ci-server-engineer/knowledge/manuals/IM36K10L41-01EN.md

---

manual: IM 36K10L41-01EN title: EQUIPMENT Service Engineering - Configuration edition: 5th Edition, Feb. 2026 (R1.05); first written from the 3rd Edition, Sep. 2023 (R1.03). Changed since: R1.04 §3.4.5/3.4.7/3.4.8, 3.12.2, 3.15, 3.32, 3.40, App. 1 new; R1.05 §3.32, App. 1.3, App. 1.4 new version: R1.05 (first written for R1.03) status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the R1.03 test system (2026-09-30); R1.05 changes added from the 5th Edition and checked read-only on the R1.05 test server (2026-10-08): Modbus datasets and setup files identical to R1.03

EQUIPMENT Service Engineering - Configuration (R1.05)

How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types, points and conversion types, then one chapter per protocol. Section numbers refer to the manual. Utilities (forced scan, statistics, debugger): IM36K10L40-01EN.md.

1–2. Architecture

• Needs BUS, DATABASE and ITEM Services running; USER Service to define stations, items and scan types.
• One plug-in per protocol: an equipment manager process (e.g. EQPMDC for Modbus master), its setup file, shared libraries and datasets for line, station, scan type and point.
• Defining a line copies the protocol's template setup file (e.g. eqpmdc.sup) and starts an equipment manager instance. The name is free but must start with eqp; for IEC 60870-5-104 and IEC 61850 (R1.04 and later) it starts with eqt (defaults EQT104, EQT850; §3.32.1, App. 1.3; for 104 the manual still says eqp104, ISS-076).
• Each manager keeps two private save files in %TLS_SAV_PATH%: <process>_MAIN.sav (lines/stations) and <process>_ITEM.sav (points), only to start fast. Deleting them loses the runtime configuration; repair with dsschk. (Test system: eqpmdc_main.sav, eqpmdc_item.sav plus .d01/.k01 files.)

3.1 Line types

Type	Addresses	Main parameters
Serial	LINE_1_DEVICE / LINE_2_DEVICE = com1: (\\.\com10 from COM10)	baud rate, 7/8 bits, parity, stop bits, XON
TCP/IP	<IP>[:<port>], can be overruled per station	DEAD_TIME (s without data → reconnect, default 30), REPEAT_CONNECTION_DELAY (default 30 s), recover script, source address, splitter, switch time, carrier on/off delay for radios
DUR	[<node>:]<process> (other CI Server processes)	timeout rounded to seconds, default 3000 ms
UDP	<IP>[:<port>]	—

Common to all: HEART_BEAT (manager cycle, ms; must be ≤ fastest scan; ~100 ms typical), PERIODIC_TIME (s; re-checks BURST LIM filters for event-based inputs), TIMEOUT (ms; for terminal servers include both network and serial times). Line 2 is the optional backup line.

3.2 Common station parameters

Name, description, station id (0 = assigned automatically), on scan, line, redundant line, suppress outputs, output method (On change / On change and connect), preferred line (None, Line 1, Line 2), and status items:

• STATUS_ITEM: 1 = station reachable, 0 = not (status OFFSCAN when off-scan);
• LINE_1_ITEM, LINE_2_ITEM: per line 1/0;
• SELECT_ITEM: line number in use. Typeless sub-items on these show sub-line states (Modbus over TCP/IP only; values 0–3, see C10 summary §4). Dynamic scanning (e.g. STARDOM FCX): a normal and a fast rate, fast while a tag is on an open display; may need a larger manager queue.

3.3 Standard conversion types (field value ↔ item)

Type	Field signal	Key parameters / behaviour
Digital	1 bit	INVERS, NO_ZERO (never send 0), AVE_UPD_INTERVAL + BURST_LIMIT (too many changes → status BURST LIM for limit × interval s)
Binary	integer, no scaling	BITS, HAS_SIGN, SWAP_BYTES, SWAP_WORDS
Linear	integer, scaled	ELEC_LOW/HIGH → PHYS_LOW/HIGH (extrapolated; outside electrical range → UNDERRANGED/OVERRANGED), DELTA_LIMIT (→ DELTA), AVE_UPD_INTERVAL + MAX_INSENS (adaptive change filter), bits/sign/swaps
Dual-bit	2 bits	value 0–3, status DB NONE/RIGHT/LEFT/BOTH; TMO_NONE/TMO_BOTH → DB NONE T / DB BOTH T
Unary	bit array, one bit set	value = lowest set bit (−1 if none); none/several → BAD VALUE
Float	32/64-bit float	FLOAT_TYPE Intel, Motorola, Tandem, Dec; STEP, OFFSET (item = field × step + offset); swaps
String	ASCIIZ ≤ 80 incl. \0	CHARS; longer output is truncated without \0
Linear-BCD	1–8 BCD digits	DIGITS, STEP, OFFSET, OVERFL_DET (counts roll-overs)
Time	7-byte IEC or 32-bit POSIX	TIME_ZONE (LCT, LST, GMT, relative), TIME_REPRES

