From 7be194d6a325800efb459248f6dd8383f2bc0284 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 10:46:28 +1000 Subject: [PATCH 1/5] Add phase 7 manual summaries (L30, L45, E20, L55) Co-Authored-By: Claude Opus 5.5 --- knowledge/manuals/IM36K10E20-01EN.md | 70 +++++++++++ knowledge/manuals/IM36K10L30-01EN.md | 133 ++++++++++++++++++++ knowledge/manuals/IM36K10L45-01EN.md | 182 +++++++++++++++++++++++++++ knowledge/manuals/IM36K10L55-01EN.md | 51 ++++++++ 4 files changed, 436 insertions(+) create mode 100644 knowledge/manuals/IM36K10E20-01EN.md create mode 100644 knowledge/manuals/IM36K10L30-01EN.md create mode 100644 knowledge/manuals/IM36K10L45-01EN.md create mode 100644 knowledge/manuals/IM36K10L55-01EN.md diff --git a/knowledge/manuals/IM36K10E20-01EN.md b/knowledge/manuals/IM36K10E20-01EN.md new file mode 100644 index 0000000..217b160 --- /dev/null +++ b/knowledge/manuals/IM36K10E20-01EN.md @@ -0,0 +1,70 @@ +--- +manual: IM 36K10E20-01EN +title: OPC Interface +edition: 2nd Edition, Sep. 2023 +version: R1.03 +status: from docs; OPC UA point and certificate forms compared with quick load on the test system 2026-10-01 (user configured a point in the Engineering Module, exported and diffed) +--- + +# OPC Interface (R1.03) + +Engineering Module procedures for OPC Classic, OPC UA client and OPC UA PubSub. Concepts, +setup files and the OPC servers: `IM36K10L45-01EN.md`. Everything here is under +*Configuration → I/O processing → Equipment → (OPC DA client | OPC A&E client | OPC UA Client | +OPC UA PubSub)*. CI Server must be running. Section numbers refer to the manual. + +## 1. OPC Classic (§1) + +- DA: line (equipment node, process name — the manual says it must start with `OPC` for DA and + A&E lines, `OPX` for OPC UA), station (OPC server node and ProgID, status item), group + (deadband, requested update rate, status item), point (external relation, group, OPC tag, + browse). Then connect items to points (Tutorial "Define points"). +- A&E: line, station (server, subscription filters), subscribed attributes; to show events in + the current alarm overview, map event sources to items. External names must be unique per + station. + +## 2. OPC UA client (§2) + +Order: line → station → subscription → points (→ methods) → alarm components / event type +filters / event nodes / template settings (only when alarms are wanted; no alarms are received +until event nodes are configured). + +| Object | Key fields (dataset field) | +|---|---| +| Line | name ≤ 31, equipment node (*None* = this node), **process name starts with `OPX`, ≤ 11 characters** (`EQUIPMENT_MAN`) | +| Station | name ≤ 19; *Host(:port)* + *Discovery* fill session/server name and endpoint, or type the endpoint (`SERVER_01_ENDPOINT`); redundant servers + *Active server item*; *On scan*; *General communication status item* (`STATUS_ITEM`); security policy and mode; anonymous or user/password; requested session time-out; alarm tab (request active alarms, store all alarms as SOE, severity → priority mapping) | +| Subscription | publishing interval, lifetime and keep-alive counts, max notifications, priority, publish enabled, status item | +| Point | external relation Input / Output / Input + Output; subscription; *Namespace*, *Node id type*, *Node Id* (or *Browse path*); read-only *Last value*, *Data type*, *Access level*, *Value rank*; array element; options (own sampling interval, monitoring mode, queue size); conversion (offset, step) | +| Method | namespace, node ID or browse path, process areas | + +**Observed (2026-10-01)**: browsing in the point form stops at the item itself +(`Objects/
/…/`) and stores the item **object** (`{"nsid":""}`), which has no +value: *Last value*/*Data type* stay empty and the point is never monitored (revised sampling +interval 0, item status 13). Type the node ID of the value instead: +`{"0":"Value","itnm":""}` (namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`, type +STRING). The form also fills `OPC_DISPLAY_NAME` and `OPC_TAG_INFO` (browse bookkeeping; +not needed for quick load). ISS-033. + +## 3. Certificates (§2.2) + +*OPC UA Client → Certificates*: **Trusted**, **Rejected** (server certificates arrive here), +**Own certificate**. Trust = open the rejected certificate, tick *Trusted*, Apply; reject = +untick. Restart the Engineering Module to refresh the folders. *Modify* the own certificate +(name, organisation, country, domain or IP, RSA key strength, signature algorithm, validity). + +**CI Server OPC UA client ↔ CI Server OPC UA server (§2.2.6)**: trust the server certificate +on the client; copy the client's own certificate +(`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs`) to the server's +`…\pki\opxuas\pkiserver\trusted\certs`; the manual also asks to tick *Use CI Server entity names +for nodeids* in `opxuas.sup` and restart the server. On the test system the loopback worked +**without** that option, using `itnm` node IDs (ISS-032). + +## 4. OPC UA PubSub (§3) + +UDP publish/subscribe of Data Access values from the CI Server OPC UA server address space +(OPC visible items). Objects: line (needs its own copy of `ServerConfig.xml` named for the +instance), published datasets, station, writer groups + dataset writers (publisher), reader +groups + dataset readers (subscriber), then *Upload dataset configurations to runtime*. +Limits per line: 4 stations, 8 writer groups, 8 reader groups, 32 dataset writers, 32 dataset +readers, 32 published datasets. Status mapping as for the server (NORMAL → Good; NOT_INIT, +UPD_OFF, OFFSCAN, OFFLINE → Uncertain; BAD_VALUE → Bad). Not practiced (needs a PubSub peer). diff --git a/knowledge/manuals/IM36K10L30-01EN.md b/knowledge/manuals/IM36K10L30-01EN.md new file mode 100644 index 0000000..691a6fd --- /dev/null +++ b/knowledge/manuals/IM36K10L30-01EN.md @@ -0,0 +1,133 @@ +--- +manual: IM 36K10L30-01EN +title: BUS Service Engineering +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs; installed tools, setup files (dur.sup, durm_1_udp.sup, time_table.sup, fmfprt.sup, durutl.sup) and durm_start.cmd checked read-only 2026-10-01; durwfp verified; umhman, umhtestprog, umhmsg fail on the test system (ISS-030) +--- + +# BUS Service Engineering (R1.03) + +BUS Service is CI Server's messaging layer ("DUR", Dynamic User Region): every CI Server +process attaches to a shared memory area and gets a **queue** (mailbox) under its DUR name; +processes talk by messages. It also does error-text management (UMH), node-to-node links +(MDUR), time handling, printer management and process control utilities. Section numbers refer +to the manual. + +## 1. Processes (§1.2) + +| Process | Role | +|---|---| +| `durini` | Initialises DUR at start, then exits | +| `durtim` | Runs every second: system time, summer/winter time, queue time-outs, checks that processes still exist (`DUR-W-REM_PROC, Process exited unexpectedly`), clock queue | +| `durprt` | Writes intercepted messages to `tls\lst\DURPRT.out` (debugging; leave running) | +| `umh` / `umhlog` | Build error texts from codes (`tls\dat\messages.umh`) and write them to the