Merge pull request 'Phase 7: BUS Service, Data Access (OPC UA/DA/A&E, ODBC), OPC Interface, Exchange tools' (#7) from docs/phase-7-interfaces into main

Reviewed-on: cliu/ci-server-config#7

.claude/skills/data-access/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: data-access
+description: >-
+  CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to
+  connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points,
+  certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC
+  DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints,
+  security policy, trusting client certificates, UaExpert), check why an OPC connection fails
+  (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM
+  tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server
+  (odbsrv, port 1583, SSL certificate). Sources IM 36K10L45-01EN, IM 36K10E20-01EN.
+---
+
+# Data access: OPC and ODBC (R1.03)
+
+Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server,
+setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment
+lines/stations/points in general: skill `equipment`.
+
+Rules:
+- Run `system-check` first; follow the user's chosen way of working.
+- **Trusting certificates is the user's decision.** Show the certificate (folder, file name,
+  common name) and let the user trust it (Engineering Module or moving the file); do not move
+  certificate files yourself.
+- Making items OPC visible / writable exposes them to every OPC client on the network: only
+  with the user's approval, and prefer read-only.
+- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
+  node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine.
+- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and
+  a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`).
+
+| Task | File | Status |
+|---|---|---|
+| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified |
+| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs |
+| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified |
+| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
+| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) |
+| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs |

.claude/skills/data-access/tasks/access-checks.md

@@ -0,0 +1,24 @@
+---
+task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server)
+version: R1.03
+source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01
+status: verified
+---
+
+# ACCESS Service checks (read-only)
+
+| Check | How | Test system result |
+|---|---|---|
+| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running |
+| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** |
+| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) |
+| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing |
+| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on |
+| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` |
+| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` |
+| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback |
+| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | |
+
+Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
+with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
+(unencrypted ODBC traffic — a security decision), then restart CI Server.

.claude/skills/data-access/tasks/opcua-client.md

@@ -0,0 +1,128 @@
+---
+task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
+version: R1.03
+source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
+status: verified
+---
+
+# OPC UA client to an OPC UA server
+
+Worked example: CI-Eng-Sample station `CIENG_UA`, CI Server's OPC UA client reading
+`CI-Eng-Sample.TANK1.LEVEL` back through CI Server's **own** OPC UA server
+(`examples/CI-Eng-Sample/12_`–`15_*.qli`, removal `76_`–`78_`). For a real server, replace the
+endpoint, security settings and node IDs.
+
+## 1. Server side: make the data visible
+
+On the CI Server OPC UA server an item is reachable only when the item has **OPC visible** and
+**Read** (Write to allow writing) and every parent section is OPC visible
+(`12_opc_visible_df.qli`, loaded with `dssqld -m`):
+
+```
+@FIELDS
+NAME,OPC_VISIBLE
+
+@SECTION_DF
+"CI-Eng-Sample",1
+"CI-Eng-Sample.TANK1",1
+
+@FIELDS
+NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE
+
+@ITEM_DF
+"CI-Eng-Sample.TANK1.LEVEL",1,1,0
+```
+
+Visible without Read: the item shows when browsing, but browsing into it fails
+(`UncertainNotAllNodesAvailable`, client message `OPXC-E-BRW_NODE`; verified). By the manual,
+Read is also what allows reading the value.
+These flags also apply to the OPC DA and A&E servers.
+
+## 2. Client configuration (quick load, in this order)
+
+1. **Line** (`OPCUAC_LINE_DF`): loading it creates and starts the client process
+   `EQUIPMENT_MAN` (must start with `OPX`, ≤ 11 characters) — wait ~10 s before the station.
+   ```
+   "CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"
+   ```
+2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name
+   `<station>:<subscription>`), **points** (`OPCUAC_POINT_DF`, name `<station>:<point>`) —
+   see `14_opcua_station_df.qli`:
+   - Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`),
+     `MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`,
+     `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 =
+     connected). `SERVER_01_NAME`/`_URI` may stay empty.
+   - Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000.
+   - Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`),
+     `OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`,
+     `GUID`), `OPC_NODE_ID`.
+3. **Items** (`ITEM_DF` with `STATION` and `POINT`), e.g. `CI-Eng-Sample.UA.LEVEL_COPY` →
+   `CIENG_UA`, `LEVEL`.
+
+## 3. Node IDs
+
+| Target | Namespace | Type | Node ID |
+|---|---|---|---|
+| Value of a CI Server item (by name — survives recreating the item) | `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` | STRING | `{"0":"Value","itnm":"<Section>.<Tag>"}` |
+| Value of a CI Server item (by namespace id) | same | STRING | `{"0":"Value","nsid":"<n>"}` |
+| Server state (any OPC UA server; good connection test, 0 = Running) | `http://opcfoundation.org/UA/` | NUMERIC | `2259` |
+
+In a `.qli` file double the quotes inside the field:
+`"{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"`.
+
+Pitfalls found on the test system:
+- Namespace `http://www.yokogawa.com/CI_Server/` (the one the manual shows) holds only the
+  **types**; with it the point is silently not monitored (ISS-032).
+- The Engineering Module's *Browse path* stops at the item and stores the **object**
+  (`{"nsid":"<n>"}`), which has no value: *Last value* stays empty, the item stays status 13.
+  Type the `Value` node ID by hand (ISS-033).
+- `nsid` numbers change when the item is deleted and created again (e.g. sample reload).
+
+A point that is not accepted shows `REVISED_SAMPLING_INTERVAL` 0 in `OPCUAC_POINT_DF` and the
+log line `Can't find Point [<point>] in subscription` when changed; a monitored point gets the
+revised interval (e.g. 1000).
+
+**Browse the server from the command line** (station connected): export `OPCUAC_TAG_DF` with
+a filter; start with an empty path, then `Objects`:
+
+```
+@SELECT
+'OPC_STATION_NAME = "CIENG_UA" and OPC_TAG_PATH = "Objects"'
+@OPCUAC_TAG_DF
+```
+
+Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper
+paths were not found yet (`Objects.CI-Eng-Sample` returned nothing).
+
+## 4. Certificate exchange (first connection; the user does it)
+
+| Step | Where it shows | What the user does |
+|---|---|---|
+| 1. Client rejects the server | `OPXC-E-CER_NO_TRU … BadCertificateUntrusted` in `umhlog.log`; file `<thumbprint>.der` in `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` | Trust it: Engineering Module *OPC UA Client → Certificates → Rejected* → *Trusted*, or move the file to `…\pkiclient\trusted\certs` |
+| 2. Server rejects the client | client log `BadSecurityChecksFailed`; file `CI_SERVER_OPCUA_CLIENT_<PROCESS> [<thumbprint>].der` in `…\pki\opxuas\pkiserver\rejected` (folder created now) | Move it to `…\pki\opxuas\pkiserver\trusted\certs` |
+
+PowerShell: file names with `[ ]` need `-LiteralPath`, otherwise `Move-Item` silently does
+nothing:
+
+```powershell
+Move-Item -LiteralPath "<rejected folder>\<file>.der" -Destination "<trusted folder>\"
+```
+
+The client retries every ~35 s (`OPXC_STATION_CON_TRY_INTERVAL` 30 s); then `OPXC-I-SRV_CONN`
+and the status item goes to 1. Certificates and trust stay when the line is removed and loaded
+again (verified: reload connected within 5 s without a new exchange). For an external server,
+its certificate arrives the same way; the client certificate
+(`…\pkiclient\own\certs\<host>_<PROCESS>.der`) must be trusted on that server.
+
+## 5. Check
+
+- `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9;
+  `UA.LEVEL_COPY` follows `TANK1.LEVEL` within ~1 s (verified 55, 62.5, 71, 33, 44.4).
+- Client log: `%TLS_LOG_PATH%\<PROCESS>.log` (`Successfully connected station`, errors with
+  status codes); server logs `OPXUAS.log`, `OpxUas_Sdk.log` (`CreateMonitoredItems`).
+- Off-scan/on-scan: `OPCUAC_STATION_DF` `ON_SCAN` 0/1 with `dssqld -m` disconnects/reconnects.
+
+## 6. Remove
+
+Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the
+client process). Reset the OPC flags only if they were not there before.

