---
manual: IM 36K10L41-01EN
title: EQUIPMENT Service Engineering - Configuration
edition: 3rd Edition, Sep. 2023
version: R1.03
status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)
---

# EQUIPMENT Service Engineering - Configuration (R1.03)

How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
points and conversion types, then one chapter per protocol. Section numbers refer to the
manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.

## 1–2. Architecture

- Needs BUS, DATABASE and ITEM Services running; USER Service to define stations, items and
  scan types.
- One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
  master), its setup file, shared libraries and datasets for line, station, scan type and point.
- **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
  an equipment manager instance. The name is free but must start with `eqp`.
- Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
  (lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
  the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
  `eqpmdc_item.sav` plus `.d01`/`.k01` files.)

## 3.1 Line types

| Type | Addresses | Main parameters |
|---|---|---|
| Serial | `LINE_1_DEVICE` / `LINE_2_DEVICE` = `com1:` (`\\.\com10` from COM10) | baud rate, 7/8 bits, parity, stop bits, XON |
| TCP/IP | `<IP>[:<port>]`, can be overruled per station | `DEAD_TIME` (s without data → reconnect, default 30), `REPEAT_CONNECTION_DELAY` (default 30 s), recover script, source address, splitter, switch time, carrier on/off delay for radios |
| DUR | `[<node>:]<process>` (other CI Server processes) | timeout rounded to seconds, default 3000 ms |
| UDP | `<IP>[:<port>]` | — |

Common to all: `HEART_BEAT` (manager cycle, ms; must be ≤ fastest scan; ~100 ms typical),
`PERIODIC_TIME` (s; re-checks BURST LIM filters for event-based inputs), `TIMEOUT` (ms; for
terminal servers include both network and serial times). Line 2 is the optional backup line.

## 3.2 Common station parameters

Name, description, station id (0 = assigned automatically), on scan, line, redundant line,
suppress outputs, output method (*On change* / *On change and connect*), preferred line
(None, Line 1, Line 2), and status items:
- `STATUS_ITEM`: 1 = station reachable, 0 = not (status OFFSCAN when off-scan);
- `LINE_1_ITEM`, `LINE_2_ITEM`: per line 1/0;
- `SELECT_ITEM`: line number in use.
Typeless sub-items on these show sub-line states (Modbus over TCP/IP only; values 0–3, see
C10 summary §4). **Dynamic scanning** (e.g. STARDOM FCX): a normal and a fast rate, fast
while a tag is on an open display; may need a larger manager queue.

## 3.3 Standard conversion types (field value ↔ item)

| Type | Field signal | Key parameters / behaviour |
|---|---|---|
| Digital | 1 bit | `INVERS`, `NO_ZERO` (never send 0), `AVE_UPD_INTERVAL` + `BURST_LIMIT` (too many changes → status BURST LIM for limit × interval s) |
| Binary | integer, no scaling | `BITS`, `HAS_SIGN`, `SWAP_BYTES`, `SWAP_WORDS` |
| Linear | integer, scaled | `ELEC_LOW/HIGH` → `PHYS_LOW/HIGH` (extrapolated; outside electrical range → UNDERRANGED/OVERRANGED), `DELTA_LIMIT` (→ DELTA), `AVE_UPD_INTERVAL` + `MAX_INSENS` (adaptive change filter), bits/sign/swaps |
| Dual-bit | 2 bits | value 0–3, status DB NONE/RIGHT/LEFT/BOTH; `TMO_NONE`/`TMO_BOTH` → DB NONE T / DB BOTH T |
| Unary | bit array, one bit set | value = lowest set bit (−1 if none); none/several → BAD VALUE |
| Float | 32/64-bit float | `FLOAT_TYPE` Intel, Motorola, Tandem, Dec; `STEP`, `OFFSET` (item = field × step + offset); swaps |
| String | ASCIIZ ≤ 80 incl. `\0` | `CHARS`; longer output is truncated without `\0` |
| Linear-BCD | 1–8 BCD digits | `DIGITS`, `STEP`, `OFFSET`, `OVERFL_DET` (counts roll-overs) |
| Time | 7-byte IEC or 32-bit POSIX | `TIME_ZONE` (LCT, LST, GMT, relative), `TIME_REPRES` |

Stations may force status/quality codes on top of these.

