R1.05 re-check: installation-security, data-access, equipment #27
11 changed files with 100 additions and 15 deletions
|
|
@ -47,7 +47,7 @@ Rules:
|
|||
|
||||
| Task | File | Status |
|
||||
|---|---|---|
|
||||
| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified on R1.03; R1.05 files and datasets checked, loopback not re-run |
|
||||
| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified on R1.03; R1.05 files and datasets checked; loopback awaiting user decision (sample load) |
|
||||
| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified on R1.03 (UA); DA/A&E from docs |
|
||||
| Read-only checks: ACCESS processes, ports (34493, 1583, 34597), OPC UA server config and PKI, extended functions, certificate validity, ODBC server state | `tasks/access-checks.md` | verified on R1.05 (2026-10-08) |
|
||||
| OPC UA client methods (`MTD_*` object, method form, `CIX_UAC_MTD` point) and R1.03 → R1.04 method upgrade | `tasks/opcua-client.md` §7 | from docs |
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
|
||||
version: R1.05 (first written for R1.03)
|
||||
source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §10, §11; IM 36K10E20-01EN 4th ed. (Feb. 2026) §2; practiced on CI-Eng-Sample 2026-10-01 on R1.03 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
|
||||
status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; the loopback itself was not re-run on the shared R1.05 test server. §7 (methods) from docs.
|
||||
status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; the loopback itself awaits the user's decision to load CI-Eng-Sample on the shared R1.05 test server (V4), the new form fields await user verification (V3; knowledge/r105-verification.md). §7 (methods) from docs.
|
||||
---
|
||||
|
||||
# OPC UA client to an OPC UA server
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
task: Modbus TCP station by quick load (line, station, scan type, points, items)
|
||||
version: R1.05 (first written for R1.03)
|
||||
source: IM 36K10L41-01EN §2, §3.1–3.2, §3.6–3.7; IM 36K10C10-01EN §4.1; practiced on CI-Eng-Sample 2026-09-30
|
||||
status: verified on R1.03 (2026-09-30); on R1.05 the datasets, setup files and start scripts were checked identical (2026-10-08, read-only), not re-run (the sample is not loaded on the shared R1.05 server)
|
||||
status: verified on R1.03 (2026-09-30); on R1.05 the datasets, setup files and start scripts were checked identical (2026-10-08, read-only), re-run awaiting the user's decision to load CI-Eng-Sample on the shared R1.05 server (V4 in knowledge/r105-verification.md)
|
||||
---
|
||||
|
||||
# Modbus TCP station by quick load
|
||||
|
|
|
|||
|
|
@ -31,8 +31,10 @@ Rules:
|
|||
Manual. From R1.04 VAGW Bossd is stopped and started with `vagwstarter.exe` (Setup summary §3).
|
||||
- Read paths from the `TLS_*` variables: the manuals print the default install paths, which
|
||||
may not be where CI Server is installed (ISS-086).
|
||||
- IT security (IT Security Tool, CIX_ groups, LAPS) is **from docs only** for R1.05: the R1.05
|
||||
test server runs Windows Server 2025, where the tool is not supported, and it is not installed.
|
||||
- IT security (IT Security Tool, CIX_ groups, LAPS) is **not tested** on R1.05 (from docs): the
|
||||
R1.05 test server runs Windows Server 2025, where the tool is not supported, and it is not
|
||||
installed. Vnet/IP, the upgrade merge and PRM are not tested either (see
|
||||
`knowledge/r105-verification.md`).
|
||||
|
||||
| Task | Where | Status |
|
||||
|---|---|---|
|
||||
|
|
|
|||
|
|
@ -74,7 +74,8 @@ Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports `[CHECK]` for t
|
|||
|
||||
## R1.05 test server result (2026-10-08)
|
||||
|
||||
Checks run one by one, read-only (the script itself was not run there). Windows Server 2025
|
||||
Checks run one by one, read-only. The script itself is **awaiting user verification** (V2 in
|
||||
`knowledge/r105-verification.md`). Windows Server 2025
|
||||
Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in
|
||||
`C:\Yokogawa\CIServer` without the IT Security Tool.
