From 5e58499fe5c81b55a131292aab135040516378c7 Mon Sep 17 00:00:00 2001 From: cliu Date: Wed, 30 Sep 2026 14:09:30 +1000 Subject: [PATCH 1/3] Add phase 2 setup and security summaries, setup check script Summarize CI Server Setup and Security Guide, add the draft installation-security skill and tools/setup_check.ps1 (read-only check practiced on the test system), and log ISS-008/009. Co-Authored-By: Claude Opus 5.5 --- .claude/skills/installation-security/SKILL.md | 32 ++++ .../tasks/setup-check.md | 46 +++++ knowledge/issues.md | 2 + knowledge/manuals/IM36K01C10-01EN.md | 159 ++++++++++++++++++ knowledge/manuals/IM36K01C30-01EN.md | 114 +++++++++++++ knowledge/progress.md | 11 +- tools/README.md | 4 + tools/setup_check.ps1 | 129 ++++++++++++++ 8 files changed, 495 insertions(+), 2 deletions(-) create mode 100644 .claude/skills/installation-security/SKILL.md create mode 100644 .claude/skills/installation-security/tasks/setup-check.md create mode 100644 knowledge/manuals/IM36K01C10-01EN.md create mode 100644 knowledge/manuals/IM36K01C30-01EN.md create mode 100644 tools/setup_check.ps1 diff --git a/.claude/skills/installation-security/SKILL.md b/.claude/skills/installation-security/SKILL.md new file mode 100644 index 0000000..cf21c96 --- /dev/null +++ b/.claude/skills/installation-security/SKILL.md @@ -0,0 +1,32 @@ +--- +name: installation-security +description: >- + CI Server R1.03 installation, upgrade and Windows/IT security. Use when the user wants to + prepare Windows for CI Server, check whether a machine meets the setup requirements, install, + reinstall, upgrade or uninstall CI Server, apply or extend a licence, install CI Server Remote + Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool, check or + open firewall ports, manage the CIX_ groups and CIX_PROCESS account, or run CI Server on a + virtual machine. Sources IM 36K01C10-01EN and IM 36K01C30-01EN. +--- + +# Installation and security (R1.03) + +Background: `knowledge/manuals/IM36K01C10-01EN.md` (Setup) and +`knowledge/manuals/IM36K01C30-01EN.md` (Security Guide). Known issues: +`knowledge/manuals/IM36K01A50-01EN.md` (IT Security tool, install path, VMs). + +Rules: +- Run the `system-check` skill first. +- Installing, upgrading, changing Windows settings or IT security needs an elevated session, + changes the machine and often needs restarts: follow the user's chosen way of working and + confirm before each step. In *prepare only* mode, produce a checklist for the user. +- Never copy old setup files over new ones after an upgrade: compare and merge. + +| Task | Where | Status | +|---|---|---| +| Check a machine against the setup and security requirements | `tasks/setup-check.md` | draft, awaiting confirmation | +| New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs | +| Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs | +| Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs | +| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON ports checked) | +| IT Security Tool, user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5 | from docs | diff --git a/.claude/skills/installation-security/tasks/setup-check.md b/.claude/skills/installation-security/tasks/setup-check.md new file mode 100644 index 0000000..be4f14b --- /dev/null +++ b/.claude/skills/installation-security/tasks/setup-check.md @@ -0,0 +1,46 @@ +--- +task: Check a machine against the CI Server setup and security requirements +version: R1.03 +source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30 +status: draft, awaiting confirmation +--- + +# Setup check (read-only) + +``` +powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 +``` + +Run from the repo root, preferably elevated. Changes nothing. One line per check: +`[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision. + +## What it checks + +| Area | Checks | +|---|---| +| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service | +| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings | +| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed | +| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 | + +## Reading the result + +- `[DIFF]` on a development PC is normal; for a production server, fix each item with the + Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by + running the IT Security Tool. +- The script finds the firewall rules only as "some rule allows this port"; check the rule + scope separately for production. +- Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report + `… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines. + The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`). +- The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in + `%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default). + +## Test system result (2026-09-30) + +Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF. +Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT +Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power +plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not +disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error +(`knowledge/issues.md` ISS-008). diff --git a/knowledge/issues.md b/knowledge/issues.md index 0569406..aa2ecad 100644 --- a/knowledge/issues.md +++ b/knowledge/issues.md @@ -26,3 +26,5 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` | | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools | | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` | +| ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill | +| ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 | diff --git a/knowledge/manuals/IM36K01C10-01EN.md b/knowledge/manuals/IM36K01C10-01EN.md new file mode 100644 index 0000000..d5e56f2 --- /dev/null +++ b/knowledge/manuals/IM36K01C10-01EN.md @@ -0,0 +1,159 @@ +--- +manual: IM 36K01C10-01EN +title: CI Server Setup +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1) +--- + +# CI Server Setup (R1.03) + +New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network +tools. Section numbers refer to the manual. + +## 1. Before you start + +- Needed: the CI Server software medium (or its ISO) and one **Activated License File per + server** (an upgrade needs one that includes the Upgrade License). +- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT + Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server + IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT + Security Tool are not supported**. VMs run Windows Server 2019. +- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365 + (Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard + antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server. + +## 2. New setup + +### Order of work (§2.1, physical machine) + +1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702). +2. Configure Windows settings (below). +3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set + Windows network settings. +4. Install CI Server (with or without the IT Security Tool). +5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain). +6. Apply the CI Server licence. + +On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package** +instead of drivers/card, VM network settings, install, IT security, licence, then VM +settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over +TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP +must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30. + +### Windows settings (§2.1.2) + +| Setting | Required value | +|---|---| +| Security patches | Apply per company policy before going live; patch promptly later | +| Visual effects | *Let Windows choose what's best* | +| Processor scheduling | *Programs* | +| Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart | +| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down | +| Fast startup | Off: run `\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 | +| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) | +| Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS | +| Drive optimization | Scheduled optimization off | +| Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled | +| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong | +| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source::\sources\sxs /limitaccess`, or Server Manager feature) | +| DCOM | Default Authentication Level = *Connect*; restart | +| Display | Scale 100 % | +| 8dot3 names | `fsutil behavior set disable8dot3 2`; restart | + +### Vnet/IP (§2.1.1, §2.1.3, §2.1.4) + +- Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd + parity; action-mode switch all OFF. One card per computer; card before drivers. +- Drivers from `\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` → + `installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off. +- Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*, + *RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4. +- Default addresses: Ethernet `172.17..