diff --git a/knowledge/manuals/IM36K10E20-01EN.md b/knowledge/manuals/IM36K10E20-01EN.md new file mode 100644 index 0000000..217b160 --- /dev/null +++ b/knowledge/manuals/IM36K10E20-01EN.md @@ -0,0 +1,70 @@ +--- +manual: IM 36K10E20-01EN +title: OPC Interface +edition: 2nd Edition, Sep. 2023 +version: R1.03 +status: from docs; OPC UA point and certificate forms compared with quick load on the test system 2026-10-01 (user configured a point in the Engineering Module, exported and diffed) +--- + +# OPC Interface (R1.03) + +Engineering Module procedures for OPC Classic, OPC UA client and OPC UA PubSub. Concepts, +setup files and the OPC servers: `IM36K10L45-01EN.md`. Everything here is under +*Configuration → I/O processing → Equipment → (OPC DA client | OPC A&E client | OPC UA Client | +OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual. + +## 1. OPC Classic (§1) + +- DA: line (equipment node, process name — the manual says it must start with `OPC` for DA and + A&E lines, `OPX` for OPC UA), station (OPC server node and ProgID, status item), group + (deadband, requested update rate, status item), point (external relation, group, OPC tag, + browse). Then connect items to points (Tutorial "Define points"). +- A&E: line, station (server, subscription filters), subscribed attributes; to show events in + the current alarm overview, map event sources to items. External names must be unique per + station. + +## 2. OPC UA client (§2) + +Order: line → station → subscription → points (→ methods) → alarm components / event type +filters / event nodes / template settings (only when alarms are wanted; no alarms are received +until event nodes are configured). + +| Object | Key fields (dataset field) | +|---|---| +| Line | name ≤ 31, equipment node (*None* = this node), **process name starts with `OPX`, ≤ 11 characters** (`EQUIPMENT_MAN`) | +| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item*; *On scan*; *General communication status item* (`STATUS_ITEM`); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) | +| Subscription | publishing interval, lifetime and keep-alive counts, max notifications, priority, publish enabled, status item | +| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) | +| Method | namespace, node ID or browse path, process areas | + +**Observed (2026-10-01)**: browsing in the point form stops at the item itself +(`Objects/
/…/`) and stores the item **object** (`{"nsid":""}`), which has no +value: *Last value*/*Data type* stay empty and the point is never monitored (revised sampling +interval 0, item status 13). Type the node ID of the value instead: +`{"0":"Value","itnm":""}` (namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`, type +STRING). The form also fills `OPC_DISPLAY_NAME` and `OPC_TAG_INFO` (browse bookkeeping; +not needed for quick load). ISS-033. + +## 3. Certificates (§2.2) + +*OPC UA Client → Certificates*: **Trusted**, **Rejected** (server certificates arrive here), +**Own certificate**. Trust = open the rejected certificate, tick *Trusted*, Apply; reject = +untick. Restart the Engineering Module to refresh the folders. *Modify* the own certificate +(name, organisation, country, domain or IP, RSA key strength, signature algorithm, validity). + +**CI Server OPC UA client ↔ CI Server OPC UA server (§2.2.6)**: trust the server certificate +on the client; copy the client's own certificate +(`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs`) to the server's +`…\pki\opxuas\pkiserver\trusted\certs`; the manual also asks to tick *Use CI Server entity names +for nodeids* in `opxuas.sup` and restart the server. On the test system the loopback worked +**without** that option, using `itnm` node IDs (ISS-032). + +## 4. OPC UA PubSub (§3) + +UDP publish/subscribe of Data Access values from the CI Server OPC UA server address space +(OPC visible items). Objects: line (needs its own copy of `ServerConfig.xml` named for the +instance), published datasets, station, writer groups + dataset writers (publisher), reader +groups + dataset readers (subscriber), then *Upload dataset configurations to runtime*. +Limits per line: 4 stations, 8 writer groups, 8 reader groups, 32 dataset writers, 32 dataset +readers, 32 published datasets. Status mapping as for the server (NORMAL → Good; NOT_INIT, +UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE → Bad). Not practiced (needs a PubSub peer). diff --git a/knowledge/manuals/IM36K10L30-01EN.md b/knowledge/manuals/IM36K10L30-01EN.md new file mode 100644 index 0000000..691a6fd --- /dev/null +++ b/knowledge/manuals/IM36K10L30-01EN.md @@ -0,0 +1,133 @@ +--- +manual: IM 36K10L30-01EN +title: BUS Service Engineering +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs; installed tools, setup files (dur.sup, durm_1_udp.sup, time_table.sup, fmfprt.sup, durutl.sup) and durm_start.cmd checked read-only 2026-10-01; durwfp verified; umhman, umhtestprog, umhmsg fail on the test system (ISS-030) +--- + +# BUS Service Engineering (R1.03) + +BUS Service is CI Server's messaging layer ("DUR", Dynamic User Region): every CI Server +process attaches to a shared memory area and gets a **queue** (mailbox) under its DUR name; +processes talk by messages. It also does error-text management (UMH), node-to-node links +(MDUR), time handling, printer management and process control utilities. Section numbers refer +to the manual. + +## 1. Processes (§1.2) + +| Process | Role | +|---|---| +| `durini` | Initialises DUR at start, then exits | +| `durtim` | Runs every second: system time, summer/winter time, queue time-outs, checks that processes still exist (`DUR-W-REM_PROC, Process exited unexpectedly`), clock queue | +| `durprt` | Writes intercepted messages to `tls\lst\DURPRT.out` (debugging; leave running) | +| `umh` / `umhlog` | Build error texts from codes (`tls\dat\messages.umh`) and write them to the message log (`umhlog.log`) | +| Optional | `dur` (DUR display utility, interactive), `durbat` (start processes on request, also remote), `durclq` (finer clock-queue resolution: `durclq 50` = 50 ms), `durdbg`, `durutl` (logical addresses, node time sync), `durecs` (external clock), `dursim`, `durstp`, `durwfp`, `umhcr`, `umhlogtoo`, `umhman`, `umhmsg` | + +Process names: fixed (e.g. `UMH`), `PID` when none given, or set with `-n ` (most +CI Server executables, e.g. `opxuas -n opxuas`). + +## 2. Messages and nodes (§2–§4) + +- Requests are asynchronous; CI Server makes them synchronous with a *reply required* flag. The + **server** converts data between different computer architectures. +- **MDUR** (§3): one `durm_` process pair per network line (`durm_udp` + `durm_udp_slv` + on Windows), started by `tls\com\durm_start.cmd`, configured in + `tls\sup\durm__udp.sup`: `line`, `quality` (lower = preferred line), `io_timeout` + (default 8000 ms, 8 checks), `portnr` (same on all nodes of one line; > 17000 advised), + `max_snd`, `cluster`, `compress`, `connect_delay`, `max_poll_int`, `our_host_name`, + `remote_set` (up to four nodes sharing one node number = redundant set). Redundant nodes + only over TCP/IP. `durmdbg -q -f ` traces a line; always stop with `-s`. +- `dur.sup`: node number, `host_node`, `rout_type` (ENDPOINT or ROUTER for multi-node + routing), sizes (`pool_kbytes`, `dur_max_proc`). +- **Logical addresses** (§4): node −1 in an address = look up a table (`durlnm.dat`), distributed + by `durutl` from a master node listed with `lnm_node = …` in `durutl.sup`. + +**Installed (single node)**: `dur.sup` `host_node 0`, `pool_kbytes 250000`, `dur_max_proc 250`, +`rout_type 2 ENDPOINT`; `durm_1_udp.sup` `line 1`, `quality 500`, `io_timeout 8000`, +`portnr 17001`, plus keywords not in the manual: `sndportnr 17101`, `ip_adr_method IPv4`, +`ENABLE_DURMS N, 0` (host-host encryption, §13); `durm_1` is running although there is no +second node; `durutl.sup` has no active lines. + +## 3. Messages and the message log (§5, §6) + +- Codes look like `FAC-S-ACRONYM` (S = S/I/W/E/F). Text comes from `messages.umh`; dynamic + values are inserted by name; several codes can form one history entry. +- `umhlog` writes to `tls\log\umhlog.log`; `-d ` also logs centrally on another node, + `-q ` prints too. +- Tools: `umhtestprog` (tests the message path), `umhmsg [ ]…` + (issue a message from a script), `umhman` (look up a hex code, interactive), + `umhlogtoo` (copy of all messages to a terminal). **On the test system** `umhman` crashes + with redirected input, `umhtestprog` crashes, and `umhmsg` ends with "license expired" + (ISS-030). +- A message shown as `UMH Message Text Error: Message number (…)` means the text could + not be formatted (e.g. a `%` in a PRINT text, ISS-025). + +## 4. Time (§7, §8, §11) + +- `time_table.sup`: `AUTOMATIC` (installed) = BUS Service takes summer/winter times from + Windows at start (scans ±15 years); otherwise `LST_OFFSET` (minutes, **positive = west**), + `LST_NAME`, `LCT_NAME`, `CHANGE` lines; month/day abbreviations. Reload via the DUR display + utility. Installed file still has the Central European example values (−60, MET/MEST); they + are ignored while `AUTOMATIC` is set. +- Node time sync with `durutl` on the master: `tms_params = , , , + , , ` and one `tms_node = ` per slave; beyond limit3 the slave is + set at once and an error is logged. External clock (serial Wharton/Trimble/Arbiter) with + `durecs` and `durecs.sup` (`ecs_params`). On Windows normally use Windows time + (`system-check`, `w32tm`). + +## 5. Process control utilities (§10) + +| Command | Use | +|---|---| +| `durwfp -p [-t ] [-e]` | Exit 0 if the process is attached (waits up to `-t`, default 60; `-t 0` = check now); `-e` waits for it to go away. Verified: `umh`, `opcman` → 0, unknown name → 1 | +| `durstp -m -p ` | Send a stop message (clean stop). `-k` kills, `-m -k` = stop, then kill after `-t` s; `-f` kills even with the common area locked (dangerous); `*` wildcard (`-p alm\*`). Never `durstp -k -p \*` | +| `durbat` | Starts processes on request from other processes (also remote) | + +`durstp` stops CI Server processes: use only with the user's approval. + +## 6. Printer management (§12) + +`FMFPRT` (printer manager, one per node) and one `FMFP_` process per device (first 8 +characters of the device name must be unique). **Destinations** (logical, e.g. +`SCREEN_CAPTURE`, `ALARMS`, `MESSAGES`, `DEFAULT`) map to **devices** (instances of an output +type) with an optional backup device. Configured in `fmfprt.sup`; devices and destinations in +datasets `PRINTER_DEV_DF`, `PRINTER_DEST_DF`, `PRINTER_TYPE_DF`, `PRINTER_OPER_DEST_DF` +(job/device lists `PRINTER_JOB_OVV`, `PRINTER_DEV_OVV`). + +**Installed `fmfprt.sup`**: `QUEUE_LIFE 1800` s (stalled job expires), `MAX_JOBS_SHOWN 10`, +`DEVICE_POLL 5` s, `MAX_BUSY 60` polls; output types `HARDCOPY` (`fmfphc`, Windows printing, +Courier New 8 pt, 72 lines, landscape), `FILE` (`fmfpfl`, file name +`TLS_%time:DDMMYY%_%seq:03%.lst` in `tls\lst`), `APPLICATION` (`fmfpap`, program set to +Internet Explorer); fixed destinations `ALARMS`→`ALDPRT`, `AUDIT_TRAIL`→`ADTLOG`, +`MESSAGES`→`UMHLOG`, `PRINTER_1`→`RPTMAN`, `SCREEN_CAPTURE`→`CWSSHOT`. `NODE_SHARE = ` +shares printers between nodes. Logging processes do not print by default (enable per process: +`aldprt.sup LOGPRT`, `adtsys.sup PRT_DEV`, `umhlog -q`). + +The CI Service account must have the printers; `DEFAULT` uses that account's default printer. +Clean-up after a crash: stop CI Server, empty `tls\lst\printing`, delete +`tls\sav\fmf_prt_last_id.sav`, `fmfprt.sav` and `tls\dat\printer_job_ovv.*`, start. + +## 7. MDUR encryption (§13) + +Host-host encryption (AES-256, certificates) between CI Cores: every node must use it; no +enterprise configurations. Keys: `gen_key is_ca=1` once (CA key), `gen_key is_ca=0` on each +node → `%TLS_ALLUSERS_PATH%\pki\mel\dur\key`; certificates with the interactive `cert_write` +(CA certificate to `…\pki\mel\dur\crt\ca\ca.crt` on every node, node certificate to +`…\crt\own`; create the folders first; log `tls\log\cert_write_log.log`). Then tick *Enable +HostHost encryption* in each `durm_x_udp.sup` (installed keyword `ENABLE_DURMS`). Keep the CA +key off the servers. Not practiced (single node; `tls\pki\mel` does not exist yet). + +## 8. Adaptive queues (§14) + +Each process has a fixed queue (the *adaptive minimum*); for processes listed on the +*Adaptive queues* tab of `dur.sup` (`ADAPTIVE_QUEUE_SETS = , `), DUR may +grow the queue temporarily by up to that percentage of the total queue area, avoiding overflows +during bursts. Add node queues for multi-node systems and new processes (extra executors, +DSS servers, equipment managers). In the performance monitor *Minimum KB*/*Maximum KB*/*Current +KB* and a high-queue of 100 % show that a queue needed more space → raise its size. Total area +exhausted → `DUR_F_NO_SPACE`. + +**Installed**: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`/`WFLIDI`/`WFLADI`/`ITHEIX`/`ITHSER` 2, +`DSSSDA*`/`DSSEVT*`/`OPCEXE` 1 %. Note: `OPCEXE` does not match the installed executor names +`OPCEXE1`…`4` (no wildcard) — see ISS-026. diff --git a/knowledge/manuals/IM36K10L45-01EN.md b/knowledge/manuals/IM36K10L45-01EN.md new file mode 100644 index 0000000..e670704 --- /dev/null +++ b/knowledge/manuals/IM36K10L45-01EN.md @@ -0,0 +1,182 @@ +--- +manual: IM 36K10L45-01EN +title: Data Access Engineering +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs +--- + +# Data Access Engineering (R1.03) + +ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC +Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section +numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on: +skill `data-access`. + +## 1. ODBC (§1–§3) + +- Multi-tier: ODBC application + driver manager + **SimbaClient** driver on the client; + **SimbaServer** + ACCESS Service ODBC engine (`odbsrv`) on the CI Server. Read and write of + existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be + created or deleted over ODBC. Needs an ODBC licence. +- `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate + `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`), + `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data + (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on). +- Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium + (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or + `CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts. +- SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`. +- Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not + running / port mismatch / BUS Service not reachable. + +**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder +`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so +`odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx(): +SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited +unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set +`USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry +defaults once (when `%TLS_DAT_PATH%\access.new` exists). + +## 2. OPC Classic basics (§4) + +DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A +and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`). +- Quality: OPC DA quality goes to the **lower** 16 bits of the CI Server quality word, OPC A&E + quality to the **upper** 16 bits. Item to OPC: CI Server quality low byte → OPC high byte; + OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised → + NOT_CONNECTED, else GOOD. +- Types: `VT_UI1/UI2/INT/I1/I2/I4` → Integer, `VT_UI4/UINT/R4/R8` → Real, `VT_BSTR` → String, + `VT_BOOL` → Boolean. +- Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC + visible* (and every parent section visible). + +## 3. OPC DA client (§5) + +- One client process per DA line (name given in the line), started/stopped with CI Server; + stop one with `durstp -msk -t10 -p `. Uses a save file in `%TLS_SAV_PATH%` named + after the process; delete it (client stopped) if it gets inconsistent. +- Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running, + 2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group + status item: 1 active / 0 not active (items offline). +- Setup (`.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server + DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING` + (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT` + (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`, + `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8), + `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`. +- Advice: one OPC server per client process (a DCOM time-out blocks the whole process). + Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`, + `POINT_DF` of one station made in the Engineering Module. +- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS, + DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm__udp.sup`, + port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's + setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon` + node monitoring with *Set slave items offline when node unavailable*. + +## 4. OPC DA server (§6) + +- COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.