message log (`umhlog.log`) | +| Optional | `dur` (DUR display utility, interactive), `durbat` (start processes on request, also remote), `durclq` (finer clock-queue resolution: `durclq 50` = 50 ms), `durdbg`, `durutl` (logical addresses, node time sync), `durecs` (external clock), `dursim`, `durstp`, `durwfp`, `umhcr`, `umhlogtoo`, `umhman`, `umhmsg` | + +Process names: fixed (e.g. `UMH`), `PID` when none given, or set with `-n ` (most +CI Server executables, e.g. `opxuas -n opxuas`). + +## 2. Messages and nodes (§2–§4) + +- Requests are asynchronous; CI Server makes them synchronous with a *reply required* flag. The + **server** converts data between different computer architectures. +- **MDUR** (§3): one `durm_` process pair per network line (`durm_udp` + `durm_udp_slv` + on Windows), started by `tls\com\durm_start.cmd`, configured in + `tls\sup\durm__udp.sup`: `line`, `quality` (lower = preferred line), `io_timeout` + (default 8000 ms, 8 checks), `portnr` (same on all nodes of one line; > 17000 advised), + `max_snd`, `cluster`, `compress`, `connect_delay`, `max_poll_int`, `our_host_name`, + `remote_set` (up to four nodes sharing one node number = redundant set). Redundant nodes + only over TCP/IP. `durmdbg -q -f ` traces a line; always stop with `-s`. +- `dur.sup`: node number, `host_node`, `rout_type` (ENDPOINT or ROUTER for multi-node + routing), sizes (`pool_kbytes`, `dur_max_proc`). +- **Logical addresses** (§4): node −1 in an address = look up a table (`durlnm.dat`), distributed + by `durutl` from a master node listed with `lnm_node = …` in `durutl.sup`. + +**Installed (single node)**: `dur.sup` `host_node 0`, `pool_kbytes 250000`, `dur_max_proc 250`, +`rout_type 2 ENDPOINT`; `durm_1_udp.sup` `line 1`, `quality 500`, `io_timeout 8000`, +`portnr 17001`, plus keywords not in the manual: `sndportnr 17101`, `ip_adr_method IPv4`, +`ENABLE_DURMS N, 0` (host-host encryption, §13); `durm_1` is running although there is no +second node; `durutl.sup` has no active lines. + +## 3. Messages and the message log (§5, §6) + +- Codes look like `FAC-S-ACRONYM` (S = S/I/W/E/F). Text comes from `messages.umh`; dynamic + values are inserted by name; several codes can form one history entry. +- `umhlog` writes to `tls\log\umhlog.log`; `-d ` also logs centrally on another node, + `-q ` prints too. +- Tools: `umhtestprog` (tests the message path), `umhmsg [ ]…` + (issue a message from a script), `umhman` (look up a hex code, interactive), + `umhlogtoo` (copy of all messages to a terminal). **On the test system** `umhman` crashes + with redirected input, `umhtestprog` crashes, and `umhmsg` ends with "license expired" + (ISS-030). +- A message shown as `UMH Message Text Error: Message number (…)` means the text could + not be formatted (e.g. a `%` in a PRINT text, ISS-025). + +## 4. Time (§7, §8, §11) + +- `time_table.sup`: `AUTOMATIC` (installed) = BUS Service takes summer/winter times from + Windows at start (scans ±15 years); otherwise `LST_OFFSET` (minutes, **positive = west**), + `LST_NAME`, `LCT_NAME`, `CHANGE` lines; month/day abbreviations. Reload via the DUR display + utility. Installed file still has the Central European example values (−60, MET/MEST); they + are ignored while `AUTOMATIC` is set. +- Node time sync with `durutl` on the master: `tms_params = , , , + , , ` and one `tms_node = ` per slave; beyond limit3 the slave is + set at once and an error is logged. External clock (serial Wharton/Trimble/Arbiter) with + `durecs` and `durecs.sup` (`ecs_params`). On Windows normally use Windows time + (`system-check`, `w32tm`). + +## 5. Process control utilities (§10) + +| Command | Use | +|---|---| +| `durwfp -p [-t ] [-e]` | Exit 0 if the process is attached (waits up to `-t`, default 60; `-t 0` = check now); `-e` waits for it to go away. Verified: `umh`, `opcman` → 0, unknown name → 1 | +| `durstp -m -p ` | Send a stop message (clean stop). `-k` kills, `-m -k` = stop, then kill after `-t` s; `-f` kills even with the common area locked (dangerous); `*` wildcard (`-p alm\*`). Never `durstp -k -p \*` | +| `durbat` | Starts processes on request from other processes (also remote) | + +`durstp` stops CI Server processes: use only with the user's approval. + +## 6. Printer management (§12) + +`FMFPRT` (printer manager, one per node) and one `FMFP_` process per device (first 8 +characters of the device name must be unique). **Destinations** (logical, e.g. +`SCREEN_CAPTURE`, `ALARMS`, `MESSAGES`, `DEFAULT`) map to **devices** (instances of an output +type) with an optional backup device. Configured in `fmfprt.sup`; devices and destinations in +datasets `PRINTER_DEV_DF`, `PRINTER_DEST_DF`, `PRINTER_TYPE_DF`, `PRINTER_OPER_DEST_DF` +(job/device lists `PRINTER_JOB_OVV`, `PRINTER_DEV_OVV`). + +**Installed `fmfprt.sup`**: `QUEUE_LIFE 1800` s (stalled job expires), `MAX_JOBS_SHOWN 10`, +`DEVICE_POLL 5` s, `MAX_BUSY 60` polls; output types `HARDCOPY` (`fmfphc`, Windows printing, +Courier New 8 pt, 72 lines, landscape), `FILE` (`fmfpfl`, file name +`TLS_%time:DDMMYY%_%seq:03%.lst` in `tls\lst`), `APPLICATION` (`fmfpap`, program set to +Internet Explorer); fixed destinations `ALARMS`→`ALDPRT`, `AUDIT_TRAIL`→`ADTLOG`, +`MESSAGES`→`UMHLOG`, `PRINTER_1`→`RPTMAN`, `SCREEN_CAPTURE`→`CWSSHOT`. `NODE_SHARE = ` +shares printers between nodes. Logging processes do not print by default (enable per process: +`aldprt.sup LOGPRT`, `adtsys.sup PRT_DEV`, `umhlog -q`). + +The CI Service account must have the printers; `DEFAULT` uses that account's default printer. +Clean-up after a crash: stop CI Server, empty `tls\lst\printing`, delete +`tls\sav\fmf_prt_last_id.sav`, `fmfprt.sav` and `tls\dat\printer_job_ovv.*`, start. + +## 7. MDUR encryption (§13) + +Host-host encryption (AES-256, certificates) between CI Cores: every node must use it; no +enterprise configurations. Keys: `gen_key is_ca=1` once (CA key), `gen_key is_ca=0` on each +node → `%TLS_ALLUSERS_PATH%\pki\mel\dur\key`; certificates with the interactive `cert_write` +(CA certificate to `…\pki\mel\dur\crt\ca\ca.crt` on every node, node certificate to +`…\crt\own`; create the folders first; log `tls\log\cert_write_log.log`). Then tick *Enable +HostHost encryption* in each `durm_x_udp.sup` (installed keyword `ENABLE_DURMS`). Keep the CA +key off the servers. Not practiced (single node; `tls\pki\mel` does not exist yet). + +## 8. Adaptive queues (§14) + +Each process has a fixed queue (the *adaptive minimum*); for processes listed on the +*Adaptive queues* tab of `dur.sup` (`ADAPTIVE_QUEUE_SETS = , `), DUR may +grow the queue temporarily by up to that percentage of the total queue area, avoiding overflows +during bursts. Add node queues for multi-node systems and new processes (extra executors, +DSS servers, equipment managers). In the performance monitor *Minimum KB*/*Maximum KB*/*Current +KB* and a high-queue of 100 % show that a queue needed more space → raise its size. Total area +exhausted → `DUR_F_NO_SPACE`. + +**Installed**: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`/`WFLIDI`/`WFLADI`/`ITHEIX`/`ITHSER` 2, +`DSSSDA*`/`DSSEVT*`/`OPCEXE` 