`/16; control bus `172.16..`/16; + Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18..`/16. +- Computer name = station name. Check `sc query VLTDI` = RUNNING. +- Never use Internet Connection Sharing, bridge connections or Homegroup. +- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8). + +### Installing CI Server (§2.1.5) + +- Run as a local administrator (domain types: domain admin or local admin + domain credentials); + join the domain first for domain/combination management. +- Close applications, disable antivirus, never run two installers, never install where CI + Server Remote Connect is installed. +- `\Windows\CIServer\ciserver-R-rM-setup.exe` = CI Server only; + `…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type + *CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default, + see known issues), reboot. +- **Change the initial passwords of the predefined CI Server user accounts** (Engineering + Module manual). + +### IT security (§2.1.6) and licence (§2.1.7) + +- IT Security Tool: select *Standard Model* and the user management type; keep default items; + restart. The model must be the same across the system. Save/export settings if you change + defaults. Running the tool (also during upgrade) overwrites manual security changes. +- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence + file › Finish. + +### CI Server Remote Connect (§2.4) + +On a CI View PC (never on a Portal or Core): browse to `http(s)://:` (defaults +8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup` +(Setup File Editor › *Client communication* tab); open them in the firewalls. + +### Virtualization extras (§2.5) + +RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1; +allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task +for sound over RDP. + +## 3. Maintenance + +**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the +*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired +licence gives an error at start. + +**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance +Licence): +1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only). +2. Stop CI Server; set the CI Service startup type to *Manual*. +3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls` + (plus project files). +4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*` + (`.sav/.d01/.k01`) and `*.sqlite`. +5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy + `tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`. +6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings. +7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again. +8. IT security, licence. +9. Restore: **compare and merge** changes into the new files (never copy old files over new + ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security. +10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`, + restore the startup type. +- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client; + on R1.02 or older with the Simba server, uninstall the server before upgrading. +- Passwords of predefined CI Server accounts are reset to the initial ones: change them again. + +**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop +standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes). + +**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must +match; takes effect within an hour. New features need CI Server stopped first. + +**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features › +CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security +definitions), then run `\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`. + +**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`: +`TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC +IPv4 settings: note them first, re-enter after restart). + +## Troubleshooting (Appendix 1) + +| Problem | Workaround | +|---|---| +| Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart | +| Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups | +| Installed updates not listed | `wmic qfe list full` | +| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator | diff --git a/knowledge/manuals/IM36K01C30-01EN.md b/knowledge/manuals/IM36K01C30-01EN.md new file mode 100644 index 0000000..c823aac --- /dev/null +++ b/knowledge/manuals/IM36K01C30-01EN.md @@ -0,0 +1,114 @@ +--- +manual: IM 36K01C30-01EN +title: CI Server Security Guide +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs (users/groups and firewall checked read-only on the test system) +--- + +# CI Server Security Guide (R1.03) + +What the IT Security Tool changes, which Windows accounts and firewall openings CI Server +needs, and the related utilities. Section numbers refer to the manual. + +## 1. Threats and measures + +- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data. +- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal + firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and + group policies (password/lockout, security options, software restriction, audit policies, + administrative templates, safe DLL search order). +- IT security settings **must** be applied at the area and process levels; business and + corporate levels follow the site's own policy. + +## 2. Security model and user management + +- CI Server supports only the **Standard model**: protects against network and terminal + attacks, **not** against theft. Password and lockout policies are *not* set by it (use + domain policy). +- User management types: + +| Type | Accounts kept on | Notes | +|---|---|---| +| Standalone | Each computer | Small systems; admin and product maintenance rights not separable | +| Domain | Domain controller | Central; rights separable | +| Combination | Domain, plus local fallback | Local `_LCL` groups for emergencies | +| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool | + +- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the + domain controller, with `_LCL` local helper groups): + +| Name | Kind | Purpose | +|---|---|---| +| `CIX_OPERATOR` | Group | Operators | +| `CIX_ENGINEER` | Group | Engineering (Engineering / Edit Module) | +| `CIX_MAINTENANCE` | Group (also Administrators) | Installation and maintenance | +| `CIX_OPC` | Group | OPC configuration and communication | +| `CIX_PROCESS` | User | Runs CI Server services and CI OPC servers | +| `CTM_PROCESS` | User | Runs VAGW services | +| `RDC_PROCESS` | User | Dual-redundant platform only | +| `VNT_*` | Groups/users | Vnet/IP Interface Package (no sign-in rights) | + +Use these accounts only for CI Server. Changing the security model may delete or rename groups. + +## 3. Firewall (§3.2) + +Windows Firewall on; block everything except what CI Server needs: + +| Use | Port | +|---|---| +| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 | +| DURM between nodes | UDP 17001, 17101 (one per DURM line) | +| SMDMON (system log collection) | UDP 18002 | +| Remote desktop (only if needed, restrict users) | TCP 3389 | +| HAC | UDP 16000–16006 (`hac.sup`, `jhacProperties\application.properties`); HACW_HMI UDP 16010–16041 | +| ODBC (SimbaServer, Core only) | TCP 1583 | +| Alarm e-mail | TCP 25 | +| NTP/SNTP (not needed with Vnet/IP) | 123 | +| OPC classic | TCP 135, 139, DCOM 20500–20550 (customizable); UDP 137, 138 | +| OPC UA | UDP 4840 discovery; communication port configurable | +| Vnet equipment (`odeq.exe`) | TCP 44818 | +| Equipment drivers | Rockwell CIP / PLC5 / Fisher ROC TCP 44818; DAQ TCP 34260, 34434; DNP3 TCP 20000; FA-M3 TCP 12289; IEC 60870-5-104 TCP 2404; IEC 61850 TCP 102; MeTro TCP 7075; Modbus TCP 502; STARDOM FCX TCP 1090 | +| Windows domain | DNS 53, Kerberos 88, LDAP 389, SMB 445, GC 3268/3269, DHCP 67, discovery 137/138/1900/3702/5355 + TCP 2869/5357/5358, MADCAP 2535, AD Web 9389 | +| Dual-redundant platform (PRC) | TCP 34480, 34483–34486; UDP 1311 | + +ICMP echo (ping) is allowed by the Standard model. + +## 4. Other settings (§3.3–§3.6) + +- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User + Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program + Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push + Notifications, and others. DHCP Client must stay running. +- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`; + network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table + also prints "2500–20550", taken as a typo). +- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then + configure HOSTS/DNS for name resolution. +- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to + allow writing temporarily. + +## 5. Tools (§4) + +| Tool | Use | +|---|---| +| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) | +| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` | +| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components | +| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p ]` (`\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart | +| `…CreateCTMProcess.exe [-p ]` | Same for `CTM_PROCESS` | +| `ITSecuritySettingItemExport.exe` | Export applied settings | +| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) | + +**Changing the account that runs CI Server (§4.9)**: create the user, add it to +Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or +`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the +Identity tab of *CI OPC AE Server* and *CI OPC DA Server* in Component Services › DCOM Config. + +## 6. Optional hardening (§5) + +Extra settings the site may add: audit policies and event log sizes, disable recovery +console and Guest account, restrict audit log and removable media access, immediate +screen-saver password, SNMP, SSL/TLS registry settings, secure startup and +`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused +protocols, block malicious DLL loading. diff --git a/knowledge/progress.md b/knowledge/progress.md index b2c8c6b..e45412e 100644 --- a/knowledge/progress.md +++ b/knowledge/progress.md @@ -31,8 +31,8 @@ AID is not needed. |---|---|---|---| | 0 | IM 36K01A50 | Release Information | summarized ([notes](manuals/IM36K01A50-01EN.md)) | | 1 | IM 36K10J10 | System Design/Management | done except migration (phase 6) and debugging tools; skill `system-management` ([notes](manuals/IM36K10J10-01EN.md)) | -| 2 | IM 36K01C10 | CI Server Setup | not started | -| 2 | IM 36K01C30 | Security Guide | not started | +| 2 | IM 36K01C10 | CI Server Setup | summarized ([notes](manuals/IM36K01C10-01EN.md)); skill `installation-security` (draft) | +| 2 | IM 36K01C30 | Security Guide | summarized ([notes](manuals/IM36K01C30-01EN.md)); skill `installation-security` (draft) | | 3 | IM 36K10G10 | Tutorial | not started | | 4 | IM 36K10R10 | CI Portal Setup | not started | | 4 | IM 36K10R20 | Setup File Editor | not started | @@ -90,3 +90,10 @@ now come before classes and objects (phase 6), and the other interfaces follow a | J10 | Backup of `tls` folders | not practiced | n/a | Plan only; the actual backup tool is site-specific. | | J10 | Migration between systems (§5.6) | not practiced | pending | Needs engineered data; revisit after phase 6. | | J10 | Tuning checks (read-only) ([task](../.claude/skills/system-management/tasks/tuning-checks.md)) | passed | n/a | Read `dur.sup` (max processes 250), `itm.sup` (item pool 650,000 KB) and the automatic health snapshots `tls\log\smd_*.log` (common memory free, queue use per process, lock collisions). Debug launchers and interactive debuggers not practiced. | +| C10/C30 | Setup check script `tools/setup_check.ps1` ([task](../.claude/skills/installation-security/tasks/setup-check.md)) | practiced, awaiting confirmation | n/a | Read-only; 16 OK / 5 CHECK / 15 DIFF on the Win10 Pro test PC. | +| C10 | Read `ci_start.log` and web ports (`jwuiisg.sup`) | practiced, awaiting confirmation | n/a | All services started; SSL error [ISS-008](issues.md). | +| C10 | Start / stop CI Server | passed (phase 1) | n/a | Via the CI Service (elevated). Start-menu shortcuts not used. | +| C10 | New install, reinstall, upgrade, uninstall, licence | not practiced | n/a | Would reinstall or change the test system; only the installed R1.03 is available. Skipped. | +| C10 | Windows settings changes (power, virtual memory, Defender, updates, …) | not practiced | n/a | Changes the test PC's OS; needs the user's go-ahead. Skipped. | +| C10 | Vnet/IP drivers / Vnet/IP Interface Package | not practiced | n/a | No Vnet/IP card; not supported on Windows 10 Pro. | +| C30 | IT Security Tool, Domain Link Management, account utilities | not practiced | n/a | Not installed and not supported on Windows 10 Pro. | diff --git a/tools/README.md b/tools/README.md index 7d055c5..c2c289d 100644 --- a/tools/README.md +++ b/tools/README.md @@ -3,3 +3,7 @@ Helper scripts Claude can run. Scripts that read the manuals must not hard-code their location; take it from an argument or environment variable, with `C:\Users\Public\Yokogawa\tls\doc\EN\` as the default. + +| Script | Purpose | +|---|---| +| `setup_check.ps1` | Read-only check of a machine against the CI Server R1.03 setup and security requirements (skill `installation-security`) | diff --git a/tools/setup_check.ps1 b/tools/setup_check.ps1 new file mode 100644 index 0000000..8af3c53 --- /dev/null +++ b/tools/setup_check.ps1 @@ -0,0 +1,129 @@ +# CI Server R1.03 - read-only setup check +# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2) +# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2). +# Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session. +# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 + +$results = New-Object System.Collections.Generic.List[object] +function Add-Result($area, $check, $expected, $actual, $ok) { + $status = 'CHECK' + if ($ok -eq $true) { $status = 'OK' } elseif ($ok -eq $false) { $status = 'DIFF' } + $results.Add([pscustomobject]@{ Status = $status; Area = $area; Check = $check; Expected = $expected; Actual = "$actual" }) +} +function Get-Reg($path, $name) { + try { (Get-ItemProperty -Path $path -Name $name -ErrorAction Stop).$name } catch { $null } +} + +# --- CI Server --------------------------------------------------------------- +$ci = $null +foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') { + foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } } +} +if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') } +else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false } +$svc = Get-Service StartCIServer -ErrorAction SilentlyContinue +if ($svc) { + Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null + Add-Result 'CI Server' 'CI Service startup type' 'Automatic in operation; Manual during upgrade' $svc.StartType $null + $acct = (Get-CimInstance Win32_Service -Filter "Name='StartCIServer'" -ErrorAction SilentlyContinue).StartName + Add-Result 'CI Server' 'CI Service account' '.\CIX_PROCESS (default)' $acct ($acct -like '*CIX_PROCESS') +} +$vagw = Get-Service | Where-Object { $_.DisplayName -like 'VAGW*' } +Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT Security Tool' ($(if ($vagw) { ($vagw | ForEach-Object { "$($_.DisplayName)=$($_.Status)" }) -join ', ' } else { 'not installed' })) $null + +# --- Operating system -------------------------------------------------------- +$os = Get-CimInstance Win32_OperatingSystem +$supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019') +$osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } } +Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk +if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null } + +# Visual effects: "Let Windows choose" = VisualFXSetting 0 +$vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting' +Add-Result 'Windows' 'Visual effects' "Let Windows choose (0)" $(if ($null -eq $vfx) { 'not set (default = Let Windows choose)' } else { $vfx }) ($null -eq $vfx -or $vfx -eq 0) + +# Virtual memory: custom size = 1.5 x RAM, not automatic +$ramMB = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB) +$auto = (Get-CimInstance Win32_ComputerSystem).AutomaticManagedPagefile +$pf = Get-CimInstance Win32_PageFileSetting -ErrorAction SilentlyContinue +$pfText = if ($pf) { ($pf | ForEach-Object { "$($_.Name) $($_.InitialSize)-$($_.MaximumSize) MB" }) -join '; ' } else { 'system managed' } +$want = [math]::Round($ramMB * 1.5) +$pfOk = (-not $auto) -and $pf -and (($pf | Where-Object { $_.InitialSize -ge $want * 0.95 -and $_.MaximumSize -ge $want * 0.95 }) -ne $null) +Add-Result 'Windows' 'Virtual memory' "custom, initial = max = ~$want MB (1.5 x $ramMB MB RAM)" "automatic=$auto; $pfText" $pfOk + +# Processor scheduling: Programs = Win32PrioritySeparation 0x26 (38) or 2 +$prio = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl' 'Win32PrioritySeparation' +Add-Result 'Windows' 'Processor scheduling' 'Programs (38 or 2)' $prio ($prio -eq 38 -or $prio -eq 2) + +# Power plan +$plan = (powercfg /getactivescheme) 2>$null +Add-Result 'Windows' 'Power plan' 'High performance; never sleep/hibernate, disk and display never off' $plan ($plan -match 'High performance') + +# Fast startup +$hib = Get-Reg 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power' 'HiberbootEnabled' +Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0) + +# Windows Defender +$defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware' +$defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue +Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1) + +# Automatic Windows updates +$au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate' +Add-Result 