cliu
b85a65250c
Read-only re-check on the shared R1.05 test server plus a diff of the R1.03 and R1.05 manual editions. - installation-security: R1.05 OS list, Defender exceptions, IT security 2.0/3.0, LAPS, automatic configuration merge (jupgutl), PRM chapter, port 34597; setup_check.ps1 gets -Version (default 1.05.00). - data-access: L45 renumbered (new ch. 4 RESTful API), extended OPC UA functions off by default, OPC UA methods (OPCUAC_METHOD_CALL2_DF), Information Model Mapper, ServerConfig.xml in %TLS_SAV_PATH%. - equipment: Modbus unchanged; IEC 104/61850 run as EQT managers (eqtdbg, eqtfrcscn), IEC 61850 report control blocks, upgrade steps. - Issues ISS-076..090; R1.05 notes on ISS-003/008/032/034/061; progress and version-differences updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
241 lines
16 KiB
Markdown
241 lines
16 KiB
Markdown
---
|
||
manual: IM 36K10L41-01EN
|
||
title: EQUIPMENT Service Engineering - Configuration
|
||
edition: 5th Edition, Feb. 2026 (R1.05); first written from the 3rd Edition, Sep. 2023 (R1.03). Changed since: R1.04 §3.4.5/3.4.7/3.4.8, 3.12.2, 3.15, 3.32, 3.40, App. 1 new; R1.05 §3.32, App. 1.3, App. 1.4 new
|
||
version: R1.05 (first written for R1.03)
|
||
status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the R1.03 test system (2026-09-30); R1.05 changes added from the 5th Edition and checked read-only on the R1.05 test server (2026-10-08): Modbus datasets and setup files identical to R1.03
|
||
---
|
||
|
||
# EQUIPMENT Service Engineering - Configuration (R1.05)
|
||
|
||
How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
|
||
points and conversion types, then one chapter per protocol. Section numbers refer to the
|
||
manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.
|
||
|
||
## 1–2. Architecture
|
||
|
||
- Needs BUS, DATABASE and ITEM Services running; USER Service to define stations, items and
|
||
scan types.
|
||
- One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
|
||
master), its setup file, shared libraries and datasets for line, station, scan type and point.
|
||
- **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
|
||
an equipment manager instance. The name is free but must start with `eqp`; for IEC 60870-5-104 and IEC 61850 (R1.04
|
||
and later) it starts with `eqt` (defaults `EQT104`, `EQT850`; §3.32.1, App. 1.3; for 104 the
|
||
manual still says `eqp104`, ISS-076).
|
||
- Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
|
||
(lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
|
||
the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
|
||
`eqpmdc_item.sav` plus `.d01`/`.k01` files.)
|
||
|
||
## 3.1 Line types
|
||
|
||
| Type | Addresses | Main parameters |
|
||
|---|---|---|
|
||
| Serial | `LINE_1_DEVICE` / `LINE_2_DEVICE` = `com1:` (`\\.\com10` from COM10) | baud rate, 7/8 bits, parity, stop bits, XON |
|
||
| TCP/IP | `<IP>[:<port>]`, can be overruled per station | `DEAD_TIME` (s without data → reconnect, default 30), `REPEAT_CONNECTION_DELAY` (default 30 s), recover script, source address, splitter, switch time, carrier on/off delay for radios |
|
||
| DUR | `[<node>:]<process>` (other CI Server processes) | timeout rounded to seconds, default 3000 ms |
|
||
| UDP | `<IP>[:<port>]` | — |
|
||
|
||
Common to all: `HEART_BEAT` (manager cycle, ms; must be ≤ fastest scan; ~100 ms typical),
|
||
`PERIODIC_TIME` (s; re-checks BURST LIM filters for event-based inputs), `TIMEOUT` (ms; for
|
||
terminal servers include both network and serial times). Line 2 is the optional backup line.
|
||
|
||
## 3.2 Common station parameters
|
||
|
||
Name, description, station id (0 = assigned automatically), on scan, line, redundant line,
|
||
suppress outputs, output method (*On change* / *On change and connect*), preferred line
|
||
(None, Line 1, Line 2), and status items:
|
||
- `STATUS_ITEM`: 1 = station reachable, 0 = not (status OFFSCAN when off-scan);
|
||
- `LINE_1_ITEM`, `LINE_2_ITEM`: per line 1/0;
|
||
- `SELECT_ITEM`: line number in use.
