.claude/skills/data-access/SKILL.md

@@ -1,39 +0,0 @@
----
-name: data-access
-description: >-
-  CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to
-  connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points,
-  certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC
-  DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints,
-  security policy, trusting client certificates, UaExpert), check why an OPC connection fails
-  (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM
-  tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server
-  (odbsrv, port 1583, SSL certificate). Sources IM 36K10L45-01EN, IM 36K10E20-01EN.
----
-
-# Data access: OPC and ODBC (R1.03)
-
-Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server,
-setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment
-lines/stations/points in general: skill `equipment`.
-
-Rules:
-- Run `system-check` first; follow the user's chosen way of working.
-- **Trusting certificates is the user's decision.** Show the certificate (folder, file name,
-  common name) and let the user trust it (Engineering Module or moving the file); do not move
-  certificate files yourself.
-- Making items OPC visible / writable exposes them to every OPC client on the network: only
-  with the user's approval, and prefer read-only.
-- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
-  node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine.
-- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and
-  a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`).
-
-| Task | File | Status |
-|---|---|---|
-| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified |
-| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs |
-| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified |
-| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
-| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) |
-| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs |

.claude/skills/data-access/tasks/access-checks.md

@@ -1,24 +0,0 @@
----
-task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server)
-version: R1.03
-source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01
-status: verified
----
-
-# ACCESS Service checks (read-only)
-
-| Check | How | Test system result |
-|---|---|---|
-| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running |
-| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** |
-| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) |
-| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing |
-| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on |
-| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` |
-| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` |
-| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback |
-| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | |
-
-Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
-with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
-(unencrypted ODBC traffic — a security decision), then restart CI Server.

.claude/skills/data-access/tasks/opcua-client.md

@@ -1,128 +0,0 @@
----
-task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
-version: R1.03
-source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
-status: verified
----
-
-# OPC UA client to an OPC UA server
-
-Worked example: CI-Eng-Sample station `CIENG_UA`, CI Server's OPC UA client reading
-`CI-Eng-Sample.TANK1.LEVEL` back through CI Server's **own** OPC UA server
-(`examples/CI-Eng-Sample/12_`–`15_*.qli`, removal `76_`–`78_`). For a real server, replace the
-endpoint, security settings and node IDs.
-
-## 1. Server side: make the data visible
-
-On the CI Server OPC UA server an item is reachable only when the item has **OPC visible** and
-**Read** (Write to allow writing) and every parent section is OPC visible
-(`12_opc_visible_df.qli`, loaded with `dssqld -m`):
-
-```
-@FIELDS
-NAME,OPC_VISIBLE
-
-@SECTION_DF
-"CI-Eng-Sample",1
-"CI-Eng-Sample.TANK1",1
-
-@FIELDS
-NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE
-
-@ITEM_DF
-"CI-Eng-Sample.TANK1.LEVEL",1,1,0
-```
-
-Visible without Read: the item shows when browsing, but browsing into it fails
-(`UncertainNotAllNodesAvailable`, client message `OPXC-E-BRW_NODE`; verified). By the manual,
-Read is also what allows reading the value.
-These flags also apply to the OPC DA and A&E servers.
-
-## 2. Client configuration (quick load, in this order)
-
-1. **Line** (`OPCUAC_LINE_DF`): loading it creates and starts the client process
-   `EQUIPMENT_MAN` (must start with `OPX`, ≤ 11 characters) — wait ~10 s before the station.
-   ```
-   "CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"
-   ```
-2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name
-   `<station>:<subscription>`), **points** (`OPCUAC_POINT_DF`, name `<station>:<point>`) —
-   see `14_opcua_station_df.qli`:
-   - Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`),
-     `MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`,
-     `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 =
-     connected). `SERVER_01_NAME`/`_URI` may stay empty.
-   - Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000.
-   - Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`),
-     `OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`,
-     `GUID`), `OPC_NODE_ID`.
-3. **Items** (`ITEM_DF` with `STATION` and `POINT`), e.g. `CI-Eng-Sample.UA.LEVEL_COPY` →
-   `CIENG_UA`, `LEVEL`.
-
-## 3. Node IDs
-
-| Target | Namespace | Type | Node ID |
-|---|---|---|---|
-| Value of a CI Server item (by name — survives recreating the item) | `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` | STRING | `{"0":"Value","itnm":"<Section>.<Tag>"}` |
-| Value of a CI Server item (by namespace id) | same | STRING | `{"0":"Value","nsid":"<n>"}` |
-| Server state (any OPC UA server; good connection test, 0 = Running) | `http://opcfoundation.org/UA/` | NUMERIC | `2259` |
-
-In a `.qli` file double the quotes inside the field:
-`"{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"`.
-
-Pitfalls found on the test system:
-- Namespace `http://www.yokogawa.com/CI_Server/` (the one the manual shows) holds only the
-  **types**; with it the point is silently not monitored (ISS-032).
-- The Engineering Module's *Browse path* stops at the item and stores the **object**
-  (`{"nsid":"<n>"}`), which has no value: *Last value* stays empty, the item stays status 13.
-  Type the `Value` node ID by hand (ISS-033).
-- `nsid` numbers change when the item is deleted and created again (e.g. sample reload).
-
-A point that is not accepted shows `REVISED_SAMPLING_INTERVAL` 0 in `OPCUAC_POINT_DF` and the
-log line `Can't find Point [<point>] in subscription` when changed; a monitored point gets the
-revised interval (e.g. 1000).
-
-**Browse the server from the command line** (station connected): export `OPCUAC_TAG_DF` with
-a filter; start with an empty path, then `Objects`:
-
-```
-@SELECT
-'OPC_STATION_NAME = "CIENG_UA" and OPC_TAG_PATH = "Objects"'
-@OPCUAC_TAG_DF
-```
-
-Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper
-paths were not found yet (`Objects.CI-Eng-Sample` returned nothing).
-
-## 4. Certificate exchange (first connection; the user does it)
-
-| Step | Where it shows | What the user does |
-|---|---|---|
-| 1. Client rejects the server | `OPXC-E-CER_NO_TRU … BadCertificateUntrusted` in `umhlog.log`; file `<thumbprint>.der` in `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` | Trust it: Engineering Module *OPC UA Client → Certificates → Rejected* → *Trusted*, or move the file to `…\pkiclient\trusted\certs` |
-| 2. Server rejects the client | client log `BadSecurityChecksFailed`; file `CI_SERVER_OPCUA_CLIENT_<PROCESS> [<thumbprint>].der` in `…\pki\opxuas\pkiserver\rejected` (folder created now) | Move it to `…\pki\opxuas\pkiserver\trusted\certs` |
-
-PowerShell: file names with `[ ]` need `-LiteralPath`, otherwise `Move-Item` silently does
-nothing:
-
-```powershell
-Move-Item -LiteralPath "<rejected folder>\<file>.der" -Destination "<trusted folder>\"
-```
-
-The client retries every ~35 s (`OPXC_STATION_CON_TRY_INTERVAL` 30 s); then `OPXC-I-SRV_CONN`
-and the status item goes to 1. Certificates and trust stay when the line is removed and loaded
-again (verified: reload connected within 5 s without a new exchange). For an external server,
-its certificate arrives the same way; the client certificate
-(`…\pkiclient\own\certs\<host>_<PROCESS>.der`) must be trusted on that server.
-
-## 5. Check
-
-- `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9;
-  `UA.LEVEL_COPY` follows `TANK1.LEVEL` within ~1 s (verified 55, 62.5, 71, 33, 44.4).
-- Client log: `%TLS_LOG_PATH%\<PROCESS>.log` (`Successfully connected station`, errors with
-  status codes); server logs `OPXUAS.log`, `OpxUas_Sdk.log` (`CreateMonitoredItems`).
-- Off-scan/on-scan: `OPCUAC_STATION_DF` `ON_SCAN` 0/1 with `dssqld -m` disconnects/reconnects.
-
-## 6. Remove
-
-Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the
-client process). Reset the OPC flags only if they were not there before.