'Windows' 'Automatic Windows updates' 'Disabled by policy (NoAutoUpdate=1)' $au ($au -eq 1) + +# Scheduled drive optimization and component cleanup +foreach ($t in @(@('\Microsoft\Windows\Defrag\', 'ScheduledDefrag', 'Automatic drive optimization'), @('\Microsoft\Windows\Servicing\', 'StartComponentCleanup', 'Automatic cleanup'))) { + $task = Get-ScheduledTask -TaskPath $t[0] -TaskName $t[1] -ErrorAction SilentlyContinue + Add-Result 'Windows' $t[2] 'Disabled' $(if ($task) { $task.State } else { 'task not found' }) ($task -and $task.State -eq 'Disabled') +} + +# .NET Framework 3.5 +$net35 = Get-Reg 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5' 'Install' +Add-Result 'Windows' '.NET Framework 3.5' 'installed' $(if ($net35 -eq 1) { 'installed' } else { 'not installed' }) ($net35 -eq 1) + +# DCOM default authentication level: Connect = 2 +$dcom = Get-Reg 'HKLM:\SOFTWARE\Microsoft\Ole' 'LegacyAuthenticationLevel' +Add-Result 'Windows' 'DCOM Default Authentication Level' 'Connect (2)' $(if ($null -eq $dcom) { 'not set (default = Connect)' } else { $dcom }) ($null -eq $dcom -or $dcom -eq 2) + +# Display scale 100 % +$dpi = Get-Reg 'HKCU:\Control Panel\Desktop\WindowMetrics' 'AppliedDPI' +Add-Result 'Windows' 'Display scale' '100 % (96 DPI)' $(if ($null -eq $dpi) { 'unknown' } else { "$dpi DPI" }) ($dpi -eq 96) + +# 8dot3 file naming +$d83 = (fsutil behavior query disable8dot3) 2>$null | Select-Object -First 1 +Add-Result 'Windows' '8dot3 file naming' 'state 2 (per volume) or 0 (enabled)' $d83 ($d83 -match 'is:\s*[02]\b|\b[02] \(') + +# Regional settings (must not change after IT security is applied) +Add-Result 'Windows' 'Regional format / UI language' 'set before applying IT security; do not change afterwards' "$((Get-Culture).Name) / $((Get-UICulture).Name)" $null + +# --- IT security (Security Guide) -------------------------------------------- +$groups = 'CIX_OPERATOR', 'CIX_ENGINEER', 'CIX_MAINTENANCE', 'CIX_OPC' +foreach ($g in $groups) { + $lg = Get-LocalGroup -Name $g -ErrorAction SilentlyContinue + Add-Result 'IT security' "Local group $g" 'exists after IT Security Tool (standalone)' $(if ($lg) { 'exists' } else { 'missing' }) ([bool]$lg) +} +foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') { + $lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue + Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu) +} +$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security' +Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec + +foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) { + Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true) +} +$ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 } +$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue +foreach ($name in $ports.Keys) { + $proto, $num = $name.Split(' ') + $hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') } + Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit) +} + +# --- Output -------------------------------------------------------------------- +foreach ($r in ($results | Sort-Object Area, Check)) { + "[{0,-5}] {1} / {2}: {3} (expected: {4})" -f $r.Status, $r.Area, $r.Check, $r.Actual, $r.Expected +} +$sum = $results | Group-Object Status | ForEach-Object { "$($_.Name)=$($_.Count)" } +"Summary: $($sum -join ', ') (OK = matches, DIFF = differs, CHECK = review manually)" From c619ca9e5f9ad3032d1879aa7ebfe11a5cb595e3 Mon Sep 17 00:00:00 2001 From: cliu Date: Wed, 30 Sep 2026 15:45:43 +1000 Subject: [PATCH 2/3] Add phase 3 Tutorial summary and extend CI-Eng-Sample Summarize the CI Server Tutorial and practice its command-line equivalents on CI-Eng-Sample: sub-items, blocking, a trigger group, a compiled class and an object. Log ISS-010/011. Co-Authored-By: Claude Opus 5.5 --- .claude/skills/installation-security/SKILL.md | 2 +- .../tasks/setup-check.md | 2 +- examples/CI-Eng-Sample/01_section_df.qli | 1 + examples/CI-Eng-Sample/02_item_df.qli | 1 + examples/CI-Eng-Sample/02b_sub_item_df.qli | 15 +++ examples/CI-Eng-Sample/05_trigger_df.qli | 12 ++ examples/CI-Eng-Sample/06_class_df.qli | 26 +++++ examples/CI-Eng-Sample/07_object_df.qli | 12 ++ .../CI-Eng-Sample/86_remove_object_df.qli | 12 ++ examples/CI-Eng-Sample/87_remove_class_df.qli | 12 ++ .../CI-Eng-Sample/88_remove_trigger_df.qli | 12 ++ .../CI-Eng-Sample/90b_remove_sub_item_df.qli | 13 +++ examples/CI-Eng-Sample/91_remove_item_df.qli | 1 + .../CI-Eng-Sample/92_remove_section_df.qli | 1 + examples/CI-Eng-Sample/README.md | 13 ++- examples/CI-Eng-Sample/load.cmd | 5 + examples/CI-Eng-Sample/remove.cmd | 6 +- knowledge/issues.md | 5 +- knowledge/manuals/IM36K10G10-01EN.md | 108 ++++++++++++++++++ knowledge/progress.md | 18 ++- 20 files changed, 265 insertions(+), 12 deletions(-) create mode 100644 examples/CI-Eng-Sample/02b_sub_item_df.qli create mode 100644 examples/CI-Eng-Sample/05_trigger_df.qli create mode 100644 examples/CI-Eng-Sample/06_class_df.qli create mode 100644 examples/CI-Eng-Sample/07_object_df.qli create mode 100644 examples/CI-Eng-Sample/86_remove_object_df.qli create mode 100644 examples/CI-Eng-Sample/87_remove_class_df.qli create mode 100644 examples/CI-Eng-Sample/88_remove_trigger_df.qli create mode 100644 examples/CI-Eng-Sample/90b_remove_sub_item_df.qli create mode 100644 knowledge/manuals/IM36K10G10-01EN.md diff --git a/.claude/skills/installation-security/SKILL.md b/.claude/skills/installation-security/SKILL.md index cf21c96..5b349fb 100644 --- a/.claude/skills/installation-security/SKILL.md +++ b/.claude/skills/installation-security/SKILL.md @@ -24,7 +24,7 @@ Rules: | Task | Where | Status | |---|---|---| -| Check a machine against the setup and security requirements | `tasks/setup-check.md` | draft, awaiting confirmation | +| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified | | New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs | | Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs | | Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs | diff --git a/.claude/skills/installation-security/tasks/setup-check.md b/.claude/skills/installation-security/tasks/setup-check.md index be4f14b..96d3ca8 100644 --- a/.claude/skills/installation-security/tasks/setup-check.md +++ b/.claude/skills/installation-security/tasks/setup-check.md @@ -2,7 +2,7 @@ task: Check a machine against the CI Server setup and security requirements version: R1.03 source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30 -status: draft, awaiting confirmation +status: verified (2026-09-30) --- # Setup check (read-only) diff --git a/examples/CI-Eng-Sample/01_section_df.qli b/examples/CI-Eng-Sample/01_section_df.qli index e1a15c7..eafc087 100644 --- a/examples/CI-Eng-Sample/01_section_df.qli +++ b/examples/CI-Eng-Sample/01_section_df.qli @@ -13,3 +13,4 @@ NAME,SECTION_PATH,SECTION_NAME,DESCRIPTION "CI-Eng-Sample.TANK1","CI-Eng-Sample","TANK1","Sample tank 1" "CI-Eng-Sample.PUMP1","CI-Eng-Sample","PUMP1","Sample pump 1" "CI-Eng-Sample.SYSTEM","CI-Eng-Sample","SYSTEM","Sample system monitoring" +"CI-Eng-Sample.DEMO","CI-Eng-Sample","DEMO","Tutorial examples (class/object)" diff --git a/examples/CI-Eng-Sample/02_item_df.qli b/examples/CI-Eng-Sample/02_item_df.qli index 8ad63dc..61cc540 100644 --- a/examples/CI-Eng-Sample/02_item_df.qli +++ b/examples/CI-Eng-Sample/02_item_df.qli @@ -18,3 +18,4 @@ LOW_LOW_LIMIT,LOW_LIMIT,HIGH_LIMIT,HIGH_HIGH_LIMIT,SCALE_LOW_LIMIT,SCALE_HIGH_LI "CI-Eng-Sample.SYSTEM.DISK_C","Disk C: from intdskmon","Real","999.9",0,0,0,0,0,100 "CI-Eng-Sample.SYSTEM.PING_LOCALHOST","localhost reachable, from inttcpmon","Integer","9",0,0,0,0,0,1 "CI-Eng-Sample.SYSTEM.PROC_ALM","ALARM process (alm) running, from intmon","Integer","9",0,0,0,0,0,1 +"CI-Eng-Sample.DEMO.COUNTER","Counter 1..100 driven by object DEMO.INCR1","Integer","999",0,0,0,0,0,100 diff --git a/examples/CI-Eng-Sample/02b_sub_item_df.qli b/examples/CI-Eng-Sample/02b_sub_item_df.qli new file mode 100644 index 0000000..eff3969 --- /dev/null +++ b/examples/CI-Eng-Sample/02b_sub_item_df.qli @@ -0,0 +1,15 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! CI-Eng-Sample sub-items (Tutorial IM 36K10G10-01EN 3.1.5, 3.2.3), CI Server R1.03.00 +! Integrator: adds value x seconds (RUNNING = 1 -> running seconds; TIME_UNIT has no effect, verified). +! Min-Max: keeps the maximum (or minimum) of the main item. +@FIELDS +NAME,DESCRIPTION,SUB_TYPE,TIME_UNIT,MIN_MAX + +@SUB_ITEM_DF +"CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS","Pump 1 running time (seconds)","Integrator","","" +"CI-Eng-Sample.TANK1.LEVEL.MAX","Tank 1 maximum level","Min-Max","","Maximum" diff --git a/examples/CI-Eng-Sample/05_trigger_df.qli b/examples/CI-Eng-Sample/05_trigger_df.qli new file mode 100644 index 0000000..788c16b --- /dev/null +++ b/examples/CI-Eng-Sample/05_trigger_df.qli @@ -0,0 +1,12 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! CI-Eng-Sample trigger group: every second (CI Server R1.03.00) +@FIELDS +NAME,DESCRIPTION,TRIGGER_INTERVAL + +@TRIGGER_DF +"CIENG_1S","CI-Eng-Sample one second trigger","1 seconds" diff --git a/examples/CI-Eng-Sample/06_class_df.qli b/examples/CI-Eng-Sample/06_class_df.qli new file mode 100644 index 0000000..950b67b --- /dev/null +++ b/examples/CI-Eng-Sample/06_class_df.qli @@ -0,0 +1,26 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! CI-Eng-Sample class (traditional language), compiled on load (COMPILE = 1) +! Based on the INCREMENT example in the CI Server Tutorial (IM 36K10G10-01EN 5.2) +@FIELDS +NAME,DESCRIPTION,PF_LANGUAGE,TRIGGER_1,COMPILE,LISTING_WANTED,METHOD + +@CLASS_DF +"CIENG_INCR","Count CI-Eng-Sample.DEMO.COUNTER 1..100","Traditional","CIENG_1S",1,1,@" +CLASS CIENG_INCR; + PROLOG + SIGNAL INPUT := "CI-Eng-Sample.DEMO.COUNTER"; + BODY + METHOD UP_AND_DOWN; + BODY + IF (INPUT >= 100) THEN + INPUT := 0; + ENDIF; + INPUT := INPUT + 1; + ENDMETHOD UP_AND_DOWN; +ENDCLASS CIENG_INCR; +"@ diff --git a/examples/CI-Eng-Sample/07_object_df.qli b/examples/CI-Eng-Sample/07_object_df.qli new file mode 100644 index 0000000..f6d407c --- /dev/null +++ b/examples/CI-Eng-Sample/07_object_df.qli @@ -0,0 +1,12 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! CI-Eng-Sample object created from class CIENG_INCR +@FIELDS +NAME,DESCRIPTION,CLASS + +@OBJECT_DF +"CI-Eng-Sample.DEMO.INCR1","Counts DEMO.COUNTER every second","CIENG_INCR" diff --git a/examples/CI-Eng-Sample/86_remove_object_df.qli b/examples/CI-Eng-Sample/86_remove_object_df.qli new file mode 100644 index 0000000..cb77b92 --- /dev/null +++ b/examples/CI-Eng-Sample/86_remove_object_df.qli @@ -0,0 +1,12 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove CI-Eng-Sample objects +@FIELDS +NAME + +@OBJECT_DF +"CI-Eng-Sample.DEMO.INCR1" diff --git a/examples/CI-Eng-Sample/87_remove_class_df.qli b/examples/CI-Eng-Sample/87_remove_class_df.qli new file mode 100644 index 0000000..8ee27d5 --- /dev/null +++ b/examples/CI-Eng-Sample/87_remove_class_df.qli @@ -0,0 +1,12 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove CI-Eng-Sample classes +@FIELDS +NAME + +@CLASS_DF +"CIENG_INCR" diff --git a/examples/CI-Eng-Sample/88_remove_trigger_df.qli b/examples/CI-Eng-Sample/88_remove_trigger_df.qli new file mode 100644 index 0000000..c0129d6 --- /dev/null +++ b/examples/CI-Eng-Sample/88_remove_trigger_df.qli @@ -0,0 +1,12 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove CI-Eng-Sample trigger groups +@FIELDS +NAME + +@TRIGGER_DF +"CIENG_1S" diff --git a/examples/CI-Eng-Sample/90b_remove_sub_item_df.qli b/examples/CI-Eng-Sample/90b_remove_sub_item_df.qli new file mode 100644 index 0000000..a420d84 --- /dev/null +++ b/examples/CI-Eng-Sample/90b_remove_sub_item_df.qli @@ -0,0 +1,13 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove CI-Eng-Sample sub-items +@FIELDS +NAME + +@SUB_ITEM_DF +"CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS" +"CI-Eng-Sample.TANK1.LEVEL.MAX" diff --git a/examples/CI-Eng-Sample/91_remove_item_df.qli b/examples/CI-Eng-Sample/91_remove_item_df.qli index 2b6a535..d91a425 100644 --- a/examples/CI-Eng-Sample/91_remove_item_df.qli +++ b/examples/CI-Eng-Sample/91_remove_item_df.qli @@ -17,3 +17,4 @@ NAME "CI-Eng-Sample.SYSTEM.DISK_C" "CI-Eng-Sample.SYSTEM.PING_LOCALHOST" "CI-Eng-Sample.SYSTEM.PROC_ALM" +"CI-Eng-Sample.DEMO.COUNTER" diff --git a/examples/CI-Eng-Sample/92_remove_section_df.qli b/examples/CI-Eng-Sample/92_remove_section_df.qli index 3926c72..d57a8e8 100644 --- a/examples/CI-Eng-Sample/92_remove_section_df.qli +++ b/examples/CI-Eng-Sample/92_remove_section_df.qli @@ -12,4 +12,5 @@ NAME "CI-Eng-Sample.TANK1" "CI-Eng-Sample.PUMP1" "CI-Eng-Sample.SYSTEM" +"CI-Eng-Sample.DEMO" "CI-Eng-Sample" diff --git a/examples/CI-Eng-Sample/README.md b/examples/CI-Eng-Sample/README.md index 4f84fd8..ab12d36 100644 --- a/examples/CI-Eng-Sample/README.md +++ b/examples/CI-Eng-Sample/README.md @@ -39,6 +39,13 @@ cmd /c "\examples\CI-Eng-Sample\remove.cmd" | `CI-Eng-Sample.SYSTEM.DISK_C` | Item, Real | Target for `intdskmon` (reports **used** %) | | `CI-Eng-Sample.SYSTEM.PING_LOCALHOST` | Item, Integer | Target for `inttcpmon` (1 = reachable) | | `CI-Eng-Sample.SYSTEM.PROC_ALM` | Item, Integer | Target for `intmon` (1 = `alm` process running) | +| `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` | Sub-item, Integrator | Running time in seconds (adds value × seconds) | +| `CI-Eng-Sample.TANK1.LEVEL.MAX` | Sub-item, Min-Max | Highest level seen | +| `CI-Eng-Sample.DEMO` | Section | Tutorial examples | +| `CI-Eng-Sample.DEMO.COUNTER` | Item, Integer | Counts 1…100, one step per second, written by `DEMO.INCR1` | +| `CIENG_1S` | Trigger group | Every second | +| `CIENG_INCR` | Class (traditional) | Increments `DEMO.COUNTER`, wraps at 100; compiled on load | +| `CI-Eng-Sample.DEMO.INCR1` | Object | Instance of `CIENG_INCR` | | `CIENG_EVENT` | Item storage group | Event/Item, lifetime 1 week, rollover 1 day | All items are internal (no station), so the project works without any PLC or simulator. @@ -50,9 +57,11 @@ New items start with status 13 (`NOT INIT`) until a value is written. |---|---| | `01_section_df.qli` | Sections (`SECTION_DF`); parents before children | | `02_item_df.qli` | Items (`ITEM_DF`) | +| `02b_sub_item_df.qli` | Sub-items (`SUB_ITEM_DF`) | | `03_his_group_df.qli` | Item storage group (`HIS_GROUP_DF`) | | `04_item_his_df.qli` | Items in the storage group (`ITEM_HIS_DF`, name `:`) | -| `89_`…`92_remove_*.qli` | Names to delete, in reverse order | +| `05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli` | Trigger group, class (source in the `METHOD` memo, `@"` … `"@`, `COMPILE` 1), object | +| `86_`…`92_remove_*.qli` | Names to delete, in reverse order | | `load.cmd`, `remove.cmd` | Run the steps in the right order | | `monitoring/*.sup.txt` | Setup-file lines for the monitoring processes (not applied by `load.cmd`) | @@ -67,7 +76,7 @@ testing. See the `system-management` skill, task `monitoring-processes.md`. | Phase | Adds | |---|---| -| 6 | Template items, a class and objects | +| 6 | Template items, a class with attributes/prompts, objects that create items | | 8 | Alarm settings on sample items | | 9 | More storage groups (scan/time, aggregation) | | 10 | A display and symbol | diff --git a/examples/CI-Eng-Sample/load.cmd b/examples/CI-Eng-Sample/load.cmd index 8858023..eee7df1 100644 --- a/examples/CI-Eng-Sample/load.cmd +++ b/examples/CI-Eng-Sample/load.cmd @@ -6,7 +6,12 @@ rem Restart CI Server afterwards: new storage groups only start storing after a cd /d "%~dp0" dssqld -i 01_section_df.qli -l 01_section_df.qlo dssqld -i 02_item_df.qli -l 02_item_df.qlo +dssqld -i 02b_sub_item_df.qli -l 02b_sub_item_df.qlo dssqld -i 03_his_group_df.qli -l 03_his_group_df.qlo rem Short pause: linking items straight after creating the group failed once. powershell -NoProfile -Command "Start-Sleep -Seconds 5" dssqld -i 04_item_his_df.qli -l 04_item_his_df.qlo +rem Processing: trigger group, class (compiled on load via COMPILE = 1), object +dssqld -i 05_trigger_df.qli -l 05_trigger_df.qlo +dssqld -i 06_class_df.qli -l 06_class_df.qlo +dssqld -i 07_object_df.qli -l 07_object_df.qlo diff --git a/examples/CI-Eng-Sample/remove.cmd b/examples/CI-Eng-Sample/remove.cmd index a55bc04..36c1154 100644 --- a/examples/CI-Eng-Sample/remove.cmd +++ b/examples/CI-Eng-Sample/remove.cmd @@ -1,16 +1,20 @@ @echo off rem Remove CI-Eng-Sample from a CI Server R1.03 TEST system (also deletes its history). rem Run in an elevated prompt while CI Server is running; call this script by full path. -rem Order: storage links, stop + delete storage group, items, sections (children first). +rem Order: object, class, trigger group, storage links, stop + delete storage group, items, sections (children first). rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the rem group first gets a stop time one minute ahead; the script waits until it has passed. cd /d "%~dp0" +dssqld -r 86_remove_object_df.qli -l 86_remove_object_df.qlo +dssqld -r 87_remove_class_df.qli -l 87_remove_class_df.qlo +dssqld -r 88_remove_trigger_df.qli -l 88_remove_trigger_df.qlo dssqld -r 89_remove_item_his_df.qli -l 89_remove_item_his_df.qlo powershell -NoProfile -Command "$t=(Get-Date).AddMinutes(1).ToString('dd-MM-yyyy HH:mm:ss'); \"@LANGUAGE`r`nENGLISH`r`n`r`n@VERSION`r`n1.03.00`r`n`r`n@FIELDS`r`nNAME,STOP_TIME`r`n`r`n@HIS_GROUP_DF`r`n\"\"CIENG_EVENT\"\",\"\"$t\"\"`r`n\" | Set-Content -Encoding ascii 90a_stop_his_group_df.qli" dssqld -m 90a_stop_his_group_df.qli -l 90a_stop_his_group_df.qlo echo Waiting 75 seconds for the storage group stop time to pass... powershell -NoProfile -Command "Start-Sleep -Seconds 75" dssqld -r 90_remove_his_group_df.qli -l 90_remove_his_group_df.qlo +dssqld -r 90b_remove_sub_item_df.qli -l 90b_remove_sub_item_df.qlo dssqld -r 91_remove_item_df.qli -l 91_remove_item_df.qlo dssqld -r 92_remove_section_df.qli -l 92_remove_section_df.qlo del 90a_stop_his_group_df.qli diff --git a/knowledge/issues.md b/knowledge/issues.md index aa2ecad..df86b0b 100644 --- a/knowledge/issues.md +++ b/knowledge/issues.md @@ -19,7 +19,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ID | Date | Area | Issue | Status | Next step / resolution | Update on close | |---|---|---|---|---|---|---| -| ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | open | 2026-09-30: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" | +| ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | open | 2026-09-30: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. 