|
||
Typeless sub-items on these show sub-line states (Modbus over TCP/IP only; values 0–3, see
|
||
C10 summary §4). **Dynamic scanning** (e.g. STARDOM FCX): a normal and a fast rate, fast
|
||
while a tag is on an open display; may need a larger manager queue.
|
||
|
||
## 3.3 Standard conversion types (field value ↔ item)
|
||
|
||
| Type | Field signal | Key parameters / behaviour |
|
||
|---|---|---|
|
||
| Digital | 1 bit | `INVERS`, `NO_ZERO` (never send 0), `AVE_UPD_INTERVAL` + `BURST_LIMIT` (too many changes → status BURST LIM for limit × interval s) |
|
||
| Binary | integer, no scaling | `BITS`, `HAS_SIGN`, `SWAP_BYTES`, `SWAP_WORDS` |
|
||
| Linear | integer, scaled | `ELEC_LOW/HIGH` → `PHYS_LOW/HIGH` (extrapolated; outside electrical range → UNDERRANGED/OVERRANGED), `DELTA_LIMIT` (→ DELTA), `AVE_UPD_INTERVAL` + `MAX_INSENS` (adaptive change filter), bits/sign/swaps |
|
||
| Dual-bit | 2 bits | value 0–3, status DB NONE/RIGHT/LEFT/BOTH; `TMO_NONE`/`TMO_BOTH` → DB NONE T / DB BOTH T |
|
||
| Unary | bit array, one bit set | value = lowest set bit (−1 if none); none/several → BAD VALUE |
|
||
| Float | 32/64-bit float | `FLOAT_TYPE` Intel, Motorola, Tandem, Dec; `STEP`, `OFFSET` (item = field × step + offset); swaps |
|
||
| String | ASCIIZ ≤ 80 incl. `\0` | `CHARS`; longer output is truncated without `\0` |
|
||
| Linear-BCD | 1–8 BCD digits | `DIGITS`, `STEP`, `OFFSET`, `OVERFL_DET` (counts roll-overs) |
|
||
| Time | 7-byte IEC or 32-bit POSIX | `TIME_ZONE` (LCT, LST, GMT, relative), `TIME_REPRES` |
|
||
|
||
Stations may force status/quality codes on top of these.
|
||
|
||
## 3.4 Specific conversion types
|
||
|
||
One per protocol where the standard ones do not fit: ProSafe-PLC, BSAP digital/float, TIE
|
||
command, STARDOM FCX (history id, special conversions of alarm/valve/batch/calc/counter/mode
|
||
status words into CI Server statuses such as HIGH, IOP+, MAN, AUT, CAS), Host-host, DNP3,
|
||
VNET, AB-CIP, Fisher ROC, Hex repeater (binary/float/relay), IEC 101/103/104 output, IEC 103
|
||
analog, IEC 61850, AC-Gateway, Wireless, Bachmann, Beckhoff ADS. Details stay in the manual.
|
||
|
||
## 3.5 Common setup-file parameters (`eqp<name>.sup`)
|
||
|
||
- *General*: `queue_size` (KB; more for many dynamic tags), `crit` (hex criterion mask for
|
||
output events, default `D` = first + value + status), `logging_size` (MB, protocol log in
|
||
the list folder, 0 = off; up to twice the size used). Installed `eqpmdc.sup` also has
|
||
`start_offline = <Y|N>` (not described).
|
||
- *Behaviour*: `updown = <slave>, <line>` (log station / line up-down messages),
|
||
`timestamp = Y` (use the RTU/manager ms time stamp for alarms and event history instead of
|
||
the item-table second), `offline = <inputs off on loss>, <inputs on at recovery>, <outputs
|
||
off on loss>, <outputs on at recovery>`. Default: inputs go offline on loss and online at
|
||
their next value; outputs stay online.
