Add data-access skill, BUS utilities task and licence run-time notes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
parent
a2d1a7e227
commit
0444e72b23
7 changed files with 253 additions and 1 deletions
39
.claude/skills/data-access/SKILL.md
Normal file
39
.claude/skills/data-access/SKILL.md
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
---
|
||||
name: data-access
|
||||
description: >-
|
||||
CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to
|
||||
connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points,
|
||||
certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC
|
||||
DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints,
|
||||
security policy, trusting client certificates, UaExpert), check why an OPC connection fails
|
||||
(BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM
|
||||
tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server
|
||||
(odbsrv, port 1583, SSL certificate). Sources IM 36K10L45-01EN, IM 36K10E20-01EN.
|
||||
---
|
||||
|
||||
# Data access: OPC and ODBC (R1.03)
|
||||
|
||||
Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server,
|
||||
setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment
|
||||
lines/stations/points in general: skill `equipment`.
|
||||
|
||||
Rules:
|
||||
- Run `system-check` first; follow the user's chosen way of working.
|
||||
- **Trusting certificates is the user's decision.** Show the certificate (folder, file name,
|
||||
common name) and let the user trust it (Engineering Module or moving the file); do not move
|
||||
certificate files yourself.
|
||||
- Making items OPC visible / writable exposes them to every OPC client on the network: only
|
||||
with the user's approval, and prefer read-only.
|
||||
- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
|
||||
node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine.
|
||||
- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and
|
||||
a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`).
|
||||
|
||||
| Task | File | Status |
|
||||
|---|---|---|
|
||||
| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified |
|
||||
| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs |
|
||||
| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified |
|
||||
| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
|
||||
| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) |
|
||||
| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs |
|
||||
24
.claude/skills/data-access/tasks/access-checks.md
Normal file
24
.claude/skills/data-access/tasks/access-checks.md
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
---
|
||||
task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server)
|
||||
version: R1.03
|
||||
source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01
|
||||
status: verified
|
||||
---
|
||||
|
||||
# ACCESS Service checks (read-only)
|
||||
|
||||
| Check | How | Test system result |
|
||||
|---|---|---|
|
||||
| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running |
|
||||
| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** |
|
||||
| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) |
|
||||
| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing |
|
||||
| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on |
|
||||
| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` |
|
||||
| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` |
|
||||
| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback |
|
||||
| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | |
|
||||
|
||||
Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
|
||||
with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
|
||||
(unencrypted ODBC traffic — a security decision), then restart CI Server.
|
||||
128
.claude/skills/data-access/tasks/opcua-client.md
Normal file
128
.claude/skills/data-access/tasks/opcua-client.md
Normal file
|
|
@ -0,0 +1,128 @@
|
|||
---
|
||||
task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
|
||||
version: R1.03
|
||||
source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
|
||||
status: verified
|
||||
---
|
||||
|
||||
# OPC UA client to an OPC UA server
|
||||
|
||||
Worked example: CI-Eng-Sample station `CIENG_UA`, CI Server's OPC UA client reading
|
||||
`CI-Eng-Sample.TANK1.LEVEL` back through CI Server's **own** OPC UA server
|
||||
(`examples/CI-Eng-Sample/12_`–`15_*.qli`, removal `76_`–`78_`). For a real server, replace the
|
||||
endpoint, security settings and node IDs.
|
||||
|
||||
## 1. Server side: make the data visible
|
||||
|
||||
On the CI Server OPC UA server an item is reachable only when the item has **OPC visible** and
|
||||
**Read** (Write to allow writing) and every parent section is OPC visible
|
||||
(`12_opc_visible_df.qli`, loaded with `dssqld -m`):
|
||||
|
||||
```
|
||||
@FIELDS
|
||||
NAME,OPC_VISIBLE
|
||||
|
||||
@SECTION_DF
|
||||
"CI-Eng-Sample",1
|
||||
"CI-Eng-Sample.TANK1",1
|
||||
|
||||
@FIELDS
|
||||
NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE
|
||||
|
||||
@ITEM_DF
|
||||
"CI-Eng-Sample.TANK1.LEVEL",1,1,0
|
||||
```
|
||||
|
||||
Visible without Read: the item shows when browsing, but browsing into it fails
|
||||
(`UncertainNotAllNodesAvailable`, client message `OPXC-E-BRW_NODE`; verified). By the manual,
|
||||
Read is also what allows reading the value.