2026-09-30 later: unblocking a sample item left the flag `ublk` (after `blk` was cleared), so `u…` flags may mean "was …" (un-blocked / un-offline). Still unconfirmed. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" | | ISS-002 | 2026-09-30 | DATABASE (`dsschk`) | `dsschk -d ITEM_DF -v` (check only) exits 0 with no console output and nothing new in `umhlog.log`. Where results are reported is unknown. | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: `dsschk -e -v` prints a start/end line per dataset (228 checked, no problems) and logs to `umhlog.log`. Plain `dsschk` only compares copies between nodes, so it prints nothing on a single-node system. `ismchk` needs a database file name (usage: `ismchk data_base_name`), not run yet. | Create `.claude/skills/system-management/tasks/consistency-check.md` and add it to that skill's `SKILL.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.1 consistency tools (add where output goes); `knowledge/progress.md` row "Consistency check" | | ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e .qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@`; run `dssqld -e .qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" | | ISS-004 | 2026-09-30 | ITEM (`itmval`) | `itmval -g -a <1..5>` returns `ITM-E-WRONG_ATT` on `AID.WRPS.*` items, so reading limits is unproven. | closed | Closed 2026-09-30 (confirmed by user). On `CI-Eng-Sample.TANK1.LEVEL` (limits set) `-a 1..5` returned deadband 0, low 20, high 80, low-low 10, high-high 90. The error only occurs on items without limits. | `.claude/skills/system-management/tasks/read-write-item.md` (limits section); `knowledge/progress.md` row "Read an item with `itmval -g`" | @@ -28,3 +28,6 @@ development system (see "Test system" in `progress.md`); they do not exist on ot | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` | | ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill | | ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 | + +| ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | open | Confirm with ITEM Service manuals (IM 36K10L35/L36) in phase 5: is there a scaling option for integrators? | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` | +| ISS-011 | 2026-09-30 | ITEM (blocking) | A write to a blocked item with `itmval -p` (without `-o`) is silently ignored: no error message, value unchanged. | open | Check in phase 5 whether any status/return code signals this. | `.claude/skills/system-management/tasks/read-write-item.md` | diff --git a/knowledge/manuals/IM36K10G10-01EN.md b/knowledge/manuals/IM36K10G10-01EN.md new file mode 100644 index 0000000..5410079 --- /dev/null +++ b/knowledge/manuals/IM36K10G10-01EN.md @@ -0,0 +1,108 @@ +--- +manual: IM 36K10G10-01EN +title: CI Server Tutorial +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs; item, sub-item, blocking, trigger group, class and object steps verified with dssqld/itmval on CI-Eng-Sample (2026-09-30) +--- + +# CI Server Tutorial (R1.03) + +A guided tour of the main engineering tasks in the Engineering Module and Edit Module. Each +chapter points to the full manual for its area; the table shows where this repo covers it. + +| Chapter | Topic | Covered in detail by | +|---|---|---| +| 1 | Engineering Module window: menu, configuration tree, work area (properties sheets), message area, edit history (undo/redo) | IM 36K10C10 (phase 5) | +| 2 | Authorization groups and users | IM 36K10C10 (phase 5) | +| 3 | Sections, items, sub-items, blocking, value updates, item statuses | IM 36K10C10, L35/L36 (phase 5) | +| 4 | Displays in the Edit Module; HTML displays | IM 36K10C50, R30 (phase 10) | +| 5 | Trigger groups, classes, objects, symbols linked to objects | IM 36K10L10, P10 (phase 6), C50 (phase 10) | +| 6 | I/O: lines, stations, scan types, points | IM 36K10L40/L41 (phase 5) | +| 7 | Item alarms | IM 36K10L15, C20 (phase 8) | +| 8 | Reports and printers | IM 36K10P20, R40, C30 (phase 11) | +| 9 | Audit trail | IM 36K10L25 (phase 12) | +| 10 | RDBMS data exposure (`dbc.sup`) | IM 36K10L45 (phase 7) | +| 11 | Item search | IM 36K10C10 (phase 5) | +| 12 | Excel Add-in | IM 36K10E10 (phase 11) | +| 13 | History: storage groups, units, collection types, aggregation, archiving | IM 36K10L20, C40 (phase 9) | + +## Key points + +**Users (ch. 2)**: create an authorization group (the set of allowed functions, e.g. `ALL` +with every function), then a user assigned to it. A user is needed to log on to the Edit +Module and Operator Interface. + +**Items (ch. 3)** +- Full name `Section.Sub-section.Item` (max 255 bytes; no `:` or `.` inside a name; case + insensitive). Sections can be blocked as a whole, e.g. for maintenance. +- Types: Boolean, Integer, Real, String (max length 80 by default, up to 168 without audit). +- Four limits (LL, L, H, HH) plus a deadband set the status LOWLOW…HIGHHIGH; the deadband sits + on the normal side of each limit. Scale high/low give OVERRANGED / UNDERRANGED. + Booleans set status TRUE/FALSE. +- An item is connected to an I/O point on the *Equipment* tab; the station must exist first. +- Sub-items: Integrator, Pulse counter, Min-Max, Rate-of-Change (with time unit), Typeless. + Sub-items cannot connect to equipment or have sub-items, and are **not** blocked with their + main item. +- Blocked items and offline items are not updated. *Update value* (Engineering Module) or + `itmval -p` changes value/status/quality; *Overwrite blocked* (`-o`) is needed for a + blocked item. New items are `NOT INIT` until a value is written. +- Item statuses are system-wide; add your own with numbers **100–127** (1–99 and above 127 + are reserved), with mnemonic, alarm priority (0–15), alarm state (Normal, Alarm 1–3), + colour and shelving. + +**Displays (ch. 4)**: a display is built of frames defined by a layout. Edit Module parts: +sheets, component bar, Visualizations tree, Symbols palette, menus, toolbars, drawing area. +Display names must be unique and without spaces. *HTML display* mode shows only components +and properties supported in HTML; switching it off keeps unsupported values. + +**Classes and objects (ch. 5)** +- Trigger group: e.g. `ONE_SECOND`, a permanent 1-second trigger. A class can also be + triggered by item changes. +- Class (traditional language): `CLASS ; PROLOG … SIGNAL := ""; BODY + METHOD ; BODY … ENDMETHOD ; ENDCLASS ;`. After *Compile*, check the *Listing* tab + for errors. `ATTRIBUTE` and `PROMPT` lines define values asked when an object is created. +- Object: created in a section, from a class, with values for the prompted attributes. +- Symbol linked to a class (*PROCESS Service class*); on a display set the symbol's `object` + property to the object. Properties are linked to items/signals on the *Connection* sheet, + with a transformation (e.g. *Linear*); buttons use *Update item/parameter* actions. +- Test in the Operator Interface by typing the display name in the title bar. + +**I/O (ch. 6)**: define in order **line → station → (scan type) → point**, then connect items +to points. Example: Modbus `LINE1` / `STATION1` / scan type `FAST` / `POINT1`. + +**Alarms (ch. 7)**: current, historical and shelved alarm overviews. Item status → alarm +state (Normal, Alarm 1–3) system-wide, or per item (overrides). Acknowledgement types are +matrices of state transitions (automatic/manual). Delay time, repeat time (after delay), +first-out groups, collection groups, alarm selection areas (ASA, filter expressions), areas +of interest (AOI), notification by e-mail/SMS (users with schedules, destinations tied to an +ASA). + +**Reports (ch. 8)**: defined with a name, destination, RQL query and layout; generated ad hoc, +on a schedule, or on an item event (with delay). Destinations: `DEFAULT`, `PRINTER_1`, +`NONE` (keep on disk), `ALARMS`, `AUDIT_TRAIL`, `MESSAGES`, `SCREEN_CAPTURE`; only `DEFAULT` and +`PRINTER_1` print by default. Destinations use primary/secondary devices with a policy +(automatic, both, none). + +**Audit trail (ch. 9)**: stored in dataset `AUDIT_TRAIL`, storage group `ADT`; events are +named `...