From 0444e72b234a1401166c7f15553872b0aa571139 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 10:46:28 +1000 Subject: [PATCH] Add data-access skill, BUS utilities task and licence run-time notes Co-Authored-By: Claude Opus 5.5 --- .claude/skills/data-access/SKILL.md | 39 ++++++ .../skills/data-access/tasks/access-checks.md | 24 ++++ .../skills/data-access/tasks/opcua-client.md | 128 ++++++++++++++++++ .claude/skills/equipment/SKILL.md | 1 + .claude/skills/system-check/SKILL.md | 6 + .claude/skills/system-management/SKILL.md | 5 +- .../system-management/tasks/bus-utilities.md | 51 +++++++ 7 files changed, 253 insertions(+), 1 deletion(-) create mode 100644 .claude/skills/data-access/SKILL.md create mode 100644 .claude/skills/data-access/tasks/access-checks.md create mode 100644 .claude/skills/data-access/tasks/opcua-client.md create mode 100644 .claude/skills/system-management/tasks/bus-utilities.md diff --git a/.claude/skills/data-access/SKILL.md b/.claude/skills/data-access/SKILL.md new file mode 100644 index 0000000..a28342d --- /dev/null +++ b/.claude/skills/data-access/SKILL.md @@ -0,0 +1,39 @@ +--- +name: data-access +description: >- + CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to + connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points, + certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC + DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints, + security policy, trusting client certificates, UaExpert), check why an OPC connection fails + (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM + tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server + (odbsrv, port 1583, SSL certificate). Sources IM 36K10L45-01EN, IM 36K10E20-01EN. +--- + +# Data access: OPC and ODBC (R1.03) + +Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server, +setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment +lines/stations/points in general: skill `equipment`. + +Rules: +- Run `system-check` first; follow the user's chosen way of working. +- **Trusting certificates is the user's decision.** Show the certificate (folder, file name, + common name) and let the user trust it (Engineering Module or moving the file); do not move + certificate files yourself. +- Making items OPC visible / writable exposes them to every OPC client on the network: only + with the user's approval, and prefer read-only. +- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected + node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine. +- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and + a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`). + +| Task | File | Status | +|---|---|---| +| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified | +| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs | +| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified | +| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) | +| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) | +| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs | diff --git a/.claude/skills/data-access/tasks/access-checks.md b/.claude/skills/data-access/tasks/access-checks.md new file mode 100644 index 0000000..0284b1a --- /dev/null +++ b/.claude/skills/data-access/tasks/access-checks.md @@ -0,0 +1,24 @@ +--- +task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server) +version: R1.03 +source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01 +status: verified +--- + +# ACCESS Service checks (read-only) + +| Check | How | Test system result | +|---|---|---| +| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running | +| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** | +| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) | +| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing | +| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on | +| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` | +| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` | +| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback | +| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `.log` | | + +Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key +with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup` +(unencrypted ODBC traffic — a security decision), then restart CI Server. diff --git a/.claude/skills/data-access/tasks/opcua-client.md b/.claude/skills/data-access/tasks/opcua-client.md new file mode 100644 index 0000000..18895c2 --- /dev/null +++ b/.claude/skills/data-access/tasks/opcua-client.md @@ -0,0 +1,128 @@ +--- +task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server) +version: R1.03 +source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared) +status: verified +--- + +# OPC UA client to an OPC UA server + +Worked example: CI-Eng-Sample station `CIENG_UA`, CI Server's OPC UA client reading +`CI-Eng-Sample.TANK1.LEVEL` back through CI Server's **own** OPC UA server +(`examples/CI-Eng-Sample/12_`–`15_*.qli`, removal `76_`–`78_`). For