R1.05 re-check: installation-security, data-access, equipment #27
30 changed files with 1363 additions and 340 deletions
|
|
@ -1,24 +1,27 @@
|
|||
---
|
||||
name: data-access
|
||||
description: >-
|
||||
CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to
|
||||
connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points,
|
||||
certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC
|
||||
DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints,
|
||||
security policy, trusting client certificates, UaExpert), check why an OPC connection fails
|
||||
(BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM
|
||||
tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server
|
||||
(odbsrv, port 1583, SSL certificate), or copy item values and timestamps into Microsoft SQL
|
||||
Server with RDBMS data exposure (dbc.sup, DEM_CONNECTION, DBCSND, DBCDEM, DATA_EXPOSURE_DF,
|
||||
data exposure aggregation interval AGG_INTERVAL, ITEM_VALUES, SQL login, DSS-E-FLT_SYN_ERR).
|
||||
Sources IM 36K10L45-01EN, IM 36K10E20-01EN, IM 36K10G10-01EN ch. 10.
|
||||
CI Server R1.05 ACCESS Service: OPC UA, OPC DA, OPC A&E, ODBC and the RESTful API. Use when
|
||||
the user wants to connect CI Server to an OPC UA server (OPC UA client line, station,
|
||||
subscription, points, certificates, node IDs, browse, OPC UA methods MTD_KEY / MTD_TRG,
|
||||
OPCUAC_METHOD_CALL2_DF), let another application read CI Server data over OPC UA, OPC DA or
|
||||
OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints, security
|
||||
policy, trusting client certificates, UaExpert, extended OPC UA functions for alarms, history
|
||||
and PubSub, OPC UA Information Model Mapper, NodeSet / imported information model), check why
|
||||
an OPC connection fails (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT,
|
||||
certificate expiry warning), configure DCOM or DCOM tunnelling for OPC Classic, use ODBC /
|
||||
SimbaClient / SQL on datasets, or check the ODBC server (odbsrv, port 1583, SSL certificate),
|
||||
use the RESTful API (jrstsrv, port 34597, API key, x-api-key), or copy item values and
|
||||
timestamps into Microsoft SQL Server with RDBMS data exposure (dbc.sup, DEM_CONNECTION, DBCSND,
|
||||
DBCDEM, DATA_EXPOSURE_DF, data exposure aggregation interval AGG_INTERVAL, ITEM_VALUES, SQL
|
||||
login, DSS-E-FLT_SYN_ERR). Sources IM 36K10L45-01EN, IM 36K10E20-01EN, IM 36K10G10-01EN ch. 10.
|
||||
---
|
||||
|
||||
# Data access: OPC, ODBC and RDBMS data exposure (R1.03; RDBMS exposure tested in R1.05 only)
|
||||
# Data access: OPC, ODBC, RESTful API and RDBMS data exposure (R1.05; first written for R1.03)
|
||||
|
||||
Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server,
|
||||
setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment
|
||||
lines/stations/points in general: skill `equipment`.
|
||||
Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, RESTful API, OPC DA/A&E/UA client and
|
||||
server, setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, Information
|
||||
Model Mapper, PubSub). Equipment lines/stations/points in general: skill `equipment`.
|
||||
|
||||
Rules:
|
||||
- Run `system-check` first; follow the user's chosen way of working.
|
||||
|
|
@ -26,20 +29,30 @@ Rules:
|
|||
common name) and let the user trust it (Engineering Module or moving the file); do not move
|
||||
certificate files yourself.
|
||||
- Making items OPC visible / writable exposes them to every OPC client on the network: only
|
||||
with the user's approval, and prefer read-only.
|
||||
with the user's approval, and prefer read-only. The same applies to the RESTful API (keep its
|
||||
read-only mode, the product default, unless the user decides otherwise).
|
||||
- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
|
||||
node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine.
|
||||
- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and
|
||||
a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`).
|
||||
node's) DA/A&E server: deadlock (IM 36K10L45 5th ed. §6.3). The OPC **UA** loopback is fine.
|
||||
- **Extended OPC UA functions are off by default since R1.04.** The OPC UA server offers only
|
||||
Data Access and methods unless `OPXUAS_ENABLE_EXTENDED_FUNC = YES` in `opxuas.sup` (needed for
|
||||
Alarms & Conditions, HistoryRead and PubSub); the OPC UA client receives no alarms unless
|
||||
`OPXC_ENABLE_EXTENDED_FUNC = YES` in its `<process>.sup`. Both are `NO` on the R1.05 test
|
||||
server (verified 2026-10-08). Source: IM 36K10L45 5th ed. ch. 11 intro, §10.4, §10.11,
|
||||
§11.6.2, App. 1.3.
|
||||
- Changing `opxsys.sup`, `opxuas.sup`, `<process>.sup`, `odbsrv.sup`, `jrstsrv.sup` or
|
||||
`ServerConfig.xml` needs admin rights and a restart: hand it to the user (skill
|
||||
`portal-setup`, task `change-setup-file.md`).
|
||||
- The same applies to `dbc.sup` (RDBMS data exposure). SQL Server changes (mixed mode, logins,
|
||||
jobs) are on another system: only with the user's and the SQL Server owner's agreement.
|
||||
|
||||
| Task | File | Status |
|
||||
|---|---|---|
|
||||
| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified |
|
||||
| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs |
|
||||
| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified |
|
||||
| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified on R1.03 and R1.05 (loopback re-tested 2026-10-08) |
|
||||
| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified on R1.03 (UA); DA/A&E from docs |
|
||||
| Read-only checks: ACCESS processes, ports (34493, 1583, 34597), OPC UA server config and PKI, extended functions, certificate validity, ODBC server state | `tasks/access-checks.md` | verified on R1.05 (2026-10-08) |
|
||||
| OPC UA client methods (`MTD_*` object, method form, `CIX_UAC_MTD` point) and R1.03 → R1.04 method upgrade | `tasks/opcua-client.md` §7 | from docs |
|
||||
| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
|
||||
| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) |
|
||||
| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs |
|
||||
| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the R1.03 and R1.05 test systems (ISS-008) |
|
||||
| RESTful API (`jrstsrv`, port 34597, API key, functions) | L45 summary §9 | from docs; port and setup keywords verified on R1.05 |
|
||||
| OPC UA alarms (external alarms), model change events, PubSub, imported information model / Information Model Mapper | L45 summary §6–§7, E20 summary §2–§5 | from docs |
|
||||
| RDBMS data exposure to SQL Server: SQL login, `dbc.sup` `DEM_CONNECTION`, `DATA_EXPOSURE_DF` (filter syntax), item aggregation interval, checks, table behaviour, SQL-side retention | `tasks/rdbms-exposure.md` | tested in R1.05 only (`ITEM_VALUES`); `ITEM_HISTORY` / `ITEM_INPUTS` not tested |
|
||||
|
|
|
|||
|
|
@ -1,23 +1,26 @@
|
|||
---
|
||||
task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server)
|
||||
version: R1.03
|
||||
source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01
|
||||
status: verified
|
||||
task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server, RESTful API)
|
||||
version: R1.05 (first written for R1.03)
|
||||
source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §1–§3, §4.2, §7, §10, §11; IM 36K10E20-01EN 4th ed. §2.2; practiced on the R1.03 test system 2026-10-01; re-checked read-only on the R1.05 test server 2026-10-08
|
||||
status: verified on R1.05 (2026-10-08, read-only checks below); R1.03 results kept where marked
|
||||
---
|
||||
|
||||
# ACCESS Service checks (read-only)
|
||||
|
||||
| Check | How | Test system result |
|
||||
| Check | How | Result (R1.05 test server 2026-10-08 unless marked) |
|
||||
|---|---|---|
|
||||
| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running |
|
||||
| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** |
|
||||
| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) |
|
||||
| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing |
|
||||
| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on |
|
||||
| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` |
|
||||
| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` |
|
||||
| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback |
|
||||
| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | |
|
||||
| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line), a `javaw.exe` for the RESTful API server; `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running; no `odbsrv` (same on R1.03) |
|
||||
| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 34597 (RESTful API, R1.04+), 135 (DCOM) | 34493 yes, 34597 yes, 135 yes, 1583 **no** (R1.03: same, no 34597) |
|
||||
| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008; R1.03 and R1.05) |
|
||||
| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `odbsrv.sup` identical to R1.03, `USESSL YES`, folder missing |
|
||||
| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `ServerConfig.xml` — R1.05: `%TLS_SAV_PATH%\ServerConfig.xml` (R1.03: `%TLS_ROOT_PATH%\tls\exe`; ISS-081); ignore commented XML | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on (unchanged from R1.03; the R1.05 file only adds SDK sections) |
|
||||
| Extended OPC UA functions | `findstr EXTENDED_FUNC` in `opxuas.sup` and in the client's `<process>.sup` (template `epauac_eqp.sup`) | `OPXUAS_ENABLE_EXTENDED_FUNC = NO`, `OPXC_ENABLE_EXTENDED_FUNC = NO` (product defaults): no OPC UA alarms, HistoryRead or PubSub until set to YES |
|
||||
| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der`; client own `<host>_OPXUAC_MON.der`; server `rejected` absent until the first rejection |
|
||||
| Certificate validity | `certutil -dump <file>.der` and look at `NotAfter` | Both own certificates valid 5 years from installation. The OPC UA client warns in the Historical Alarm Overview and the UMH message log before a client or server certificate expires (IM 36K10E20 4th ed. §2.2); lead time = hidden keyword `OPXC_CERT_EXP_PERIOD_WARN`, 2 months in `epauac_eqp.sup` |
|
||||
| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO`; new in R1.05: `OPXAES_DIR_ALM = YES` (A&E server, "Direct" alarm events; not in the manual, ISS-085) |
|
||||
| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`, `OPCUAC_METHOD_CALL2_DF` | R1.03: only the sample loopback. R1.05: dataset structure of line, station, subscription and point unchanged |
|
||||
| RESTful API settings | `tls\sup\jrstsrv.sup`: `JRST_NETWORK_PORT` (34597), `JRST_READ_ONLY_MODE` (product default YES), `JRST_MAX_RECORDS` (default 100), `JRST_USE_TWO_WAY_SSL` (NO), `JRST_USER_CACHE_TIME` (600 s), `JRST_CUSTOM_DATASETS`; API keys in dataset `API_KEYS_DF` (export without records in reports) | Keywords as in IM 36K10L45 5th ed. §4.2.1; compare the active values with the `!DEFAULT` block |
|
||||
| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | `OPXUAS.log`, `OpxUas_Sdk*.log`, `OPXUAC_MON.log` present |
|
||||
|
||||
Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
|
||||
with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
---
|
||||
task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
|
||||
version: R1.03
|
||||
source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
|
||||
status: verified
|
||||
version: R1.05 (first written for R1.03)
|
||||
source: IM 36K10L45-01EN 5th ed. (Feb. 2026) §10, §11; IM 36K10E20-01EN 4th ed. (Feb. 2026) §2; practiced on CI-Eng-Sample 2026-10-01 on R1.03 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
|
||||
status: verified on R1.03 (§1–§6). R1.05 (2026-10-08, read-only): line/station/subscription/point dataset definitions identical to R1.03, PKI folders and client setup files checked; loopback re-tested on R1.05 2026-10-08 with the reduced sample load (certificate exchange as in §4, done by the user; COMM_OK 1, SRV_STATE 0, LEVEL_COPY follows TANK1.LEVEL; removed afterwards), the new form fields were confirmed in the installed form definitions (point form `READ_NODE_INFO` / `REBROWSE`; method form node ID type, parent object node ID, manual arguments, no process-area field), the forms themselves not opened. §7 (methods) from docs.
|
||||
---
|
||||
|
||||
# OPC UA client to an OPC UA server
|
||||
|
|
@ -45,13 +45,25 @@ These flags also apply to the OPC DA and A&E servers.
|
|||
```
|
||||
"CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"
|
||||
```
|
||||
The process reads `tls\sup\<process>.sup` (here `opxcieng.sup`), else the template
|
||||
`epauac_eqp.sup` (IM 36K10L45 5th ed. §10.11; the R1.03 manual named a non-existent
|
||||
`opxuac.sup`, ISS-084). On the R1.03 test system `opxcieng.sup` appeared as an exact copy of
|
||||
the template. R1.05 template changes (verified 2026-10-08, ISS-083): new
|
||||
`OPXC_ENABLE_EXTENDED_FUNC` (NO; YES needed for OPC UA alarms), `OPXC_BASE_MODEL_CHANGE_EVENT`
|
||||
(NO), `OPXC_DISABLE_SAV_FILE` (NO), `OPXC_ALARM_TIME_ATTRIBUTE`, hidden
|
||||
`OPXC_CERT_EXP_PERIOD_WARN` (2 months), and `OPXC_SERVICE_CALL_TIME_OUT` 60 s (manual: 10 s).
|
||||
A per-process file copied from R1.03 lacks these keywords, so their defaults apply.
|
||||
2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name
|
||||
`<station>:<subscription>`), **points** (`OPCUAC_POINT_DF`, name `<station>:<point>`) —
|
||||
see `14_opcua_station_df.qli`:
|
||||
- Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`),
|
||||
`MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`,
|
||||
`SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 =
|
||||
connected). `SERVER_01_NAME`/`_URI` may stay empty.
|
||||
`SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (1 = connected; a Boolean
|
||||
item worked on R1.03). `SERVER_01_NAME`/`_URI` may stay empty. The R1.05 OPC Interface
|
||||
manual (IM 36K10E20 4th ed. §2.1.2) lists states 0–5 for this item (0 preparing,
|
||||
1 connected, 2 comm error/reconnecting, 3 connect failed, 4 server shutdown received,
|
||||
5 connection recreated) while IM 36K10L45 §10.9.2 still calls it Boolean; not re-tested on
|
||||
R1.05 (ISS-080). An Integer item shows all states.
|
||||
- Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000.
|
||||
- Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`),
|
||||
`OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`,
|
||||
|
|
@ -94,7 +106,26 @@ a filter; start with an empty path, then `Objects`:
|
|||
```
|
||||
|
||||
Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper
|
||||
paths were not found yet (`Objects.CI-Eng-Sample` returned nothing).
|
||||
paths were not found yet on R1.03 (`Objects.CI-Eng-Sample` returned nothing).
|
||||
|
||||
R1.05: `OPCUAC_TAG_DF` (and `OPCUAC_TAG_CMPN_DF`) have two new Boolean fields, `REBROWSE`
|
||||
(ask the server again) and `READ_NODE_INFO` (read node attributes while browsing; switching it
|
||||
off is faster on slow links) (installed `opcuac_tag_df.dss`, verified 2026-10-08; not tried).
|
||||
The point form has the matching *Read additional node information* check box, and F5 in the
|
||||
expanded *Browse path* list rebrowses (IM 36K10E20 4th ed. §2.1.5).
|
||||
|
||||
**Data types (IM 36K10L45 5th ed. §10.3.4, from docs):** UInt32, Int64 and UInt64 map to Real
|
||||
(no negatives for unsigned, no decimals), DateTime/UtcTime to String in the form
|
||||
`YYYY-MM-DDThh:mm:ss.sssZ`, ExtensionObject only for EURange / EngineeringUnits, enumerations as
|
||||
their Int32 value; one array element per point. A value that cannot be converted is logged and
|
||||
the item gets status Bad.
|
||||
|
||||
**Model change events (IM 36K10L45 5th ed. §10.5, from docs):** the client reacts to the
|
||||
server's `GeneralModelChangeEvent` (node or reference added: the point is recreated; deleted: the
|
||||
item goes offline; external alarms are refreshed with ConditionRefresh). The coarse
|
||||
`BaseModelChangeEvent` (recreate everything) is handled only with
|
||||
`OPXC_BASE_MODEL_CHANGE_EVENT = YES`. Events within 10 s are handled once; the server must
|
||||
support Read and Browse.
|
||||
|
||||
## 4. Certificate exchange (first connection; the user does it)
|
||||
|
||||
|
|
@ -116,6 +147,11 @@ again (verified: reload connected within 5 s without a new exchange). For an ext
|
|||
its certificate arrives the same way; the client certificate
|
||||
(`…\pkiclient\own\certs\<host>_<PROCESS>.der`) must be trusted on that server.
|
||||
|
||||
From R1.05 the client warns in the Historical Alarm Overview and the UMH message log before its
|
||||
own or the server's certificate expires (IM 36K10E20 4th ed. §2.2; lead time
|
||||
`OPXC_CERT_EXP_PERIOD_WARN`, 2 months in the installed template). The own certificates made at
|
||||
installation were valid for 5 years on the R1.05 test server (verified 2026-10-08).
|
||||
|
||||
## 5. Check
|
||||
|
||||
- `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9;
|
||||
|
|
@ -128,3 +164,31 @@ its certificate arrives the same way; the client certificate
|
|||
|
||||
Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the
|
||||
client process). Reset the OPC flags only if they were not there before.
|
||||
|
||||
## 7. Calling a method on an external OPC UA server (R1.04+, from docs)
|
||||
|
||||
Source: IM 36K10L45 5th ed. §10.6, App. 1.3–1.4; IM 36K10E20 4th ed. §2.1.6. Not practiced.
|
||||
Installed on R1.05 (verified 2026-10-08): dataset `OPCUAC_METHOD_CALL2_DF`, loader
|
||||
`opcuac_method_u0104`, AOG displays `AOG_UAC_Method_Demo`, `AOG_UAC_Method_Call`,
|
||||
`AOG_UAC_MethodArg_Call(2)` with their symbols.
|
||||
|
||||
1. **Class** for the method object (sample Java class `UAC_MTD_JBASE`): attribute `MTD_KEY`
|
||||
(holds the method name) and signals `MTD_TRG` (0 idle/done, 1 call, 2 failed), `MTD_RET`
|
||||
(result code as text; its quality holds the numeric code), `MTD_IN_ARG_0…` and
|
||||
`MTD_OUT_ARG_0…` (at most 10 each, same order and types as on the server). These names are
|
||||
reserved in that class. Use a class with a unique name per method object (App. 1.4).
|
||||
2. **Method** under the station (Engineering Module *Methods → Add method*, dataset
|
||||
`OPCUAC_METHOD_CALL2_DF`, name `<station>:<method>`): `OPC_NAMESPACE`, `OPC_NODE_ID_TYPE`,
|
||||
`OPC_NODE_ID`. If the server does not browse its method nodes: parent object node ID by hand
|
||||
(`MANUAL_OBJ_OPC_NODE_ID`, `OBJ_OPC_NAMESPACE`, `OBJ_OPC_NODE_ID_TYPE`, `OBJ_OPC_NODE_ID`) and
|
||||
argument types by hand (`MANUAL_ARGUMENT_CONFIGURATION`, `ARGUMENT_IN_n_TYPE` / `…OUT…`).
|
||||
3. **Point**, one per method: *Input + Output*, namespace `CIX_UAC_MTD`, type STRING, node ID
|
||||
`CIX_UAC_MTD`; connect it to the object's `MTD_TRG` signal (*Connected I/O point*). Set
|
||||
`MTD_KEY` to the method name. The process area goes on `MTD_TRG` (the method form no longer
|
||||
has one). `MTD_TRG` shows status UPD_OFFLINE.
|
||||
4. **Symbol and display** for the class (see the AOG demo display), then trigger from there.
|
||||
|
||||
Upgrade from R1.03 (App. 1.3): R1.03 methods called through dataset fields
|
||||
(`OPCUAC_METHOD_CALL_IN_DF` / `…_OUT_DF`, both gone in R1.05) stop working. Rebuild the class
|
||||
with the `MTD_*` members (*Extended reset enabled*, then reset), rebuild symbols and displays,
|
||||
and re-save (or copy and re-add) any method with String or Boolean input arguments.
|
||||
|
|
|
|||
|
|
@ -11,7 +11,9 @@ status: tested in R1.05 only
|
|||
Edition on a separate domain-joined host). Not re-tested on R1.03 or on CI-Eng-Sample (user
|
||||
decision 2026-10-02). On the R1.03 development machine the files `dbc.sup`,
|
||||
`data_exposure_df.dss` and `item_df.dss` were checked read-only and match what is described
|
||||
here (`dbc.sup` is identical in R1.03 and R1.05).
|
||||
here (`dbc.sup` is identical in R1.03 and R1.05 apart from the site's `DEM_CONNECTION` line;
|
||||
`data_exposure_df.dss` and `item_df.dss` identical; re-checked read-only on the R1.05 test
|
||||
server 2026-10-08).
|
||||
|
||||
**Changes live configuration on two systems** (SQL Server and CI Server): follow the user's
|
||||
chosen way of working. SQL Server changes on a shared server need the owner's agreement.
|
||||
|
|
|
|||
|
|
@ -1,16 +1,21 @@
|
|||
---
|
||||
name: equipment
|
||||
description: >-
|
||||
CI Server R1.03 EQUIPMENT Service: lines, stations, scan types, I/O points and conversion
|
||||
CI Server R1.05 EQUIPMENT Service: lines, stations, scan types, I/O points and conversion
|
||||
types. Use when the user wants to connect CI Server to a PLC, RTU or other device (Modbus
|
||||
TCP/RTU, STARDOM FCX, FA-M3, DNP3, IEC 60870-5-104, IEC 61850, MQTT, OPC …), define or
|
||||
remove a line, station, scan type or point, connect an item to an I/O address, set a station
|
||||
off-scan or suppress outputs, add a station communication status item, run CI Server as a
|
||||
Modbus slave, force a faster scan (eqpfrcscn), check equipment statistics or use the
|
||||
equipment debugger (eqpdbg). Sources IM 36K10L40-01EN, IM 36K10L41-01EN, IM 36K10C10-01EN §4.1.
|
||||
equipment debugger (eqpdbg), or work with the IEC 60870-5-104 / IEC 61850 EQT managers
|
||||
(eqt104, eqt850, eqtdbg, eqtfrcscn, IEC 61850 report control blocks, upgrade from R1.03).
|
||||
Sources IM 36K10L40-01EN, IM 36K10L41-01EN, IM 36K10C10-01EN §4.1.
|
||||
---
|
||||
|
||||
# Equipment (R1.03)
|
||||
# Equipment (R1.05)
|
||||
|
||||
Re-checked on R1.05 on 2026-10-08 (read-only): Modbus datasets, setup files and tools are
|
||||
identical to R1.03. IEC 60870-5-104 and IEC 61850 now run as **EQT** managers (see below).
|
||||
|
||||
Background: `knowledge/manuals/IM36K10L41-01EN.md` (line types, station parameters,
|
||||
conversion types, Modbus, driver table), `IM36K10L40-01EN.md` (forced scan, statistics,
|
||||
|
|
@ -24,12 +29,18 @@ Rules:
|
|||
- Outputs write to real devices: never write to a production station's output points without
|
||||
the user's explicit approval.
|
||||
- `eqpdbg`: only the read-only actions (see L40 summary) unless the user approves.
|
||||
- IEC 104 and IEC 61850 lines (R1.04 and later) run under an `EQT<name>` manager (`eqt104`,
|
||||
`eqt850`, started by `etaman`). `eqpdbg` and `eqpfrcscn` only reach `EQP*` managers; for EQT
|
||||
managers use `eqtdbg` (default process `EQT`, same menu and same read-only actions) and
|
||||
`eqtfrcscn` (template `tls\tpl\eqtfrcscn.tpl`). The manual does not describe these tools
|
||||
(ISS-078).
|
||||
|
||||
| Task | File | Status |
|
||||
|---|---|---|
|
||||
| Modbus TCP station by quick load: line, station, scan type, points, connected items; test, off-scan, remove | `tasks/modbus-station.md` | verified |
|
||||
| Modbus TCP station by quick load: line, station, scan type, points, connected items; test, off-scan, remove | `tasks/modbus-station.md` | verified (R1.03; re-tested on R1.05 2026-10-08) |
|
||||
| CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) |
|
||||
| Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified |
|
||||
| Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
|
||||
| OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) |
|
||||
| Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |
|
||||
| IEC 61850 / IEC 104 on R1.04 and later: EQT managers, report control blocks, upgrade from R1.03 | L41 summary §3.32 and App. 1 | from docs; installed files checked on R1.05 |
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
---
|
||||
task: Modbus TCP station by quick load (line, station, scan type, points, items)
|
||||
version: R1.03
|
||||
version: R1.05 (first written for R1.03)
|
||||
source: IM 36K10L41-01EN §2, §3.1–3.2, §3.6–3.7; IM 36K10C10-01EN §4.1; practiced on CI-Eng-Sample 2026-09-30
|
||||
status: verified
|
||||
status: verified on R1.03 (2026-09-30); on R1.05 the datasets, setup files and start scripts were checked identical (2026-10-08, read-only), re-tested on R1.05 2026-10-08 with the reduced sample load on the shared test server (setpoint 1234 read back, COMM_OK 1, eqpdbg slave GOOD; mirror started for the test only; everything removed afterwards)
|
||||
---
|
||||
|
||||
# Modbus TCP station by quick load
|
||||
|
|
@ -24,7 +24,9 @@ CI Server ships a Modbus slave "mirror" that needs no hardware:
|
|||
Started by hand from a normal prompt they run until logoff or CI Server restart. To start
|
||||
them with CI Server, an administrator copies `examples/CI-Eng-Sample/equipment/
|
||||
eqpciengslv_start.cmd` and `_stop.cmd` to `%TLS_ROOT_PATH%\tls\com`: `equipment_start.cmd`
|
||||
runs every `eqp*start.cmd` there.
|
||||
runs every `eqp*start.cmd` there. On R1.05 (checked 2026-10-08) it also runs `eqt*start.cmd`
|
||||
and, on the host node, every `?*_equipment_start.cmd` (with `?*_equipment_stop.cmd` called
|
||||
from `equipment_stop.cmd`), which is a cleaner hook for such extensions.
|
||||
|
||||
## 2. Line (`MODBUS_LINE_DF`)
|
||||
|
||||
|
|
@ -112,7 +114,7 @@ on-scan (output method *On change and connect*).
|
|||
and `tls\sav` files.
|
||||
4. The status item and section with the other items.
|
||||
|
||||
## Test system (2026-09-30)
|
||||
## Test system (R1.03, 2026-09-30)
|
||||
|
||||
Full cycle on CI-Eng-Sample: loaded, `SETPOINT` 1234/4321/2468 and `CMD` 1/0 read back
|
||||
through Modbus on `READBACK`/`FEEDBACK`, off-scan/on-scan checked, removed (manager stopped,
|
||||
|
|
|
|||
|
|
@ -1,15 +1,20 @@
|
|||
---
|
||||
name: installation-security
|
||||
description: >-
|
||||
CI Server R1.03 installation, upgrade and Windows/IT security. Use when the user wants to
|
||||
CI Server R1.05 installation, upgrade and Windows/IT security. Use when the user wants to
|
||||
prepare Windows for CI Server, check whether a machine meets the setup requirements, install,
|
||||
reinstall, upgrade or uninstall CI Server, apply or extend a licence, install CI Server Remote
|
||||
Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool, check or
|
||||
open firewall ports, manage the CIX_ groups and CIX_PROCESS account, or run CI Server on a
|
||||
virtual machine. Sources IM 36K01C10-01EN and IM 36K01C30-01EN.
|
||||
reinstall, upgrade or uninstall CI Server, merge configuration files after an upgrade
|
||||
(automatic merge, jupgutl, upgrade report), apply or extend a licence, install CI Server Remote
|
||||
Connect, set up Vnet/IP drivers or network addresses, apply the IT Security Tool (IT security
|
||||
version 2.0 or 3.0), set up LAPS, check or open firewall ports, manage the CIX_ groups and
|
||||
CIX_PROCESS account, install CI Server next to PRM, or run CI Server on a virtual machine.
|
||||
Sources IM 36K01C10-01EN and IM 36K01C30-01EN (5th editions).
|
||||
---
|
||||
|
||||
# Installation and security (R1.03)
|
||||
# Installation and security (R1.05)
|
||||
|
||||
First written for R1.03 (frozen on branch `r1.03`), re-checked against the R1.05 manuals
|
||||
(5th editions, Feb. 2026) and the R1.05 test server on 2026-10-08.
|
||||
|
||||
Background: `knowledge/manuals/IM36K01C10-01EN.md` (Setup) and
|
||||
`knowledge/manuals/IM36K01C30-01EN.md` (Security Guide). Known issues:
|
||||
|
|
@ -20,13 +25,25 @@ Rules:
|
|||
- Installing, upgrading, changing Windows settings or IT security needs an elevated session,
|
||||
changes the machine and often needs restarts: follow the user's chosen way of working and
|
||||
confirm before each step. In *prepare only* mode, produce a checklist for the user.
|
||||
- Never copy old setup files over new ones after an upgrade: compare and merge.