.claude/skills/equipment/SKILL.md

@@ -31,4 +31,5 @@ Rules:
 | CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) |
 | Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified |
 | Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
+| OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) |
 | Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |

.claude/skills/installation-security/tasks/setup-check.md

@@ -43,4 +43,7 @@ Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROC
 Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
 plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
 disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL certificate error
-(`knowledge/issues.md` ISS-008).
+(`InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`): the ODBC server `odbsrv`
+has `USESSL = YES` but no certificate in `%TLS_ROOT_PATH%\tls\pki\odbsrv`, so it exits at
+start (harmless unless ODBC is used; fix in skill `data-access`, task `access-checks.md`;
+`knowledge/issues.md` ISS-008).

.claude/skills/system-check/SKILL.md

@@ -77,6 +77,12 @@ prompt. Setup files (`*.sup`) are plain text (CRLF); edit them with the Setup Fi
   (elevated): `Stop-Service StartCIServer` then `Start-Service StartCIServer`. Before a long
   task on an unlicensed system, note the start time (`(Get-Process ciserv).StartTime`) and
   restart first if the hour is nearly up.
+  Time left is in the health snapshots: `License time left : <s>` in
+  `%TLS_LOG_PATH%\smd_<node>_LOW_smdsnp_general.log` (3600 s after a start, −600 per 10 min);
+  `*** license problem : 3 ***` once it has run out. The count pauses while the PC sleeps
+  (observed 2026-10-01: a run started 17:25 ran out at 09:52 the next morning after a sleep);
+  some processes (e.g. `umh`) stay attached, but `dssqld`/`itmval` fail and the log shows
+  `ISF-F-LIC_PROB, DATABASE Service is not licensed`.
 
 ## 4. Time synchronization
 

.claude/skills/system-management/SKILL.md

@@ -6,7 +6,9 @@ description: >-
   (dssqld, .qli), create sections or items in bulk, read or write item values or limits (itmval), load or import history,
   check database consistency (dsschk), monitor processes/CPU/disk/network, back up or migrate
   a system, tune or debug CI Server, or plan a system layout (standalone, separate portal, HAC,
-  host-to-host, enterprise) or time synchronization. Source IM 36K10J10-01EN.
+  host-to-host, enterprise) or time synchronization, check whether a CI Server process is
+  running (durwfp), stop a single process (durstp), read the message log (umhlog), or check
+  BUS Service queues (adaptive queues, dur.sup). Sources IM 36K10J10-01EN, IM 36K10L30-01EN.
 ---
 
 # System management (R1.03)
@@ -31,3 +33,4 @@ Rules for every task:
 | Monitor CPU, disk, network, processes; run a command on an item change | `tasks/monitoring-processes.md` | verified |
 | Database consistency check (`dsschk`) | `tasks/consistency-check.md` | verified (check only) |
 | Tuning checks: limits and health snapshots | `tasks/tuning-checks.md` | verified (read-only) |
+| BUS Service utilities: is a process attached (`durwfp`), stop one process (`durstp`), message tools, adaptive queues | `tasks/bus-utilities.md` | verified (`durwfp`, read-only checks); message tools fail (ISS-030) |

.claude/skills/system-management/tasks/bus-utilities.md

@@ -0,0 +1,51 @@
+---
+task: BUS Service utilities - process checks, stopping single processes, message tools, adaptive queues
+version: R1.03
+source: IM 36K10L30-01EN §1, §5, §6, §10, §14; checked on the test system 2026-10-01
+status: verified for durwfp and the read-only setup file checks; umhman, umhtestprog, umhmsg fail on the test system (ISS-030)
+---
+
+# BUS Service utilities
+
+Background: `knowledge/manuals/IM36K10L30-01EN.md`.
+
+## Is a CI Server process attached?
+
+`durwfp -p <DUR name> -t 0` → exit code **0** = attached (running), **1** = not. Without
+`-t 0` it waits up to 60 s for the process to appear; `-e` waits for it to go away. Verified:
+`umh`, `opcman`, `durm_1` → 0; unknown name → 1. Bash: `durwfp -p opcman -t 0; echo $?`.
+DUR names are those given with `-n` (e.g. `OPXCIENG`, `EQPCIENG`, `opxuas`).
+
+## Stop or kill one process (only with the user's approval)
+
+`durstp -m -p <name>` sends a stop message (clean stop); `durstp -m -k -t 10 -p <name>` stops,
+then kills after 10 s. `*` wildcards stop many processes (`-p alm\*`). Never `durstp -k -p \*`
+(kills `durtim` and leaves DUR memory locked). Restart a process by hand with
+`<exe> -n <name>` from `tls\exe` or by restarting CI Server.
+
+## Messages
+
+- Message log: `%TLS_LOG_PATH%\umhlog.log` (`--> From: <PROCESS> (<node>) on <time>`, then
+  `FAC-S-CODE, text` lines). `UMH Message Text Error: Message number <hex> (…)` = the text
+  could not be formatted (e.g. `%` in a PRINT text, ISS-025).
+- `umhman` (hex code → text), `umhtestprog` (test the log path) and `umhmsg <hex> [<var>
+  <value>]` (log a message from a script) **did not work on the test system**: `umhman`
+  crashes with redirected input (run it interactively), `umhtestprog` crashes, `umhmsg` stops
+  with `license expired` on the unlicensed node (ISS-030).
+
+## Adaptive queues (read-only check)
+
+`tls\sup\dur.sup`, tab *Adaptive queues*: `ADAPTIVE_QUEUE_SETS = <process>, <percent>`
+(wildcard `*` allowed, max 40 %). Installed: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`,
+`WFLIDI`, `WFLADI`, `ITHEIX`, `ITHSER` 2, `DSSSDA*`, `DSSEVT*`, `OPCEXE` 1. Add entries for
+new busy processes (extra executors, equipment managers, custom processes); `OPCEXE` without
+`*` may not cover the installed `OPCEXE1`…`4` (ISS-026). Changing `dur.sup` needs admin and a
+restart (skill `portal-setup`). Queue use per process: health snapshots
+(`tuning-checks.md`) or the performance monitor (*Minimum/Maximum/Current KB*, high queue
+100 % = the queue had to grow → raise its size).
+
+## Node links (MDUR)
+
+`tls\sup\durm_<line>_udp.sup` and `tls\com\durm_start.cmd`; single-node installs still run
+`durm_1` (`durm_1_udp.sup`: line 1, quality 500, port 17001). Multi-node set-up is in the L30
+summary §2; not practiced (one node).

examples/CI-Eng-Sample/01_section_df.qli

@@ -16,3 +16,4 @@ NAME,SECTION_PATH,SECTION_NAME,DESCRIPTION
 "CI-Eng-Sample.SYSTEM","CI-Eng-Sample","SYSTEM","Sample system monitoring"
 "CI-Eng-Sample.DEMO","CI-Eng-Sample","DEMO","Tutorial examples (class/object)"
 "CI-Eng-Sample.PLC1","CI-Eng-Sample","PLC1","Modbus loopback station CIENG_PLC"
+"CI-Eng-Sample.UA","CI-Eng-Sample","UA","OPC UA loopback station CIENG_UA"

examples/CI-Eng-Sample/02_item_df.qli

@@ -21,3 +21,4 @@ LOW_LOW_LIMIT,LOW_LIMIT,HIGH_LIMIT,HIGH_HIGH_LIMIT,SCALE_LOW_LIMIT,SCALE_HIGH_LI
 "CI-Eng-Sample.SYSTEM.PROC_ALM","ALARM process (alm) running, from intmon","Integer","9",0,0,0,0,0,1
 "CI-Eng-Sample.DEMO.COUNTER","Counter 1..100 driven by object DEMO.INCR1","Integer","999",0,0,0,0,0,100
 "CI-Eng-Sample.PLC1.COMM_OK","Station CIENG_PLC communication (1 = good), status item","Boolean","",0,0,0,0,0,0
+"CI-Eng-Sample.UA.COMM_OK","Station CIENG_UA communication (1 = good), status item","Boolean","",0,0,0,0,0,0