.claude/skills/equipment/SKILL.md

@@ -31,5 +31,4 @@ Rules:
 | CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) |
 | Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified |
 | Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
-| OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) |
 | Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |

.claude/skills/installation-security/tasks/setup-check.md

@@ -43,7 +43,4 @@ Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROC
 Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
 plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
 disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error
-(`InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`): the ODBC server `odbsrv`
+(`knowledge/issues.md` ISS-008).
-has `USESSL = YES` but no certificate in `%TLS_ROOT_PATH%\tls\pki\odbsrv`, so it exits at
-start (harmless unless ODBC is used; fix in skill `data-access`, task `access-checks.md`;
-`knowledge/issues.md` ISS-008).

.claude/skills/system-check/SKILL.md

@@ -77,12 +77,6 @@ prompt. Setup files (`*.sup`) are plain text (CRLF); edit them with the Setup Fi
   (elevated): `Stop-Service StartCIServer` then `Start-Service StartCIServer`. Before a long
   task on an unlicensed system, note the start time (`(Get-Process ciserv).StartTime`) and
   restart first if the hour is nearly up.
-  Time left is in the health snapshots: `License time left : <s>` in
-  `%TLS_LOG_PATH%\smd_<node>_LOW_smdsnp_general.log` (3600 s after a start, −600 per 10 min);
-  `*** license problem : 3 ***` once it has run out. The count pauses while the PC sleeps
-  (observed 2026-10-01: a run started 17:25 ran out at 09:52 the next morning after a sleep);
-  some processes (e.g. `umh`) stay attached, but `dssqld`/`itmval` fail and the log shows
-  `ISF-F-LIC_PROB, DATABASE Service is not licensed`.
 
 ## 4. Time synchronization
 

.claude/skills/system-management/SKILL.md

@@ -6,9 +6,7 @@ description: >-
   (dssqld, .qli), create sections or items in bulk, read or write item values or limits (itmval), load or import history,
   check database consistency (dsschk), monitor processes/CPU/disk/network, back up or migrate
   a system, tune or debug CI Server, or plan a system layout (standalone, separate portal, HAC,
-  host-to-host, enterprise) or time synchronization, check whether a CI Server process is
+  host-to-host, enterprise) or time synchronization. Source IM 36K10J10-01EN.
-  running (durwfp), stop a single process (durstp), read the message log (umhlog), or check
-  BUS Service queues (adaptive queues, dur.sup). Sources IM 36K10J10-01EN, IM 36K10L30-01EN.
 ---
 
 # System management (R1.03)
@@ -33,4 +31,3 @@ Rules for every task:
 | Monitor CPU, disk, network, processes; run a command on an item change | `tasks/monitoring-processes.md` | verified |
 | Database consistency check (`dsschk`) | `tasks/consistency-check.md` | verified (check only) |
 | Tuning checks: limits and health snapshots | `tasks/tuning-checks.md` | verified (read-only) |
-| BUS Service utilities: is a process attached (`durwfp`), stop one process (`durstp`), message tools, adaptive queues | `tasks/bus-utilities.md` | verified (`durwfp`, read-only checks); message tools fail (ISS-030) |

.claude/skills/system-management/tasks/bus-utilities.md

@@ -1,51 +0,0 @@
----
-task: BUS Service utilities - process checks, stopping single processes, message tools, adaptive queues
-version: R1.03
-source: IM 36K10L30-01EN §1, §5, §6, §10, §14; checked on the test system 2026-10-01
-status: verified for durwfp and the read-only setup file checks; umhman, umhtestprog, umhmsg fail on the test system (ISS-030)
----
-
-# BUS Service utilities
-
-Background: `knowledge/manuals/IM36K10L30-01EN.md`.
-
-## Is a CI Server process attached?
-
-`durwfp -p <DUR name> -t 0` → exit code **0** = attached (running), **1** = not. Without
-`-t 0` it waits up to 60 s for the process to appear; `-e` waits for it to go away. Verified:
-`umh`, `opcman`, `durm_1` → 0; unknown name → 1. Bash: `durwfp -p opcman -t 0; echo $?`.
-DUR names are those given with `-n` (e.g. `OPXCIENG`, `EQPCIENG`, `opxuas`).
-
-## Stop or kill one process (only with the user's approval)
-
-`durstp -m -p <name>` sends a stop message (clean stop); `durstp -m -k -t 10 -p <name>` stops,
-then kills after 10 s. `*` wildcards stop many processes (`-p alm\*`). Never `durstp -k -p \*`
-(kills `durtim` and leaves DUR memory locked). Restart a process by hand with
-`<exe> -n <name>` from `tls\exe` or by restarting CI Server.
-
-## Messages
-
-- Message log: `%TLS_LOG_PATH%\umhlog.log` (`--> From: <PROCESS> (<node>) on <time>`, then
-  `FAC-S-CODE, text` lines). `UMH Message Text Error: Message number <hex> (…)` = the text
-  could not be formatted (e.g. `%` in a PRINT text, ISS-025).
-- `umhman` (hex code → text), `umhtestprog` (test the log path) and `umhmsg <hex> [<var>
-  <value>]` (log a message from a script) **did not work on the test system**: `umhman`
-  crashes with redirected input (run it interactively), `umhtestprog` crashes, `umhmsg` stops
-  with `license expired` on the unlicensed node (ISS-030).
-
-## Adaptive queues (read-only check)
-
-`tls\sup\dur.sup`, tab *Adaptive queues*: `ADAPTIVE_QUEUE_SETS = <process>, <percent>`
-(wildcard `*` allowed, max 40 %). Installed: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`,
-`WFLIDI`, `WFLADI`, `ITHEIX`, `ITHSER` 2, `DSSSDA*`, `DSSEVT*`, `OPCEXE` 1. Add entries for
-new busy processes (extra executors, equipment managers, custom processes); `OPCEXE` without
-`*` may not cover the installed `OPCEXE1`…`4` (ISS-026). Changing `dur.sup` needs admin and a
-restart (skill `portal-setup`). Queue use per process: health snapshots
-(`tuning-checks.md`) or the performance monitor (*Minimum/Maximum/Current KB*, high queue
-100 % = the queue had to grow → raise its size).
-
-## Node links (MDUR)
-
-`tls\sup\durm_<line>_udp.sup` and `tls\com\durm_start.cmd`; single-node installs still run
-`durm_1` (`durm_1_udp.sup`: line 1, quality 500, port 17001). Multi-node set-up is in the L30
-summary §2; not practiced (one node).

examples/CI-Eng-Sample/01_section_df.qli

@@ -16,4 +16,3 @@ NAME,SECTION_PATH,SECTION_NAME,DESCRIPTION
 "CI-Eng-Sample.SYSTEM","CI-Eng-Sample","SYSTEM","Sample system monitoring"
 "CI-Eng-Sample.DEMO","CI-Eng-Sample","DEMO","Tutorial examples (class/object)"
 "CI-Eng-Sample.PLC1","CI-Eng-Sample","PLC1","Modbus loopback station CIENG_PLC"
-"CI-Eng-Sample.UA","CI-Eng-Sample","UA","OPC UA loopback station CIENG_UA"

examples/CI-Eng-Sample/02_item_df.qli

@@ -21,4 +21,3 @@ LOW_LOW_LIMIT,LOW_LIMIT,HIGH_LIMIT,HIGH_HIGH_LIMIT,SCALE_LOW_LIMIT,SCALE_HIGH_LI
 "CI-Eng-Sample.SYSTEM.PROC_ALM","ALARM process (alm) running, from intmon","Integer","9",0,0,0,0,0,1
 "CI-Eng-Sample.DEMO.COUNTER","Counter 1..100 driven by object DEMO.INCR1","Integer","999",0,0,0,0,0,100
 "CI-Eng-Sample.PLC1.COMM_OK","Station CIENG_PLC communication (1 = good), status item","Boolean","",0,0,0,0,0,0
-"CI-Eng-Sample.UA.COMM_OK","Station CIENG_UA communication (1 = good), status item","Boolean","",0,0,0,0,0,0