|
||||
- Never copy old setup files over new ones after an upgrade: compare and merge. The R1.05
|
||||
automatic merge does not cover every file (Setup summary §3).
|
||||
- Before a reinstall or upgrade, set the startup type of *CI Service* and *VAGW Bossd* to
|
||||
Manual. From R1.04 VAGW Bossd is stopped and started with `vagwstarter.exe` (Setup summary §3).
|
||||
- Read paths from the `TLS_*` variables: the manuals print the default install paths, which
|
||||
may not be where CI Server is installed (ISS-086).
|
||||
- IT security (IT Security Tool, CIX_ groups, LAPS) is **not tested** on R1.05 (from docs): the
|
||||
R1.05 test server runs Windows Server 2025, where the tool is not supported, and it is not
|
||||
installed. Vnet/IP, the upgrade merge and PRM are not tested either (see
|
||||
`knowledge/r105-verification.md`).
|
||||
|
||||
| Task | Where | Status |
|
||||
|---|---|---|
|
||||
| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified |
|
||||
| Check a machine against the setup and security requirements | `tasks/setup-check.md` | verified (R1.03; R1.05 checks run one by one) |
|
||||
| New installation (physical, VM, dual-redundant): order of work, Windows settings, Vnet/IP, install, IT security, licence | Setup summary §2 | from docs |
|
||||
| Start/stop, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
|
||||
| Start/stop CI Server and VAGW Bossd, reinstall, upgrade (incl. HAC), extend licence, uninstall | Setup summary §3 | from docs |
|
||||
| Upgrade with automatic merge of configuration files (installer checkbox, `jupgutl`, merge report and conflict log) | Setup summary §3 | from docs (files and merge patterns checked on the R1.05 test server) |
|
||||
| Install CI Server Remote Connect; web ports | Setup summary §2.4 | from docs |
|
||||
| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON ports checked) |
|
||||
| IT Security Tool, user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5 | from docs |
|
||||
| CI Server and PRM on one computer or connected | Setup summary §4 | from docs |
|
||||
| Firewall ports for CI Server and drivers | Security Guide summary §3 | from docs (web, DURM, SMDMON, RESTful API ports checked on R1.03 / R1.05) |
|
||||
| IT Security Tool (version 2.0 / 3.0), user management types, CIX_ groups/accounts, change service account | Security Guide summary §2, §5, §7 | from docs |
|
||||
| LAPS (linked domain management with IT security 3.0) | Setup summary §2.1.6, Security Guide summary §7 | from docs |
|
||||
|
|
|
|||
|
|
@ -1,27 +1,43 @@
|
|||
---
|
||||
task: Check a machine against the CI Server setup and security requirements
|
||||
version: R1.03
|
||||
source: IM 36K01C10-01EN §1, §2.1.2, §3.2.12; IM 36K01C30-01EN §2.2, §3.2; practiced on the test system 2026-09-30
|
||||
status: verified (2026-09-30)
|
||||
version: R1.05 (first written for R1.03)
|
||||
source: IM 36K01C10-01EN 5th ed. §1.3.2, §1.3.3, §2.1.2, §2.1.3, §3.3.15; IM 36K01C30-01EN 5th ed. §2.2.1, §3.2, §3.5.4, §3.7; practiced on the R1.03 test system 2026-09-30 and checked read-only on the R1.05 test server 2026-10-08
|
||||
status: verified on R1.03 (2026-09-30); R1.05 checks verified one by one (R1.05 test server, 2026-10-08), script itself not yet run on R1.05
|
||||
---
|
||||
|
||||
# Setup check (read-only)
|
||||
|
||||
```
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 -Version 1.03.00
|
||||
```
|
||||
|
||||
Run from the repo root, preferably elevated. Changes nothing. One line per check:
|
||||
Run from the repo root, preferably elevated. Changes nothing. The default target is R1.05
|
||||
(`-Version 1.05.00`); use `-Version 1.03.00` for an R1.03 machine. One line per check:
|
||||
`[OK]` matches the manual, `[DIFF]` differs, `[CHECK]` needs a human decision.
|
||||
|
||||
The script must be on the machine being checked. On a server you reach only remotely, the
|
||||
user copies it there (or runs the checks below by hand); it writes nothing.
|
||||
|
||||
## What it checks
|
||||
|
||||
| Area | Checks |
|
||||
|---|---|
|
||||
| CI Server | Installed version (1.03.00), CI Service state, startup type and account (`.\CIX_PROCESS`), VAGW service |
|
||||
| Windows | Supported OS, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy, automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
|
||||
| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed |
|
||||
| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002 |
|
||||
| CI Server | Installed version (1.05.00 by default), CI Service (`StartCIServer`) state, startup type and account (`.\CIX_PROCESS`), VAGW service |
|
||||
| Windows | Supported OS for the target version, visual effects, processor scheduling, virtual memory (custom, 1.5 × RAM), power plan, fast startup, Windows Defender policy (with the R1.05 exceptions), automatic updates policy, scheduled defrag and component cleanup, .NET 3.5, DCOM authentication level, display scale, 8dot3 names, regional settings |
|
||||
| IT security | `CIX_OPERATOR`, `CIX_ENGINEER`, `CIX_MAINTENANCE`, `CIX_OPC` groups, `CIX_PROCESS` / `CTM_PROCESS` users, IT Security Tool installed (program folder or the IT security 3.0 folder under ProgramData) |
|
||||
| Firewall | Profiles enabled; inbound allowed for TCP 8080, 8443, UDP 17001, 17101, 18002; on R1.05 also TCP 34597 (RESTful API) |
|
||||
|
||||
R1.05 supported OS (IM 36K01C10 5th ed. §1.3.2), all 64-bit: Windows 10 Enterprise / IoT
|
||||
Enterprise LTSC 2019 and 2021, Windows 11 Pro and Enterprise, Windows 11 Enterprise / IoT
|
||||
Enterprise LTSC 2024, Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025
|
||||
(Standard). On Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT
|
||||
Security Tool are not supported. Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016 and Server
|
||||
2016 are no longer listed.
|
||||
|
||||
Defender (IM 36K01C10 5th ed. §2.1.2, IM 36K01C30 5th ed. §3.5.4): normally turned off by
|
||||
group policy, but it must stay on with Windows 11 Pro 24H2, and it cannot be turned off on
|
||||
Windows 10 LTSC 2021 or Windows 11 LTSC 2024. The script reports `[CHECK]` for those.
|
||||
|
||||
## Reading the result
|
||||
|
||||
|
|
@ -29,23 +45,58 @@ Run from the repo root, preferably elevated. Changes nothing. One line per check
|
|||
Setup summary's Windows settings table (`knowledge/manuals/IM36K01C10-01EN.md` §2) or by
|
||||
running the IT Security Tool.
|
||||
- The script finds the firewall rules only as "some rule allows this port"; check the rule
|
||||
scope separately for production.
|
||||
scope separately for production. If the active profile is switched off, no rule is needed
|
||||
and every port is open: check which profile is active (`Get-NetConnectionProfile`).
|
||||
- Listening ports (useful when there are no rules): `Get-NetTCPConnection -State Listen` and
|
||||
`Get-NetUDPEndpoint` with the owning process. On R1.05 the RESTful API server (`jrstsrv`,
|
||||
a `javaw` process) also listens on TCP 7073, which no manual mentions (ISS-087): do not open
|
||||
it in the firewall.
|
||||
- Also read `%TLS_LOG_PATH%\ci_start.log` after a start: every service should report
|
||||
`… started` and the log ends with `CI Server started`; look for `-E-` and `failed` lines.
|
||||
The first lines show the version and build (e.g. `R1.03.00 … (r10200M)`).
|
||||
`… started` and there should be a `CI Server started` line; look for `-E-` and `failed`
|
||||
lines. The log keeps growing after the start (equipment messages), so the `CI Server
|
||||
started` line is not always last. The `UMHLOGTOO` line near the top shows the version and
|
||||
build (R1.03: `R1.03.00 … (r10200M)`, R1.05: `R1.05.00 … (r11609M)`).
|
||||
- The web ports actually used are `SECURE_PORT_NUMBER` / `NON_SECURE_PORT_NUMBER` in
|
||||
`%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default).
|
||||
`%TLS_ROOT_PATH%\tls\sup\jwuiisg.sup` (8443 / 8080 by default); the RESTful API port is
|
||||
`JRST_NETWORK_PORT` in `jrstsrv.sup` (34597 by default, R1.05).
|
||||
- Installed updates: `Get-HotFix`. `wmic qfe list full` (Setup App. 1.3) fails on Windows
|
||||
Server 2025 / 24H2, where WMIC is no longer installed (ISS-088).
|
||||
- Folder rights (not in the script): setup files can hold passwords (e.g. `dbc.sup`). Check
|
||||
who can read and change them:
|
||||
`foreach ($r in (Get-Acl "$env:TLS_ROOT_PATH\tls\sup").Access) { "{0} : {1}" -f $r.IdentityReference, $r.FileSystemRights }`.
|
||||
Under Program Files, Users can read; an install outside Program Files (e.g.
|
||||
`C:\Yokogawa\CIServer`, seen on an R1.05 system) can inherit *Authenticated Users: Modify*,
|
||||
so any signed-in user can change setup files (ISS-061). Fixing it is a site decision (IT
|
||||
Security Tool).
|
||||
`C:\Yokogawa\CIServer`, as on the R1.05 test server) can inherit *Authenticated Users:
|
||||
Modify*, so any signed-in user can change setup files (ISS-061). Fixing it is a site
|
||||
decision (IT Security Tool).
|
||||
- A local group `RDC_GA_CLIENT` with member `CIX_PROCESS` can exist on a machine that is not
|
||||
a dual-redundant platform and has no IT security applied (seen on R1.05). It needs no
|
||||
action (ISS-089).
|
||||
|
||||
## Test system result (2026-09-30)
|
||||
## R1.05 test server result (2026-10-08)
|
||||
|
||||
Checks run one by one, read-only, then the script itself (copied to a temporary folder,
|
||||
run from an elevated session, deleted again): **12 OK, 5 CHECK, 20 DIFF**. The first run
|
||||
showed the CI Server ports as allowed: the script counted program-limited Windows rules with
|
||||
"any port" (e.g. Remote Desktop Shadow) as a match. Fixed 2026-10-08; such rules no longer count. Windows Server 2025
|
||||
Datacenter (24H2) virtual machine, domain member, CI Server R1.05.00 (r11609M) installed in
|
||||
`C:\Yokogawa\CIServer` without the IT Security Tool.
|
||||
|
||||
- Matched: CI Service running, automatic, account `.\CIX_PROCESS`; fast startup off; High
|
||||
performance plan; processor scheduling Programs; 8dot3 names enabled; 100 % scale; web
|
||||
ports 8443/8080; RESTful API on 34597; DURM UDP 17001/17101 and SMDMON UDP 18002 listening.
|
||||
- Differed: Datacenter edition is not listed (only Standard); firewall profile for the
|
||||
domain network off and no CI Server inbound rules; Defender on; automatic updates, defrag
|
||||
and component cleanup not disabled; virtual memory not a custom size; .NET 3.5 not
|
||||
installed; no `CIX_` groups, no `CTM_PROCESS`, no VAGW Bossd service (IT Security Tool not
|
||||
installed and not supported on Server 2025, so IT security is **not tested** on this server).
|
||||
- `ci_start.log`: all services started; the same odbsrv SSL certificate error as on R1.03
|
||||
(ISS-008).
|
||||
|
||||
## R1.03 test system result (2026-09-30)
|
||||
|
||||
Windows 10 Pro 19045 development PC without the IT Security Tool: 16 OK, 5 CHECK, 15 DIFF.
|
||||
(Run before the firewall-check fix of 2026-10-08, so "inbound allowed" lines may have counted
|
||||
program-limited "any port" rules; re-run to confirm.)
|
||||
Differences: firewall domain/private profiles off; no `CIX_` groups or `CTM_PROCESS` (IT
|
||||
Security Tool not installed; not supported on Windows 10 Pro); fast startup on; Balanced power
|
||||
plan; automatic virtual memory; Defender on; automatic updates, defrag and cleanup not
|
||||
|
|
@ -53,4 +104,4 @@ disabled. Web ports 8443/8080. `ci_start.log`: all services started, one SSL cer
|
|||
(`InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`): the ODBC server `odbsrv`
|
||||
has `USESSL = YES` but no certificate in `%TLS_ROOT_PATH%\tls\pki\odbsrv`, so it exits at
|
||||
start (harmless unless ODBC is used; fix in skill `data-access`, task `access-checks.md`;
|
||||
`knowledge/issues.md` ISS-008).
|
||||
`knowledge/issues.md` ISS-008). Windows 10 Pro is no longer a supported OS for R1.05.
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
---
|
||||
task: Load and remove dataset records with dssqld (quick load)
|
||||
version: R1.03
|
||||
source: IM 36K10J10-01EN §2.9.2, §5.6; IM 36K10L45-01EN §9.10–9.11; practiced with CI-Eng-Sample 2026-09-30
|
||||
source: IM 36K10J10-01EN §2.9.2, §5.6; IM 36K10L45-01EN §10.12–10.13 (5th ed.; §9.10–9.11 in the R1.03 edition); practiced with CI-Eng-Sample 2026-09-30
|
||||
status: verified
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -60,3 +60,7 @@ The R1.05 test server is shared with other projects. Never disturb their work th
|
|||
read-only checks unless the user approves a change, never restart CI Server, never write to other
|
||||
projects' records or to live plant values, and remove anything you put on the server.
|
||||
Fixes that also apply to R1.03 can be cherry-picked onto branch `r1.03`.
|
||||
|
||||
When re-checking a manual for R1.05, compare its full text with the R1.03 edition
|
||||
(`tools/manual_diff.py`), not just the revision table or release notes: R1.04 changes are
|
||||
often not listed there.
|
||||
|
|
|
|||
|
|
@ -1,11 +1,15 @@
|
|||
# CI-Eng-Sample
|
||||
|
||||
A small, invented sample project that anyone with this repo can load into a CI Server
|
||||
**R1.03** test system. Skills use its names in their examples, and every skill task is
|
||||
test system (R1.03 or R1.05). Skills use its names in their examples, and every skill task is
|
||||
re-tested against it so that no other project is needed.
|
||||
|
||||
Built and tested on CI Server R1.03.00 (unlicensed test system), 2026-09-30; operator HMI, demo
|
||||
user and live-data feed added 2026-10-06.
|
||||
user and live-data feed added 2026-10-06. Reduced load (below) tested on R1.05.00 on a shared
|
||||
server, 2026-10-08: loads with 0 errors (the `@VERSION 1.03.00` headers are accepted).
|
||||
|
||||
**Every test ends with the system back in its original state:** remove what was loaded, stop
|
||||
processes started for the test, undo certificate trust, delete scratch and temporary files.
|
||||
|
||||
## Load and remove
|
||||
|
||||
|
|
@ -30,6 +34,25 @@ cmd /c "<repo>\examples\CI-Eng-Sample\remove.cmd"
|
|||
has passed, so the script sets a stop time one minute ahead and waits. Removing the group
|
||||
also deletes its history.
|
||||
|
||||
### Testing on a shared server (`shared\`)
|
||||
|
||||
For a server that other projects use, where CI Server must not be restarted:
|
||||
|
||||
| Script | Does |
|
||||
|---|---|
|
||||
| `shared\snapshot.ps1 -Out <file>` | Read-only snapshot: record names (count, hash, `CIENG*` names) of every dataset the sample touches, file lists of `tls\com`, `sup`, `sav`, `lst`, the `pki` folders, running CI Server processes. Run before and after; compare the two files. |
|
||||
| `shared\reduced_load.cmd` | `load.cmd` without the storage groups and history bindings (`03`, `04`: need a restart), the authorization group and user `CIENG` (`08`, `08b`: a password-less user on a shared server) and the layouts/displays (shared `Layouts.xml`) |
|
||||
| `shared\test_r105.ps1` | Starts the Modbus slave mirror only for the test, checks classes, sub-items, Modbus loopback and OPC UA loopback with `itmval`, stops the mirror again |
|
||||
| `shared\reduced_remove.cmd` | Removes exactly what `reduced_load.cmd` loaded |
|
||||
| `shared\clean_dss_tmp.ps1 -Since <time>` | Deletes the `dss_*.tmp` files the test left in `%TLS_LST_PATH%` (ISS-091) |
|
||||
|
||||
Copy the whole sample folder to a temporary folder on the server, run from there, and delete
|
||||
it afterwards. Also delete `%TLS_LOG_PATH%\OPXCIENG.log`. The OPC UA certificate exchange and
|
||||
its undo are user steps (see below); the client's own certificate `<host>_OPXCIENG.der/.pem`
|
||||
and the trusted copies stay in the `pki` folders (and in `OPCUAC_PKI_CERTIFICATES_DF`, which
|
||||
follows the files) until they are deleted; the server-side `pkiserver\rejected` folder is also
|
||||
created by the test; delete it when it is empty.
|
||||
|
||||
## Current contents
|
||||
|
||||
| Name | Kind | Details |
|
||||
|
|
|
|||
15
examples/CI-Eng-Sample/shared/clean_dss_tmp.ps1
Normal file
15
examples/CI-Eng-Sample/shared/clean_dss_tmp.ps1
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
# Remove the DSS temporary files that a test session left in %TLS_LST_PATH%.
|
||||
# Each dssqld run can leave a 0-byte dss_<n>_<id>.tmp there, and loading a class leaves its source
|
||||
# text in one (verified on R1.05, 2026-10-08). Only files written since -Since are touched: 0-byte
|
||||
# files, and non-empty files that contain sample text (CIENG / CI-Eng-Sample). Files in use are skipped.
|
||||
# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File clean_dss_tmp.ps1 -Since "2026-10-08T07:00:00"
|
||||
param([Parameter(Mandatory = $true)][datetime]$Since)
|
||||
$lst = $env:TLS_LST_PATH
|
||||
$f = Get-ChildItem -Path $lst -Filter 'dss_*.tmp' | Where-Object { $_.LastWriteTime -ge $Since }
|
||||
$ok = 0; $skip = 0
|
||||
foreach ($i in $f) {
|
||||
$mine = ($i.Length -eq 0) -or (Select-String -LiteralPath $i.FullName -Pattern 'CIENG|CI-Eng-Sample' -Quiet)
|
||||
if (-not $mine) { $skip++; continue }
|
||||
try { Remove-Item -LiteralPath $i.FullName -ErrorAction Stop; $ok++ } catch { $skip++ }
|
||||
}
|
||||
"deleted $ok, left $skip (other content or in use)"
|
||||
27
examples/CI-Eng-Sample/shared/reduced_load.cmd
Normal file
27
examples/CI-Eng-Sample/shared/reduced_load.cmd
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
@echo off
|
||||
REM Reduced CI-Eng-Sample load for the shared R1.05 test server (2026-10-08).
|
||||
REM Skips: history group/bindings (03, 04: need a CI Server restart), auth group and user (08, 08b),
|
||||
REM layouts/displays. Run from the copied sample folder (this script lives in its shared subfolder).
|
||||
cd /d "%~dp0.."
|
||||
dssqld -i 01_section_df.qli -l 01_section_df.qlo
|
||||
dssqld -i 01b_alarm_df.qli -l 01b_alarm_df.qlo
|
||||
dssqld -i 02_item_df.qli -l 02_item_df.qlo
|
||||
dssqld -i 02b_sub_item_df.qli -l 02b_sub_item_df.qlo
|
||||
dssqld -i 05_trigger_df.qli -l 05_trigger_df.qlo
|
||||
dssqld -i 06_class_df.qli -l 06_class_df.qlo
|
||||
dssqld -i 07_object_df.qli -l 07_object_df.qlo
|
||||
dssqld -i 09_modbus_line_df.qli -l 09_modbus_line_df.qlo
|
||||
powershell -NoProfile -Command "Start-Sleep -Seconds 15"
|
||||
dssqld -i 10_modbus_station_df.qli -l 10_modbus_station_df.qlo
|
||||
dssqld -i 11_item_eqp_df.qli -l 11_item_eqp_df.qlo
|
||||
dssqld -m 12_opc_visible_df.qli -l 12_opc_visible_df.qlo
|
||||
dssqld -i 13_opcua_line_df.qli -l 13_opcua_line_df.qlo
|
||||
powershell -NoProfile -Command "Start-Sleep -Seconds 10"
|
||||
dssqld -i 14_opcua_station_df.qli -l 14_opcua_station_df.qlo
|
||||
dssqld -i 15_item_opcua_df.qli -l 15_item_opcua_df.qlo
|
||||
dssqld -m 16_item_alarm_df.qli -l 16_item_alarm_df.qlo
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File 17_printer_df.ps1
|
||||
dssqld -i 17_printer_df.qli -l 17_printer_df.qlo
|
||||
dssqld -i 18_report_df.qli -l 18_report_df.qlo
|
||||
dssqld -i 19_audit_df.qli -l 19_audit_df.qlo
|
||||
dssqld -m 19b_audit_item_df.qli -l 19b_audit_item_df.qlo
|
||||
21
examples/CI-Eng-Sample/shared/reduced_remove.cmd
Normal file
21
examples/CI-Eng-Sample/shared/reduced_remove.cmd
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
@echo off
|
||||
REM Removes the reduced CI-Eng-Sample load (reverse of reduced_load.cmd).
|
||||
cd /d "%~dp0.."
|
||||
dssqld -r 79_remove_audit_df.qli -l 79_remove_audit_df.qlo
|
||||
dssqld -m 83a_stop_report_df.qli -l 83a_stop_report_df.qlo
|
||||
dssqld -r 83_remove_report_df.qli -l 83_remove_report_df.qlo
|
||||
dssqld -r 84_remove_printer_df.qli -l 84_remove_printer_df.qlo
|
||||
if exist "%TLS_LST_PATH%\cieng_report.txt" del "%TLS_LST_PATH%\cieng_report.txt"
|
||||
dssqld -r 76_remove_item_opcua_df.qli -l 76_remove_item_opcua_df.qlo
|
||||
dssqld -r 77_remove_opcua_station_df.qli -l 77_remove_opcua_station_df.qlo
|
||||
dssqld -r 78_remove_opcua_line_df.qli -l 78_remove_opcua_line_df.qlo
|
||||
dssqld -r 80_remove_item_eqp_df.qli -l 80_remove_item_eqp_df.qlo
|
||||
dssqld -r 81_remove_modbus_station_df.qli -l 81_remove_modbus_station_df.qlo
|
||||
dssqld -r 82_remove_modbus_line_df.qli -l 82_remove_modbus_line_df.qlo
|
||||
dssqld -r 86_remove_object_df.qli -l 86_remove_object_df.qlo
|
||||
dssqld -r 87_remove_class_df.qli -l 87_remove_class_df.qlo
|
||||
dssqld -r 88_remove_trigger_df.qli -l 88_remove_trigger_df.qlo
|
||||
dssqld -r 90b_remove_sub_item_df.qli -l 90b_remove_sub_item_df.qlo
|
||||
dssqld -r 91_remove_item_df.qli -l 91_remove_item_df.qlo
|
||||
dssqld -r 92_remove_section_df.qli -l 92_remove_section_df.qlo
|
||||
dssqld -r 93_remove_alarm_df.qli -l 93_remove_alarm_df.qlo
|
||||
37
examples/CI-Eng-Sample/shared/snapshot.ps1
Normal file
37
examples/CI-Eng-Sample/shared/snapshot.ps1
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
# Read-only snapshot of everything the reduced CI-Eng-Sample test can touch.
|
||||
param([string]$Out)
|
||||
$ErrorActionPreference = 'Continue'
|
||||
$w = New-Object System.Collections.Generic.List[string]
|
||||
$tmp = Join-Path $PSScriptRoot 'snapx'
|
||||
New-Item -ItemType Directory -Force -Path $tmp | Out-Null
|
||||
$ds = 'SECTION_DF','ITEM_DF','SUB_ITEM_DF','ALARM_ACK_DF','ALARM_AOI_DF','ALARM_ASA_DF','TRIGGER_DF',
|
||||
'CLASS_DF','OBJECT_DF','LINE_DF','STATION_DF','POINT_DF','MODBUS_LINE_DF','MODBUS_STATION_DF',
|
||||
'MODBUS_SCAN_TYPE_DF','MODBUS_POINT_DF','OPCUAC_LINE_DF','OPCUAC_STATION_DF',
|
||||
'OPCUAC_SUBSCRIPTION_DF','OPCUAC_POINT_DF','PRINTER_DEV_DF','PRINTER_DEST_DF','REPORT_DF',
|
||||
'AUDIT_SELGRP_DF','OPCUAC_PKI_CERTIFICATES_DF'
|
||||
foreach ($d in $ds) {
|
||||
$f = Join-Path $tmp "$d.qlo"
|
||||
$null = & dssqld -e $f -d $d -c 2>&1
|
||||
$names = @()
|
||||
if (Test-Path $f) { $names = @(Import-Csv $f | ForEach-Object { $_.NAME }) | Sort-Object }
|
||||
$sha = [BitConverter]::ToString((New-Object Security.Cryptography.SHA256Managed).ComputeHash([Text.Encoding]::UTF8.GetBytes(($names -join "`n")))).Replace('-','').Substring(0,16)
|
||||
$mine = @($names | Where-Object { $_ -match 'CIENG|CI-Eng' })
|
||||
$w.Add("DS $d count=$($names.Count) hash=$sha cieng=$($mine.Count) $($mine -join ';')")
|
||||
}
|
||||
Remove-Item -Recurse -Force $tmp
|
||||
$root = $env:TLS_ALLUSERS_PATH
|
||||
foreach ($sub in 'com','sup','sav','lst') {
|
||||
foreach ($i in (Get-ChildItem -Path (Join-Path $env:TLS_ROOT_PATH "tls\$sub") -File | Sort-Object Name)) {
|
||||
if ($sub -eq 'lst' -or $sub -eq 'sav') { $w.Add("FILE $sub\$($i.Name)") }
|
||||
else { $w.Add("FILE $sub\$($i.Name) $($i.Length) $($i.LastWriteTime.ToString('s'))") }
|
||||
}
|
||||
}
|
||||
foreach ($i in (Get-ChildItem -Path (Join-Path $root 'pki') -Recurse -File | Sort-Object FullName)) {
|
||||
$w.Add("PKI $($i.FullName.Substring($root.Length)) $($i.Length)")
|
||||
}
|
||||
$exe = Join-Path $env:TLS_ROOT_PATH 'tls\exe'
|
||||
foreach ($g in (Get-Process | Where-Object { $_.Path -like "$exe*" } | Group-Object Name | Sort-Object Name)) {
|
||||
$w.Add("PROC $($g.Name) x$($g.Count)")
|
||||
}
|
||||
$w | Set-Content -Encoding utf8 $Out
|
||||
"snapshot: $($w.Count) lines -> $Out"
|
||||
36
examples/CI-Eng-Sample/shared/test_r105.ps1
Normal file
36
examples/CI-Eng-Sample/shared/test_r105.ps1
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
# Functional test of the reduced CI-Eng-Sample load on R1.05. Starts the Modbus slave mirror only
|
||||
# for the duration of the test and stops it again.
|
||||
$P = 'CI-Eng-Sample'
|
||||
function V($n) { (& itmval -g -n "$P.$n" 2>&1 | Out-String).Trim() -replace '\s+', ' ' }
|
||||
function W($n, $v) { $null = & itmval -p -n "$P.$n" -v $v 2>&1 }
|
||||
|
||||
"--- start Modbus slave mirror"
|
||||
$mem = Start-Process -FilePath eqpmdcmem -ArgumentList '-n','EQPMDCMEM' -WindowStyle Hidden -PassThru
|
||||
Start-Sleep 3
|
||||
$slv = Start-Process -FilePath eqpmdcslvtcp -ArgumentList '-n','EQPMDCSLVTCP','-p','5020' -WindowStyle Hidden -PassThru
|
||||
"mirror pids $($mem.Id) $($slv.Id)"
|
||||
"--- classes and sub-items"
|
||||
"COUNTER t0: $(V 'DEMO.COUNTER')"; Start-Sleep 3; "COUNTER t3: $(V 'DEMO.COUNTER')"
|
||||
W 'TANK1.LEVEL' 50; W 'TANK1.INFLOW' 120; Start-Sleep 3
|
||||
"TANK1.CALC.VOLUME (expect 100): $(V 'TANK1.CALC.VOLUME')"
|
||||
"TANK1.JFLOW.sPerMin (expect 2): $(V 'TANK1.JFLOW.sPerMin')"
|
||||
"TANK1.LEVEL.MAX: $(V 'TANK1.LEVEL.MAX')"
|
||||
"--- wait 45 s for Modbus station and OPC UA client"
|
||||
Start-Sleep 45
|
||||
W 'PLC1.SETPOINT' 1234; Start-Sleep 4
|
||||
"PLC1.READBACK (expect 1234): $(V 'PLC1.READBACK')"
|
||||
"PLC1.COMM_OK (expect 1): $(V 'PLC1.COMM_OK')"
|
||||
"--- eqpdbg slave info"
|
||||
('3', '1', '-1') -join "`n" | & eqpdbg 0 EQPCIENG 2>&1 | Select-String -Pattern 'scan status|Slave name|name|Line status|Good|requests' | Select-Object -First 12 | ForEach-Object { $_.Line.Trim() }
|
||||
"--- OPC UA loopback"
|
||||
"UA.COMM_OK: $(V 'UA.COMM_OK')"
|
||||
"UA.SRV_STATE: $(V 'UA.SRV_STATE')"
|
||||
"UA.LEVEL_COPY: $(V 'UA.LEVEL_COPY')"
|
||||
$pki = $env:TLS_ALLUSERS_PATH + '\pki'
|
||||
"client rejected: " + ((Get-ChildItem "$pki\opxuac\pkiclient\rejected" -File -ErrorAction SilentlyContinue | ForEach-Object Name) -join '; ')
|
||||
"server rejected: " + ((Get-ChildItem "$pki\opxuas\pkiserver\rejected" -File -ErrorAction SilentlyContinue | ForEach-Object Name) -join '; ')
|
||||
"--- stop mirror"
|
||||
& durstp -msk -t 10 -p EQPMDCSLVTCP 2>&1 | Out-Null
|
||||
& durstp -msk -t 10 -p EQPMDCMEM 2>&1 | Out-Null
|
||||
Start-Sleep 2
|
||||
"mirror still running: " + ((Get-Process -Id $mem.Id, $slv.Id -ErrorAction SilentlyContinue | ForEach-Object Id) -join ' ')
|
||||
|
|
@ -10,3 +10,4 @@ that area's skill (`.claude/skills/<area>/reference/`).
