
+
+- `EQUIPMENT_MAN` = equipment manager process name, must start with `EQP`, ≤ 12 characters.
+- Leave `EQUIPMENT_NODE` out: it defaults to the local node (keeps files portable).
+- Loading it **creates** `tls\com\eqpcieng_start.cmd`, `eqpcieng_stop.cmd` and
+  `tls\sup\eqpcieng.sup` (written by the CI Service, no admin rights needed) and **starts**
+  `eqpmdc -n EQPCIENG` a few seconds later. Wait ~15 s before loading stations.
+
+## 3. Station, scan type, points (`MODBUS_STATION_DF`, `MODBUS_SCAN_TYPE_DF`, `MODBUS_POINT_DF`)
+
+```
+@FIELDS
+NAME,DESCRIPTION,LINE,PROTOCOL,LINE_1_DEVICE,SUB_STATION_ID,OUTPUT_METHOD,STATUS_ITEM,ON_SCAN
+
+@MODBUS_STATION_DF
+"CIENG_PLC","Loopback to CI Server Modbus slave (port 5020)","CIENG_MB_LINE","Open Modbus/TCP","localhost:5020",1,"On change and connect","CI-Eng-Sample.PLC1.COMM_OK",1
+
+@FIELDS
+NAME,DESCRIPTION,SCAN_INTERVAL
+
+@MODBUS_SCAN_TYPE_DF
+"CIENG_SCAN1S","CI-Eng-Sample 1 s scan",1000
+
+@FIELDS
+NAME,STATION,POINT,DESCRIPTION,IO_ADDRESS,EXTERNAL_RELATION,SCAN_TYPE,CONV_TYPE,BITS
+
+@MODBUS_POINT_DF
+"CIENG_PLC:SP","CIENG_PLC","SP","Setpoint, holding register 1","RO:1","Output","CIENG_SCAN1S","Binary",16
+"CIENG_PLC:PV","CIENG_PLC","PV","Read-back, input register 1","RI:1","Input","CIENG_SCAN1S","Binary",16
+```
+
+- `PROTOCOL`: `Open Modbus/TCP`, `RTU` or `Ascii`. The CI Server TCP slave only answered
+  **Open Modbus/TCP** (with `RTU` every request timed out, `EQP-E-TCPRCVTMO`; ISS-024).
+- `LINE_1_DEVICE` `<host>[:<port>]`, default port 502. `SUB_STATION_ID` = Modbus unit id.
+- `STATUS_ITEM`: an existing Boolean item; 1 = communication good, 0 = bad, status 22
+  OFFSCAN when off-scan. Load it before the station.
+- Points need `NAME` = `<station>:<point>` as well as `STATION` and `POINT`
+  (without it: `DSS-E-PIDX_FST`).
+- Addresses: `DO:n` coil, `DI:n` input bit, `RO:n[,bit]` holding register, `RI:n[,bit]` input
+  register (numbers from 1, not 40001/30001). `EXTERNAL_RELATION`: `Input`, `Output`,
+  `Input + Output`. `CONV_TYPE`: `Binary`, `Linear` (with `ELEC_LOW/HIGH`, `PHYS_LOW/HIGH`),
+  `Float` (`FLOAT_TYPE` Intel, swap words), `Digital`, … (L41 summary §3.3).
+
+## 4. Connect items (`ITEM_DF.STATION`, `POINT`)
+
+```
+@FIELDS
+NAME,DESCRIPTION,ITEM_REP,VALUE_FORMAT,STATION,POINT
+
+@ITEM_DF
+"CI-Eng-Sample.PLC1.SETPOINT","Setpoint written to holding register 1","Integer","99999","CIENG_PLC","SP"
+"CI-Eng-Sample.PLC1.READBACK","Read back from input register 1","Integer","99999","CIENG_PLC","PV"
+```
+
+## 5. Test
+
+```
+itmval -p -n CI-Eng-Sample.PLC1.SETPOINT -v 1234
+itmval -g -n CI-Eng-Sample.PLC1.READBACK
+itmval -g -n CI-Eng-Sample.PLC1.COMM_OK
+printf '3\n1\n-1\n' | eqpdbg 0 EQPCIENG     # slave 1: scan status, line status, request statistics
+```
+
+Before the first good scan input items show `off` (offline) and status 13 NOT INIT.
+
+**Off-scan / on-scan** (`dssqld -m` with `NAME,ON_SCAN` = 0 or 1): off-scan sets the status
+item to 0 / status 22 OFFSCAN and freezes input items at their last value with the `off`
+flag; a value written to an output while off-scan reached the device after going back
+on-scan (output method *On change and connect*).
+
+## 6. Remove (reverse order)
+
+1. Items connected to points (`ITEM_DF` names).
+2. Points, then station, then scan type (one file, in that order).
+3. Line: this **stops** the equipment manager and deletes its start/stop scripts, setup file
+   and `tls\sav` files.
+4. The status item and section with the other items.
+
+## Test system (2026-09-30)
+
+Full cycle on CI-Eng-Sample: loaded, `SETPOINT` 1234/4321/2468 and `CMD` 1/0 read back
+through Modbus on `READBACK`/`FEEDBACK`, off-scan/on-scan checked, removed (manager stopped,
+files deleted), reloaded from the sample files and re-tested: all 0 errors. With
+`eqpciengslv_start.cmd`/`_stop.cmd` copied to `tls\com` and CI Server restarted, the mirror and
+`EQPCIENG` started under the CI Service, `COMM_OK` = 1, and the saved setpoint (2468) was
+re-sent to the freshly zeroed slave memory on connect (output method *On change and connect*).

.claude/skills/item-engineering/SKILL.md

@@ -3,8 +3,9 @@ name: item-engineering
 description: >-
   CI Server R1.03 sections, items and sub-items. Use when the user wants to create or change
   sections, items or sub-items (integrator, min-max, pulse, rate-of-change), set limits,
-  scale or value format, block or unblock items or sections, or understand item status and
+  scale or value format, string item length, integrator time unit (integration granule),
-  option flags. Sources IM 36K10G10-01EN (Tutorial); to be extended with IM 36K10C10 in phase 5.
+  PIT filter, block or unblock items or sections, or understand item status and option flags
+  (blk, off, uoff, ublk). Sources IM 36K10G10-01EN (Tutorial) and IM 36K10C10-01EN.
 ---
 
 # Item engineering (R1.03)
@@ -21,3 +22,5 @@ Rules:
 |---|---|---|
 | Sub-items (integrator, min-max) | `tasks/sub-items.md` | verified |
 | Block / unblock an item; write to a blocked item | `tasks/block-item.md` | verified |
+| String items: length limit (1–200) and truncation | `tasks/string-items.md` | verified |
+| Item forms, limits, PIT filter, clamping, alarm tab, option bits, item statuses | `knowledge/manuals/IM36K10C10-01EN.md` §3–4 | from docs |

.claude/skills/item-engineering/tasks/block-item.md

@@ -33,4 +33,6 @@ dssqld -m block.qli -l block.qlo
 - `itmval -p -n <item> -v <value>` on a blocked item is **silently ignored** (no error, value
   unchanged; `knowledge/issues.md` ISS-011). Add `-o` to overwrite:
   `itmval -p -n <item> -v <value> -o`.
-- After unblocking, `blk` is replaced by `ublk` (meaning not yet confirmed, see ISS-001).
+- After unblocking, `blk` is gone but `ublk` (option bit 16, *updated blocked*) remains: the
+  item was written by an application (`itmval -o`) while it was blocked (IM 36K10C10 §3.5,
+  ISS-001).

.claude/skills/item-engineering/tasks/string-items.md

@@ -0,0 +1,37 @@
+---
+task: String items: length limit and truncation
+version: R1.03
+source: IM 36K10C10-01EN §3.3.4; data dictionary (`dssqld -f`); practiced on CI-Eng-Sample 2026-09-30
+status: verified
+---
+
+# String items
+
+A string item has a maximum length set when it is created (`ITEM_DF.STRING_LENGTH`).
+
+| Rule | Value (verified) |
+|---|---|
+| Allowed `STRING_LENGTH` | 1–200 (default 80); 201 is rejected with `DSS-E-VAL_RANGE` |
+| Audit trailing (`AUDIT_INFO`) | no effect on the limit (200 loads with audit on) |
+| Characters the item holds | **length − 1** (length 100 holds 99) |
+| Value that fits | stored, status 9 NORMAL |
+| Value too long | cut to length − 1, status **12 OVERRANGED**, no error from `itmval` |
+
+The manuals disagree (Engineering Module: max 100; Tutorial: 168); the installed software
+allows 200 (`knowledge/issues.md` ISS-019). Multi-byte characters take more than one byte.
+
+Quick load (the section must exist):
+
+```
+@FIELDS
+NAME,DESCRIPTION,ITEM_REP,STRING_LENGTH,AUDIT_INFO
+
+@ITEM_DF
+"<Section>.<Tag>","Status text","String",120,0
+```
+
+Write and read: `itmval -p -n <Section>.<Tag> -v "text"`, `itmval -g -n <Section>.<Tag>`.
+After a write, check the status: 12 means the text was cut.
+
+The representation (type) and length cannot be changed on an existing item: remove and
+load it again.

.claude/skills/item-engineering/tasks/sub-items.md

@@ -1,7 +1,7 @@
 ---
 task: Create sub-items (integrator, min-max)
 version: R1.03
-source: IM 36K10G10-01EN §3.1.5, §3.2.3; practiced with CI-Eng-Sample 2026-09-30
+source: IM 36K10G10-01EN §3.1.5, §3.2.3; IM 36K10C10-01EN §3.2; practiced with CI-Eng-Sample 2026-09-30
 status: verified
 ---
 
@@ -27,9 +27,13 @@ Load with `dssqld -i <file>.qli -l <file>.qlo`; remove with a `NAME`-only file a
 
 ## Behaviour (verified)
 
-- **Integrator** adds *value × seconds*: with the main item at 1 it grows by 1 per second.
+- **Integrator** adds *value × time unit*: with the main item at 1 it grows by 1 per second
-  `TIME_UNIT` (e.g. `Hour`) made no difference (`knowledge/issues.md` ISS-010); to show hours,
+  by default. The time unit is the **integration granule** `itm_int_secs` in `itm.sup`
-  divide by 3600 where the value is used.
+  (Setup File Editor label "Integration granule, sec."), **system-wide** for all integrators,
+  installed value 1. Setting 60 and restarting CI Server made it grow by 1 per minute
+  (verified 2026-09-30, ISS-010). Changing it is a setup-file change (skill `portal-setup`,
+  task `change-setup-file.md`); existing integrator values are not converted, so reset or
+  note them. `TIME_UNIT` on the sub-item has no effect on integrators.
 - **Min-Max** with `MIN_MAX` = `Maximum` (or `Minimum`) keeps the highest (lowest) value
   written to the main item: writing 30, 70, 50 gave 70.
 - `TIME_UNIT` (Second, Minute, Hour, Day) belongs to Rate-of-Change (from docs, not practiced).

.claude/skills/system-management/tasks/read-write-item.md

@@ -32,9 +32,12 @@ Quality = 0
 - **Status** is a number from `STATUS_DF` (export it with `dssqld -e status_df.qli -d STATUS_DF -c`
   to look numbers up). Common ones: 9 `NORMAL`, 13 `NOT INIT` (never written; new items start
   here), 4 / 5 `BOOLEAN 0` / `BOOLEAN 1`, 11 `HIGH HIGH`.
-- **Options** lists item flags as words after the hex value, e.g. `ack` (acknowledged),
+- **Options** lists item flags as words after the hex value (option bits, IM 36K10C10 §3.5):
-  `off` (item's station not communicating). `uoff` also appears on station items after a write;
+  `blk` 1 blocked, `off` 2 offline (station not communicating), `uoff` 4 **updated offline**
-  its meaning is not yet known (see `knowledge/issues.md` ISS-001).
+  (written by an application such as `itmval` while offline), `ack` 8 acknowledged, `ublk` 16
+  **updated blocked** (written while blocked, e.g. with `-o`); 32/64 direct/delayed alarm.
+  So writing a station item whose station is down adds `uoff` (0x…8a → 0x…8e); internal items
+  (no station) never get it.
 
 ## Read limits
 

.claude/skills/system-management/tasks/tuning-checks.md

@@ -37,8 +37,20 @@ Read the newest entries:
 Test system (2026-09-30): common memory 665.6 MB, free 665.3 MB; queues empty; 3 lock
 collisions in total.
 