examples/CI-Eng-Sample/12_opc_visible_df.qli

@@ -1,20 +0,0 @@
-@LANGUAGE
-ENGLISH
-
-@VERSION
-1.03.00
-
-! Make sections and TANK1.LEVEL visible (read-only) to OPC clients (OPC UA/DA/A&E servers). Load with dssqld -m.
-! Every parent section must be OPC visible too.
-@FIELDS
-NAME,OPC_VISIBLE
-
-@SECTION_DF
-"CI-Eng-Sample",1
-"CI-Eng-Sample.TANK1",1
-
-@FIELDS
-NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE
-
-@ITEM_DF
-"CI-Eng-Sample.TANK1.LEVEL",1,1,0

examples/CI-Eng-Sample/13_opcua_line_df.qli

@@ -1,12 +0,0 @@
-@LANGUAGE
-ENGLISH
-
-@VERSION
-1.03.00
-
-! OPC UA client line; loading it creates and starts the client process OPXCIENG (name must start with OPX)
-@FIELDS
-NAME,DESCRIPTION,EQUIPMENT_MAN
-
-@OPCUAC_LINE_DF
-"CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"

examples/CI-Eng-Sample/14_opcua_station_df.qli

@@ -1,27 +0,0 @@
-@LANGUAGE
-ENGLISH
-
-@VERSION
-1.03.00
-
-! OPC UA loopback: CI Server OPC UA client -> own OPC UA server (opc.tcp://localhost:34493)
-! First connection needs a one-time certificate exchange (see README).
-! CI Server entities: namespace urn:Yokogawa:CI_SERVER_OPC_UA_SERVER, string node id {"0":"Value","itnm":"<item>"}
-@FIELDS
-NAME,DESCRIPTION,LINE,USER_ANONYMOUS,MSG_SECURITY_01_MODE,MSG_SECURITY_01_POLICY,SERVER_01_ENDPOINT,STATUS_ITEM
-
-@OPCUAC_STATION_DF
-"CIENG_UA","Loopback to own OPC UA server","CIENG_UA_LINE",1,"SignAndEncrypt","Basic256Sha256","opc.tcp://localhost:34493","CI-Eng-Sample.UA.COMM_OK"
-
-@FIELDS
-NAME,STATION_NAME,SUBSCRIPTION_NAME,REQUESTED_PUBLISH_INTERVAL,DESCRIPTION
-
-@OPCUAC_SUBSCRIPTION_DF
-"CIENG_UA:CIENG_SUB","CIENG_UA","CIENG_SUB",1000,"1 s subscription"
-
-@FIELDS
-NAME,STATION,POINT,DESCRIPTION,SUBSCRIPTION,EXTERNAL_RELATION,OPC_NAMESPACE,OPC_NODE_ID_TYPE,OPC_NODE_ID
-
-@OPCUAC_POINT_DF
-"CIENG_UA:LEVEL","CIENG_UA","LEVEL","TANK1.LEVEL via own OPC UA server","CIENG_SUB","Input","urn:Yokogawa:CI_SERVER_OPC_UA_SERVER","STRING","{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"
-"CIENG_UA:SRV_STATE","CIENG_UA","SRV_STATE","Server/ServerStatus/State (0 = Running)","CIENG_SUB","Input","http://opcfoundation.org/UA/","NUMERIC","2259"

examples/CI-Eng-Sample/15_item_opcua_df.qli

@@ -1,13 +0,0 @@
-@LANGUAGE
-ENGLISH
-
-@VERSION
-1.03.00
-
-! Items connected to OPC UA points of station CIENG_UA
-@FIELDS
-NAME,DESCRIPTION,ITEM_REP,VALUE_FORMAT,STATION,POINT
-
-@ITEM_DF
-"CI-Eng-Sample.UA.LEVEL_COPY","TANK1.LEVEL read back through OPC UA","Real","999.9","CIENG_UA","LEVEL"
-"CI-Eng-Sample.UA.SRV_STATE","OPC UA server state (0 = Running)","Integer","9","CIENG_UA","SRV_STATE"

examples/CI-Eng-Sample/76_remove_item_opcua_df.qli

@@ -1,13 +0,0 @@
-@LANGUAGE
-ENGLISH
-
-@VERSION
-1.03.00
-
-! Remove items connected to OPC UA points
-@FIELDS
-NAME
-
-@ITEM_DF
-"CI-Eng-Sample.UA.LEVEL_COPY"
-"CI-Eng-Sample.UA.SRV_STATE"

examples/CI-Eng-Sample/77_remove_opcua_station_df.qli

@@ -1,25 +0,0 @@
-@LANGUAGE
-ENGLISH
-
-@VERSION
-1.03.00
-
-! Remove OPC UA points, subscription, station
-@FIELDS
-NAME
-
-@OPCUAC_POINT_DF
-"CIENG_UA:LEVEL"
-"CIENG_UA:SRV_STATE"
-
-@FIELDS
-NAME
-
-@OPCUAC_SUBSCRIPTION_DF
-"CIENG_UA:CIENG_SUB"
-
-@FIELDS
-NAME
-
-@OPCUAC_STATION_DF
-"CIENG_UA"

examples/CI-Eng-Sample/78_remove_opcua_line_df.qli

@@ -1,12 +0,0 @@
-@LANGUAGE
-ENGLISH
-
-@VERSION
-1.03.00
-
-! Remove the OPC UA client line (stops process OPXCIENG)
-@FIELDS
-NAME
-
-@OPCUAC_LINE_DF
-"CIENG_UA_LINE"

examples/CI-Eng-Sample/91_remove_item_df.qli

@@ -19,5 +19,4 @@ NAME
 "CI-Eng-Sample.SYSTEM.PROC_ALM"
 "CI-Eng-Sample.DEMO.COUNTER"
 "CI-Eng-Sample.PLC1.COMM_OK"
-"CI-Eng-Sample.UA.COMM_OK"
 "CI-Eng-Sample.TEMPLATES.TPL_REAL"

examples/CI-Eng-Sample/92_remove_section_df.qli

@@ -13,7 +13,6 @@ NAME
 "CI-Eng-Sample.PUMP1"
 "CI-Eng-Sample.SYSTEM"
 "CI-Eng-Sample.PLC1"
-"CI-Eng-Sample.UA"
 "CI-Eng-Sample.DEMO"
 "CI-Eng-Sample.TEMPLATES"
 "CI-Eng-Sample"

examples/CI-Eng-Sample/README.md

@@ -60,13 +60,6 @@ cmd /c "<repo>\examples\CI-Eng-Sample\remove.cmd"
 | `CIENG_MB_LINE` | Modbus line (TCP/IP) | Equipment manager `EQPCIENG` (created and started by loading the line) |
 | `CIENG_PLC` | Modbus station | Open Modbus/TCP to `localhost:5020`, unit 1, output method *On change and connect* |
 | `CIENG_SCAN1S` | Modbus scan type | 1000 ms |
-| `CI-Eng-Sample.UA` | Section | OPC UA loopback station |
-| `CI-Eng-Sample.UA.COMM_OK` | Item, Boolean | Status item of station `CIENG_UA` (1 = connected) |
-| `CI-Eng-Sample.UA.LEVEL_COPY` | Item, Real | `TANK1.LEVEL` read back through CI Server's own OPC UA server |
-| `CI-Eng-Sample.UA.SRV_STATE` | Item, Integer | OPC UA server state node (ns 0, i=2259), 0 = Running |
-| `CIENG_UA_LINE` | OPC UA client line | Client process `OPXCIENG` (created and started by loading the line) |
-| `CIENG_UA` | OPC UA station | `opc.tcp://localhost:34493`, Basic256Sha256 / SignAndEncrypt, anonymous; subscription `CIENG_SUB` (1 s); points `LEVEL`, `SRV_STATE` |
-| OPC visible | Flags | Sections `CI-Eng-Sample`, `TANK1` and item `TANK1.LEVEL` are OPC visible, item read-only (`12_opc_visible_df.qli`) |
 | `CIENG_VIEWER` | Authorization group | Read-only: `ITEM_READ`, `SECTION_READ`, `ALARM_CURRENT_READ`, `ALARM_CHRONO_READ`. No users are created by the sample. |
 