a real server, replace the +endpoint, security settings and node IDs. + +## 1. Server side: make the data visible + +On the CI Server OPC UA server an item is reachable only when the item has **OPC visible** and +**Read** (Write to allow writing) and every parent section is OPC visible +(`12_opc_visible_df.qli`, loaded with `dssqld -m`): + +``` +@FIELDS +NAME,OPC_VISIBLE + +@SECTION_DF +"CI-Eng-Sample",1 +"CI-Eng-Sample.TANK1",1 + +@FIELDS +NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE + +@ITEM_DF +"CI-Eng-Sample.TANK1.LEVEL",1,1,0 +``` + +Visible without Read: the item shows when browsing, but browsing into it fails +(`UncertainNotAllNodesAvailable`, client message `OPXC-E-BRW_NODE`; verified). By the manual, +Read is also what allows reading the value. +These flags also apply to the OPC DA and A&E servers. + +## 2. Client configuration (quick load, in this order) + +1. **Line** (`OPCUAC_LINE_DF`): loading it creates and starts the client process + `EQUIPMENT_MAN` (must start with `OPX`, ≤ 11 characters) — wait ~10 s before the station. + ``` + "CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG" + ``` +2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name + `:`), **points** (`OPCUAC_POINT_DF`, name `:`) — + see `14_opcua_station_df.qli`: + - Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`), + `MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`, + `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 = + connected). `SERVER_01_NAME`/`_URI` may stay empty. + - Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000. + - Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`), + `OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`, + `GUID`), `OPC_NODE_ID`. +3. **Items** (`ITEM_DF` with `STATION` and `POINT`), e.g. `CI-Eng-Sample.UA.LEVEL_COPY` → + `CIENG_UA`, `LEVEL`. + +## 3. Node IDs + +| Target | Namespace | Type | Node ID | +|---|---|---|---| +| Value of a CI Server item (by name — survives recreating the item) | `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` | STRING | `{"0":"Value","itnm":"
."}` | +| Value of a CI Server item (by namespace id) | same | STRING | `{"0":"Value","nsid":""}` | +| Server state (any OPC UA server; good connection test, 0 = Running) | `http://opcfoundation.org/UA/` | NUMERIC | `2259` | + +In a `.qli` file double the quotes inside the field: +`"{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"`. + +Pitfalls found on the test system: +- Namespace `http://www.yokogawa.com/CI_Server/` (the one the manual shows) holds only the + **types**; with it the point is silently not monitored (ISS-032). +- The Engineering Module's *Browse path* stops at the item and stores the **object** + (`{"nsid":""}`), which has no value: *Last value* stays empty, the item stays status 13. + Type the `Value` node ID by hand (ISS-033). +- `nsid` numbers change when the item is deleted and created again (e.g. sample reload). + +A point that is not accepted shows `REVISED_SAMPLING_INTERVAL` 0 in `OPCUAC_POINT_DF` and the +log line `Can't find Point [] in subscription` when changed; a monitored point gets the +revised interval (e.g. 1000). + +**Browse the server from the command line** (station connected): export `OPCUAC_TAG_DF` with +a filter; start with an empty path, then `Objects`: + +``` +@SELECT +'OPC_STATION_NAME = "CIENG_UA" and OPC_TAG_PATH = "Objects"' +@OPCUAC_TAG_DF +``` + +Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper +paths were not found yet (`Objects.CI-Eng-Sample` returned nothing). + +## 4. Certificate exchange (first connection; the user does it) + +| Step | Where it shows | What the user does | +|---|---|---| +| 1. Client rejects the server | `OPXC-E-CER_NO_TRU … BadCertificateUntrusted` in `umhlog.log`; file `.der` in `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` | Trust it: Engineering Module *OPC UA Client → Certificates → Rejected* → *Trusted*, or move the file to `…\pkiclient\trusted\certs` | +| 2. Server rejects the client | client log `BadSecurityChecksFailed`; file `CI_SERVER_OPCUA_CLIENT_ [].der` in `…\pki\opxuas\pkiserver\rejected` (folder created now) | Move it to `…\pki\opxuas\pkiserver\trusted\certs` | + +PowerShell: file names with `[ ]` need `-LiteralPath`, otherwise `Move-Item` silently does +nothing: + +```powershell +Move-Item -LiteralPath "\.der" -Destination "\" +``` + +The client retries every ~35 s (`OPXC_STATION_CON_TRY_INTERVAL` 30 s); then `OPXC-I-SRV_CONN` +and the status item goes to 1. Certificates and trust stay when the line is removed and loaded +again (verified: reload connected within 5 s without a new exchange). For an external server, +its certificate arrives the same way; the client certificate +(`…\pkiclient\own\certs\_.der`) must be trusted on that server. + +## 5. Check + +- `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9; + `UA.LEVEL_COPY` follows `TANK1.LEVEL` within ~1 s (verified 55, 62.5, 71, 33, 44.4). +- Client log: `%TLS_LOG_PATH%\.log` (`Successfully