cliu
90058ffdef
- New skill equipment with task modbus-station: line, station, scan type, points and connected items by quick load, tested against CI Server's own Modbus slave mirror (eqpmdcmem + eqpmdcslvtcp) - CI-Eng-Sample: section PLC1, station CIENG_PLC with write/read-back items, load/remove steps and mirror start/stop scripts - ISS-024: the TCP slave answers Open Modbus/TCP, not RTU (closed) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
195 lines
12 KiB
Markdown
195 lines
12 KiB
Markdown
---
|
||
manual: IM 36K10L41-01EN
|
||
title: EQUIPMENT Service Engineering - Configuration
|
||
edition: 3rd Edition, Sep. 2023
|
||
version: R1.03
|
||
status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)
|
||
---
|
||
|
||
# EQUIPMENT Service Engineering - Configuration (R1.03)
|
||
|
||
How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
|
||
points and conversion types, then one chapter per protocol. Section numbers refer to the
|
||
manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.
|
||
|
||
## 1–2. Architecture
|
||
|
||
- Needs BUS, DATABASE and ITEM Services running; USER Service to define stations, items and
|
||
scan types.
|
||
- One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
|
||
master), its setup file, shared libraries and datasets for line, station, scan type and point.
|
||
- **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
|
||
an equipment manager instance. The name is free but must start with `eqp`.
|
||
- Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
|
||
(lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
|
||
the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
|
||
`eqpmdc_item.sav` plus `.d01`/`.k01` files.)
|
||
|
||
## 3.1 Line types
|
||
|
||
| Type | Addresses | Main parameters |
|
||
|---|---|---|
|
||
| Serial | `LINE_1_DEVICE` / `LINE_2_DEVICE` = `com1:` (`\\.\com10` from COM10) | baud rate, 7/8 bits, parity, stop bits, XON |
|
||
| TCP/IP | `<IP>[:<port>]`, can be overruled per station | `DEAD_TIME` (s without data → reconnect, default 30), `REPEAT_CONNECTION_DELAY` (default 30 s), recover script, source address, splitter, switch time, carrier on/off delay for radios |
|
||
| DUR | `[<node>:]<process>` (other CI Server processes) | timeout rounded to seconds, default 3000 ms |
|
||
| UDP | `<IP>[:<port>]` | — |
|
||
|
||
Common to all: `HEART_BEAT` (manager cycle, ms; must be ≤ fastest scan; ~100 ms typical),
|
||
`PERIODIC_TIME` (s; re-checks BURST LIM filters for event-based inputs), `TIMEOUT` (ms; for
|
||
terminal servers include both network and serial times). Line 2 is the optional backup line.
|
||
|
||
## 3.2 Common station parameters
|
||
|
||
Name, description, station id (0 = assigned automatically), on scan, line, redundant line,
|
||
suppress outputs, output method (*On change* / *On change and connect*), preferred line
|
||
(None, Line 1, Line 2), and status items:
|
||
- `STATUS_ITEM`: 1 = station reachable, 0 = not (status OFFSCAN when off-scan);
|
||
- `LINE_1_ITEM`, `LINE_2_ITEM`: per line 1/0;
|
||
- `SELECT_ITEM`: line number in use.
|
||
Typeless sub-items on these show sub-line states (Modbus over TCP/IP only; values 0–3, see
|
||
C10 summary §4). **Dynamic scanning** (e.g. STARDOM FCX): a normal and a fast rate, fast
|
||
while a tag is on an open display; may need a larger manager queue.
|
||
|
||
## 3.3 Standard conversion types (field value ↔ item)
|
||
|
||
| Type | Field signal | Key parameters / behaviour |
|
||
|---|---|---|
|
||
| Digital | 1 bit | `INVERS`, `NO_ZERO` (never send 0), `AVE_UPD_INTERVAL` + `BURST_LIMIT` (too many changes → status BURST LIM for limit × interval s) |
|
||
| Binary | integer, no scaling | `BITS`, `HAS_SIGN`, `SWAP_BYTES`, `SWAP_WORDS` |
|
||
| Linear | integer, scaled | `ELEC_LOW/HIGH` → `PHYS_LOW/HIGH` (extrapolated; outside electrical range → UNDERRANGED/OVERRANGED), `DELTA_LIMIT` (→ DELTA), `AVE_UPD_INTERVAL` + `MAX_INSENS` (adaptive change filter), bits/sign/swaps |
|
||
| Dual-bit | 2 bits | value 0–3, status DB NONE/RIGHT/LEFT/BOTH; `TMO_NONE`/`TMO_BOTH` → DB NONE T / DB BOTH T |
|
||
| Unary | bit array, one bit set | value = lowest set bit (−1 if none); none/several → BAD VALUE |
|
||
| Float | 32/64-bit float | `FLOAT_TYPE` Intel, Motorola, Tandem, Dec; `STEP`, `OFFSET` (item = field × step + offset); swaps |
|
||
| String | ASCIIZ ≤ 80 incl. `\0` | `CHARS`; longer output is truncated without `\0` |
|
||
| Linear-BCD | 1–8 BCD digits | `DIGITS`, `STEP`, `OFFSET`, `OVERFL_DET` (counts roll-overs) |
|
||
| Time | 7-byte IEC or 32-bit POSIX | `TIME_ZONE` (LCT, LST, GMT, relative), `TIME_REPRES` |
|
||
|
||
Stations may force status/quality codes on top of these.