 Items created by objects (`TANK1.CALC.VOLUME`, `TANK1.JFLOW.sPerMin`) and their sections are
@@ -87,8 +80,6 @@ New items start with status 13 (`NOT INIT`) until a value is written.
 | `05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli` | Trigger group; classes (source in the `METHOD` memo, `@"` … `"@`, `COMPILE` 1; Traditional and Java); objects (`ATTR_VALUE_1` = prompt answer) |
 | `08_auth_group_df.qli` | Authorization group (`AUTH_GROUP_DF`) |
 | `09_modbus_line_df.qli`, `10_modbus_station_df.qli`, `11_item_eqp_df.qli` | Modbus line; station, scan type, points; items connected to points |
-| `12_opc_visible_df.qli` | OPC visible / read flags (loaded with `dssqld -m`) |
-| `13_opcua_line_df.qli`, `14_opcua_station_df.qli`, `15_item_opcua_df.qli` | OPC UA client line; station, subscription, points; connected items |
 | `equipment/eqpciengslv_start.cmd`, `_stop.cmd` | Start/stop the Modbus slave mirror (copy to `tls\com`) |
 | `80_`…`92_remove_*.qli` | Names to delete, in reverse order |
 | `load.cmd`, `remove.cmd` | Run the steps in the right order |
@@ -110,22 +101,6 @@ start eqpmdcslvtcp -n EQPMDCSLVTCP -p 5020
 Remove the two files from `tls\com` when the sample is removed. See skill `equipment`, task
 `modbus-station.md`.
 
-## OPC UA loopback (station CIENG_UA)
-
-`CIENG_UA` is CI Server's OPC UA client connected to CI Server's own OPC UA server, so no
-external server is needed. The **first** connection on a system needs a one-time certificate
-exchange, done by the user (skill `data-access`, task `opcua-client.md` §4):
-
-1. After loading, the client logs `OPXC-E-CER_NO_TRU`; trust the server certificate in
-   `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` (Engineering Module, or move it to
-   `…\pkiclient\trusted\certs`).
-2. The server then rejects the client; move `CI_SERVER_OPCUA_CLIENT_OPXCIENG […].der` from
-   `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\rejected` to `…\pkiserver\trusted\certs`
-   (PowerShell: `Move-Item -LiteralPath`, the name contains brackets).
-
-Then `UA.COMM_OK` = 1 and `UA.LEVEL_COPY` follows `TANK1.LEVEL`. The trust is kept when the
-sample is removed and loaded again.
-
 ## Monitoring processes (optional)
 
 `monitoring/` holds the lines to add to the setup files in `%TLS_ROOT_PATH%\tls\sup\` so that

examples/CI-Eng-Sample/load.cmd

@@ -24,12 +24,3 @@ echo Waiting 15 seconds for equipment manager EQPCIENG to start...
 powershell -NoProfile -Command "Start-Sleep -Seconds 15"
 dssqld -i 10_modbus_station_df.qli -l 10_modbus_station_df.qlo
 dssqld -i 11_item_eqp_df.qli -l 11_item_eqp_df.qlo
-rem OPC: make TANK1.LEVEL and its sections visible to OPC clients (modify existing records)
-dssqld -m 12_opc_visible_df.qli -l 12_opc_visible_df.qlo
-rem OPC UA loopback: client line (starts OPXCIENG), station/subscription/points, connected items.
-rem The first connection needs a one-time certificate exchange (see README).
-dssqld -i 13_opcua_line_df.qli -l 13_opcua_line_df.qlo
-echo Waiting 10 seconds for OPC UA client OPXCIENG to start...
-powershell -NoProfile -Command "Start-Sleep -Seconds 10"
-dssqld -i 14_opcua_station_df.qli -l 14_opcua_station_df.qlo
-dssqld -i 15_item_opcua_df.qli -l 15_item_opcua_df.qlo

examples/CI-Eng-Sample/remove.cmd

@@ -5,9 +5,6 @@ rem Order: object, class, trigger group, storage links, stop + delete storage gr
 rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the
 rem group first gets a stop time one minute ahead; the script waits until it has passed.
 cd /d "%~dp0"
-dssqld -r 76_remove_item_opcua_df.qli -l 76_remove_item_opcua_df.qlo
-dssqld -r 77_remove_opcua_station_df.qli -l 77_remove_opcua_station_df.qlo
-dssqld -r 78_remove_opcua_line_df.qli -l 78_remove_opcua_line_df.qlo
 dssqld -r 80_remove_item_eqp_df.qli -l 80_remove_item_eqp_df.qlo
 dssqld -r 81_remove_modbus_station_df.qli -l 81_remove_modbus_station_df.qlo
 dssqld -r 82_remove_modbus_line_df.qli -l 82_remove_modbus_line_df.qlo

knowledge/issues.md

@@ -26,7 +26,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
 | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. 2026-09-30 (phase 5): IM 36K10L35 §1.3/§5 explains the first part: event storage picks the unit by time stamp, never older than 60 units, and within the storage process's `gap_time` (ITHEEX/ITHEIX 2880 min) and, for EVENT/ITEM, `max_sample_delay` (ITHEIX 14400 min); older data needs earlier unit files (`hisdbg`, `hisrecover`, `isfrename`), `ithrecover <group> -p` and a restart. Practice in phase 9. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
 | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
-| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
+| ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill |
 | ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
 
 | ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.2 and `itm.sup` answer it: the integral is divided by the **integration granule** `itm_int_secs` (label "Integration granule, sec.") in `itm.sup` — **system-wide**, installed value 1 (seconds); 60 = minutes, 3600 = hours. `TIME_UNIT` only applies to Rate-of-Change. Practiced 2026-09-30: set to 60 and restarted → `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` rose exactly 1.0 in 60 s; restored to 1 (file identical to backup) → 8 in 8 s. Existing integrator values are not converted when the granule changes. Closed 2026-09-30 (confirmed by user). | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
@@ -49,8 +49,3 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-027 | 2026-09-30 | PROCESS (`opcdbg`) | IM 36K10L10 §4 says the `opcdbg` *Dump classes/objects* files can be read by `dssqld`. The files have no `@LANGUAGE`/`@FIELDS`/`@<dataset>` headers (`NAME,"desc",prio` + source lines prefixed `- `); `dssqld -i` on the object dump gave `DSS-E-UNK_DS_NM, Unknown data set name`. | open | Use `dssqld -e CLASS_DF` / `OBJECT_DF` for transfers. Maybe an old tool reads the dump format; not found. | `knowledge/manuals/IM36K10L10-01EN.md` §4; `.claude/skills/class-object-engineering/tasks/opcdbg-checks.md` |
 | ISS-028 | 2026-09-30 | PROCESS (class reset) | After recompiling a class with objects (`RESET_REQUIRED` 1), `dssqld -m` with `CLASS_DF` `RESET` = 1 (also with `RESET_NODE` = host node name) is accepted with 0 errors but does not reset; `OBJECT_DF` `RESET` = 1 is refused (`OPC-E-OBJ_RSTREQ`). `opcdbg` Classes → 8 *Reset class* works; it asks for a reset report file, which the manual does not list. | open | Use `opcdbg`. Still to try: `CLASS_RESET_COMMAND` (system-wide) and the Engineering Module's reset. | `.claude/skills/class-object-engineering/tasks/change-reset-class.md`; `knowledge/manuals/IM36K10L10-01EN.md` §4 |
 | ISS-029 | 2026-09-30 | PROCESS (Java) | IM 36K10P11 §10.4 says a new Java class must be reset before objects are added, otherwise the code does not take effect. A Java class inserted with `COMPILE` 1 by `dssqld` ran its first object correctly without any reset (twice, including a full sample reload). | open | Installed behaviour is the reference; keep "reset after changing a class that has objects". Check whether the Engineering Module path (compile without quick load) behaves differently. | `knowledge/manuals/IM36K10P11-01EN.md` §7; `.claude/skills/class-object-engineering/tasks/java-class.md` |
-| ISS-030 | 2026-10-01 | BUS (UMH tools) | `umhman` (hex code → text) crashes with redirected input (bash: segmentation fault 139 with CRLF input; PowerShell `Start-Process -RedirectStandardInput`: 0xC0000005); with an argument it only prompts. `umhtestprog` prints `UMH TEST UTILITY` and crashes (segmentation fault). `umhmsg 8010008` stops with `umh_panic: …umhmsg.exe, license expired` although other tools (`dssqld`, `itmval`) still worked at that time. | open | Try `umhman` interactively in a console; check `umhmsg` on a licensed system. Similar to ISS-022 (`itmval -f`). | `.claude/skills/system-management/tasks/bus-utilities.md`; `knowledge/manuals/IM36K10L30-01EN.md` §3 |
-| ISS-031 | 2026-10-01 | LICENCE (unlicensed node) | The unlicensed test node counts down about 1 hour of run time per CI Server start (`License time left` in `smd_<node>_LOW_smdsnp_general.log`, 3600 s → `*** license problem : 3 ***`); then `dssqld`/`itmval` stop with `license expired` and `ISF-F-LIC_PROB, DATABASE Service is not licensed`. A PC sleep pauses the count (start 17:25, ran out 09:52 next day). Restart of the CI Service resets it (verified 2026-10-01, back after ~45 s). | closed | Closed 2026-10-01 (confirmed by user): known limitation of the unlicensed test system, documented in system-check. Known limitation of the test system, documented in `system-check`. Plan tests in ≤ 1 h blocks. Close when the user confirms. | `.claude/skills/system-check/SKILL.md` §3 (done) |
-| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
-| ISS-033 | 2026-10-01 | ACCESS (Engineering Module OPC UA point) | Tested by the user: the point form's *Browse path* stops at the item (`Objects/CI-Eng-Sample/TANK1/INFLOW`) and stores the item **object** `{"nsid":"548"}`; the point is not monitored (revised sampling interval 0, connected item status 13, *Last value*/*Data type* empty). Typing `{"0":"Value","itnm":"CI-Eng-Sample.TANK1.INFLOW"}` in *Node Id* fixed it (values followed at once). Browsing into an item that is OPC visible but not *Read* fails (`UncertainNotAllNodesAvailable`, `OPXC-E-BRW_NODE`). | open | Check whether the browse dialog can expand an item to `Value` (e.g. double-click); otherwise type the node ID. | `knowledge/manuals/IM36K10E20-01EN.md` §2 (done); `.claude/skills/data-access/tasks/opcua-client.md` §3 (done) |
-| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |

knowledge/manuals/IM36K10E20-01EN.md

@@ -1,70 +0,0 @@
----
-manual: IM 36K10E20-01EN
-title: OPC Interface
-edition: 2nd Edition, Sep. 2023
-version: R1.03
-status: from docs; OPC UA point and certificate forms compared with quick load on the test system 2026-10-01 (user configured a point in the Engineering Module, exported and diffed)
----
-
-# OPC Interface (R1.03)
-
-Engineering Module procedures for OPC Classic, OPC UA client and OPC UA PubSub. Concepts,
-setup files and the OPC servers: `IM36K10L45-01EN.md`. Everything here is under
-*Configuration → I/O processing → Equipment → (OPC DA client | OPC A&E client | OPC UA Client |
-OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
-
-## 1. OPC Classic (§1)
-
-- DA: line (equipment node, process name — the manual says it must start with `OPC` for DA and
-  A&E lines, `OPX` for OPC UA), station (OPC server node and ProgID, status item), group
-  (deadband, requested update rate, status item), point (external relation, group, OPC tag,
-  browse). Then connect items to points (Tutorial "Define points").
-- A&E: line, station (server, subscription filters), subscribed attributes; to show events in
-  the current alarm overview, map event sources to items. External names must be unique per
-  station.
-
-## 2. OPC UA client (§2)
-
-Order: line → station → subscription → points (→ methods) → alarm components / event type
-filters / event nodes / template settings (only when alarms are wanted; no alarms are received
-until event nodes are configured).
-
-| Object | Key fields (dataset field) |
-|---|---|
-| Line | name ≤ 31, equipment node (*None* = this node), **process name starts with `OPX`, ≤ 11 characters** (`EQUIPMENT_MAN`) |
-| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item*; *On scan*; *General communication status item* (`STATUS_ITEM`); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
-| Subscription | publishing interval, lifetime and keep-alive counts, max notifications, priority, publish enabled, status item |
-| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
-| Method | namespace, node ID or browse path, process areas |
-
-**Observed (2026-10-01)**: browsing in the point form stops at the item itself
-(`Objects/<section>/…/<item>`) and stores the item **object** (`{"nsid":"<n>"}`), which has no
-value: *Last value*/*Data type* stay empty and the point is never monitored (revised sampling
-interval 0, item status 13). Type the node ID of the value instead:
-`{"0":"Value","itnm":"<item>"}` (namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`, type
-STRING). The form also fills `OPC_DISPLAY_NAME` and `OPC_TAG_INFO` (browse bookkeeping;
-not needed for quick load). ISS-033.
-
-## 3. Certificates (§2.2)
-
-*OPC UA Client → Certificates*: **Trusted**, **Rejected** (server certificates arrive here),
-**Own certificate**. Trust = open the rejected certificate, tick *Trusted*, Apply; reject =
-untick. Restart the Engineering Module to refresh the folders. *Modify* the own certificate
-(name, organisation, country, domain or IP, RSA key strength, signature algorithm, validity).
-
-**CI Server OPC UA client ↔ CI Server OPC UA server (§2.2.6)**: trust the server certificate
-on the client; copy the client's own certificate
-(`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs`) to the server's
-`…\pki\opxuas\pkiserver\trusted\certs`; the manual also asks to tick *Use CI Server entity names
-for nodeids* in `opxuas.sup` and restart the server. On the test system the loopback worked
-**without** that option, using `itnm` node IDs (ISS-032).
-
-## 4. OPC UA PubSub (§3)
-
-UDP publish/subscribe of Data Access values from the CI Server OPC UA server address space
-(OPC visible items). Objects: line (needs its own copy of `ServerConfig.xml` named for the
-instance), published datasets, station, writer groups + dataset writers (publisher), reader
-groups + dataset readers (subscriber), then *Upload dataset configurations to runtime*.
-Limits per line: 4 stations, 8 writer groups, 8 reader groups, 32 dataset writers, 32 dataset
-readers, 32 published datasets. Status mapping as for the server (NORMAL → Good; NOT_INIT,
-UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE → Bad). Not practiced (needs a PubSub peer).