examples/CI-Eng-Sample/12_opc_visible_df.qli

@@ -0,0 +1,20 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Make sections and TANK1.LEVEL visible (read-only) to OPC clients (OPC UA/DA/A&E servers). Load with dssqld -m.
+! Every parent section must be OPC visible too.
+@FIELDS
+NAME,OPC_VISIBLE
+
+@SECTION_DF
+"CI-Eng-Sample",1
+"CI-Eng-Sample.TANK1",1
+
+@FIELDS
+NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE
+
+@ITEM_DF
+"CI-Eng-Sample.TANK1.LEVEL",1,1,0

examples/CI-Eng-Sample/13_opcua_line_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! OPC UA client line; loading it creates and starts the client process OPXCIENG (name must start with OPX)
+@FIELDS
+NAME,DESCRIPTION,EQUIPMENT_MAN
+
+@OPCUAC_LINE_DF
+"CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"

examples/CI-Eng-Sample/14_opcua_station_df.qli

@@ -0,0 +1,27 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! OPC UA loopback: CI Server OPC UA client -> own OPC UA server (opc.tcp://localhost:34493)
+! First connection needs a one-time certificate exchange (see README).
+! CI Server entities: namespace urn:Yokogawa:CI_SERVER_OPC_UA_SERVER, string node id {"0":"Value","itnm":"<item>"}
+@FIELDS
+NAME,DESCRIPTION,LINE,USER_ANONYMOUS,MSG_SECURITY_01_MODE,MSG_SECURITY_01_POLICY,SERVER_01_ENDPOINT,STATUS_ITEM
+
+@OPCUAC_STATION_DF
+"CIENG_UA","Loopback to own OPC UA server","CIENG_UA_LINE",1,"SignAndEncrypt","Basic256Sha256","opc.tcp://localhost:34493","CI-Eng-Sample.UA.COMM_OK"
+
+@FIELDS
+NAME,STATION_NAME,SUBSCRIPTION_NAME,REQUESTED_PUBLISH_INTERVAL,DESCRIPTION
+
+@OPCUAC_SUBSCRIPTION_DF
+"CIENG_UA:CIENG_SUB","CIENG_UA","CIENG_SUB",1000,"1 s subscription"
+
+@FIELDS
+NAME,STATION,POINT,DESCRIPTION,SUBSCRIPTION,EXTERNAL_RELATION,OPC_NAMESPACE,OPC_NODE_ID_TYPE,OPC_NODE_ID
+
+@OPCUAC_POINT_DF
+"CIENG_UA:LEVEL","CIENG_UA","LEVEL","TANK1.LEVEL via own OPC UA server","CIENG_SUB","Input","urn:Yokogawa:CI_SERVER_OPC_UA_SERVER","STRING","{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"
+"CIENG_UA:SRV_STATE","CIENG_UA","SRV_STATE","Server/ServerStatus/State (0 = Running)","CIENG_SUB","Input","http://opcfoundation.org/UA/","NUMERIC","2259"

examples/CI-Eng-Sample/15_item_opcua_df.qli

@@ -0,0 +1,13 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Items connected to OPC UA points of station CIENG_UA
+@FIELDS
+NAME,DESCRIPTION,ITEM_REP,VALUE_FORMAT,STATION,POINT
+
+@ITEM_DF
+"CI-Eng-Sample.UA.LEVEL_COPY","TANK1.LEVEL read back through OPC UA","Real","999.9","CIENG_UA","LEVEL"
+"CI-Eng-Sample.UA.SRV_STATE","OPC UA server state (0 = Running)","Integer","9","CIENG_UA","SRV_STATE"

examples/CI-Eng-Sample/76_remove_item_opcua_df.qli

@@ -0,0 +1,13 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove items connected to OPC UA points
+@FIELDS
+NAME
+
+@ITEM_DF
+"CI-Eng-Sample.UA.LEVEL_COPY"
+"CI-Eng-Sample.UA.SRV_STATE"

examples/CI-Eng-Sample/77_remove_opcua_station_df.qli

@@ -0,0 +1,25 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove OPC UA points, subscription, station
+@FIELDS
+NAME
+
+@OPCUAC_POINT_DF
+"CIENG_UA:LEVEL"
+"CIENG_UA:SRV_STATE"
+
+@FIELDS
+NAME
+
+@OPCUAC_SUBSCRIPTION_DF
+"CIENG_UA:CIENG_SUB"
+
+@FIELDS
+NAME
+
+@OPCUAC_STATION_DF
+"CIENG_UA"

examples/CI-Eng-Sample/78_remove_opcua_line_df.qli

@@ -0,0 +1,12 @@
+@LANGUAGE
+ENGLISH
+
+@VERSION
+1.03.00
+
+! Remove the OPC UA client line (stops process OPXCIENG)
+@FIELDS
+NAME
+
+@OPCUAC_LINE_DF
+"CIENG_UA_LINE"

examples/CI-Eng-Sample/91_remove_item_df.qli

@@ -19,4 +19,5 @@ NAME
 "CI-Eng-Sample.SYSTEM.PROC_ALM"
 "CI-Eng-Sample.DEMO.COUNTER"
 "CI-Eng-Sample.PLC1.COMM_OK"
+"CI-Eng-Sample.UA.COMM_OK"
 "CI-Eng-Sample.TEMPLATES.TPL_REAL"

examples/CI-Eng-Sample/92_remove_section_df.qli

@@ -13,6 +13,7 @@ NAME
 "CI-Eng-Sample.PUMP1"
 "CI-Eng-Sample.SYSTEM"
 "CI-Eng-Sample.PLC1"
+"CI-Eng-Sample.UA"
 "CI-Eng-Sample.DEMO"
 "CI-Eng-Sample.TEMPLATES"
 "CI-Eng-Sample"

examples/CI-Eng-Sample/README.md

@@ -60,6 +60,13 @@ cmd /c "<repo>\examples\CI-Eng-Sample\remove.cmd"
 | `CIENG_MB_LINE` | Modbus line (TCP/IP) | Equipment manager `EQPCIENG` (created and started by loading the line) |
 | `CIENG_PLC` | Modbus station | Open Modbus/TCP to `localhost:5020`, unit 1, output method *On change and connect* |
 | `CIENG_SCAN1S` | Modbus scan type | 1000 ms |
+| `CI-Eng-Sample.UA` | Section | OPC UA loopback station |
+| `CI-Eng-Sample.UA.COMM_OK` | Item, Boolean | Status item of station `CIENG_UA` (1 = connected) |
+| `CI-Eng-Sample.UA.LEVEL_COPY` | Item, Real | `TANK1.LEVEL` read back through CI Server's own OPC UA server |
+| `CI-Eng-Sample.UA.SRV_STATE` | Item, Integer | OPC UA server state node (ns 0, i=2259), 0 = Running |
+| `CIENG_UA_LINE` | OPC UA client line | Client process `OPXCIENG` (created and started by loading the line) |
+| `CIENG_UA` | OPC UA station | `opc.tcp://localhost:34493`, Basic256Sha256 / SignAndEncrypt, anonymous; subscription `CIENG_SUB` (1 s); points `LEVEL`, `SRV_STATE` |
+| OPC visible | Flags | Sections `CI-Eng-Sample`, `TANK1` and item `TANK1.LEVEL` are OPC visible, item read-only (`12_opc_visible_df.qli`) |
 | `CIENG_VIEWER` | Authorization group | Read-only: `ITEM_READ`, `SECTION_READ`, `ALARM_CURRENT_READ`, `ALARM_CHRONO_READ`. No users are created by the sample. |
 