|
||||
These flags also apply to the OPC DA and A&E servers.
|
||||
|
||||
## 2. Client configuration (quick load, in this order)
|
||||
|
||||
1. **Line** (`OPCUAC_LINE_DF`): loading it creates and starts the client process
|
||||
`EQUIPMENT_MAN` (must start with `OPX`, ≤ 11 characters) — wait ~10 s before the station.
|
||||
```
|
||||
"CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"
|
||||
```
|
||||
2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name
|
||||
`<station>:<subscription>`), **points** (`OPCUAC_POINT_DF`, name `<station>:<point>`) —
|
||||
see `14_opcua_station_df.qli`:
|
||||
- Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`),
|
||||
`MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`,
|
||||
`SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 =
|
||||
connected). `SERVER_01_NAME`/`_URI` may stay empty.
|
||||
- Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000.
|
||||
- Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`),
|
||||
`OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`,
|
||||
`GUID`), `OPC_NODE_ID`.
|
||||
3. **Items** (`ITEM_DF` with `STATION` and `POINT`), e.g. `CI-Eng-Sample.UA.LEVEL_COPY` →
|
||||
`CIENG_UA`, `LEVEL`.
|
||||
|
||||
## 3. Node IDs
|
||||
|
||||
| Target | Namespace | Type | Node ID |
|
||||
|---|---|---|---|
|
||||
| Value of a CI Server item (by name — survives recreating the item) | `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` | STRING | `{"0":"Value","itnm":"<Section>.<Tag>"}` |
|
||||
| Value of a CI Server item (by namespace id) | same | STRING | `{"0":"Value","nsid":"<n>"}` |
|
||||
| Server state (any OPC UA server; good connection test, 0 = Running) | `http://opcfoundation.org/UA/` | NUMERIC | `2259` |
|
||||
|
||||
In a `.qli` file double the quotes inside the field:
|
||||
`"{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"`.
|
||||
|
||||
Pitfalls found on the test system:
|
||||
- Namespace `http://www.yokogawa.com/CI_Server/` (the one the manual shows) holds only the
|
||||
**types**; with it the point is silently not monitored (ISS-032).
|
||||
- The Engineering Module's *Browse path* stops at the item and stores the **object**
|
||||
(`{"nsid":"<n>"}`), which has no value: *Last value* stays empty, the item stays status 13.
|
||||
Type the `Value` node ID by hand (ISS-033).
|
||||
- `nsid` numbers change when the item is deleted and created again (e.g. sample reload).
|
||||
|
||||
A point that is not accepted shows `REVISED_SAMPLING_INTERVAL` 0 in `OPCUAC_POINT_DF` and the
|
||||
log line `Can't find Point [<point>] in subscription` when changed; a monitored point gets the
|
||||
revised interval (e.g. 1000).
|
||||
|
||||
**Browse the server from the command line** (station connected): export `OPCUAC_TAG_DF` with
|
||||
a filter; start with an empty path, then `Objects`:
|
||||
|
||||
```
|
||||
@SELECT
|
||||
'OPC_STATION_NAME = "CIENG_UA" and OPC_TAG_PATH = "Objects"'
|
||||
@OPCUAC_TAG_DF
|
||||
```
|
||||
|
||||
Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper
|
||||
paths were not found yet (`Objects.CI-Eng-Sample` returned nothing).