|
||
|
||
## 3.4 Specific conversion types
|
||
|
||
One per protocol where the standard ones do not fit: ProSafe-PLC, BSAP digital/float, TIE
|
||
command, STARDOM FCX (history id, special conversions of alarm/valve/batch/calc/counter/mode
|
||
status words into CI Server statuses such as HIGH, IOP+, MAN, AUT, CAS), Host-host, DNP3,
|
||
VNET, AB-CIP, Fisher ROC, Hex repeater (binary/float/relay), IEC 101/103/104 output, IEC 103
|
||
analog, IEC 61850, AC-Gateway, Wireless, Bachmann, Beckhoff ADS. Details stay in the manual.
|
||
|
||
## 3.5 Common setup-file parameters (`eqp<name>.sup`)
|
||
|
||
- *General*: `queue_size` (KB; more for many dynamic tags), `crit` (hex criterion mask for
|
||
output events, default `D` = first + value + status), `logging_size` (MB, protocol log in
|
||
the list folder, 0 = off; up to twice the size used). Installed `eqpmdc.sup` also has
|
||
`start_offline = <Y|N>` (not described).
|
||
- *Behaviour*: `updown = <slave>, <line>` (log station / line up-down messages),
|
||
`timestamp = Y` (use the RTU/manager ms time stamp for alarms and event history instead of
|
||
the item-table second), `offline = <inputs off on loss>, <inputs on at recovery>, <outputs
|
||
off on loss>, <outputs on at recovery>`. Default: inputs go offline on loss and online at
|
||
their next value; outputs stay online.
|
||
Test system `eqpmdc.sup`: `queue_size = 20`, `crit = D`, `updown = Y,N`, `timestamp = Y`,
|
||
`offline = N,N,N,N`.
|
||
|
||
## 3.6 Modbus master (`EQPMDC`)
|
||
|
||
Modbus ASCII, RTU (serial, or TCP/IP to a serial converter) or Open Modbus/TCP.
|
||
Steps: line → setup file (created automatically) → stations → scan types → points.
|
||
|
||
Datasets (test system, via `dssqld -f`): `MODBUS_LINE_DF`, `MODBUS_STATION_DF`,
|
||
`MODBUS_SCAN_TYPE_DF`, `MODBUS_POINT_DF`; the general views `LINE_DF`, `STATION_DF`,
|
||
`SCAN_TYPE_DF`, `POINT_DF` list all protocols.
|
||
|
||
**Station, Options tab**: `PROTOCOL` (Ascii, RTU, Open Modbus/TCP — default), `SUB_STATION_ID`
|
||
(Modbus unit id), `ADDRESS_INCREMENT` (JBUS: addresses on the wire start at 1),
|
||
`RECOVER_TIME` (s between reconnect tries, default 10; a try can block the manager for a
|
||
timeout), `RECOVER_TRIES` (default 2), `WRITE_WAIT` (ms before each write), `SIGNAL_GAP`
|
||
(bytes of unused addresses read to merge requests, default 20), `SIGNALS` (max bytes per
|
||
request, ≤ 240), `FAR_END_CHECK`, `ALIVE_CHECK_METHOD` (function 7 by default; 8 or 1–4),
|
||
`ALIVE_CHECK_REGISTER_START`, `SEQUENCE_CHECK` (Modbus/TCP transaction ids, default on).
|
||
General tab: `LINE_1_DEVICE` / `LINE_2_DEVICE` = `<IP>[:<port>][;<IP2>[:<port>]]`, default
|
||
port 502.
|
||
|
||
**Scan types**: name + positive interval (ms), e.g. Fast 1000, Slow 10000.
|
||
|
||
**Points** (`IO_ADDRESS`, `EXTERNAL_RELATION` Input / Output / Input+Output, `SCAN_TYPE`,
|
||
`CONV_TYPE`):
|
||
|
||
| Address | Element | Function codes | Direction |
|
||
|---|---|---|---|
|
||
| `DO:<n>` | coil 1–65536 | 1, 5 | in/out |
|
||
| `DI:<n>` | input status (give 1… not 10001…) | 2 (15) | in |
|
||
| `RO:<n>[,<bit>]` | holding register (1… not 40001…), bit 0–15 | 3, 6, 16 | in/out |
|
||
| `RI:<n>[,<bit>]` | input register (1… not 30001…) | 4 | in |
|
||
| `ES:<n>` | exception status bit 1–8 | 7 | in |
|
||
| `LO:<n>[,<bit>]` | Daniel 4-byte register 1–32768, bit 0–31 | 3, 6, 16 | in/out |
|
||
|
||
Bits in registers are written read-modify-write. Floats are usually Intel, swap words on,
|
||
swap bytes off.