Stations may force status/quality codes on top of these.

3.4 Specific conversion types

One per protocol where the standard ones do not fit: ProSafe-PLC, BSAP digital/float, TIE command, STARDOM FCX (history id, special conversions of alarm/valve/batch/calc/counter/mode status words into CI Server statuses such as HIGH, IOP+, MAN, AUT, CAS), Host-host, DNP3, VNET, AB-CIP, Fisher ROC, Hex repeater (binary/float/relay), IEC 101/103/104 output, IEC 103 analog, IEC 61850, AC-Gateway, Wireless, Bachmann, Beckhoff ADS. Details stay in the manual.

3.5 Common setup-file parameters (eqp<name>.sup)

• General: queue_size (KB; more for many dynamic tags), crit (hex criterion mask for output events, default D = first + value + status), logging_size (MB, protocol log in the list folder, 0 = off; up to twice the size used). Installed eqpmdc.sup also has start_offline = <Y|N> (not described).
• Behaviour: updown = <slave>, <line> (log station / line up-down messages), timestamp = Y (use the RTU/manager ms time stamp for alarms and event history instead of the item-table second), offline = <inputs off on loss>, <inputs on at recovery>, <outputs off on loss>, <outputs on at recovery>. Default: inputs go offline on loss and online at their next value; outputs stay online. Test system eqpmdc.sup: queue_size = 20, crit = D, updown = Y,N, timestamp = Y, offline = N,N,N,N.

3.6 Modbus master (EQPMDC)

Modbus ASCII, RTU (serial, or TCP/IP to a serial converter) or Open Modbus/TCP. Steps: line → setup file (created automatically) → stations → scan types → points.

Datasets (test system, via dssqld -f): MODBUS_LINE_DF, MODBUS_STATION_DF, MODBUS_SCAN_TYPE_DF, MODBUS_POINT_DF; the general views LINE_DF, STATION_DF, SCAN_TYPE_DF, POINT_DF list all protocols.

Station, Options tab: PROTOCOL (Ascii, RTU, Open Modbus/TCP — default), SUB_STATION_ID (Modbus unit id), ADDRESS_INCREMENT (JBUS: addresses on the wire start at 1), RECOVER_TIME (s between reconnect tries, default 10; a try can block the manager for a timeout), RECOVER_TRIES (default 2), WRITE_WAIT (ms before each write), SIGNAL_GAP (bytes of unused addresses read to merge requests, default 20), SIGNALS (max bytes per request, ≤ 240), FAR_END_CHECK, ALIVE_CHECK_METHOD (function 7 by default; 8 or 1–4), ALIVE_CHECK_REGISTER_START, SEQUENCE_CHECK (Modbus/TCP transaction ids, default on). General tab: LINE_1_DEVICE / LINE_2_DEVICE = <IP>[:<port>][;<IP2>[:<port>]], default port 502.

Scan types: name + positive interval (ms), e.g. Fast 1000, Slow 10000.

Points (IO_ADDRESS, EXTERNAL_RELATION Input / Output / Input+Output, SCAN_TYPE, CONV_TYPE):

Address	Element	Function codes	Direction
DO:<n>	coil 1–65536	1, 5	in/out
DI:<n>	input status (give 1… not 10001…)	2 (15)	in
RO:<n>[,<bit>]	holding register (1… not 40001…), bit 0–15	3, 6, 16	in/out
RI:<n>[,<bit>]	input register (1… not 30001…)	4	in
ES:<n>	exception status bit 1–8	7	in
LO:<n>[,<bit>]	Daniel 4-byte register 1–32768, bit 0–31	3, 6, 16	in/out

Bits in registers are written read-modify-write. Floats are usually Intel, swap words on, swap bytes off.