|
||||
|
||||
## 4. Certificate exchange (first connection; the user does it)
|
||||
|
||||
| Step | Where it shows | What the user does |
|
||||
|---|---|---|
|
||||
| 1. Client rejects the server | `OPXC-E-CER_NO_TRU … BadCertificateUntrusted` in `umhlog.log`; file `<thumbprint>.der` in `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` | Trust it: Engineering Module *OPC UA Client → Certificates → Rejected* → *Trusted*, or move the file to `…\pkiclient\trusted\certs` |
|
||||
| 2. Server rejects the client | client log `BadSecurityChecksFailed`; file `CI_SERVER_OPCUA_CLIENT_<PROCESS> [<thumbprint>].der` in `…\pki\opxuas\pkiserver\rejected` (folder created now) | Move it to `…\pki\opxuas\pkiserver\trusted\certs` |
|
||||
|
||||
PowerShell: file names with `[ ]` need `-LiteralPath`, otherwise `Move-Item` silently does
|
||||
nothing:
|
||||
|
||||
```powershell
|
||||
Move-Item -LiteralPath "<rejected folder>\<file>.der" -Destination "<trusted folder>\"
|
||||
```
|
||||
|
||||
The client retries every ~35 s (`OPXC_STATION_CON_TRY_INTERVAL` 30 s); then `OPXC-I-SRV_CONN`
|
||||
and the status item goes to 1. Certificates and trust stay when the line is removed and loaded
|
||||
again (verified: reload connected within 5 s without a new exchange). For an external server,
|
||||
its certificate arrives the same way; the client certificate
|
||||
(`…\pkiclient\own\certs\<host>_<PROCESS>.der`) must be trusted on that server.
|
||||
|
||||
## 5. Check
|
||||
|
||||
- `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9;
|
||||
`UA.LEVEL_COPY` follows `TANK1.LEVEL` within ~1 s (verified 55, 62.5, 71, 33, 44.4).
|
||||
- Client log: `%TLS_LOG_PATH%\<PROCESS>.log` (`Successfully connected station`, errors with
|
||||
status codes); server logs `OPXUAS.log`, `OpxUas_Sdk.log` (`CreateMonitoredItems`).
|
||||
- Off-scan/on-scan: `OPCUAC_STATION_DF` `ON_SCAN` 0/1 with `dssqld -m` disconnects/reconnects.
|
||||
|
||||
## 6. Remove
|
||||
|
||||
Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the
|
||||
client process). Reset the OPC flags only if they were not there before.
|
||||
|
|
@ -31,4 +31,5 @@ Rules:
|
|||
| CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) |
|
||||
| Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified |
|
||||
| Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
|
||||
| OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) |
|
||||
| Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |
|
||||
|
|
|
|||
|
|
@ -77,6 +77,12 @@ prompt. Setup files (`*.sup`) are plain text (CRLF); edit them with the Setup Fi
|
|||
(elevated): `Stop-Service StartCIServer` then `Start-Service StartCIServer`. Before a long
|
||||
task on an unlicensed system, note the start time (`(Get-Process ciserv).StartTime`) and
|
||||
restart first if the hour is nearly up.
|
||||
Time left is in the health snapshots: `License time left : <s>` in
|
||||
`%TLS_LOG_PATH%\smd_<node>_LOW_smdsnp_general.log` (3600 s after a start, −600 per 10 min);
|
||||
`*** license problem : 3 ***` once it has run out. The count pauses while the PC sleeps
|
||||
(observed 2026-10-01: a run started 17:25 ran out at 09:52 the next morning after a sleep);
|
||||
some processes (e.g. `umh`) stay attached, but `dssqld`/`itmval` fail and the log shows
|
||||
`ISF-F-LIC_PROB, DATABASE Service is not licensed`.
|
||||
|
||||
## 4. Time synchronization
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,9 @@ description: >-
|
|||
(dssqld, .qli), create sections or items in bulk, read or write item values or limits (itmval), load or import history,
|
||||
check database consistency (dsschk), monitor processes/CPU/disk/network, back up or migrate
|
||||
a system, tune or debug CI Server, or plan a system layout (standalone, separate portal, HAC,
|
||||
host-to-host, enterprise) or time synchronization. Source IM 36K10J10-01EN.
|
||||
host-to-host, enterprise) or time synchronization, check whether a CI Server process is
|
||||
running (durwfp), stop a single process (durstp), read the message log (umhlog), or check
|
||||
BUS Service queues (adaptive queues, dur.sup). Sources IM 36K10J10-01EN, IM 36K10L30-01EN.