1 %. Note: `OPCEXE` does not match the installed executor names +`OPCEXE1`…`4` (no wildcard) — see ISS-026. diff --git a/knowledge/manuals/IM36K10L45-01EN.md b/knowledge/manuals/IM36K10L45-01EN.md new file mode 100644 index 0000000..e670704 --- /dev/null +++ b/knowledge/manuals/IM36K10L45-01EN.md @@ -0,0 +1,182 @@ +--- +manual: IM 36K10L45-01EN +title: Data Access Engineering +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs +--- + +# Data Access Engineering (R1.03) + +ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC +Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section +numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on: +skill `data-access`. + +## 1. ODBC (§1–§3) + +- Multi-tier: ODBC application + driver manager + **SimbaClient** driver on the client; + **SimbaServer** + ACCESS Service ODBC engine (`odbsrv`) on the CI Server. Read and write of + existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be + created or deleted over ODBC. Needs an ODBC licence. +- `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate + `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`), + `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data + (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on). +- Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium + (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or + `CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts. +- SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`. +- Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not + running / port mismatch / BUS Service not reachable. + +**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder +`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so +`odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx(): +SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited +unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set +`USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry +defaults once (when `%TLS_DAT_PATH%\access.new` exists). + +## 2. OPC Classic basics (§4) + +DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A +and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`). +- Quality: OPC DA quality goes to the **lower** 16 bits of the CI Server quality word, OPC A&E + quality to the **upper** 16 bits. Item to OPC: CI Server quality low byte → OPC high byte; + OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised → + NOT_CONNECTED, else GOOD. +- Types: `VT_UI1/UI2/INT/I1/I2/I4` → Integer, `VT_UI4/UINT/R4/R8` → Real, `VT_BSTR` → String, + `VT_BOOL` → Boolean. +- Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC + visible* (and every parent section visible). + +## 3. OPC DA client (§5) + +- One client process per DA line (name given in the line), started/stopped with CI Server; + stop one with `durstp -msk -t10 -p `. Uses a save file in `%TLS_SAV_PATH%` named + after the process; delete it (client stopped) if it gets inconsistent. +- Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running, + 2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group + status item: 1 active / 0 not active (items offline). +- Setup (`.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server + DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING` + (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT` + (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`, + `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8), + `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`. +- Advice: one OPC server per client process (a DCOM time-out blocks the whole process). + Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`, + `POINT_DF` of one station made in the Engineering Module. +- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS, + DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm__udp.sup`, + port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's + setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon` + node monitoring with *Set slave items offline when node unavailable*. + +## 4. OPC DA server (§6) + +- COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.`, DUR name `OPXDAS`; started by + COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown). +- Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE + pattern). *Cache read* is fast and correct; *device read* blocks — use only after queue + overflow. Timestamp = time written into the server cache. +- `opxsys.sup` *Data Access Server* tab: `OPXDAS_DUR_QSZ` (100 kB), `…_HBEAT`, `…_ITMBUF`, + `OPXDAS_USER` (log on as a CI Server user to apply its authorisation; empty = full access, + fastest), `OPXDAS_DCOM_TUN`, `OPXDAS_IGNORE_FTQ`. Installed also: `OPXDAS_SET_LOG_LEVEL` + (not described). +- Remote access needs DCOM configuration (`dcomcnfg`: authentication Connect, impersonation + Identify, access/launch permissions for an OPC account; identity of the server = that account), + `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for + `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT + Security Tool is applied. Same account/password on both sides in a workgroup. +- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`, + `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic), + `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first. + +## 5. OPC A&E client and server (§7, §8) + +- Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `.sup` or `opxsys.sup` + (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`, + `…_TRACE`); maps condition events to items; one server per client advised. +- Server `opxaes`, ProgID `Yokogawa.CIOpcAes.`, DUR name `OPXAES`; publishes items + with alarm monitoring as conditions; `OPXAES_ACK_ALLOWED` (acknowledge from clients), + `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the + CI Server-specific event attributes (old/new value, quality, status, alarm state, item + description, units, node, group, number, sub-number). Installed: all on. + +## 6. OPC UA client (§9) + +- OPC UA TCP only; security by X.509 certificates (application authentication), user + anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256, + Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not). +- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in + Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good, + 1 bad, 2 uncertain. +- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other + events INFORMATIONAL; filters by event type, component, event node; severity → priority + table (901–1000 → 1 … 1–100 → 15), per station; don't manage + NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled. +- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold + backup with two endpoints (*Active server item* 0/1/2). +- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11 + characters), station (= session), subscription, point (= monitored item), alarm component / + event type filter / event node / template settings, method. +- Certificates: the client process creates `_.der` in + `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset + `OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be + trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`, + `rejected` added by CI Server. The server must trust the client's certificate too. +- Setup (`.