|
|||
| `manuals/` | One summary per manual (`IM36K….md`), written in our own words |
|
||||
| `document-map.md` | All EN manuals by IM number, with editions |
|
||||
| `version-differences.md` | What changed from R1.03 to R1.05 (manuals and installed files) |
|
||||
| `r105-verification.md` | R1.05 checks marked *not tested* and the steps awaiting user verification |
|
||||
|
|
|
|||
|
|
@ -21,12 +21,12 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
|
|||
|---|---|---|---|---|---|---|
|
||||
| ISS-001 | 2026-09-30 | ITEM (`itmval`) | Writing an item with `itmval -p -n AID.WRPS.SIM.INFLOW -v 400` added the `uoff` option flag (options 0x…8a → 0x…8e). The flag stayed after writing the original value back. Meaning of `uoff` unknown; not found in the EN manuals by text search. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.5 gives the option bits: 1 blocked, 2 offline, **4 updated offline** (written by an application while offline), 8 acknowledged, **16 updated blocked**, 32 direct alarm, 64 delayed alarm. 0x8a = offline + acknowledged (+0x80, not documented); +4 = 0x8e, so `uoff` = updated offline and `ublk` = updated blocked. Matches all observations. Not yet found: how to clear the flags (probably on the next update from the station). Closed 2026-09-30 (confirmed by user). Earlier notes: writing internal sample items (`CI-Eng-Sample.*`, no station) does **not** set `uoff` (options stay 0x…88), so it is tied to station-connected items (the AID item was already `off`, its station not communicating). Still to find: meaning and how to clear it (ITEM Service IM 36K10L35/L36, Engineering Module I/O Processes IM 36K10C10). Revisit in phase 5 with a station item. 2026-09-30 later: unblocking a sample item left the flag `ublk` (after `blk` was cleared), so `u…` flags may mean "was …" (un-blocked / un-offline). Still unconfirmed. | `.claude/skills/system-management/tasks/read-write-item.md` (replace the `uoff` note under "Read the current value"); `knowledge/progress.md` row "Write an item with `itmval -p`" |
|
||||
| ISS-002 | 2026-09-30 | DATABASE (`dsschk`) | `dsschk -d ITEM_DF -v` (check only) exits 0 with no console output and nothing new in `umhlog.log`. Where results are reported is unknown. | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: `dsschk -e -v` prints a start/end line per dataset (228 checked, no problems) and logs to `umhlog.log`. Plain `dsschk` only compares copies between nodes, so it prints nothing on a single-node system. `ismchk` needs a database file name (usage: `ismchk data_base_name`), not run yet. | Create `.claude/skills/system-management/tasks/consistency-check.md` and add it to that skill's `SKILL.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.1 consistency tools (add where output goes); `knowledge/progress.md` row "Consistency check" |
|
||||
| ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
|
||||
| ISS-003 | 2026-09-30 | DATABASE (`dssqld`) | Filtered export (`dssqld -e <out> <filter>.qli`) failed with a guessed filter syntax (`@ITEM_DF`, `@FIELD`, `@SELECT`). | closed | R1.05 (2026-10-08): the quick load format section is now IM 36K10L45 5th ed. §10.13 (was §9.11). Closed 2026-09-30 (confirmed by user). 2026-09-30: the quick load **data** format is now known and verified (`@LANGUAGE`, `@VERSION`, `@FIELDS`, `@<DATASET>`, quoted CSV records, `\` continuation, `!` comments; IM 36K10L45 §9.11). Filter syntax found (IM 36K10L50 §3.6) and practiced, awaiting confirmation: a file with `@SELECT`, then the filter in single quotes (strings in double quotes), then `@<DATASET>`; run `dssqld -e <out> <filter>.qli`. `ITEM_HISTORY` returns nothing unless the filter names `ITEM_NAME` and a `SAMPLE_TIME` range (`SAMPLE_TIME > "dd-mm-yyyy hh:mm:ss" and SAMPLE_TIME < ...`). | `.claude/skills/system-management/tasks/export-dataset.md` section "Filtered exports"; `knowledge/manuals/IM36K10J10-01EN.md` §5.6 step 1; `knowledge/progress.md` row "Export a dataset" |
|
||||
| ISS-004 | 2026-09-30 | ITEM (`itmval`) | `itmval -g -a <1..5>` returns `ITM-E-WRONG_ATT` on `AID.WRPS.*` items, so reading limits is unproven. | closed | Closed 2026-09-30 (confirmed by user). On `CI-Eng-Sample.TANK1.LEVEL` (limits set) `-a 1..5` returned deadband 0, low 20, high 80, low-low 10, high-high 90. The error only occurs on items without limits. | `.claude/skills/system-management/tasks/read-write-item.md` (limits section); `knowledge/progress.md` row "Read an item with `itmval -g`" |
|
||||
| ISS-005 | 2026-09-30 | DATABASE (`dssqld`) | Loading `04_item_his_df.qli` straight after creating the storage group gave 2 errors once; three other runs were clean. Error text not captured. | closed | Added a 5 s pause in `load.cmd`. No recurrence since: every full sample reload in phases 6-12 (latest 2026-10-01) loaded `04_item_his_df.qli` with 0 errors. Closed 2026-10-01 (confirmed by user). | `examples/CI-Eng-Sample/load.cmd`; `.claude/skills/system-management/tasks/load-remove-records.md` |
|
||||
| ISS-006 | 2026-09-30 | HISTORY (`ithloahis`) | Samples dated before the start of the current storage unit were not stored (no error shown); samples after it were. Also, a new storage group stored nothing until CI Server was restarted. | closed | Closed 2026-10-01 (confirmed by user). Confirm with History Management (IM 36K10L20) in phase 9: how to load into older units, and whether a restart is really required. 2026-09-30 (phase 5): IM 36K10L35 §1.3/§5 explains the first part: event storage picks the unit by time stamp, never older than 60 units, and within the storage process's `gap_time` (ITHEEX/ITHEIX 2880 min) and, for EVENT/ITEM, `max_sample_delay` (ITHEIX 14400 min); older data needs earlier unit files (`hisdbg`, `hisrecover`, `isfrename`), `ithrecover <group> -p` and a restart. Practice in phase 9. 2026-10-01 (phase 9, verified): (1) restart **is** required — `CIENG_SCAN10S` / `CIENG_AGG` loaded at 11:54 and `CIENG_EVENT` reloaded at 11:32 stored nothing until the 12:00 restart, then stored at once. (2) The first unit of a new Event/Item or Aggregation group is dated 2 days back (= `gap_time` 2880 min), but samples loaded into that pre-restart unit (11:50, 30-Sep) were still dropped; samples inside the active unit (12:02) and inside a unit closed by a forced rollover (12:03 into unit 3,1) were stored. So: samples older than the first unit opened since the restart are dropped silently. Loading older data would need `hisrecover` / `isfrename` / `ithrecover` (not practiced). Proposed close: documented in `load-history.md` and skill `history-management`. | `.claude/skills/system-management/tasks/load-history.md`; `examples/CI-Eng-Sample/README.md`; `knowledge/manuals/IM36K10J10-01EN.md` command-line tools |
|
||||
| ISS-007 | 2026-09-30 | INTEGRATION (monitoring) | `intdskmon` wrote 61.9 for a C: drive that is 61.9 % used / 38.1 % free, although the manual says it monitors the disk free space rate. `intspawn` did nothing when the command path was ~130 characters; a short path worked (limit unknown). | closed | Disk value: the test showed **used** % (61.9 on a 61.9 % used disk), and the task file says so; installed behaviour is the reference. `intspawn` path limit: not measured (needs admin edits of `tls\sup\<name>.sup` and restarts for each length); guidance kept: put the command in a `.cmd` with a short path (other CI Server tools cut paths at 79 characters, ISS-020). Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/monitoring-processes.md`; `knowledge/manuals/IM36K10J10-01EN.md` §4.1.6; `examples/CI-Eng-Sample/monitoring/` |
|
||||
| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
|
||||
| ISS-008 | 2026-09-30 | ACCESS (ODBC server `odbsrv`) | `ci_start.log` on the test system shows `CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed.` right after ACCESS Service starts. Which component and certificate is not known. | closed | R1.05 (2026-10-08): unchanged on the R1.05 test server: same `ci_start.log` message, `tls\pki\odbsrv` missing, port 1583 not listening, `odbsrv.sup` identical. Closed 2026-10-01 (confirmed by user): cause known, ODBC server left as is (not licensed/used on the test system). Identify in phase 7. 2026-10-01 (phase 7): cause found. The message comes from the ODBC server `odbsrv` (ACCESS Service, Simba): `odbsrv.sup` has `USESSL = YES` and `access_start.cmd` points it at `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` / `SampleServerKey.pem`, but that folder does not exist and no sample certificate is installed. `odbsrv` exits right after start (`DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`), port 1583 does not listen. Fix (admin, only if ODBC is licensed and wanted): install a certificate + key there, or set `USESSL = NO`. Not applied. Close when the user confirms. | `.claude/skills/installation-security/tasks/setup-check.md`; `knowledge/manuals/IM36K10L45-01EN.md` §1 (done); `.claude/skills/data-access/tasks/access-checks.md` (done) |
|
||||
| ISS-009 | 2026-09-30 | Security Guide | DCOM port range printed as 20500–20550 in the firewall table but "2500–20550" in the OPC configuration table. Taken as a typo for 20500–20550. | closed | Confirm on a system with IT security applied. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K01C30-01EN.md` §4 |
|
||||
|
||||
| ISS-010 | 2026-09-30 | ITEM (sub-items) | The Integrator sub-item adds value × seconds; setting `TIME_UNIT` = Hour made no difference (1 per second while the main item was 1). The Tutorial lists a time unit only for Rate-of-Change. | closed | 2026-09-30 (phase 5): IM 36K10C10 §3.2 and `itm.sup` answer it: the integral is divided by the **integration granule** `itm_int_secs` (label "Integration granule, sec.") in `itm.sup` — **system-wide**, installed value 1 (seconds); 60 = minutes, 3600 = hours. `TIME_UNIT` only applies to Rate-of-Change. Practiced 2026-09-30: set to 60 and restarted → `CI-Eng-Sample.PUMP1.RUNNING.RUN_SECONDS` rose exactly 1.0 in 60 s; restored to 1 (file identical to backup) → 8 in 8 s. Existing integrator values are not converted when the granule changes. Closed 2026-09-30 (confirmed by user). | `examples/CI-Eng-Sample/02b_sub_item_df.qli`; `knowledge/manuals/IM36K10G10-01EN.md` |
|
||||
|
|
@ -51,9 +51,9 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
|
|||
| ISS-029 | 2026-09-30 | PROCESS (Java) | IM 36K10P11 §10.4 says a new Java class must be reset before objects are added, otherwise the code does not take effect. A Java class inserted with `COMPILE` 1 by `dssqld` ran its first object correctly without any reset (twice, including a full sample reload). | open | Installed behaviour is the reference; keep "reset after changing a class that has objects". Check whether the Engineering Module path (compile without quick load) behaves differently. | `knowledge/manuals/IM36K10P11-01EN.md` §7; `.claude/skills/class-object-engineering/tasks/java-class.md` |
|
||||
| ISS-030 | 2026-10-01 | BUS (UMH tools) | `umhman` (hex code → text) crashes with redirected input (bash: segmentation fault 139 with CRLF input; PowerShell `Start-Process -RedirectStandardInput`: 0xC0000005); with an argument it only prompts. `umhtestprog` prints `UMH TEST UTILITY` and crashes (segmentation fault). `umhmsg 8010008` stops with `umh_panic: …umhmsg.exe, license expired` although other tools (`dssqld`, `itmval`) still worked at that time. | closed | Retested 2026-10-01 right after a CI Server restart: all three work — `umhman` with piped input (bash, LF or CRLF; via `cmd <` too), `umhmsg 083A001B text "…"` writes the message to `umhlog.log` (process `UMHMSG_<pid>`, prints nothing), `umhtestprog` runs its self-test. The earlier failures came late in an unlicensed session (licence nearly expired). `itmval -f` (ISS-022) still crashes on a fresh start, so it is a separate fault. Closed 2026-10-01 (confirmed by user). | `.claude/skills/system-management/tasks/bus-utilities.md`; `knowledge/manuals/IM36K10L30-01EN.md` §3 |
|
||||
| ISS-031 | 2026-10-01 | LICENCE (unlicensed node) | The unlicensed test node counts down about 1 hour of run time per CI Server start (`License time left` in `smd_<node>_LOW_smdsnp_general.log`, 3600 s → `*** license problem : 3 ***`); then `dssqld`/`itmval` stop with `license expired` and `ISF-F-LIC_PROB, DATABASE Service is not licensed`. A PC sleep pauses the count (start 17:25, ran out 09:52 next day). Restart of the CI Service resets it (verified 2026-10-01, back after ~45 s). | closed | Closed 2026-10-01 (confirmed by user): known limitation of the unlicensed test system, documented in system-check. Known limitation of the test system, documented in `system-check`. Plan tests in ≤ 1 h blocks. Close when the user confirms. | `.claude/skills/system-check/SKILL.md` §3 (done) |
|
||||
| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
|
||||
| ISS-032 | 2026-10-01 | ACCESS (OPC UA server node IDs) | IM 36K10L45 §10.3 shows CI Server node IDs (`{"nsid":"32"}`, `{"0":"Value","itnm":"ITEM1"}`) and the CI Server namespace `http://www.yokogawa.com/CI_Server/` (ns 3) but not which namespace the **entities** use. With that URI (or `urn:<host>:Yokogawa:CI_SERVER_OPC_UA_SERVER`) the client point was silently not monitored. Browsing (`OPCUAC_TAG_DF`) shows sections/items in **`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`**; with it `{"0":"Value","itnm":"<item>"}` and `{"0":"Value","nsid":"<n>"}` both work. IM 36K10E20 §2.2.6 also asks to enable `OPXUAS_USE_NAME_NODEIDS` and restart for CI client ↔ CI server; not needed on the test system. | closed | R1.05 (2026-10-08): sections are now IM 36K10L45 5th ed. §11.3 and IM 36K10E20 4th ed. §2.3; `OPXUAS_USE_NAME_NODEIDS` is still NO by default. Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §7 (done); `knowledge/manuals/IM36K10E20-01EN.md` §3 (done); `.claude/skills/data-access/tasks/opcua-client.md` (done) |
|
||||
| ISS-033 | 2026-10-01 | ACCESS (Engineering Module OPC UA point) | Tested by the user: the point form's *Browse path* stops at the item (`Objects/CI-Eng-Sample/TANK1/INFLOW`) and stores the item **object** `{"nsid":"548"}`; the point is not monitored (revised sampling interval 0, connected item status 13, *Last value*/*Data type* empty). Typing `{"0":"Value","itnm":"CI-Eng-Sample.TANK1.INFLOW"}` in *Node Id* fixed it (values followed at once). Browsing into an item that is OPC visible but not *Read* fails (`UncertainNotAllNodesAvailable`, `OPXC-E-BRW_NODE`). | closed | Answered 2026-10-01 by the user: the browse dialog can expand the item; picking `…/LEVEL/Value` stored `{"0":"Value","nsid":"713"}` with *Last value* 85, *Data type* Double. So: pick the `Value` node, not the item. The `itnm` form stays the choice for quick load (`nsid` changes on reload). Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10E20-01EN.md` §2 (done); `.claude/skills/data-access/tasks/opcua-client.md` §3 (done) |
|
||||
| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |
|
||||
| ISS-034 | 2026-10-01 | ACCESS (OPC UA server setup) | Installed vs IM 36K10L45 §10.5–10.6: `ServerConfig.xml` enables certificate user tokens (`EnableCertificate true`, manual false) and offers no `None` endpoint (only Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt); the `rejected` folder is created only at the first rejection; `opxuas.sup` uses `OPXUAS_DYNAMIC_SCANRATE` (manual `OPXUAS_USE_DYNAMIC_SCANRATE`) and has `OPXUAS_SET_HIGH_PRIO_15` (not described); `opxsys.sup` has `OPXDAS_SET_LOG_LEVEL` (not described). Also `dur.sup` adaptive queue entry `OPCEXE` while the installed executors are `OPCEXE1`–`4`. | closed | R1.05 (2026-10-08): all points still hold on the R1.05 test server; manual sections are now IM 36K10L45 5th ed. §11.6–11.7. Closed 2026-10-01 (user decision: installed software is the reference). Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` §4, §7 (done); `knowledge/manuals/IM36K10L30-01EN.md` §8 (done) |
|
||||
| ISS-035 | 2026-10-01 | ALARM (`ALDPRT`) | `ALDPRT` is running and connected (`almdbg` 1 shows `Events-send-to` rising with each alarm), `aldprt.sup` sets no log destination (so per IM 36K10L15 §4.3 it should log via UMH) and `EVENTS` includes `alarm`/`ackn`, but no alarm line appears in `tls\log\umhlog.log` for the CI-Eng-Sample HIGH / HIGH HIGH / acknowledge events. No other log file changed. Cause unknown (UMH filtering? output only with `LOGUMH` set explicitly?). | open | Rechecked 2026-10-01 after a restart: `aldprt.exe` runs; `umhlog.log` still has no alarm lines for the new `TANK1.LEVEL` HIGH alarm (only `ALD-I-ALDPRT_EXIT` at each licence shutdown). `fmfprt.sup` assigns printer function `ALARMS` to `ALDPRT`; destination `ALARMS` (policy *Automatic*) has **no device**, and `PRINTER_JOB_OVV` has no `ALDPRT` jobs. The `aldprt.sup` help says UMH is used only when no destination is enabled — the printer function may count as one. Next: test `LOGUMH` in `aldprt.sup` (admin, restart). Low priority: history and overviews are not affected. | `.claude/skills/alarm-management/tasks/item-alarming.md` (last line); `knowledge/manuals/IM36K10L15-01EN.md` §8 |
|
||||
| ISS-036 | 2026-10-01 | ALARM (setup) | Installed vs manuals: `alh.sup` has `DB-JRNL = WAL` and `DB-SYNC = OFF`, not described in IM 36K10L15 §3.4; storage group `ALH` has lifetime **52 weeks** while IM 36K10C20 §A7 says the default is 2 days (may have been changed on this system earlier — unknown); `aldprt.sup` uses `TIMEFMT` where the manual text also writes `TIMFMT`. | closed | Installed software is the reference (standing user decision). Close when the user confirms. Closed 2026-10-01 (confirmed by user). | `knowledge/manuals/IM36K10L15-01EN.md` §7, §8; `knowledge/manuals/IM36K10C20-01EN.md` §A7 |
|
||||
| ISS-037 | 2026-10-01 | ALARM (history fields) | `ALARM_CHRONO` records contain leftover or unreadable text: INFO events generated with `almdbg` 16 carry `INSTALL`/`UNIT`/`TAG`/`SUB` values from earlier events and non-ASCII bytes in `SOURCE`, `CATEGORY`, `CONDITION`; item events of `CI-Eng-Sample.TANK1.LEVEL` show `SUB` = `RoC` although the item has only the sub-item `MAX`. | closed | Rechecked 2026-10-01 after a restart: a new HIGH alarm on `CI-Eng-Sample.TANK1.LEVEL` (raised with `itmval -p`) gave a clean `ALARM_CHRONO` record (`INSTALL`/`UNIT`/`TAG` correct, `SUB` empty, `SOURCE`/`CATEGORY`/`CONDITION` empty), and the user's Current Alarm Overview showed correct columns. The leftover/garbled values are limited to the older records (INFO events made with the `almdbg` 16 test function and events from that session). Documented: treat `SUB`/`SOURCE`/`CATEGORY`/`CONDITION` as reliable only for normal item and OPC events. Closed 2026-10-01 (confirmed by user). | `.claude/skills/alarm-management/tasks/alarm-checks.md` §4 |
|
||||
|
|
@ -80,7 +80,7 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
|
|||
| ISS-058 | 2026-10-02 | DATA EXPOSURE (ITEM_HISTORY, manual vs installed) | IM 36K10G10 ch. 10 lists `ITEM_HISTORY` as an exposure source (filter required). The installed `dbc.sup` (R1.03 and R1.05, identical) has the change-log line `PCL Aug-19 e12150 Refactor to support MS-SQL/ODBC, remove ITM history support`. An `ITEM_HISTORY` record (all fields, quoted filter, ISS-057) on the user's R1.05 system never created its table; it was disabled and then deleted, so whether ITEM_HISTORY works with a correct filter is **not tested**. | open | Treat ITEM_HISTORY exposure as unsupported and use `ITEM_VALUES` with `AGG_INTERVAL`. To close: on an R1.05 system, create an `ITEM_HISTORY` record with an unquoted filter and check whether `DBCSND` stays up and the table is created. | `.claude/skills/data-access/tasks/rdbms-exposure.md`; `knowledge/manuals/IM36K10G10-01EN.md`; `knowledge/manuals/IM36K10L45-01EN.md` §8 |
|
||||
| ISS-059 | 2026-10-02 | DATA EXPOSURE (authentication) | IM 36K10G10 §10.2 says to add the `CIX_PROCESS` account to SQL Server as a Windows user (db_owner) in a domain. The CI Service runs as the **local** `.\CIX_PROCESS` (also on the user's domain-joined R1.05 CI Server), which a SQL Server on another host cannot authenticate. | closed | Closed 2026-10-02 (confirmed by user): use a SQL login with db_owner on the target database; SQL Server set to mixed mode (needs a SQL Server restart). Windows authentication only if the SQL host knows the account (not tested). Tested in R1.05 only. | `.claude/skills/data-access/tasks/rdbms-exposure.md` (done); `knowledge/manuals/IM36K10G10-01EN.md` (done) |
|
||||
| ISS-060 | 2026-10-02 | DATA EXPOSURE (rows of steady items) | IM 36K10G10 ch. 10 says `ITEM_VALUES` is exposed once per interval, with the aggregation time as timestamp when the item did not change. In one snapshot on R1.05 (1-minute interval), changing items had rows at 02:13:23 while steady items (`VALUE_COUNT` 1) were still at 02:12:24. Whether steady items get a row every interval (maybe written later) or only after an update is not known. | open | Count rows per item over one hour (`SELECT NAME, COUNT(*) … WHERE [TIMESTAMP] > … GROUP BY NAME`) and compare steady with changing items. Until then the task says: take a steady item's last row at or before T. | `.claude/skills/data-access/tasks/rdbms-exposure.md` |
|
||||
| ISS-061 | 2026-10-02 | INSTALLATION (folder permissions) | On the user's R1.05 system installed in `C:\Yokogawa\CIServer` (outside Program Files) `tls\sup` and `dbc.sup` inherit **Authenticated Users: Modify** (plus Users: Read): any signed-in user can read the SQL password in `dbc.sup` and change setup files. On the R1.03 development machine (Program Files) `tls\sup` gives Users: ReadAndExecute (read still possible, no write). | closed | Closed 2026-10-02 (user decision: shared internal dev/demo server, left as is). Option if needed, not applied or tested: `icacls <dbc.sup> /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" "CIX_PROCESS:(R)"`; folder rights in general are set by the IT Security Tool. | `.claude/skills/installation-security/tasks/setup-check.md` (done); `.claude/skills/data-access/tasks/rdbms-exposure.md` (done) |
|
||||
| ISS-061 | 2026-10-02 | INSTALLATION (folder permissions) | On the user's R1.05 system installed in `C:\Yokogawa\CIServer` (outside Program Files) `tls\sup` and `dbc.sup` inherit **Authenticated Users: Modify** (plus Users: Read): any signed-in user can read the SQL password in `dbc.sup` and change setup files. On the R1.03 development machine (Program Files) `tls\sup` gives Users: ReadAndExecute (read still possible, no write). | closed | R1.05 (2026-10-08): confirmed again on the R1.05 test server (`icacls`: Authenticated Users:(M) inherited on the install folder and `tls\sup`). Closed 2026-10-02 (user decision: shared internal dev/demo server, left as is). Option if needed, not applied or tested: `icacls <dbc.sup> /inheritance:r /grant:r "SYSTEM:(F)" "Administrators:(F)" "CIX_PROCESS:(R)"`; folder rights in general are set by the IT Security Tool. | `.claude/skills/installation-security/tasks/setup-check.md` (done); `.claude/skills/data-access/tasks/rdbms-exposure.md` (done) |
|
||||
| ISS-062 | 2026-10-02 | GRAPHICS (layouts) | `Layouts.readme` lists the menu/toolbar command `help`, but in R1.03 the Operator Interface fails with *Failed to execute menu command 'help'*, *Unrecognized keyword* (`MNUCMD`, `IllegalArgumentException`). The factory layouts do not use it. | open | Software is the reference: documented as not supported. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
|
||||
| ISS-063 | 2026-10-02 | GRAPHICS (layouts) | The readme does not say that menu items with the commands `toolbar`, `statusline` and `playback record` must be `type="check"`. With a normal item the Operator Interface does not start (*INITFAILED*, `JMenuItem cannot be cast to JCheckBoxMenuItem` in `MenuToolbarOption.checkState`); the web client just drops check items. | open | Rule added to the task. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
|
||||
| ISS-064 | 2026-10-02 | GRAPHICS (layouts) | Readme: `rows`/`cols` `n*` values share the remaining space by fraction (as HTML frames). Observed: the desktop ignores the fractions (`2*,1*` gave 800:88 px, sizes follow the displays); the web client turns every `n*` into its single *main* panel, so two `n*` overwrite each other. | open | Use one `n*` per frame set, all other divisions in pixels or `fitDisplay`. Close when the user confirms. | `.claude/skills/graphics/tasks/layouts.md` §6 (done) |
|
||||
|
|
@ -95,3 +95,19 @@ development system (see "Test system" in `progress.md`); they do not exist on ot
|
|||
| ISS-073 | 2026-10-06 | DSS (remove group / DSSSDA) | Removing an authorization group while a session of one of its users is open fails with *DSSP-E-NODEL … in dataset USER_VAL*; after logging out the session was still referenced, and a retry stopped the process `DSSSDA03` (*DUR-F-BAD_SIZE, Negative size not allowed*; `DUR-W-REM_PROC … exited unexpectedly`); following DSS requests failed with *DUR-F-UNKNOWN_ATT … DSSSDA03* until CI Server was restarted (2026-10-06). After the restart the group was removed without error. `USER_VAL` exports only its header, so open sessions cannot be listed. | open | Workaround: log out the user's sessions and restart CI Server before removing the group; noted in the sample `remove.cmd` / README and `users-groups.md`. Not repeated on purpose (it stops a CI Server process). Report to Yokogawa. | `.claude/skills/authorization/tasks/users-groups.md` (done); `examples/CI-Eng-Sample/remove.cmd`, `README.md` (done) |
|
||||
| ISS-074 | 2026-10-06 | GRAPHICS (HTML display login) | IM 36K10R30 §4 lists the user profile fields used by the HTML display login as "… initial display, locale (layout not)". On R1.03.00 the profile's *Layout* is used too: a logon as `CIENG` (layout `CIENG_Operator`) at `/mobileoperator/` without `?l=` opened `CIENG_Operator` (2026-10-02 with ADMIN, 2026-10-06 with `CIENG`). | open | Installed software is the reference; R30 summary and `layouts.md` §3 updated. Close when the user confirms. | `knowledge/manuals/IM36K10R30-01EN.md` (done); `.claude/skills/graphics/tasks/layouts.md` §3, §5 (done) |
|
||||
| ISS-075 | 2026-10-06 | GRAPHICS (`jwuiutl -v`) | `deploy-displays.md` called `jwuiutl -v` "report only", but `jwuiutl -d -v -i -l <log> <display>` re-saves the validated display (normalised XML: defaults dropped, positions as attributes; 9 618 → 11 191 bytes for `CIENG_Test`, 2026-10-06). On 2026-10-02 a validation of eight displays hung on one and left `<name>.lck` and `<name>.xml.tmp`; not reproduced on 2026-10-06. | open | Documented in `deploy-displays.md` §2 and the C50 summary. Close when the user confirms. | `.claude/skills/graphics/tasks/deploy-displays.md` §2 (done); `knowledge/manuals/IM36K10C50-01EN.md` (done) |