+## Live values from the interactive debuggers (read-only)
+
+The debuggers ask for a code; pipe the answers in and end with `-1` (exit). Use only the
+read-only codes listed in the manual summaries:
+
+| Command | Shows | Reference |
+|---|---|---|
+| `printf '2\n-1\n' \| itmdbg` | item common size/free, number of items, integration granule, update counters | `knowledge/manuals/IM36K10L36-01EN.md` §4 |
+| `printf '1\n-1\n' \| eqpdbg 0 <EQP process>` | equipment manager: lines attached, scan tick, slave count, line load % | `knowledge/manuals/IM36K10L40-01EN.md` §3 |
+
+Verified 2026-09-30 (bash). Other codes change the running system (delete items, unlock,
+update scan status); do not use them without the user's approval.
+
 ## Not yet practiced
 
-Debug launchers (`jwuipoi_debug`, `jhmiset_debug`, …), interactive debuggers (`itmdbg`,
+Debug launchers (`jwuipoi_debug`, `jhmiset_debug`, …), other debuggers (`opcdbg`, `ithdbg`,
-`opcdbg`, `eqpdbg`, …), and per-process debug settings; see
+…), and per-process debug settings; see `knowledge/manuals/IM36K10J10-01EN.md` §5.5.2.
-`knowledge/manuals/IM36K10J10-01EN.md` §5.5.2.

examples/CI-Eng-Sample/01_section_df.qli

@@ -14,3 +14,4 @@ NAME,SECTION_PATH,SECTION_NAME,DESCRIPTION
 "CI-Eng-Sample.PUMP1","CI-Eng-Sample","PUMP1","Sample pump 1"
 "CI-Eng-Sample.SYSTEM","CI-Eng-Sample","SYSTEM","Sample system monitoring"
 "CI-Eng-Sample.DEMO","CI-Eng-Sample","DEMO","Tutorial examples (class/object)"
+"CI-Eng-Sample.PLC1","CI-Eng-Sample","PLC1","Modbus loopback station CIENG_PLC"

examples/CI-Eng-Sample/02_item_df.qli

@@ -19,3 +19,4 @@ LOW_LOW_LIMIT,LOW_LIMIT,HIGH_LIMIT,HIGH_HIGH_LIMIT,SCALE_LOW_LIMIT,SCALE_HIGH_LI
 "CI-Eng-Sample.SYSTEM.PING_LOCALHOST","localhost reachable, from inttcpmon","Integer","9",0,0,0,0,0,1
 "CI-Eng-Sample.SYSTEM.PROC_ALM","ALARM process (alm) running, from intmon","Integer","9",0,0,0,0,0,1
 "CI-Eng-Sample.DEMO.COUNTER","Counter 1..100 driven by object DEMO.INCR1","Integer","999",0,0,0,0,0,100
+"CI-Eng-Sample.PLC1.COMM_OK","Station CIENG_PLC communication (1 = good), status item","Boolean","",0,0,0,0,0,0

examples/CI-Eng-Sample/02b_sub_item_df.qli

@@ -5,7 +5,7 @@ ENGLISH
 1.03.00
 
 ! CI-Eng-Sample sub-items (Tutorial IM 36K10G10-01EN 3.1.5, 3.2.3), CI Server R1.03.00
-! Integrator: adds value x seconds (RUNNING = 1 -> running seconds; TIME_UNIT has no effect, verified).
+! Integrator: adds value x integration granule (itm_int_secs in itm.sup, default 1 s; TIME_UNIT has no effect, verified).
 ! Min-Max: keeps the maximum (or minimum) of the main item.
 @FIELDS
 NAME,DESCRIPTION,SUB_TYPE,TIME_UNIT,MIN_MAX

examples/CI-Eng-Sample/08_auth_group_df.qli

@@ -0,0 +1,13 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample read-only authorization group (IM 36K10C10-01EN 2.4), CI Server R1.03.00
+! Actions are NAME values from AUTH_ACTION_DF.
+@FIELDS
+NAME,DESCRIPTION,ACTION_NAME_1,ACTION_NAME_2,ACTION_NAME_3,ACTION_NAME_4
+
+@AUTH_GROUP_DF
+"CIENG_VIEWER","CI-Eng-Sample read-only viewer","ITEM_READ","SECTION_READ","ALARM_CURRENT_READ","ALARM_CHRONO_READ"

examples/CI-Eng-Sample/09_modbus_line_df.qli

@@ -0,0 +1,14 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample Modbus line (IM 36K10L41-01EN 3.6.1), CI Server R1.03.00
+! Loading it creates tls\com\eqpcieng_start.cmd, _stop.cmd and tls\sup\eqpcieng.sup and
+! starts equipment manager EQPCIENG (eqpmdc) after a few seconds. EQUIPMENT_NODE blank = local node.
+@FIELDS
+NAME,DESCRIPTION,LINE_TYPE,EQUIPMENT_MAN,HEART_BEAT,TIMEOUT,DEAD_TIME,REPEAT_CONNECTION_DELAY
+
+@MODBUS_LINE_DF
+"CIENG_MB_LINE","CI-Eng-Sample Modbus loopback line","TCP/IP","EQPCIENG",100,3000,30,10

examples/CI-Eng-Sample/10_modbus_station_df.qli

@@ -0,0 +1,30 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample Modbus station, scan type and points (IM 36K10L41-01EN 3.6.3-3.6.5), CI Server R1.03.00
+! The station talks to CI Server's own Modbus slave mirror (eqpmdcmem + eqpmdcslvtcp on port 5020,
+! started by equipment/eqpciengslv_start.cmd). Protocol must be Open Modbus/TCP (RTU does not answer).
+! Input and holding registers share memory in the mirror (RI:1 = RO:1), as do inputs and coils (DI:1 = DO:1).
+@FIELDS
+NAME,DESCRIPTION,LINE,PROTOCOL,LINE_1_DEVICE,SUB_STATION_ID,OUTPUT_METHOD,STATUS_ITEM,ON_SCAN
+
+@MODBUS_STATION_DF
+"CIENG_PLC","Loopback to CI Server Modbus slave (port 5020)","CIENG_MB_LINE","Open Modbus/TCP","localhost:5020",1,"On change and connect","CI-Eng-Sample.PLC1.COMM_OK",1
+
+@FIELDS
+NAME,DESCRIPTION,SCAN_INTERVAL
+
+@MODBUS_SCAN_TYPE_DF
+"CIENG_SCAN1S","CI-Eng-Sample 1 s scan",1000
+
+@FIELDS
+NAME,STATION,POINT,DESCRIPTION,IO_ADDRESS,EXTERNAL_RELATION,SCAN_TYPE,CONV_TYPE,BITS
+
+@MODBUS_POINT_DF
+"CIENG_PLC:SP","CIENG_PLC","SP","Setpoint, holding register 1","RO:1","Output","CIENG_SCAN1S","Binary",16
+"CIENG_PLC:PV","CIENG_PLC","PV","Read-back, input register 1 (same memory)","RI:1","Input","CIENG_SCAN1S","Binary",16
+"CIENG_PLC:CMD","CIENG_PLC","CMD","Command, coil 1","DO:1","Output","CIENG_SCAN1S","Digital",1
+"CIENG_PLC:FB","CIENG_PLC","FB","Feedback, input bit 1 (same memory)","DI:1","Input","CIENG_SCAN1S","Digital",1

examples/CI-Eng-Sample/11_item_eqp_df.qli

@@ -0,0 +1,15 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! CI-Eng-Sample items connected to Modbus points (ITEM_DF STATION + POINT), CI Server R1.03.00
+@FIELDS
+NAME,DESCRIPTION,ITEM_REP,VALUE_FORMAT,STATION,POINT
+
+@ITEM_DF
+"CI-Eng-Sample.PLC1.SETPOINT","Setpoint written to holding register 1","Integer","99999","CIENG_PLC","SP"
+"CI-Eng-Sample.PLC1.READBACK","Read back from input register 1","Integer","99999","CIENG_PLC","PV"
+"CI-Eng-Sample.PLC1.CMD","Command written to coil 1","Boolean","","CIENG_PLC","CMD"
+"CI-Eng-Sample.PLC1.FEEDBACK","Feedback read from input bit 1","Boolean","","CIENG_PLC","FB"

examples/CI-Eng-Sample/80_remove_item_eqp_df.qli

@@ -0,0 +1,15 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove the CI-Eng-Sample items connected to Modbus points
+@FIELDS
+NAME
+
+@ITEM_DF
+"CI-Eng-Sample.PLC1.SETPOINT"
+"CI-Eng-Sample.PLC1.READBACK"
+"CI-Eng-Sample.PLC1.CMD"
+"CI-Eng-Sample.PLC1.FEEDBACK"

examples/CI-Eng-Sample/81_remove_modbus_station_df.qli

@@ -0,0 +1,21 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove CI-Eng-Sample Modbus points, scan type and station (points first)
+@FIELDS
+NAME
+
+@MODBUS_POINT_DF
+"CIENG_PLC:SP"
+"CIENG_PLC:PV"
+"CIENG_PLC:CMD"
+"CIENG_PLC:FB"
+
+@MODBUS_STATION_DF
+"CIENG_PLC"
+
+@MODBUS_SCAN_TYPE_DF
+"CIENG_SCAN1S"

examples/CI-Eng-Sample/82_remove_modbus_line_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove the CI-Eng-Sample Modbus line (after its stations)
+@FIELDS
+NAME
+
+@MODBUS_LINE_DF
+"CIENG_MB_LINE"

examples/CI-Eng-Sample/85_remove_auth_group_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove the CI-Eng-Sample authorization group (remove its users first)
+@FIELDS
+NAME
+
+@AUTH_GROUP_DF
+"CIENG_VIEWER"

examples/CI-Eng-Sample/91_remove_item_df.qli

@@ -18,3 +18,4 @@ NAME
 "CI-Eng-Sample.SYSTEM.PING_LOCALHOST"
 "CI-Eng-Sample.SYSTEM.PROC_ALM"
 "CI-Eng-Sample.DEMO.COUNTER"
+"CI-Eng-Sample.PLC1.COMM_OK"

examples/CI-Eng-Sample/92_remove_section_df.qli

@@ -12,5 +12,6 @@ NAME
 "CI-Eng-Sample.TANK1"
 "CI-Eng-Sample.PUMP1"
 "CI-Eng-Sample.SYSTEM"
+"CI-Eng-Sample.PLC1"
 "CI-Eng-Sample.DEMO"
 "CI-Eng-Sample"

examples/CI-Eng-Sample/README.md

@@ -39,7 +39,7 @@ cmd /c "<repo>\examples\CI-Eng-Sample\remove.cmd"
 | `CI-Eng-Sample.SYSTEM.DISK_C` | Item, Real | Target for `intdskmon` (reports **used** %) |
 | `CI-Eng-Sample.SYSTEM.PING_LOCALHOST` | Item, Integer | Target for `inttcpmon` (1 = reachable) |
 | `CI-Eng-Sample.SYSTEM.PROC_ALM` | Item, Integer | Target for `intmon` (1 = `alm` process running) |
-| `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` | Sub-item, Integrator | Running time in seconds (adds value × seconds) |
+| `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` | Sub-item, Integrator | Running time in seconds (adds value × integration granule, `itm_int_secs` in `itm.sup`, default 1 s) |
 | `CI-Eng-Sample.TANK1.LEVEL.MAX` | Sub-item, Min-Max | Highest level seen |
 | `CI-Eng-Sample.DEMO` | Section | Tutorial examples |
 | `CI-Eng-Sample.DEMO.COUNTER` | Item, Integer | Counts 1…100, one step per second, written by `DEMO.INCR1` |
@@ -47,8 +47,16 @@ cmd /c "<repo>\examples\CI-Eng-Sample\remove.cmd"
 | `CIENG_INCR` | Class (traditional) | Increments `DEMO.COUNTER`, wraps at 100; compiled on load |
 | `CI-Eng-Sample.DEMO.INCR1` | Object | Instance of `CIENG_INCR` |
 | `CIENG_EVENT` | Item storage group | Event/Item, lifetime 1 week, rollover 1 day |
+| `CI-Eng-Sample.PLC1` | Section | Modbus loopback station |
+| `CI-Eng-Sample.PLC1.COMM_OK` | Item, Boolean | Status item of station `CIENG_PLC` (1 = communicating, status 22 when off-scan) |
+| `CI-Eng-Sample.PLC1.SETPOINT` / `.READBACK` | Items, Integer | Written to holding register 1 (`RO:1`) / read from input register 1 (`RI:1`), same memory |
+| `CI-Eng-Sample.PLC1.CMD` / `.FEEDBACK` | Items, Boolean | Written to coil 1 (`DO:1`) / read from input bit 1 (`DI:1`), same memory |
+| `CIENG_MB_LINE` | Modbus line (TCP/IP) | Equipment manager `EQPCIENG` (created and started by loading the line) |
+| `CIENG_PLC` | Modbus station | Open Modbus/TCP to `localhost:5020`, unit 1, output method *On change and connect* |
+| `CIENG_SCAN1S` | Modbus scan type | 1000 ms |
+| `CIENG_VIEWER` | Authorization group | Read-only: `ITEM_READ`, `SECTION_READ`, `ALARM_CURRENT_READ`, `ALARM_CHRONO_READ`. No users are created by the sample. |
 
-All items are internal (no station), so the project works without any PLC or simulator.
+All items except `PLC1.*` are internal (no station). The `PLC1` station talks to CI Server's own Modbus slave mirror (see below), so no PLC is needed either.
 New items start with status 13 (`NOT INIT`) until a value is written.
 