Troubleshooting: protocol error (function x, error 2) = RTU refuses part of the address range (unused addresses read because of the signal gap, or DI/DO blocks not on 8-bit boundaries: start at 1, 9, 17 …) → define the gap registers or set the gap to 0. Slow communication: gaps of up to ~15 bytes are cheaper to read than an extra request; use WRITE_WAIT if the RTU needs time after a reply. TCP/IP: ping first; switch off sequence check if the station does not support it. Protocol logging marks errors with /ERROR.

External interface (for programs): send a raw request to an RTU, force a reconnect.

3.7 Modbus slave (Windows only)

CI Server can serve third-party Modbus masters through a "mirror":

• EQPMDCMEM: universal slave memory; per station id 64K registers (input and holding registers are the same area) and 64K status bits (coils and inputs the same); starts at 0; answers function codes 1–7, 15, 16. No setup file.
• EQPMDCSLVSER: serial slave (one per port; setup file copied from eqpmdcslvser.sup, tabs General, Terminal server, Direct port, Serial line).
• EQPMDCSLVTCP: Modbus RTU over TCP slave, eqpmdcslvtcp -n <name> [-p <port>] (default 502), several connections per instance, no setup file.
• Start them from the equipment start sequence; then define a normal Modbus master line and stations in CI Server pointing at the slave's address (output method On change and connect). CI Server items then read and write the same registers the third party sees. Installed on the test system: eqpmdcmem.exe, eqpmdcslvser.exe, eqpmdcslvtcp.exe; none running. Verified 2026-09-30 with CI-Eng-Sample station CIENG_PLC: the TCP slave answered only with station protocol Open Modbus/TCP, not RTU as the manual says (ISS-024); skill equipment, task modbus-station.md. On R1.03 equipment_start.cmd runs every tls\com\eqp*start.cmd, so a separate start file is enough (see L40 summary).

3.8–3.40 Other drivers

§	Driver	Connection	Notes
3.8	MQTT	TCP/IP via a broker	CI Server is an MQTT client
3.9	ProSafe-COM (MULCOM/MODCOM)	serial or TCP/IP	extended Modbus
3.10	ProSafe-PLC	APACS API (Windows only)	time sync, SOE
3.11	STARDOM FCX	TCP/IP	FCX preparation, message interface, SOE, dynamic scanning, history buffer
3.12	VNET	Vnet/IP	needs Vnet/IP set up (not on Windows 10 test PC)
3.13	Host-Host Coupling (EQPHHC)	MDUR to another CI Core	read/write points of a remote CI Server
3.14	FA-M3	TCP/IP
3.15	MELSEC	EZSocket (TCP/IP, UDP, serial)	EZSocket must be installed: installer on the install media (\Windows\EZSocketPcRedistributableInstaller), run as administrator; fails if CI Server is not in the default location or its path has spaces (R1.04)
3.16	DAQSTATION	TCP/IP	DX, CX, MW100, GX/GP/GM
3.17	Beckhoff BK8100	serial / terminal server
3.18	Allen Bradley PLC5	DH+ via ControlLogix DHRIO, or DF1 serial/terminal server	BCC checksum only
3.19	Allen Bradley CIP	TCP/IP to ControlLogix Ethernet module	connected messaging
3.20	Siemens 3964R	serial
3.21	Siemens SAPI-S7	API software
3.22	Bristol Babcock BSAP	serial / terminal server	RTU preparation, external interface
3.23	Fisher ROC	serial / terminal server	FloBoss 100/407/500, ROC300/800, RegFlo
3.24	DNP3	TCP/IP or serial	authentication option
3.25	HART router	serial in, terminal server out	re-issues HART commands to a multiplexer
3.26	Hex repeater	terminal server	RTU models in hxr_model.sup
3.27	TIE 870-5	serial
3.28–3.31	IEC 60870-5-101 / 102 / 103 / 104	serial or TCP/IP (104: TCP/IP)	104 on R1.04+: manager EQT104, template eta104_eqt.sup with an undocumented quality_code_parsing switch (ISS-076, ISS-077)
3.32	IEC 61850	TCP/IP	manager EQT850 on R1.04+: polling or IEC 61850 reports, report control blocks; see below
3.33–3.34	WITS level 0 slave / master (EQPWITS, EQPWITSWR)	serial / terminal server	drilling data
3.35	STX-Bachmann	Modbus to STX PLC	event buffer extension
3.36	DTS	Modbus TCP + (S)FTP WITSML	stores in history group DTS_DATA; EQPDTSDBG
3.37	AC-Gateway	ASCII subset (BK, SI, FG, FS)
3.38	Bachmann	M1COM library
3.39	Omron FINS	UDP	CIO, WR, HR, AR, DM areas
3.40	Beckhoff ADS	TwinCAT 3 router	TwinCAT 3 Build 4024 or later (R1.04; was 3.1.4022.2)