 Items created by objects (`TANK1.CALC.VOLUME`, `TANK1.JFLOW.sPerMin`) and their sections are
@@ -80,6 +87,8 @@ New items start with status 13 (`NOT INIT`) until a value is written.
 | `05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli` | Trigger group; classes (source in the `METHOD` memo, `@"` … `"@`, `COMPILE` 1; Traditional and Java); objects (`ATTR_VALUE_1` = prompt answer) |
 | `08_auth_group_df.qli` | Authorization group (`AUTH_GROUP_DF`) |
 | `09_modbus_line_df.qli`, `10_modbus_station_df.qli`, `11_item_eqp_df.qli` | Modbus line; station, scan type, points; items connected to points |
+| `12_opc_visible_df.qli` | OPC visible / read flags (loaded with `dssqld -m`) |
+| `13_opcua_line_df.qli`, `14_opcua_station_df.qli`, `15_item_opcua_df.qli` | OPC UA client line; station, subscription, points; connected items |
 | `equipment/eqpciengslv_start.cmd`, `_stop.cmd` | Start/stop the Modbus slave mirror (copy to `tls\com`) |
 | `80_`…`92_remove_*.qli` | Names to delete, in reverse order |
 | `load.cmd`, `remove.cmd` | Run the steps in the right order |
@@ -101,6 +110,22 @@ start eqpmdcslvtcp -n EQPMDCSLVTCP -p 5020
 Remove the two files from `tls\com` when the sample is removed. See skill `equipment`, task
 `modbus-station.md`.
 
+## OPC UA loopback (station CIENG_UA)
+
+`CIENG_UA` is CI Server's OPC UA client connected to CI Server's own OPC UA server, so no
+external server is needed. The **first** connection on a system needs a one-time certificate
+exchange, done by the user (skill `data-access`, task `opcua-client.md` §4):
+
+1. After loading, the client logs `OPXC-E-CER_NO_TRU`; trust the server certificate in
+   `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` (Engineering Module, or move it to
+   `…\pkiclient\trusted\certs`).
+2. The server then rejects the client; move `CI_SERVER_OPCUA_CLIENT_OPXCIENG […].der` from
+   `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\rejected` to `…\pkiserver\trusted\certs`
+   (PowerShell: `Move-Item -LiteralPath`, the name contains brackets).
+
+Then `UA.COMM_OK` = 1 and `UA.LEVEL_COPY` follows `TANK1.LEVEL`. The trust is kept when the
+sample is removed and loaded again.
+
 ## Monitoring processes (optional)
 
 `monitoring/` holds the lines to add to the setup files in `%TLS_ROOT_PATH%\tls\sup\` so that

examples/CI-Eng-Sample/load.cmd

@@ -24,3 +24,12 @@ echo Waiting 15 seconds for equipment manager EQPCIENG to start...
 powershell -NoProfile -Command "Start-Sleep -Seconds 15"
 dssqld -i 10_modbus_station_df.qli -l 10_modbus_station_df.qlo
 dssqld -i 11_item_eqp_df.qli -l 11_item_eqp_df.qlo
+rem OPC: make TANK1.LEVEL and its sections visible to OPC clients (modify existing records)
+dssqld -m 12_opc_visible_df.qli -l 12_opc_visible_df.qlo
+rem OPC UA loopback: client line (starts OPXCIENG), station/subscription/points, connected items.
+rem The first connection needs a one-time certificate exchange (see README).
+dssqld -i 13_opcua_line_df.qli -l 13_opcua_line_df.qlo
+echo Waiting 10 seconds for OPC UA client OPXCIENG to start...
+powershell -NoProfile -Command "Start-Sleep -Seconds 10"
+dssqld -i 14_opcua_station_df.qli -l 14_opcua_station_df.qlo
+dssqld -i 15_item_opcua_df.qli -l 15_item_opcua_df.qlo

examples/CI-Eng-Sample/remove.cmd

@@ -5,6 +5,9 @@ rem Order: object, class, trigger group, storage links, stop + delete storage gr
 rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the
 rem group first gets a stop time one minute ahead; the script waits until it has passed.
 cd /d "%~dp0"
+dssqld -r 76_remove_item_opcua_df.qli -l 76_remove_item_opcua_df.qlo
+dssqld -r 77_remove_opcua_station_df.qli -l 77_remove_opcua_station_df.qlo
+dssqld -r 78_remove_opcua_line_df.qli -l 78_remove_opcua_line_df.qlo
 dssqld -r 80_remove_item_eqp_df.qli -l 80_remove_item_eqp_df.qlo
 dssqld -r 81_remove_modbus_station_df.qli -l 81_remove_modbus_station_df.qlo
 dssqld -r 82_remove_modbus_line_df.qli -l 82_remove_modbus_line_df.qlo

knowledge/issues.md

@@ -26,7 +26,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | open | Added a 5 s pause in `load.cmd`. If it happens again, capture `04_item_his_df.qlo`. | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
 | ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | open | Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. 2026-09-30 (phase 5): IM 36K10L35 §1.3/§5 explains the first part: event storage picks the unit by time stamp, never older than 60 units, and within the storage process's `gap_time` (ITHEEX/ITHEIX 2880 min) and, for EVENT/ITEM, `max_sample_delay` (ITHEIX 14400 min); older data needs earlier unit files (`hisdbg`, `hisrecover`, `isfrename`), `ithrecover <group> -p` and a restart. Practice in phase 9. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
 | ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | open | Confirm the disk value meaning and the path limit. | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
-| ISS-008 | 2026-09-30 | ACCESS (web/OPC UA server?) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | open | Identify in phase 7 (OPC Interface IM 36K10E20, Data Access IM 36K10L45). | `.claude/skills/installation-security/tasks/setup-check.md`; the phase 7 skill |
+| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
 | ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | open | Confirm on a system with IT security applied. | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
 
 | ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.2 and `itm.sup` answer it: the integral is divided by the **integration granule** `itm_int_secs` (label "Integration granule, sec.") in `itm.sup` — **system-wide**, installed value 1 (seconds); 60 = minutes, 3600 = hours. `TIME_UNIT` only applies to Rate-of-Change. Practiced 2026-09-30: set to 60 and restarted → `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` rose exactly 1.0 in 60 s; restored to 1 (file identical to backup) → 8 in 8 s. Existing integrator values are not converted when the granule changes. Closed 2026-09-30 (confirmed by user). | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
@@ -49,3 +49,8 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
 | ISS-027 | 2026-09-30 | PROCESS (`opcdbg`) | IM 36K10L10 §4 says the `opcdbg` *Dump classes/objects* files can be read by `dssqld`. The files have no `@LANGUAGE`/`@FIELDS`/`@<dataset>` headers (`NAME,"desc",prio` + source lines prefixed `- `); `dssqld -i` on the object dump gave `DSS-E-UNK_DS_NM, Unknown data set name`. | open | Use `dssqld -e CLASS_DF` / `OBJECT_DF` for transfers. Maybe an old tool reads the dump format; not found. | `knowledge/manuals/IM36K10L10-01EN.md` §4; `.claude/skills/class-object-engineering/tasks/opcdbg-checks.md` |
 | ISS-028 | 2026-09-30 | PROCESS (class reset) | After recompiling a class with objects (`RESET_REQUIRED` 1), `dssqld -m` with `CLASS_DF` `RESET` = 1 (also with `RESET_NODE` = host node name) is accepted with 0 errors but does not reset; `OBJECT_DF` `RESET` = 1 is refused (`OPC-E-OBJ_RSTREQ`). `opcdbg` Classes → 8 *Reset class* works; it asks for a reset report file, which the manual does not list. | open | Use `opcdbg`. Still to try: `CLASS_RESET_COMMAND` (system-wide) and the Engineering Module's reset. | `.claude/skills/class-object-engineering/tasks/change-reset-class.md`; `knowledge/manuals/IM36K10L10-01EN.md` §4 |
 | ISS-029 | 2026-09-30 | PROCESS (Java) | IM 36K10P11 §10.4 says a new Java class must be reset before objects are added, otherwise the code does not take effect. A Java class inserted with `COMPILE` 1 by `dssqld` ran its first object correctly without any reset (twice, including a full sample reload). | open | Installed behaviour is the reference; keep "reset after changing a class that has objects". Check whether the Engineering Module path (compile without quick load) behaves differently. | `knowledge/manuals/IM36K10P11-01EN.md` §7; `.claude/skills/class-object-engineering/tasks/java-class.md` |
+| ISS-030 | 2026-10-01 | BUS (UMH tools) | `umhman` (hex code → text) crashes with redirected input (bash: segmentation fault 139 with CRLF input; PowerShell `Start-Process -RedirectStandardInput`: 0xC0000005); with an argument it only prompts. `umhtestprog` prints `UMH TEST UTILITY` and crashes (segmentation fault). `umhmsg 8010008` stops with `umh_panic: …umhmsg.exe, license expired` although other tools (`dssqld`, `itmval`) still worked at that time. | open | Try `umhman` interactively in a console; check `umhmsg` on a licensed system. Similar to ISS-022 (`itmval -f`). | `.claude/skills/system-management/tasks/bus-utilities.md`; `knowledge/manuals/IM36K10L30-01EN.md` §3 |
+| ISS-031 | 2026-10-01 | LICENCE (unlicensed node) | The unlicensed test node counts down about 1 hour of run time per CI Server start (`License time left` in `smd_<node>_LOW_smdsnp_general.log`, 3600 s → `*** license problem : 3 ***`); then `dssqld`/`itmval` stop with `license expired` and `ISF-F-LIC_PROB, DATABASE Service is not licensed`. A PC sleep pauses the count (start 17:25, ran out 09:52 next day). Restart of the CI Service resets it (verified 2026-10-01, back after ~45 s). | closed | Closed 2026-10-01 (confirmed by user): known limitation of the unlicensed test system, documented in system-check. Known limitation of the test system, documented in `system-check`. Plan tests in ≤ 1 h blocks. Close when the user confirms. | `.claude/skills/system-check/SKILL.md` §3 (done) |
+| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
+| ISS-033 | 2026-10-01 | ACCESS (Engineering Module OPC UA point) | Tested by the user: the point form's *Browse path* stops at the item (`Objects/CI-Eng-Sample/TANK1/INFLOW`) and stores the item **object** `{"nsid":"548"}`; the point is not monitored (revised sampling interval 0, connected item status 13, *Last value*/*Data type* empty). Typing `{"0":"Value","itnm":"CI-Eng-Sample.TANK1.INFLOW"}` in *Node Id* fixed it (values followed at once). Browsing into an item that is OPC visible but not *Read* fails (`UncertainNotAllNodesAvailable`, `OPXC-E-BRW_NODE`). | open | Check whether the browse dialog can expand an item to `Value` (e.g. double-click); otherwise type the node ID. | `knowledge/manuals/IM36K10E20-01EN.md` §2 (done); `.claude/skills/data-access/tasks/opcua-client.md` §3 (done) |
+| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |

knowledge/manuals/IM36K10E20-01EN.md

@@ -0,0 +1,70 @@
+---
+manual: IM 36K10E20-01EN
+title: OPC Interface
+edition: 2nd Edition, Sep. 2023
+version: R1.03
+status: from docs; OPC UA point and certificate forms compared with quick load on the test system 2026-10-01 (user configured a point in the Engineering Module, exported and diffed)
+---
+
+# OPC Interface (R1.03)
+
+Engineering Module procedures for OPC Classic, OPC UA client and OPC UA PubSub. Concepts,
+setup files and the OPC servers: `IM36K10L45-01EN.md`. Everything here is under
+*Configuration → I/O processing → Equipment → (OPC DA client | OPC A&E client | OPC UA Client |
+OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
+
+## 1. OPC Classic (§1)
+
+- DA: line (equipment node, process name — the manual says it must start with `OPC` for DA and
+  A&E lines, `OPX` for OPC UA), station (OPC server node and ProgID, status item), group
+  (deadband, requested update rate, status item), point (external relation, group, OPC tag,
+  browse). Then connect items to points (Tutorial "Define points").
+- A&E: line, station (server, subscription filters), subscribed attributes; to show events in
+  the current alarm overview, map event sources to items. External names must be unique per
+  station.
+
+## 2. OPC UA client (§2)
+
+Order: line → station → subscription → points (→ methods) → alarm components / event type
+filters / event nodes / template settings (only when alarms are wanted; no alarms are received
+until event nodes are configured).
+
+| Object | Key fields (dataset field) |
+|---|---|
+| Line | name ≤ 31, equipment node (*None* = this node), **process name starts with `OPX`, ≤ 11 characters** (`EQUIPMENT_MAN`) |
+| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item*; *On scan*; *General communication status item* (`STATUS_ITEM`); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
+| Subscription | publishing interval, lifetime and keep-alive counts, max notifications, priority, publish enabled, status item |
+| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
+| Method | namespace, node ID or browse path, process areas |
+
+**Observed (2026-10-01)**: browsing in the point form stops at the item itself
+(`Objects/<section>/…/<item>`) and stores the item **object** (`{"nsid":"<n>"}`), which has no
+value: *Last value*/*Data type* stay empty and the point is never monitored (revised sampling
+interval 0, item status 13). Type the node ID of the value instead:
+`{"0":"Value","itnm":"<item>"}` (namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`, type
+STRING). The form also fills `OPC_DISPLAY_NAME` and `OPC_TAG_INFO` (browse bookkeeping;
+not needed for quick load). ISS-033.
+
+## 3. Certificates (§2.2)
+
+*OPC UA Client → Certificates*: **Trusted**, **Rejected** (server certificates arrive here),
+**Own certificate**. Trust = open the rejected certificate, tick *Trusted*, Apply; reject =
+untick. Restart the Engineering Module to refresh the folders. *Modify* the own certificate
+(name, organisation, country, domain or IP, RSA key strength, signature algorithm, validity).
+
+**CI Server OPC UA client ↔ CI Server OPC UA server (§2.2.6)**: trust the server certificate
+on the client; copy the client's own certificate
+(`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs`) to the server's
+`…\pki\opxuas\pkiserver\trusted\certs`; the manual also asks to tick *Use CI Server entity names
+for nodeids* in `opxuas.sup` and restart the server. On the test system the loopback worked
+**without** that option, using `itnm` node IDs (ISS-032).
+
+## 4. OPC UA PubSub (§3)
+
+UDP publish/subscribe of Data Access values from the CI Server OPC UA server address space
+(OPC visible items). Objects: line (needs its own copy of `ServerConfig.xml` named for the
+instance), published datasets, station, writer groups + dataset writers (publisher), reader
+groups + dataset readers (subscriber), then *Upload dataset configurations to runtime*.
+Limits per line: 4 stations, 8 writer groups, 8 reader groups, 32 dataset writers, 32 dataset
+readers, 32 published datasets. Status mapping as for the server (NORMAL → Good; NOT_INIT,
+UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE → Bad). Not practiced (needs a PubSub peer).