|
||||
| ISS-076 | 2026-10-08 | EQUIPMENT (IEC 104 naming, R1.05) | IM 36K10L41 5th ed. §3.31.1–3.31.2 still calls the IEC 104 manager `eqp104` / `eqp104.sup` and says its name starts with "eqp". R1.05 installs `eqt104.exe` (no `eqp104.exe`), template `eta104_eqt.sup`, and `IEC104_LINE_DF.EQUIPMENT_MAN` defaults to `EQT104` (R1.05 test server, read-only). App. 1.3 gives upgrade steps for IEC 61850 only. Unknown whether an R1.03 IEC 104 line needs the same renaming after an upgrade. | open | Installed software is the reference; summaries use `EQT104`. Needs an upgrade test or a Yokogawa answer. | `knowledge/manuals/IM36K10L41-01EN.md` §1–2, §3.28–3.31 row (done); `.claude/skills/equipment/SKILL.md` (done) |
|
||||
| ISS-077 | 2026-10-08 | EQUIPMENT (IEC 104 setup file, R1.05) | The installed template `eta104_eqt.sup` has a keyword `quality_code_parsing = Y\|N` (default N) that moves IEC 104 cause of transmission and quality flags into the item quality field instead of the item status. The 5th ed. manual does not describe it. | open | Behaviour not tested (no IEC 104 device). | `knowledge/manuals/IM36K10L41-01EN.md` §3.28–3.31 row (done) |
|
||||
| ISS-078 | 2026-10-08 | EQUIPMENT (EQT utilities, R1.05) | IM 36K10L40 4th ed. describes only `eqpfrcscn`, `eqpiostat` and `eqpdbg` (and still lists IEC 61850, I/O type 1636, under `eqpfrcscn`). R1.05 installs `eqtdbg` (same menu, default process `EQT`), `eqtfrcscn` (template `eqtfrcscn.tpl`) and `eqtiostat` (start line commented out in `equipment_start.cmd`). None is in the manual. | open | Documented from installed files only; `eqtdbg`/`eqtfrcscn` not run (shared server, no EQT line). | `knowledge/manuals/IM36K10L40-01EN.md` §1–3, installed section (done); `.claude/skills/equipment/SKILL.md` (done) |
|
||||
| ISS-079 | 2026-10-08 | EQUIPMENT (IEC 61850 client name) | IM 36K10L41 5th ed. §3.32 tells the user to give the IED engineer the client name "EQP850", while §3.32.1 and App. 1.3 use `EQT850`, the process name R1.05 actually uses. | open | Presumably `EQT850`; low priority. | `knowledge/manuals/IM36K10L41-01EN.md` §3.32 (done) |
|
||||
| ISS-080 | 2026-10-08 | ACCESS (OPC UA client status item, R1.05) | IM 36K10E20 4th ed. §2.1.2 lists integer states 0–5 for the station `STATUS_ITEM` (0 preparing, 1 connected, 2 communication error and reconnecting, 3 connect attempt failed, 4 server shutdown received, 5 connection recreated); IM 36K10L45 5th ed. §10.9.2 still calls it a Boolean. On R1.03 a Boolean item with 1 = connected was verified. | open | R1.05 (2026-10-08): with the sample's Boolean status item the station showed 0 / status 4 while the server rejected the client and 1 / status 5 when connected; integer states 2–5 still not observed. Re-test on an R1.05 system with an Integer status item (not on the shared R1.05 test server without approval). | `.claude/skills/data-access/tasks/opcua-client.md` §2; `knowledge/manuals/IM36K10E20-01EN.md` |
|
||||
| ISS-081 | 2026-10-08 | ACCESS (OPC UA server `ServerConfig.xml`, R1.05) | IM 36K10L45 5th ed. §11.7 places `ServerConfig.xml` in `%TLS_ROOT_PATH%\tls\exe`; on the R1.05 test server it exists only in `%TLS_SAV_PATH%` (IM 36K10E20 4th ed. §3.4 agrees). On R1.03 it was in `tls\exe`. The R1.05 file only adds SDK blocks (roles, user password management, PubSub settings, thread pools). | closed | Installed software is the reference (standing user decision). Close when the user confirms. | `.claude/skills/data-access/tasks/access-checks.md`; `knowledge/manuals/IM36K10L45-01EN.md`; `knowledge/manuals/IM36K10E20-01EN.md` |
|
||||
| ISS-082 | 2026-10-08 | ACCESS (OPC UA server keywords, R1.05) | The manual names the switch that keeps the native model visible next to an imported information model `OPXUAS_ENABLE_NATIVE_MODEL_TREE`; the installed `opxuas.sup` has `OPXUAS_ENABLE_OWN_MODEL_TREE`. The installed file also has a hidden `OPXUAS_METHOD_TIMEOUT_MARGIN` (10000 ms) that the manual does not describe. | closed | Installed software is the reference (standing user decision). Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` |
|
||||
| ISS-083 | 2026-10-08 | ACCESS (OPC UA client setup defaults, R1.05) | IM 36K10L45 5th ed. §10.11 gives `OPXC_SERVICE_CALL_TIME_OUT` default 10 s; the installed template `epauac_eqp.sup` has 60 s. The template also has `OPXC_DISABLE_SAV_FILE`, `OPXC_ALARM_TIME_ATTRIBUTE` and a hidden `OPXC_CERT_EXP_PERIOD_WARN` (2 months) that the manual does not describe. The installed `opxuac_mon.sup` was not updated (still 10 s, none of the new keywords). | open | Installed software is the reference. Open question: whether per-process files created on R1.03 should get the new keywords after an upgrade. | `knowledge/manuals/IM36K10L45-01EN.md`; `.claude/skills/data-access/tasks/access-checks.md` |
|
||||
| ISS-084 | 2026-10-08 | ACCESS (OPC UA client fallback setup file) | The R1.03 manual (and the R1.03 summary) named the fallback client setup file `opxuac.sup`, which exists on neither version. The R1.05 manual (IM 36K10L45 5th ed. §10.11) names `epauac_eqp.sup`, which matches both installations. | closed | Answered by the R1.05 manual and the installed files. Close when the user confirms. | `knowledge/manuals/IM36K10L45-01EN.md` |
|
||||
| ISS-085 | 2026-10-08 | ACCESS (OPC A&E server, R1.05) | The installed `opxsys.sup` has a new keyword `OPXAES_DIR_ALM = YES` (A&E server "direct" alarm events) that IM 36K10L45 5th ed. does not describe. | open | Behaviour not tested (OPC A&E loopback is not allowed). | `knowledge/manuals/IM36K10L45-01EN.md`; `.claude/skills/data-access/tasks/access-checks.md` |
|
||||
| ISS-086 | 2026-10-08 | INSTALLATION (upgrade merge, R1.05) | IM 36K01C10 5th ed. §2.1.5, §3.3.8, §3.3.15 write the upgrade backup, `jupgutl`, `jmrgconfig.properties` and log paths as `C:\Program Files (x86)\…` and `C:\Users\Public\…`. On the R1.05 test server (installed in `C:\Yokogawa\CIServer`) they are `%TLS_ROOT_PATH%\tls\upg`, `%TLS_ROOT_PATH%\tls\com\jupgutl.cmd`, `%TLS_WAP_PATH%\cfg\properties\jmrgconfig.properties` and `%TLS_SAV_PATH%\jmrg\ref-data`. The text says `-c` takes the properties file, but the examples pass the `properties` folder. | open | Paths written with `%TLS_*%`. The `-c` argument needs a test on a non-shared machine (no upgrade was done on the R1.05 test server). | `knowledge/manuals/IM36K01C10-01EN.md`; `.claude/skills/installation-security/SKILL.md` |
|
||||
| ISS-087 | 2026-10-08 | SECURITY (RESTful API ports, R1.05) | The RESTful API server `jrstsrv` listens on TCP 34597 (documented, `JRST_NETWORK_PORT`) and also on TCP 7073 on all addresses. 7073 is not in the Security Guide port table (IM 36K01C30 5th ed. §3.2) or in `jrstsrv.sup`. | open | Do not open 7073 in the firewall unless a need is found. Find out what it is (Yokogawa question). | `knowledge/manuals/IM36K01C30-01EN.md`; `.claude/skills/installation-security/tasks/setup-check.md` |
|
||||
| ISS-088 | 2026-10-08 | WINDOWS (WMIC) | IM 36K01C10 5th ed. App. 1.3 still uses `wmic qfe list full`, but WMIC is not installed on Windows Server 2025 / 24H2 (missing on the R1.05 test server). `Get-HotFix` works there. | closed | Use `Get-HotFix`. Close when the user confirms. | `knowledge/manuals/IM36K01C10-01EN.md`; `tools/setup_check.ps1` |
|
||||
| ISS-089 | 2026-10-08 | INSTALLATION (local groups, R1.05) | On the R1.05 test server (no dual-redundant platform, no IT Security Tool) the local group `RDC_GA_CLIENT` exists with member `CIX_PROCESS`. The Security Guide mentions this group only for the dual-redundant platform (IM 36K01C30 5th ed. §4.9). | closed | Information only: apparently created by the installer; no action. Close when the user confirms. | `knowledge/manuals/IM36K01C30-01EN.md` |
|
||||
| ISS-090 | 2026-10-08 | DOCS (CI Server + PRM) | IM 36K01C10 5th ed. §4.1.1 requires PRM R4.06 or later in a note but R4.08 or later in Table 4.1.1-1 (integration code 1901-0302-03-01). | open | Use R4.08 until clarified (from docs; no PRM available). | `knowledge/manuals/IM36K01C10-01EN.md` |
|
||||
| ISS-091 | 2026-10-08 | DSS (temporary files) | Each `dssqld` run (exports and quick loads) left a 0-byte `dss_<n>_<id>.tmp` in `%TLS_LST_PATH%`, and loading a class left a `dss_*.tmp` holding the class source (R1.05 test server: 34 files after one session of checks and a sample load/remove). They are not removed by CI Server. | closed | Test cleanup deletes them: `examples/CI-Eng-Sample/shared/clean_dss_tmp.ps1 -Since <test start>` (0-byte files and files with sample text only). Not checked on R1.03. Close when the user confirms. | `examples/CI-Eng-Sample/README.md` (done); `knowledge/r105-verification.md` (done) |
|
||||
|
|
|
|||
|
|
@ -1,15 +1,17 @@
|
|||
---
|
||||
manual: IM 36K01A50-01EN
|
||||
title: CI Server Release Information
|
||||
edition: 3rd Edition, Sep. 2023
|
||||
version: R1.03
|
||||
status: from docs
|
||||
edition: 5th Edition, Feb. 2026 (section "Platform and installation"); other sections still from the 3rd Edition, Sep. 2023
|
||||
version: R1.05 (first written for R1.03); only "Platform and installation" re-checked so far
|
||||
status: from docs ("Platform and installation" compared with the 5th edition on 2026-10-08; Start-menu folder checked on the R1.05 test server)
|
||||
---
|
||||
|
||||
# Release Information: known issues and cautions (R1.03)
|
||||
# Release Information: known issues and cautions (R1.05)
|
||||
|
||||
Known limitations and workarounds that the other manuals do not cover. Check this list
|
||||
before recommending a workflow in any area. Section numbers refer to the manual.
|
||||
before recommending a workflow in any area. Section numbers refer to the manual. The
|
||||
"Platform and installation" table follows the 5th edition (R1.05); the other sections were
|
||||
written from the 3rd edition (R1.03) and are re-checked with their skills.
|
||||
|
||||
## Platform and installation
|
||||
|
||||
|
|
@ -19,10 +21,12 @@ before recommending a workflow in any area. Section numbers refer to the manual.
|
|||
| Dual-redundant platform (1.1) | After both computers restart, the former standby may come up as *Guest OS (Isolated)*. | In the Redundancy Management Tool set Next Status to *Standby*, then restart that computer. |
|
||||
| IT Security tool (1.3) | Remote Desktop to the CI Server may fail after applying IT Security if OS patch levels differ. | Patch both the server and the RDP client to the latest level. |
|
||||
| IT Security tool (1.3) | Changing Windows region/language after applying IT Security causes problems. | Set region and language **before** applying IT Security; never change afterwards. |
|
||||
| Windows (1.4) | Windows Server 2016 start menu may not refresh after install. | Restart after installing CI Server. |
|
||||
| Windows (1.4) | CI Server started from the command line on Win10 / Server 2016 needs elevation. | Always use *Run as administrator*. |
|
||||
| IT Security tool (1.3, R1.04+) | Upgrading from R1.03 or earlier where the IT security defaults were changed: a dialog offers to reset the account lockout settings (threshold, counter reset, duration). | Answer Yes (No returns to the start of the IT security setup); afterwards set any custom lockout values again. |
|
||||
| Windows (1.4) | CI Server started from the command line on Win10 / Win11 needs elevation. (The R1.03 Server 2016 start-menu note is gone.) | Always use *Run as administrator*. |
|
||||
| Windows (1.4) | Custom fonts can cause visual glitches in the Engineering and Edit modules. | Avoid custom fonts. |
|
||||
| Install path (1.9) | The MELSEC EZSocket installer fails if CI Server is in a non-default path that contains spaces. | Non-default install paths must have no spaces. |
|
||||
| Windows (1.4, R1.04+) | After a user without rights to the CI Server programs opens the CI Server Start-menu folder, its icons stay blank for everyone. | In an elevated prompt, in `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CI Server` (likewise *CI Server Remote Connect*, *YOKOGAWA Security*, *YOKOGAWA Redundancy*) run `COPY /B * +,,` to touch the shortcuts. The manual's path has typos; the folder name was checked on the R1.05 test server (2026-10-08). |
|
||||
| Install path (1.9) | The MELSEC EZSocket installer fails if CI Server is in a non-default path that contains spaces (still in the 5th edition). | Non-default install paths must have no spaces. |
|
||||
| MELSEC (1.9, R1.05) | iQ-R support now uses EZSocket 5.9, installed from `<ISO drive>\Windows\EZSocketPcRedistributableInstaller` (`RunInstaller` as administrator); Mitsubishi reports a vulnerability in it. | Uninstall older EZSocket first. Keep the EZSocket folder writable by Administrators only, run antivirus, keep the PC off untrusted networks (VPN/firewall for remote access), open no untrusted files or links. |
|
||||
| Virtual machines (1.19) | Live migration, failover and shared-storage path switching lose acquired data/alarms; failover during engineering can corrupt the engineering data. | Migrate only when no engineering is in progress; keep engineering backups. |
|
||||
| Virtual machines (1.19) | Serial-only drivers (Siemens 3964R, telemetry integration), Siemens SAPI-S7 and MELSEC are unavailable on VMs; many other drivers work over TCP/IP only. | Check driver support before choosing a VM. |
|
||||
| Virtual machines (1.19) | Do not use VM replication; do not mix physical and virtual machines in HAC; only thin clients may RDP into a virtual CI Server. | Design accordingly. |
|
||||
|
|
@ -31,7 +35,7 @@ before recommending a workflow in any area. Section numbers refer to the manual.
|
|||
## Services
|
||||
|
||||
**ACCESS (1.5)**
|
||||
- OPC classic on Win10 / Server 2016 / 2019 needs .NET 3.5. Install it from the Windows medium
|
||||
- OPC classic on Win10 / Win11 / Server 2019 / 2022 needs .NET 3.5 (5th edition; R1.03 listed Server 2016). Install it from the Windows medium
|
||||
(`DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:<drive>:\sources\sxs`),
|
||||
then re-run the OPC Core Components Redistributable in `%TLS_EXE_PATH%`.
|
||||
- OPC AE: items in the tree root (no section) appear as `.NAME` and some clients can't use them
|
||||
|
|
@ -50,12 +54,14 @@ before recommending a workflow in any area. Section numbers refer to the manual.
|
|||
application appearing. Expected behavior.
|
||||
|
||||
**EQUIPMENT (1.9)**
|
||||
- MELSEC iQ-R needs Mitsubishi EZSocket 4.4: uninstall older EZSocket first, then run
|
||||
`RunInstaller` (as administrator) from `%TLS_ROOT_PATH%\tls\exe\EZSocketPcRedistributableInstaller`.
|
||||
- MELSEC iQ-R: R1.03 needed Mitsubishi EZSocket 4.4 from `%TLS_ROOT_PATH%\tls\exe\EZSocketPcRedistributableInstaller`;
|
||||
R1.05 uses EZSocket 5.9 from the install media (see the MELSEC row in the table above).
|
||||
Uninstall older EZSocket first and run `RunInstaller` as administrator.
|
||||
- IEC 61850: add the line, then the station (General tab: device IP; Options tab: domain prefix
|
||||
and report object), then points. The element address is `<domain prefix><rest>`; the point
|
||||
I/O address is only the part **after** the prefix (the prefix is added automatically).
|
||||
Wrong delimiting means no reports/elements are created.
|
||||
Wrong delimiting means no reports/elements are created. (R1.03 edition; this precaution was
|
||||
removed in the 5th edition, see the L41 summary §3.32 for R1.05.)
|
||||
|
||||
**PROCESS (1.10)**
|
||||
- Java classes that access datasets must get the DSS session with `getDssSession()` (never
|
||||
|
|
|
|||
|
|
@ -1,27 +1,37 @@
|
|||
---
|
||||
manual: IM 36K01C10-01EN
|
||||
title: CI Server Setup
|
||||
edition: 3rd Edition, Sep. 2023
|
||||
version: R1.03
|
||||
status: from docs (Windows settings checked read-only on the test system with tools/setup_check.ps1)
|
||||
edition: 5th Edition, Feb. 2026
|
||||
version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
|
||||
status: from docs (Windows settings, services, ports and upgrade-merge files checked read-only on the R1.03 test system and the R1.05 test server, 2026-10-08; not tested on the R1.05 test server: IT security, Vnet/IP, the upgrade merge itself and PRM, which are not available there)
|
||||
---
|
||||
|
||||
# CI Server Setup (R1.03)
|
||||
# CI Server Setup (R1.05)
|
||||
|
||||
New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall) and network
|
||||
tools. Section numbers refer to the manual.
|
||||
New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall), network
|
||||
tools and, new in R1.05, connection to other Yokogawa products (PRM). Section numbers refer to
|
||||
the 5th edition. The manual prints the default paths (`C:\Program Files (x86)\Yokogawa\CIServer`,
|
||||
`C:\Users\Public\Yokogawa\tls`); on a machine installed elsewhere use the `TLS_*` variables
|
||||
(ISS-086).
|
||||
|
||||
## 1. Before you start
|
||||
|
||||
- Needed: the CI Server software medium (or its ISO) and one **Activated License File per
|
||||
server** (an upgrade needs one that includes the Upgrade License).
|
||||
- Supported OS for R1.03: Windows 10 Pro / Enterprise (64-bit), Windows 10 Enterprise and IoT
|
||||
Enterprise 2016 LTSB and 2019 LTSC, Windows Server 2016, Windows Server 2019, Windows Server
|
||||
IoT 2019. On **Windows 10 Pro/Enterprise (non-LTSB/LTSC) the Vnet/IP drivers and the IT
|
||||
Security Tool are not supported**. VMs run Windows Server 2019.
|
||||
- Only listed software may coexist: Chrome / Firefox / Edge 112, Microsoft Office 2016/2019/365
|
||||
(Excel Add-in), PI AF SDK 2.10.5 + .NET 4.6.2, Adobe Acrobat (Reader) DC, Yokogawa standard
|
||||
antivirus, Standard Whitelisting Software for Endpoint Security. Anything else may disturb CI Server.
|
||||
- Needed: the CI Server ISO file and one **Activated License File per server** (an upgrade
|
||||
needs one that includes the Upgrade License).
|
||||
- Supported OS for R1.05 (§1.3.2), all 64-bit: Windows 10 Enterprise / IoT Enterprise LTSC
|
||||
2019 and 2021; Windows 11 Pro and Enterprise; Windows 11 Enterprise / IoT Enterprise LTSC
|
||||
2024; Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025 (Standard).
|
||||
- On **Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT Security
|
||||
Tool are not supported**; the other OSs also allow CI Server and PRM on one computer.
|
||||
- Gone since R1.03: Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016, Server 2016. The R1.03
|
||||
rule "VMs run Windows Server 2019" is no longer in the manual.
|
||||
- Verified (R1.05 test server, 2026-10-08): CI Server R1.05 runs on Windows Server 2025
|
||||
Datacenter, an edition the list does not name.
|
||||
- Only listed software may coexist (§1.3.3): Chrome 130, Firefox 131, Edge 130; Microsoft
|
||||
Office 2024 / Microsoft 365 (Excel Add-in); PI AF SDK 2.10.5 + .NET 4.6.2; Python 3.12
|
||||
(pyTOOLS); SimbaClient ODBC driver 10.2; Adobe Acrobat / Acrobat Reader DC; Yokogawa standard
|
||||
antivirus; Standard Whitelisting Software for Endpoint Security (not on Windows 11 Pro or
|
||||
Server 2025; ask Yokogawa before using it on VMs). Anything else may disturb CI Server.
|
||||
|
||||
## 2. New setup
|
||||
|
||||
|
|
@ -33,13 +43,16 @@ tools. Section numbers refer to the manual.
|
|||
Windows network settings.
|
||||
4. Install CI Server (with or without the IT Security Tool).
|
||||
5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
|
||||
Use the same security model as the Yokogawa products it connects to or shares the PC with.
|
||||
6. Apply the CI Server licence.
|
||||
|
||||
On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package**
|
||||
instead of drivers/card, VM network settings, install, IT security, licence, then VM
|
||||
settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over
|
||||
TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP
|
||||
must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
|
||||
must not use 192.168.0.0/16. The Vnet/IP Interface Package works only with IT security
|
||||
applied. Mounting the ISO from Hyper-V Manager needs a Server 2019 or 2022 Datacenter host
|
||||
with the Hyper-V role (§2.2.1). Dual-redundant platform: see §2.3 and IM 30A05C30.
|
||||
|
||||
### Windows settings (§2.1.2)
|
||||
|
||||
|
|
@ -49,23 +62,32 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
|
|||
| Visual effects | *Let Windows choose what's best* |
|
||||
| Processor scheduling | *Programs* |
|
||||
| Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart |
|
||||
| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; power button = shut down |
|
||||
| Fast startup | Off: run `<DVD>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
|
||||
| Windows Defender | Turned off by group policy (Server 2016: *Turn off Windows Defender*; 2019: *Turn off Windows Defender Antivirus*) |
|
||||
| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; adaptive brightness off; power button = shut down |
|
||||
| Fast startup | Off: run `<ISO drive>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
|
||||
| Microsoft Defender Antivirus | Turned off by group policy *Turn off Microsoft Defender Antivirus*. Exceptions: on Windows 11 Pro 24H2 keep it on; on Win10 LTSC 2021 and Win11 LTSC 2024 it cannot be turned off |
|
||||
| Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS |
|
||||
| Drive optimization | Scheduled optimization off |
|
||||
| Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled |
|
||||
| Windows updates | KB5023702 (2023-03) on Win10 2019 LTSC / Server 2019, or folder permissions may be wrong |
|
||||
| .NET Framework 3.5.1 | Installed (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<DVD>:\sources\sxs /limitaccess`, or Server Manager feature) |
|
||||
| DCOM | Default Authentication Level = *Connect*; restart |
|
||||
| Windows updates | Apply the per-OS list of cumulative OS and .NET updates in §2.1.2 (state of Feb. 2026; Yokogawa's Endpoint Security Service has the current list), or some install-folder rights may be wrong. Replaces the single R1.03 update KB5023702 |
|
||||
| .NET Framework 3.5.1 | Installed on all listed OSs (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<drive>:\sources\sxs /limitaccess` from the Windows medium, or the Server Manager feature) |
|
||||
| DCOM | Default Authentication Level = *Connect* (needed for OPC Classic on a CI Core); restart |
|
||||
| Display | Scale 100 % |
|
||||
| 8dot3 names | `fsutil behavior set disable8dot3 2`; restart |
|
||||
| Japanese keyboards (new) | On Win10 LTSC 2021 / Win11 LTSC 2024 switch to the previous Microsoft IME version |
|
||||
|
||||
Verified (R1.05 test server, 2026-10-08): a server can run CI Server with several of these
|
||||
not applied (Defender on, updates and cleanup not disabled, no .NET 3.5); the manual still
|
||||
requires them for operation.
|
||||
|
||||
### Vnet/IP (§2.1.1, §2.1.3, §2.1.4)
|
||||
|
||||
- Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd
|
||||
parity; action-mode switch all OFF. One card per computer; card before drivers.
|
||||
- Drivers from `<DVD>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
|
||||
- Which drivers: Vnet/IP and Ethernet on the same computer → control bus driver only (no open
|
||||
communication driver); Vnet/IP only → both; no Vnet/IP → neither.
|
||||
- Before the open communication driver on Win10 LTSC 2019, Server 2019 or Server 2022, check
|
||||
in `msinfo32` that **Kernel DMA Protection** is Off (switch it off in the BIOS if needed).
|
||||
- Drivers from `<ISO drive>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
|
||||
`installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off.
|
||||
- Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*,
|
||||
*RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4.
|
||||
|
|
@ -73,7 +95,7 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
|
|||
Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18.<domain>.<station>`/16.
|
||||
- Computer name = station name. Check `sc query VLTDI` = RUNNING.
|
||||
- Never use Internet Connection Sharing, bridge connections or Homegroup.
|
||||
- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.8).
|
||||
- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.9).
|
||||
|
||||
### Installing CI Server (§2.1.5)
|
||||
|
||||
|
|
@ -81,79 +103,185 @@ must not use 192.168.0.0/16. Dual-redundant platform: see §2.3 and IM 30A05C30.
|
|||
join the domain first for domain/combination management.
|
||||
- Close applications, disable antivirus, never run two installers, never install where CI
|
||||
Server Remote Connect is installed.
|
||||
- `<DVD>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
|
||||
- `<ISO drive>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
|
||||
`…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type
|
||||
*CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default,
|
||||
see known issues), reboot.
|
||||
see known issues). An upgrade keeps the first install folder.
|
||||
- Upgrade to R1.05 or later: the installer offers *Automatic upgrade CI Server configuration*
|
||||
(ticked by default). See §3.
|
||||
- At the end: tick *I want to set up IT Security Tool Now* for IT security 2.0, untick it
|
||||
for 3.0 (below); then reboot.
|
||||
- **Change the initial passwords of the predefined CI Server user accounts** (Engineering
|
||||
Module manual).
|
||||
|
||||
### IT security (§2.1.6) and licence (§2.1.7)
|
||||
### IT security (§2.1.6)
|
||||
|
||||
- IT Security Tool: select *Standard Model* and the user management type; keep default items;
|
||||
restart. The model must be the same across the system. Save/export settings if you change
|
||||
defaults. Running the tool (also during upgrade) overwrites manual security changes.
|
||||
- Licence: Start menu › *License Authorization Wizard* (admin) › select the activated licence
|
||||
file › Finish.
|
||||
The IT Security Tool now offers **IT security version 2.0 or 3.0**. A full list of the 3.0
|
||||
settings comes as a PDF with the tool. Common rules:
|
||||
- The security model must be the same across the system; linked domain management: apply
|
||||
*Standalone* first, join the domain, then link with the Domain Link Management Tool.
|
||||
- Export the settings if you change defaults. Running the tool (also during an upgrade)
|
||||
overwrites security changes made by other means.
|
||||
|
||||
**Version 2.0**: at the end of the install keep the checkbox ticked, choose version 2.0,
|
||||
*Standard Model*, the user management type, keep default items, restart.