|
||||
|
||||
|
|
@ -85,7 +86,7 @@ Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) i
|
|||
domain network off and no CI Server inbound rules; Defender on; automatic updates, defrag
|
||||
and component cleanup not disabled; virtual memory not a custom size; .NET 3.5 not
|
||||
installed; no `CIX_` groups, no `CTM_PROCESS`, no VAGW Bossd service (IT Security Tool not
|
||||
installed and not supported on Server 2025, so IT security cannot be verified on this server).
|
||||
installed and not supported on Server 2025, so IT security is **not tested** on this server).
|
||||
- `ci_start.log`: all services started; the same odbsrv SSL certificate error as on R1.03
|
||||
(ISS-008).
|
||||
|
||||
|
|
|
|||
|
|
@ -10,3 +10,4 @@ that area's skill (`.claude/skills/<area>/reference/`).
|
|||
| `manuals/` | One summary per manual (`IM36K….md`), written in our own words |
|
||||
| `document-map.md` | All EN manuals by IM number, with editions |
|
||||
| `version-differences.md` | What changed from R1.03 to R1.05 (manuals and installed files) |
|
||||
| `r105-verification.md` | R1.05 checks marked *not tested* and the steps awaiting user verification |
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ manual: IM 36K01C10-01EN
|
|||
title: CI Server Setup
|
||||
edition: 5th Edition, Feb. 2026
|
||||
version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
|
||||
status: from docs (Windows settings, services, ports and upgrade-merge files checked read-only on the R1.03 test system and the R1.05 test server, 2026-10-08; IT security not verifiable on the R1.05 test server)
|
||||
status: from docs (Windows settings, services, ports and upgrade-merge files checked read-only on the R1.03 test system and the R1.05 test server, 2026-10-08; not tested on the R1.05 test server: IT security, Vnet/IP, the upgrade merge itself and PRM, which are not available there)
|
||||
---
|
||||
|
||||
# CI Server Setup (R1.05)
|
||||
|
|
|
|||
|
|
@ -157,7 +157,7 @@ with an administrator account. The RESTful API is HTTPS only; use the newest TLS
|
|||
|
||||
## 7. IT security version 3.0 (new in R1.05)
|
||||
|
||||
From docs only (§2.1, §3.7, §4.8.3–4.8.4, ch. 6). Installation: Setup summary §2.1.6.
|
||||
From docs, not tested (IT Security Tool not available on the R1.05 test server) (§2.1, §3.7, §4.8.3–4.8.4, ch. 6). Installation: Setup summary §2.1.6.
|
||||
- Chosen in the IT Security Tool next to 2.0; needs a licence number per computer. The full
|
||||
setting list is a PDF installed with the tool. Settings are grouped in categories (Access
|
||||
Control, Firewall per profile, System Services, Password Policy, Account Lockout Policy,
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ manual: IM 36K10L40-01EN
|
|||
title: EQUIPMENT Service Engineering - Utilities
|
||||
edition: 4th Edition, Feb. 2026 (R1.05); content unchanged since the 3rd Edition, Sep. 2023 (R1.03): the revision table lists contact information only
|
||||
version: R1.05 (first written for R1.03)
|
||||
status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08), eqpdbg not run there
|
||||
status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08); eqpdbg "Get main info" on R1.05 awaiting user verification (V1 in knowledge/r105-verification.md); EQT tools not tested (no EQT line)
|
||||
---
|
||||
|
||||
# EQUIPMENT Service Engineering - Utilities (R1.05)
|
||||
|
|
@ -43,7 +43,7 @@ normally read hourly.
|
|||
`tls\tpl\eqtfrcscn.tpl` has the same `FORCE` / `FCX_EVENT` / `queue_size` keywords and I/O type
|
||||
list, with the EQT node and process as arguments. R1.05 installs no `eqtfrcscn.sup`; an
|
||||
`eqtfrcscn_start.cmd` in `tls\com` would start it, because `equipment_start.cmd` runs
|
||||
`eqt*start.cmd`. The manual does not describe it (ISS-078; checked from files only, not run).
|
||||
`eqt*start.cmd`. The manual does not describe it (ISS-078; checked from files only, not tested: no EQT line on the R1.05 test server).
|
||||
Example: a change of the trigger item makes 60 s points scan every 10 s for 600 s.
|
||||
Long scan intervals can let an RTU close its TCP socket; keep at least one faster item or
|
||||
lengthen the RTU's socket timeout.
|
||||
|
|
|
|||
|
|
@ -40,12 +40,18 @@ and its row here is updated.
|
|||
|
||||
**R1.05 status:** not started · manual diff read · re-checked (read-only) · re-tested · done
|
||||
|
||||
Two labels for checks Claude cannot do (details and steps in
|
||||
[`r105-verification.md`](r105-verification.md)): **not tested** = the function is not
|
||||
available on the R1.05 test server (reason given); **awaiting user verification** = Claude
|
||||
prepared the step and the user runs it on the server or in the GUI and sends the output or a
|
||||
screenshot.
|
||||
|
||||
| Skill / area | Manual changes after R1.03 | R1.05 status | Notes |
|
||||
|---|---|---|---|
|
||||
| `system-check` | — | re-checked (read-only) | Version, paths, service, node, time on the R1.05 test server 2026-10-08. Start/stop not repeated (shared server). |
|
||||
| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server (the script itself was not run there). IT security cannot be verified there (Windows Server 2025, IT Security Tool not installed). ISS-086–090. |
|
||||
| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; OPC UA loopback not re-run (shared server). Sample qli files unchanged. ISS-080–085. |
|
||||
| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. `eqpdbg` not re-run on R1.05 (blocked as a remote command). Sample qli files unchanged. ISS-076–079. |
|
||||
| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server. **Awaiting user verification:** the script itself (V2). **Not tested:** IT security 2.0/3.0, LAPS, Vnet/IP, upgrade merge, PRM (not available there). ISS-086–090. |
|
||||
| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; Sample qli files unchanged. **Awaiting user verification:** Engineering Module forms (V3); OPC UA loopback needs the sample loaded (V4, decision). **Not tested:** OPC A&E direct alarms, PubSub, imported information model. ISS-080–085. |
|
||||
| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. Sample qli files unchanged. **Awaiting user verification:** `eqpdbg` main info (V1); Modbus station re-test needs the sample loaded (V4, decision). **Not tested:** IEC 104 / IEC 61850 and the EQT tools (no device). ISS-076–079. |
|
||||
| pyTOOLS (new) | P40 new | not started | No skill yet. |
|
||||
| `graphics` | C50, C60, R30 (small) | manual diff read | |
|
||||
| `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | The REST API itself is described in skill `data-access` (L45 ch. 4); link to it from here. |
|
||||
|
|
@ -58,7 +64,7 @@ and its row here is updated.
|
|||
| `class-object-engineering` | none | not started | |
|
||||
| `high-availability` | none | not started | |
|
||||
| `reporting` | none | not started | |
|
||||
| `examples/CI-Eng-Sample` | — | not started | Load on the shared server only with the user's approval. |
|
||||
| `examples/CI-Eng-Sample` | — | not started | Awaiting the user's decision to load it on the shared server (V4 in `r105-verification.md`). |
|
||||
|
||||
## Manuals, in working order
|
||||
|
||||
|
|
|
|||
75
knowledge/r105-verification.md
Normal file
75
knowledge/r105-verification.md
Normal file
|
|
@ -0,0 +1,75 @@
|
|||
# R1.05 verification checklist
|
||||
|
||||
Two kinds of R1.05 checks are open after the read-only re-check of 2026-10-08:
|
||||
|
||||
- **Not tested:** the function is not available on the R1.05 test server, so it cannot be
|
||||
tested there at all. The content stays "from docs" and is marked **not tested** with the
|
||||
reason. Nothing to do until a suitable system exists.
|
||||
- **Awaiting user verification:** Claude could not run the step itself (refused as a remote
|
||||
command, needs an administrator, needs the GUI). Claude prepared the steps and expected
|
||||
results below; the user runs them on the server or in the GUI and sends the output or a
|
||||
screenshot, and Claude records the result in the task file and in `progress.md`.
|
||||
|
||||
All steps below are read-only: they open forms or print information and save nothing.
|
||||
Close every form with *Cancel*.