knowledge/manuals/IM36K10L30-01EN.md

@@ -0,0 +1,133 @@
+---
+manual: IM 36K10L30-01EN
+title: BUS Service Engineering
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; installed tools, setup files (dur.sup, durm_1_udp.sup, time_table.sup, fmfprt.sup, durutl.sup) and durm_start.cmd checked read-only 2026-10-01; durwfp verified; umhman, umhtestprog, umhmsg fail on the test system (ISS-030)
+---
+
+# BUS Service Engineering (R1.03)
+
+BUS Service is CI Server's messaging layer ("DUR", Dynamic User Region): every CI Server
+process attaches to a shared memory area and gets a **queue** (mailbox) under its DUR name;
+processes talk by messages. It also does error-text management (UMH), node-to-node links
+(MDUR), time handling, printer management and process control utilities. Section numbers refer
+to the manual.
+
+## 1. Processes (§1.2)
+
+| Process | Role |
+|---|---|
+| `durini` | Initialises DUR at start, then exits |
+| `durtim` | Runs every second: system time, summer/winter time, queue time-outs, checks that processes still exist (`DUR-W-REM_PROC, Process <x> exited unexpectedly`), clock queue |
+| `durprt` | Writes intercepted messages to `tls\lst\DURPRT.out` (debugging; leave running) |
+| `umh` / `umhlog` | Build error texts from codes (`tls\dat\messages.umh`) and write them to the message log (`umhlog.log`) |
+| Optional | `dur` (DUR display utility, interactive), `durbat` (start processes on request, also remote), `durclq` (finer clock-queue resolution: `durclq 50` = 50 ms), `durdbg`, `durutl` (logical addresses, node time sync), `durecs` (external clock), `dursim`, `durstp`, `durwfp`, `umhcr`, `umhlogtoo`, `umhman`, `umhmsg` |
+
+Process names: fixed (e.g. `UMH`), `PID<n>` when none given, or set with `-n <name>` (most
+CI Server executables, e.g. `opxuas -n opxuas`).
+
+## 2. Messages and nodes (§2–§4)
+
+- Requests are asynchronous; CI Server makes them synchronous with a *reply required* flag. The
+  **server** converts data between different computer architectures.
+- **MDUR** (§3): one `durm_<line>` process pair per network line (`durm_udp` + `durm_udp_slv`
+  on Windows), started by `tls\com\durm_start.cmd`, configured in
+  `tls\sup\durm_<line>_udp.sup`: `line`, `quality` (lower = preferred line), `io_timeout`
+  (default 8000 ms, 8 checks), `portnr` (same on all nodes of one line; > 17000 advised),
+  `max_snd`, `cluster`, `compress`, `connect_delay`, `max_poll_int`, `our_host_name`,
+  `remote_set` (up to four nodes sharing one node number = redundant set). Redundant nodes
+  only over TCP/IP. `durmdbg -q <durm> -f <file>` traces a line; always stop with `-s`.
+- `dur.sup`: node number, `host_node`, `rout_type` (ENDPOINT or ROUTER for multi-node
+  routing), sizes (`pool_kbytes`, `dur_max_proc`).
+- **Logical addresses** (§4): node −1 in an address = look up a table (`durlnm.dat`), distributed
+  by `durutl` from a master node listed with `lnm_node = …` in `durutl.sup`.
+
+**Installed (single node)**: `dur.sup` `host_node 0`, `pool_kbytes 250000`, `dur_max_proc 250`,
+`rout_type 2 ENDPOINT`; `durm_1_udp.sup` `line 1`, `quality 500`, `io_timeout 8000`,
+`portnr 17001`, plus keywords not in the manual: `sndportnr 17101`, `ip_adr_method IPv4`,
+`ENABLE_DURMS N, 0` (host-host encryption, §13); `durm_1` is running although there is no
+second node; `durutl.sup` has no active lines.
+
+## 3. Messages and the message log (§5, §6)
+
+- Codes look like `FAC-S-ACRONYM` (S = S/I/W/E/F). Text comes from `messages.umh`; dynamic
+  values are inserted by name; several codes can form one history entry.
+- `umhlog` writes to `tls\log\umhlog.log`; `-d <node>` also logs centrally on another node,
+  `-q <printer queue>` prints too.
+- Tools: `umhtestprog` (tests the message path), `umhmsg <hex code> [<var> <value>]…`
+  (issue a message from a script), `umhman` (look up a hex code, interactive),
+  `umhlogtoo` (copy of all messages to a terminal). **On the test system** `umhman` crashes
+  with redirected input, `umhtestprog` crashes, and `umhmsg` ends with "license expired"
+  (ISS-030).
+- A message shown as `UMH Message Text Error: Message number <hex> (…)` means the text could
+  not be formatted (e.g. a `%` in a PRINT text, ISS-025).
+
+## 4. Time (§7, §8, §11)
+
+- `time_table.sup`: `AUTOMATIC` (installed) = BUS Service takes summer/winter times from
+  Windows at start (scans ±15 years); otherwise `LST_OFFSET` (minutes, **positive = west**),
+  `LST_NAME`, `LCT_NAME`, `CHANGE` lines; month/day abbreviations. Reload via the DUR display
+  utility. Installed file still has the Central European example values (−60, MET/MEST); they
+  are ignored while `AUTOMATIC` is set.
+- Node time sync with `durutl` on the master: `tms_params = <interval s>, <limit1>, <limit2>,
+  <limit3>, <step2>, <step3>` and one `tms_node = <n>` per slave; beyond limit3 the slave is
+  set at once and an error is logged. External clock (serial Wharton/Trimble/Arbiter) with
+  `durecs` and `durecs.sup` (`ecs_params`). On Windows normally use Windows time
+  (`system-check`, `w32tm`).
+
+## 5. Process control utilities (§10)
+
+| Command | Use |
+|---|---|
+| `durwfp -p <name> [-t <s>] [-e]` | Exit 0 if the process is attached (waits up to `-t`, default 60; `-t 0` = check now); `-e` waits for it to go away. Verified: `umh`, `opcman` → 0, unknown name → 1 |
+| `durstp -m -p <name>` | Send a stop message (clean stop). `-k` kills, `-m -k` = stop, then kill after `-t` s; `-f` kills even with the common area locked (dangerous); `*` wildcard (`-p alm\*`). Never `durstp -k -p \*` |
+| `durbat` | Starts processes on request from other processes (also remote) |
+
+`durstp` stops CI Server processes: use only with the user's approval.
+
+## 6. Printer management (§12)
+
+`FMFPRT` (printer manager, one per node) and one `FMFP_<device>` process per device (first 8
+characters of the device name must be unique). **Destinations** (logical, e.g.
+`SCREEN_CAPTURE`, `ALARMS`, `MESSAGES`, `DEFAULT`) map to **devices** (instances of an output
+type) with an optional backup device. Configured in `fmfprt.sup`; devices and destinations in
+datasets `PRINTER_DEV_DF`, `PRINTER_DEST_DF`, `PRINTER_TYPE_DF`, `PRINTER_OPER_DEST_DF`
+(job/device lists `PRINTER_JOB_OVV`, `PRINTER_DEV_OVV`).
+
+**Installed `fmfprt.sup`**: `QUEUE_LIFE 1800` s (stalled job expires), `MAX_JOBS_SHOWN 10`,
+`DEVICE_POLL 5` s, `MAX_BUSY 60` polls; output types `HARDCOPY` (`fmfphc`, Windows printing,
+Courier New 8 pt, 72 lines, landscape), `FILE` (`fmfpfl`, file name
+`TLS_%time:DDMMYY%_%seq:03%.lst` in `tls\lst`), `APPLICATION` (`fmfpap`, program set to
+Internet Explorer); fixed destinations `ALARMS`→`ALDPRT`, `AUDIT_TRAIL`→`ADTLOG`,
+`MESSAGES`→`UMHLOG`, `PRINTER_1`→`RPTMAN`, `SCREEN_CAPTURE`→`CWSSHOT`. `NODE_SHARE = <node|-1>`
+shares printers between nodes. Logging processes do not print by default (enable per process:
+`aldprt.sup LOGPRT`, `adtsys.sup PRT_DEV`, `umhlog -q`).
+
+The CI Service account must have the printers; `DEFAULT` uses that account's default printer.
+Clean-up after a crash: stop CI Server, empty `tls\lst\printing`, delete
+`tls\sav\fmf_prt_last_id.sav`, `fmfprt.sav` and `tls\dat\printer_job_ovv.*`, start.
+
+## 7. MDUR encryption (§13)
+
+Host-host encryption (AES-256, certificates) between CI Cores: every node must use it; no
+enterprise configurations. Keys: `gen_key is_ca=1` once (CA key), `gen_key is_ca=0` on each
+node → `%TLS_ALLUSERS_PATH%\pki\mel\dur\key`; certificates with the interactive `cert_write`
+(CA certificate to `…\pki\mel\dur\crt\ca\ca.crt` on every node, node certificate to
+`…\crt\own`; create the folders first; log `tls\log\cert_write_log.log`). Then tick *Enable
+HostHost encryption* in each `durm_x_udp.sup` (installed keyword `ENABLE_DURMS`). Keep the CA
+key off the servers. Not practiced (single node; `tls\pki\mel` does not exist yet).
+
+## 8. Adaptive queues (§14)
+
+Each process has a fixed queue (the *adaptive minimum*); for processes listed on the
+*Adaptive queues* tab of `dur.sup` (`ADAPTIVE_QUEUE_SETS = <process>, <percent>`), DUR may
+grow the queue temporarily by up to that percentage of the total queue area, avoiding overflows
+during bursts. Add node queues for multi-node systems and new processes (extra executors,
+DSS servers, equipment managers). In the performance monitor *Minimum KB*/*Maximum KB*/*Current
+KB* and a high-queue of 100 % show that a queue needed more space → raise its size. Total area
+exhausted → `DUR_F_NO_SPACE`.
+
+**Installed**: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`/`WFLIDI`/`WFLADI`/`ITHEIX`/`ITHSER` 2,
+`DSSSDA*`/`DSSEVT*`/`OPCEXE` 1 %. Note: `OPCEXE` does not match the installed executor names
+`OPCEXE1`…`4` (no wildcard) — see ISS-026.