knowledge/manuals/IM36K10L30-01EN.md

@@ -1,133 +0,0 @@
----
-manual: IM 36K10L30-01EN
-title: BUS Service Engineering
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs; installed tools, setup files (dur.sup, durm_1_udp.sup, time_table.sup, fmfprt.sup, durutl.sup) and durm_start.cmd checked read-only 2026-10-01; durwfp verified; umhman, umhtestprog, umhmsg fail on the test system (ISS-030)
----
-
-# BUS Service Engineering (R1.03)
-
-BUS Service is CI Server's messaging layer ("DUR", Dynamic User Region): every CI Server
-process attaches to a shared memory area and gets a **queue** (mailbox) under its DUR name;
-processes talk by messages. It also does error-text management (UMH), node-to-node links
-(MDUR), time handling, printer management and process control utilities. Section numbers refer
-to the manual.
-
-## 1. Processes (§1.2)
-
-| Process | Role |
-|---|---|
-| `durini` | Initialises DUR at start, then exits |
-| `durtim` | Runs every second: system time, summer/winter time, queue time-outs, checks that processes still exist (`DUR-W-REM_PROC, Process <x> exited unexpectedly`), clock queue |
-| `durprt` | Writes intercepted messages to `tls\lst\DURPRT.out` (debugging; leave running) |
-| `umh` / `umhlog` | Build error texts from codes (`tls\dat\messages.umh`) and write them to the message log (`umhlog.log`) |
-| Optional | `dur` (DUR display utility, interactive), `durbat` (start processes on request, also remote), `durclq` (finer clock-queue resolution: `durclq 50` = 50 ms), `durdbg`, `durutl` (logical addresses, node time sync), `durecs` (external clock), `dursim`, `durstp`, `durwfp`, `umhcr`, `umhlogtoo`, `umhman`, `umhmsg` |
-
-Process names: fixed (e.g. `UMH`), `PID<n>` when none given, or set with `-n <name>` (most
-CI Server executables, e.g. `opxuas -n opxuas`).
-
-## 2. Messages and nodes (§2–§4)
-
-- Requests are asynchronous; CI Server makes them synchronous with a *reply required* flag. The
-  **server** converts data between different computer architectures.
-- **MDUR** (§3): one `durm_<line>` process pair per network line (`durm_udp` + `durm_udp_slv`
-  on Windows), started by `tls\com\durm_start.cmd`, configured in
-  `tls\sup\durm_<line>_udp.sup`: `line`, `quality` (lower = preferred line), `io_timeout`
-  (default 8000 ms, 8 checks), `portnr` (same on all nodes of one line; > 17000 advised),
-  `max_snd`, `cluster`, `compress`, `connect_delay`, `max_poll_int`, `our_host_name`,
-  `remote_set` (up to four nodes sharing one node number = redundant set). Redundant nodes
-  only over TCP/IP. `durmdbg -q <durm> -f <file>` traces a line; always stop with `-s`.
-- `dur.sup`: node number, `host_node`, `rout_type` (ENDPOINT or ROUTER for multi-node
-  routing), sizes (`pool_kbytes`, `dur_max_proc`).
-- **Logical addresses** (§4): node −1 in an address = look up a table (`durlnm.dat`), distributed
-  by `durutl` from a master node listed with `lnm_node = …` in `durutl.sup`.
-
-**Installed (single node)**: `dur.sup` `host_node 0`, `pool_kbytes 250000`, `dur_max_proc 250`,
-`rout_type 2 ENDPOINT`; `durm_1_udp.sup` `line 1`, `quality 500`, `io_timeout 8000`,
-`portnr 17001`, plus keywords not in the manual: `sndportnr 17101`, `ip_adr_method IPv4`,
-`ENABLE_DURMS N, 0` (host-host encryption, §13); `durm_1` is running although there is no
-second node; `durutl.sup` has no active lines.
-
-## 3. Messages and the message log (§5, §6)
-
-- Codes look like `FAC-S-ACRONYM` (S = S/I/W/E/F). Text comes from `messages.umh`; dynamic
-  values are inserted by name; several codes can form one history entry.
-- `umhlog` writes to `tls\log\umhlog.log`; `-d <node>` also logs centrally on another node,
-  `-q <printer queue>` prints too.
-- Tools: `umhtestprog` (tests the message path), `umhmsg <hex code> [<var> <value>]…`
-  (issue a message from a script), `umhman` (look up a hex code, interactive),
-  `umhlogtoo` (copy of all messages to a terminal). **On the test system** `umhman` crashes
-  with redirected input, `umhtestprog` crashes, and `umhmsg` ends with "license expired"
-  (ISS-030).
-- A message shown as `UMH Message Text Error: Message number <hex> (…)` means the text could
-  not be formatted (e.g. a `%` in a PRINT text, ISS-025).
-
-## 4. Time (§7, §8, §11)
-
-- `time_table.sup`: `AUTOMATIC` (installed) = BUS Service takes summer/winter times from
-  Windows at start (scans ±15 years); otherwise `LST_OFFSET` (minutes, **positive = west**),
-  `LST_NAME`, `LCT_NAME`, `CHANGE` lines; month/day abbreviations. Reload via the DUR display
-  utility. Installed file still has the Central European example values (−60, MET/MEST); they
-  are ignored while `AUTOMATIC` is set.
-- Node time sync with `durutl` on the master: `tms_params = <interval s>, <limit1>, <limit2>,
-  <limit3>, <step2>, <step3>` and one `tms_node = <n>` per slave; beyond limit3 the slave is
-  set at once and an error is logged. External clock (serial Wharton/Trimble/Arbiter) with
-  `durecs` and `durecs.sup` (`ecs_params`). On Windows normally use Windows time
-  (`system-check`, `w32tm`).
-
-## 5. Process control utilities (§10)
-
-| Command | Use |
-|---|---|
-| `durwfp -p <name> [-t <s>] [-e]` | Exit 0 if the process is attached (waits up to `-t`, default 60; `-t 0` = check now); `-e` waits for it to go away. Verified: `umh`, `opcman` → 0, unknown name → 1 |
-| `durstp -m -p <name>` | Send a stop message (clean stop). `-k` kills, `-m -k` = stop, then kill after `-t` s; `-f` kills even with the common area locked (dangerous); `*` wildcard (`-p alm\*`). Never `durstp -k -p \*` |
-| `durbat` | Starts processes on request from other processes (also remote) |
-
-`durstp` stops CI Server processes: use only with the user's approval.
-
-## 6. Printer management (§12)
-
-`FMFPRT` (printer manager, one per node) and one `FMFP_<device>` process per device (first 8
-characters of the device name must be unique). **Destinations** (logical, e.g.
-`SCREEN_CAPTURE`, `ALARMS`, `MESSAGES`, `DEFAULT`) map to **devices** (instances of an output
-type) with an optional backup device. Configured in `fmfprt.sup`; devices and destinations in
-datasets `PRINTER_DEV_DF`, `PRINTER_DEST_DF`, `PRINTER_TYPE_DF`, `PRINTER_OPER_DEST_DF`
-(job/device lists `PRINTER_JOB_OVV`, `PRINTER_DEV_OVV`).
-
-**Installed `fmfprt.sup`**: `QUEUE_LIFE 1800` s (stalled job expires), `MAX_JOBS_SHOWN 10`,
-`DEVICE_POLL 5` s, `MAX_BUSY 60` polls; output types `HARDCOPY` (`fmfphc`, Windows printing,
-Courier New 8 pt, 72 lines, landscape), `FILE` (`fmfpfl`, file name
-`TLS_%time:DDMMYY%_%seq:03%.lst` in `tls\lst`), `APPLICATION` (`fmfpap`, program set to
-Internet Explorer); fixed destinations `ALARMS`→`ALDPRT`, `AUDIT_TRAIL`→`ADTLOG`,
-`MESSAGES`→`UMHLOG`, `PRINTER_1`→`RPTMAN`, `SCREEN_CAPTURE`→`CWSSHOT`. `NODE_SHARE = <node|-1>`
-shares printers between nodes. Logging processes do not print by default (enable per process:
-`aldprt.sup LOGPRT`, `adtsys.sup PRT_DEV`, `umhlog -q`).
-
-The CI Service account must have the printers; `DEFAULT` uses that account's default printer.
-Clean-up after a crash: stop CI Server, empty `tls\lst\printing`, delete
-`tls\sav\fmf_prt_last_id.sav`, `fmfprt.sav` and `tls\dat\printer_job_ovv.*`, start.
-
-## 7. MDUR encryption (§13)
-
-Host-host encryption (AES-256, certificates) between CI Cores: every node must use it; no
-enterprise configurations. Keys: `gen_key is_ca=1` once (CA key), `gen_key is_ca=0` on each
-node → `%TLS_ALLUSERS_PATH%\pki\mel\dur\key`; certificates with the interactive `cert_write`
-(CA certificate to `…\pki\mel\dur\crt\ca\ca.crt` on every node, node certificate to
-`…\crt\own`; create the folders first; log `tls\log\cert_write_log.log`). Then tick *Enable
-HostHost encryption* in each `durm_x_udp.sup` (installed keyword `ENABLE_DURMS`). Keep the CA
-key off the servers. Not practiced (single node; `tls\pki\mel` does not exist yet).
-
-## 8. Adaptive queues (§14)
-
-Each process has a fixed queue (the *adaptive minimum*); for processes listed on the
-*Adaptive queues* tab of `dur.sup` (`ADAPTIVE_QUEUE_SETS = <process>, <percent>`), DUR may
-grow the queue temporarily by up to that percentage of the total queue area, avoiding overflows
-during bursts. Add node queues for multi-node systems and new processes (extra executors,
-DSS servers, equipment managers). In the performance monitor *Minimum KB*/*Maximum KB*/*Current
-KB* and a high-queue of 100 % show that a queue needed more space → raise its size. Total area
-exhausted → `DUR_F_NO_SPACE`.
-
-**Installed**: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`/`WFLIDI`/`WFLADI`/`ITHEIX`/`ITHSER` 2,
-`DSSSDA*`/`DSSEVT*`/`OPCEXE` 1 %. Note: `OPCEXE` does not match the installed executor names
-`OPCEXE1`…`4` (no wildcard) — see ISS-026.