 ## Files
@@ -61,10 +69,29 @@ New items start with status 13 (`NOT INIT`) until a value is written.
 | `03_his_group_df.qli` | Item storage group (`HIS_GROUP_DF`) |
 | `04_item_his_df.qli` | Items in the storage group (`ITEM_HIS_DF`, name `<group>:<item>`) |
 | `05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli` | Trigger group, class (source in the `METHOD` memo, `@"` … `"@`, `COMPILE` 1), object |
-| `86_`…`92_remove_*.qli` | Names to delete, in reverse order |
+| `08_auth_group_df.qli` | Authorization group (`AUTH_GROUP_DF`) |
+| `09_modbus_line_df.qli`, `10_modbus_station_df.qli`, `11_item_eqp_df.qli` | Modbus line; station, scan type, points; items connected to points |
+| `equipment/eqpciengslv_start.cmd`, `_stop.cmd` | Start/stop the Modbus slave mirror (copy to `tls\com`) |
+| `80_`…`92_remove_*.qli` | Names to delete, in reverse order |
 | `load.cmd`, `remove.cmd` | Run the steps in the right order |
 | `monitoring/*.sup.txt` | Setup-file lines for the monitoring processes (not applied by `load.cmd`) |
 
+## Modbus slave mirror (for station CIENG_PLC)
+
+`CIENG_PLC` reads and writes CI Server's own Modbus slave: `eqpmdcmem` (slave memory) and
+`eqpmdcslvtcp` (Modbus TCP on port 5020). Without them the station reports bad communication
+(`COMM_OK` = 0) but everything loads. To start them with CI Server, an administrator copies
+`equipment/eqpciengslv_start.cmd` and `eqpciengslv_stop.cmd` to `%TLS_ROOT_PATH%\tls\com`;
+for a quick test they can also be started by hand from a normal prompt:
+
+```
+start eqpmdcmem -n EQPMDCMEM
+start eqpmdcslvtcp -n EQPMDCSLVTCP -p 5020
+```
+
+Remove the two files from `tls\com` when the sample is removed. See skill `equipment`, task
+`modbus-station.md`.
+
 ## Monitoring processes (optional)
 
 `monitoring/` holds the lines to add to the setup files in `%TLS_ROOT_PATH%\tls\sup\` so that

examples/CI-Eng-Sample/equipment/eqpciengslv_start.cmd

@@ -0,0 +1,5 @@
+@echo off
+REM CI-Eng-Sample: start the Modbus slave mirror used by station CIENG_PLC.
+REM Copy to %TLS_ROOT_PATH%\tls\com (administrator); equipment_start.cmd calls every eqp*start.cmd there.
+start /B /NORMAL %TLS_ROOT_PATH%\tls\exe\eqpmdcmem.exe -n EQPMDCMEM
+start /B /NORMAL %TLS_ROOT_PATH%\tls\exe\eqpmdcslvtcp.exe -n EQPMDCSLVTCP -p 5020

examples/CI-Eng-Sample/equipment/eqpciengslv_stop.cmd

@@ -0,0 +1,4 @@
+@echo off
+REM CI-Eng-Sample: stop the Modbus slave mirror.
+%TLS_ROOT_PATH%\tls\exe\durstp.exe -msk -t 10 -p EQPMDCSLVTCP
+%TLS_ROOT_PATH%\tls\exe\durstp.exe -msk -t 10 -p EQPMDCMEM

examples/CI-Eng-Sample/load.cmd

@@ -15,3 +15,12 @@ rem Processing: trigger group, class (compiled on load via COMPILE = 1), object
 dssqld -i 05_trigger_df.qli -l 05_trigger_df.qlo
 dssqld -i 06_class_df.qli -l 06_class_df.qlo
 dssqld -i 07_object_df.qli -l 07_object_df.qlo
+rem Authorization: read-only group (no users are created by the sample)
+dssqld -i 08_auth_group_df.qli -l 08_auth_group_df.qlo
+rem Equipment: Modbus loopback line, station, scan type, points, connected items.
+rem The station needs the Modbus slave mirror (equipment\eqpciengslv_start.cmd, see README).
+dssqld -i 09_modbus_line_df.qli -l 09_modbus_line_df.qlo
+echo Waiting 15 seconds for equipment manager EQPCIENG to start...
+powershell -NoProfile -Command "Start-Sleep -Seconds 15"
+dssqld -i 10_modbus_station_df.qli -l 10_modbus_station_df.qlo
+dssqld -i 11_item_eqp_df.qli -l 11_item_eqp_df.qlo

examples/CI-Eng-Sample/remove.cmd

@@ -5,6 +5,10 @@ rem Order: object, class, trigger group, storage links, stop + delete storage gr
 rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the
 rem group first gets a stop time one minute ahead; the script waits until it has passed.
 cd /d "%~dp0"
+dssqld -r 80_remove_item_eqp_df.qli -l 80_remove_item_eqp_df.qlo
+dssqld -r 81_remove_modbus_station_df.qli -l 81_remove_modbus_station_df.qlo
+dssqld -r 82_remove_modbus_line_df.qli -l 82_remove_modbus_line_df.qlo
+dssqld -r 85_remove_auth_group_df.qli -l 85_remove_auth_group_df.qlo
 dssqld -r 86_remove_object_df.qli -l 86_remove_object_df.qlo
 dssqld -r 87_remove_class_df.qli -l 87_remove_class_df.qlo
 dssqld -r 88_remove_trigger_df.qli -l 88_remove_trigger_df.qlo

knowledge/issues.md

@@ -19,21 +19,28 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 
 | ID | Date | Area | Issue | Status | Next step / resolution | Update on close |
 |---|---|---|---|---|---|---|
-| ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | open | 2026-09-30: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. 2026-09-30 later: unblocking a sample item left the flag `ublk` (after `blk` was cleared), so `u…` flags may mean "was …" (un-blocked / un-offline). Still unconfirmed. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" |
+| ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.5 gives the option bits: 1 blocked, 2 offline, **4 updated offline** (written by an application while offline), 8 acknowledged, **16 updated blocked**, 32 direct alarm, 64 delayed alarm. 0x8a = offline + acknowledged (+0x80, not documented); +4 = 0x8e, so `uoff` = updated offline and `ublk` = updated blocked. Matches all observations. Not yet found: how to clear the flags (probably on the next update from the station). Closed 2026-09-30 (confirmed by user). Earlier notes: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. 2026-09-30 later: unblocking a sample item left the flag `ublk` (after `blk` was cleared), so `u…` flags may mean "was …" (un-blocked / un-offline). Still unconfirmed. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" |
 | ISS-002 | 2026-09-30 | DATABASE (`dsschk`) | `dsschk -d ITEM_DF -v` (check only) exits 0 with no console output and nothing new in `umhlog.log`. Where results are reported is unknown. | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: `dsschk -e -v` prints a start/end line per dataset (228 checked, no problems) and logs to `umhlog.log`. Plain `dsschk` only compares copies between nodes, so it prints nothing on a single-node system. `ismchk` needs a database file name (usage: `ismchk data_base_name`), not run yet. | Create `.claude/skills/system-management/tasks/consistency-check.md` and add it to that skill's `SKILL.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.1 consistency tools (add where output goes); `knowledge/progress.md` row "Consistency check" |
 | ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
 | ISS-004 | 2026-09-30 | ITEM (`itmval`) | `itmval -g -a <1..5>` returns `ITM-E-WRONG_ATT` on `AID.WRPS.*` items, so reading limits is unproven. | closed | Closed 2026-09-30 (confirmed by user). On `CI-Eng-Sample.TANK1.LEVEL` (limits set) `-a 1..5` returned deadband 0, low 20, high 80, low-low 10, high-high 90. The error only occurs on items without limits. | `.claude/skills/system-management/tasks/read-write-item.md` (limits section); `knowledge/progress.md` row "Read an item with `itmval -g`" |
 | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
-| ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
+| ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. 2026-09-30 (phase 5): IM 36K10L35 §1.3/§5 explains the first part: event storage picks the unit by time stamp, never older than 60 units, and within the storage process's `gap_time` (ITHEEX/ITHEIX 2880 min) and, for EVENT/ITEM, `max_sample_delay` (ITHEIX 14400 min); older data needs earlier unit files (`hisdbg`, `hisrecover`, `isfrename`), `ithrecover <group> -p` and a restart. Practice in phase 9. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
 | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
 | ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill |
 | ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
 
-| ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | open | Confirm with ITEM Service manuals (IM 36K10L35/L36) in phase 5: is there a scaling option for integrators? | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
+| ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.2 and `itm.sup` answer it: the integral is divided by the **integration granule** `itm_int_secs` (label "Integration granule, sec.") in `itm.sup` — **system-wide**, installed value 1 (seconds); 60 = minutes, 3600 = hours. `TIME_UNIT` only applies to Rate-of-Change. Practiced 2026-09-30: set to 60 and restarted → `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` rose exactly 1.0 in 60 s; restored to 1 (file identical to backup) → 8 in 8 s. Existing integrator values are not converted when the granule changes. Closed 2026-09-30 (confirmed by user). | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
 | ISS-011 | 2026-09-30 | ITEM (blocking) | A write to a blocked item with `itmval -p` (without `-o`) is silently ignored: no error message, value unchanged. | open | Check in phase 5 whether any status/return code signals this. | `.claude/skills/system-management/tasks/read-write-item.md` |
 | ISS-012 | 2026-09-30 | CI Portal setup files | IM 36K10R10 §4.4 names the alarm item/display relation setup file `wfla_displays.sup`; the installed file is `wfla_display.sup` (no `s`). | closed | Closed 2026-09-30 (user decision: the installed software and files are the reference). The repo uses `wfla_display.sup`. | `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/tasks/read-setup-file.md` |
 | ISS-013 | 2026-09-30 | CI Portal setup files | Installed values differ from the defaults stated in IM 36K10R10 §4.4: `wfla_display.sup` `DUR_QUEUE_SIZE = 1000` (manual 500 kB); `wflgdi.sup` `DUR_QUEUE_SIZE = 252` (manual 1000 kB); `wfla_display.sup` and `wflcdi.sup` set `TIMER_INTERVAL = 10` (manual: 1 s when not set). | closed | Closed 2026-09-30 (user decision: the installed software and files are the reference). The repo quotes the installed values as defaults. | `knowledge/manuals/IM36K10R10-01EN.md` §4 |
 | ISS-014 | 2026-09-30 | CI Portal setup files | `jwuiisg.sup` has a *Security* tab (`SECURITY_ENABLED`, `CORS_ENTRY`, `HEADER_ENTRY`) that IM 36K10R10 §4.3 does not describe. | closed | Closed 2026-09-30 (user decision: the installed software and files are the reference). Documented from the file's own `!KEYWORD`/`!HELP` text. Installed CORS allows all origins (`allowedOrigins "*"`); tightening it is a site security decision. | `knowledge/manuals/IM36K10R10-01EN.md` §4.3 |
 | ISS-015 | 2026-09-30 | Setup File Editor | In `wfla_display.sup` the seven main keywords (`RELATION_LOCATION` … `TIMER_INTERVAL`) come before the only tab line `!TAB = Debug`. By IM 36K10R20 §3.1, keywords before the first `!TAB` are not shown, yet IM 36K10R10 §4.4.1 shows them on a *General* tab. What the editor really shows is unknown. | closed | Closed 2026-09-30 (checked in the Setup File Editor by the user; installed software is the reference). The editor shows keywords placed before the first `!TAB` on a **General** tab, followed by the defined tabs: `wfla_display.sup` shows *General* (all 7 fields, values as in the file) and *Debug*. The manual's statement that such keywords are ignored does not hold in R1.03. | `knowledge/manuals/IM36K10R20-01EN.md` §3; `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/tasks/change-setup-file.md` |
 | ISS-016 | 2026-09-30 | Setup File Editor | The R1.03 editor has features IM 36K10R20 §2 does not describe: a *Templates* tab next to *Setup Files*; a *Status* column in the file list (e.g. "Default"); *Undo Field* and *Reset Field* buttons on the edit form besides OK/Cancel/Help; a status bar with the selected file's description and the time. | open | Installed software is the reference (user decision). 2026-09-30, tested on `wfla_display.sup` (`DUR_QUEUE_SIZE` 1000 → 2000): clicking **OK writes the file immediately** (only the active line changed; the manual says OK keeps the change in memory until Exit). Status becomes **Changed** when an active value differs from the file's `!DEFAULT` block; the changed field's label turns **blue**. *Reset Field* is enabled when the cursor is in a changed field; *Reset Field* + *OK* put the value back to the `!DEFAULT` value (2000 → 1000) and wrote the file at once (16:22:28); the rest of the file was unchanged. Still to find: what *Templates* holds and what *Undo Field* does. | `knowledge/manuals/IM36K10R20-01EN.md` §2; `.claude/skills/portal-setup/tasks/change-setup-file.md` |
-| ISS-017 | 2026-09-30 | CI Portal setup files | IM 36K10R10 §4 says the logon method is the one user-interface setting normally changed, but the R1.03 `jwuiisg.sup` *Information* tab says the login method and login control settings have moved to `dssana.sup` (authentication and authorization). `dssana.sup` is not described in R10. | open | Installed software is the reference. 2026-09-30: `dssana.sup` ("Authentication and authorization setup") has tabs General, User Interfaces, Clients System Trust, Login control (`LOGIN_METHOD = <client>, <user interface>, <method>, …`), Active Directory, Single Sign On, Password rules, Logging. Manuals mentioning it: IM 36K01A50 (5×), 36K10C10 (6×), 36K10J40 (13×), 36K10L45 (2×), 36K10L50 (3×). Cover it in phase 5 (C10) and phase 13 (J40). | `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/SKILL.md` |
+| ISS-017 | 2026-09-30 | CI Portal setup files | IM 36K10R10 §4 says the logon method is the one user-interface setting normally changed, but the R1.03 `jwuiisg.sup` *Information* tab says the login method and login control settings have moved to `dssana.sup` (authentication and authorization). `dssana.sup` is not described in R10. | open | Installed software is the reference. 2026-09-30: `dssana.sup` ("Authentication and authorization setup") has tabs General, User Interfaces, Clients System Trust, Login control (`LOGIN_METHOD = <client>, <user interface>, <method>, …`), Active Directory, Single Sign On, Password rules, Logging. Manuals mentioning it: IM 36K01A50 (5×), 36K10C10 (6×), 36K10J40 (13×), 36K10L45 (2×), 36K10L50 (3×). Cover it in phase 5 (C10) and phase 13 (J40). 2026-09-30: login methods (Automatic, Manual CI Server, Manual OS, No, SSO, Deny) now summarized from C10 §2.2 in `knowledge/manuals/IM36K10C10-01EN.md`; AD/SSO details remain for J40. | `knowledge/manuals/IM36K10R10-01EN.md` §4; `.claude/skills/portal-setup/SKILL.md` |
+| ISS-018 | 2026-09-30 | Authorization (`dssana.sup`) | IM 36K10C10 §2.2 says the *No* login method applies the user profile `FT_NO_LOGIN`; the installed `dssana.sup` names `CI_NO_LOGIN` (and `CI_NO_LOGIN_OPCUAS` for anonymous OPC UA) as the no-login profile. `USER_DF` on the test system has `CI_NO_LOGIN_OPCUAS` but no `CI_NO_LOGIN`. | open | Installed software is the reference: use `CI_NO_LOGIN`. Still to check: behaviour of a *No* login when that user does not exist (manual: no profile applied). Covered again in phase 13 (IM 36K10J40). | `knowledge/manuals/IM36K10C10-01EN.md` §2 |
+| ISS-019 | 2026-09-30 | ITEM (string items) | Maximum string item length differs by source: IM 36K10C10 §3.3.4 says default 80, max 100; the Tutorial summary says up to 168 without audit; the data dictionary (`dssqld -f`) gives `ITEM_DF.STRING_LENGTH` range 1–200, default 80. | closed | Tested 2026-09-30 on CI-Eng-Sample (`dssqld -i`, `itmval -p/-g`, non-elevated): `STRING_LENGTH` 100, 168 and 200 load with or without `AUDIT_INFO`; 201 fails with `DSS-E-VAL_RANGE`. An item holds **length − 1** characters: a 99-character value in a length-100 item is stored with status 9 NORMAL; longer values are cut to length − 1 with status **12 OVERRANGED** (100 → 99, 200 → 199, 201 → 199). So the data dictionary (1–200) is right. Test items removed. Closed 2026-09-30 (confirmed by user). | `knowledge/manuals/IM36K10C10-01EN.md` §3; `knowledge/manuals/IM36K10G10-01EN.md` (items); `.claude/skills/item-engineering/SKILL.md` |
+| ISS-020 | 2026-09-30 | DATABASE (`dssqld`) | `dssqld -i "<long absolute path>\user.qli"` failed with `CRL-E-ENOENT` / `DSSQ-E-QLD_FILOPN`: the path in the message was cut after 79 characters (`…\73b3559a-12.`). A relative file name from the same folder works. Similar to the `intspawn` path limit (ISS-007). | open | Find the exact limit (79/80 characters?) and whether `-l` and `-e` paths are also cut. Until then: `cd` to the folder and use short relative names. | `.claude/skills/system-management/tasks/load-remove-records.md`; `.claude/skills/system-management/tasks/export-dataset.md` |
+| ISS-021 | 2026-09-30 | EQUIPMENT (`eqpiostat`) | IM 36K10L40 §2 says `eqpiostat` stores hourly I/O statistics per station line in "history group STATION_STAT". On the test system `eqpiostat` runs (started by `equipment_start.cmd` on the host node) and `STATION_STAT` is a dataset, but `dssqld -e` returned 0 records, also with filters on `TIME_STAMP` and `STATION` (AID Modbus stations, which send requests). | open | Check whether records appear after a full hour with a communicating station, or whether the dataset is read another way (e.g. Engineering Module, report). | `knowledge/manuals/IM36K10L40-01EN.md` §2 |
+| ISS-022 | 2026-09-30 | ITEM (`itmval -f`) | `itmval -f <file> vs -n CI-Eng-Sample.TANK1.LEVEL` (IM 36K10L36 §1.4, write a restore command) crashes with a segmentation fault (bash) / access violation 0xC0000005 (PowerShell) and writes no file; also with `-l`. The manual's space-separated form `-n <inst> <unit> <tag>` is rejected with `FSL-E-NARG_ALL`. `itmval -g`/`-p` work. | open | Workaround: build restore lines from `itmval -g` output. Report to Yokogawa support if needed. | `knowledge/manuals/IM36K10L36-01EN.md` §3; `.claude/skills/system-management/tasks/read-write-item.md` |
+| ISS-023 | 2026-09-30 | ITEM / ITH (manual vs install) | Installed ITEM Service differs from IM 36K10L35/L36: `item_start.cmd` starts `itheix` (EVENT/ITEM storage, not described), aggregation `ithsag`/`ithrag`, two instances of each retrieve process, and `itmtim 100 1000 1 200 1` (five arguments, three documented); `itm.sup` item pool is 650000 KB (manual default 50000) and has `not_regained` (not described); `itheix.sup` has `max_sample_delay`, `max_samples_queued`, `max_open_files`. | closed | Closed 2026-09-30 (user decision: the installed software is the reference). Summaries describe the installed values. | `knowledge/manuals/IM36K10L35-01EN.md`; `knowledge/manuals/IM36K10L36-01EN.md` |
+| ISS-024 | 2026-09-30 | EQUIPMENT (Modbus slave) | IM 36K10L41 §3.7 says `EQPMDCSLVTCP` waits for "MODBUS RTU requests via TCP/IP" and the CI Server master should use "MODBUS RTU via TCP/IP". A Modbus master station with `PROTOCOL = RTU` to `eqpmdcslvtcp` (port 5020) got no answer (`EQP-E-TCPRCVTMO`, 4 requests, 0 valid); with `Open Modbus/TCP` it worked at once. | closed | Closed 2026-09-30 (user decision: installed software is the reference). Use `Open Modbus/TCP` towards `eqpmdcslvtcp`. | `knowledge/manuals/IM36K10L41-01EN.md` §3.7; `.claude/skills/equipment/tasks/modbus-station.md` |

