ci-server-engineer/knowledge/manuals/IM36K10L41-01EN.md

manual	title	edition	version	status
IM 36K10L41-01EN	EQUIPMENT Service Engineering - Configuration	3rd Edition, Sep. 2023	R1.03	from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)

EQUIPMENT Service Engineering - Configuration (R1.03)

How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types, points and conversion types, then one chapter per protocol. Section numbers refer to the manual. Utilities (forced scan, statistics, debugger): IM36K10L40-01EN.md.

1–2. Architecture

• Needs BUS, DATABASE and ITEM Services running; USER Service to define stations, items and scan types.
• One plug-in per protocol: an equipment manager process (e.g. EQPMDC for Modbus master), its setup file, shared libraries and datasets for line, station, scan type and point.
• Defining a line copies the protocol's template setup file (e.g. eqpmdc.sup) and starts an equipment manager instance. The name is free but must start with eqp.
• Each manager keeps two private save files in %TLS_SAV_PATH%: <process>_MAIN.sav (lines/stations) and <process>_ITEM.sav (points), only to start fast. Deleting them loses the runtime configuration; repair with dsschk. (Test system: eqpmdc_main.sav, eqpmdc_item.sav plus .d01/.k01 files.)

3.1 Line types

Type	Addresses	Main parameters
Serial	LINE_1_DEVICE / LINE_2_DEVICE = com1: (\\.\com10 from COM10)	baud rate, 7/8 bits, parity, stop bits, XON
TCP/IP	<IP>[:<port>], can be overruled per station	DEAD_TIME (s without data → reconnect, default 30), REPEAT_CONNECTION_DELAY (default 30 s), recover script, source address, splitter, switch time, carrier on/off delay for radios
DUR	[<node>:]<process> (other CI Server processes)	timeout rounded to seconds, default 3000 ms
UDP	<IP>[:<port>]	—

Common to all: HEART_BEAT (manager cycle, ms; must be ≤ fastest scan; ~100 ms typical), PERIODIC_TIME (s; re-checks BURST LIM filters for event-based inputs), TIMEOUT (ms; for terminal servers include both network and serial times). Line 2 is the optional backup line.

3.2 Common station parameters

Name, description, station id (0 = assigned automatically), on scan, line, redundant line, suppress outputs, output method (On change / On change and connect), preferred line (None, Line 1, Line 2), and status items:

• STATUS_ITEM: 1 = station reachable, 0 = not (status OFFSCAN when off-scan);
• LINE_1_ITEM, LINE_2_ITEM: per line 1/0;
• SELECT_ITEM: line number in use. Typeless sub-items on these show sub-line states (Modbus over TCP/IP only; values 0–3, see C10 summary §4). Dynamic scanning (e.g. STARDOM FCX): a normal and a fast rate, fast while a tag is on an open display; may need a larger manager queue.

3.3 Standard conversion types (field value ↔ item)

Type	Field signal	Key parameters / behaviour
Digital	1 bit	INVERS, NO_ZERO (never send 0), AVE_UPD_INTERVAL + BURST_LIMIT (too many changes → status BURST LIM for limit × interval s)
Binary	integer, no scaling	BITS, HAS_SIGN, SWAP_BYTES, SWAP_WORDS
Linear	integer, scaled	ELEC_LOW/HIGH → PHYS_LOW/HIGH (extrapolated; outside electrical range → UNDERRANGED/OVERRANGED), DELTA_LIMIT (→ DELTA), AVE_UPD_INTERVAL + MAX_INSENS (adaptive change filter), bits/sign/swaps
Dual-bit	2 bits	value 0–3, status DB NONE/RIGHT/LEFT/BOTH; TMO_NONE/TMO_BOTH → DB NONE T / DB BOTH T
Unary	bit array, one bit set	value = lowest set bit (−1 if none); none/several → BAD VALUE
Float	32/64-bit float	FLOAT_TYPE Intel, Motorola, Tandem, Dec; STEP, OFFSET (item = field × step + offset); swaps
String	ASCIIZ ≤ 80 incl. \0	CHARS; longer output is truncated without \0
Linear-BCD	1–8 BCD digits	DIGITS, STEP, OFFSET, OVERFL_DET (counts roll-overs)
Time	7-byte IEC or 32-bit POSIX	TIME_ZONE (LCT, LST, GMT, relative), TIME_REPRES

Stations may force status/quality codes on top of these.