`, e.g. `ITEM.VALUE.MODIFY.HMI`; records +cannot be deleted except by deleting storage units. + +**RDBMS exposure (ch. 10)**: copies CI Server data (`ITEM_VALUES` aggregated per interval, +`ITEM_HISTORY` with a mandatory filter, `ITEM_INPUTS` for writes back, or any dataset on +change) into SQL tables. Configure the connection string or system DSN in `dbc.sup`; with +Windows authentication add `CIX_PROCESS` to SQL Server (db_owner). + +**Other**: Item search (wildcards, copy/drag to Excel or Trend); Excel Add-in reports; +history storage groups and archiving (phase 9). + +## Verified on CI-Eng-Sample (command-line equivalents) + +| Tutorial step | Done with | Result | +|---|---|---| +| Sections and items (3.2) | `dssqld -i` `SECTION_DF`, `ITEM_DF` | loaded | +| Sub-items (3.2.3) | `SUB_ITEM_DF` | Min-Max keeps the maximum; **Integrator adds value × seconds; `TIME_UNIT` has no effect** | +| Block item (3.3) | `dssqld -m` `ITEM_DF` `BLOCKED` 1/0 | option flag `blk` (status stays 9); writes without `-o` are **silently ignored**; after unblocking the flag `ublk` appears | +| Trigger group (5.1) | `TRIGGER_DF` (`TRIGGER_INTERVAL` "1 seconds") | loaded | +| Class (5.2) | `CLASS_DF` with `METHOD` memo and `COMPILE` 1 | compiled on load | +| Object (5.3) | `OBJECT_DF` (`NAME`, `CLASS`) | runs: `DEMO.COUNTER` counts 1…100 every second | diff --git a/knowledge/progress.md b/knowledge/progress.md index e45412e..7a4d745 100644 --- a/knowledge/progress.md +++ b/knowledge/progress.md @@ -31,9 +31,9 @@ AID is not needed. |---|---|---|---| | 0 | IM 36K01A50 | Release Information | summarized ([notes](manuals/IM36K01A50-01EN.md)) | | 1 | IM 36K10J10 | System Design/Management | done except migration (phase 6) and debugging tools; skill `system-management` ([notes](manuals/IM36K10J10-01EN.md)) | -| 2 | IM 36K01C10 | CI Server Setup | summarized ([notes](manuals/IM36K01C10-01EN.md)); skill `installation-security` (draft) | -| 2 | IM 36K01C30 | Security Guide | summarized ([notes](manuals/IM36K01C30-01EN.md)); skill `installation-security` (draft) | -| 3 | IM 36K10G10 | Tutorial | not started | +| 2 | IM 36K01C10 | CI Server Setup | summarized ([notes](manuals/IM36K01C10-01EN.md)); skill `installation-security` | +| 2 | IM 36K01C30 | Security Guide | summarized ([notes](manuals/IM36K01C30-01EN.md)); skill `installation-security` | +| 3 | IM 36K10G10 | Tutorial | summarized ([notes](manuals/IM36K10G10-01EN.md)); command-line equivalents practiced on CI-Eng-Sample | | 4 | IM 36K10R10 | CI Portal Setup | not started | | 4 | IM 36K10R20 | Setup File Editor | not started | | 5 | IM 36K10C10 | Engineering Module - I/O Processes | not started | @@ -90,10 +90,16 @@ now come before classes and objects (phase 6), and the other interfaces follow a | J10 | Backup of `tls` folders | not practiced | n/a | Plan only; the actual backup tool is site-specific. | | J10 | Migration between systems (§5.6) | not practiced | pending | Needs engineered data; revisit after phase 6. | | J10 | Tuning checks (read-only) ([task](../.claude/skills/system-management/tasks/tuning-checks.md)) | passed | n/a | Read `dur.sup` (max processes 250), `itm.sup` (item pool 650,000 KB) and the automatic health snapshots `tls\log\smd_*.log` (common memory free, queue use per process, lock collisions). Debug launchers and interactive debuggers not practiced. | -| C10/C30 | Setup check script `tools/setup_check.ps1` ([task](../.claude/skills/installation-security/tasks/setup-check.md)) | practiced, awaiting confirmation | n/a | Read-only; 16 OK / 5 CHECK / 15 DIFF on the Win10 Pro test PC. | -| C10 | Read `ci_start.log` and web ports (`jwuiisg.sup`) | practiced, awaiting confirmation | n/a | All services started; SSL error [ISS-008](issues.md). | +| C10/C30 | Setup check script `tools/setup_check.ps1` ([task](../.claude/skills/installation-security/tasks/setup-check.md)) | passed | n/a | Read-only; 16 OK / 5 CHECK / 15 DIFF on the Win10 Pro test PC (kept as dev PC by decision). | +| C10 | Read `ci_start.log` and web ports (`jwuiisg.sup`) | passed | n/a | All services started; SSL error [ISS-008](issues.md). | | C10 | Start / stop CI Server | passed (phase 1) | n/a | Via the CI Service (elevated). Start-menu shortcuts not used. | | C10 | New install, reinstall, upgrade, uninstall, licence | not practiced | n/a | Would reinstall or change the test system; only the installed R1.03 is available. Skipped. | -| C10 | Windows settings changes (power, virtual memory, Defender, updates, …) | not practiced | n/a | Changes the test PC's OS; needs the user's go-ahead. Skipped. | +| C10 | Windows settings changes (power, virtual memory, Defender, updates, …) | not practiced | n/a | Test PC kept as a development PC (user decision 2026-09-30); not applied. | | C10 | Vnet/IP drivers / Vnet/IP Interface Package | not practiced | n/a | No Vnet/IP card; not supported on Windows 10 Pro. | | C30 | IT Security Tool, Domain Link Management, account utilities | not practiced | n/a | Not installed and not supported on Windows 10 Pro. | +| G10 | Sub-items: Integrator, Min-Max (`SUB_ITEM_DF`) | practiced, awaiting confirmation | added (awaiting confirmation) | Integrator adds value × seconds; `TIME_UNIT` ignored. | +| G10 | Block / unblock an item (`ITEM_DF.BLOCKED` via `dssqld -m`); write with `itmval -o` | practiced, awaiting confirmation | passed (awaiting confirmation) | `blk` flag, writes without `-o` silently ignored; `ublk` after unblock ([ISS-001](issues.md)). | +| G10 | Trigger group, class (compile on load), object via quick load | practiced, awaiting confirmation | added (awaiting confirmation) | `DEMO.COUNTER` counts every second; full remove/load cycle clean. | +| G10 | Authorization group and user creation | not practiced | n/a | Creates CI Server login accounts; left for the user or phase 5. | +| G10 | Displays, symbols, Operator Interface test | not practiced | pending | GUI (Edit Module); phase 10. | +| G10 | Lines / stations / points, alarms, reports, audit, RDBMS, history | not practiced | pending | Covered in their own phases (5–12). | From edb9948891a7ae341611facac2048a80aebfb1ae Mon Sep 17 00:00:00 2001 From: cliu Date: Wed, 30 Sep 2026 15:56:49 +1000 Subject: [PATCH 3/3] Record confirmed tutorial tasks in item and class/object skills Co-Authored-By: Claude Opus 5.5 --- .../skills/class-object-engineering/SKILL.md | 20 ++++++ .../tasks/load-class-object.md | 68 +++++++++++++++++++ .claude/skills/item-engineering/SKILL.md | 23 +++++++ .../item-engineering/tasks/block-item.md | 36 ++++++++++ .../item-engineering/tasks/sub-items.md | 37 ++++++++++ knowledge/progress.md | 6 +- 6 files changed, 187 insertions(+), 3 deletions(-) create mode 100644 .claude/skills/class-object-engineering/SKILL.md create mode 100644 .claude/skills/class-object-engineering/tasks/load-class-object.md create mode 100644 .claude/skills/item-engineering/SKILL.md create mode 100644 .claude/skills/item-engineering/tasks/block-item.md create mode 100644 .claude/skills/item-engineering/tasks/sub-items.md diff --git a/.claude/skills/class-object-engineering/SKILL.md b/.claude/skills/class-object-engineering/SKILL.md new file mode 100644 index 0000000..53826cd --- /dev/null +++ b/.claude/skills/class-object-engineering/SKILL.md @@ -0,0 +1,20 @@ +--- +name: class-object-engineering +description: >- + CI Server R1.03 PROCESS Service classes, objects and trigger groups. Use when the user wants + to create a trigger group, write or compile a class (traditional language), create objects + from a class, or load classes and objects with quick load files. Sources IM 36K10G10-01EN + (Tutorial) and IM 36K10J10-01EN; to be extended with IM 36K10L10, P10 and P11 in phase 6. +--- + +# Class and object engineering (R1.03) + +Background: `knowledge/manuals/IM36K10G10-01EN.md` (chapter 5) and +`knowledge/manuals/IM36K10J10-01EN.md` (sections 2.4 and 5.3). Known issues for PROCESS +Service: `knowledge/manuals/IM36K01A50-01EN.md`. + +Rules: run `system-check` first; creating classes and objects changes the running system. + +| Task | File | Status | +|---|---|---| +| Trigger group, class (compiled on load) and object via quick load | `tasks/load-class-object.md` | verified | diff --git a/.claude/skills/class-object-engineering/tasks/load-class-object.md b/.claude/skills/class-object-engineering/tasks/load-class-object.md new file mode 100644 index 0000000..9aca5ba --- /dev/null +++ b/.claude/skills/class-object-engineering/tasks/load-class-object.md @@ -0,0 +1,68 @@ +--- +task: Create a trigger group, class and object with quick