knowledge/manuals/IM36K10L45-01EN.md

@@ -1,182 +0,0 @@
----
-manual: IM 36K10L45-01EN
-title: Data Access Engineering
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs
----
-
-# Data Access Engineering (R1.03)
-
-ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC
-Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section
-numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on:
-skill `data-access`.
-
-## 1. ODBC (§1–§3)
-
-- Multi-tier: ODBC application + driver manager + **SimbaClient** driver on the client;
-  **SimbaServer** + ACCESS Service ODBC engine (`odbsrv`) on the CI Server. Read and write of
-  existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be
-  created or deleted over ODBC. Needs an ODBC licence.
-- `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate
-  `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`),
-  `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data
-  (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on).
-- Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium
-  (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or
-  `CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts.
-- SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`.
-- Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not
-  running / port mismatch / BUS Service not reachable.
-
-**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder
-`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
-`odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx():
-SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited
-unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set
-`USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry
-defaults once (when `%TLS_DAT_PATH%\access.new` exists).
-
-## 2. OPC Classic basics (§4)
-
-DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A
-and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`).
-- Quality: OPC DA quality goes to the **lower** 16 bits of the CI Server quality word, OPC A&E
-  quality to the **upper** 16 bits. Item to OPC: CI Server quality low byte → OPC high byte;
-  OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised →
-  NOT_CONNECTED, else GOOD.
-- Types: `VT_UI1/UI2/INT/I1/I2/I4` → Integer, `VT_UI4/UINT/R4/R8` → Real, `VT_BSTR` → String,
-  `VT_BOOL` → Boolean.
-- Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC
-  visible* (and every parent section visible).
-
-## 3. OPC DA client (§5)
-
-- One client process per DA line (name given in the line), started/stopped with CI Server;
-  stop one with `durstp -msk -t10 -p <client>`. Uses a save file in `%TLS_SAV_PATH%` named
-  after the process; delete it (client stopped) if it gets inconsistent.
-- Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running,
-  2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group
-  status item: 1 active / 0 not active (items offline).
-- Setup (`<client>.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server
-  DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING`
-  (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT`
-  (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`,
-  `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8),
-  `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
-- Advice: one OPC server per client process (a DCOM time-out blocks the whole process).
-  Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`,
-  `POINT_DF` of one station made in the Engineering Module.
-- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS,
-  DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm_<n>_udp.sup`,
-  port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's
-  setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon`
-  node monitoring with *Set slave items offline when node unavailable*.
-
-## 4. OPC DA server (§6)
-
-- COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.<version>`, DUR name `OPXDAS`; started by
-  COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown).
-- Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE
-  pattern). *Cache read* is fast and correct; *device read* blocks — use only after queue
-  overflow. Timestamp = time written into the server cache.
-- `opxsys.sup` *Data Access Server* tab: `OPXDAS_DUR_QSZ` (100 kB), `…_HBEAT`, `…_ITMBUF`,
-  `OPXDAS_USER` (log on as a CI Server user to apply its authorisation; empty = full access,
-  fastest), `OPXDAS_DCOM_TUN`, `OPXDAS_IGNORE_FTQ`. Installed also: `OPXDAS_SET_LOG_LEVEL`
-  (not described).
-- Remote access needs DCOM configuration (`dcomcnfg`: authentication Connect, impersonation
-  Identify, access/launch permissions for an OPC account; identity of the server = that account),
-  `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for
-  `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT
-  Security Tool is applied. Same account/password on both sides in a workgroup.
-- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
-  `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic),
-  `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first.
-
-## 5. OPC A&E client and server (§7, §8)
-
-- Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `<name>.sup` or `opxsys.sup`
-  (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`,
-  `…_TRACE`); maps condition events to items; one server per client advised.
-- Server `opxaes`, ProgID `Yokogawa.CIOpcAes.<version>`, DUR name `OPXAES`; publishes items
-  with alarm monitoring as conditions; `OPXAES_ACK_ALLOWED` (acknowledge from clients),
-  `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the
-  CI Server-specific event attributes (old/new value, quality, status, alarm state, item
-  description, units, node, group, number, sub-number). Installed: all on.
-
-## 6. OPC UA client (§9)
-
-- OPC UA TCP only; security by X.509 certificates (application authentication), user
-  anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256,
-  Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
-- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in
-  Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good,
-  1 bad, 2 uncertain.
-- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other
-  events INFORMATIONAL; filters by event type, component, event node; severity → priority
-  table (901–1000 → 1 … 1–100 → 15), per station; don't manage
-  NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled.
-- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold
-  backup with two endpoints (*Active server item* 0/1/2).
-- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11
-  characters), station (= session), subscription, point (= monitored item), alarm component /
-  event type filter / event node / template settings, method.
-- Certificates: the client process creates `<host>_<PROCESS>.der` in
-  `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset
-  `OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be
-  trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`,
-  `rejected` added by CI Server. The server must trust the client's certificate too.
-- Setup (`<process>.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats,
-  buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed
-  retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and
-  session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
-- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`
-  (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server
-  (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`).
-- Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`.
-
-## 7. OPC UA server (§10)
-
-- Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p
-  opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log`
-  and `OpxUas_Sdk*.log`.
-- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read
-  values, browse into the item) and **Write** (write values, alarm methods). Parent sections must
-  be visible. Without Read the item is listed but browsing into it fails
-  (`UncertainNotAllNodesAvailable`).
-- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ`
-  (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
-- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`,
-  `…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`,
-  `Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in
-  `http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections,
-  items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing;
-  the manual does not name it, ISS-032).
-- NodeIds are JSON strings: `{"nsid":"<namespace id>"}` for the entity,
-  `{"0":"Value","nsid":"<n>"}` for its value; or by name: `{"0":"Value","itnm":"<item>"}`
-  (case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`.
-  `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
-- Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH →
-  BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority →
-  severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03).
-- History: items in a history group show HistoryRead; max 5000 values per node per call.
-- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal);
-  external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM.
-- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
-  (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`,
-  `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`,
-  `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` =
-  ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE`
-  (manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034).
-- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list
-  `…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first
-  rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256,
-  Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint);
-  anonymous, user/password **and certificate** user tokens enabled (manual: certificate off,
-  ISS-034); `AutomaticallyTrustAllClientCertificates` false.
-- First connection of any client: trust the server certificate on the client, then move the
-  client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
-  suggested test client.
-- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate
-  management (concepts only).