knowledge/manuals/IM36K10C10-01EN.md

@@ -0,0 +1,247 @@
+---
+manual: IM 36K10C10-01EN
+title: Engineering Module - I/O Processes
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; setup files and default datasets (users, authorization groups, schemes, trigger groups) checked read-only on the test system (2026-09-30)
+---
+
+# Engineering Module - I/O Processes (R1.03)
+
+The Engineering Module (Java GUI) defines what CI Server knows: users and rights, sections,
+items and sub-items, equipment (lines, stations, points, scan types), item statuses, classes,
+sequences and trigger groups. Section numbers refer to the manual. Command-line equivalents
+used in this repo are given where they exist (quick load with `dssqld`, dataset names from
+`dssqld -f`).
+
+## 1. Window (§1)
+
+Menu bar, toolbar, configuration tree (left), work area with property sheets, message area and
+edit history (undo/redo of edits).
+- *View → List*: List Items (item search), List Objects, item list of a section with values,
+  record layout list.
+- *Archive*: automatic/manual archive, retrieve, mount/initialize/register storage media
+  (history, phase 9).
+- *Playback*: record Engineering Module operations and open the recording viewer.
+- Configuration tree areas: sections and items; I/O processing (equipment, classes, …);
+  alarms; reports; history; authorization; references.
+
+## 2. Authorization (§2)
+
+**Login setup lives in `dssana.sup`** (Setup File Editor), on **CI Core**, so each CI Portal /
+user interface combination can have its own login method (tab *Login control*,
+`LOGIN_METHOD = <client>, <user interface>, <method>, <prompt to define users>, <no-login
+profile>`). It also holds single sign-on, Active Directory and password rules (§2.1.1, §2.2).
+
+Login methods:
+
+| Method | Behaviour |
+|---|---|
+| Automatic | Windows user name = CI Server user name; no password |
+| Manual CI Server | CI Server login form; user must exist in CI Server |
+| Manual OS | Windows login form; with AD on, AD attributes pick the CI Server profile; with AD off the Windows name (without domain) must exist as CI Server user |
+| No | No login; a no-login profile is applied. Only on CI Portal itself, not remote CI View. Protect that profile with a password. |
+| SSO | AD single sign-on, no credentials; if SSO is off in `dssana.sup`, falls back to Manual CI Server |
+| Deny | The user interface cannot be started |
+
+With AD, a user in several groups gets the merged profiles (priority per profile). If no users
+exist yet, the Engineering Module asks you to define one instead of logging in.
+
+Test system (`dssana.sup` installed values): local Engineering/Edit Module, Operator
+Interface etc. use **SSO**; remote Playback Viewer, Quickload and Display/Symbol utilities are
+**Deny**; OPC UA/ODBC use *Manual CI Server*. The no-login profile named there is
+`CI_NO_LOGIN` (the manual says `FT_NO_LOGIN`, ISS-018); no user of that name exists on the
+test system.
+
+**Enterprise engineers (§2.3)** may maintain only their area: sections and everything in them,
+definitions and deployments, authorization data, and equalization — and can deploy to a
+server only if they have write rights there (e.g. on `ITEM_DF`).
+
+**Authorization groups (§2.4)** (`AUTH_GROUP_DF`, actions in `AUTH_ACTION_DF`): a group is a
+list of allowed actions. Most are `<CATEGORY>_<READ|INSERT|MODIFY|DELETE>` for a dataset
+category (e.g. `ITEM`, `SECTION`, `STATION`, `CLASS`, `OBJECT`, `USER`, `AUTH_GROUP`,
+`TRIGGER_GROUP`, `HIS_GROUP`, `REPORT`, `DISPLAY`, `ALARM_*`, `AUD*`). Others are single
+actions, e.g. `ITEM_MODIFY_VALUE`, `ITEM_MODIFY_LIMIT_HIGH`, `ITEM_MODIFY_BLOCKED_VALUE`,
+`ITEM_ACK_ALARM`, `SECTION_BLOCK_UNBLOCK`, `STATION_ON_OFF_SCAN`, `ALARM_CURRENT_ACK`,
+`REPORT_GENERATE_ADHOC`, `SYS_LOG_READ`, `EXECUTE_GENERAL_COMMANDS`,
+`HIS_GROUP_FORCE_ROLLOVER`. Installed also: `AGGREGATION_OVERWRITE_*` (not in the manual).
+Default groups on R1.03: `SYSTEM_MANAGER`, `ENGINEER`, `OPERATOR` (process areas 1–999) and
+`GUEST`.
+
+**Users (§2.5)** (`USER_DF`); changes apply at the user's next login. Tabs:
+- *General*: name, description, password (≤ 31 characters, case-sensitive), enterprise user
+  (must be deployed to every CI Core where needed), authorization group, process areas
+  (1–999, lists/ranges like `3 5 8 10-19`), locale (`en-US`, `ja-JP`; blank = Windows).
+- *Directory services*: AD group mapping and profile priority (higher wins when merging).
+- *Alarming*: alarm selection area, alarm shelving group.
+- *Operator Interface*: logoff timeout (min, 0 = off), deployment folder (default
+  `%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY`), layout, initial display.
+- *Destinations*: user's report printer for on-demand reports.
+- *Playback*: recording on/off/"HMI Client dependent" (then set in
+  `%TLS_WAP_PATH%\cfg\playback\playback.xml` per client, application and user), and whether the
+  user may switch recording, change its properties, view, play all users' recordings, export.
+Default users on R1.03: `ADMIN` (SYSTEM_MANAGER), `ADMINE` (enterprise admin), `OPER`, and
+`CI_NO_LOGIN_OPCUAS` (anonymous OPC UA).
+
+**Schemes (§2.6)** (`SCHEME_DF`) hide Engineering Module folders and fields a project does not
+need. Activating one restarts the Engineering Module (OK/Apply do not activate). Tabs: General
+(multi-language, OPC server, playback, enterprise), I/O processing (PIT filter, STX-Bachmann,
+hide item statuses), Alarming (e-mail notification, AOI, ASA, first-out, collection, groups,
+diagnostic flag, OPC AE detection, predefined ack types only), Processing (control item,
+sequences, priorities, extended reset, predefined trigger groups only), Reporting (item
+trigger, priorities, lifetime), Historization (external archive, warning time, non-item
+groups, direct storage), Authorization (process areas, predefined groups only). Installed:
+`STARTER`, `STANDARD`, `ADVANCED`, none active.
+
+## 3. Items (§3)
+
+**Concepts (§3.1)**: an item holds value plus conversion, format, alarm parameters, I/O
+authority, application info and status. Name `Section[.Sub-section…].Item`, max **255 bytes**
+(multi-byte characters count more). An item can be connected to one I/O point on a station.
+Raw values are converted to engineering units (e.g. linear `f(x)=ax+b` from electrical to
+physical limits; overflow/underflow and a DELTA change limit give statuses; other conversions:
+IM 36K10L41).
+
+**Limits and deadband**: up to four limits (none, H+L, or all four) plus one deadband on the
+normal side; statuses LOWLOW, LOW, NORMAL, HIGH, HIGHHIGH. Scale high/low give
+OVERRANGED/UNDERRANGED and override limit statuses. Booleans get status TRUE/FALSE
+(BOOLEAN 1/0).
+
+**PIT filter** (reduces history events; used only if the application honours it): an update
+passes when `(P OR I) AND NOT T`.
+- P: |new − reference| > P.
+- I: integral of (sample − reference) × seconds > I (1 s resolution).
+- T: for T seconds after a pass, nothing passes.
+- Each pass sets a new reference.
+
+**Sub-items (§3.2)**: Integrator, Pulse counter (Boolean main item, counts 0→1), Min/Max
+indicator (runs until reset), Rate of change (time unit day/hour/minute/second chosen per
+sub-item), Type-less (a free Real item written by PROCESS/REPORT services or applications).
+- **Integrator**: `new = (t_now − t_prev) × previous value + old`, evaluated every second;
+  negative values subtract. The result is divided by the **integration granule**
+  `itm_int_secs` in `itm.sup` — **system-wide**, default and test-system value 1 (seconds);
+  3600 gives hours (answers ISS-010).
+- Sub-items have no Equipment tab and are **not** blocked with their main item.
+
+**Defining (§3.3)** — right-click node/section → Add. Sections: name cannot be changed (delete
+and recreate; only possible when empty), new sections are UNBLOCKED; fields Blocked, Visible
+via OPC, Alarm inhibit, plus read-only parent flags. Nesting is limited by the 255-character
+path. Blocking a large section can take long.
+
+Item form tabs: General, Item Management, Limits and filtering (not for Boolean), Equipment,
+Alarm (only if alarming on), Area of interest. Item name (tag): letters, digits, `_`
+recommended; tag and type cannot be changed (delete and recreate).
+- *General*: engineering units, value format (`9`, `0`, `+`, `.`, `EEEE`, date/time codes
+  `D DD M MM MMM Y YY YYYY h hh mm ss p`, `\` escapes a letter), representation (Boolean,
+  Integer 32-bit, Real 64-bit, String), alarming, audit trailing, *remember last value
+  immediately* (keep value/status/quality over a warm restart instead of NOT INIT), process
+  areas, comment 1/2, map position (WGS 84 latitude/longitude).
+- *Item management*: blocked, OPC visible (+ read/write; also needs the section visible),
+  alarm inhibit, parent flags, data exposure aggregation interval (60 s–7 days, 0 = off).
+- *Limits and filtering*: HH/H/L/LL, deadband (values may be rounded), scale high/low, limit
+  clamping (HH-LL, H-L, scale, none), out-of-range support, trend axis limits, PIT values.
+  String items: max length, default 80. The manual says max 100; the installed software
+  accepts 1–200 and stores length − 1 characters, cutting longer values with status 12
+  OVERRANGED (verified, ISS-019).
+- *Equipment*: pick an existing I/O point of a station, or define a new point here (created
+  with the item; delete it yourself when deleting the item). No connection = internal item.
+- *Alarming*: OPC AE detection (AE station/event source) or CI Server detection, diagnostic
+  item, acknowledgment type, alarm collection, first-out group/item, delay time, repeat time,
+  per-status alarm state (None, Normal, Alarm 1–3), priority 0–15 (15 highest unless
+  `alm.sup` inverts it), text, colour, mnemonic, shelve enable. Ack types, collections and
+  first-out groups must exist first.
+- *Areas of interest*: up to 16 labels used to filter alarms.
+
+**Blocking and offline (§3.4)**: blocked (manual, per item/sub-item, nested section or top
+section) and offline (station connection lost) items are not updated by equipment. Unblocking
+a section leaves items that were blocked individually still blocked.
+
+**Update value (§3.5)** (= `itmval -p`): value, status, quality code, *Overwrite blocked*
+(= `itmval -o`), lock (user/terminal). **Option bits** (explains the `blk`/`off`/`uoff`/`ublk`
+flags of `itmval -g`, ISS-001):
+
+| Bit | Value | Meaning |
+|---|---|---|
+| 0 | 1 | Blocked |
+| 1 | 2 | Offline (no connection to equipment) |
+| 2 | 4 | **Updated offline**: written by an application (object, this form, `itmval`) while offline |
+| 3 | 8 | Acknowledged (last alarm event) |
+| 4 | 16 | **Updated blocked**: written by an application while blocked |
+| 5 | 32 | Direct alarm (alarm state reached, delay running) |
+| 6 | 64 | Delayed alarm (after the delay; set together with bit 5) |
+
+Also on the form: force to normal / force to alarm, priority, colour, mnemonic, text.
+
+## 4. I/O processing (§4)
+
+**Equipment (§4.1)**: *lines* (protocol/connection), *stations* (controllers, identified
+internally by equipment manager + slave number; up to 4095 per manager) and *points* (I/O
+addresses). Details per station type: IM 36K10L40/L41.
+- Station form: line, redundant lines and TCP/IP addresses, preferred line; **On scan**
+  (off-scan stops input updates for the whole station — cheaper than blocking each item;
+  outputs continue), **Suppress outputs**, output method (on change / on change and connect);
+  status items: general communication (1 good, 0 bad, status OFFSCAN when off-scan), line 1,
+  line 2 (typeless sub-items show sub-line states for Modbus TCP), line selection.
+- Scan types (`SCAN_TYPE_DF`): name + interval (ms); intervals are multiples of the equipment
+  manager's tick. PLC reads are grouped using *maximum gap* and *maximum size*.
+- *All equipment definitions* shows lines, stations, points and scan types read-only;
+  editing is done under each plug-in's own tree node. Points created from an item form are
+  shown as `[<item name>]`.
+
+**Item statuses (§4.2)** (`STATUS_DF`): numbers 0–255 mapped to a system text (fixed),
+description (user text), mnemonic, alarm priority, alarm state, colour, shelve enable.
+**100–127 are free**; the rest are reserved (34–99 and 128+ used for DCS/batch/HAC interfaces).
+Common ones: 1 CALCULATE, 3 BLOCKED, 4/5 BOOLEAN 0/1, 6 UNDERRANGED, 7 LOW LOW, 8 LOW,
+9 NORMAL, 10 HIGH, 11 HIGH HIGH, 12 OVERRANGED, 13 NOT INIT, 14 OFFLINE, 15 UPD OFFLINE,
+16 UPD BLOCKED, 21 DELTA, 22 OFFSCAN, 23 OUT_SUPR, 24 BAD VALUE.
+
+**Classes (§4.3)** (`CLASS_DF`): templates in the PROCESS Service traditional language
+(IM 36K10P10) or Java (IM 36K10P11); the language is fixed once created and the two cannot
+reference each other. Changing a class needs a **reset** before objects use it.
+
+**Sequences (§4.4)** (`SEQUENCE_DF`): a one-off program (class and object in one) tied to a
+**control item**; traditional language only. Compile, then set activation time, trigger
+interval (or trigger once / event-driven `TRIGGER` on TIMER or ITEM), deactivation time,
+daylight-saving correction. Blocking the control item puts the sequence off-line; the `STEP`
+variable is the control item's value. Classes are preferred for maintainability.
+
+**Trigger groups (§4.5)** (`TRIGGER_DF`): name (≤ 15 characters, letter first, then letters,
+digits, `_`), activation time (immediate or date), deactivation (infinite or date), trigger
+once or interval (seconds … years), daylight-saving correction. Triggers fire at activation
+time + n × interval. Editable except the name; deletable only when unused. Installed defaults:
+`ONCE`, `ONE_SECOND`, `TWO_SECONDS`, `FIVE_SECONDS`, `TEN_SECONDS`, `THIRTY_SECONDS`,
+`ONE_MINUTE`, `TWO_MINUTES`, `FIVE_MINUTES`, `TEN_MINUTES`, `THIRTY_MINUTES`, `ONE_HOUR`.
+
+## 5. Class and object engineering (§5)
+
+Flow: trigger group → class (code, compile) → object → test → (symbol → display → test).
+PROCESS Service runs at 1-second resolution at best.
+- **Class** (§5.2): name ≤ 15 characters (letter first); language; priority (load balancing,
+  ranges set in the PROCESS Service setup file); *Extended reset enabled*. Code tab (template,
+  Compile after reopening the form), Listing tab (errors start `**** ERROR:`; double-click to
+  jump), Trigger Groups tab.
+- **Object** (§5.3): created under a section like an item; node (blank = local / control
+  item's node), priority 0–999 (0 = class priority), class, optional **control item** (object
+  runs when its status is on-line; BLOCKED disables methods; `STEP` = its value), map
+  position, up to 99 attribute prompts. Item management: *Items may exist* (reuse existing
+  items with identical attributes), *Leave items* (keep created items when deleting the
+  object), blocked, OPC visible, alarm inhibit. Object trigger groups override the class's.
+- **Testing** (§5.4): `PRINT` statements go to the message log (remove afterwards); right-click
+  object → *Debug* collects a trace (triggers, methods, changed signals/attributes) shown when
+  debug is switched off.
+- **Reset** (§5.5): compiled changes take effect only after resetting the class (all objects)
+  or single objects; control may be lost briefly; there is no indication which objects were
+  reset. *Normal reset* for body changes; *extended reset* when the **signature** changes
+  (traditional: prolog section; Java: attribute/signal declarations or `create()`); it may
+  create/modify/delete signal items. If the compiler misses a signature change, force it
+  (*Extended reset forced*).
+- **Symbols** (§5.6–5.9): a symbol can be tied to a PROCESS Service class; its component
+  properties connect to class signals (e.g. fill colour via a threshold table); on a display
+  each symbol instance is pointed at an object (Edit Module, phase 10).
+
+## Differences from the installed software
+
+Logged in `knowledge/issues.md`; the installed software is taken as right:
+- ISS-018: no-login profile `CI_NO_LOGIN` (manual: `FT_NO_LOGIN`).
+- ISS-019 (closed): string item maximum length is 200 in the software (manual: 100; Tutorial: 168).
+- Installed authorization actions include `AGGREGATION_OVERWRITE_*`, not listed in §2.4.

knowledge/manuals/IM36K10G10-01EN.md

@@ -36,7 +36,9 @@ Module and Operator Interface.
 **Items (ch. 3)**
 - Full name `Section.Sub-section.Item` (max 255 bytes; no `:` or `.` inside a name; case
   insensitive). Sections can be blocked as a whole, e.g. for maintenance.
-- Types: Boolean, Integer, Real, String (max length 80 by default, up to 168 without audit).
+- Types: Boolean, Integer, Real, String (the Tutorial says max length 80 by default, up to 168
+  without audit; the installed R1.03 allows `STRING_LENGTH` 1–200 with or without audit and
+  holds length − 1 characters, verified, ISS-019).
 - Four limits (LL, L, H, HH) plus a deadband set the status LOWLOW…HIGHHIGH; the deadband sits
   on the normal side of each limit. Scale high/low give OVERRANGED / UNDERRANGED.
   Booleans set status TRUE/FALSE.
@@ -101,7 +103,7 @@ history storage groups and archiving (phase 9).
 | Tutorial step | Done with | Result |
 |---|---|---|
 | Sections and items (3.2) | `dssqld -i` `SECTION_DF`, `ITEM_DF` | loaded |
-| Sub-items (3.2.3) | `SUB_ITEM_DF` | Min-Max keeps the maximum; **Integrator adds value × seconds; `TIME_UNIT` has no effect** |
+| Sub-items (3.2.3) | `SUB_ITEM_DF` | Min-Max keeps the maximum; **Integrator adds value × integration granule (`itm_int_secs` in `itm.sup`, default 1 s, system-wide); `TIME_UNIT` has no effect** (ISS-010) |
 | Block item (3.3) | `dssqld -m` `ITEM_DF` `BLOCKED` 1/0 | option flag `blk` (status stays 9); writes without `-o` are **silently ignored**; after unblocking the flag `ublk` appears |
 | Trigger group (5.1) | `TRIGGER_DF` (`TRIGGER_INTERVAL` "1 seconds") | loaded |
 | Class (5.2) | `CLASS_DF` with `METHOD` memo and `COMPILE` 1 | compiled on load |