|
||||
---
|
||||
|
||||
# System management (R1.03)
|
||||
|
|
@ -31,3 +33,4 @@ Rules for every task:
|
|||
| Monitor CPU, disk, network, processes; run a command on an item change | `tasks/monitoring-processes.md` | verified |
|
||||
| Database consistency check (`dsschk`) | `tasks/consistency-check.md` | verified (check only) |
|
||||
| Tuning checks: limits and health snapshots | `tasks/tuning-checks.md` | verified (read-only) |
|
||||
| BUS Service utilities: is a process attached (`durwfp`), stop one process (`durstp`), message tools, adaptive queues | `tasks/bus-utilities.md` | verified (`durwfp`, read-only checks); message tools fail (ISS-030) |
|
||||
|
|
|
|||
51
.claude/skills/system-management/tasks/bus-utilities.md
Normal file
51
.claude/skills/system-management/tasks/bus-utilities.md
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
---
|
||||
task: BUS Service utilities - process checks, stopping single processes, message tools, adaptive queues
|
||||
version: R1.03
|
||||
source: IM 36K10L30-01EN §1, §5, §6, §10, §14; checked on the test system 2026-10-01
|
||||
status: verified for durwfp and the read-only setup file checks; umhman, umhtestprog, umhmsg fail on the test system (ISS-030)
|
||||
---
|
||||
|
||||
# BUS Service utilities
|
||||
|
||||
Background: `knowledge/manuals/IM36K10L30-01EN.md`.
|
||||
|
||||
## Is a CI Server process attached?
|
||||
|
||||
`durwfp -p <DUR name> -t 0` → exit code **0** = attached (running), **1** = not. Without
|
||||
`-t 0` it waits up to 60 s for the process to appear; `-e` waits for it to go away. Verified:
|
||||
`umh`, `opcman`, `durm_1` → 0; unknown name → 1. Bash: `durwfp -p opcman -t 0; echo $?`.
|
||||
DUR names are those given with `-n` (e.g. `OPXCIENG`, `EQPCIENG`, `opxuas`).
|
||||
|
||||
## Stop or kill one process (only with the user's approval)
|
||||
|
||||
`durstp -m -p <name>` sends a stop message (clean stop); `durstp -m -k -t 10 -p <name>` stops,
|
||||
then kills after 10 s. `*` wildcards stop many processes (`-p alm\*`). Never `durstp -k -p \*`
|
||||
(kills `durtim` and leaves DUR memory locked). Restart a process by hand with
|
||||
`<exe> -n <name>` from `tls\exe` or by restarting CI Server.
|
||||
|
||||
## Messages
|
||||
|
||||
- Message log: `%TLS_LOG_PATH%\umhlog.log` (`--> From: <PROCESS> (<node>) on <time>`, then
|
||||
`FAC-S-CODE, text` lines). `UMH Message Text Error: Message number <hex> (…)` = the text
|
||||
could not be formatted (e.g. `%` in a PRINT text, ISS-025).
|
||||
- `umhman` (hex code → text), `umhtestprog` (test the log path) and `umhmsg <hex> [<var>
|
||||
<value>]` (log a message from a script) **did not work on the test system**: `umhman`
|
||||
crashes with redirected input (run it interactively), `umhtestprog` crashes, `umhmsg` stops
|
||||
with `license expired` on the unlicensed node (ISS-030).
|
||||
|
||||
## Adaptive queues (read-only check)
|
||||
|
||||
`tls\sup\dur.sup`, tab *Adaptive queues*: `ADAPTIVE_QUEUE_SETS = <process>, <percent>`
|
||||
(wildcard `*` allowed, max 40 %). Installed: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`,
|
||||
`WFLIDI`, `WFLADI`, `ITHEIX`, `ITHSER` 2, `DSSSDA*`, `DSSEVT*`, `OPCEXE` 1. Add entries for
|
||||
new busy processes (extra executors, equipment managers, custom processes); `OPCEXE` without
|
||||
`*` may not cover the installed `OPCEXE1`…`4` (ISS-026). Changing `dur.sup` needs admin and a
|
||||
restart (skill `portal-setup`). Queue use per process: health snapshots
|
||||
(`tuning-checks.md`) or the performance monitor (*Minimum/Maximum/Current KB*, high queue
|
||||
100 % = the queue had to grow → raise its size).
|
||||
|
||||
## Node links (MDUR)
|
||||
|
||||
`tls\sup\durm_<line>_udp.sup` and `tls\com\durm_start.cmd`; single-node installs still run
|
||||
`durm_1` (`durm_1_udp.sup`: line 1, quality 500, port 17001). Multi-node set-up is in the L30
|
||||
summary §2; not practiced (one node).
|
||||
Loading…
Add table
Reference in a new issue