## 3.4 Specific conversion types

One per protocol where the standard ones do not fit: ProSafe-PLC, BSAP digital/float, TIE
command, STARDOM FCX (history id, special conversions of alarm/valve/batch/calc/counter/mode
status words into CI Server statuses such as HIGH, IOP+, MAN, AUT, CAS), Host-host, DNP3,
VNET, AB-CIP, Fisher ROC, Hex repeater (binary/float/relay), IEC 101/103/104 output, IEC 103
analog, IEC 61850, AC-Gateway, Wireless, Bachmann, Beckhoff ADS. Details stay in the manual.

## 3.5 Common setup-file parameters (`eqp<name>.sup`)

- *General*: `queue_size` (KB; more for many dynamic tags), `crit` (hex criterion mask for
  output events, default `D` = first + value + status), `logging_size` (MB, protocol log in
  the list folder, 0 = off; up to twice the size used). Installed `eqpmdc.sup` also has
  `start_offline = <Y|N>` (not described).
- *Behaviour*: `updown = <slave>, <line>` (log station / line up-down messages),
  `timestamp = Y` (use the RTU/manager ms time stamp for alarms and event history instead of
  the item-table second), `offline = <inputs off on loss>, <inputs on at recovery>, <outputs
  off on loss>, <outputs on at recovery>`. Default: inputs go offline on loss and online at
  their next value; outputs stay online.
Test system `eqpmdc.sup`: `queue_size = 20`, `crit = D`, `updown = Y,N`, `timestamp = Y`,
`offline = N,N,N,N`.

## 3.6 Modbus master (`EQPMDC`)

Modbus ASCII, RTU (serial, or TCP/IP to a serial converter) or Open Modbus/TCP.
Steps: line → setup file (created automatically) → stations → scan types → points.

Datasets (test system, via `dssqld -f`): `MODBUS_LINE_DF`, `MODBUS_STATION_DF`,
`MODBUS_SCAN_TYPE_DF`, `MODBUS_POINT_DF`; the general views `LINE_DF`, `STATION_DF`,
`SCAN_TYPE_DF`, `POINT_DF` list all protocols.

**Station, Options tab**: `PROTOCOL` (Ascii, RTU, Open Modbus/TCP — default), `SUB_STATION_ID`
(Modbus unit id), `ADDRESS_INCREMENT` (JBUS: addresses on the wire start at 1),
`RECOVER_TIME` (s between reconnect tries, default 10; a try can block the manager for a
timeout), `RECOVER_TRIES` (default 2), `WRITE_WAIT` (ms before each write), `SIGNAL_GAP`
(bytes of unused addresses read to merge requests, default 20), `SIGNALS` (max bytes per
request, ≤ 240), `FAR_END_CHECK`, `ALIVE_CHECK_METHOD` (function 7 by default; 8 or 1–4),
`ALIVE_CHECK_REGISTER_START`, `SEQUENCE_CHECK` (Modbus/TCP transaction ids, default on).
General tab: `LINE_1_DEVICE` / `LINE_2_DEVICE` = `<IP>[:<port>][;<IP2>[:<port>]]`, default
port 502.

**Scan types**: name + positive interval (ms), e.g. Fast 1000, Slow 10000.

**Points** (`IO_ADDRESS`, `EXTERNAL_RELATION` Input / Output / Input+Output, `SCAN_TYPE`,
`CONV_TYPE`):

| Address | Element | Function codes | Direction |
|---|---|---|---|
| `DO:<n>` | coil 1–65536 | 1, 5 | in/out |
| `DI:<n>` | input status (give 1… not 10001…) | 2 (15) | in |
| `RO:<n>[,<bit>]` | holding register (1… not 40001…), bit 0–15 | 3, 6, 16 | in/out |
| `RI:<n>[,<bit>]` | input register (1… not 30001…) | 4 | in |
| `ES:<n>` | exception status bit 1–8 | 7 | in |
| `LO:<n>[,<bit>]` | Daniel 4-byte register 1–32768, bit 0–31 | 3, 6, 16 | in/out |

Bits in registers are written read-modify-write. Floats are usually Intel, swap words on,
swap bytes off.