connected station`, errors with + status codes); server logs `OPXUAS.log`, `OpxUas_Sdk.log` (`CreateMonitoredItems`). +- Off-scan/on-scan: `OPCUAC_STATION_DF` `ON_SCAN` 0/1 with `dssqld -m` disconnects/reconnects. + +## 6. Remove + +Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the +client process). Reset the OPC flags only if they were not there before. diff --git a/.claude/skills/equipment/SKILL.md b/.claude/skills/equipment/SKILL.md index 7ebb4fd..d4d824d 100644 --- a/.claude/skills/equipment/SKILL.md +++ b/.claude/skills/equipment/SKILL.md @@ -31,4 +31,5 @@ Rules: | CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) | | Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified | | Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) | +| OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) | | Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) | diff --git a/.claude/skills/system-check/SKILL.md b/.claude/skills/system-check/SKILL.md index 007248c..98dddef 100644 --- a/.claude/skills/system-check/SKILL.md +++ b/.claude/skills/system-check/SKILL.md @@ -77,6 +77,12 @@ prompt. Setup files (`*.sup`) are plain text (CRLF); edit them with the Setup Fi (elevated): `Stop-Service StartCIServer` then `Start-Service StartCIServer`. Before a long task on an unlicensed system, note the start time (`(Get-Process ciserv).StartTime`) and restart first if the hour is nearly up. + Time left is in the health snapshots: `License time left : ` in + `%TLS_LOG_PATH%\smd__LOW_smdsnp_general.log` (3600 s after a start, −600 per 10 min); + `*** license problem : 3 ***` once it has run out. The count pauses while the PC sleeps + (observed 2026-10-01: a run started 17:25 ran out at 09:52 the next morning after a sleep); + some processes (e.g. `umh`) stay attached, but `dssqld`/`itmval` fail and the log shows + `ISF-F-LIC_PROB, DATABASE Service is not licensed`. ## 4. Time synchronization diff --git a/.claude/skills/system-management/SKILL.md b/.claude/skills/system-management/SKILL.md index c09ab1c..9f1df69 100644 --- a/.claude/skills/system-management/SKILL.md +++ b/.claude/skills/system-management/SKILL.md @@ -6,7 +6,9 @@ description: >- (dssqld, .qli), create sections or items in bulk, read or write item values or limits (itmval), load or import history, check database consistency (dsschk), monitor processes/CPU/disk/network, back up or migrate a system, tune or debug CI Server, or plan a system layout (standalone, separate portal, HAC, - host-to-host, enterprise) or time synchronization. Source IM 36K10J10-01EN. + host-to-host, enterprise) or time synchronization, check whether a CI Server process is + running (durwfp), stop a single process (durstp), read the message log (umhlog), or check + BUS Service queues (adaptive queues, dur.sup). Sources IM 36K10J10-01EN, IM 36K10L30-01EN. --- # System management (R1.03) @@ -31,3 +33,4 @@ Rules for every task: | Monitor CPU, disk, network, processes; run a command on an item change | `tasks/monitoring-processes.md` | verified | | Database consistency check (`dsschk`) | `tasks/consistency-check.md` | verified (check only) | | Tuning checks: limits and health snapshots | `tasks/tuning-checks.md` | verified (read-only) | +| BUS Service utilities: is a process attached (`durwfp`), stop one process (`durstp`), message tools, adaptive queues | `tasks/bus-utilities.md` | verified (`durwfp`, read-only checks); message tools fail (ISS-030) | diff --git a/.claude/skills/system-management/tasks/bus-utilities.md b/.claude/skills/system-management/tasks/bus-utilities.md new file mode 100644 index 0000000..a155b06 --- /dev/null +++ b/.claude/skills/system-management/tasks/bus-utilities.md @@ -0,0 +1,51 @@ +--- +task: BUS Service utilities - process checks, stopping single processes, message tools, adaptive queues +version: R1.03 +source: IM 36K10L30-01EN §1, §5, §6, §10, §14; checked on the test system 2026-10-01 +status: verified for durwfp and the read-only setup file checks; umhman, umhtestprog, umhmsg fail on the test system (ISS-030) +--- + +# BUS Service utilities + +Background: `knowledge/manuals/IM36K10L30-01EN.md`. + +## Is a CI Server process attached? + +`durwfp -p -t 0` → exit code **0** = attached (running), **1** = not. Without +`-t 0` it waits up to 60 s for the process to appear; `-e` waits for it to go away. Verified: +`umh`, `opcman`, `durm_1` → 0; unknown name → 1. Bash: `durwfp -p opcman -t 0; echo $?`. +DUR names are those given with `-n` (e.g. `OPXCIENG`, `EQPCIENG`, `opxuas`). + +## Stop or kill one process (only with the user's approval) + +`durstp -m -p ` sends a stop message (clean stop); `durstp -m -k -t 10 -p ` stops, +then kills after 10 s. `*` wildcards stop many processes (`-p alm\*`). Never `durstp -k -p \*` +(kills `durtim` and leaves DUR memory locked). Restart a process by hand with +` -n ` from `tls\exe` or by restarting CI Server. + +## Messages + +- Message log: `%TLS_LOG_PATH%\umhlog.log` (`--> From: () on