knowledge/manuals/IM36K10L35-01EN.md

@@ -0,0 +1,103 @@
+---
+manual: IM 36K10L35-01EN
+title: ITEM Service Engineering - ITH
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; installed ITH processes (item_start.cmd), setup files itheex.sup and itheix.sup checked read-only on the test system (2026-09-30); ithloahis practiced in phase 1
+---
+
+# ITEM Service Engineering - ITH (R1.03)
+
+ITH is the item-history part of ITEM Service: it gathers item values from ITM and stores and
+retrieves them for the storage (history) groups that HISTORY Service manages. Section numbers
+refer to the manual. Storage groups themselves: phase 9 (IM 36K10L20, C40).
+
+## 1. Processes and data (§1)
+
+- **Collection/storage types** and their processes:
+
+| Group type (collection/storage) | Store process | Retrieve process |
+|---|---|---|
+| SCAN / TIME | `ITHSTX` (more: `ITHST2`…, setup key `task`) | `ITHRTT` |
+| SCAN / ITEM | `ITHSIX` | `ITHRTI` |
+| EVENT / EVENT | `ITHEEX` | `ITHRTE` |
+| EVENT / ITEM | `ITHEIX` (not described in the manual; used by CI-Eng-Sample `CIENG_EVENT`) | `ITHREI` |
+| DIRECT / EVENT (values from applications, e.g. an equipment manager reading history from the field) | `ITHSDE` | `ITHRDE` |
+| DIRECT / ITEM | `ITHSDI` | `ITHRDI` |
+
+- `ITHSER`: one per node (normally the host). Group definition (with HIS) and retrieval:
+  finds the item's groups, picks the **highest-priority** group, finds the first unit in the
+  time window and hands the request to a retrieve process. Keeps the item directory.
+- `ITHDBG` debugger, `ITHRECOVER` repair.
+- Start/stop lists: `tls\com\item_start.cmd` / `item_stop.cmd`; processes for unused types can
+  be removed there. **Installed R1.03 start list**: `ithser`, `itheex`, `itheix`, `ithstx`,
+  `ithsde`, aggregation `ithsag` and retrieve processes in **two instances each**
+  (`ithrte00/01`, `ithrei00/01`, `ithrag00/01`, `ithrtt00/01`, `ithrde00/01`). Not started:
+  `ithsix`, `ithrti`, `ithsdi`, `ithrdi`.
+
+**Files** (in the history/data folders; do not delete):
+- `ith_itmdir.dat` item directory (item, id, time window, group, priority).
+- Group description `hnnggg000000.dat`, unit descriptions `hnnggguuu000.dat` (a new one on
+  every group change, so old compositions stay readable), unit data `hnnggguuuddd.dat` (a new
+  one at each start/rollover). `nn` node, `ggg` group, `uuu` unit, `ddd` data sequence.
+- Record layouts: time-based (one scan of many items per record, split into file groups),
+  item-based (many scans of one item), event-based (one event per record). **Events older
+  than 60 units cannot be stored.**
+
+## 2. Setup files (§2)
+
+Each process reads `<process name>.sup` (missing → error in `umhlog`).
+- `ithser.sup`: `agg_hour_method` (hourly aggregate labelled by start or end of hour, default
+  start), `his` (HIS address), `con_timeout` (group configuration lock, default 8 min),
+  `his_path`, `sh_path` (default history and shadow paths), `his_mod` (allow modifying
+  `ITEM_HISTORY` data via the API).
+- `ithstx.sup` / `ithsix.sup`: `his`, `task`, `run_interval` (heartbeat, ≤ 1/10 of the
+  shortest scan interval), `max_recsize`, `itms_a_rscan`/`itms_a_dscan` (items per ITM
+  lock, ~50), `itms_a_rrun`/`itms_a_drun` (items per heartbeat, limits CPU peaks),
+  overheads; ITHSIX also `max_total_buf`, `max_grp_buf` (memory in 28-byte blocks).
+- `itheex.sup` (test system values): `run_interval = 600` s, `buffer_size = 10` events,
+  `event_timeout = 1` s, **`gap_time = 2880` min**, `queue_size = 750` KB, optional
+  `overflow_item` (counts/toggles on queue overflow).
+- `itheix.sup` (not in the manual; test system): `run_interval = 60`, `buffer_size = 20`,
+  `event_timeout = 1`, **`gap_time = 2880` min**, **`max_sample_delay = 14400` min**,
+  `max_samples_queued = 25` (million), `max_open_files = 10`, `queue_size = 2000`.
+- `ithsde.sup` / `ithsdi.sup`: `his`, `task`, `max_open_files` (10), `max_recsize` (4000),
+  `gap_time` (60 min).
+
+## 3. `ithrecover` (§3)
+
+`ithrecover <group | "*"> [-v] [-p]` repairs the relations between item definitions, group
+descriptions, the item-in-use list and the item directory (trusting item definitions and group
+descriptions). Needs HISTORY Service and ITHSER running, no group configuration in progress.
+`-p` extends the item directory into the past for history migration (advanced; with product
+support).
+
+## 4. `ithdbg` (§4)
+
+Menu: 1 group contents, 2 item directory, 3 unit data file dump, 4–18 global/group info of
+each ITH process, 20 retrieve history, 80 stop a process, 90 log to file, −1 exit. Group names
+are case-sensitive.
+
+## 5. `ithloahis` item history loader (§5)
+
+`ithloahis -f <file> [-v] [-l] [-i] [-s <section>] [-t GMT|LST|LCT]` loads CSV history into
+EVENT/EVENT and EVENT/ITEM groups (not SCAN). Groups and items must exist. `-i` also writes
+the value to the item (e.g. to trigger alarms). Formats: `SCAN, item1, item2` header then
+`time, v1, v2` rows (blank = no sample), or `EVENT` header then `time, item, value` rows.
+Time as `29-Apr-14 11:48:17.452`, `29-04-2014 11:48:18.452` or UTC seconds. Practiced: skill
+`system-management`, task `load-history.md`.
+
+**Loading older history (migration)**:
+1. Raise `gap_time` in `itheex.sup` (EVENT/EVENT) or `gap_time` and `max_sample_delay` in
+   `itheix.sup` (EVENT/ITEM) beyond the age of the oldest sample (5 years ≈ 2,628,000 min);
+   note the old values; restart CI Server.
+2. Create the group, add all items, start it immediately.
+3. Create earlier unit files: `hisdbg` option 3 for unit info; copy unit files to
+   `%TLS_HIS_PATH%\has`, delete the unit (`hisdbg` 4), copy back, set times with
+   `hisrecover <unit>.his "<start LCT>" "<end LCT>"`, create the next with `isfrename`,
+   repeat until the original second unit's start time.
+4. `ithrecover <group> -p`, restart CI Core.
+5. `ithloahis -f <file>`.
+6. Restore the setup values and restart.
+This explains why samples older than the current unit were not stored in phase 1
+(`knowledge/issues.md` ISS-006). From an older CI Server version use `ITHIMPORT` instead.

knowledge/manuals/IM36K10L36-01EN.md

@@ -0,0 +1,81 @@
+---
+manual: IM 36K10L36-01EN
+title: ITEM Service Engineering - ITM
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; itm.sup, item_start.cmd and itmdbg statistics checked on the test system (2026-09-30); itmval -g/-p verified in phase 1; itmval -f crashes (ISS-022)
+---
+
+# ITEM Service Engineering - ITM (R1.03)
+
+ITM is the real-time item database (item common, shared memory). Section numbers refer to the
+manual.
+
+## 1. Processes (§1.1–1.2)
+
+| Process | Role |
+|---|---|
+| `ITM` | item handler, message interface |
+| `ITMTIM` | sends buffered item events; recalculates integrators |
+| `ITMCPM` / `ITMCPS` | item copy master / slave for distributed items between nodes (buffered, compressed; after a lost MDUR link it rescans all or only changed master items in limited batches). Restart `ITMCPM` after deleting a distributed group. |
+| `ITMLIMUPD` | copies limit/deadband changes to other nodes |
+| `ITMREM` | cleans up event requests of processes that disappeared |
+| `itmval` | command-line get/put |
+
+`itmtim [<period ms, default 100>] [<integration step ms, default 1000>] [<save count>]`:
+save count = integrators saved to disk per recalculation. **Installed** `item_start.cmd`
+starts `itmtim 100 1000 1 200 1` (five arguments; the last two are not documented). Also
+started: `itmaah`, `intitmini`, `itmlimupd`, `itmrem`.
+
+## 2. `itm.sup` (§1.3)
+
+| Setting (keyword) | Manual default | Test system |
+|---|---|---|
+| Queue size (`queue_size`) | 200 KB | 200 |
+| Save items (`item_save`): ITEM_BASE (per item's *remember last value*), ALWAYS, NEVER | ITEM_BASE | ITEM_BASE |
+| Max item groups (`max_groups`) | 255 | 255 |
+| Max items per group (`max_number`) | 65534 (255 × 65534 = 16,711,170 items) | 65534 |
+| Max application info per item (`max_appl_info`) | ≤ 20 bytes always fits | 0 |
+| Max update info per item (`max_upd_info`) | 512 | 512 |
+| Item pool size (`pool_kbytes`), guide `0.07 × groups × items + appl KB × groups × items + 10` | **50000 KB** | **650000** |
+| Integration granule (`itm_int_secs`), system-wide integrator time unit | 1 s | 1 (60 tested, ISS-010) |
+| Lock timeout (`lock_timeout_secs`) | 60 s | 60 |
+| Save to disk (`disk_save`) | YES | yes |
+| Not regained (`not_regained`): after start, mark possibly stale values until the first update; hidden in trends | not described | no (default block) |
+
+## 3. `itmval` (§1.4)
+
+```
+itmval -g [-l] -n <item>
+itmval -p [-l] -n <item> [-v <value>] [-s <status>] [-q <quality>] [-o] [-t [<date>] <time> [GMT|LST]]
+itmval -f <file> <vsqo> [-l] -n <item>
+```
+
+`-l` = use this node instead of the host; `-o` = overwrite a blocked item; `-t` = update time
+(default local time). `-f` should append an `itmval -p …` restore line with the chosen parts
+(value, status, quality, options) to a command file, but on the test system it **crashes**
+(segmentation fault / access violation) and writes nothing (ISS-022). The manual's
+space-separated name form (`-n <inst> <unit> <tag>`) is rejected ("no (extra) command line
+arguments allowed"); use the dotted full name. Practiced: skill `system-management`, task
+`read-write-item.md`.
+
+## 4. `itmdbg` (§2)
+
+Start `itmdbg`, then a code; answers can be piped, e.g. read-only statistics:
+`printf '2\n-1\n' | itmdbg`.
+
+| Code | Shows / does |
+|---|---|
+| 1 | main info (root pointers, criterion and event request bits) |
+| 2 | statistics: common size/free/fragments, configured limits, **nr of items**, integration secs, save mode, counters (item/sub-item updates, gets, buffered events, automatic saves, flow control) since system start and since debugger start |
+| 3 / 4 | item / sub-item info by group and sequence number (value, status, options, limits, update times, name) |
+| 5–11 | action blocks, main actions, task table (event requesters), event buffers, mask info (criterion bits: 1 FIRST, 2 EACH, 4 VAL, 8 STA, 10 DEL, …), item pointers, last update |
+| 12 | unlock item data area (after a killed process; if pointers were being changed, restart ITEM Service) |
+| 13 | save all item info to disk (before a shutdown, for a clean warm restart) |
+| 14, 15, 17, 18 | flow control, integrator list, locked items, group–node relation |
+| 16 | **delete item** from the in-core database (test/repair only) |
+| 19 / 20 | most frequently updated items (10–1000) / reset those counters |
+
+Test system (`itmdbg` code 2): common 665,600,000 bytes, free 665,307,508, 203 items,
+integration 1 s, save mode item base. The same numbers appear in the automatic snapshots
+`smd_*_itmdbg_all.log` (skill `system-management`, task `tuning-checks.md`).