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats, + buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed + retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and + session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\.log`. +- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` + (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server + (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`). +- Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`. + +## 7. OPC UA server (§10) + +- Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p + opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log` + and `OpxUas_Sdk*.log`. +- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read + values, browse into the item) and **Write** (write values, alarm methods). Parent sections must + be visible. Without Read the item is listed but browsing into it fails + (`UncertainNotAllNodesAvailable`). +- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ` + (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods). +- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`, + `…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`, + `Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in + `http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections, + items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing; + the manual does not name it, ISS-032). +- NodeIds are JSON strings: `{"nsid":""}` for the entity, + `{"0":"Value","nsid":""}` for its value; or by name: `{"0":"Value","itnm":""}` + (case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`. + `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs. +- Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH → + BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority → + severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03). +- History: items in a history group show HistoryRead; max 5000 values per node per call. +- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal); + external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM. +- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab + (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`, + `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`, + `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` = + ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE` + (manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034). +- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list + `…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first + rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256, + Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint); + anonymous, user/password **and certificate** user tokens enabled (manual: certificate off, + ISS-034); `AutomaticallyTrustAllClientCertificates` false. +- First connection of any client: trust the server certificate on the client, then move the + client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the + suggested test client. +- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate + management (concepts only). diff --git a/knowledge/manuals/IM36K10L55-01EN.md b/knowledge/manuals/IM36K10L55-01EN.md new file mode 100644 index 0000000..ff2968d --- /dev/null +++ b/knowledge/manuals/IM36K10L55-01EN.md @@ -0,0 +1,51 @@ +--- +manual: IM 36K10L55-01EN +title: Exchange Tool Engineering +edition: 3rd Edition, Sep. 2023 +version: R1.03 +status: from docs only (needs CENTUM VP / an RGS node or CCC Prodigy data; not available on the test system) +--- + +# Exchange Tool Engineering (R1.03) + +Two tools convert another system's engineering data into CI Server engineering data +(a "publication" = generated quick load files plus `load.cmd`). Section numbers refer to the +manual; Appendix 1 lists the supported CENTUM VP function blocks. + +## 1. CI Exchange for CENTUM VP (§2) + +- Runs on an **RGS** (Remote Gateway Station: CI Server PC with a Vnet/IP card and driver from + the medium, `VirtualProduct_CIServer_packageRxxx.zip`, option *installVirtProd*) that talks + to CENTUM VP. *Single server*: the RGS is also the CI Core. *Non-single*: an upper CI Core + gets the data from the RGS (MDUR). +- Solutions: **RGS** (manual or automatic mode; automatic = the tool is embedded in the RGS, + ENG HIS equalisation enabled, the RGS registered in the CENTUM VP project; publications + generated after each CENTUM VP download) and **RGS with EAL** (external alarms; manual mode + only). +- Manual workflow: start the tool → create a project (*Single Server* ticked or not) → import + CENTUM VP engineering data from the ENG HIS (and MTL file) → *Publish* (name pattern, folder, + optional SQL tag filter such as `%PVI%`) → copy the publication folder to + `C:\Program Files (x86)\Yokogawa\CIServer\Utility` → run its `load.cmd` on the RGS and/or CI + Core (in an IT-security environment run `cmd.exe` *as different user* first). Automatic + publications land in `%TLS_ALLUSERS_PATH%\lst\rgs\pub\`. +- Output: items `
..` (e.g. `
.FIC001.PV`), points + `:[]`, plus lines/stations, displays and symbols (displays only on the CI + Core in non-single configurations). +- Precautions (§2.15): refresh open LIST displays after a CENTUM VP online download; CI Server + does not allow alarm limits on the wrong side of SV; short data gaps after Vnet scan changes + or RDC switch-over; trends may lag after large downloads — reload displays, roll over the + history group, tune scan types. +- Installed: launcher `%TLS_ROOT_PATH%\tls\com\jwuiutl_ciexchange.cmd` (no RGS on the test + system). + +## 2. CI Exchange for Prodigy (§3) + +- For CCC Prodigy turbo-machinery controllers (antisurge, performance, speed). Input: the + Modbus register list (`.csv`, from MakerPro) per controller; the station name and IP are + entered in the tool. +- Install: copy `Windows\EngineeringTools\CIExchange_Prodigy.zip` from the medium, extract to + `C:\Program Files (x86)\Yokogawa\CIServer\Utility` (create the folder), run + `CIExchange_Prodigy.cmd`. +- Workflow: create project → import source configuration → generate publication → load it. + Output: items `