|
||
|
||
**Troubleshooting**: *protocol error (function x, error 2)* = RTU refuses part of the address
|
||
range (unused addresses read because of the signal gap, or DI/DO blocks not on 8-bit
|
||
boundaries: start at 1, 9, 17 …) → define the gap registers or set the gap to 0. Slow
|
||
communication: gaps of up to ~15 bytes are cheaper to read than an extra request; use
|
||
`WRITE_WAIT` if the RTU needs time after a reply. TCP/IP: ping first; switch off sequence
|
||
check if the station does not support it. Protocol logging marks errors with `/ERROR`.
|
||
|
||
External interface (for programs): send a raw request to an RTU, force a reconnect.
|
||
|
||
## 3.7 Modbus slave (Windows only)
|
||
|
||
CI Server can serve third-party Modbus masters through a "mirror":
|
||
- `EQPMDCMEM`: universal slave memory; per station id 64K registers (input and holding
|
||
registers are the same area) and 64K status bits (coils and inputs the same); starts at 0;
|
||
answers function codes 1–7, 15, 16. No setup file.
|
||
- `EQPMDCSLVSER`: serial slave (one per port; setup file copied from `eqpmdcslvser.sup`,
|
||
tabs General, Terminal server, Direct port, Serial line).
|
||
- `EQPMDCSLVTCP`: Modbus RTU over TCP slave, `eqpmdcslvtcp -n <name> [-p <port>]`
|
||
(default 502), several connections per instance, no setup file.
|
||
- Start them from the equipment start sequence; then define a normal **Modbus master line
|
||
and stations in CI Server pointing at the slave's address** (output method *On change and
|
||
connect*). CI Server items then read and write the same registers the third party sees.
|
||
Installed on the test system: `eqpmdcmem.exe`, `eqpmdcslvser.exe`, `eqpmdcslvtcp.exe`; none
|
||
running. **Verified** 2026-09-30 with CI-Eng-Sample station `CIENG_PLC`: the TCP slave answered only with
|
||
station protocol **Open Modbus/TCP**, not RTU as the manual says (ISS-024); skill `equipment`, task
|
||
`modbus-station.md`. On R1.03 `equipment_start.cmd` runs every `tls\com\eqp*start.cmd`, so a separate
|
||
start file is enough (see L40 summary).
|
||
|
||
## 3.8–3.40 Other drivers
|
||
|
||
| § | Driver | Connection | Notes |
|
||
|---|---|---|---|
|
||
| 3.8 | MQTT | TCP/IP via a broker | CI Server is an MQTT client |
|
||
| 3.9 | ProSafe-COM (MULCOM/MODCOM) | serial or TCP/IP | extended Modbus |
|
||
| 3.10 | ProSafe-PLC | APACS API (Windows only) | time sync, SOE |
|
||
| 3.11 | STARDOM FCX | TCP/IP | FCX preparation, message interface, SOE, dynamic scanning, history buffer |
|
||
| 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
|
||
| 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
|
||
| 3.14 | FA-M3 | TCP/IP | |
|
||
| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed |
|
||
| 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
|
||
| 3.17 | Beckhoff BK8100 | serial / terminal server | |
|
||
| 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
|
||
| 3.19 | Allen Bradley CIP | TCP/IP to ControlLogix Ethernet module | connected messaging |
|
||
| 3.20 | Siemens 3964R | serial | |
|
||
| 3.21 | Siemens SAPI-S7 | API software | |
|
||
| 3.22 | Bristol Babcock BSAP | serial / terminal server | RTU preparation, external interface |
|
||
| 3.23 | Fisher ROC | serial / terminal server | FloBoss 100/407/500, ROC300/800, RegFlo |
|
||
| 3.24 | DNP3 | TCP/IP or serial | authentication option |
|
||
| 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
|
||
| 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
|
||
| 3.27 | TIE 870-5 | serial | |
|
||
| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | |
|
||
| 3.32 | IEC 61850 | TCP/IP | scan reads; direct write and control models |
|
||
| 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
|
||
| 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
|
||
| 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
|
||
| 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
|
||
| 3.38 | Bachmann | M1COM library | |
|
||
| 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
|
||
| 3.40 | Beckhoff ADS | TwinCAT 3 router | |
|
||
|
||
## Test system (read-only, 2026-09-30)
|
||
|
||
The author's AID project has line `MODSIM_LINE` (TCP/IP, manager `EQPMDC`, heart beat 100,
|
||
timeout 3000, dead time 30) with Modbus/TCP stations `MODSIM_STATION` (localhost) and
|
||
`WRPS_PLC` (host `dev-ubuntu`), scan type `MOD_SCAN` 500 ms and 69 points (e.g. `RI:01`
|
||
Linear 0–100); nothing listens on port 502, so both stations are down. Line `LINE_MQTT` uses
|
||
`EQPMQTT`.
|