|
||||
|
||||
**Version 3.0** (needs a v3.0 licence number per computer, from the licence certificate):
|
||||
1. Unblock the ISO file (file properties) so the script runs properly.
|
||||
2. Untick the IT Security checkbox at the end of the install.
|
||||
3. As administrator run `<ISO drive>\Windows\CIServer\ITSecurity\Installer\ITSec_3_InstalledSoftwareForCIX.cmd`
|
||||
and enter the licence number (up to 20 letters/digits, no hyphens).
|
||||
4. Start the IT Security Tool, *Setup*, version 3.0 (Standard model and Standalone are
|
||||
preselected), restart.
|
||||
- The GPO file `CIX_Standard_3.0.zip` and the settings PDF are placed under
|
||||
`C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\GPOFiles\3.0` and `…\Document\3.0`.
|
||||
- CI Mobile View or a domain controller: run `ITSec_3_ForCIViewHTML.cmd` or
|
||||
`ITSec_3_DCForCIX.cmd` from the same folder, then `ciserver-…-ITSecurity.exe` with install
|
||||
type *Apply IT Security only*, version 3.0, model *CI View standard Model Standalone Management*.
|
||||
|
||||
**Other Yokogawa products on the same PC**: if CI Server is installed after a product that has
|
||||
IT security 3.0, CI Server may use 2.0 or 3.0; after a product with 2.0, only 2.0. If the
|
||||
other product is installed later, its own supported versions decide (a 2.0-only product
|
||||
forces 2.0).
|
||||
|
||||
**LAPS** (Local Administrator Password Solution; only with linked domain management and IT
|
||||
security 3.0, after the v3.0 GPO is applied to the clients):
|
||||
- Install `<ISO drive>\Windows\ThirdParty\LAPS\LAPS.x64.msi`: on the domain controller only
|
||||
the management tools, on the clients only the AdmPwd GPO extension.
|
||||
- On the domain controller, as a member of Enterprise Admins and Schema Admins, in an
|
||||
elevated PowerShell: `Import-module AdmPwd.PS`, `Update-AdmPwdADSchema`,
|
||||
`Set-AdmPwdComputerSelfPermission -OrgUnit "<OU>"`. Then enable the policy (Security Guide
|
||||
summary §7).
|
||||
- With software restriction policies applied, start the msi from an elevated command prompt.
|
||||
|
||||
### Licence (§2.1.7)
|
||||
|
||||
Start menu › *License Authorization Wizard* (admin) › select the activated licence file › Finish.
|
||||
|
||||
### CI Server Remote Connect (§2.4)
|
||||
|
||||
On a CI View PC (never on a Portal or Core): browse to `http(s)://<portal>:<port>` (defaults
|
||||
8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup`
|
||||
(Setup File Editor › *Client communication* tab); open them in the firewalls.
|
||||
- Moving Remote Connect to a later *version* means uninstall, then install the new one; a
|
||||
later revision of the same version can be installed over it.
|
||||
- With software restriction policies applied, switch them off before upgrading Remote Connect
|
||||
and on again afterwards.
|
||||
- IT security on a Remote Connect PC: run `ciserver-…-ITSecurity.exe` with install type
|
||||
*IT Security for multi-product environment*, then version 2.0 (checkbox) or 3.0
|
||||
(`ITSec_3_InstalledSoftwareForCIViewRC.cmd`, then the tool).
|
||||
|
||||
### Virtualization extras (§2.5)
|
||||
|
||||
RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1;
|
||||
allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task
|
||||
for sound over RDP.
|
||||
for sound over RDP. Before applying IT security 3.0 there, set the *Windows Remote Management
|
||||
(WS-Management)* service to Automatic and the policy *Allow Remote Shell Access* to Not
|
||||
Configured, then restart.
|
||||
|
||||
## 3. Maintenance
|
||||
|
||||
**Start/stop (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI Server*, or the
|
||||
*CI Service* Windows service (set startup type *Automatic* for automatic start). An expired
|
||||
licence gives an error at start.
|
||||
**Start/stop CI Server (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI
|
||||
Server*, or the *CI Service* Windows service (service name `StartCIServer`; startup type
|
||||
*Automatic* for automatic start). An expired licence gives an error at start.
|
||||
|
||||
**Reinstall / upgrade (§3.2)**, upgrades from R1.02 or earlier (needs a Product Maintenance
|
||||
Licence):
|
||||
1. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
|
||||
2. Stop CI Server; set the CI Service startup type to *Manual*.
|
||||
3. Stop the *VAGW Bossd* service, then back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls`
|
||||
(plus project files).
|
||||
4. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
|
||||
**Start/stop VAGW Bossd (§3.2, new)**: from R1.04, as a `CIX_MAINTENANCE` administrator in an
|
||||
elevated prompt: `%TLS_ROOT_PATH%\tls\vagw\program(x64)\vagwstarter.exe -s` (start) or `-e`
|
||||
(stop); log in `C:\ProgramData\Yokogawa\IA\iPCS\Products\CENTUMVP\UACS\Server\Log`. On R1.03
|
||||
use the Services console. VAGW exists only when installed with the IT Security Tool.
|
||||
|
||||
**Reinstall / upgrade (§3.3)**: direct upgrade from R1.01 or later; apply the Product
|
||||
Maintenance Licence to the Portal/Core first. If CI Server was installed with the IT Security
|
||||
Tool, the reinstall/upgrade must include it too.
|
||||
1. (§3.3.1) Note the instance setup files (one per equipment line: equipment process name +
|
||||
`.sup`, Engineering Module › Equipment › Lines) and their templates (Setup File Editor ›
|
||||
*Templates*, `*_eqp.sup` / `*_eqt.sup`; since R1.04 `eqa850_eqp.sup` is `eta850_eqt.sup`).
|
||||
2. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
|
||||
3. (§3.3.3, Vnet/IP on a VM, from R1.01–R1.03 to R1.04+) Set the device of every Vnet line
|
||||
back to `/dev/bk00` in the Engineering Module.
|
||||
4. Stop CI Server; set *CI Service* to *Manual*. Stop VAGW Bossd (above) and set it to *Manual*.
|
||||
5. Back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls` (plus project files).
|
||||
6. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
|
||||
(`.sav/.d01/.k01`) and `*.sqlite`.
|
||||
5. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
|
||||
`tls\com`, `sup`, `tpl`, `src` and `%TLS_ALLUSERS_PATH%\wap`.
|
||||
6. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
|
||||
7. Install over the top (no uninstall); if IT Security Tool was installed before, install it again.
|
||||
8. IT security, licence.
|
||||
9. Restore: **compare and merge** changes into the new files (never copy old files over new
|
||||
ones), including `wap\cfg\operatorInterfaces\DEPLOY\layouts\`; re-apply IT security.
|
||||
10. Verify: start, `dsschk -e -r` three times, restart, check `%TLS_LOG_PATH%\ci_start.log`,
|
||||
restore the startup type.
|
||||
- ODBC: if the Simba client version differs, remove DSNs, uninstall and reinstall the client;
|
||||
on R1.02 or older with the Simba server, uninstall the server before upgrading.
|
||||
- Passwords of predefined CI Server accounts are reset to the initial ones: change them again.
|
||||
7. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
|
||||
`tls\com`, `sup`, `tpl`, `src`, `exe\ServerConfig.xml` and `%TLS_ALLUSERS_PATH%\wap`.
|
||||
8. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
|
||||
9. Install over the top (no uninstall), keeping the automatic merge ticked unless you want to
|
||||
merge everything by hand.
|
||||
10. IT security (version 3.0: run `ITSec_3_InstalledSoftwareForCIX.cmd` first), licence; start
|
||||
CI Server once to confirm, then stop it.
|
||||
11. Restore (§3.3.14): check the merge report and conflict log (below) and merge by hand what
|
||||
was not merged. Compare instance setup files with the **new templates** and copy new
|
||||
keywords into each; compare other setup files with the newly installed ones; never copy
|
||||
old files over new ones. Layouts (`wap\cfg\operatorInterfaces\DEPLOY\layouts\`): check
|
||||
them if merged automatically, merge by hand otherwise. Re-apply IT security.
|
||||
12. Verify (§3.3.15): start, `dsschk -e -r` three times, stop, start VAGW Bossd, start,
|
||||
check `%TLS_LOG_PATH%\ci_start.log`; from R1.01/R1.02 compile all alarm selection area
|
||||
expressions; restore the startup types (VAGW Bossd back to Automatic).
|
||||
- Product-specific upgrade notes live elsewhere: ODBC from R1.02 or older (IM 36K10L45
|
||||
"Notes for upgrading to R1.03.00"), OPC UA client/server (IM 36K10L45 "Notes for upgrading
|
||||
to R1.04.00"), IEC 61850 (IM 36K10L41 App. 1), RGS with EAL from R1.03 (merge the OPC UA
|
||||
client setup file, download the project common section and tag list from the ENG HIS).
|
||||
The R1.03 Simba client/server reinstall notes are no longer in this manual.
|
||||
- Passwords of predefined CI Server accounts are reset to the initial ones: change them
|
||||
again (running the IT Security Tool does not reset them).
|
||||
|
||||
**HAC upgrade (§3.3)**: stop standby, disconnect its network, upgrade and test offline, stop
|
||||
standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync resumes).
|
||||
**Automatic merge of configuration files (R1.05+, §2.1.5, §3.3.8, §3.3.14, §3.3.15)**
|
||||
- The installer copies user files to `%TLS_ROOT_PATH%\tls\upg\to-<new>\util\backup\user\tls`
|
||||
(`com`, `sup`, and `wap\cfg\operatorInterfaces\DEPLOY\layouts`, `colors`, `chartGroups`)
|
||||
and merges them with the new version.
|
||||
- Results: `upgrade-report-<old>-to-<new>-<date>.csv` (columns File name, Attribute, Conf
|
||||
value, Default old, Default new, Merged value, Reason) and `upgrade-conflicts-…log`, in
|
||||
`%TLS_LOG_PATH%\jmrg` (the manual prints the default path).
|
||||
- If it did not run: copy the backup `com` and `sup` folders and the three wap folders into
|
||||
that `upg` path, then in an elevated prompt in `%TLS_ROOT_PATH%\tls\com` run
|
||||
`jupgutl.cmd -o <old version> -n <new version> -p "<tls root>" -c "<…\wap\cfg\properties>"`
|
||||
(e.g. `-o 1.04.00 -n 1.05.00`). The text says `-c` is the `jmrgconfig.properties` file but
|
||||
the examples pass its folder; not tested (ISS-086).
|
||||
- Verified (R1.05 test server, 2026-10-08): `jupgutl.cmd` starts the Java tool in
|
||||
`tls\exe\jmrg.jar`; `%TLS_WAP_PATH%\cfg\properties\jmrgconfig.properties` limits the merge
|
||||
to `*_start*` / `*_stop*` files in `com`, `*.sup` in `sup` and `*.xml` in the three wap
|
||||
folders; reference copies of the shipped files of R1.01.00–R1.04.00 are in
|
||||
`%TLS_SAV_PATH%\jmrg\ref-data`. Other files (rest of `com`, `tpl`, `src`,
|
||||
`ServerConfig.xml`) still need a manual compare.
|
||||
|
||||
**Extend licence (§3.4)**: License Authorization Wizard while running; node name/number must
|
||||
**HAC upgrade (§3.4)**: stop standby, disconnect its network, upgrade and test offline, stop
|
||||
standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync
|
||||
resumes). Keep one server running if several are upgraded at once.
|
||||
|
||||
**Extend licence (§3.5)**: License Authorization Wizard while running; node name/number must
|
||||
match; takes effect within an hour. New features need CI Server stopped first.
|
||||
|
||||
**Uninstall (§3.5, §3.6)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
|
||||
**Uninstall (§3.6, §3.7)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
|
||||
CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security
|
||||
definitions), then run `<DVD>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
|
||||
definitions), then run `<ISO drive>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
|
||||
|
||||
**TCP/IP tools (§3.8)**: from the VirtualProduct package `XCM3003\Module\Tool`:
|
||||
**TCP/IP tools (§3.9)**: from the VirtualProduct package `XCM3003\Module\Tool`:
|
||||
`TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC
|
||||
IPv4 settings: note them first, re-enter after restart).
|
||||
|
||||
## 4. Connecting Yokogawa products (new chapter)
|
||||
|
||||
- Each combination has an **integration code**: package code 1 – package code 2 – type –
|
||||
revision. Type 01: same PC, no interaction; 02: separate PCs that interact (two type-02
|
||||
products never on one PC); 03: same or separate PCs, working together; 04: as 03 with
|
||||
limits. When manuals of two products disagree, use the one with the newer revision.
|
||||
- Security model and user management type must match on both products.
|
||||
- **CI Server + PRM Server** (§4.1.1): code 1901-0302-03-01; CI Server R1.04 or later, PRM
|
||||
Server R4.08 or later (a note in the same section says R4.06; ISS-090); Standard model;
|
||||
standalone or domain/combination management; the same IT security version on both.
|
||||
- PRM first: (if VAGW or Vnet/IP is used) remove the Vnet driver with PRM Disc 1 and install
|
||||
the one from the CI Server ISO; run the CI Server + IT Security installer until it
|
||||
restarts; stop PRM with `<OS drive>:\PRM\Tool\PRMStop.bat`; finish the install; set
|
||||
security; restart (PRM services start by themselves).
|
||||
- CI Server first: stop CI Server and VAGW Bossd, set both to Manual, install PRM, restore
|
||||
both startup types.
|
||||
|
||||
## Troubleshooting (Appendix 1)
|
||||
|
||||
| Problem | Workaround |
|
||||
|---|---|
|
||||
| Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart |
|
||||
| Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups |
|
||||
| Installed updates not listed | `wmic qfe list full` |
|
||||
| Cannot change time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
|
||||
| Installed updates not listed | Manual: `wmic qfe list full`. WMIC is missing on Windows Server 2025 / 24H2 (verified, R1.05 test server, 2026-10-08): use `Get-HotFix` in PowerShell (ISS-088) |
|
||||
| Cannot change the time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
|
||||
|
|
|
|||
|
|
@ -1,31 +1,39 @@
|
|||
---
|
||||
manual: IM 36K01C30-01EN
|
||||
title: CI Server Security Guide
|
||||
edition: 3rd Edition, Sep. 2023
|
||||
version: R1.03
|
||||
status: from docs (users/groups and firewall checked read-only on the test system)
|
||||
edition: 5th Edition, Feb. 2026
|
||||
version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
|
||||
status: from docs (users/groups and firewall checked read-only on the R1.03 test system; listening ports, users and firewall checked read-only on the R1.05 test server, 2026-10-08; the IT Security Tool is not installed there and not supported on its Windows Server 2025, so IT security itself is not verified on R1.05)
|
||||
---
|
||||
|
||||
# CI Server Security Guide (R1.03)
|
||||
# CI Server Security Guide (R1.05)
|
||||
|
||||
What the IT Security Tool changes, which Windows accounts and firewall openings CI Server
|
||||
needs, and the related utilities. Section numbers refer to the manual.
|
||||
needs, and the related utilities. Section numbers refer to the 5th edition. Since R1.04 the
|
||||
manual covers Windows Server 2022 instead of 2016; R1.05 adds Windows 11 Enterprise LTSC 2024
|
||||
and **IT security version 3.0** (§7 below).
|
||||
|
||||
## 1. Threats and measures
|
||||
|
||||
- Threats: attacks over the network, direct attacks at a terminal, theft of a computer/data.
|
||||
- Measures: access control (files, folders, registry, DCOM/OPC, system commands), personal
|
||||
firewall, stopping unused services, IT environment settings (NetBIOS, disk password), and
|
||||
group policies (password/lockout, security options, software restriction, audit policies,
|
||||
administrative templates, safe DLL search order).
|
||||
firewall, stopping unused services, IT environment settings (NetBIOS, disk password,
|
||||
Delivery Optimization, Defender), and group policies (password/lockout, security options,
|
||||
software restriction, audit policies, administrative templates, safe DLL search order).
|
||||
- IT security settings **must** be applied at the area and process levels; business and
|
||||
corporate levels follow the site's own policy.
|
||||
|
||||
## 2. Security model and user management
|
||||
|
||||
- CI Server supports only the **Standard model**: protects against network and terminal
|
||||
attacks, **not** against theft. Password and lockout policies are *not* set by it (use
|
||||
domain policy).
|
||||
attacks, **not** against theft.
|
||||
- Password and lockout (§2.1, §3.6.1–3.6.2): in IT security 2.0 the password policy is not
|
||||
applied (use domain policy), but the **account lockout policy is applied** (10 failed
|
||||
sign-ins, counter reset after 15 min, locked for 15 min). In 3.0 both are settings of the
|
||||
tool; for domain accounts set them on the domain controller or in the Default Domain Policy.
|
||||
(The R1.03 version of this summary said lockout was not set; that was wrong in R1.03 too.)
|
||||
- Upgrading from R1.03 or earlier with changed IT security defaults: a dialog asks to reset
|
||||
the lockout values; answer Yes, then set custom values again (IM 36K01A50 §1.3).
|
||||
- User management types:
|
||||
|
||||
| Type | Accounts kept on | Notes |
|
||||
|
|
@ -36,7 +44,8 @@ needs, and the related utilities. Section numbers refer to the manual.
|
|||
| Linked domain (recommended for new systems) | Domain, linked to local groups | Apply *Standalone* first, join domain, then link with Domain Link Management Tool |
|
||||
|
||||
- Groups/accounts created by the IT Security Tool (standalone: local; domain types: on the
|
||||
domain controller, with `_LCL` local helper groups):
|
||||
domain controller, with `_LCL` local helper groups). **With IT security 3.0 only the
|
||||
Standalone and Linked domain sets are created** (§2.2.1).
|
||||
|
||||
| Name | Kind | Purpose |
|
||||
|---|---|---|
|
||||
|
|
@ -51,13 +60,21 @@ needs, and the related utilities. Section numbers refer to the manual.
|
|||
|
||||
Use these accounts only for CI Server. Changing the security model may delete or rename groups.
|
||||
|
||||
Verified (R1.05 test server, 2026-10-08): without the IT Security Tool, CI Server still
|
||||
creates the local user `CIX_PROCESS` (member of Administrators) and runs *CI Service* with it;
|
||||
there are no `CIX_` groups and no `CTM_PROCESS`. A local group `RDC_GA_CLIENT` with member
|
||||
`CIX_PROCESS` also exists although the server is not a dual-redundant platform (ISS-089, no
|
||||
action needed).
|
||||
|
||||
## 3. Firewall (§3.2)
|
||||
|
||||
Windows Firewall on; block everything except what CI Server needs:
|
||||
Windows Firewall on; block everything except what CI Server needs. IT security 3.0 uses the
|
||||
same exception list (§3.7.2).
|
||||
|
||||
| Use | Port |
|
||||
|---|---|
|
||||
| Web / secure web (CI View, CI Portal) | TCP 8080 / 80, TCP 8443 / 443 |
|
||||
| RESTful API web server (`jrstsrv`, new in R1.04/R1.05) | TCP 34597 (`JRST_NETWORK_PORT` in `jrstsrv.sup`) |
|
||||
| DURM between nodes | UDP 17001, 17101 (one per DURM line) |
|
||||
| SMDMON (system log collection) | UDP 18002 |
|
||||
| Remote desktop (only if needed, restrict users) | TCP 3389 |
|
||||
|
|
@ -74,15 +91,26 @@ Windows Firewall on; block everything except what CI Server needs:
|
|||
|
||||
ICMP echo (ping) is allowed by the Standard model.
|
||||
|
||||
Verified (R1.05 test server, 2026-10-08): listening are TCP 8080/8443 (web), 34597 (RESTful
|
||||
API), 34493 (OPC UA server `opxuas`), UDP 17001/17101 (DURM) and 18002 (SMDMON). The RESTful
|
||||
API server also listens on **TCP 7073** on all interfaces; no manual mentions this port and
|
||||
`jrstsrv.sup` has no keyword for it (ISS-087). Do not open it in the firewall.
|
||||
|
||||
## 4. Other settings (§3.3–§3.6)
|
||||
|
||||
- Unused services disabled by the tool (depending on OS): Diagnostic Policy, Connected User
|
||||
Experiences and Telemetry, dmwappushsvc, Downloaded Maps Manager, IP Helper, Program
|
||||
Compatibility Assistant, Remote Registry, Shell Hardware Detection, Themes, Windows Push
|
||||
Notifications, and others. DHCP Client must stay running.
|
||||
- Unused services disabled by the tool (OS columns now Win10 LTSC, Win11 LTSC 2024, Server
|
||||
2019, Server 2022): Diagnostic Policy, Connected User Experiences and Telemetry,
|
||||
dmwappushsvc, Downloaded Maps Manager, IP Helper, Program Compatibility Assistant, Remote
|
||||
Registry, Shell Hardware Detection, Themes, Windows Push Notifications, and others.
|
||||
Delivery Optimization is no longer stopped; WinHTTP Web Proxy Auto-Discovery left the list.
|
||||
DHCP Client must stay running.
|
||||
- Delivery Optimization (§3.5.3): limited by policy (Server 2022: HTTP only; other listed OSs:
|
||||
bypass) so updates do not spread between plant PCs.
|
||||
- Defender (§3.5.4): the "turn off" policy is set on OSs older than Windows 11 and left
|
||||
unconfigured on Windows 11; it has no effect on Win10 LTSC 2021 / Win11 LTSC 2024.
|
||||
- OPC: *Create permanent shared objects* right for `CIX_OPC`, `CIX_PROCESS`, `CTM_PROCESS`;
|
||||
network access sharing model *Classic*; DCOM port range 20500–20550 (the manual's table
|
||||
also prints "2500–20550", taken as a typo).
|
||||
still prints "2500–20550" in R1.05, taken as a typo).
|
||||
- NetBIOS over TCP/IP can be disabled (default with domain/combination management); then
|
||||
configure HOSTS/DNS for name resolution.
|
||||
- USB storage disabled; use the StorageDeviceCTL utility (members of `CIX_MAINTENANCE`) to
|
||||
|
|
@ -92,14 +120,22 @@ ICMP echo (ping) is allowed by the Standard model.
|
|||
|
||||
| Tool | Use |
|
||||
|---|---|
|
||||
| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (model + management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
|
||||
| IT Security Tool (Start › YOKOGAWA Security) | *Setup* (version 2.0/3.0, model, management type), *Save*/*Restore* (with a default password for recreated accounts), *Change Password* of the saved file, *Import*/*Export*, *Information* (summary) |
|
||||
| Domain Link Management Tool | Link/unlink the domain (linked domain management); sign in as local admin + `CIX_MAINTENANCE` |
|
||||
| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components |
|
||||
| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<DVD>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
|
||||
| `PrepareReconstruction.cmd` then `ciserver-…-ITSecurity.exe` › *Apply IT Security only* | Re-apply with different target components (CI Mobile View, General PC, domain controller) |
|
||||
| Reapply on Remote Connect after an upgrade to R1.05 | Run the R1.05 `-ITSecurity.exe` installer again to reinstall the IT Security Tool (overwrite install), then apply (§4.8.1) |
|
||||
| `ResetITSecCondition.cmd` (`<ISO drive>\Windows\CIServer\ITSecurity`) | First step when switching CI Mobile View, General PC or a domain controller between IT security 2.0 and 3.0 (§4.8.3–4.8.4) |
|
||||
| `Yokogawa.IA.iPCS.Platform.Security.CreateCIXProcess.exe [-p <password>]` (`<ISO drive>\Windows\CIServer\ITSecurity`) | Create `CIX_PROCESS` or set its password; same password on all collaborating computers; restart |
|
||||
| `…CreateCTMProcess.exe [-p <password>]` | Same for `CTM_PROCESS` |
|
||||
| `ITSecuritySettingItemExport.exe` | Export applied settings |
|
||||
| `YWVNETCreateVNTUser` | Change passwords of the Vnet/IP Interface Package users (VM) |
|
||||
|
||||
Installer options (App. 2.5): *CI Server and IT Security Tool* for CI Core / CI Portal; *IT
|
||||
Security for multi-product environment* for CI View / CI Mobile View on a PC where another
|
||||
Yokogawa product's IT security is applied; *Apply IT Security only* for CI Mobile View,
|
||||
General PC and domain controller (avoid it where other products are installed). Applying the
|
||||
wrong station type means reinstalling Windows. Version 3.0 always needs a licence number.
|
||||
|
||||
**Changing the account that runs CI Server (§4.9)**: create the user, add it to
|
||||
Administrators (and `RDC_GA_CLIENT` on a dual-redundant platform; `CIX_OPC` or
|
||||
`CIX_OPC_LCL` when IT security is applied), set it on the *CI Service* Log On tab and on the
|
||||
|
|
@ -111,4 +147,49 @@ Extra settings the site may add: audit policies and event log sizes, disable rec
|
|||
console and Guest account, restrict audit log and removable media access, immediate
|
||||
screen-saver password, SNMP, SSL/TLS registry settings, secure startup and
|
||||
`AllowedPaths` registry keys, remove *Everyone* for anonymous users, remove unused
|
||||
protocols, block malicious DLL loading.
|
||||
protocols, block malicious DLL loading, show a notice on entry to a security zone (§5.26).
|
||||
|
||||
**Safe API use (§5.27, new)**: give each client application of the APIs (ODBC, OPC UA, web,
|
||||
RESTful API, …) its own DSS user or authorization group with only the datasets and the
|
||||
read/insert/update/delete rights it needs and a unique password; never run it as SYSTEM or
|
||||
with an administrator account. The RESTful API is HTTPS only; use the newest TLS version
|
||||
(§5.14). Treat exported data as sensitive and delete what is not needed.
|
||||
|
||||
## 7. IT security version 3.0 (new in R1.05)
|
||||
|
||||
From docs, not tested (IT Security Tool not available on the R1.05 test server) (§2.1, §3.7, §4.8.3–4.8.4, ch. 6). Installation: Setup summary §2.1.6.
|
||||
- Chosen in the IT Security Tool next to 2.0; needs a licence number per computer. The full
|
||||
setting list is a PDF installed with the tool. Settings are grouped in categories (Access
|
||||
Control, Firewall per profile, System Services, Password Policy, Account Lockout Policy,
|
||||
Security Options, Administrative Templates, Removable Storage Access, …); access control,
|
||||
firewall exceptions, OPC, HDD password and software restriction work as in 2.0.
|
||||
- Defaults worth knowing:
|
||||
- Unticked by default (tick them on *Select Setting Items* if wanted): screen lock after
|
||||
inactivity, 15-minute limit for idle RDP sessions, password-protected screen saver,
|
||||
SMB signing (Windows 11 signs by default; switch it off on both sides if a product
|
||||
cannot cope).
|
||||
- Ticked by default: Kerberos limited to AES (a domain user may get a "current
|
||||
credentials" prompt; reset that user's password or untick the item), Internet Explorer 11
|
||||
disabled, network level authentication and a single session per RDP user, Print Spooler
|
||||
refuses client connections, no PnP redirection over RDP, auto logon disabled.
|
||||
- PowerShell script-block logging and transcription are on, so a password typed in
|
||||
PowerShell ends up in the log: run security utilities that take passwords in cmd.
|
||||
- CD/DVD access can be denied only with the Group Policy Editor, not with the tool.
|
||||
- Built-in accounts (§3.7.18, §3.7.22): disable or rename the built-in Administrator and
|
||||
Guest; avoid names containing admin, root or su; on the dual-redundant platform rename
|
||||
ADMINISTRATOR / PATCHUSER with the Redundancy Management Tool.
|
||||
- LAPS (§3.7.23): only with linked domain management and 3.0. After installing it (Setup
|
||||
summary §2.1.6), enable *Enable Local Admin Password Management* in the GPO of the OU of the
|
||||
target computers. The built-in Administrator then gets a different, rotating password on
|
||||
each computer (read it with LAPS UI on the domain controller), so do not use that account
|
||||
for CI Server.
|
||||
- Switching CI Mobile View, General PC or a domain controller between 2.0 and 3.0 (§4.8.3–4.8.4):
|
||||
sign in as a `CIX_MAINTENANCE` administrator, run `ResetITSecCondition.cmd`, start the tool
|
||||
and choose the version. Back to 2.0: first *Restore* the file
|
||||
`PrepareToChangeITSecVer.hed` under `C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\System\Extension\3.0`.
|
||||
For linked domain management, leave the domain, reapply, rejoin and relink.
|
||||
- Central management with Active Directory (ch. 6): on the domain controller create a GPO,
|
||||
*Import Settings* from `CIX_Standard_2.0.zip` or `CIX_Standard_3.0.zip` (from
|
||||
`…\ITSecurity\GPOFiles\<version>`; 3.0 comes from the IT security 3.0 medium), and link it
|
||||
to the OU of the CI Server computers. Apply IT security on every client first; change
|
||||
settings only in the GPO on the domain controller.