3.32 IEC 61850 on R1.04 and later

From docs (5th Edition §3.32) unless marked; installed files checked on the R1.05 test server (2026-10-08).

• Order: line, setup file, stations, I/O points, then report control blocks. Give the IED engineer the client file tls\sup\eqt850.icd once per project (installed on R1.05). The manual names the client EQP850 in one place and EQT850 elsewhere (ISS-079).
• Station: DOMAIN_PREFIX = logical-device name put in front of every I/O address (no "/"); default port 102. The old station field REPORTS is hidden on R1.05; on upgrade its content becomes report control blocks RCB10…RCB50.
• Points: IO_ADDRESS, TIMESTAMP_ADDRESS, QUALITY_ADDRESS up to 139 characters (field length 140 on R1.05, 130 on R1.03). No prefix = polled; prefix R: = taken from a received report. All three addresses of a point must be in the same report data set, and R: addresses must be unique. Arrays as [n], n 0–9999. Scan types Slow / Medium / Fast / Event; DATA_TYPE default Automatic.
• Quality: bits 0–12 carry the IEC 61850 quality. With a control model, bits 13–31 of the item quality report Select / Operate / Cancel, stSeld, AddCause and command termination (timeout operTimeout, default 60000 ms). A failed write to a report-sourced item sets BAD VALUE and sends a general interrogation to all report control blocks of the station.
• Report control blocks, dataset IEC61850_RCB_DF (new; fields checked on R1.05): NAME = <station>:<rcb name>, STATION, RCB_NAME, DESCRIPTION, RCB_IO_ADDRESS (required), STANBY_RCB_BLOCKS, STANBY_RCB_IO_ADDRESS (spelled this way), CONNECTION_TIMEOUT (default 5000 ms), IS_DYN_SETTABLE_OPTFLDS (default 1; set optional fields dynamically only when the IED's SCL file allows it). Trigger options dchg, qchg, dupd, integrity, GI; RptID unique per block; the EntryID lets the client resume after a reconnect.
• Setup file eqt850.sup (template eta850_eqt.sup, checked on R1.05): crit default 8D (adds the quality criterion); new switch select_oper_internal = Y|N (default N; Y keeps the R1.03 behaviour of an internal Select).

Appendix 1: upgrade precautions (R1.04 and later)

From docs (5th Edition App. 1.1–1.4).

• From R1.03 with IEC 61850 configured: the line's process name changes automatically from EQP… to EQT…, but the instance setup file is not renamed: rename eqp850.sup to eqt850.sup and merge it with the new template eta850_eqt.sup (old epa850_eqp.sup); rename and edit tls\com\eqp850_start.cmd / _stop.cmd to eqt850_* with eqt850.exe / EQT850. This can be done by hand or with %TLS_ROOT_PATH%\tls\com\jupgutl (log in %TLS_LOG_PATH%\jmrg\); it is not needed when Automatic upgrade CI Server configuration was chosen during setup.
• No precautions for R1.01→R1.02, R1.02→R1.03 or R1.04→R1.05. IEC 104 is not mentioned (ISS-076).
• §3.4.5, 3.4.7, 3.4.8 (STARDOM FCX, VNET and CENTUM status words) were rewritten as tables of item statuses; the mapping did not change.

Test system (read-only, 2026-09-30)

The author's AID project has line MODSIM_LINE (TCP/IP, manager EQPMDC, heart beat 100, timeout 3000, dead time 30) with Modbus/TCP stations MODSIM_STATION (localhost) and WRPS_PLC (host dev-ubuntu), scan type MOD_SCAN 500 ms and 69 points (e.g. RI:01 Linear 0–100); nothing listens on port 502, so both stations are down. Line LINE_MQTT uses EQPMQTT.