|
||
Test system `eqpmdc.sup`: `queue_size = 20`, `crit = D`, `updown = Y,N`, `timestamp = Y`,
|
||
`offline = N,N,N,N`.
|
||
|
||
## 3.6 Modbus master (`EQPMDC`)
|
||
|
||
Modbus ASCII, RTU (serial, or TCP/IP to a serial converter) or Open Modbus/TCP.
|
||
Steps: line → setup file (created automatically) → stations → scan types → points.
|
||
|
||
Datasets (test system, via `dssqld -f`): `MODBUS_LINE_DF`, `MODBUS_STATION_DF`,
|
||
`MODBUS_SCAN_TYPE_DF`, `MODBUS_POINT_DF`; the general views `LINE_DF`, `STATION_DF`,
|
||
`SCAN_TYPE_DF`, `POINT_DF` list all protocols.
|
||
|
||
**Station, Options tab**: `PROTOCOL` (Ascii, RTU, Open Modbus/TCP — default), `SUB_STATION_ID`
|
||
(Modbus unit id), `ADDRESS_INCREMENT` (JBUS: addresses on the wire start at 1),
|
||
`RECOVER_TIME` (s between reconnect tries, default 10; a try can block the manager for a
|
||
timeout), `RECOVER_TRIES` (default 2), `WRITE_WAIT` (ms before each write), `SIGNAL_GAP`
|
||
(bytes of unused addresses read to merge requests, default 20), `SIGNALS` (max bytes per
|
||
request, ≤ 240), `FAR_END_CHECK`, `ALIVE_CHECK_METHOD` (function 7 by default; 8 or 1–4),
|
||
`ALIVE_CHECK_REGISTER_START`, `SEQUENCE_CHECK` (Modbus/TCP transaction ids, default on).
|
||
General tab: `LINE_1_DEVICE` / `LINE_2_DEVICE` = `<IP>[:<port>][;<IP2>[:<port>]]`, default
|
||
port 502.
|
||
|
||
**Scan types**: name + positive interval (ms), e.g. Fast 1000, Slow 10000.
|
||
|
||
**Points** (`IO_ADDRESS`, `EXTERNAL_RELATION` Input / Output / Input+Output, `SCAN_TYPE`,
|
||
`CONV_TYPE`):
|
||
|
||
| Address | Element | Function codes | Direction |
|
||
|---|---|---|---|
|
||
| `DO:<n>` | coil 1–65536 | 1, 5 | in/out |
|
||
| `DI:<n>` | input status (give 1… not 10001…) | 2 (15) | in |
|
||
| `RO:<n>[,<bit>]` | holding register (1… not 40001…), bit 0–15 | 3, 6, 16 | in/out |
|
||
| `RI:<n>[,<bit>]` | input register (1… not 30001…) | 4 | in |
|
||
| `ES:<n>` | exception status bit 1–8 | 7 | in |
|
||
| `LO:<n>[,<bit>]` | Daniel 4-byte register 1–32768, bit 0–31 | 3, 6, 16 | in/out |
|
||
|
||
Bits in registers are written read-modify-write. Floats are usually Intel, swap words on,
|
||
swap bytes off.
|
||
|
||
**Troubleshooting**: *protocol error (function x, error 2)* = RTU refuses part of the address
|
||
range (unused addresses read because of the signal gap, or DI/DO blocks not on 8-bit
|
||
boundaries: start at 1, 9, 17 …) → define the gap registers or set the gap to 0. Slow
|
||
communication: gaps of up to ~15 bytes are cheaper to read than an extra request; use
|
||
`WRITE_WAIT` if the RTU needs time after a reply. TCP/IP: ping first; switch off sequence
|
||
check if the station does not support it. Protocol logging marks errors with `/ERROR`.
|
||
|
||
External interface (for programs): send a raw request to an RTU, force a reconnect.
|
||
|
||
## 3.7 Modbus slave (Windows only)
|
||
|
||
CI Server can serve third-party Modbus masters through a "mirror":
|
||
- `EQPMDCMEM`: universal slave memory; per station id 64K registers (input and holding
|
||
registers are the same area) and 64K status bits (coils and inputs the same); starts at 0;
|
||
answers function codes 1–7, 15, 16. No setup file.