knowledge/manuals/IM36K10L40-01EN.md

@@ -0,0 +1,85 @@
+---
+manual: IM 36K10L40-01EN
+title: EQUIPMENT Service Engineering - Utilities
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the test system (2026-09-30)
+---
+
+# EQUIPMENT Service Engineering - Utilities (R1.03)
+
+Three utilities of the EQUIPMENT Service (the equipment managers `eqp<type>` that talk to
+stations). Section numbers refer to the manual.
+
+## 1. Forced scan: `eqpfrcscn` (§1)
+
+Temporarily scans a group of points faster when a **trigger item** changes, e.g. a tuning tag
+normally read hourly.
+
+1. Create `%TLS_ROOT_PATH%\tls\com\eqpfrcscn_start.cmd` that starts
+   `%TLS_ROOT_PATH%\tls\exe\eqpfrcscn -n EQPFRCSCN`, and `eqpfrcscn_stop.cmd` that stops it
+   with `durstp.exe -msk -t 10 -p EQPFRCSCN`. (The manual's example start line uses
+   `-n eqpfrcsrn`, a typo.) On the test system `equipment_start.cmd` calls **every
+   `eqp*start.cmd`** in `tls\com`, so the start file makes it start with CI Server.
+2. Define the trigger item; any value change starts a forced scan.
+3. Give the points to be forced a scan type (e.g. 60000 ms) and link them to items.
+4. In `eqpfrcscn.sup` (Setup File Editor; description "Force scanning equipment"):
+   - Tab *General*, keyword `FORCE = <trigger item>, <EQP node>, <EQP process name>,
+     <slave number>, <I/O type number>, <scan rate number>, <scan period s>, <scan duration s>`
+     (repeatable), plus `queue_size` (KB, default 20).
+   - Tab *Special events*, keyword `FCX_EVENT = <trigger item>, <node>, <process>, <slave>,
+     <period>, <duration>` for STARDOM, DNP3 and IEC101 events.
+   - EQP process name = *Equipment process name* of the line; slave number = *Internal
+     station id* (or `eqpdbg` "Get slave info").
+   - I/O type numbers include 100/101/103/104/106 Modbus (Modicon) reads, 293 Siemens 3964R,
+     580 BK8100, 644 STARDOM FCX (-1 slow, -2 fast, -3 medium), 772/774 ProSafe-COM,
+     836 FA-M3, 996 AB PLC5, 1028 DNP3, 1092 Siemens S7, 1156 DAQSTATION, 1188 AB CIP,
+     1220 Fisher ROC, 1316 HexRepeater, 1636 IEC 61850.
+   - Scan rate number: the points' scan interval in ms, or the driver's internal rate number.
+5. Restart CI Server (or the `EQPFRCSCN` process).
+Example: a change of the trigger item makes 60 s points scan every 10 s for 600 s.
+Long scan intervals can let an RTU close its TCP socket; keep at least one faster item or
+lengthen the RTU's socket timeout.
+
+## 2. Hourly I/O statistics: `eqpiostat` (§2)
+
+Stores the I/O statistics per station line every hour (no record when nothing was sent).
+No setup file, no parameters. On the test system `equipment_start.cmd` starts it
+automatically on the host node, and it was running. The manual calls the target a history
+group; it is the dataset **`STATION_STAT`** (fields: time stamp, station, line, time span,
+sends, good answers, bad return code, timeouts, frame errors, bad CRC, retries, line bad).
+An export returned no records on the test system (ISS-021).
+
+## 3. Debugger: `eqpdbg` (§3)
+
+`eqpdbg [<node> <process>]` then an action number; node 0 = this node, process default `EQP`
+(use the line's equipment process name, e.g. `EQPMDC` for Modbus). Answers can be piped in,
+e.g. read-only main info:
+
+```
+printf '1\n-1\n' | eqpdbg 0 EQPMDC
+```
+
+| No. | Action | Changes anything? |
+|---|---|---|
+| 1 | Get main info: lines attached, scan interval (tick), scan status, slave count, scans done, line load % | no |
+| 3 | Get slave info: type, name, wanted path, scan status, recover count, scan preset, output method, address gap / max size, per-line status items and message statistics | no |
+| 8, 9, 10, 11, 13, 17, 18, 23 | I/O type, scan rate, item pointer, timing statistics, item, item by id, slave-specific, item ids | no |
+| 4, 5 | Update slave scan status / address gap and max size | **yes**, makes EQP differ from the database |
+| 6, 12 | Delete slave / item signal (EQP only; repair with `dsschk`) | **yes** |
+| 7 | Reset statistics (optionally enable I/O timing) | yes (counters) |
+| 14 | Save all info on disk (optionally stop the EQP process) | yes |
+| 15, 16, 20, 21 | Total scan, force item update, force re-init, general request | triggers I/O |
+| 19 | Logging file size (MB, 0 = off): `<process>.xml` / `_old.xml` in the list folder | yes |
+| -2 | Dump memory (a wrong address crashes EQP) | risky |
+| -1 | Exit | — |
+
+Test system: `eqpdbg 0 EQPMDC` main info showed line type 107, both lines attached, 100 ms
+scan interval, 2 slaves, 2 % line load.
+
+## Installed on the test system
+
+Many drivers `tls\exe\eqp<type>.exe` (e.g. `eqpmdc` Modbus, `eqpfcx` STARDOM, `eqpfam3` FA-M3,
+`eqp850` IEC 61850, `eqpdnp` DNP3); setup files `eqp*.sup` (e.g. `eqpmdc.sup`, `eqpmqtt.sup`,
+`eqpfrcscn.sup`); start scripts `eqpmdc_start.cmd`, `eqpmqtt_start.cmd`. Running managers:
+`eqpmdc`, `eqpmqtt`, `eqpiostat`.

knowledge/manuals/IM36K10L41-01EN.md

@@ -0,0 +1,195 @@
+---
+manual: IM 36K10L41-01EN
+title: EQUIPMENT Service Engineering - Configuration
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)
+---
+
+# EQUIPMENT Service Engineering - Configuration (R1.03)
+
+How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
+points and conversion types, then one chapter per protocol. Section numbers refer to the
+manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.
+
+## 1–2. Architecture
+
+- Needs BUS, DATABASE and ITEM Services running; USER Service to define stations, items and
+  scan types.
+- One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
+  master), its setup file, shared libraries and datasets for line, station, scan type and point.
+- **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
+  an equipment manager instance. The name is free but must start with `eqp`.
+- Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
+  (lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
+  the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
+  `eqpmdc_item.sav` plus `.d01`/`.k01` files.)
+
+## 3.1 Line types
+
+| Type | Addresses | Main parameters |
+|---|---|---|
+| Serial | `LINE_1_DEVICE` / `LINE_2_DEVICE` = `com1:` (`\\.\com10` from COM10) | baud rate, 7/8 bits, parity, stop bits, XON |
+| TCP/IP | `<IP>[:<port>]`, can be overruled per station | `DEAD_TIME` (s without data → reconnect, default 30), `REPEAT_CONNECTION_DELAY` (default 30 s), recover script, source address, splitter, switch time, carrier on/off delay for radios |
+| DUR | `[<node>:]<process>` (other CI Server processes) | timeout rounded to seconds, default 3000 ms |
+| UDP | `<IP>[:<port>]` | — |
+
+Common to all: `HEART_BEAT` (manager cycle, ms; must be ≤ fastest scan; ~100 ms typical),
+`PERIODIC_TIME` (s; re-checks BURST LIM filters for event-based inputs), `TIMEOUT` (ms; for
+terminal servers include both network and serial times). Line 2 is the optional backup line.
+
+## 3.2 Common station parameters
+
+Name, description, station id (0 = assigned automatically), on scan, line, redundant line,
+suppress outputs, output method (*On change* / *On change and connect*), preferred line
+(None, Line 1, Line 2), and status items:
+- `STATUS_ITEM`: 1 = station reachable, 0 = not (status OFFSCAN when off-scan);
+- `LINE_1_ITEM`, `LINE_2_ITEM`: per line 1/0;
+- `SELECT_ITEM`: line number in use.
+Typeless sub-items on these show sub-line states (Modbus over TCP/IP only; values 0–3, see
+C10 summary §4). **Dynamic scanning** (e.g. STARDOM FCX): a normal and a fast rate, fast
+while a tag is on an open display; may need a larger manager queue.
+
+## 3.3 Standard conversion types (field value ↔ item)
+
+| Type | Field signal | Key parameters / behaviour |
+|---|---|---|
+| Digital | 1 bit | `INVERS`, `NO_ZERO` (never send 0), `AVE_UPD_INTERVAL` + `BURST_LIMIT` (too many changes → status BURST LIM for limit × interval s) |
+| Binary | integer, no scaling | `BITS`, `HAS_SIGN`, `SWAP_BYTES`, `SWAP_WORDS` |
+| Linear | integer, scaled | `ELEC_LOW/HIGH` → `PHYS_LOW/HIGH` (extrapolated; outside electrical range → UNDERRANGED/OVERRANGED), `DELTA_LIMIT` (→ DELTA), `AVE_UPD_INTERVAL` + `MAX_INSENS` (adaptive change filter), bits/sign/swaps |
+| Dual-bit | 2 bits | value 0–3, status DB NONE/RIGHT/LEFT/BOTH; `TMO_NONE`/`TMO_BOTH` → DB NONE T / DB BOTH T |
+| Unary | bit array, one bit set | value = lowest set bit (−1 if none); none/several → BAD VALUE |
+| Float | 32/64-bit float | `FLOAT_TYPE` Intel, Motorola, Tandem, Dec; `STEP`, `OFFSET` (item = field × step + offset); swaps |
+| String | ASCIIZ ≤ 80 incl. `\0` | `CHARS`; longer output is truncated without `\0` |
+| Linear-BCD | 1–8 BCD digits | `DIGITS`, `STEP`, `OFFSET`, `OVERFL_DET` (counts roll-overs) |
+| Time | 7-byte IEC or 32-bit POSIX | `TIME_ZONE` (LCT, LST, GMT, relative), `TIME_REPRES` |
+
+Stations may force status/quality codes on top of these.
+
+## 3.4 Specific conversion types
+
+One per protocol where the standard ones do not fit: ProSafe-PLC, BSAP digital/float, TIE
+command, STARDOM FCX (history id, special conversions of alarm/valve/batch/calc/counter/mode
+status words into CI Server statuses such as HIGH, IOP+, MAN, AUT, CAS), Host-host, DNP3,
+VNET, AB-CIP, Fisher ROC, Hex repeater (binary/float/relay), IEC 101/103/104 output, IEC 103
+analog, IEC 61850, AC-Gateway, Wireless, Bachmann, Beckhoff ADS. Details stay in the manual.
+
+## 3.5 Common setup-file parameters (`eqp<name>.sup`)
+
+- *General*: `queue_size` (KB; more for many dynamic tags), `crit` (hex criterion mask for
+  output events, default `D` = first + value + status), `logging_size` (MB, protocol log in
+  the list folder, 0 = off; up to twice the size used). Installed `eqpmdc.sup` also has
+  `start_offline = <Y|N>` (not described).
+- *Behaviour*: `updown = <slave>, <line>` (log station / line up-down messages),
+  `timestamp = Y` (use the RTU/manager ms time stamp for alarms and event history instead of
+  the item-table second), `offline = <inputs off on loss>, <inputs on at recovery>, <outputs
+  off on loss>, <outputs on at recovery>`. Default: inputs go offline on loss and online at
+  their next value; outputs stay online.
+Test system `eqpmdc.sup`: `queue_size = 20`, `crit = D`, `updown = Y,N`, `timestamp = Y`,
+`offline = N,N,N,N`.
+
+## 3.6 Modbus master (`EQPMDC`)
+
+Modbus ASCII, RTU (serial, or TCP/IP to a serial converter) or Open Modbus/TCP.
+Steps: line → setup file (created automatically) → stations → scan types → points.
+
+Datasets (test system, via `dssqld -f`): `MODBUS_LINE_DF`, `MODBUS_STATION_DF`,
+`MODBUS_SCAN_TYPE_DF`, `MODBUS_POINT_DF`; the general views `LINE_DF`, `STATION_DF`,
+`SCAN_TYPE_DF`, `POINT_DF` list all protocols.
+
+**Station, Options tab**: `PROTOCOL` (Ascii, RTU, Open Modbus/TCP — default), `SUB_STATION_ID`
+(Modbus unit id), `ADDRESS_INCREMENT` (JBUS: addresses on the wire start at 1),
+`RECOVER_TIME` (s between reconnect tries, default 10; a try can block the manager for a
+timeout), `RECOVER_TRIES` (default 2), `WRITE_WAIT` (ms before each write), `SIGNAL_GAP`
+(bytes of unused addresses read to merge requests, default 20), `SIGNALS` (max bytes per
+request, ≤ 240), `FAR_END_CHECK`, `ALIVE_CHECK_METHOD` (function 7 by default; 8 or 1–4),
+`ALIVE_CHECK_REGISTER_START`, `SEQUENCE_CHECK` (Modbus/TCP transaction ids, default on).
+General tab: `LINE_1_DEVICE` / `LINE_2_DEVICE` = `<IP>[:<port>][;<IP2>[:<port>]]`, default
+port 502.
+
+**Scan types**: name + positive interval (ms), e.g. Fast 1000, Slow 10000.
+
+**Points** (`IO_ADDRESS`, `EXTERNAL_RELATION` Input / Output / Input+Output, `SCAN_TYPE`,
+`CONV_TYPE`):
+
+| Address | Element | Function codes | Direction |
+|---|---|---|---|
+| `DO:<n>` | coil 1–65536 | 1, 5 | in/out |
+| `DI:<n>` | input status (give 1… not 10001…) | 2 (15) | in |
+| `RO:<n>[,<bit>]` | holding register (1… not 40001…), bit 0–15 | 3, 6, 16 | in/out |
+| `RI:<n>[,<bit>]` | input register (1… not 30001…) | 4 | in |
+| `ES:<n>` | exception status bit 1–8 | 7 | in |
+| `LO:<n>[,<bit>]` | Daniel 4-byte register 1–32768, bit 0–31 | 3, 6, 16 | in/out |
+
+Bits in registers are written read-modify-write. Floats are usually Intel, swap words on,
+swap bytes off.
+
+**Troubleshooting**: *protocol error (function x, error 2)* = RTU refuses part of the address
+range (unused addresses read because of the signal gap, or DI/DO blocks not on 8-bit
+boundaries: start at 1, 9, 17 …) → define the gap registers or set the gap to 0. Slow
+communication: gaps of up to ~15 bytes are cheaper to read than an extra request; use
+`WRITE_WAIT` if the RTU needs time after a reply. TCP/IP: ping first; switch off sequence
+check if the station does not support it. Protocol logging marks errors with `/ERROR`.
+
+External interface (for programs): send a raw request to an RTU, force a reconnect.
+
+## 3.7 Modbus slave (Windows only)
+
+CI Server can serve third-party Modbus masters through a "mirror":
+- `EQPMDCMEM`: universal slave memory; per station id 64K registers (input and holding
+  registers are the same area) and 64K status bits (coils and inputs the same); starts at 0;
+  answers function codes 1–7, 15, 16. No setup file.
+- `EQPMDCSLVSER`: serial slave (one per port; setup file copied from `eqpmdcslvser.sup`,
+  tabs General, Terminal server, Direct port, Serial line).
+- `EQPMDCSLVTCP`: Modbus RTU over TCP slave, `eqpmdcslvtcp -n <name> [-p <port>]`
+  (default 502), several connections per instance, no setup file.
+- Start them from the equipment start sequence; then define a normal **Modbus master line
+  and stations in CI Server pointing at the slave's address** (output method *On change and
+  connect*). CI Server items then read and write the same registers the third party sees.
+Installed on the test system: `eqpmdcmem.exe`, `eqpmdcslvser.exe`, `eqpmdcslvtcp.exe`; none
+running. **Verified** 2026-09-30 with CI-Eng-Sample station `CIENG_PLC`: the TCP slave answered only with
+station protocol **Open Modbus/TCP**, not RTU as the manual says (ISS-024); skill `equipment`, task
+`modbus-station.md`. On R1.03 `equipment_start.cmd` runs every `tls\com\eqp*start.cmd`, so a separate
+start file is enough (see L40 summary).
+
+## 3.8–3.40 Other drivers
+
+| § | Driver | Connection | Notes |
+|---|---|---|---|
+| 3.8 | MQTT | TCP/IP via a broker | CI Server is an MQTT client |
+| 3.9 | ProSafe-COM (MULCOM/MODCOM) | serial or TCP/IP | extended Modbus |
+| 3.10 | ProSafe-PLC | APACS API (Windows only) | time sync, SOE |
+| 3.11 | STARDOM FCX | TCP/IP | FCX preparation, message interface, SOE, dynamic scanning, history buffer |
+| 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
+| 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
+| 3.14 | FA-M3 | TCP/IP | |
+| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed |
+| 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
+| 3.17 | Beckhoff BK8100 | serial / terminal server | |
+| 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
+| 3.19 | Allen Bradley CIP | TCP/IP to ControlLogix Ethernet module | connected messaging |
+| 3.20 | Siemens 3964R | serial | |
+| 3.21 | Siemens SAPI-S7 | API software | |
+| 3.22 | Bristol Babcock BSAP | serial / terminal server | RTU preparation, external interface |
+| 3.23 | Fisher ROC | serial / terminal server | FloBoss 100/407/500, ROC300/800, RegFlo |
+| 3.24 | DNP3 | TCP/IP or serial | authentication option |
+| 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
+| 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
+| 3.27 | TIE 870-5 | serial | |
+| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | |
+| 3.32 | IEC 61850 | TCP/IP | scan reads; direct write and control models |
+| 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
+| 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
+| 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
+| 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
+| 3.38 | Bachmann | M1COM library | |
+| 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
+| 3.40 | Beckhoff ADS | TwinCAT 3 router | |
+
+## Test system (read-only, 2026-09-30)
+
+The author's AID project has line `MODSIM_LINE` (TCP/IP, manager `EQPMDC`, heart beat 100,
+timeout 3000, dead time 30) with Modbus/TCP stations `MODSIM_STATION` (localhost) and
+`WRPS_PLC` (host `dev-ubuntu`), scan type `MOD_SCAN` 500 ms and 69 points (e.g. `RI:01`
+Linear 0–100); nothing listens on port 502, so both stations are down. Line `LINE_MQTT` uses
+`EQPMQTT`.