.`, Modbus points `:[]`, and + faceplates (title and engineering unit can be customised, §3.12.1). -- 2.45.3 From a2d1a7e22756941cb771973120aa3cb2cf0fb7c9 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 10:46:28 +1000 Subject: [PATCH 2/5] Add OPC UA loopback station CIENG_UA to CI-Eng-Sample Co-Authored-By: Claude Opus 5.5 --- examples/CI-Eng-Sample/01_section_df.qli | 1 + examples/CI-Eng-Sample/02_item_df.qli | 1 + examples/CI-Eng-Sample/12_opc_visible_df.qli | 20 ++++++++++++++ examples/CI-Eng-Sample/13_opcua_line_df.qli | 12 +++++++++ .../CI-Eng-Sample/14_opcua_station_df.qli | 27 +++++++++++++++++++ examples/CI-Eng-Sample/15_item_opcua_df.qli | 13 +++++++++ .../CI-Eng-Sample/76_remove_item_opcua_df.qli | 13 +++++++++ .../77_remove_opcua_station_df.qli | 25 +++++++++++++++++ .../CI-Eng-Sample/78_remove_opcua_line_df.qli | 12 +++++++++ examples/CI-Eng-Sample/91_remove_item_df.qli | 1 + .../CI-Eng-Sample/92_remove_section_df.qli | 1 + examples/CI-Eng-Sample/README.md | 25 +++++++++++++++++ examples/CI-Eng-Sample/load.cmd | 9 +++++++ examples/CI-Eng-Sample/remove.cmd | 3 +++ 14 files changed, 163 insertions(+) create mode 100644 examples/CI-Eng-Sample/12_opc_visible_df.qli create mode 100644 examples/CI-Eng-Sample/13_opcua_line_df.qli create mode 100644 examples/CI-Eng-Sample/14_opcua_station_df.qli create mode 100644 examples/CI-Eng-Sample/15_item_opcua_df.qli create mode 100644 examples/CI-Eng-Sample/76_remove_item_opcua_df.qli create mode 100644 examples/CI-Eng-Sample/77_remove_opcua_station_df.qli create mode 100644 examples/CI-Eng-Sample/78_remove_opcua_line_df.qli diff --git a/examples/CI-Eng-Sample/01_section_df.qli b/examples/CI-Eng-Sample/01_section_df.qli index b8a5ad1..a2fa557 100644 --- a/examples/CI-Eng-Sample/01_section_df.qli +++ b/examples/CI-Eng-Sample/01_section_df.qli @@ -16,3 +16,4 @@ NAME,SECTION_PATH,SECTION_NAME,DESCRIPTION "CI-Eng-Sample.SYSTEM","CI-Eng-Sample","SYSTEM","Sample system monitoring" "CI-Eng-Sample.DEMO","CI-Eng-Sample","DEMO","Tutorial examples (class/object)" "CI-Eng-Sample.PLC1","CI-Eng-Sample","PLC1","Modbus loopback station CIENG_PLC" +"CI-Eng-Sample.UA","CI-Eng-Sample","UA","OPC UA loopback station CIENG_UA" diff --git a/examples/CI-Eng-Sample/02_item_df.qli b/examples/CI-Eng-Sample/02_item_df.qli index 6f78b41..d689ea3 100644 --- a/examples/CI-Eng-Sample/02_item_df.qli +++ b/examples/CI-Eng-Sample/02_item_df.qli @@ -21,3 +21,4 @@ LOW_LOW_LIMIT,LOW_LIMIT,HIGH_LIMIT,HIGH_HIGH_LIMIT,SCALE_LOW_LIMIT,SCALE_HIGH_LI "CI-Eng-Sample.SYSTEM.PROC_ALM","ALARM process (alm) running, from intmon","Integer","9",0,0,0,0,0,1 "CI-Eng-Sample.DEMO.COUNTER","Counter 1..100 driven by object DEMO.INCR1","Integer","999",0,0,0,0,0,100 "CI-Eng-Sample.PLC1.COMM_OK","Station CIENG_PLC communication (1 = good), status item","Boolean","",0,0,0,0,0,0 +"CI-Eng-Sample.UA.COMM_OK","Station CIENG_UA communication (1 = good), status item","Boolean","",0,0,0,0,0,0 diff --git a/examples/CI-Eng-Sample/12_opc_visible_df.qli b/examples/CI-Eng-Sample/12_opc_visible_df.qli new file mode 100644 index 0000000..1a9da98 --- /dev/null +++ b/examples/CI-Eng-Sample/12_opc_visible_df.qli @@ -0,0 +1,20 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Make sections and TANK1.LEVEL visible (read-only) to OPC clients (OPC UA/DA/A&E servers). Load with dssqld -m. +! Every parent section must be OPC visible too. +@FIELDS +NAME,OPC_VISIBLE + +@SECTION_DF +"CI-Eng-Sample",1 +"CI-Eng-Sample.TANK1",1 + +@FIELDS +NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE + +@ITEM_DF +"CI-Eng-Sample.TANK1.LEVEL",1,1,0 diff --git a/examples/CI-Eng-Sample/13_opcua_line_df.qli b/examples/CI-Eng-Sample/13_opcua_line_df.qli new file mode 100644 index 0000000..a3d8d18 --- /dev/null +++ b/examples/CI-Eng-Sample/13_opcua_line_df.qli @@ -0,0 +1,12 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! OPC UA client line; loading it creates and starts the client process OPXCIENG (name must start with OPX) +@FIELDS +NAME,DESCRIPTION,EQUIPMENT_MAN + +@OPCUAC_LINE_DF +"CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG" diff --git a/examples/CI-Eng-Sample/14_opcua_station_df.qli b/examples/CI-Eng-Sample/14_opcua_station_df.qli new file mode 100644 index 0000000..37d9f89 --- /dev/null +++ b/examples/CI-Eng-Sample/14_opcua_station_df.qli @@ -0,0 +1,27 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! OPC UA loopback: CI Server OPC UA client -> own OPC UA server (opc.tcp://localhost:34493) +! First connection needs a one-time certificate exchange (see README). +! CI Server entities: namespace urn:Yokogawa:CI_SERVER_OPC_UA_SERVER, string node id {"0":"Value","itnm":""} +@FIELDS +NAME,DESCRIPTION,LINE,USER_ANONYMOUS,MSG_SECURITY_01_MODE,MSG_SECURITY_01_POLICY,SERVER_01_ENDPOINT,STATUS_ITEM + +@OPCUAC_STATION_DF +"CIENG_UA","Loopback to own OPC UA server","CIENG_UA_LINE",1,"SignAndEncrypt","Basic256Sha256","opc.tcp://localhost:34493","CI-Eng-Sample.UA.COMM_OK" + +@FIELDS +NAME,STATION_NAME,SUBSCRIPTION_NAME,REQUESTED_PUBLISH_INTERVAL,DESCRIPTION + +@OPCUAC_SUBSCRIPTION_DF +"CIENG_UA:CIENG_SUB","CIENG_UA","CIENG_SUB",1000,"1 s subscription" + +@FIELDS +NAME,STATION,POINT,DESCRIPTION,SUBSCRIPTION,EXTERNAL_RELATION,OPC_NAMESPACE,OPC_NODE_ID_TYPE,OPC_NODE_ID + +@OPCUAC_POINT_DF +"CIENG_UA:LEVEL","CIENG_UA","LEVEL","TANK1.LEVEL via own OPC UA server","CIENG_SUB","Input","urn:Yokogawa:CI_SERVER_OPC_UA_SERVER","STRING","{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}" +"CIENG_UA:SRV_STATE","CIENG_UA","SRV_STATE","Server/ServerStatus/State (0 = Running)","CIENG_SUB","Input","http://opcfoundation.org/UA/","NUMERIC","2259" diff --git a/examples/CI-Eng-Sample/15_item_opcua_df.qli b/examples/CI-Eng-Sample/15_item_opcua_df.qli new file mode 100644 index 0000000..8dcec98 --- /dev/null +++ b/examples/CI-Eng-Sample/15_item_opcua_df.qli @@ -0,0 +1,13 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Items connected to OPC UA points of station CIENG_UA +@FIELDS +NAME,DESCRIPTION,ITEM_REP,VALUE_FORMAT,STATION,POINT + +@ITEM_DF +"CI-Eng-Sample.UA.LEVEL_COPY","TANK1.LEVEL read back through OPC UA","Real","999.9","CIENG_UA","LEVEL" +"CI-Eng-Sample.UA.SRV_STATE","OPC UA server state (0 = Running)","Integer","9","CIENG_UA","SRV_STATE" diff --git a/examples/CI-Eng-Sample/76_remove_item_opcua_df.qli b/examples/CI-Eng-Sample/76_remove_item_opcua_df.qli new file mode 100644 index 0000000..e5fdf27 --- /dev/null +++ b/examples/CI-Eng-Sample/76_remove_item_opcua_df.qli @@ -0,0 +1,13 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove items connected to OPC UA points +@FIELDS +NAME + +@ITEM_DF +"CI-Eng-Sample.UA.LEVEL_COPY" +"CI-Eng-Sample.UA.SRV_STATE" diff --git a/examples/CI-Eng-Sample/77_remove_opcua_station_df.qli b/examples/CI-Eng-Sample/77_remove_opcua_station_df.qli new file mode 100644 index 0000000..37d8eb7 --- /dev/null +++ b/examples/CI-Eng-Sample/77_remove_opcua_station_df.qli @@ -0,0 +1,25 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove OPC UA points, subscription, station +@FIELDS +NAME + +@OPCUAC_POINT_DF +"CIENG_UA:LEVEL" +"CIENG_UA:SRV_STATE" + +@FIELDS +NAME + +@OPCUAC_SUBSCRIPTION_DF +"CIENG_UA:CIENG_SUB" + +@FIELDS +NAME + +@OPCUAC_STATION_DF +"CIENG_UA" diff --git a/examples/CI-Eng-Sample/78_remove_opcua_line_df.qli b/examples/CI-Eng-Sample/78_remove_opcua_line_df.qli new file mode 100644 index 0000000..1bc3ffc --- /dev/null +++ b/examples/CI-Eng-Sample/78_remove_opcua_line_df.qli @@ -0,0 +1,12 @@ +@LANGUAGE +ENGLISH + +@VERSION +1.03.00 + +! Remove the OPC UA client line (stops process OPXCIENG) +@FIELDS +NAME + +@OPCUAC_LINE_DF +"CIENG_UA_LINE" diff --git a/examples/CI-Eng-Sample/91_remove_item_df.qli b/examples/CI-Eng-Sample/91_remove_item_df.qli index 5c33008..bf4d425 100644 --- a/examples/CI-Eng-Sample/91_remove_item_df.qli +++ b/examples/CI-Eng-Sample/91_remove_item_df.qli @@ -19,4 +19,5 @@ NAME "CI-Eng-Sample.SYSTEM.PROC_ALM" "CI-Eng-Sample.DEMO.COUNTER" "CI-Eng-Sample.PLC1.COMM_OK" +"CI-Eng-Sample.UA.COMM_OK" "CI-Eng-Sample.TEMPLATES.TPL_REAL" diff --git a/examples/CI-Eng-Sample/92_remove_section_df.qli b/examples/CI-Eng-Sample/92_remove_section_df.qli index 7070088..5ad8ce6 100644 --- a/examples/CI-Eng-Sample/92_remove_section_df.qli +++ b/examples/CI-Eng-Sample/92_remove_section_df.qli @@ -13,6 +13,7 @@ NAME "CI-Eng-Sample.PUMP1" "CI-Eng-Sample.SYSTEM" "CI-Eng-Sample.PLC1" +"CI-Eng-Sample.UA" "CI-Eng-Sample.DEMO" "CI-Eng-Sample.TEMPLATES" "CI-Eng-Sample" diff --git a/examples/CI-Eng-Sample/README.md b/examples/CI-Eng-Sample/README.md index dab3942..5f84a03 100644 --- a/examples/CI-Eng-Sample/README.md +++ b/examples/CI-Eng-Sample/README.md @@ -60,6 +60,13 @@ cmd /c "\examples\CI-Eng-Sample\remove.cmd" | `CIENG_MB_LINE` | Modbus line (TCP/IP) | Equipment manager `EQPCIENG` (created and started by loading the line) | | `CIENG_PLC` | Modbus station | Open Modbus/TCP to `localhost:5020`, unit 1, output method *On change and connect* | | `CIENG_SCAN1S` | Modbus scan type | 1000 ms | +| `CI-Eng-Sample.UA` | Section | OPC UA loopback station | +| `CI-Eng-Sample.UA.COMM_OK` | Item, Boolean | Status item of station `CIENG_UA` (1 = connected) | +| `CI-Eng-Sample.UA.LEVEL_COPY` | Item, Real | `TANK1.LEVEL` read back through CI Server's own OPC UA server | +| `CI-Eng-Sample.UA.SRV_STATE` | Item, Integer | OPC UA server state node (ns 0, i=2259), 0 = Running | +| `CIENG_UA_LINE` | OPC UA client line | Client process `OPXCIENG` (created and started by loading the line) | +| `CIENG_UA` | OPC UA station | `opc.tcp://localhost:34493`, Basic256Sha256 / SignAndEncrypt, anonymous; subscription `CIENG_SUB` (1 s); points `LEVEL`, `SRV_STATE` | +| OPC visible | Flags | Sections `CI-Eng-Sample`, `TANK1` and item `TANK1.LEVEL` are OPC visible, item read-only (`12_opc_visible_df.qli`) | | `CIENG_VIEWER` | Authorization group | Read-only: `ITEM_READ`, `SECTION_READ`, `ALARM_CURRENT_READ`, `ALARM_CHRONO_READ`. No users are created by the sample. | Items created by objects (`TANK1.CALC.VOLUME`, `TANK1.JFLOW.sPerMin`) and their sections are @@ -80,6 +87,8 @@ New items start with status 13 (`NOT INIT`) until a value is written. | `05_trigger_df.qli`, `06_class_df.qli`, `07_object_df.qli` | Trigger group; classes (source in the `METHOD` memo, `@"` … `"@`, `COMPILE` 1; Traditional and Java); objects (`ATTR_VALUE_1` = prompt answer) | | `08_auth_group_df.qli` | Authorization group (`AUTH_GROUP_DF`) | | `09_modbus_line_df.qli`, `10_modbus_station_df.qli`, `11_item_eqp_df.qli` | Modbus line; station, scan type, points; items connected to points | +| `12_opc_visible_df.qli` | OPC visible / read flags (loaded with `dssqld -m`) | +| `13_opcua_line_df.qli`, `14_opcua_station_df.qli`, `15_item_opcua_df.qli` | OPC UA client line; station, subscription, points; connected items | | `equipment/eqpciengslv_start.cmd`, `_stop.cmd` | Start/stop the Modbus slave mirror (copy to `tls\com`) | | `80_`…`92_remove_*.qli` | Names to delete, in reverse order | | `load.cmd`, `remove.cmd` | Run the steps in the right order | @@ -101,6 +110,22 @@ start eqpmdcslvtcp -n EQPMDCSLVTCP -p 5020 Remove the two files from `tls\com` when the sample is removed. See skill `equipment`, task `modbus-station.md`. +## OPC UA loopback (station CIENG_UA) + +`CIENG_UA` is CI Server's OPC UA client connected to CI Server's own OPC UA server, so no +external server is needed. The **first** connection on a system needs a one-time certificate +exchange, done by the user (skill `data-access`, task `opcua-client.md` §4): + +1. After loading, the client logs `OPXC-E-CER_NO_TRU`; trust the server certificate in + `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` (Engineering Module, or move it to + `…\pkiclient\trusted\certs`). +2. The server then rejects the client; move `CI_SERVER_OPCUA_CLIENT_OPXCIENG […].der` from + `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\rejected` to `…\pkiserver\trusted\certs` + (PowerShell: `Move-Item -LiteralPath`, the name contains brackets). + +Then `UA.COMM_OK` = 1 and `UA.LEVEL_COPY` follows `TANK1.LEVEL`. The trust is kept when the +sample is removed and loaded again. + ## Monitoring processes (optional) `monitoring/` holds the lines to add to the setup files in `%TLS_ROOT_PATH%\tls\sup\` so that diff --git a/examples/CI-Eng-Sample/load.cmd b/examples/CI-Eng-Sample/load.cmd index bfa4197..58bf228 100644 --- a/examples/CI-Eng-Sample/load.cmd +++ b/examples/CI-Eng-Sample/load.cmd @@ -24,3 +24,12 @@ echo Waiting 15 seconds for equipment manager EQPCIENG to start... powershell -NoProfile -Command "Start-Sleep -Seconds 15" dssqld -i 10_modbus_station_df.qli -l 10_modbus_station_df.qlo dssqld -i 11_item_eqp_df.qli -l 11_item_eqp_df.qlo +rem OPC: make TANK1.LEVEL and its sections visible to OPC clients (modify existing records) +dssqld -m 12_opc_visible_df.qli -l 12_opc_visible_df.qlo +rem OPC UA loopback: client line (starts OPXCIENG), station/subscription/points, connected items. +rem The first connection needs a one-time certificate exchange (see README). +dssqld -i 13_opcua_line_df.qli -l 13_opcua_line_df.qlo +echo Waiting 10 seconds for OPC UA client OPXCIENG to start... +powershell -NoProfile -Command "Start-Sleep -Seconds 10" +dssqld -i 14_opcua_station_df.qli -l 14_opcua_station_df.qlo +dssqld -i 15_item_opcua_df.qli -l 15_item_opcua_df.qlo diff --git a/examples/CI-Eng-Sample/remove.cmd b/examples/CI-Eng-Sample/remove.cmd index c354c05..486236c 100644 --- a/examples/CI-Eng-Sample/remove.cmd +++ b/examples/CI-Eng-Sample/remove.cmd @@ -5,6 +5,9 @@ rem Order: object, class, trigger group, storage links, stop + delete storage gr rem A storage group with an active unit cannot be deleted (HIS-E-GROUPHASUNT), so the rem group first gets a stop time one minute ahead; the script waits until it has passed. cd /d "%~dp0" +dssqld -r 76_remove_item_opcua_df.qli -l 76_remove_item_opcua_df.qlo +dssqld -r 77_remove_opcua_station_df.qli -l 77_remove_opcua_station_df.qlo +dssqld -r 78_remove_opcua_line_df.qli -l 78_remove_opcua_line_df.qlo dssqld -r 80_remove_item_eqp_df.qli -l 80_remove_item_eqp_df.qlo dssqld -r 81_remove_modbus_station_df.qli -l 81_remove_modbus_station_df.qlo dssqld -r 82_remove_modbus_line_df.qli -l 82_remove_modbus_line_df.qlo -- 2.45.3 From 0444e72b234a1401166c7f15553872b0aa571139 Mon Sep 17 00:00:00 2001 From: cliu Date: Thu, 1 Oct 2026 10:46:28 +1000 Subject: [PATCH 3/5] Add data-access skill, BUS utilities task and licence run-time notes Co-Authored-By: Claude Opus 5.5 --- .claude/skills/data-access/SKILL.md | 39 ++++++ .../skills/data-access/tasks/access-checks.md | 24 ++++ .../skills/data-access/tasks/opcua-client.md | 128 ++++++++++++++++++ .claude/skills/equipment/SKILL.md | 1 + .claude/skills/system-check/SKILL.md | 6 + .claude/skills/system-management/SKILL.md | 5 +- .../system-management/tasks/bus-utilities.md | 51 +++++++ 7 files changed, 253 insertions(+), 1 deletion(-) create mode 100644 .claude/skills/data-access/SKILL.md create mode 100644 .claude/skills/data-access/tasks/access-checks.md create mode 100644 .claude/skills/data-access/tasks/opcua-client.md create mode 100644 .claude/skills/system-management/tasks/bus-utilities.md diff --git a/.claude/skills/data-access/SKILL.md b/.claude/skills/data-access/SKILL.md new file mode 100644 index 0000000..a28342d --- /dev/null +++ b/.claude/skills/data-access/SKILL.md @@ -0,0 +1,39 @@ +--- +name: data-access +description: >- + CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to + connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points, + certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC + DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints, + security policy, trusting client certificates, UaExpert), check why an OPC connection fails + (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM + tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server + (odbsrv, port 1583, SSL certificate). Sources IM 36K10L45-01EN, IM 36K10E20-01EN. +--- + +# Data access: OPC and ODBC (R1.03) + +Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server, +setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment +lines/stations/points in general: skill `equipment`. + +Rules: +- Run `system-check` first; follow the user's chosen way of working. +- **Trusting certificates is the user's decision.** Show the certificate (folder, file name, + common name) and let the user trust it (Engineering Module or moving the file); do not move + certificate files yourself. +- Making items OPC visible / writable exposes them to every OPC client on the network: only + with the user's approval, and prefer read-only. +- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected + node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine. +- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and + a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`). + +| Task | File | Status | +|---|---|---| +| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified | +| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs | +| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified | +| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) | +| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) | +| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs | diff --git a/.claude/skills/data-access/tasks/access-checks.md b/.claude/skills/data-access/tasks/access-checks.md new file mode 100644 index 0000000..0284b1a --- /dev/null +++ b/.claude/skills/data-access/tasks/access-checks.md @@ -0,0 +1,24 @@ +--- +task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server) +version: R1.03 +source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01 +status: verified +--- + +# ACCESS Service checks (read-only) + +| Check | How | Test system result | +|---|---|---| +| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running | +| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** | +| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) | +| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing | +| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on | +| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` | +| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` | +| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback | +| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `.log` | | + +Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key +with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup` +(unencrypted ODBC traffic — a security decision), then restart CI Server. diff --git a/.claude/skills/data-access/tasks/opcua-client.md b/.claude/skills/data-access/tasks/opcua-client.md new file mode 100644 index 0000000..18895c2 --- /dev/null +++ b/.claude/skills/data-access/tasks/opcua-client.md @@ -0,0 +1,128 @@ +--- +task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server) +version: R1.03 +source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared) +status: verified +--- + +# OPC UA client to an OPC UA server + +Worked example: CI-Eng-Sample station `CIENG_UA`, CI Server's OPC UA client reading +`CI-Eng-Sample.TANK1.LEVEL` back through CI Server's **own** OPC UA server +(`examples/CI-Eng-Sample/12_`–`15_*.qli`, removal `76_`–`78_`). For a real server, replace the +endpoint, security settings and node IDs. + +## 1. Server side: make the data visible + +On the CI Server OPC UA server an item is reachable only when the item has **OPC visible** and +**Read** (Write to allow writing) and every parent section is OPC visible +(`12_opc_visible_df.qli`, loaded with `dssqld -m`): + +``` +@FIELDS +NAME,OPC_VISIBLE + +@SECTION_DF +"CI-Eng-Sample",1 +"CI-Eng-Sample.TANK1",1 + +@FIELDS +NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE + +@ITEM_DF +"CI-Eng-Sample.TANK1.LEVEL",1,1,0 +``` + +Visible without Read: the item shows when browsing, but browsing into it fails +(`UncertainNotAllNodesAvailable`, client message `OPXC-E-BRW_NODE`; verified). By the manual, +Read is also what allows reading the value. +These flags also apply to the OPC DA and A&E servers. + +## 2. Client configuration (quick load, in this order) + +1. **Line** (`OPCUAC_LINE_DF`): loading it creates and starts the client process + `EQUIPMENT_MAN` (must start with `OPX`, ≤ 11 characters) — wait ~10 s before the station. + ``` + "CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG" + ``` +2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name + `:`), **points** (`OPCUAC_POINT_DF`, name `:`) — + see `14_opcua_station_df.qli`: + - Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`), + `MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`, + `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 = + connected). `SERVER_01_NAME`/`_URI` may stay empty. + - Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000. + - Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`), + `OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`, + `GUID`), `OPC_NODE_ID`. +3. **Items** (`ITEM_DF` with `STATION` and `POINT`), e.g. `CI-Eng-Sample.UA.LEVEL_COPY` → + `CIENG_UA`, `LEVEL`. + +## 3. Node IDs + +| Target | Namespace | Type | Node ID | +|---|---|---|---| +| Value of a CI Server item (by name — survives recreating the item) | `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` | STRING | `{"0":"Value","itnm":"
."}` | +| Value of a CI Server item (by namespace id) | same | STRING | `{"0":"Value","nsid":""}` | +| Server state (any OPC UA server; good connection test, 0 = Running) | `http://opcfoundation.org/UA/` | NUMERIC | `2259` | + +In a `.qli` file double the quotes inside the field: +`"{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"`. + +Pitfalls found on the test system: +- Namespace `http://www.yokogawa.com/CI_Server/` (the one the manual shows) holds only the + **types**; with it the point is silently not monitored (ISS-032). +- The Engineering Module's *Browse path* stops at the item and stores the **object** + (`{"nsid":""}`), which has no value: *Last value* stays empty, the item stays status 13. + Type the `Value` node ID by hand (ISS-033). +- `nsid` numbers change when the item is deleted and created again (e.g. sample reload). + +A point that is not accepted shows `REVISED_SAMPLING_INTERVAL` 0 in `OPCUAC_POINT_DF` and the +log line `Can't find Point [] in subscription` when changed; a monitored point gets the +revised interval (e.g. 1000). + +**Browse the server from the command line** (station connected): export `OPCUAC_TAG_DF` with +a filter; start with an empty path, then `Objects`: + +``` +@SELECT +'OPC_STATION_NAME = "CIENG_UA" and OPC_TAG_PATH = "Objects"' +@OPCUAC_TAG_DF +``` + +Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper +paths were not found yet (`Objects.CI-Eng-Sample` returned nothing). + +## 4. Certificate exchange (first connection; the user does it) + +| Step | Where it shows | What the user does | +|---|---|---| +| 1. Client rejects the server | `OPXC-E-CER_NO_TRU … BadCertificateUntrusted` in `umhlog.log`; file `.der` in `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` | Trust it: Engineering Module *OPC UA Client → Certificates → Rejected* → *Trusted*, or move the file to `…\pkiclient\trusted\certs` | +| 2. Server rejects the client | client log `BadSecurityChecksFailed`; file `CI_SERVER_OPCUA_CLIENT_ [].der` in `…\pki\opxuas\pkiserver\rejected` (folder created now) | Move it to `…\pki\opxuas\pkiserver\trusted\certs` | + +PowerShell: file names with `[ ]` need `-LiteralPath`, otherwise `Move-Item` silently does +nothing: + +```powershell +Move-Item -LiteralPath "\.der" -Destination "\" +``` + +The client retries every ~35 s (`OPXC_STATION_CON_TRY_INTERVAL` 30 s); then `OPXC-I-SRV_CONN` +and the status item goes to 1. Certificates and trust stay when the line is removed and loaded +again (verified: reload connected within 5 s without a new exchange). For an external server, +its certificate arrives the same way; the client certificate +(`…\pkiclient\own\certs\_.der`) must be trusted on that server. + +## 5. Check + +- `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9; + `UA.LEVEL_COPY` follows `TANK1.LEVEL` within ~1 s (verified 55, 62.5, 71, 33, 44.4). +- Client log: `%TLS_LOG_PATH%\.log` (`Successfully connected station`, errors with + status codes); server logs `OPXUAS.log`, `OpxUas_Sdk.log` (`CreateMonitoredItems`). +- Off-scan/on-scan: `OPCUAC_STATION_DF` `ON_SCAN` 0/1 with `dssqld -m` disconnects/reconnects. + +## 6. Remove + +Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the +client process). Reset the OPC flags only if they were not there before. diff --git a/.claude/skills/equipment/SKILL.md b/.claude/skills/equipment/SKILL.md index 7ebb4fd..d4d824d 100644 --- a/.claude/skills/equipment/SKILL.md +++ b/.claude/skills/equipment/SKILL.md @@ -31,4 +31,5 @@ Rules: | CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) | | Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified | | Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) | +| OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) | | Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) | diff --git a/.claude/skills/system-check/SKILL.md b/.claude/skills/system-check/SKILL.md index 007248c..98dddef 100644 --- a/.claude/skills/system-check/SKILL.md +++ b/.claude/skills/system-check/SKILL.md @@ -77,6 +77,12 @@ prompt. Setup files (`*.sup`) are plain text (CRLF); edit them with the Setup Fi (elevated): `Stop-Service StartCIServer` then `Start-Service StartCIServer`. Before a long task on an unlicensed system, note the start time (`(Get-Process ciserv).StartTime`) and restart first if the hour is nearly up. + Time left is in the health snapshots: `License time left : ` in + `%TLS_LOG_PATH%\smd__LOW_smdsnp_general.log` (3600 s after a start, −600 per 10 min); + `*** license problem : 3 ***` once it has run out. The count pauses while the PC sleeps + (observed 2026-10-01: a run started 17:25 ran out at 09:52 the next morning after a sleep); + some processes (e.g. `umh`) stay attached, but `dssqld`/`itmval` fail and the log shows + `ISF-F-LIC_PROB, DATABASE Service is not licensed`. ## 4. Time synchronization diff --git a/.claude/skills/system-management/SKILL.md b/.claude/skills/system-management/SKILL.md index c09ab1c..9f1df69 100644 --- a/.claude/skills/system-management/SKILL.md +++ b/.claude/skills/system-management/SKILL.md @@ -6,7 +6,9 @@ description: >- (dssqld, .qli), create sections or items in bulk, read or write item values or limits (itmval), load or import history, check database consistency (dsschk), monitor processes/CPU/disk/network, back up or migrate a system, tune or debug CI Server, or plan a system layout (standalone, separate portal, HAC, - host-to-host, enterprise) or time synchronization. Source IM 36K10J10-01EN. + host-to-host, enterprise) or time synchronization, check whether a CI Server process is + running (durwfp), stop a single process (durstp), read the message log (umhlog), or check + BUS Service queues (adaptive queues, dur.sup). Sources IM 36K10J10-01EN, IM 36K10L30-01EN. --- # System management (R1.03) @@ -31,3 +33,4 @@ Rules for every task: | Monitor CPU, disk, network, processes; run a command on an item change | `tasks/monitoring-processes.md` | verified | | Database consistency check (`dsschk`) | `tasks/consistency-check.md` | verified (check only) | | Tuning checks: limits and health snapshots | `tasks/tuning-checks.md` | verified (read-only) | +| BUS Service utilities: is a process attached (`durwfp`), stop one process (`durstp`), message tools, adaptive queues | `tasks/bus-utilities.md` | verified (`durwfp`, read-only checks); message tools fail (ISS-030) | diff --git a/.claude/skills/system-management/tasks/bus-utilities.md b/.claude/skills/system-management/tasks/bus-utilities.md new file mode 100644 index 0000000..a155b06 --- /dev/null +++ b/.claude/skills/system-management/tasks/bus-utilities.md @@ -0,0 +1,51 @@ +--- +task: BUS Service utilities - process checks, stopping single processes, message tools, adaptive queues +version: R1.03 +source: IM 36K10L30-01EN §1, §5, §6, §10, §14; checked on the test system 2026-10-01 +status: verified for durwfp and the read-only setup file checks; umhman, umhtestprog, umhmsg fail on the test system (ISS-030) +--- + +# BUS Service utilities + +Background: `knowledge/manuals/IM36K10L30-01EN.md`. + +## Is a CI Server process attached? + +`durwfp -p -t 0` → exit code **0** = attached (running), **1** = not. Without +`-t 0` it waits up to 60 s for the process to appear; `-e` waits for it to go away. Verified: +`umh`, `opcman`, `durm_1` → 0; unknown name → 1. Bash: `durwfp -p opcman -t 0; echo $?`. +DUR names are those given with `-n` (e.g. `OPXCIENG`, `EQPCIENG`, `opxuas`). + +## Stop or kill one process (only with the user's approval) + +`durstp -m -p ` sends a stop message (clean stop); `durstp -m -k -t 10 -p ` stops, +then kills after 10 s. `*` wildcards stop many processes (`-p alm\*`). Never `durstp -k -p \*` +(kills `durtim` and leaves DUR memory locked). Restart a process by hand with +` -n ` from `tls\exe` or by restarting CI Server. + +## Messages + +- Message log: `%TLS_LOG_PATH%\umhlog.log` (`--> From: () on