|
||
- `EQPMDCSLVSER`: serial slave (one per port; setup file copied from `eqpmdcslvser.sup`,
|
||
tabs General, Terminal server, Direct port, Serial line).
|
||
- `EQPMDCSLVTCP`: Modbus RTU over TCP slave, `eqpmdcslvtcp -n <name> [-p <port>]`
|
||
(default 502), several connections per instance, no setup file.
|
||
- Start them from the equipment start sequence; then define a normal **Modbus master line
|
||
and stations in CI Server pointing at the slave's address** (output method *On change and
|
||
connect*). CI Server items then read and write the same registers the third party sees.
|
||
Installed on the test system: `eqpmdcmem.exe`, `eqpmdcslvser.exe`, `eqpmdcslvtcp.exe`; none
|
||
running. **Verified** 2026-09-30 with CI-Eng-Sample station `CIENG_PLC`: the TCP slave answered only with
|
||
station protocol **Open Modbus/TCP**, not RTU as the manual says (ISS-024); skill `equipment`, task
|
||
`modbus-station.md`. On R1.03 `equipment_start.cmd` runs every `tls\com\eqp*start.cmd`, so a separate
|
||
start file is enough (see L40 summary).
|
||
|
||
## 3.8–3.40 Other drivers
|
||
|
||
| § | Driver | Connection | Notes |
|
||
|---|---|---|---|
|
||
| 3.8 | MQTT | TCP/IP via a broker | CI Server is an MQTT client |
|
||
| 3.9 | ProSafe-COM (MULCOM/MODCOM) | serial or TCP/IP | extended Modbus |
|
||
| 3.10 | ProSafe-PLC | APACS API (Windows only) | time sync, SOE |
|
||
| 3.11 | STARDOM FCX | TCP/IP | FCX preparation, message interface, SOE, dynamic scanning, history buffer |
|
||
| 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
|
||
| 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
|
||
| 3.14 | FA-M3 | TCP/IP | |
|
||
| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed: installer on the install media (`\Windows\EZSocketPcRedistributableInstaller`), run as administrator; fails if CI Server is not in the default location or its path has spaces (R1.04) |
|
||
| 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
|
||
| 3.17 | Beckhoff BK8100 | serial / terminal server | |
|
||
| 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
|
||
| 3.19 | Allen Bradley CIP | TCP/IP to ControlLogix Ethernet module | connected messaging |
|
||
| 3.20 | Siemens 3964R | serial | |
|
||
| 3.21 | Siemens SAPI-S7 | API software | |
|
||
| 3.22 | Bristol Babcock BSAP | serial / terminal server | RTU preparation, external interface |
|
||
| 3.23 | Fisher ROC | serial / terminal server | FloBoss 100/407/500, ROC300/800, RegFlo |
|
||
| 3.24 | DNP3 | TCP/IP or serial | authentication option |
|
||
| 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
|
||
| 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
|
||
| 3.27 | TIE 870-5 | serial | |
|
||
| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | 104 on R1.04+: manager `EQT104`, template `eta104_eqt.sup` with an undocumented `quality_code_parsing` switch (ISS-076, ISS-077) |
|
||
| 3.32 | IEC 61850 | TCP/IP | manager `EQT850` on R1.04+: polling or IEC 61850 reports, report control blocks; see below |
|
||
| 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
|
||
| 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
|
||
| 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
|
||
| 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
|
||
| 3.38 | Bachmann | M1COM library | |
|
||
| 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
|
||
| 3.40 | Beckhoff ADS | TwinCAT 3 router | TwinCAT 3 Build 4024 or later (R1.04; was 3.1.4022.2) |
|
||
|
||
### 3.32 IEC 61850 on R1.04 and later
|
||
|
||
From docs (5th Edition §3.32) unless marked; installed files checked on the R1.05 test server
|
||
(2026-10-08).
|
||
- **Order:** line, setup file, stations, I/O points, then report control blocks. Give the IED
|
||
engineer the client file `tls\sup\eqt850.icd` once per project (installed on R1.05). The
|
||
manual names the client `EQP850` in one place and `EQT850` elsewhere (ISS-079).