**Troubleshooting**: *protocol error (function x, error 2)* = RTU refuses part of the address
range (unused addresses read because of the signal gap, or DI/DO blocks not on 8-bit
boundaries: start at 1, 9, 17 …) → define the gap registers or set the gap to 0. Slow
communication: gaps of up to ~15 bytes are cheaper to read than an extra request; use
`WRITE_WAIT` if the RTU needs time after a reply. TCP/IP: ping first; switch off sequence
check if the station does not support it. Protocol logging marks errors with `/ERROR`.

External interface (for programs): send a raw request to an RTU, force a reconnect.

## 3.7 Modbus slave (Windows only)

CI Server can serve third-party Modbus masters through a "mirror":
- `EQPMDCMEM`: universal slave memory; per station id 64K registers (input and holding
  registers are the same area) and 64K status bits (coils and inputs the same); starts at 0;
  answers function codes 1–7, 15, 16. No setup file.
- `EQPMDCSLVSER`: serial slave (one per port; setup file copied from `eqpmdcslvser.sup`,
  tabs General, Terminal server, Direct port, Serial line).
- `EQPMDCSLVTCP`: Modbus RTU over TCP slave, `eqpmdcslvtcp -n <name> [-p <port>]`
  (default 502), several connections per instance, no setup file.
- Start them from the equipment start sequence; then define a normal **Modbus master line
  and stations in CI Server pointing at the slave's address** (output method *On change and
  connect*). CI Server items then read and write the same registers the third party sees.
Installed on the test system: `eqpmdcmem.exe`, `eqpmdcslvser.exe`, `eqpmdcslvtcp.exe`; none
running. **Verified** 2026-09-30 with CI-Eng-Sample station `CIENG_PLC`: the TCP slave answered only with
station protocol **Open Modbus/TCP**, not RTU as the manual says (ISS-024); skill `equipment`, task
`modbus-station.md`. On R1.03 `equipment_start.cmd` runs every `tls\com\eqp*start.cmd`, so a separate
start file is enough (see L40 summary).

## 3.8–3.40 Other drivers

| § | Driver | Connection | Notes |
|---|---|---|---|
| 3.8 | MQTT | TCP/IP via a broker | CI Server is an MQTT client |
| 3.9 | ProSafe-COM (MULCOM/MODCOM) | serial or TCP/IP | extended Modbus |
| 3.10 | ProSafe-PLC | APACS API (Windows only) | time sync, SOE |
| 3.11 | STARDOM FCX | TCP/IP | FCX preparation, message interface, SOE, dynamic scanning, history buffer |
| 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
| 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
| 3.14 | FA-M3 | TCP/IP | |
| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed |
| 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
| 3.17 | Beckhoff BK8100 | serial / terminal server | |
| 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
| 3.19 | Allen Bradley CIP | TCP/IP to ControlLogix Ethernet module | connected messaging |
| 3.20 | Siemens 3964R | serial | |
| 3.21 | Siemens SAPI-S7 | API software | |
| 3.22 | Bristol Babcock BSAP | serial / terminal server | RTU preparation, external interface |
| 3.23 | Fisher ROC | serial / terminal server | FloBoss 100/407/500, ROC300/800, RegFlo |
| 3.24 | DNP3 | TCP/IP or serial | authentication option |
| 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
| 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
| 3.27 | TIE 870-5 | serial | |
| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | |
| 3.32 | IEC 61850 | TCP/IP | scan reads; direct write and control models |
| 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
| 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
| 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
| 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
| 3.38 | Bachmann | M1COM library | |
| 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
| 3.40 | Beckhoff ADS | TwinCAT 3 router | |

## Test system (read-only, 2026-09-30)

The author's AID project has line `MODSIM_LINE` (TCP/IP, manager `EQPMDC`, heart beat 100,
timeout 3000, dead time 30) with Modbus/TCP stations `MODSIM_STATION` (localhost) and
`WRPS_PLC` (host `dev-ubuntu`), scan type `MOD_SCAN` 500 ms and 69 points (e.g. `RI:01`
Linear 0–100); nothing listens on port 502, so both stations are down. Line `LINE_MQTT` uses
`EQPMQTT`.