load files +version: R1.03 +source: IM 36K10G10-01EN §5.1–5.3; IM 36K10J10-01EN §5.6; practiced with CI-Eng-Sample 2026-09-30 +status: verified +--- + +# Trigger group, class and object via quick load + +Load in this order (each with `dssqld -i .qli -l .qlo`, check `Errors` = 0); +remove in reverse (object, class, trigger group) with `NAME`-only files and `dssqld -r`. + +**1. Trigger group** (`TRIGGER_DF`, name max 16 characters): + +``` +@FIELDS +NAME,DESCRIPTION,TRIGGER_INTERVAL + +@TRIGGER_DF +"CIENG_1S","CI-Eng-Sample one second trigger","1 seconds" +``` + +**2. Class** (`CLASS_DF`, name max 16 characters). The source goes in the `METHOD` memo field, +between `@"` and `"@` on their own lines; `COMPILE` 1 compiles it on load; `TRIGGER_1` +attaches a trigger group: + +``` +@FIELDS +NAME,DESCRIPTION,PF_LANGUAGE,TRIGGER_1,COMPILE,LISTING_WANTED,METHOD + +@CLASS_DF +"CIENG_INCR","Count CI-Eng-Sample.DEMO.COUNTER 1..100","Traditional","CIENG_1S",1,1,\ +@" +CLASS CIENG_INCR; + PROLOG + SIGNAL INPUT := "CI-Eng-Sample.DEMO.COUNTER"; + BODY + METHOD UP_AND_DOWN; + BODY + IF (INPUT >= 100) THEN + INPUT := 0; + ENDIF; + INPUT := INPUT + 1; + ENDMETHOD UP_AND_DOWN; +ENDCLASS CIENG_INCR; +"@ +``` + +The item a `SIGNAL` names must exist first (or be created by the class with `FROM … MAKE`). + +**3. Object** (`OBJECT_DF`): full name in its section, and the class: + +``` +@FIELDS +NAME,DESCRIPTION,CLASS + +@OBJECT_DF +"CI-Eng-Sample.DEMO.INCR1","Counts DEMO.COUNTER every second","CIENG_INCR" +``` + +## Check + +Run `itmval -g -n CI-Eng-Sample.DEMO.COUNTER` a few seconds apart: the value rises by one per +second. To inspect a class, export it with a filter file (`@SELECT`, then +`'NAME = ""'`, then `@CLASS_DF`). + +Example files: `examples/CI-Eng-Sample/05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli`, +`86_` to `88_remove_*.qli`. diff --git a/.claude/skills/item-engineering/SKILL.md b/.claude/skills/item-engineering/SKILL.md new file mode 100644 index 0000000..5ac92fa --- /dev/null +++ b/.claude/skills/item-engineering/SKILL.md @@ -0,0 +1,23 @@ +--- +name: item-engineering +description: >- + CI Server R1.03 sections, items and sub-items. Use when the user wants to create or change + sections, items or sub-items (integrator, min-max, pulse, rate-of-change), set limits, + scale or value format, block or unblock items or sections, or understand item status and + option flags. Sources IM 36K10G10-01EN (Tutorial); to be extended with IM 36K10C10 in phase 5. +--- + +# Item engineering (R1.03) + +Background: `knowledge/manuals/IM36K10G10-01EN.md` (chapter 3). Bulk creation of sections and +items uses quick load files: skill `system-management`, task `load-remove-records.md`. +Reading and writing values: `system-management` task `read-write-item.md`. + +Rules: +- Run the `system-check` skill first; follow the user's chosen way of working for any change. +- Names: `Section.Sub-section.Item`, max 255 bytes, no `:` or `.` inside a name, case insensitive. + +| Task | File | Status | +|---|---|---| +| Sub-items (integrator, min-max) | `tasks/sub-items.md` | verified | +| Block / unblock an item; write to a blocked item | `tasks/block-item.md` | verified | diff --git a/.claude/skills/item-engineering/tasks/block-item.md b/.claude/skills/item-engineering/tasks/block-item.md new file mode 100644 index 0000000..581cd3e --- /dev/null +++ b/.claude/skills/item-engineering/tasks/block-item.md @@ -0,0 +1,36 @@ +--- +task: Block / unblock an item and write to a blocked item +version: R1.03 +source: IM 36K10G10-01EN §3.3, §3.4; practiced with CI-Eng-Sample 2026-09-30 +status: verified +--- + +# Block / unblock an item + +A blocked item is not updated (e.g. during device maintenance). Blocking can be done per item, +sub-item or section; sub-items of a blocked item keep working. **Changes live behaviour:** +follow the user's chosen way of working. + +Block (`BLOCKED` 1) or unblock (`BLOCKED` 0) with an update file and `dssqld -m`: + +``` +@FIELDS +NAME,BLOCKED + +@ITEM_DF +"
.",1 +``` + +``` +dssqld -m block.qli -l block.qlo +``` + +(Engineering Module: right-click the item or section › *Block/Unblock*.) + +## Behaviour (verified on `CI-Eng-Sample.TANK1.INFLOW`) + +- Blocked: option flag `blk` appears in `itmval -g`; the status number is unchanged (stayed 9). +- `itmval -p -n -v ` on a blocked item is **silently ignored** (no error, value + unchanged; `knowledge/issues.md` ISS-011). Add `-o` to overwrite: + `itmval -p -n -v -o`. +- After unblocking, `blk` is replaced by `ublk` (meaning not yet confirmed, see ISS-001). diff --git a/.claude/skills/item-engineering/tasks/sub-items.md b/.claude/skills/item-engineering/tasks/sub-items.md new file mode 100644 index 0000000..1bd6453 --- /dev/null +++ b/.claude/skills/item-engineering/tasks/sub-items.md @@ -0,0 +1,37 @@ +--- +task: Create sub-items (integrator, min-max) +version: R1.03 +source: IM 36K10G10-01EN §3.1.5, §3.2.3; practiced with CI-Eng-Sample 2026-09-30 +status: verified +--- + +# Sub-items + +A sub-item hangs under an item (`
..`) and processes the main item's value. +Types: `Integrator`, `Min-Max`, `Pulse`, `Rate-of-Change`, `Typeless`. Sub-items cannot connect +to equipment, cannot have sub-items, and are **not** blocked when the main item is blocked. + +Quick load (`SUB_ITEM_DF`; the main item must exist): + +``` +@FIELDS +NAME,DESCRIPTION,SUB_TYPE,TIME_UNIT,MIN_MAX + +@SUB_ITEM_DF +"CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS","Pump 1 running time (seconds)","Integrator","","" +"CI-Eng-Sample.TANK1.LEVEL.MAX","Tank 1 maximum level","Min-Max","","Maximum" +``` + +Load with `dssqld -i .qli -l .qlo`; remove with a `NAME`-only file and `dssqld -r` +(before removing the main item). + +## Behaviour (verified) + +- **Integrator** adds *value × seconds*: with the main item at 1 it grows by 1 per second. + `TIME_UNIT` (e.g. `Hour`) made no difference (`knowledge/issues.md` ISS-010); to show hours, + divide by 3600 where the value is used. +- **Min-Max** with `MIN_MAX` = `Maximum` (or `Minimum`) keeps the highest (lowest) value + written to the main item: writing 30, 70, 50 gave 70. +- `TIME_UNIT` (Second, Minute, Hour, Day) belongs to Rate-of-Change (from docs, not practiced). + +Example files: `examples/CI-Eng-Sample/02b_sub_item_df.qli`, `90b_remove_sub_item_df.qli`. diff --git a/knowledge/progress.md b/knowledge/progress.md index 7a4d745..342cea7 100644 --- a/knowledge/progress.md +++ b/knowledge/progress.md @@ -97,9 +97,9 @@ now come before classes and objects (phase 6), and the other interfaces follow a | C10 | Windows settings changes (power, virtual memory, Defender, updates, …) | not practiced | n/a | Test PC kept as a development PC (user decision 2026-09-30); not applied. | | C10 | Vnet/IP drivers / Vnet/IP Interface Package | not practiced | n/a | No Vnet/IP card; not supported on Windows 10 Pro. | | C30 | IT Security Tool, Domain Link Management, account utilities | not practiced | n/a | Not installed and not supported on Windows 10 Pro. | -| G10 | Sub-items: Integrator, Min-Max (`SUB_ITEM_DF`) | practiced, awaiting confirmation | added (awaiting confirmation) | Integrator adds value × seconds; `TIME_UNIT` ignored. | -| G10 | Block / unblock an item (`ITEM_DF.BLOCKED` via `dssqld -m`); write with `itmval -o` | practiced, awaiting confirmation | passed (awaiting confirmation) | `blk` flag, writes without `-o` silently ignored; `ublk` after unblock ([ISS-001](issues.md)). | -| G10 | Trigger group, class (compile on load), object via quick load | practiced, awaiting confirmation | added (awaiting confirmation) | `DEMO.COUNTER` counts every second; full remove/load cycle clean. | +| G10 | Sub-items: Integrator, Min-Max (`SUB_ITEM_DF`) ([task](../.claude/skills/item-engineering/tasks/sub-items.md)) | passed | passed | Integrator adds value × seconds; `TIME_UNIT` ignored. | +| G10 | Block / unblock an item (`ITEM_DF.BLOCKED` via `dssqld -m`); write with `itmval -o` ([task](../.claude/skills/item-engineering/tasks/block-item.md)) | passed | passed | `blk` flag, writes without `-o` silently ignored; `ublk` after unblock ([ISS-001](issues.md)). | +| G10 | Trigger group, class (compile on load), object via quick load ([task](../.claude/skills/class-object-engineering/tasks/load-class-object.md)) | passed | passed | `DEMO.COUNTER` counts every second; full remove/load cycle clean. | | G10 | Authorization group and user creation | not practiced | n/a | Creates CI Server login accounts; left for the user or phase 5. | | G10 | Displays, symbols, Operator Interface test | not practiced | pending | GUI (Edit Module); phase 10. | | G10 | Lines / stations / points, alarms, reports, audit, RDBMS, history | not practiced | pending | Covered in their own phases (5–12). |