|
||
- **Station:** `DOMAIN_PREFIX` = logical-device name put in front of every I/O address (no
|
||
"/"); default port 102. The old station field `REPORTS` is hidden on R1.05; on upgrade its
|
||
content becomes report control blocks `RCB10`…`RCB50`.
|
||
- **Points:** `IO_ADDRESS`, `TIMESTAMP_ADDRESS`, `QUALITY_ADDRESS` up to 139 characters
|
||
(field length 140 on R1.05, 130 on R1.03). No prefix = polled; prefix `R:` = taken from a
|
||
received report. All three addresses of a point must be in the same report data set, and
|
||
`R:` addresses must be unique. Arrays as `[n]`, n 0–9999. Scan types Slow / Medium / Fast /
|
||
Event; `DATA_TYPE` default Automatic.
|
||
- **Quality:** bits 0–12 carry the IEC 61850 quality. With a control model, bits 13–31 of the
|
||
item quality report Select / Operate / Cancel, `stSeld`, AddCause and command termination
|
||
(timeout `operTimeout`, default 60000 ms). A failed write to a report-sourced item sets BAD
|
||
VALUE and sends a general interrogation to all report control blocks of the station.
|
||
- **Report control blocks, dataset `IEC61850_RCB_DF`** (new; fields checked on R1.05): `NAME`
|
||
= `<station>:<rcb name>`, `STATION`, `RCB_NAME`, `DESCRIPTION`, `RCB_IO_ADDRESS` (required),
|
||
`STANBY_RCB_BLOCKS`, `STANBY_RCB_IO_ADDRESS` (spelled this way), `CONNECTION_TIMEOUT` (default
|
||
5000 ms), `IS_DYN_SETTABLE_OPTFLDS` (default 1; set optional fields dynamically only when the
|
||
IED's SCL file allows it). Trigger options dchg, qchg, dupd, integrity, GI; `RptID` unique per
|
||
block; the EntryID lets the client resume after a reconnect.
|
||
- **Setup file `eqt850.sup`** (template `eta850_eqt.sup`, checked on R1.05): `crit` default
|
||
`8D` (adds the quality criterion); new switch `select_oper_internal = Y|N` (default N; Y
|
||
keeps the R1.03 behaviour of an internal Select).
|
||
|
||
## Appendix 1: upgrade precautions (R1.04 and later)
|
||
|
||
From docs (5th Edition App. 1.1–1.4).
|
||
- **From R1.03 with IEC 61850 configured:** the line's process name changes automatically from
|
||
`EQP…` to `EQT…`, but the instance setup file is not renamed: rename `eqp850.sup` to
|
||
`eqt850.sup` and merge it with the new template `eta850_eqt.sup` (old `epa850_eqp.sup`); rename
|
||
and edit `tls\com\eqp850_start.cmd` / `_stop.cmd` to `eqt850_*` with `eqt850.exe` / `EQT850`.
|
||
This can be done by hand or with `%TLS_ROOT_PATH%\tls\com\jupgutl` (log in
|
||
`%TLS_LOG_PATH%\jmrg\`); it is not needed when *Automatic upgrade CI Server configuration* was
|
||
chosen during setup.
|
||
- No precautions for R1.01→R1.02, R1.02→R1.03 or R1.04→R1.05. IEC 104 is not mentioned
|
||
(ISS-076).
|
||
- §3.4.5, 3.4.7, 3.4.8 (STARDOM FCX, VNET and CENTUM status words) were rewritten as tables of
|
||
item statuses; the mapping did not change.
|
||
|
||
## Test system (read-only, 2026-09-30)
|
||
|
||
The author's AID project has line `MODSIM_LINE` (TCP/IP, manager `EQPMDC`, heart beat 100,
|
||
timeout 3000, dead time 30) with Modbus/TCP stations `MODSIM_STATION` (localhost) and
|
||
`WRPS_PLC` (host `dev-ubuntu`), scan type `MOD_SCAN` 500 ms and 69 points (e.g. `RI:01`
|
||
Linear 0–100); nothing listens on port 502, so both stations are down. Line `LINE_MQTT` uses
|
||
`EQPMQTT`.
|