knowledge/manuals/IM36K10L45-01EN.md

@@ -0,0 +1,182 @@
+---
+manual: IM 36K10L45-01EN
+title: Data Access Engineering
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs
+---
+
+# Data Access Engineering (R1.03)
+
+ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC
+Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section
+numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on:
+skill `data-access`.
+
+## 1. ODBC (§1–§3)
+
+- Multi-tier: ODBC application + driver manager + **SimbaClient** driver on the client;
+  **SimbaServer** + ACCESS Service ODBC engine (`odbsrv`) on the CI Server. Read and write of
+  existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be
+  created or deleted over ODBC. Needs an ODBC licence.
+- `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate
+  `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`),
+  `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data
+  (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on).
+- Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium
+  (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or
+  `CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts.
+- SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`.
+- Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not
+  running / port mismatch / BUS Service not reachable.
+
+**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder
+`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
+`odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx():
+SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited
+unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set
+`USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry
+defaults once (when `%TLS_DAT_PATH%\access.new` exists).
+
+## 2. OPC Classic basics (§4)
+
+DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A
+and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`).
+- Quality: OPC DA quality goes to the **lower** 16 bits of the CI Server quality word, OPC A&E
+  quality to the **upper** 16 bits. Item to OPC: CI Server quality low byte → OPC high byte;
+  OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised →
+  NOT_CONNECTED, else GOOD.
+- Types: `VT_UI1/UI2/INT/I1/I2/I4` → Integer, `VT_UI4/UINT/R4/R8` → Real, `VT_BSTR` → String,
+  `VT_BOOL` → Boolean.
+- Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC
+  visible* (and every parent section visible).
+
+## 3. OPC DA client (§5)
+
+- One client process per DA line (name given in the line), started/stopped with CI Server;
+  stop one with `durstp -msk -t10 -p <client>`. Uses a save file in `%TLS_SAV_PATH%` named
+  after the process; delete it (client stopped) if it gets inconsistent.
+- Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running,
+  2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group
+  status item: 1 active / 0 not active (items offline).
+- Setup (`<client>.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server
+  DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING`
+  (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT`
+  (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`,
+  `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8),
+  `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
+- Advice: one OPC server per client process (a DCOM time-out blocks the whole process).
+  Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`,
+  `POINT_DF` of one station made in the Engineering Module.
+- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS,
+  DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm_<n>_udp.sup`,
+  port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's
+  setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon`
+  node monitoring with *Set slave items offline when node unavailable*.
+
+## 4. OPC DA server (§6)
+
+- COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.<version>`, DUR name `OPXDAS`; started by
+  COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown).
+- Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE
+  pattern). *Cache read* is fast and correct; *device read* blocks — use only after queue
+  overflow. Timestamp = time written into the server cache.
+- `opxsys.sup` *Data Access Server* tab: `OPXDAS_DUR_QSZ` (100 kB), `…_HBEAT`, `…_ITMBUF`,
+  `OPXDAS_USER` (log on as a CI Server user to apply its authorisation; empty = full access,
+  fastest), `OPXDAS_DCOM_TUN`, `OPXDAS_IGNORE_FTQ`. Installed also: `OPXDAS_SET_LOG_LEVEL`
+  (not described).
+- Remote access needs DCOM configuration (`dcomcnfg`: authentication Connect, impersonation
+  Identify, access/launch permissions for an OPC account; identity of the server = that account),
+  `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for
+  `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT
+  Security Tool is applied. Same account/password on both sides in a workgroup.
+- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
+  `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic),
+  `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first.
+
+## 5. OPC A&E client and server (§7, §8)
+
+- Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `<name>.sup` or `opxsys.sup`
+  (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`,
+  `…_TRACE`); maps condition events to items; one server per client advised.
+- Server `opxaes`, ProgID `Yokogawa.CIOpcAes.<version>`, DUR name `OPXAES`; publishes items
+  with alarm monitoring as conditions; `OPXAES_ACK_ALLOWED` (acknowledge from clients),
+  `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the
+  CI Server-specific event attributes (old/new value, quality, status, alarm state, item
+  description, units, node, group, number, sub-number). Installed: all on.
+
+## 6. OPC UA client (§9)
+
+- OPC UA TCP only; security by X.509 certificates (application authentication), user
+  anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256,
+  Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
+- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in
+  Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good,
+  1 bad, 2 uncertain.
+- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other
+  events INFORMATIONAL; filters by event type, component, event node; severity → priority
+  table (901–1000 → 1 … 1–100 → 15), per station; don't manage
+  NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled.
+- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold
+  backup with two endpoints (*Active server item* 0/1/2).
+- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11
+  characters), station (= session), subscription, point (= monitored item), alarm component /
+  event type filter / event node / template settings, method.
+- Certificates: the client process creates `<host>_<PROCESS>.der` in
+  `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset
+  `OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be
+  trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`,
+  `rejected` added by CI Server. The server must trust the client's certificate too.
+- Setup (`<process>.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats,
+  buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed
+  retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and
+  session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
+- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`
+  (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server
+  (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`).
+- Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`.
+
+## 7. OPC UA server (§10)
+
+- Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p
+  opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log`
+  and `OpxUas_Sdk*.log`.
+- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read
+  values, browse into the item) and **Write** (write values, alarm methods). Parent sections must
+  be visible. Without Read the item is listed but browsing into it fails
+  (`UncertainNotAllNodesAvailable`).
+- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ`
+  (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
+- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`,
+  `…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`,
+  `Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in
+  `http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections,
+  items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing;
+  the manual does not name it, ISS-032).
+- NodeIds are JSON strings: `{"nsid":"<namespace id>"}` for the entity,
+  `{"0":"Value","nsid":"<n>"}` for its value; or by name: `{"0":"Value","itnm":"<item>"}`
+  (case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`.
+  `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
+- Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH →
+  BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority →
+  severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03).
+- History: items in a history group show HistoryRead; max 5000 values per node per call.
+- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal);
+  external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM.
+- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
+  (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`,
+  `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`,
+  `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` =
+  ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE`
+  (manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034).
+- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list
+  `…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first
+  rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256,
+  Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint);
+  anonymous, user/password **and certificate** user tokens enabled (manual: certificate off,
+  ISS-034); `AutomaticallyTrustAllClientCertificates` false.
+- First connection of any client: trust the server certificate on the client, then move the
+  client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
+  suggested test client.
+- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate
+  management (concepts only).