knowledge/manuals/IM36K10L55-01EN.md

@@ -1,51 +0,0 @@
----
-manual: IM 36K10L55-01EN
-title: Exchange Tool Engineering
-edition: 3rd Edition, Sep. 2023
-version: R1.03
-status: from docs only (needs CENTUM VP / an RGS node or CCC Prodigy data; not available on the test system)
----
-
-# Exchange Tool Engineering (R1.03)
-
-Two tools convert another system's engineering data into CI Server engineering data
-(a "publication" = generated quick load files plus `load.cmd`). Section numbers refer to the
-manual; Appendix 1 lists the supported CENTUM VP function blocks.
-
-## 1. CI Exchange for CENTUM VP (§2)
-
-- Runs on an **RGS** (Remote Gateway Station: CI Server PC with a Vnet/IP card and driver from
-  the medium, `VirtualProduct_CIServer_packageRxxx.zip`, option *installVirtProd*) that talks
-  to CENTUM VP. *Single server*: the RGS is also the CI Core. *Non-single*: an upper CI Core
-  gets the data from the RGS (MDUR).
-- Solutions: **RGS** (manual or automatic mode; automatic = the tool is embedded in the RGS,
-  ENG HIS equalisation enabled, the RGS registered in the CENTUM VP project; publications
-  generated after each CENTUM VP download) and **RGS with EAL** (external alarms; manual mode
-  only).
-- Manual workflow: start the tool → create a project (*Single Server* ticked or not) → import
-  CENTUM VP engineering data from the ENG HIS (and MTL file) → *Publish* (name pattern, folder,
-  optional SQL tag filter such as `%PVI%`) → copy the publication folder to
-  `C:\Program Files (x86)\Yokogawa\CIServer\Utility` → run its `load.cmd` on the RGS and/or CI
-  Core (in an IT-security environment run `cmd.exe` *as different user* first). Automatic
-  publications land in `%TLS_ALLUSERS_PATH%\lst\rgs\pub\`.
-- Output: items `<section>.<TAG>.<PARAM>` (e.g. `<Section>.FIC001.PV`), points
-  `<STATION>:[<item>]`, plus lines/stations, displays and symbols (displays only on the CI
-  Core in non-single configurations).
-- Precautions (§2.15): refresh open LIST displays after a CENTUM VP online download; CI Server
-  does not allow alarm limits on the wrong side of SV; short data gaps after Vnet scan changes
-  or RDC switch-over; trends may lag after large downloads — reload displays, roll over the
-  history group, tune scan types.
-- Installed: launcher `%TLS_ROOT_PATH%\tls\com\jwuiutl_ciexchange.cmd` (no RGS on the test
-  system).
-
-## 2. CI Exchange for Prodigy (§3)
-
-- For CCC Prodigy turbo-machinery controllers (antisurge, performance, speed). Input: the
-  Modbus register list (`.csv`, from MakerPro) per controller; the station name and IP are
-  entered in the tool.
-- Install: copy `Windows\EngineeringTools\CIExchange_Prodigy.zip` from the medium, extract to
-  `C:\Program Files (x86)\Yokogawa\CIServer\Utility` (create the folder), run
-  `CIExchange_Prodigy.cmd`.
-- Workflow: create project → import source configuration → generate publication → load it.
-  Output: items `<section>.<Prodigy variable path>`, Modbus points `<STATION>:[<item>]`, and
-  faceplates (title and engineering unit can be customised, §3.12.1).

knowledge/progress.md

@@ -44,10 +44,10 @@ AID is not needed.
 | 6 | IM 36K10L10 | Class/Object Engineering | done; `opc.sup` read-only, `opcdbg` read-only actions and Reset class practiced ([notes](manuals/IM36K10L10-01EN.md)); skill `class-object-engineering` |
 | 6 | IM 36K10P10 | Class Description Language - Traditional | done for prompts, signals, created items, transitional operators, PRINT/ERROR; timers, alarms, containment, STEP, DSS routines, AGA from docs ([notes](manuals/IM36K10P10-01EN.md)) |
 | 6 | IM 36K10P11 | Class Description Language - Java | done for a basic class (attach/create items, signal trigger, systemMessage); timers, containment, inheritance from docs ([notes](manuals/IM36K10P11-01EN.md)) |
-| 7 | IM 36K10L55 | Exchange Tool Engineering | summarized, from docs only (needs CENTUM VP / RGS or Prodigy) ([notes](manuals/IM36K10L55-01EN.md)) |
+| 7 | IM 36K10L55 | Exchange Tool Engineering | not started |
-| 7 | IM 36K10L30 | BUS Service | done for single-node checks; MDUR, encryption, logical addresses, printer devices from docs ([notes](manuals/IM36K10L30-01EN.md)); task `system-management/bus-utilities.md` |
+| 7 | IM 36K10L30 | BUS Service | not started |
-| 7 | IM 36K10L45 | Data Access Engineering | done for OPC UA client/server (loopback); OPC DA/A&E from docs (DA loopback not allowed); ODBC not running (ISS-008) ([notes](manuals/IM36K10L45-01EN.md)); skill `data-access` |
+| 7 | IM 36K10L45 | Data Access Engineering | not started |
-| 7 | IM 36K10E20 | OPC Interface | summarized; OPC UA point form compared with quick load by the user ([notes](manuals/IM36K10E20-01EN.md)) |
+| 7 | IM 36K10E20 | OPC Interface | not started |
 | 8 | IM 36K10L15 | Alarm Management Engineering | not started |
 | 8 | IM 36K10C20 | Engineering Module - Alarms | not started |
 | 8 | IM 36K10E30 | Alarm System Performance Analysis | not started |
@@ -115,8 +115,3 @@ now come before classes and objects (phase 6), and the other interfaces follow a
 | R10/R20 | Change a setup file safely ([task](../.claude/skills/portal-setup/tasks/change-setup-file.md)) | passed | n/a | `jwuiisg.sup` HTTP port 8080 → 8081 (text edit, elevated restart): 8081 served the page, 8080 refused; restored, hash identical to backup. Editor: *OK* writes at once, *Reset Field* restores the default (ISS-016). |
 | R10 | Separate CI Portal node (licence, DURM line, `dur.sup` host node, copy displays) | not practiced | n/a | Needs a second node. |
 | R10 | Login method / login control | not practiced | n/a | Moved to `dssana.sup` (ISS-017); phase 5 (C10) and 13 (J40). |
-| L45/E20 | OPC UA client → own OPC UA server loopback by quick load; certificate exchange; node IDs ([task](../.claude/skills/data-access/tasks/opcua-client.md)) | passed | passed | Station `CIENG_UA` (`opc.tcp://localhost:34493`, Basic256Sha256/SignAndEncrypt): `UA.LEVEL_COPY` follows `TANK1.LEVEL` (55, 62.5, 71, 33, 44.4), `UA.SRV_STATE` 0. Certificates trusted by the user (client side, then server side). Entity namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` found by browsing `OPCUAC_TAG_DF` (ISS-032). Full remove/reload clean, reconnects without a new exchange. User configured a point in the Engineering Module: browse stores the item object, value node must be typed (ISS-033); test item/point removed afterwards. |
-| L45 | ACCESS read-only checks: processes, ports, OPC UA server config/PKI, ODBC server ([task](../.claude/skills/data-access/tasks/access-checks.md)) | passed | n/a | ISS-008 cause found: `odbsrv` cannot load its SSL certificate (folder `tls\pki\odbsrv` missing) and exits. |
-| L30 | BUS utilities: `durwfp`, setup files (`dur.sup`, `durm_1_udp.sup`, `time_table.sup`, `fmfprt.sup`) ([task](../.claude/skills/system-management/tasks/bus-utilities.md)) | passed (read-only) | n/a | `umhman`, `umhtestprog`, `umhmsg` fail (ISS-030). Unlicensed run-time limit hit and documented (ISS-031). |
-| L30 | MDUR node links, encryption, logical addresses, printer devices | not practiced | n/a | Single node, no printer devices. |
-| L55 | CI Exchange for CENTUM VP / Prodigy | not practiced | n/a | Needs CENTUM VP (RGS, Vnet/IP) or Prodigy data. |