|
||||
|
|
|
|||
|
|
@ -1,17 +1,19 @@
|
|||
---
|
||||
manual: IM 36K10E20-01EN
|
||||
title: OPC Interface
|
||||
edition: 2nd Edition, Sep. 2023
|
||||
version: R1.03
|
||||
status: from docs; OPC UA point and certificate forms compared with quick load on the test system 2026-10-01 (user configured a point in the Engineering Module, exported and diffed)
|
||||
edition: 4th Edition, Feb. 2026 (R1.05); first summarised from the 2nd Edition, Sep. 2023 (R1.03)
|
||||
version: R1.05 (first written for R1.03)
|
||||
status: from docs. R1.03 (2026-10-01): OPC UA point and certificate forms compared with quick load on the test system (user configured a point in the Engineering Module, exported and diffed). R1.05 (2026-10-08, read-only): method and mapper datasets, installed mapper files, AOG method displays and the ServerConfig.xml location checked; forms not opened, nothing configured
|
||||
---
|
||||
|
||||
# OPC Interface (R1.03)
|
||||
# OPC Interface (R1.05)
|
||||
|
||||
Engineering Module procedures for OPC Classic, OPC UA client and OPC UA PubSub. Concepts,
|
||||
setup files and the OPC servers: `IM36K10L45-01EN.md`. Everything here is under
|
||||
*Configuration → I/O processing → Equipment → (OPC DA client | OPC A&E client | OPC UA Client |
|
||||
OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
|
||||
Engineering Module procedures for OPC Classic, OPC UA client, the OPC UA Information Model
|
||||
Mapper (new in R1.05) and OPC UA PubSub. Concepts, setup files and the OPC servers:
|
||||
`IM36K10L45-01EN.md`. Client and PubSub objects are under *Configuration → I/O processing →
|
||||
Equipment → (OPC DA client | OPC A&E client | OPC UA Client | OPC UA PubSub)*. CI Server must be
|
||||
running. Section numbers refer to the 4th edition (R1.03 §2.2.6 is now §2.3, PubSub moved from
|
||||
ch. 3 to ch. 4).
|
||||
|
||||
## 1. OPC Classic (§1)
|
||||
|
||||
|
|
@ -19,25 +21,34 @@ OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual.
|
|||
A&E lines, `OPX` for OPC UA), station (OPC server node and ProgID, status item), group
|
||||
(deadband, requested update rate, status item), point (external relation, group, OPC tag,
|
||||
browse). Then connect items to points (Tutorial "Define points").
|
||||
- A&E: line, station (server, subscription filters), subscribed attributes; to show events in
|
||||
the current alarm overview, map event sources to items. External names must be unique per
|
||||
station.
|
||||
- A&E: line, station (server, subscription filters; category filter = event category codes of
|
||||
the A&E server, comma separated), subscribed attributes; to show events in the current alarm
|
||||
overview, map event sources to items. External names must be unique per station.
|
||||
|
||||
## 2. OPC UA client (§2)
|
||||
## 2. OPC UA client (§2.1)
|
||||
|
||||
Order: line → station → subscription → points (→ methods) → alarm components / event type
|
||||
filters / event nodes / template settings (only when alarms are wanted; no alarms are received
|
||||
until event nodes are configured).
|
||||
until event nodes are configured, and since R1.04 only with `OPXC_ENABLE_EXTENDED_FUNC = YES`,
|
||||
see `IM36K10L45-01EN.md` §6).
|
||||
|
||||
| Object | Key fields (dataset field) |
|
||||
|---|---|
|
||||
| Line | name ≤ 31, equipment node (*None* = this node), **process name starts with `OPX`, ≤ 11 characters** (`EQUIPMENT_MAN`) |
|
||||
| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item*; *On scan*; *General communication status item* (`STATUS_ITEM`); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
|
||||
| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item* (0 none, 1 server 1, 2 server 2); *On scan*; *General communication status item* (`STATUS_ITEM`; 4th ed. lists 0 preparing, 1 connected, 2 comm error/reconnecting, 3 connect failed, 4 shutdown received, 5 connection recreated — a Boolean item worked on R1.03, ISS-080); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) |
|
||||
| Subscription | publishing interval, lifetime and keep-alive counts, max notifications, priority, publish enabled, status item |
|
||||
| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
|
||||
| Method | namespace, node ID or browse path, process areas |
|
||||
| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*; F5 rebrowses); *Read additional node information* (R1.05; clear it for slow links); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) |
|
||||
| Method (§2.1.6) | name (≤ 255), namespace, node ID type, node ID (or browse path); *Options*: parent object node ID set by hand; *Arguments*: input/output argument types set by hand (use the server's types). Dataset `OPCUAC_METHOD_CALL2_DF`. No process areas any more (set them on the method object's `MTD_TRG` signal) |
|
||||
|
||||
**Observed (2026-10-01)**: in the point form's browse, picking the item itself
|
||||
Alarm event types (§2.1.4): `GeneralModelChangeEventType` and, only with
|
||||
`OPXC_BASE_MODEL_CHANGE_EVENT` set, `BaseModelChangeEventType`.
|
||||
|
||||
Upgrade from R1.03 (§2.1.6): methods with String or Boolean input arguments must be refreshed —
|
||||
edit any field and Apply (rebrowse), or copy the method, set the arguments, delete the old one
|
||||
and add the copy. Running a method needs a CI Server object (IM 36K10L45 5th ed. §10.6; skill
|
||||
`data-access`, `opcua-client.md` §7).
|
||||
|
||||
**Observed on R1.03 (2026-10-01)**: in the point form's browse, picking the item itself
|
||||
(`Objects/<section>/…/<item>`) stores the item **object** (`{"nsid":"<n>"}`), which has no
|
||||
value: *Last value*/*Data type* stay empty and the point is never monitored (revised sampling
|
||||
interval 0, item status 13). Expanding the item and picking its `Value` node works
|
||||
|
|
@ -46,26 +57,59 @@ interval 0, item status 13). Expanding the item and picking its `Value` node wor
|
|||
STRING). The form also fills `OPC_DISPLAY_NAME` and `OPC_TAG_INFO` (browse bookkeeping;
|
||||
not needed for quick load). ISS-033.
|
||||
|
||||
## 3. Certificates (§2.2)
|
||||
## 3. Certificates (§2.2, §2.3)
|
||||
|
||||
*OPC UA Client → Certificates*: **Trusted**, **Rejected** (server certificates arrive here),
|
||||
**Own certificate**. Trust = open the rejected certificate, tick *Trusted*, Apply; reject =
|
||||
untick. Restart the Engineering Module to refresh the folders. *Modify* the own certificate
|
||||
(name, organisation, country, domain or IP, RSA key strength, signature algorithm, validity).
|
||||
|
||||
**CI Server OPC UA client ↔ CI Server OPC UA server (§2.2.6)**: trust the server certificate
|
||||
New in R1.05 (§2.2): the client warns in the Historical Alarm Overview and the UMH message log
|
||||
when its own or the server's certificate is about to expire (lead time = hidden
|
||||
`OPXC_CERT_EXP_PERIOD_WARN`, 2 months in the installed `epauac_eqp.sup`, verified 2026-10-08).
|
||||
|
||||
**CI Server OPC UA client ↔ CI Server OPC UA server (§2.3)**: trust the server certificate
|
||||
on the client; copy the client's own certificate
|
||||
(`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs`) to the server's
|
||||
`…\pki\opxuas\pkiserver\trusted\certs`; the manual also asks to tick *Use CI Server entity names
|
||||
for nodeids* in `opxuas.sup` and restart the server. On the test system the loopback worked
|
||||
**without** that option, using `itnm` node IDs (ISS-032).
|
||||
for nodeids* in `opxuas.sup` and restart the server. On the R1.03 test system the loopback
|
||||
worked **without** that option, using `itnm` node IDs (ISS-032).
|
||||
|
||||
## 4. OPC UA PubSub (§3)
|
||||
## 4. OPC UA Information Model Mapper (ch. 3, App. 1; new in R1.05)
|
||||
|
||||
From docs; installed parts verified on R1.05 (2026-10-08): dataset `UASERVER_MAPPER_DF`,
|
||||
`%TLS_WAP_PATH%\cfg\tools\uamapper\` with libraries `UAMapperLibrary_MDIS`, `_None`,
|
||||
`_Use_model`.
|
||||
|
||||
- Purpose: publish CI Server data under a standard OPC UA information model (NodeSet file, e.g.
|
||||
MDIS or PA-DIM) instead of, or next to, the native CI Server model (server side:
|
||||
`IM36K10L45-01EN.md` §7).
|
||||
- Rights: `UA_MAPPER_PROJECT_INSERT`, `_MODIFY`, `_DELETE` (already in `SYSTEM_MANAGER`).
|
||||
- Workflow (*Tools › OPC UA Information Model Mapper*): **New Mapping** (folder
|
||||
`%TLS_WAP_PATH%\cfg\tools\uamapper\mapperprojects\<name>`) → **Configure**: NodeSet file (base
|
||||
models in the same folder) and optional library template → **Edit Rules**: per OPC UA object
|
||||
type a selection query on CI Server objects or sections (`CLASSNAME = …`, `SECTIONNAME = …`;
|
||||
SQL keywords in App. 1), then methods → class names, variables → tag names, events → item or
|
||||
external alarm names → **Build** (results can be exported to / imported from CSV;
|
||||
`MappingReport.txt`) → **Load** to an OPC UA server process. Removing a mapping does not
|
||||
unload it from the server (§3.4.6).
|
||||
- Rule-based mapping needs consistent naming or class/object engineering; otherwise map by CSV.
|
||||
In enterprise engineering, map on each CI Core. The manual advises trying a mapping on an
|
||||
extra OPC UA server instance first (§3.4; instance procedure in `IM36K10L45-01EN.md` §7,
|
||||
`<instance>_ServerConfig.xml` in `%TLS_SAV_PATH%`).
|
||||
- Dataset `UASERVER_MAPPER_DF`: `NAME`, `DESCRIPTION`, `UA_NAMESPACE`, `UA_MODEL_FILE`,
|
||||
`LIBRARY_NAME`, `MAPPING_FILE`, `TARGET_UA_SERVER`, `PROJECT_STATE` (INIT, CONFIGURED,
|
||||
MAPPED, DEPLOYED).
|
||||
|
||||
## 5. OPC UA PubSub (ch. 4)
|
||||
|
||||
UDP publish/subscribe of Data Access values from the CI Server OPC UA server address space
|
||||
(OPC visible items). Objects: line (needs its own copy of `ServerConfig.xml` named for the
|
||||
instance), published datasets, station, writer groups + dataset writers (publisher), reader
|
||||
groups + dataset readers (subscriber), then *Upload dataset configurations to runtime*.
|
||||
Limits per line: 4 stations, 8 writer groups, 8 reader groups, 32 dataset writers, 32 dataset
|
||||
readers, 32 published datasets. Status mapping as for the server (NORMAL → Good; NOT_INIT,
|
||||
UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE → Bad). Not practiced (needs a PubSub peer).
|
||||
(OPC visible items). Needs `OPXUAS_ENABLE_EXTENDED_FUNC = YES` since R1.04
|
||||
(`IM36K10L45-01EN.md` §7). Objects: line, published datasets, station, writer groups + dataset
|
||||
writers (publisher), reader groups + dataset readers (subscriber), then *Upload dataset
|
||||
configurations to runtime*. Each extra PubSub line needs its own OPC UA server instance named
|
||||
like the line's server name (own `<instance>_ServerConfig.xml`, which R1.05 keeps in
|
||||
`%TLS_SAV_PATH%` — R1.03: `tls\exe`; ISS-081). Limits per line: 4 stations, 8 writer groups,
|
||||
8 reader groups, 32 dataset writers, 32 dataset readers, 32 published datasets. Status mapping
|
||||
as for the server (NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE →
|
||||
Bad). Not practiced (needs a PubSub peer).
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
---
|
||||
manual: IM 36K10L40-01EN
|
||||
title: EQUIPMENT Service Engineering - Utilities
|
||||
edition: 3rd Edition, Sep. 2023
|
||||
version: R1.03
|
||||
status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the test system (2026-09-30)
|
||||
edition: 4th Edition, Feb. 2026 (R1.05); content unchanged since the 3rd Edition, Sep. 2023 (R1.03): the revision table lists contact information only
|
||||
version: R1.05 (first written for R1.03)
|
||||
status: from docs; installed programs, setup file and start scripts checked, eqpdbg "Get main info" run read-only on the R1.03 test system (2026-09-30); on the R1.05 test server files and tool menus checked read-only (2026-10-08); eqpdbg "Get main info" run read-only on R1.05 too (2026-10-08); EQT tools not tested (no EQT line)
|
||||
---
|
||||
|
||||
# EQUIPMENT Service Engineering - Utilities (R1.03)
|
||||
# EQUIPMENT Service Engineering - Utilities (R1.05)
|
||||
|
||||
Three utilities of the EQUIPMENT Service (the equipment managers `eqp<type>` that talk to
|
||||
stations). Section numbers refer to the manual.
|
||||
|
|
@ -37,6 +37,13 @@ normally read hourly.
|
|||
1220 Fisher ROC, 1316 HexRepeater, 1636 IEC 61850.
|
||||
- Scan rate number: the points' scan interval in ms, or the driver's internal rate number.
|
||||
5. Restart CI Server (or the `EQPFRCSCN` process).
|
||||
|
||||
**R1.04 and later:** IEC 61850 (and IEC 104) lines run under an EQT manager, which
|
||||
`eqpfrcscn` does not reach. The forced scan for them is `eqtfrcscn`: its template
|
||||
`tls\tpl\eqtfrcscn.tpl` has the same `FORCE` / `FCX_EVENT` / `queue_size` keywords and I/O type
|
||||
list, with the EQT node and process as arguments. R1.05 installs no `eqtfrcscn.sup`; an
|
||||
`eqtfrcscn_start.cmd` in `tls\com` would start it, because `equipment_start.cmd` runs
|
||||
`eqt*start.cmd`. The manual does not describe it (ISS-078; checked from files only, not tested: no EQT line on the R1.05 test server).
|
||||
Example: a change of the trigger item makes 60 s points scan every 10 s for 600 s.
|
||||
Long scan intervals can let an RTU close its TCP socket; keep at least one faster item or
|
||||
lengthen the RTU's socket timeout.
|
||||
|
|
@ -52,6 +59,9 @@ sends, good answers, bad return code, timeouts, frame errors, bad CRC, retries,
|
|||
(`NAME` = `<DD-MON-YY hh:00>/<station>/<line>`), e.g. `CIENG_PLC` with `TIMESPAN` (seconds
|
||||
counted in that hour), `SENDS` and `GOODANS` 1560/1560. Only stations that actually sent requests
|
||||
appear; the first export (no communicating station) was empty (ISS-021). History type 4.
|
||||
R1.05 also installs `eqtiostat` for EQT managers, but its start line in `equipment_start.cmd`
|
||||
is commented out (checked 2026-10-08); whether IEC 104/61850 stations reach `STATION_STAT` is
|
||||
not checked.
|
||||
|
||||
## 3. Debugger: `eqpdbg` (§3)
|
||||
|
||||
|
|
@ -79,10 +89,28 @@ printf '1\n-1\n' | eqpdbg 0 EQPMDC
|
|||
|
||||
Test system: `eqpdbg 0 EQPMDC` main info showed line type 107, both lines attached, 100 ms
|
||||
scan interval, 2 slaves, 2 % line load.
|
||||
R1.05 test server (2026-10-08): same tool, prompts and output layout: line type 107, lines 0 and 1
|
||||
attached, 100 ms, ON_SCAN, 1 slave, criterion mask 0x000D, 0 % line load; `-1` exits.
|
||||
|
||||
## Installed on the test system
|
||||
**`eqtdbg`** (R1.04 and later) is the same debugger for EQT managers: default process `EQT`,
|
||||
same action numbers −2…23 (menu strings read from both programs on R1.05, 2026-10-08; not
|
||||
run). Use the line's equipment process name, e.g. `EQT850`. Not in the manual (ISS-078).
|
||||
|
||||
## Installed on the R1.03 test system
|
||||
|
||||
Many drivers `tls\exe\eqp<type>.exe` (e.g. `eqpmdc` Modbus, `eqpfcx` STARDOM, `eqpfam3` FA-M3,
|
||||
`eqp850` IEC 61850, `eqpdnp` DNP3); setup files `eqp*.sup` (e.g. `eqpmdc.sup`, `eqpmqtt.sup`,
|
||||
`eqpfrcscn.sup`); start scripts `eqpmdc_start.cmd`, `eqpmqtt_start.cmd`. Running managers:
|
||||
`eqpmdc`, `eqpmqtt`, `eqpiostat`.
|
||||
|
||||
## Installed on the R1.05 test server (2026-10-08)
|
||||
|
||||
Program and data under `C:\Yokogawa\CIServer`. `eqp104`, `eqp850` and `eqp850dmp` are gone;
|
||||
instead `eqt104`, `eqt850`, `eqt850dmp`, `eqtdbg`, `eqtfrcscn`, `eqtiostat`, `etaman` and the
|
||||
data servers `eta10464.dll` / `eta85064.dll`. Setup files `eqtini.sup` (licence only),
|
||||
`eta.sup` (protocols run by the EQT framework: `iec61850`, `iec104`), `eta104*.sup`,
|
||||
`eta850*.sup`, client file `eqt850.icd`; templates `eqtfrcscn.tpl`, `eqtini.tpl`.
|
||||
`equipment_start.cmd` starts `etaman` after `epaman` and runs `eqt*start.cmd`;
|
||||
`equipment_stop.cmd` stops `eta*` and `eqt*`. Running: `epaman`, `etaman`, `eqpmdc`,
|
||||
`eqpmqtt`, `eqpiostat`. Modbus files (`eqpmdc.sup`, `epamdc*.sup`, `eqpfrcscn.sup`/`.tpl`) are
|
||||
identical to R1.03.
|
||||
|
|
|
|||
|
|
@ -1,12 +1,12 @@
|
|||
---
|
||||
manual: IM 36K10L41-01EN
|
||||
title: EQUIPMENT Service Engineering - Configuration
|
||||
edition: 3rd Edition, Sep. 2023
|
||||
version: R1.03
|
||||
status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the test system (2026-09-30)
|
||||
edition: 5th Edition, Feb. 2026 (R1.05); first written from the 3rd Edition, Sep. 2023 (R1.03). Changed since: R1.04 §3.4.5/3.4.7/3.4.8, 3.12.2, 3.15, 3.32, 3.40, App. 1 new; R1.05 §3.32, App. 1.3, App. 1.4 new
|
||||
version: R1.05 (first written for R1.03)
|
||||
status: from docs; general parts (§1–3.5) and Modbus (§3.6–3.7) summarized in detail, other drivers as a table; Modbus datasets, eqpmdc.sup and save files checked read-only on the R1.03 test system (2026-09-30); R1.05 changes added from the 5th Edition and checked read-only on the R1.05 test server (2026-10-08): Modbus datasets and setup files identical to R1.03
|
||||
---
|
||||
|
||||
# EQUIPMENT Service Engineering - Configuration (R1.03)
|
||||
# EQUIPMENT Service Engineering - Configuration (R1.05)
|
||||
|
||||
How CI Server exchanges data with PLCs, RTUs and other systems: lines, stations, scan types,
|
||||
points and conversion types, then one chapter per protocol. Section numbers refer to the
|
||||
|
|
@ -19,7 +19,9 @@ manual. Utilities (forced scan, statistics, debugger): `IM36K10L40-01EN.md`.
|
|||
- One **plug-in per protocol**: an equipment manager process (e.g. `EQPMDC` for Modbus
|
||||
master), its setup file, shared libraries and datasets for line, station, scan type and point.
|
||||
- **Defining a line** copies the protocol's template setup file (e.g. `eqpmdc.sup`) and starts
|
||||
an equipment manager instance. The name is free but must start with `eqp`.
|
||||
an equipment manager instance. The name is free but must start with `eqp`; for IEC 60870-5-104 and IEC 61850 (R1.04
|
||||
and later) it starts with `eqt` (defaults `EQT104`, `EQT850`; §3.32.1, App. 1.3; for 104 the
|
||||
manual still says `eqp104`, ISS-076).
|
||||
- Each manager keeps two private save files in `%TLS_SAV_PATH%`: `<process>_MAIN.sav`
|
||||
(lines/stations) and `<process>_ITEM.sav` (points), only to start fast. Deleting them loses
|
||||
the runtime configuration; repair with `dsschk`. (Test system: `eqpmdc_main.sav`,
|
||||
|
|
@ -163,7 +165,7 @@ start file is enough (see L40 summary).
|
|||
| 3.12 | VNET | Vnet/IP | needs Vnet/IP set up (not on Windows 10 test PC) |
|
||||
| 3.13 | Host-Host Coupling (`EQPHHC`) | MDUR to another CI Core | read/write points of a remote CI Server |
|
||||
| 3.14 | FA-M3 | TCP/IP | |
|
||||
| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed |
|
||||
| 3.15 | MELSEC | EZSocket (TCP/IP, UDP, serial) | EZSocket must be installed: installer on the install media (`\Windows\EZSocketPcRedistributableInstaller`), run as administrator; fails if CI Server is not in the default location or its path has spaces (R1.04) |
|
||||
| 3.16 | DAQSTATION | TCP/IP | DX, CX, MW100, GX/GP/GM |
|
||||
| 3.17 | Beckhoff BK8100 | serial / terminal server | |
|
||||
| 3.18 | Allen Bradley PLC5 | DH+ via ControlLogix DHRIO, or DF1 serial/terminal server | BCC checksum only |
|
||||
|
|
@ -176,15 +178,59 @@ start file is enough (see L40 summary).
|
|||
| 3.25 | HART router | serial in, terminal server out | re-issues HART commands to a multiplexer |
|
||||
| 3.26 | Hex repeater | terminal server | RTU models in `hxr_model.sup` |
|
||||
| 3.27 | TIE 870-5 | serial | |
|
||||
| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | |
|
||||
| 3.32 | IEC 61850 | TCP/IP | scan reads; direct write and control models |
|
||||
| 3.28–3.31 | IEC 60870-5-101 / 102 / 103 / 104 | serial or TCP/IP (104: TCP/IP) | 104 on R1.04+: manager `EQT104`, template `eta104_eqt.sup` with an undocumented `quality_code_parsing` switch (ISS-076, ISS-077) |
|
||||
| 3.32 | IEC 61850 | TCP/IP | manager `EQT850` on R1.04+: polling or IEC 61850 reports, report control blocks; see below |
|
||||
| 3.33–3.34 | WITS level 0 slave / master (`EQPWITS`, `EQPWITSWR`) | serial / terminal server | drilling data |
|
||||
| 3.35 | STX-Bachmann | Modbus to STX PLC | event buffer extension |
|
||||
| 3.36 | DTS | Modbus TCP + (S)FTP WITSML | stores in history group `DTS_DATA`; `EQPDTSDBG` |
|
||||
| 3.37 | AC-Gateway | ASCII subset (BK, SI, FG, FS) | |
|
||||
| 3.38 | Bachmann | M1COM library | |
|
||||
| 3.39 | Omron FINS | UDP | CIO, WR, HR, AR, DM areas |
|
||||
| 3.40 | Beckhoff ADS | TwinCAT 3 router | |
|
||||
| 3.40 | Beckhoff ADS | TwinCAT 3 router | TwinCAT 3 Build 4024 or later (R1.04; was 3.1.4022.2) |
|
||||
|
||||
### 3.32 IEC 61850 on R1.04 and later
|
||||
|
||||
From docs (5th Edition §3.32) unless marked; installed files checked on the R1.05 test server
|
||||
(2026-10-08).
|
||||
- **Order:** line, setup file, stations, I/O points, then report control blocks. Give the IED
|
||||
engineer the client file `tls\sup\eqt850.icd` once per project (installed on R1.05). The
|
||||
manual names the client `EQP850` in one place and `EQT850` elsewhere (ISS-079).
|
||||
- **Station:** `DOMAIN_PREFIX` = logical-device name put in front of every I/O address (no
|
||||
"/"); default port 102. The old station field `REPORTS` is hidden on R1.05; on upgrade its
|
||||
content becomes report control blocks `RCB10`…`RCB50`.
|
||||
- **Points:** `IO_ADDRESS`, `TIMESTAMP_ADDRESS`, `QUALITY_ADDRESS` up to 139 characters
|
||||
(field length 140 on R1.05, 130 on R1.03). No prefix = polled; prefix `R:` = taken from a
|
||||
received report. All three addresses of a point must be in the same report data set, and
|
||||
`R:` addresses must be unique. Arrays as `[n]`, n 0–9999. Scan types Slow / Medium / Fast /
|
||||
Event; `DATA_TYPE` default Automatic.
|
||||
- **Quality:** bits 0–12 carry the IEC 61850 quality. With a control model, bits 13–31 of the
|
||||
item quality report Select / Operate / Cancel, `stSeld`, AddCause and command termination
|
||||
(timeout `operTimeout`, default 60000 ms). A failed write to a report-sourced item sets BAD
|
||||
VALUE and sends a general interrogation to all report control blocks of the station.
|
||||
- **Report control blocks, dataset `IEC61850_RCB_DF`** (new; fields checked on R1.05): `NAME`
|
||||
= `<station>:<rcb name>`, `STATION`, `RCB_NAME`, `DESCRIPTION`, `RCB_IO_ADDRESS` (required),
|
||||
`STANBY_RCB_BLOCKS`, `STANBY_RCB_IO_ADDRESS` (spelled this way), `CONNECTION_TIMEOUT` (default
|
||||
5000 ms), `IS_DYN_SETTABLE_OPTFLDS` (default 1; set optional fields dynamically only when the
|
||||
IED's SCL file allows it). Trigger options dchg, qchg, dupd, integrity, GI; `RptID` unique per
|
||||
block; the EntryID lets the client resume after a reconnect.
|
||||
- **Setup file `eqt850.sup`** (template `eta850_eqt.sup`, checked on R1.05): `crit` default
|
||||
`8D` (adds the quality criterion); new switch `select_oper_internal = Y|N` (default N; Y
|
||||
keeps the R1.03 behaviour of an internal Select).
|
||||
|
||||
## Appendix 1: upgrade precautions (R1.04 and later)
|
||||
|
||||
From docs (5th Edition App. 1.1–1.4).
|
||||
- **From R1.03 with IEC 61850 configured:** the line's process name changes automatically from
|
||||
`EQP…` to `EQT…`, but the instance setup file is not renamed: rename `eqp850.sup` to
|
||||
`eqt850.sup` and merge it with the new template `eta850_eqt.sup` (old `epa850_eqp.sup`); rename
|
||||
and edit `tls\com\eqp850_start.cmd` / `_stop.cmd` to `eqt850_*` with `eqt850.exe` / `EQT850`.
|
||||
This can be done by hand or with `%TLS_ROOT_PATH%\tls\com\jupgutl` (log in
|
||||
`%TLS_LOG_PATH%\jmrg\`); it is not needed when *Automatic upgrade CI Server configuration* was
|
||||
chosen during setup.
|
||||
- No precautions for R1.01→R1.02, R1.02→R1.03 or R1.04→R1.05. IEC 104 is not mentioned
|
||||
(ISS-076).
|
||||
- §3.4.5, 3.4.7, 3.4.8 (STARDOM FCX, VNET and CENTUM status words) were rewritten as tables of
|
||||
item statuses; the mapping did not change.
|
||||
|
||||
## Test system (read-only, 2026-09-30)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,17 +1,19 @@
|
|||
---
|
||||
manual: IM 36K10L45-01EN
|
||||
title: Data Access Engineering
|
||||
edition: 3rd Edition, Sep. 2023
|
||||
version: R1.03
|
||||
status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs
|
||||
edition: 5th Edition, Feb. 2026 (R1.05); first summarised from the 3rd Edition, Sep. 2023 (R1.03)
|
||||
version: R1.05 (first written for R1.03)
|
||||
status: from docs. R1.03 (2026-10-01): installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA). R1.05 (2026-10-08, read-only on the test server): setup files (opxuas.sup, opxsys.sup, epauac_eqp.sup, opxuac_mon.sup, odbsrv.sup, dbc.sup, jrstsrv.sup, dssana.sup), ServerConfig.xml, PKI folders, processes, ports, data dictionary and dataset definitions compared with R1.03; loopback not re-run. ODBC not working on either system (ISS-008); OPC DA/A&E, RESTful API calls, methods and the imported information model from docs
|
||||
---
|
||||
|
||||
# Data Access Engineering (R1.03)
|
||||
# Data Access Engineering (R1.05)
|
||||
|
||||
ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC
|
||||
Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section
|
||||
numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on:
|
||||
skill `data-access`.