knowledge/progress.md

@@ -36,11 +36,11 @@ AID is not needed.
 | 3 | IM 36K10G10 | Tutorial | summarized ([notes](manuals/IM36K10G10-01EN.md)); command-line equivalents practiced on CI-Eng-Sample |
 | 4 | IM 36K10R10 | CI Portal Setup | done except separate CI Portal node (needs a second node); skill `portal-setup` ([notes](manuals/IM36K10R10-01EN.md)) |
 | 4 | IM 36K10R20 | Setup File Editor | done; Templates tab and Undo Field not explored ([notes](manuals/IM36K10R20-01EN.md), ISS-016) |
-| 5 | IM 36K10C10 | Engineering Module - I/O Processes | not started |
+| 5 | IM 36K10C10 | Engineering Module - I/O Processes | summarized ([notes](manuals/IM36K10C10-01EN.md)); default datasets checked read-only |
-| 5 | IM 36K10L40 | EQUIPMENT Service - Utilities | not started |
+| 5 | IM 36K10L40 | EQUIPMENT Service - Utilities | summarized ([notes](manuals/IM36K10L40-01EN.md)); `eqpdbg` main info run read-only |
-| 5 | IM 36K10L41 | EQUIPMENT Service - Configuration | not started |
+| 5 | IM 36K10L41 | EQUIPMENT Service - Configuration | summarized ([notes](manuals/IM36K10L41-01EN.md)); general + Modbus in detail, other drivers as a table |
-| 5 | IM 36K10L35 | ITEM Service - ITH | not started |
+| 5 | IM 36K10L35 | ITEM Service - ITH | summarized ([notes](manuals/IM36K10L35-01EN.md)); installed processes and setup files checked |
-| 5 | IM 36K10L36 | ITEM Service - ITM | not started |
+| 5 | IM 36K10L36 | ITEM Service - ITM | summarized ([notes](manuals/IM36K10L36-01EN.md)); `itmdbg` statistics run; `itmval -f` crashes (ISS-022) |
 | 6 | IM 36K10L10 | Class/Object Engineering | not started |
 | 6 | IM 36K10P10 | Class Description Language - Traditional | not started |
 | 6 | IM 36K10P11 | Class Description Language - Java | not started |
@@ -81,7 +81,7 @@ now come before classes and objects (phase 6), and the other interfaces follow a
 | J10 | Export a dataset with `dssqld` ([task](../.claude/skills/system-management/tasks/export-dataset.md)) | passed | n/a | Filtered export (`@SELECT`) passed ([ISS-003](issues.md), closed). |
 | J10 | Import and delete dataset records with `dssqld` (`-i`, `-r`) ([task](../.claude/skills/system-management/tasks/load-remove-records.md)) | passed | passed | Built CI-Eng-Sample: 3 sections + 4 items imported, removed and re-imported with 0 errors. 2026-09-30 later: `-m` (update, used to set a storage group stop time) and loading/removing storage groups passed; see [ISS-005](issues.md). |
 | J10 | Read an item with `itmval -g` ([task](../.claude/skills/system-management/tasks/read-write-item.md)) | passed | passed | Read `AID.WRPS.*` items. `-a 1..5` gave `ITM-E-WRONG_ATT` on an item without limits; works on items with limits ([ISS-004](issues.md), closed). |
-| J10 | Write an item with `itmval -p` ([task](../.claude/skills/system-management/tasks/read-write-item.md)) | passed | passed | Sample: `TANK1.INFLOW` 120.5 then 130 with `-s 9`, `PUMP1.RUNNING` 1 (status 5 BOOLEAN 1); no `uoff` flag. AID: `AID.WRPS.SIM.INFLOW` 419.76 → 400 → 419.76. After the first write the item's options gained the `uoff` flag (0x8a → 0x8e), which stays after restoring the value. See [ISS-001](issues.md). |
+| J10 | Write an item with `itmval -p` ([task](../.claude/skills/system-management/tasks/read-write-item.md)) | passed | passed | Sample: `TANK1.INFLOW` 120.5 then 130 with `-s 9`, `PUMP1.RUNNING` 1 (status 5 BOOLEAN 1); no `uoff` flag. AID: `AID.WRPS.SIM.INFLOW` 419.76 → 400 → 419.76. After the first write the item's options gained the `uoff` flag (0x8a → 0x8e) = *updated offline*, option bit 4 (written while its station was offline). See [ISS-001](issues.md), closed. |
 | J10 | Read the message log (`tls\log\umhlog.log`) | passed | n/a | |
 | J10 | Per-component version list (`tls\lst\tls_versions.lst`) | passed | n/a | |
 | J10 | Load history from CSV with `ithloahis`; read history back with `dssqld` ([task](../.claude/skills/system-management/tasks/load-history.md)) | passed | passed | Sample storage group `CIENG_EVENT` (Event/Item). SCAN file (LEVEL 61–63, INFLOW 101–103) and EVENT file (LEVEL 47, 48) stored and read back via `ITEM_HISTORY`. New groups need a CI Server restart before they store; samples dated before the current storage unit were not stored ([ISS-006](issues.md)). |
@@ -98,11 +98,14 @@ now come before classes and objects (phase 6), and the other interfaces follow a
 | C10 | Vnet/IP drivers / Vnet/IP Interface Package | not practiced | n/a | No Vnet/IP card; not supported on Windows 10 Pro. |
 | C30 | IT Security Tool, Domain Link Management, account utilities | not practiced | n/a | Not installed and not supported on Windows 10 Pro. |
 | G10 | Sub-items: Integrator, Min-Max (`SUB_ITEM_DF`) ([task](../.claude/skills/item-engineering/tasks/sub-items.md)) | passed | passed | Integrator adds value × seconds; `TIME_UNIT` ignored. |
-| G10 | Block / unblock an item (`ITEM_DF.BLOCKED` via `dssqld -m`); write with `itmval -o` ([task](../.claude/skills/item-engineering/tasks/block-item.md)) | passed | passed | `blk` flag, writes without `-o` silently ignored; `ublk` after unblock ([ISS-001](issues.md)). |
+| G10 | Block / unblock an item (`ITEM_DF.BLOCKED` via `dssqld -m`); write with `itmval -o` ([task](../.claude/skills/item-engineering/tasks/block-item.md)) | passed | passed | `blk` flag, writes without `-o` silently ignored; `ublk` (*updated blocked*) after unblock ([ISS-001](issues.md), closed). |
 | G10 | Trigger group, class (compile on load), object via quick load ([task](../.claude/skills/class-object-engineering/tasks/load-class-object.md)) | passed | passed | `DEMO.COUNTER` counts every second; full remove/load cycle clean. |
-| G10 | Authorization group and user creation | not practiced | n/a | Creates CI Server login accounts; left for the user or phase 5. |
+| G10/C10 | Authorization group and user creation ([task](../.claude/skills/authorization/tasks/users-groups.md)) | passed | passed | Group `CIENG_VIEWER` (sample file `08_auth_group_df.qli`) loaded/removed by Claude; test user `CIENG_TEST` (no password) loaded by the user, checked and removed. The sample creates no users. |
+| C10 | String items: length 1–200, holds length − 1 characters ([task](../.claude/skills/item-engineering/tasks/string-items.md)) | passed | passed | Tested with temporary `CI-Eng-Sample.DEMO.STR*` items (removed): 201 rejected; too-long writes cut, status 12 OVERRANGED ([ISS-019](issues.md)). |
+| C10 | Integrator time unit: integration granule `itm_int_secs` in `itm.sup` ([task](../.claude/skills/item-engineering/tasks/sub-items.md)) | passed | passed | 60 → `RUN_SECONDS` +1 per minute; restored to 1 (file identical to backup), +1 per second again ([ISS-010](issues.md)). Elevated restarts run by the user. |
 | G10 | Displays, symbols, Operator Interface test | not practiced | pending | GUI (Edit Module); phase 10. |
-| G10 | Lines / stations / points, alarms, reports, audit, RDBMS, history | not practiced | pending | Covered in their own phases (5–12). |
+| L41/C10 | Modbus TCP line, station, scan type, points, connected items by quick load ([task](../.claude/skills/equipment/tasks/modbus-station.md)) | passed | passed | Loopback to CI Server's own Modbus slave (`eqpmdcmem` + `eqpmdcslvtcp` on 5020, started by hand). Line load created and started `EQPCIENG`; removal stopped it and deleted its files. Write/read-back, off-scan/on-scan checked; full remove/reload from sample files. Protocol must be Open Modbus/TCP ([ISS-024](issues.md)). Mirror start files copied to `tls\com` by the user; after a restart everything came back under the CI Service and the setpoint was re-sent on connect. |
+| G10 | Alarms, reports, audit, RDBMS, history | not practiced | pending | Covered in their own phases (7–12). |
 | R10/R20 | Read a setup file: active settings and keyword help ([task](../.claude/skills/portal-setup/tasks/read-setup-file.md)) | passed | n/a | Read-only. Compared with the Setup File Editor GUI for `wfla_display.sup`, `wflgdi.sup` and all 9 tabs of `jwuiisg.sup`: fields and values identical. Manual differences logged as ISS-012 to ISS-017 (installed software taken as the reference). |
 | R10 | Check web access for CI View: ports, Remote Connect page, `DEPLOY` folder ([task](../.claude/skills/portal-setup/tasks/check-web-access.md)) | passed | n/a | 8080/8443 listening, page 200, six `DEPLOY` folders. |
 | R10/R20 | Change a setup file safely ([task](../.claude/skills/portal-setup/tasks/change-setup-file.md)) | passed | n/a | `jwuiisg.sup` HTTP port 8080 → 8081 (text edit, elevated restart): 8081 served the page, 8080 refused; restored, hash identical to backup. Editor: *OK* writes at once, *Reset Field* restores the default (ISS-016). |