`, DUR name `OPXDAS`; started by + COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown). +- Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE + pattern). *Cache read* is fast and correct; *device read* blocks — use only after queue + overflow. Timestamp = time written into the server cache. +- `opxsys.sup` *Data Access Server* tab: `OPXDAS_DUR_QSZ` (100 kB), `…_HBEAT`, `…_ITMBUF`, + `OPXDAS_USER` (log on as a CI Server user to apply its authorisation; empty = full access, + fastest), `OPXDAS_DCOM_TUN`, `OPXDAS_IGNORE_FTQ`. Installed also: `OPXDAS_SET_LOG_LEVEL` + (not described). +- Remote access needs DCOM configuration (`dcomcnfg`: authentication Connect, impersonation + Identify, access/launch permissions for an OPC account; identity of the server = that account), + `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for + `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT + Security Tool is applied. Same account/password on both sides in a workgroup. +- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`, + `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic), + `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first. + +## 5. OPC A&E client and server (§7, §8) + +- Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `.sup` or `opxsys.sup` + (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`, + `…_TRACE`); maps condition events to items; one server per client advised. +- Server `opxaes`, ProgID `Yokogawa.CIOpcAes.`, DUR name `OPXAES`; publishes items + with alarm monitoring as conditions; `OPXAES_ACK_ALLOWED` (acknowledge from clients), + `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the + CI Server-specific event attributes (old/new value, quality, status, alarm state, item + description, units, node, group, number, sub-number). Installed: all on. + +## 6. OPC UA client (§9) + +- OPC UA TCP only; security by X.509 certificates (application authentication), user + anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256, + Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not). +- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in + Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good, + 1 bad, 2 uncertain. +- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other + events INFORMATIONAL; filters by event type, component, event node; severity → priority + table (901–1000 → 1 … 1–100 → 15), per station; don't manage + NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled. +- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold + backup with two endpoints (*Active server item* 0/1/2). +- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11 + characters), station (= session), subscription, point (= monitored item), alarm component / + event type filter / event node / template settings, method. +- Certificates: the client process creates `_.der` in + `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset + `OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be + trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`, + `rejected` added by CI Server. The server must trust the client's certificate too. +- Setup (`.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats, + buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed + retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and + session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\.log`. +- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` + (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server + (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`). +- Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`. + +## 7. OPC UA server (§10) + +- Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p + opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log` + and `OpxUas_Sdk*.log`. +- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read + values, browse into the item) and **Write** (write values, alarm methods). Parent sections must + be visible. Without Read the item is listed but browsing into it fails + (`UncertainNotAllNodesAvailable`). +- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ` + (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods). +- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`, + `…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`, + `Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in + `http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections, + items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing; + the manual does not name it, ISS-032). +- NodeIds are JSON strings: `{"nsid":""}` for the entity, + `{"0":"Value","nsid":""}` for its value; or by name: `{"0":"Value","itnm":""}` + (case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`. + `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs. +- Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH → + BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority → + severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03). +- History: items in a history group show HistoryRead; max 5000 values per node per call. +- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal); + external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM. +- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab + (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`, + `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`, + `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` = + ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE` + (manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034). +- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list + `…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first + rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256, + Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint); + anonymous, user/password **and certificate** user tokens enabled (manual: certificate off, + ISS-034); `AutomaticallyTrustAllClientCertificates` false. +- First connection of any client: trust the server certificate on the client, then move the + client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the + suggested test client. +- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate + management (concepts only). diff --git a/knowledge/manuals/IM36K10L55-01EN.md b/knowledge/manuals/IM36K10L55-01EN.md new file mode 100644 index 0000000..ff2968d --- /dev/null +++ b/knowledge/manuals/IM36K10L55-01EN.md @@ -0,0 +1,51 @@ +--- +manual: IM 36K10L55-01EN +title: Exchange Tool Engineering +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs only (needs CENTUM VP / an RGS node or CCC Prodigy data; not available on the test system) +--- + +# Exchange Tool Engineering (R1.03) + +Two tools convert another system's engineering data into CI Server engineering data +(a "publication" = generated quick load files plus `load.cmd`). Section numbers refer to the +manual; Appendix 1 lists the supported CENTUM VP function blocks. + +## 1. CI Exchange for CENTUM VP (§2) + +- Runs on an **RGS** (Remote Gateway Station: CI Server PC with a Vnet/IP card and driver from + the medium, `VirtualProduct_CIServer_packageRxxx.zip`, option *installVirtProd*) that talks + to CENTUM VP. *Single server*: the RGS is also the CI Core. *Non-single*: an upper CI Core + gets the data from the RGS (MDUR). +- Solutions: **RGS** (manual or automatic mode; automatic = the tool is embedded in the RGS, + ENG HIS equalisation enabled, the RGS registered in the CENTUM VP project; publications + generated after each CENTUM VP download) and **RGS with EAL** (external alarms; manual mode + only). +- Manual workflow: start the tool → create a project (*Single Server* ticked or not) → import + CENTUM VP engineering data from the ENG HIS (and MTL file) → *Publish* (name pattern, folder, + optional SQL tag filter such as `%PVI%`) → copy the publication folder to + `C:\Program Files (x86)\Yokogawa\CIServer\Utility` → run its `load.cmd` on the RGS and/or CI + Core (in an IT-security environment run `cmd.exe` *as different user* first). Automatic + publications land in `%TLS_ALLUSERS_PATH%\lst\rgs\pub\`. +- Output: items `
..` (e.g. `
.FIC001.PV`), points + `:[]`, plus lines/stations, displays and symbols (displays only on the CI + Core in non-single configurations). +- Precautions (§2.15): refresh open LIST displays after a CENTUM VP online download; CI Server + does not allow alarm limits on the wrong side of SV; short data gaps after Vnet scan changes + or RDC switch-over; trends may lag after large downloads — reload displays, roll over the + history group, tune scan types. +- Installed: launcher `%TLS_ROOT_PATH%\tls\com\jwuiutl_ciexchange.cmd` (no RGS on the test + system). + +## 2. CI Exchange for Prodigy (§3) + +- For CCC Prodigy turbo-machinery controllers (antisurge, performance, speed). Input: the + Modbus register list (`.csv`, from MakerPro) per controller; the station name and IP are + entered in the tool. +- Install: copy `Windows\EngineeringTools\CIExchange_Prodigy.zip` from the medium, extract to + `C:\Program Files (x86)\Yokogawa\CIServer\Utility` (create the folder), run + `CIExchange_Prodigy.cmd`. +- Workflow: create project → import source configuration → generate publication → load it. + Output: items `
.`, Modbus points `:[]`, and + faceplates (title and engineering unit can be customised, §3.12.1).