knowledge/manuals/IM36K10L55-01EN.md

@@ -0,0 +1,51 @@
+---
+manual: IM 36K10L55-01EN
+title: Exchange Tool Engineering
+edition: 3rd Edition, Sep. 2023
+version: R1.03
+status: from docs only (needs CENTUM VP / an RGS node or CCC Prodigy data; not available on the test system)
+---
+
+# Exchange Tool Engineering (R1.03)
+
+Two tools convert another system's engineering data into CI Server engineering data
+(a "publication" = generated quick load files plus `load.cmd`). Section numbers refer to the
+manual; Appendix 1 lists the supported CENTUM VP function blocks.
+
+## 1. CI Exchange for CENTUM VP (§2)
+
+- Runs on an **RGS** (Remote Gateway Station: CI Server PC with a Vnet/IP card and driver from
+  the medium, `VirtualProduct_CIServer_packageRxxx.zip`, option *installVirtProd*) that talks
+  to CENTUM VP. *Single server*: the RGS is also the CI Core. *Non-single*: an upper CI Core
+  gets the data from the RGS (MDUR).
+- Solutions: **RGS** (manual or automatic mode; automatic = the tool is embedded in the RGS,
+  ENG HIS equalisation enabled, the RGS registered in the CENTUM VP project; publications
+  generated after each CENTUM VP download) and **RGS with EAL** (external alarms; manual mode
+  only).
+- Manual workflow: start the tool → create a project (*Single Server* ticked or not) → import
+  CENTUM VP engineering data from the ENG HIS (and MTL file) → *Publish* (name pattern, folder,
+  optional SQL tag filter such as `%PVI%`) → copy the publication folder to
+  `C:\Program Files (x86)\Yokogawa\CIServer\Utility` → run its `load.cmd` on the RGS and/or CI
+  Core (in an IT-security environment run `cmd.exe` *as different user* first). Automatic
+  publications land in `%TLS_ALLUSERS_PATH%\lst\rgs\pub\`.
+- Output: items `<section>.<TAG>.<PARAM>` (e.g. `<Section>.FIC001.PV`), points
+  `<STATION>:[<item>]`, plus lines/stations, displays and symbols (displays only on the CI
+  Core in non-single configurations).
+- Precautions (§2.15): refresh open LIST displays after a CENTUM VP online download; CI Server
+  does not allow alarm limits on the wrong side of SV; short data gaps after Vnet scan changes
+  or RDC switch-over; trends may lag after large downloads — reload displays, roll over the
+  history group, tune scan types.
+- Installed: launcher `%TLS_ROOT_PATH%\tls\com\jwuiutl_ciexchange.cmd` (no RGS on the test
+  system).
+
+## 2. CI Exchange for Prodigy (§3)
+
+- For CCC Prodigy turbo-machinery controllers (antisurge, performance, speed). Input: the
+  Modbus register list (`.csv`, from MakerPro) per controller; the station name and IP are
+  entered in the tool.
+- Install: copy `Windows\EngineeringTools\CIExchange_Prodigy.zip` from the medium, extract to
+  `C:\Program Files (x86)\Yokogawa\CIServer\Utility` (create the folder), run
+  `CIExchange_Prodigy.cmd`.
+- Workflow: create project → import source configuration → generate publication → load it.
+  Output: items `<section>.<Prodigy variable path>`, Modbus points `<STATION>:[<item>]`, and
+  faceplates (title and engineering unit can be customised, §3.12.1).

knowledge/progress.md

@@ -44,10 +44,10 @@ AID is not needed.
 | 6 | IM 36K10L10 | Class/Object Engineering | done; `opc.sup` read-only, `opcdbg` read-only actions and Reset class practiced ([notes](manuals/IM36K10L10-01EN.md)); skill `class-object-engineering` |
 | 6 | IM 36K10P10 | Class Description Language - Traditional | done for prompts, signals, created items, transitional operators, PRINT/ERROR; timers, alarms, containment, STEP, DSS routines, AGA from docs ([notes](manuals/IM36K10P10-01EN.md)) |
 | 6 | IM 36K10P11 | Class Description Language - Java | done for a basic class (attach/create items, signal trigger, systemMessage); timers, containment, inheritance from docs ([notes](manuals/IM36K10P11-01EN.md)) |
-| 7 | IM 36K10L55 | Exchange Tool Engineering | not started |
+| 7 | IM 36K10L55 | Exchange Tool Engineering | summarized, from docs only (needs CENTUM VP / RGS or Prodigy) ([notes](manuals/IM36K10L55-01EN.md)) |
-| 7 | IM 36K10L30 | BUS Service | not started |
+| 7 | IM 36K10L30 | BUS Service | done for single-node checks; MDUR, encryption, logical addresses, printer devices from docs ([notes](manuals/IM36K10L30-01EN.md)); task `system-management/bus-utilities.md` |
-| 7 | IM 36K10L45 | Data Access Engineering | not started |
+| 7 | IM 36K10L45 | Data Access Engineering | done for OPC UA client/server (loopback); OPC DA/A&E from docs (DA loopback not allowed); ODBC not running (ISS-008) ([notes](manuals/IM36K10L45-01EN.md)); skill `data-access` |
-| 7 | IM 36K10E20 | OPC Interface | not started |
+| 7 | IM 36K10E20 | OPC Interface | summarized; OPC UA point form compared with quick load by the user ([notes](manuals/IM36K10E20-01EN.md)) |
 | 8 | IM 36K10L15 | Alarm Management Engineering | not started |
 | 8 | IM 36K10C20 | Engineering Module - Alarms | not started |
 | 8 | IM 36K10E30 | Alarm System Performance Analysis | not started |
@@ -115,3 +115,8 @@ now come before classes and objects (phase 6), and the other interfaces follow a
 | R10/R20 | Change a setup file safely ([task](../.claude/skills/portal-setup/tasks/change-setup-file.md)) | passed | n/a | `jwuiisg.sup` HTTP port 8080 → 8081 (text edit, elevated restart): 8081 served the page, 8080 refused; restored, hash identical to backup. Editor: *OK* writes at once, *Reset Field* restores the default (ISS-016). |
 | R10 | Separate CI Portal node (licence, DURM line, `dur.sup` host node, copy displays) | not practiced | n/a | Needs a second node. |
 | R10 | Login method / login control | not practiced | n/a | Moved to `dssana.sup` (ISS-017); phase 5 (C10) and 13 (J40). |
+| L45/E20 | OPC UA client → own OPC UA server loopback by quick load; certificate exchange; node IDs ([task](../.claude/skills/data-access/tasks/opcua-client.md)) | passed | passed | Station `CIENG_UA` (`opc.tcp://localhost:34493`, Basic256Sha256/SignAndEncrypt): `UA.LEVEL_COPY` follows `TANK1.LEVEL` (55, 62.5, 71, 33, 44.4), `UA.SRV_STATE` 0. Certificates trusted by the user (client side, then server side). Entity namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` found by browsing `OPCUAC_TAG_DF` (ISS-032). Full remove/reload clean, reconnects without a new exchange. User configured a point in the Engineering Module: browse stores the item object, value node must be typed (ISS-033); test item/point removed afterwards. |
+| L45 | ACCESS read-only checks: processes, ports, OPC UA server config/PKI, ODBC server ([task](../.claude/skills/data-access/tasks/access-checks.md)) | passed | n/a | ISS-008 cause found: `odbsrv` cannot load its SSL certificate (folder `tls\pki\odbsrv` missing) and exits. |
+| L30 | BUS utilities: `durwfp`, setup files (`dur.sup`, `durm_1_udp.sup`, `time_table.sup`, `fmfprt.sup`) ([task](../.claude/skills/system-management/tasks/bus-utilities.md)) | passed (read-only) | n/a | `umhman`, `umhtestprog`, `umhmsg` fail (ISS-030). Unlicensed run-time limit hit and documented (ISS-031). |
+| L30 | MDUR node links, encryption, logical addresses, printer devices | not practiced | n/a | Single node, no printer devices. |
+| L55 | CI Exchange for CENTUM VP / Prodigy | not practiced | n/a | Needs CENTUM VP (RGS, Vnet/IP) or Prodigy data. |