|
||||
ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), the
|
||||
**RESTful API** (R1.04+), **OPC Classic** (DA and A&E, client and server, DCOM) and **OPC UA**
|
||||
(client and server). Section numbers refer to the 5th edition. R1.04 inserted ch. 4 (RESTful
|
||||
API), so OPC chapters moved up by one compared with R1.03 (R1.03 §4–§10 = R1.05 §5–§11; in the
|
||||
OPC UA client chapter R1.03 §9.5–9.11 = R1.05 §10.7–10.13). Engineering Module forms:
|
||||
`IM36K10E20-01EN.md`. Hands-on: skill `data-access`.
|
||||
|
||||
## 1. ODBC (§1–§3)
|
||||
|
||||
|
|
@ -22,23 +24,26 @@ skill `data-access`.
|
|||
- `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate
|
||||
`%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`),
|
||||
`REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data
|
||||
(`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on).
|
||||
(`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on). Unchanged in R1.05
|
||||
(verified).
|
||||
- Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium
|
||||
(`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or
|
||||
`CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts.
|
||||
`CiSimbaClientDriver32`, server IP and port 1583. SimbaServer is installed and removed with
|
||||
CI Server (§3.2). Delete the DSN when ODBC is no longer used. Removing Simba parts from
|
||||
before R1.03 is now in App. 1.2.
|
||||
- SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`.
|
||||
- Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not
|
||||
running / port mismatch / BUS Service not reachable.
|
||||
|
||||
**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder
|
||||
`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
|
||||
**Installed (R1.03 and R1.05 test systems)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the
|
||||
folder `%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
|
||||
`odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx():
|
||||
SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited
|
||||
unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set
|
||||
`USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry
|
||||
defaults once (when `%TLS_DAT_PATH%\access.new` exists).
|
||||
|
||||
## 2. OPC Classic basics (§4)
|
||||
## 2. OPC Classic basics (§5)
|
||||
|
||||
DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A
|
||||
and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`).
|
||||
|
|
@ -51,7 +56,7 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
|
|||
- Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC
|
||||
visible* (and every parent section visible).
|
||||
|
||||
## 3. OPC DA client (§5)
|
||||
## 3. OPC DA client (§6)
|
||||
|
||||
- One client process per DA line (name given in the line), started/stopped with CI Server;
|
||||
stop one with `durstp -msk -t10 -p <client>`. Uses a save file in `%TLS_SAV_PATH%` named
|
||||
|
|
@ -59,22 +64,22 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
|
|||
- Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running,
|
||||
2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group
|
||||
status item: 1 active / 0 not active (items offline).
|
||||
- Setup (`<client>.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server
|
||||
DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING`
|
||||
(ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT`
|
||||
(100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`,
|
||||
`…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8),
|
||||
`…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
|
||||
- Setup (`<client>.sup`, else `opxsys.sup`; §6.3): `OPXDAC_SAFE_CON` (allow connecting to a
|
||||
CI Server DA server — **never to the own node or a DURM-connected node: deadlock**),
|
||||
`OPXDAC_PING` (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`,
|
||||
`…_HBEAT` (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`,
|
||||
`…_DISABLE_BROWSING`, `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default
|
||||
asks VT_R8), `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
|
||||
- Advice: one OPC server per client process (a DCOM time-out blocks the whole process).
|
||||
Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`,
|
||||
`POINT_DF` of one station made in the Engineering Module.
|
||||
- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS,
|
||||
DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm_<n>_udp.sup`,
|
||||
port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's
|
||||
setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon`
|
||||
node monitoring with *Set slave items offline when node unavailable*.
|
||||
- **DCOM tunnelling** (§6.6): run the client on a PC in the OPC server's domain (CI Server with
|
||||
BUS, DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR
|
||||
(`durm_<n>_udp.sup`, port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to
|
||||
host* on the client's setup file; on the host add the line with *Equipment node* = tunneller
|
||||
node. Use `intmon` node monitoring with *Set slave items offline when node unavailable*.
|
||||
|
||||
## 4. OPC DA server (§6)
|
||||
## 4. OPC DA server (§7)
|
||||
|
||||
- COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.<version>`, DUR name `OPXDAS`; started by
|
||||
COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown).
|
||||
|
|
@ -90,11 +95,11 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
|
|||
`secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for
|
||||
`opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT
|
||||
Security Tool is applied. Same account/password on both sides in a workgroup.
|
||||
- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
|
||||
- Troubleshooting (§7.9): `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
|
||||
`opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic),
|
||||
`regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first.
|
||||
|
||||
## 5. OPC A&E client and server (§7, §8)
|
||||
## 5. OPC A&E client and server (§8, §9)
|
||||
|
||||
- Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `<name>.sup` or `opxsys.sup`
|
||||
(`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`,
|
||||
|
|
@ -104,89 +109,162 @@ and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`op
|
|||
`…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the
|
||||
CI Server-specific event attributes (old/new value, quality, status, alarm state, item
|
||||
description, units, node, group, number, sub-number). Installed: all on.
|
||||
- Installed R1.05 only (verified 2026-10-08, not in the manual, ISS-085): `OPXAES_DIR_ALM`
|
||||
(YES) switches "Direct" alarm events of the A&E server.
|
||||
|
||||
## 6. OPC UA client (§9)
|
||||
## 6. OPC UA client (§10)
|
||||
|
||||
- OPC UA TCP only; security by X.509 certificates (application authentication), user
|
||||
anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256,
|
||||
Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
|
||||
- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in
|
||||
Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good,
|
||||
1 bad, 2 uncertain.
|
||||
- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other
|
||||
- Data types (§10.3.4, new in R1.04): Boolean → Boolean; SByte, Byte, Int16, UInt16, Int32,
|
||||
Integer → Integer; UInt32, Int64, UInt64, Float, Double, Number, UInteger, Duration → Real; String, ByteString,
|
||||
LocalizedText, DateTime / UtcTime (only `YYYY-MM-DDThh:mm:ss.sssZ`) → String of up to 250
|
||||
bytes; ExtensionObject only for EURange and EngineeringUnits; enumerations as Int32. Unsigned
|
||||
types take no negatives, 64-bit types no decimals. One array element per point (methods take
|
||||
no arrays). A failed conversion is logged and the item gets status Bad. OPC UA status →
|
||||
CI Server quality: 0 good, 1 bad, 2 uncertain.
|
||||
- A&C (§10.4): **only with `OPXC_ENABLE_EXTENDED_FUNC = YES`** in the client's setup file (R1.04+,
|
||||
default NO). External alarms from ConditionType and derived types (ALARM/NORMAL events), other
|
||||
events INFORMATIONAL; filters by event type, component, event node; severity → priority
|
||||
table (901–1000 → 1 … 1–100 → 15), per station; don't manage
|
||||
NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled.
|
||||
- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold
|
||||
backup with two endpoints (*Active server item* 0/1/2).
|
||||
- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11
|
||||
characters), station (= session), subscription, point (= monitored item), alarm component /
|
||||
event type filter / event node / template settings, method.
|
||||
- Certificates: the client process creates `<host>_<PROCESS>.der` in
|
||||
table (901–1000 → 1 … 1–100 → 15), per station; don't manage NonExclusiveLimitAlarmType.
|
||||
- Model change events (§10.5, R1.04): `GeneralModelChangeEvent` is handled per change type —
|
||||
node/reference added: the affected points are recreated; node/reference deleted: the linked
|
||||
items go offline and external alarms get a ConditionRefresh; data type changed: nothing.
|
||||
`BaseModelChangeEvent` (no detail; recreate all points and event nodes) only with
|
||||
`OPXC_BASE_MODEL_CHANGE_EVENT = YES` (default NO). Bursts within 10 s are handled once,
|
||||
handling waits during alarm floods, and the server must support Read and Browse.
|
||||
- Methods (§10.6, R1.04): a CI Server object per method with attribute `MTD_KEY` and signals
|
||||
`MTD_TRG`, `MTD_RET`, `MTD_IN_ARG_n`, `MTD_OUT_ARG_n` (≤ 10 each; sample Java class
|
||||
`UAC_MTD_JBASE`); a method record per station and one point (namespace and node ID
|
||||
`CIX_UAC_MTD`, Input + Output) connected to `MTD_TRG`; symbol/display (demo
|
||||
`AOG_UAC_Method_Demo`). Dataset `OPCUAC_METHOD_CALL2_DF` (R1.03: `OPCUAC_METHOD_CALL_IN_DF` /
|
||||
`…_OUT_DF`, removed). Procedure: skill `data-access`, `opcua-client.md` §7.
|
||||
- Redundancy (§10.7): no client redundancy (use HAC); servers: transparent, or non-transparent
|
||||
cold backup with two endpoints (*Active server item* 0/1/2).
|
||||
- Engineering objects (§10.9): line (starts a client process; **name must start with `OPX`**,
|
||||
max 11 characters), station (= session), subscription, point (= monitored item), alarm
|
||||
component / event type filter / event node / template settings, method. The station's
|
||||
communication status item is called Boolean in §10.9.2, but IM 36K10E20 4th ed. lists states
|
||||
0–5 (ISS-080).
|
||||
- Certificates (§10.9.10): the client process creates `<host>_<PROCESS>.der` in
|
||||
`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset
|
||||
`OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be
|
||||
trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`,
|
||||
`rejected` added by CI Server. The server must trust the client's certificate too.
|
||||
- Setup (`<process>.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats,
|
||||
buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed
|
||||
retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and
|
||||
session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
|
||||
- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`
|
||||
(+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server
|
||||
(filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`).
|
||||
`OPCUAC_PKI_CERTIFICATES_DF`; verified on R1.03 and R1.05); server certificates arrive in
|
||||
`…\pkiclient\rejected` and must be trusted (Engineering Module, or move to
|
||||
`…\pkiclient\trusted\certs`); folders `deleted`, `rejected` added by CI Server. The server
|
||||
must trust the client's certificate too. Expiry warnings: see `IM36K10E20-01EN.md` §3.
|
||||
- Setup (§10.11; `<process>.sup`, else the template **`epauac_eqp.sup`** — the R1.03 edition
|
||||
named `opxuac.sup`, which is not installed on R1.03 or R1.05, ISS-084): `OPXC_DUR_QUEUE_SIZE`
|
||||
(10000 kB), heartbeats, buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s),
|
||||
`OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed retries every ~35 s on R1.03),
|
||||
`OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and session time-outs,
|
||||
`OPXC_SERVICE_COMPLIANCE`, and new in R1.04 `OPXC_BASE_MODEL_CHANGE_EVENT`,
|
||||
`OPXC_ENABLE_EXTENDED_FUNC` (both NO). Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
|
||||
- **Installed R1.05 `epauac_eqp.sup`** (verified 2026-10-08, ISS-083):
|
||||
`OPXC_SERVICE_CALL_TIME_OUT = 60` (manual default 10 s); undocumented `OPXC_DISABLE_SAV_FILE`
|
||||
(NO), `OPXC_ALARM_TIME_ATTRIBUTE` (tab *Alarm Time*), hidden `OPXC_CERT_EXP_PERIOD_WARN`
|
||||
(2 months). `opxuac_mon.sup` is unchanged from R1.03 (none of the new keywords).
|
||||
- Quick load (§10.12–10.13): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`,
|
||||
`…_POINT_DF` (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected
|
||||
server (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`; R1.05 adds `REBROWSE` and
|
||||
`READ_NODE_INFO`). Line, station, subscription and point definitions are identical in R1.03
|
||||
and R1.05 (verified).
|
||||
- Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`.
|
||||
- Upgrade from R1.03 (App. 1.3): set `OPXC_ENABLE_EXTENDED_FUNC` if A&C was used; methods
|
||||
driven by dataset field updates no longer work — rebuild classes (`MTD_*`, extended reset),
|
||||
symbols and displays, and re-save methods with String or Boolean input arguments. App. 1.4
|
||||
(R1.05): one class name per method object.
|
||||
|
||||
## 7. OPC UA server (§10)
|
||||
## 7. OPC UA server (§11)
|
||||
|
||||
- Since R1.04 the server offers only Data Access and methods by default. **Alarms &
|
||||
Conditions, HistoryRead and PubSub need `OPXUAS_ENABLE_EXTENDED_FUNC = YES`** in `opxuas.sup`
|
||||
(ch. 11 intro, §11.6.2; installed default NO, verified on R1.05). An upgrade with the
|
||||
automatic configuration merge sets it; otherwise set it by hand if these were used
|
||||
(App. 1.3).
|
||||
- Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p
|
||||
opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log`
|
||||
and `OpxUas_Sdk*.log`.
|
||||
- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read
|
||||
values, browse into the item) and **Write** (write values, alarm methods). Parent sections must
|
||||
be visible. Without Read the item is listed but browsing into it fails
|
||||
(`UncertainNotAllNodesAvailable`).
|
||||
- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ`
|
||||
(browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
|
||||
- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`,
|
||||
`…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`,
|
||||
`Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in
|
||||
`http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections,
|
||||
items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing;
|
||||
the manual does not name it, ISS-032).
|
||||
- Visible data (§11.1.4): sections, objects, items with *OPC visible*; items also need **Read**
|
||||
(read values, browse into the item) and **Write** (write values, alarm methods). Parent
|
||||
sections must be visible. Without Read the item is listed but browsing into it fails
|
||||
(`UncertainNotAllNodesAvailable`). External alarms: OPC visible / read / write / manual reset
|
||||
in the station's alarm template settings.
|
||||
- Users (§11.1.5–11.1.6): anonymous = like `OPC_UA_SERVER_READ`; authorisation actions
|
||||
`OPC_UA_SERVER_READ` (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
|
||||
Anonymous access is governed by the `dssana.sup` user interface "Anonymous Via OPC UA
|
||||
Server" (`OPXUASANY`): installed default (R1.03 and R1.05) is no login with profile
|
||||
`CI_NO_LOGIN_OPCUAS` for local clients and *Manual CI Server* for remote clients. With AD
|
||||
integration, "Via OPC UA Server" + *Automatic* needs no AD password.
|
||||
- Address space (§11.3, now called the **native information model**): `Objects` → sections
|
||||
(folders) → objects → items (`CIItemNumericType`, `…BooleanType`, `…StringType`,
|
||||
`…NumericSubType`) with child nodes such as `Value`, `Status`, `Blocked`, `Offline`, `HMIInfo`,
|
||||
and alarm condition nodes. Types are in `http://www.yokogawa.com/CI_Server/` (ns 3 in the
|
||||
manual). **CI Server entities (sections, items) are in namespace
|
||||
`urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing on R1.03; the manual does not
|
||||
name it, ISS-032).
|
||||
- NodeIds are JSON strings: `{"nsid":"<namespace id>"}` for the entity,
|
||||
`{"0":"Value","nsid":"<n>"}` for its value; or by name: `{"0":"Value","itnm":"<item>"}`
|
||||
(case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`.
|
||||
`OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
|
||||
(case sensitive; verified on R1.03). The `nsid` changes when the item is recreated — prefer
|
||||
`itnm`. `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
|
||||
- Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH →
|
||||
BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority →
|
||||
severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03).
|
||||
- History: items in a history group show HistoryRead; max 5000 values per node per call.
|
||||
- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal);
|
||||
external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM.
|
||||
- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
|
||||
severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (since R1.03).
|
||||
- History (§11.3.3; extended functions): items in a history group show HistoryRead; max 5000
|
||||
values per node per call.
|
||||
- Alarm methods (extended functions): Acknowledge, Confirm (= acknowledge), Disable/Enable
|
||||
(force to normal); external alarms Acknowledge/Confirm passed to the source;
|
||||
`CIManualReset` for CENTUM.
|
||||
- **Imported information model (§11.4, new in R1.05)**: a standard NodeSet file (UANodeSet 1.05
|
||||
schema) is mapped to CI Server entities with the OPC UA Information Model Mapper
|
||||
(`IM36K10E20-01EN.md` §4) and loaded as `%TLS_DAT_PATH%\<queue>_<NodeSet file>.xml` (one per
|
||||
server process, reloaded at server start). Mapping: section/object → Object; method object
|
||||
(`MTD_*` class; sample `UAS_MTD_JBASE`) → Method; item/sub-item → Variable; item alarm or
|
||||
external alarm → Event. OPC visible / Read / Write still apply. Once loaded, the native model
|
||||
is hidden unless `OPXUAS_ENABLE_OWN_MODEL_TREE` (manual name `…_NATIVE_MODEL_TREE`) is YES.
|
||||
Variables: no arrays, basic types only; out-of-range values give `BadOutOfRange` (item
|
||||
status unchanged). Method calls return OPC UA status codes (e.g. `BadUserAccessDenied`,
|
||||
`BadNotExecutable` when the item is blocked or the object not OPC visible). Rights:
|
||||
`UA_MAPPER_PROJECT_INSERT` / `_MODIFY` / `_DELETE` (in `SYSTEM_MANAGER`), dataset
|
||||
`UASERVER_MAPPER_DF`.
|
||||
- `opxuas.sup` (§11.6): General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
|
||||
(`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`,
|
||||
`…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`,
|
||||
`…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` =
|
||||
ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE`
|
||||
(manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034).
|
||||
- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list
|
||||
`…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first
|
||||
rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256,
|
||||
`…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000, and new
|
||||
`…_ENABLE_NATIVE_MODEL_TREE`, `…_ENABLE_EXTENDED_FUNC`), Alarm settings (`EVENTS` = ALARM,
|
||||
ACKN, DEACT, INFO), Logging. `OPXUAS_MODEL_CHANGE_EVENTS` now needs the extended functions;
|
||||
it sends BaseModelChangeEvents (also on NodeSet load/unload) and GeneralModelChangeEvents for
|
||||
root-level entities — deeper levels need an item `NodeVersion` (or `<process>_NodeVersion`,
|
||||
OPC visible + Read) at that level.
|
||||
- **Installed keyword names differ** (verified R1.03 and R1.05): `OPXUAS_DYNAMIC_SCANRATE`
|
||||
(manual `…_USE_DYNAMIC_SCANRATE`), extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034); R1.05:
|
||||
`OPXUAS_ENABLE_OWN_MODEL_TREE` (manual `…_NATIVE_MODEL_TREE`) and hidden
|
||||
`OPXUAS_METHOD_TIMEOUT_MARGIN` (10000 ms) (ISS-082).
|
||||
- `ServerConfig.xml` (§11.7): the manual still gives `%TLS_ROOT_PATH%\tls\exe`; **installed
|
||||
R1.05 has it only in `%TLS_SAV_PATH%`** (R1.03: `tls\exe`; ISS-081). Endpoint
|
||||
`opc.tcp://[NodeName]:34493`; trust list `…\pki\opxuas\pkiserver\trusted\certs`, rejected
|
||||
`…\pkiserver\rejected` (created at the first rejection), own certificate
|
||||
`ciserveruaserver.der`. **Installed (R1.03 and R1.05)**: only Basic256Sha256,
|
||||
Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint);
|
||||
anonymous, user/password **and certificate** user tokens enabled (manual: certificate off,
|
||||
ISS-034); `AutomaticallyTrustAllClientCertificates` false.
|
||||
- First connection of any client: trust the server certificate on the client, then move the
|
||||
client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
|
||||
ISS-034); `AutomaticallyTrustAllClientCertificates` false. The R1.05 file adds SDK sections
|
||||
(role configuration, user/password management, PubSub settings).
|
||||
- First connection of any client (§11.1.6): trust the server certificate on the client, then
|
||||
move the client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
|
||||
suggested test client.
|
||||
- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate
|
||||
management (concepts only).
|
||||
- Extra server instances (for PubSub lines or to test an information model): copy
|
||||
`ServerConfig.xml` to `<instance>_ServerConfig.xml` with another port, copy `opxuas.sup` to
|
||||
`<instance>.sup`, add a start line in `access_start.cmd`; instance names start with `OPX`
|
||||
(IM 36K10E20 4th ed. §3.4).
|
||||
- Discovery (§11.8): LDS on 4840 only when several servers are on a host; GDS for central
|
||||
certificate management (concepts only).
|
||||
|
||||
## 8. RDBMS data exposure (not in this manual)
|
||||
|
||||
IM 36K10L45 does not describe RDBMS data exposure; it is in the Tutorial (IM 36K10G10 ch. 10)
|
||||
and the item form (IM 36K10C10 §3.3). Summary here because it is an ACCESS-type interface;
|
||||
**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical).
|
||||
Procedure: skill `data-access`, task `rdbms-exposure.md`.
|
||||
**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical;
|
||||
R1.05 files re-checked 2026-10-08). Procedure: skill `data-access`, task `rdbms-exposure.md`.
|
||||
|
||||
- Processes `DBCSND` (sender, subscribes to DSS data) and `DBCDEM` (receiver, writes to MS SQL
|
||||
Server via ODBC); setup file `dbc.sup` (sender and receiver tabs; connection string
|
||||
|
|
@ -201,3 +279,29 @@ Procedure: skill `data-access`, task `rdbms-exposure.md`.
|
|||
log disagree (ISS-058).
|
||||
- The CI Service account `.\CIX_PROCESS` is local, so a remote SQL Server needs a SQL login and
|
||||
mixed mode (ISS-059).
|
||||
|
||||
## 9. RESTful API (§4, new in R1.04)
|
||||
|
||||
From docs; port 34597 listening and the `jrstsrv.sup` keywords verified on R1.05 (2026-10-08).
|
||||
No request was sent.
|
||||
|
||||
- HTTPS server installed with CI Server and started/stopped by ACCESS Service, on a CI Core or
|
||||
on a CI Portal (reaching the core over MDUR). Not supported by CI View, Remote Connect or
|
||||
enterprise setups. Nothing to install on the client.
|
||||
- Authentication: HTTP Basic (CI Server user) plus an API key sent in the `x-api-key` header.
|
||||
Keys are made in the Engineering Module (*Authorisation › Users*, *Add API Key*, type RESTful
|
||||
API), one per user; stored in dataset `API_KEYS_DF`.
|
||||
- `jrstsrv.sup` (§4.2.1): `JRST_MAX_RECORDS` (records per reply, default 100),
|
||||
`JRST_USE_TWO_WAY_SSL` (default off: client trusts the server's self-signed certificate in
|
||||
`%TLS_ALLUSERS_PATH%\pki\jrstsrv\keystore`), `JRST_READ_ONLY_MODE` (default on),
|
||||
`JRST_NETWORK_PORT` (34597), `JRST_USER_CACHE_TIME` (600 s, must be > 0),
|
||||
`JRST_CUSTOM_DATASETS` (user datasets with read/write rights).
|
||||
- Requests (§4.3.2): `https://<host>:34597/jrest/v2/<entity type>/<function>` with OData
|
||||
options `$filter`, `$select`, `$top`, `$skip`; replies are OData JSON. Entity sets `Tags`,
|
||||
`EventCategories`, `EventRecords`. Functions: `GetHistory` (one tag, ISO 8601 times, sample
|
||||
interval in s; highest-priority history group), `GetHistoryMultiTag` (≤ 5 tags),
|
||||
`GetEventHistory`, `GetAuditInfo`, `GetCurrentAlarms`, `AcknowledgeAlarms` (several per
|
||||
request), `UpdateItems` (value, optional quality and status — status must match
|
||||
`STATUS_DF.NAME`), `ReadDataset` and `Dataset` (PUT/PATCH/DELETE on custom datasets).
|
||||
- Status codes (§4.3.3): 200, 204, 400 (bad URL or no data), 401 (rights or credentials), 404,
|
||||
405, 500, 503.
|
||||
|
|
|
|||
|
|
@ -40,25 +40,31 @@ and its row here is updated.
|
|||
|
||||
**R1.05 status:** not started · manual diff read · re-checked (read-only) · re-tested · done
|
||||
|
||||
Two labels for checks Claude cannot do (details and steps in
|
||||
[`r105-verification.md`](r105-verification.md)): **not tested** = the function is not
|
||||
available on the R1.05 test server (reason given); **awaiting user verification** = Claude
|
||||
prepared the step and the user runs it on the server or in the GUI and sends the output or a
|
||||
screenshot.
|
||||
|
||||
| Skill / area | Manual changes after R1.03 | R1.05 status | Notes |
|
||||
|---|---|---|---|
|
||||
| `system-check` | — | re-checked (read-only) | Version, paths, service, node, time on the R1.05 test server 2026-10-08. Start/stop not repeated (shared server). |
|
||||
| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | manual diff read | |
|
||||
| `data-access` | L45, E20 (large: OPC UA methods, information model mapper, certificate expiry), L50 dataset rename | manual diff read | |
|
||||
| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | manual diff read | |
|
||||
| `installation-security` | C10, C30 (large: IT security 3.0, LAPS, upgrade merge `jupgutl`, PRM) | re-checked (read-only) | 2026-10-08: skill, summaries and `tools/setup_check.ps1` updated to R1.05. Setup check run by hand on the R1.05 test server. Script run there too (12 OK, 5 CHECK, 20 DIFF; firewall check fixed). **Not tested:** IT security 2.0/3.0, LAPS, Vnet/IP, upgrade merge, PRM (not available there). ISS-086–090. |
|
||||
| `data-access` | L45, E20 (large: REST API, OPC UA methods, information model mapper, certificate expiry, extended functions off by default), L50 dataset rename | re-checked (read-only) | 2026-10-08: skill and summaries updated, L45 section numbers remapped. Setup files, datasets, ports and certificates checked; Sample qli files unchanged. New form fields confirmed in the installed form definitions (V3); OPC UA loopback re-tested on R1.05 with the reduced sample load (V4, 2026-10-08), certificate exchange done by the user. **Not tested:** OPC A&E direct alarms, PubSub, imported information model. ISS-080–085. |
|
||||
| `equipment` | L41 (IEC 61850, item status, App. 1); IEC 104/61850 drivers moved to `eqt`/`eta` | re-checked (read-only) | 2026-10-08: Modbus datasets, setup files and tools identical to R1.03; EQT family, IEC 61850 report control blocks and upgrade steps added. Sample qli files unchanged. `eqpdbg` main info run on R1.05 (V1); Modbus loopback re-tested on R1.05 with the reduced sample load (V4, 2026-10-08). **Not tested:** IEC 104 / IEC 61850 and the EQT tools (no device). ISS-076–079. |
|
||||
| pyTOOLS (new) | P40 new | not started | No skill yet. |
|
||||
| `graphics` | C50, C60, R30 (small) | manual diff read | |
|
||||
| `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | |
|
||||
| `history-management` | C40 §4.2 (REST API, pyTOOLS) | manual diff read | The REST API itself is described in skill `data-access` (L45 ch. 4); link to it from here. |
|
||||
| `portal-setup` | R10 §3.3 | manual diff read | |
|
||||
| `system-management` | J10 §2.9.1, L50 | manual diff read | |
|
||||
| `item-engineering` | C10 §2.2 | manual diff read | |
|
||||
| `alarm-management` | none | not started | |
|
||||
| `audit-trail` | none | not started | |
|
||||
| `authorization` | none (new `dss_ath_grp_u0104` loader) | not started | |
|
||||
| `class-object-engineering` | none | not started | |
|
||||
| `class-object-engineering` | none | not started | Sample classes `CIENG_INCR`, `CIENG_TANK` (traditional) and `CIENG_JFLOW` (Java) loaded and ran correctly on R1.05 (V4, 2026-10-08). |
|
||||
| `high-availability` | none | not started | |
|
||||
| `reporting` | none | not started | |
|
||||
| `examples/CI-Eng-Sample` | — | not started | Load on the shared server only with the user's approval. |
|
||||
| `examples/CI-Eng-Sample` | — | re-tested | Reduced load (no history group, user or layouts) loaded, tested and removed on the shared R1.05 server 2026-10-08 (V4); scripts in `shared\`. Full load not tested on R1.05. |
|
||||
|
||||
## Manuals, in working order
|
||||
|
||||
|
|
|
|||
102
knowledge/r105-verification.md
Normal file
102
knowledge/r105-verification.md
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
# R1.05 verification checklist
|
||||
|
||||
Two kinds of R1.05 checks are open after the read-only re-check of 2026-10-08:
|
||||
|
||||
- **Not tested:** the function is not available on the R1.05 test server, so it cannot be
|
||||
tested there at all. The content stays "from docs" and is marked **not tested** with the
|
||||
reason. Nothing to do until a suitable system exists.
|
||||
- **Awaiting user verification:** Claude could not run the step itself (refused as a remote
|
||||
command, needs an administrator, needs the GUI). Claude prepared the steps and expected
|
||||
results below; the user runs them on the server or in the GUI and sends the output or a
|
||||
screenshot, and Claude records the result in the task file and in `progress.md`.
|
||||
|
||||
All steps below are read-only: they open forms or print information and save nothing.
|
||||
Close every form with *Cancel*.