|
||||
|
||||
## Not tested on the R1.05 test server
|
||||
|
||||
| Area | Reason | Where marked |
|
||||
|---|---|---|
|
||||
| IT Security Tool (version 2.0 / 3.0), `CIX_` groups, `CTM_PROCESS`, LAPS, GPO import | Tool not installed; Windows Server 2025 is not supported by the tool | skill `installation-security`, C10/C30 summaries |
|
||||
| Vnet/IP drivers, VAGW Bossd | No Vnet/IP card; not supported on Server 2025 | skill `installation-security`, C10 summary |
|
||||
| Upgrade from R1.03/R1.04 with the automatic configuration merge (`jupgutl`, `-c` argument) | Fresh R1.05 install, no upgrade to observe; an upgrade test needs a separate machine | C10 summary, ISS-086 |
|
||||
| CI Server with PRM | No PRM | C10 summary, ISS-090 |
|
||||
| IEC 60870-5-104 and IEC 61850 (EQT managers, report control blocks, `eqtdbg`, `eqtfrcscn`) | No device and no EQT line on the server | skill `equipment`, L40/L41 summaries, ISS-076–079 |
|
||||
| OPC A&E `OPXAES_DIR_ALM`, OPC UA PubSub, imported information model | Needs another client/server or extra server instances | skill `data-access`, ISS-085 |
|
||||
|
||||
## Awaiting user verification
|
||||
|
||||
### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3)
|
||||
|
||||
On the R1.05 test server, in a normal command prompt:
|
||||
|
||||
```
|
||||
eqpdbg 0 EQPMDC
|
||||
```
|
||||
|
||||
Type `1` (Get main info), Enter, read the output, then `-1` (Exit). Expected: line type 107,
|
||||
the Modbus line(s) attached, scan interval (tick) in ms, number of slaves, line load %.
|
||||
Do not choose any other action number. Send a screenshot of the output.
|
||||
|
||||
### V2. Setup check script (skill `installation-security`, task `setup-check.md`)
|
||||
|
||||
Copy `tools/setup_check.ps1` from this repo to a scratch folder on the server, run it in an
|
||||
**elevated** Windows PowerShell, then delete the copy:
|
||||
|
||||
```
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File setup_check.ps1
|
||||
```
|
||||
|
||||
Expected (from the one-by-one checks of 2026-10-08): CI Server 1.05.00 OK; Windows Server 2025
|
||||
Datacenter shown as not in the list; DIFF for firewall domain profile, Defender, automatic
|
||||
updates, defrag / component cleanup, page file, .NET 3.5, missing `CIX_` groups; CHECK lines
|
||||
for IT security. Send the result table (screenshot or text).
|
||||
|
||||
### V3. Engineering Module forms (skill `data-access`)
|
||||
|
||||
In the Engineering Module on the server (log on as a user with engineering rights), open each
|
||||
form below, take a screenshot, and close it with *Cancel*:
|
||||
|
||||
1. *Tools › OPC UA Information Model Mapper*: the mapper window opens (shows *New Mapping*).
|
||||
2. *Authorisation › Users*, any user: the *Add API Key* function exists (do not create a key).
|
||||
3. An OPC UA client point form (*New* on an OPC UA station is enough to see it, then
|
||||
*Cancel*): the checkbox *Read additional node information* exists.
|
||||
4. An OPC UA client method form: fields for node ID type, *Options* tab (parent object node ID)
|
||||
and *Arguments* tab; no process-area field.
|
||||
|
||||
If no OPC UA client line exists on the server, steps 3–4 need one: skip them and say so.
|
||||
|
||||
### V4. Needs a decision first: CI-Eng-Sample on the R1.05 test server
|
||||
|
||||
The sample tasks (Modbus mirror station, OPC UA loopback, items, alarms …) can only be
|
||||
re-tested on R1.05 by loading `CI-Eng-Sample` (all names `CIENG*`) onto the shared server. It
|
||||
adds records and starts extra equipment processes (`EQPCIENG` on port 5020), but touches no
|
||||
other project's records. Load only after the user approves; otherwise these tasks stay
|
||||
"verified on R1.03, files checked identical on R1.05".
|
||||
Loading…
Add table
Reference in a new issue