3.4 Specific conversion types

One per protocol where the standard ones do not fit: ProSafe-PLC, BSAP digital/float, TIE command, STARDOM FCX (history id, special conversions of alarm/valve/batch/calc/counter/mode status words into CI Server statuses such as HIGH, IOP+, MAN, AUT, CAS), Host-host, DNP3, VNET, AB-CIP, Fisher ROC, Hex repeater (binary/float/relay), IEC 101/103/104 output, IEC 103 analog, IEC 61850, AC-Gateway, Wireless, Bachmann, Beckhoff ADS. Details stay in the manual.

3.5 Common setup-file parameters (eqp<name>.sup)

• General: queue_size (KB; more for many dynamic tags), crit (hex criterion mask for output events, default D = first + value + status), logging_size (MB, protocol log in the list folder, 0 = off; up to twice the size used). Installed eqpmdc.sup also has start_offline = <Y|N> (not described).
• Behaviour: updown = <slave>, <line> (log station / line up-down messages), timestamp = Y (use the RTU/manager ms time stamp for alarms and event history instead of the item-table second), offline = <inputs off on loss>, <inputs on at recovery>, <outputs off on loss>, <outputs on at recovery>. Default: inputs go offline on loss and online at their next value; outputs stay online. Test system eqpmdc.sup: queue_size = 20, crit = D, updown = Y,N, timestamp = Y, offline = N,N,N,N.

3.6 Modbus master (EQPMDC)

Modbus ASCII, RTU (serial, or TCP/IP to a serial converter) or Open Modbus/TCP. Steps: line → setup file (created automatically) → stations → scan types → points.

Datasets (test system, via dssqld -f): MODBUS_LINE_DF, MODBUS_STATION_DF, MODBUS_SCAN_TYPE_DF, MODBUS_POINT_DF; the general views LINE_DF, STATION_DF, SCAN_TYPE_DF, POINT_DF list all protocols.

Station, Options tab: PROTOCOL (Ascii, RTU, Open Modbus/TCP — default), SUB_STATION_ID (Modbus unit id), ADDRESS_INCREMENT (JBUS: addresses on the wire start at 1), RECOVER_TIME (s between reconnect tries, default 10; a try can block the manager for a timeout), RECOVER_TRIES (default 2), WRITE_WAIT (ms before each write), SIGNAL_GAP (bytes of unused addresses read to merge requests, default 20), SIGNALS (max bytes per request, ≤ 240), FAR_END_CHECK, ALIVE_CHECK_METHOD (function 7 by default; 8 or 1–4), ALIVE_CHECK_REGISTER_START, SEQUENCE_CHECK (Modbus/TCP transaction ids, default on). General tab: LINE_1_DEVICE / LINE_2_DEVICE = <IP>[:<port>][;<IP2>[:<port>]], default port 502.

Scan types: name + positive interval (ms), e.g. Fast 1000, Slow 10000.

Points (IO_ADDRESS, EXTERNAL_RELATION Input / Output / Input+Output, SCAN_TYPE, CONV_TYPE):

Address	Element	Function codes	Direction
DO:<n>	coil 1–65536	1, 5	in/out
DI:<n>	input status (give 1… not 10001…)	2 (15)	in
RO:<n>[,<bit>]	holding register (1… not 40001…), bit 0–15	3, 6, 16	in/out
RI:<n>[,<bit>]	input register (1… not 30001…)	4	in
ES:<n>	exception status bit 1–8	7	in
LO:<n>[,<bit>]	Daniel 4-byte register 1–32768, bit 0–31	3, 6, 16	in/out

Bits in registers are written read-modify-write. Floats are usually Intel, swap words on, swap bytes off.

Troubleshooting: protocol error (function x, error 2) = RTU refuses part of the address range (unused addresses read because of the signal gap, or DI/DO blocks not on 8-bit boundaries: start at 1, 9, 17 …) → define the gap registers or set the gap to 0. Slow communication: gaps of up to ~15 bytes are cheaper to read than an extra request; use WRITE_WAIT if the RTU needs time after a reply. TCP/IP: ping first; switch off sequence check if the station does not support it. Protocol logging marks errors with /ERROR.

External interface (for programs): send a raw request to an RTU, force a reconnect.

3.7 Modbus slave (Windows only)

CI Server can serve third-party Modbus masters through a "mirror":

• EQPMDCMEM: universal slave memory; per station id 64K registers (input and holding registers are the same area) and 64K status bits (coils and inputs the same); starts at 0; answers function codes 1–7, 15, 16. No setup file.
• EQPMDCSLVSER: serial slave (one per port; setup file copied from eqpmdcslvser.sup, tabs General, Terminal server, Direct port, Serial line).
• EQPMDCSLVTCP: Modbus RTU over TCP slave, eqpmdcslvtcp -n <name> [-p <port>] (default 502), several connections per instance, no setup file.
• Start them from the equipment start sequence; then define a normal Modbus master line and stations in CI Server pointing at the slave's address (output method On change and connect). CI Server items then read and write the same registers the third party sees. Installed on the test system: eqpmdcmem.exe, eqpmdcslvser.exe, eqpmdcslvtcp.exe; none running. Verified 2026-09-30 with CI-Eng-Sample station CIENG_PLC: the TCP slave answered only with station protocol Open Modbus/TCP, not RTU as the manual says (ISS-024); skill equipment, task modbus-station.md. On R1.03 equipment_start.cmd runs every tls\com\eqp*start.cmd, so a separate start file is enough (see L40 summary).

3.8–3.40 Other drivers

§	Driver	Connection	Notes
3.8	MQTT	TCP/IP via a broker	CI Server is an MQTT client
3.9	ProSafe-COM (MULCOM/MODCOM)	serial or TCP/IP	extended Modbus
3.10	ProSafe-PLC	APACS API (Windows only)	time sync, SOE
3.11	STARDOM FCX	TCP/IP	FCX preparation, message interface, SOE, dynamic scanning, history buffer
3.12	VNET	Vnet/IP	needs Vnet/IP set up (not on Windows 10 test PC)
3.13	Host-Host Coupling (EQPHHC)	MDUR to another CI Core	read/write points of a remote CI Server
3.14	FA-M3	TCP/IP
3.15	MELSEC	EZSocket (TCP/IP, UDP, serial)	EZSocket must be installed
3.16	DAQSTATION	TCP/IP	DX, CX, MW100, GX/GP/GM
3.17	Beckhoff BK8100	serial / terminal server
3.18	Allen Bradley PLC5	DH+ via ControlLogix DHRIO, or DF1 serial/terminal server	BCC checksum only
3.19	Allen Bradley CIP	TCP/IP to ControlLogix Ethernet module	connected messaging
3.20	Siemens 3964R	serial
3.21	Siemens SAPI-S7	API software
3.22	Bristol Babcock BSAP	serial / terminal server	RTU preparation, external interface
3.23	Fisher ROC	serial / terminal server	FloBoss 100/407/500, ROC300/800, RegFlo
3.24	DNP3	TCP/IP or serial	authentication option
3.25	HART router	serial in, terminal server out	re-issues HART commands to a multiplexer
3.26	Hex repeater	terminal server	RTU models in hxr_model.sup
3.27	TIE 870-5	serial
3.28–3.31	IEC 60870-5-101 / 102 / 103 / 104	serial or TCP/IP (104: TCP/IP)
3.32	IEC 61850	TCP/IP	scan reads; direct write and control models
3.33–3.34	WITS level 0 slave / master (EQPWITS, EQPWITSWR)	serial / terminal server	drilling data
3.35	STX-Bachmann	Modbus to STX PLC	event buffer extension
3.36	DTS	Modbus TCP + (S)FTP WITSML	stores in history group DTS_DATA; EQPDTSDBG
3.37	AC-Gateway	ASCII subset (BK, SI, FG, FS)
3.38	Bachmann	M1COM library
3.39	Omron FINS	UDP	CIO, WR, HR, AR, DM areas
3.40	Beckhoff ADS	TwinCAT 3 router

Test system (read-only, 2026-09-30)

The author's AID project has line MODSIM_LINE (TCP/IP, manager EQPMDC, heart beat 100, timeout 3000, dead time 30) with Modbus/TCP stations MODSIM_STATION (localhost) and WRPS_PLC (host dev-ubuntu), scan type MOD_SCAN 500 ms and 69 points (e.g. RI:01 Linear 0–100); nothing listens on port 502, so both stations are down. Line LINE_MQTT uses EQPMQTT.