|
||||
|
||||
## Not tested on the R1.05 test server
|
||||
|
||||
| Area | Reason | Where marked |
|
||||
|---|---|---|
|
||||
| IT Security Tool (version 2.0 / 3.0), `CIX_` groups, `CTM_PROCESS`, LAPS, GPO import | Tool not installed; Windows Server 2025 is not supported by the tool | skill `installation-security`, C10/C30 summaries |
|
||||
| Vnet/IP drivers, VAGW Bossd | No Vnet/IP card; not supported on Server 2025 | skill `installation-security`, C10 summary |
|
||||
| Upgrade from R1.03/R1.04 with the automatic configuration merge (`jupgutl`, `-c` argument) | Fresh R1.05 install, no upgrade to observe; an upgrade test needs a separate machine | C10 summary, ISS-086 |
|
||||
| CI Server with PRM | No PRM | C10 summary, ISS-090 |
|
||||
| IEC 60870-5-104 and IEC 61850 (EQT managers, report control blocks, `eqtdbg`, `eqtfrcscn`) | No device and no EQT line on the server | skill `equipment`, L40/L41 summaries, ISS-076–079 |
|
||||
| OPC A&E `OPXAES_DIR_ALM`, OPC UA PubSub, imported information model | Needs another client/server or extra server instances | skill `data-access`, ISS-085 |
|
||||
|
||||
## Awaiting user verification
|
||||
|
||||
### V1. `eqpdbg` main info (skill `equipment`, L40 summary §3): **done 2026-10-08**
|
||||
|
||||
Run by Claude over ssh at the user's request; output as expected (recorded in the L40 summary).
|
||||
|
||||
On the R1.05 test server, in a normal command prompt:
|
||||
|
||||
```
|
||||
eqpdbg 0 EQPMDC
|
||||
```
|
||||
|
||||
Type `1` (Get main info), Enter, read the output, then `-1` (Exit). Expected: line type 107,
|
||||
the Modbus line(s) attached, scan interval (tick) in ms, number of slaves, line load %.
|
||||
Do not choose any other action number. Send a screenshot of the output.
|
||||
|
||||
### V2. Setup check script (skill `installation-security`, task `setup-check.md`): **done 2026-10-08**
|
||||
|
||||
Run by Claude (temporary copy, deleted afterwards): 12 OK, 5 CHECK, 20 DIFF after fixing the
|
||||
firewall check (see `setup-check.md`).
|
||||
|
||||
Copy `tools/setup_check.ps1` from this repo to a scratch folder on the server, run it in an
|
||||
**elevated** Windows PowerShell, then delete the copy:
|
||||
|
||||
```
|
||||
powershell -NoProfile -ExecutionPolicy Bypass -File setup_check.ps1
|
||||
```
|
||||
|
||||
Expected (from the one-by-one checks of 2026-10-08): CI Server 1.05.00 OK; Windows Server 2025
|
||||
Datacenter shown as not in the list; DIFF for firewall domain profile, Defender, automatic
|
||||
updates, defrag / component cleanup, page file, .NET 3.5, missing `CIX_` groups; CHECK lines
|
||||
for IT security. Send the result table (screenshot or text).
|
||||
|
||||
### V3. Engineering Module forms (skill `data-access`): **form definitions checked 2026-10-08**
|
||||
|
||||
Claude has no GUI access to the server. Checked instead in the installed form definitions
|
||||
(`tls\wap\cfg`): the main menu has the *OPC UA Information Model Mapper* action (dataset
|
||||
`UASERVER_MAPPER_DF`); each user in the project tree has *Add API key* (dataset `API_KEYS_DF`);
|
||||
the OPC UA client point form has `READ_NODE_INFO` and `REBROWSE`; the method form has node ID
|
||||
type, parent object node ID, manual argument fields and no process-area field. Screenshots of
|
||||
the open forms are optional.
|
||||
|
||||
In the Engineering Module on the server (log on as a user with engineering rights), open each
|
||||
form below, take a screenshot, and close it with *Cancel*:
|
||||
|
||||
1. *Tools › OPC UA Information Model Mapper*: the mapper window opens (shows *New Mapping*).
|
||||
2. *Authorisation › Users*, any user: the *Add API Key* function exists (do not create a key).
|
||||
3. An OPC UA client point form (*New* on an OPC UA station is enough to see it, then
|
||||
*Cancel*): the checkbox *Read additional node information* exists.
|
||||
4. An OPC UA client method form: fields for node ID type, *Options* tab (parent object node ID)
|
||||
and *Arguments* tab; no process-area field.
|
||||
|
||||
If no OPC UA client line exists on the server, steps 3–4 need one: skip them and say so.
|
||||
|
||||
### V4. CI-Eng-Sample on the R1.05 test server: **reduced load tested 2026-10-08**
|
||||
|
||||
The user approved a reduced load (no history group, no user `CIENG`, no layouts/displays) that
|
||||
is removed again afterwards. Scripts: `examples/CI-Eng-Sample/shared/`.
|
||||
|
||||
- Load: 0 errors in every step; R1.05 accepts the sample's `@VERSION 1.03.00` files.
|
||||
- Classes: `DEMO.COUNTER` counts (65 → 68 in 3 s); `TANK1.CALC.VOLUME` = 100 for level 50
|
||||
(traditional class); `TANK1.JFLOW.sPerMin` = 2 for inflow 120 (Java class); sub-item
|
||||
`TANK1.LEVEL.MAX` follows the level.
|
||||
- Modbus loopback (mirror started for the test only): setpoint 1234 → readback 1234,
|
||||
`PLC1.COMM_OK` = 1; `eqpdbg 0 EQPCIENG` slave info: `CIENG_PLC` ON_SCAN, line GOOD.
|
||||
- OPC UA loopback: after the two certificate moves done by the user, `UA.COMM_OK` = 1 (status
|
||||
5), `UA.SRV_STATE` = 0, `UA.LEVEL_COPY` followed `TANK1.LEVEL` (62.5). While the server still
|
||||
rejected the client, the Boolean status item showed 0 with status 4 (ISS-080).
|
||||
- Remove: 0 errors. Before/after snapshot: all datasets identical (count and name hash), no
|
||||
`CIENG*` record left. Left over and cleaned: 34 `dss_*.tmp` files in `tls\lst` (ISS-091),
|
||||
`OPXCIENG.log`, the temporary sample copy.
|
||||
- Certificates: the test's files (client own certificate `<host>_OPXCIENG.der/.pem`, the
|
||||
server certificate trusted in the client store, the client certificate trusted in the
|
||||
server store) and the `pkiserver\rejected` folder created by the test were deleted with the
|
||||
user's approval. `OPCUAC_PKI_CERTIFICATES_DF` went back from 3 to 1 record by itself: the
|
||||
dataset follows the certificate files. The server is back in its original state.
|
||||
|
|
@ -31,7 +31,7 @@ until they are re-checked.
|
|||
| IEC 60870-5-104 and IEC 61850 drivers | New driver family `eqt*` / `eta*`: `eqt104`, `eqt850`, `eqt850dmp`, `eqtdbg`, `eqtfrcscn`, `eqtiostat`, `etaman`, `eta104*.sup`, `eta850*.sup`, `eqtini.sup`, `eqt850.icd`, `eqtfrcscn.tpl`, `eqtini.tpl` | `eqp104`, `eqp850`, `eqp850dmp`, `epa104*.sup`, `epa850*.sup` (the drivers left the `eqp` EQUIPMENT family) |
|
||||
| IEC 61850 configuration | Quick load / form programs `iec61850_line_u0104`, `iec61850_station_u0104`, `iec61850_point_u0105`, `iec61850_rcb_u0105` | — |
|
||||
| OPC UA | `opcuac_method_u0104` (OPC UA client methods), `opcuac_station_u0104`, `opcaec_station_u0104` | `opcaec_station_u0103` |
|
||||
| REST API | `jrstsrv.jar`, `jrstsrv.sup`, `jrstsrv.tpl` (RESTful API server, see IM 36K10C40 §4.2) | — |
|
||||
| REST API | `jrstsrv.jar`, `jrstsrv.sup`, `jrstsrv.tpl` (RESTful API server on TCP 34597, IM 36K10L45 ch. 4; skill `data-access`) | — |
|
||||
| Upgrade | `jupgutl.cmd`, `jmrg.jar` (merge configuration files on upgrade, IM 36K01C10 ch. 3) | — |
|
||||
| Data access | `dacbackfill.cmd`, `intimpdac.exe` (OPC DA backfill; not yet investigated) | — |
|
||||
| Graphics | `connectrdp.cmd` (Edit Module *RDP Connect* action, IM 36K10C50 §2.31) | — |
|
||||
|
|
@ -56,7 +56,7 @@ the R1.04 and R1.05 revision tables.
|
|||
| IM 36K10L45 Data Access Engineering | R1.04: ch. 4 new, §10.3.4, 10.5, 10.6 new, setup-file parameters in §10.4, 10.9, 11, 11.5.2. R1.05: §11.4 new, §11.1.6 note, §11.6.2 setup file, App. 1.3 | `data-access` |
|
||||
| IM 36K10E20 OPC Interface | R1.04: parent object node ID and arguments of OPC UA methods. R1.05: certificate-expiry notifications, ch. 3 new *OPC UA Information Model Mapper* (map external OPC UA entities to CI Server), App. 1 SQL keywords | `data-access` |
|
||||
| IM 36K10L41 EQUIPMENT Configuration | R1.04: item status descriptions (§3.4.5–3.4.8), §3.12.2, §3.15, IEC 61850 functions (§3.32), App. 1 new (precautions on upgrade to R1.04). R1.05: §3.32, App. 1.3, App. 1.4 new | `equipment` |
|
||||
| IM 36K10L50 Data Set Service Engineering | R1.04: OPC UA client method dataset renamed `OPCUAC_METHOD_CALL_IN_DF` → `OPCUAC_METHOD_CALL2_DF` | `system-management`, `data-access` |
|
||||
| IM 36K10L50 Data Set Service Engineering | R1.04: OPC UA client method dataset renamed `OPCUAC_METHOD_CALL_IN_DF` → `OPCUAC_METHOD_CALL2_DF` (installed: `…CALL_IN_DF` and `…CALL_OUT_DF` both gone); new datasets `IEC61850_RCB_DF`, `UASERVER_MAPPER_DF`, `API_KEYS_DF` | `system-management`, `data-access` |
|
||||
| IM 36K10C40 Engineering Module – Historical | R1.04 §4.2: external access to history now lists ODBC, .NET API, **RESTful API**, **pyTOOLS** (C API no longer listed) | `history-management` |
|
||||
| IM 36K10C50 Edit Module | R1.04: §2.22 properties, §2.31 *Password Check* action, §4.12 update item/parameter. R1.05: §2.22, 2.25, 2.26, 2.33 properties, §2.31 *RDP Connect* action | `graphics` |
|
||||
| IM 36K10C60 Advanced Operating Graphics | R1.04 §1.2.2: demo displays | `graphics` |
|
||||
|
|
@ -67,17 +67,36 @@ the R1.04 and R1.05 revision tables.
|
|||
| IM 36K10G10 Tutorial | R1.04 §9.2, ch. 14 new. R1.05 ch. 14 extended, ch. 15 new | `knowledge/manuals/IM36K10G10-01EN.md` |
|
||||
| IM 36K10L55 Exchange Tool Engineering | R1.04: upgrade scenario for CI Exchange for CENTUM VP. R1.05 §2.7: HIS-TSE connection options | `knowledge/manuals/IM36K10L55-01EN.md` |
|
||||
|
||||
**No content change** (only contact information or wording): C20, C30, E10, E30, J20, J40,
|
||||
L10, L15, L20, L25, L30, L35, L36, L40, P10, P11, P20, P30, R20, R40. Skills based only on
|
||||
these manuals still need a quick re-test on R1.05 (installed files may differ), but their
|
||||
content is expected to hold.
|
||||
**Revision table lists only contact information:** C20, C30, E10, E30, J20, J40, L10, L15,
|
||||
L20, L25, L30, L35, L36, L40, P10, P11, P20, P30, R20, R40. The revision tables do not list
|
||||
every R1.04 edit, so each of these was also compared word by word with its R1.03 edition
|
||||
(`tools/manual_diff.py`, 2026-10-08). Result:
|
||||
|
||||
| Manual | Unlisted changes found by the text diff |
|
||||
|---|---|
|
||||
| E10 Excel Add-in | Item search: new description of the *Item Filter* / *Description Filter* boxes and wildcards (`*` default; both filters combine with AND); a CI Portal SSL note moved |
|
||||
| E30 Alarm System Performance Analysis | KPI grid: the KPI charts now have labels (*In Time*, *Too Late*, *Not Ackn*, *Nuisance*) |
|
||||
| L30 BUS Service | `durwfp` return value reworded (1 = process attached/running, 0 = otherwise); same meaning |
|
||||
| P11 Java class language | §10.2 methods reworded; same meaning |
|
||||
| P20 RQL | Footer `<position>` sentence split in two; same meaning |
|
||||
| L40, R20, R40, C30, L35, J40 | Spacing, punctuation, titles only |
|
||||
| C20, J20, L10, L15, L20, L25, L36, P10, P30 | None |
|
||||
|
||||
Skills based only on these manuals still need a quick re-test on R1.05 (installed files may
|
||||
differ), but their content is expected to hold. The E10 and E30 changes go into the
|
||||
`reporting` and `alarm-management` re-checks.
|
||||
|
||||
**Method for every manual re-check:** do not rely on the revision table or the release notes.
|
||||
Run `python tools/manual_diff.py <R1.03 doc\EN> <R1.05 doc\EN> <IM>` and review every change,
|
||||
including those made in R1.04.
|
||||
|
||||
## 3. Re-check plan
|
||||
|
||||
Order (biggest change first), tracked in `progress.md` under *R1.05 re-check*:
|
||||
|
||||
1. `system-check` (paths, version string): done in the baseline.
|
||||
2. `installation-security`, `data-access`, `equipment`: real manual changes.
|
||||
2. `installation-security`, `data-access`, `equipment`: real manual changes. Re-checked read-only 2026-10-08
|
||||
(ISS-076–090). IM 36K10L45 section numbers moved by one chapter from ch. 4 on (new ch. 4 REST API).
|
||||
3. New pyTOOLS manual (P40) and the REST API.
|
||||
4. `graphics`, `history-management`, `portal-setup`, `system-management`.
|
||||
5. All other skills: re-test the task files on R1.05, no manual change expected.
|
||||
|
|
|
|||
71
tools/manual_diff.py
Normal file
71
tools/manual_diff.py
Normal file
|
|
@ -0,0 +1,71 @@
|
|||
"""Word-level diff of one CI Server manual between two releases (e.g. R1.03 and R1.05).
|
||||
|
||||
Catches changes the revision table does not mention (for example R1.04 edits listed only as
|
||||
"Added contact information"). Needs `pdftotext` (Poppler / Git for Windows) on PATH.
|
||||
|
||||
Usage:
|
||||
python tools/manual_diff.py <old_pdf_dir> <new_pdf_dir> IM36K10L40-01EN [more IMs] [-o out_dir]
|
||||
|
||||
Prints one block per change: [replace]/[insert]/[delete] with old (-) and new (+) words.
|
||||
Page footers, edition lines and dates are removed first, so only text changes remain.
|
||||
Writes nothing into the repo; with -o it saves <IM>.diff.txt files in out_dir.
|
||||
"""
|
||||
import difflib
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
|
||||
NOISE = re.compile(
|
||||
r'IM ?36K\w+-01EN( \d+\w\w Edition)?( : [A-Za-z]+\.? ?\d+, ?\d+-00)?'
|
||||
r'|\d+(st|nd|rd|th) Edition|Toc-\d+|Rev-\d+|App\.\d+-\d+|\b\d+-\d+\b')
|
||||
|
||||
|
||||
def words(pdf):
|
||||
with tempfile.TemporaryDirectory() as d:
|
||||
out = os.path.join(d, 'm.txt')
|
||||
subprocess.run(['pdftotext', pdf, out], check=True)
|
||||
text = open(out, encoding='utf-8', errors='replace').read()
|
||||
return NOISE.sub(' ', text).split()
|
||||
|
||||
|
||||
def diff(old_pdf, new_pdf):
|
||||
a, b = words(old_pdf), words(new_pdf)
|
||||
sm = difflib.SequenceMatcher(None, a, b, autojunk=False)
|
||||
lines = []
|
||||
for op, a1, a2, b1, b2 in sm.get_opcodes():
|
||||
if op == 'equal':
|
||||
continue
|
||||
lines.append('[%s] at word %d\n - %s\n + %s' % (
|
||||
op, a1, ' '.join(a[a1:a2]), ' '.join(b[b1:b2])))
|
||||
return lines
|
||||
|
||||
|
||||
def main(argv):
|
||||
out_dir = None
|
||||
if '-o' in argv:
|
||||
i = argv.index('-o')
|
||||
out_dir = argv[i + 1]
|
||||
del argv[i:i + 2]
|
||||
if len(argv) < 3:
|
||||
sys.exit(__doc__)
|
||||
old_dir, new_dir, ims = argv[0], argv[1], argv[2:]
|
||||
for im in ims:
|
||||
old_pdf = os.path.join(old_dir, im + '.pdf')
|
||||
new_pdf = os.path.join(new_dir, im + '.pdf')
|
||||
if not os.path.exists(old_pdf):
|
||||
print('=====', im, ': new manual (no old edition)')
|
||||
continue
|
||||
lines = diff(old_pdf, new_pdf)
|
||||
report = '\n'.join(lines)
|
||||
print('=====', im, ':', len(lines), 'changes')
|
||||
if out_dir:
|
||||
os.makedirs(out_dir, exist_ok=True)
|
||||
open(os.path.join(out_dir, im + '.diff.txt'), 'w', encoding='utf-8').write(report)
|
||||
else:
|
||||
print(report)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main(sys.argv[1:])
|
||||
|
|
@ -1,8 +1,15 @@
|
|||
# CI Server R1.03 - read-only setup check
|
||||
# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §2.1.2)
|
||||
# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2).
|
||||
# CI Server R1.05 / R1.03 - read-only setup check
|
||||
# Compares a machine with the Windows settings required by CI Server Setup (IM 36K01C10-01EN §1.3.2, §2.1.2)
|
||||
# and the IT security state described in the Security Guide (IM 36K01C30-01EN §2.2, §3.2, §3.5.4).
|
||||
# R1.05 rules: 5th editions (Feb. 2026); R1.03 rules: 3rd editions (Sep. 2023).
|
||||
# Changes nothing. Run in Windows PowerShell 5.1; some checks need an elevated session.
|
||||
# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1
|
||||
# Usage: powershell -NoProfile -ExecutionPolicy Bypass -File tools\setup_check.ps1 [-Version 1.05.00|1.03.00]
|
||||
param(
|
||||
[ValidateSet('1.05.00', '1.03.00')]
|
||||
[string]$Version = '1.05.00'
|
||||
)
|
||||
$isR103 = ($Version -eq '1.03.00')
|
||||
"Target: CI Server R$Version"
|
||||
|
||||
$results = New-Object System.Collections.Generic.List[object]
|
||||
function Add-Result($area, $check, $expected, $actual, $ok) {
|
||||
|
|
@ -19,8 +26,8 @@ $ci = $null
|
|||
foreach ($k in 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*') {
|
||||
foreach ($i in (Get-ItemProperty $k -ErrorAction SilentlyContinue)) { if ($i.DisplayName -like 'CI Server R*') { $ci = $i } }
|
||||
}
|
||||
if ($ci) { Add-Result 'CI Server' 'Installed version' '1.03.00' $ci.DisplayVersion ($ci.DisplayVersion -eq '1.03.00') }
|
||||
else { Add-Result 'CI Server' 'Installed version' '1.03.00' 'not found' $false }
|
||||
if ($ci) { Add-Result 'CI Server' 'Installed version' $Version $ci.DisplayVersion ($ci.DisplayVersion -eq $Version) }
|
||||
else { Add-Result 'CI Server' 'Installed version' $Version 'not found' $false }
|
||||
$svc = Get-Service StartCIServer -ErrorAction SilentlyContinue
|
||||
if ($svc) {
|
||||
Add-Result 'CI Server' 'CI Service state' 'Running (when in use)' $svc.Status $null
|
||||
|
|
@ -33,10 +40,27 @@ Add-Result 'CI Server' 'VAGW Bossd service' 'present only if installed with IT S
|
|||
|
||||
# --- Operating system --------------------------------------------------------
|
||||
$os = Get-CimInstance Win32_OperatingSystem
|
||||
$osText = "$($os.Caption) build $($os.BuildNumber)"
|
||||
if ($isR103) {
|
||||
# R1.03 (IM 36K01C10-01EN 3rd ed. §1)
|
||||
$supported = @('Windows 10 Pro', 'Windows 10 Enterprise', 'Windows 10 IoT Enterprise', 'Windows Server 2016', 'Windows Server 2019', 'Windows Server IoT 2019')
|
||||
$osOk = $false; foreach ($s in $supported) { if ($os.Caption -like "*$s*") { $osOk = $true } }
|
||||
Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' "$($os.Caption) build $($os.BuildNumber)" $osOk
|
||||
Add-Result 'Windows' 'Operating system' 'Win10 Pro/Enterprise/IoT LTSB 2016/LTSC 2019, Server 2016/2019' $osText $osOk
|
||||
if ($os.Caption -like '*Windows 10 Pro*') { Add-Result 'Windows' 'Windows 10 Pro note' 'Vnet/IP drivers and IT Security Tool not supported on Win10 Pro' 'Windows 10 Pro' $null }
|
||||
}
|
||||
else {
|
||||
# R1.05 (IM 36K01C10-01EN 5th ed. §1.3.2): Server editions are listed as Standard only
|
||||
$supported = @(
|
||||
'Windows 10 (IoT )?Enterprise LTSC (2019|2021)',
|
||||
'Windows 11 (Pro|Enterprise)\b',
|
||||
'Windows 11 IoT Enterprise LTSC 2024',
|
||||
'Windows Server (IoT )?(2019|2022|2025) Standard'
|
||||
)
|
||||
$osOk = $false; foreach ($s in $supported) { if ($os.Caption -match $s) { $osOk = $true } }
|
||||
Add-Result 'Windows' 'Operating system' 'Win10 (IoT) Ent. LTSC 2019/2021, Win11 Pro/Ent., Win11 (IoT) Ent. LTSC 2024, Server (IoT) 2019/2022/2025 Standard' $osText $osOk
|
||||
$noItSec = ($os.Caption -match 'Windows Server (IoT )?2025') -or (($os.Caption -match 'Windows 11') -and ($os.Caption -notmatch 'LTSC'))
|
||||
if ($noItSec) { Add-Result 'Windows' 'Vnet/IP and IT security note' 'Vnet/IP drivers and IT Security Tool not supported on Win11 Pro/Ent. and Server 2025' $os.Caption $null }
|
||||
}
|
||||
|
||||
# Visual effects: "Let Windows choose" = VisualFXSetting 0
|
||||
$vfx = Get-Reg 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects' 'VisualFXSetting'
|
||||
|
|
@ -66,7 +90,14 @@ Add-Result 'Windows' 'Fast startup (HiberbootEnabled)' '0' $hib ($hib -eq 0)
|
|||
# Windows Defender
|
||||
$defPol = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' 'DisableAntiSpyware'
|
||||
$defSvc = Get-Service WinDefend -ErrorAction SilentlyContinue
|
||||
Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })" ($defPol -eq 1)
|
||||
$defText = "policy DisableAntiSpyware=$defPol; service=$(if ($defSvc) { $defSvc.Status } else { 'none' })"
|
||||
# R1.05 exceptions (IM 36K01C10-01EN 5th ed. §2.1.2, IM 36K01C30-01EN 5th ed. §3.5.4):
|
||||
# Win11 Pro 24H2 (build 26100+) must keep Defender on; Win10 LTSC 2021 (build 19044) and Win11 LTSC 2024 cannot turn it off.
|
||||
$defKeepOn = (-not $isR103) -and ($os.Caption -match 'Windows 11 Pro') -and ([int]$os.BuildNumber -ge 26100)
|
||||
$defCannotOff = (-not $isR103) -and (($os.Caption -match 'Windows 11 .*LTSC') -or (($os.Caption -match 'Windows 10 .*LTSC') -and ([int]$os.BuildNumber -eq 19044)))
|
||||
if ($defKeepOn) { Add-Result 'Windows' 'Windows Defender' 'Win11 Pro 24H2: must stay on' $defText $null }
|
||||
elseif ($defCannotOff) { Add-Result 'Windows' 'Windows Defender' 'Win10 LTSC 2021 / Win11 LTSC 2024: cannot be turned off' $defText $null }
|
||||
else { Add-Result 'Windows' 'Windows Defender' 'turned off by policy (use Yokogawa-approved antivirus)' $defText ($defPol -eq 1) }
|
||||
|
||||
# Automatic Windows updates
|
||||
$au = Get-Reg 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' 'NoAutoUpdate'
|
||||
|
|
@ -107,18 +138,32 @@ foreach ($u in 'CIX_PROCESS', 'CTM_PROCESS') {
|
|||
$lu = Get-LocalUser -Name $u -ErrorAction SilentlyContinue
|
||||
Add-Result 'IT security' "Local user $u" 'exists' $(if ($lu) { "exists, enabled=$($lu.Enabled)" } else { 'missing' }) ([bool]$lu)
|
||||
}
|
||||
$itsec = Test-Path 'C:\Program Files (x86)\YOKOGAWA\IA\iPCS\Platform\Security'
|
||||
Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe' $(if ($itsec) { 'yes' } else { 'no' }) $itsec
|
||||
# Program folder of the IT Security Tool; IT security 3.0 also puts its GPO file and settings PDF
|
||||
# under ProgramData (IM 36K01C10-01EN 5th ed. §2.1.6)
|
||||
$secPaths = @((Join-Path ${env:ProgramFiles(x86)} 'YOKOGAWA\IA\iPCS\Platform\Security'), (Join-Path $env:ProgramData 'Yokogawa\IA\iPCS\Platform\Security'))
|
||||
$found = @($secPaths | Where-Object { Test-Path $_ })
|
||||
$itsec = $found.Count -gt 0
|
||||
$v3 = Test-Path (Join-Path $env:ProgramData 'Yokogawa\IA\iPCS\Platform\Security\GPOFiles\3.0')
|
||||
$secText = if ($itsec) { "yes ($($found -join '; '))$(if ($v3) { '; IT security 3.0 files present' })" } else { 'no' }
|
||||
Add-Result 'IT security' 'IT Security Tool installed' 'yes, when installed with ciserver-...-ITSecurity.exe (or the IT security 3.0 installer)' $secText $itsec
|
||||
|
||||
foreach ($p in (Get-NetFirewallProfile -ErrorAction SilentlyContinue)) {
|
||||
Add-Result 'Firewall' "Profile $($p.Name)" 'Enabled' $p.Enabled ($p.Enabled -eq $true)
|
||||
}
|
||||
$ports = @{ 'TCP 8080' = 8080; 'TCP 8443' = 8443; 'UDP 17001' = 17001; 'UDP 17101' = 17101; 'UDP 18002' = 18002 }
|
||||
$allow = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
|
||||
# R1.05: RESTful API web server (jrstsrv.sup JRST_NETWORK_PORT), IM 36K01C30-01EN 5th ed. Table 3.2-1
|
||||
if (-not $isR103) { $ports['TCP 34597'] = 34597 }
|
||||
# A rule counts when it names the port, or allows any port without being limited to one program
|
||||
# (Windows' own "any port" rules such as Remote Desktop Shadow are program-limited and do not count).
|
||||
$allow = foreach ($r in (Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue)) {
|
||||
$pf = $r | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
|
||||
$af = $r | Get-NetFirewallApplicationFilter -ErrorAction SilentlyContinue
|
||||
[pscustomobject]@{ Protocol = $pf.Protocol; LocalPort = @($pf.LocalPort); AnyProgram = ($af.Program -eq 'Any' -and $af.Package -in @($null, '', 'Any')) }
|
||||
}
|
||||
foreach ($name in $ports.Keys) {
|
||||
$proto, $num = $name.Split(' ')
|
||||
$hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or $_.LocalPort -contains 'Any') }
|
||||
Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
|
||||
$hit = $allow | Where-Object { $_.Protocol -eq $proto -and ($_.LocalPort -contains "$num" -or ($_.LocalPort -contains 'Any' -and $_.AnyProgram)) }
|
||||
Add-Result 'Firewall' "Inbound $name allowed" 'yes (web / secure web / DURM / SMDMON / RESTful API)' $(if ($hit) { 'yes' } else { 'no rule found' }) ([bool]$hit)
|
||||
}
|
||||
|
||||
# --- Output --------------------------------------------------------------------
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue