.claude/skills/data-access/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: data-access
+description: >-
+  CI Server R1.03 ACCESS Service: OPC UA, OPC DA, OPC A&E and ODBC. Use when the user wants to
+  connect CI Server to an OPC UA server (OPC UA client line, station, subscription, points,
+  certificates, node IDs, browse), let another application read CI Server data over OPC UA, OPC
+  DA or OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints,
+  security policy, trusting client certificates, UaExpert), check why an OPC connection fails
+  (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT), configure DCOM or DCOM
+  tunnelling for OPC Classic, use ODBC / SimbaClient / SQL on datasets, or check the ODBC server
+  (odbsrv, port 1583, SSL certificate). Sources IM 36K10L45-01EN, IM 36K10E20-01EN.
+---
+
+# Data access: OPC and ODBC (R1.03)
+
+Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, OPC DA/A&E/UA client and server,
+setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, PubSub). Equipment
+lines/stations/points in general: skill `equipment`.
+
+Rules:
+- Run `system-check` first; follow the user's chosen way of working.
+- **Trusting certificates is the user's decision.** Show the certificate (folder, file name,
+  common name) and let the user trust it (Engineering Module or moving the file); do not move
+  certificate files yourself.
+- Making items OPC visible / writable exposes them to every OPC client on the network: only
+  with the user's approval, and prefer read-only.
+- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
+  node's) DA/A&E server: deadlock (manual §5.3). The OPC **UA** loopback is fine.
+- Changing `opxsys.sup`, `opxuas.sup`, `odbsrv.sup` or `ServerConfig.xml` needs admin rights and
+  a restart: hand it to the user (skill `portal-setup`, task `change-setup-file.md`).
+
+| Task | File | Status |
+|---|---|---|
+| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified |
+| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified (UA); DA/A&E from docs |
+| Read-only checks: ACCESS processes, ports, OPC UA server config and PKI, ODBC server state | `tasks/access-checks.md` | verified |
+| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
+| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the test system (ISS-008) |
+| OPC UA alarms (external alarms), methods, PubSub | L45 §6, E20 §2–§4 | from docs |

.claude/skills/data-access/tasks/access-checks.md

@@ -0,0 +1,24 @@
+---
+task: Read-only checks of ACCESS Service (OPC UA server, OPC clients, ODBC server)
+version: R1.03
+source: IM 36K10L45-01EN §1–§3, §6, §9, §10; practiced on the test system 2026-10-01
+status: verified
+---
+
+# ACCESS Service checks (read-only)
+
+| Check | How | Test system result |
+|---|---|---|
+| Processes | `tasklist` → `opxuas.exe` (UA server), `opxuac.exe` (one per OPC UA line + `opxuac_mon`), `opxdas12.exe` / `opxaes.exe` (only while a client is connected), `opxdac.exe`/`opxaec.exe` (per line); `durwfp -p <name> -t 0` → 0 = attached | `opxuas`, `opxuac` (`OPXUAC_MON`) running |
+| Ports | `netstat -ano` LISTENING: 34493 (OPC UA server), 1583 (ODBC), 135 (DCOM) | 34493 yes, 1583 **no** |
+| Start log | `%TLS_LOG_PATH%\ci_start.log`, `umhlog.log` | `InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed` + `Process ODBSRV exited unexpectedly` = ODBC server cannot load its certificate (ISS-008) |
+| ODBC settings | `tls\sup\odbsrv.sup` (`PORT`, `USESSL`), certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem` + key | `USESSL YES`, folder missing |
+| OPC UA server settings | `tls\sup\opxuas.sup`; endpoints and user tokens in `tls\exe\ServerConfig.xml` (ignore commented XML) | Endpoint `opc.tcp://[NodeName]:34493`; Basic256Sha256 / Aes128_Sha256_RsaOaep / Aes256_Sha256_RsaPss with Sign or SignAndEncrypt; anonymous, user/password, certificate tokens on |
+| OPC UA certificates | `%TLS_ALLUSERS_PATH%\pki\opxuas\pkiserver\{own,trusted,rejected,issuers}`; client `…\pki\opxuac\pkiclient\{own,trusted,rejected,deleted,issuers}`; dataset `OPCUAC_PKI_CERTIFICATES_DF` | Server own `ciserveruaserver.der` |
+| OPC Classic settings | `tls\sup\opxsys.sup` (tabs Alarm and Event Client, Data Access Server, Alarm & Event Server) | Defaults; `OPXAEC_SAFE_CON NO` |
+| OPC UA client config | export `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` | Only the sample loopback |
+| Logs | `%TLS_LOG_PATH%\OPXUAS.log`, `OpxUas_Sdk*.log`, `<UA client process>.log` | |
+
+Fixing the ODBC server (only if ODBC is licensed and wanted; admin): place a certificate and key
+with the names above in `%TLS_ROOT_PATH%\tls\pki\odbsrv\`, or set `USESSL = NO` in `odbsrv.sup`
+(unencrypted ODBC traffic — a security decision), then restart CI Server.

.claude/skills/data-access/tasks/opcua-client.md

@@ -0,0 +1,128 @@
+---
+task: OPC UA client to an OPC UA server by quick load (loopback to CI Server's own OPC UA server)
+version: R1.03
+source: IM 36K10L45-01EN §9, §10; IM 36K10E20-01EN §2; practiced on CI-Eng-Sample 2026-10-01 (station CIENG_UA; full remove/reload; point also configured in the Engineering Module by the user and compared)
+status: verified
+---
+
+# OPC UA client to an OPC UA server
+
+Worked example: CI-Eng-Sample station `CIENG_UA`, CI Server's OPC UA client reading
+`CI-Eng-Sample.TANK1.LEVEL` back through CI Server's **own** OPC UA server
+(`examples/CI-Eng-Sample/12_`–`15_*.qli`, removal `76_`–`78_`). For a real server, replace the
+endpoint, security settings and node IDs.
+
+## 1. Server side: make the data visible
+
+On the CI Server OPC UA server an item is reachable only when the item has **OPC visible** and
+**Read** (Write to allow writing) and every parent section is OPC visible
+(`12_opc_visible_df.qli`, loaded with `dssqld -m`):
+
+```
+@FIELDS
+NAME,OPC_VISIBLE
+
+@SECTION_DF
+"CI-Eng-Sample",1
+"CI-Eng-Sample.TANK1",1
+
+@FIELDS
+NAME,OPC_VISIBLE,OPC_READ,OPC_WRITE
+
+@ITEM_DF
+"CI-Eng-Sample.TANK1.LEVEL",1,1,0
+```
+
+Visible without Read: the item shows when browsing, but browsing into it fails
+(`UncertainNotAllNodesAvailable`, client message `OPXC-E-BRW_NODE`; verified). By the manual,
+Read is also what allows reading the value.
+These flags also apply to the OPC DA and A&E servers.
+
+## 2. Client configuration (quick load, in this order)
+
+1. **Line** (`OPCUAC_LINE_DF`): loading it creates and starts the client process
+   `EQUIPMENT_MAN` (must start with `OPX`, ≤ 11 characters) — wait ~10 s before the station.
+   ```
+   "CIENG_UA_LINE","CI-Eng-Sample OPC UA loopback line","OPXCIENG"
+   ```
+2. **Station** (`OPCUAC_STATION_DF`), **subscription** (`OPCUAC_SUBSCRIPTION_DF`, name
+   `<station>:<subscription>`), **points** (`OPCUAC_POINT_DF`, name `<station>:<point>`) —
+   see `14_opcua_station_df.qli`:
+   - Station: `LINE`, `USER_ANONYMOUS` 1 (or `USER_NAME`/`USER_PASSWORD`),
+     `MSG_SECURITY_01_MODE` `SignAndEncrypt`, `MSG_SECURITY_01_POLICY` `Basic256Sha256`,
+     `SERVER_01_ENDPOINT` `opc.tcp://localhost:34493`, `STATUS_ITEM` (Boolean item, 1 =
+     connected). `SERVER_01_NAME`/`_URI` may stay empty.
+   - Subscription: `REQUESTED_PUBLISH_INTERVAL` 1000.
+   - Point: `SUBSCRIPTION`, `EXTERNAL_RELATION` (`Input`, `Output`, `Input + Output`),
+     `OPC_NAMESPACE` (namespace **URI**, not index), `OPC_NODE_ID_TYPE` (`STRING`, `NUMERIC`,
+     `GUID`), `OPC_NODE_ID`.
+3. **Items** (`ITEM_DF` with `STATION` and `POINT`), e.g. `CI-Eng-Sample.UA.LEVEL_COPY` →
+   `CIENG_UA`, `LEVEL`.
+
+## 3. Node IDs
+
+| Target | Namespace | Type | Node ID |
+|---|---|---|---|
+| Value of a CI Server item (by name — survives recreating the item) | `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER` | STRING | `{"0":"Value","itnm":"<Section>.<Tag>"}` |
+| Value of a CI Server item (by namespace id) | same | STRING | `{"0":"Value","nsid":"<n>"}` |
+| Server state (any OPC UA server; good connection test, 0 = Running) | `http://opcfoundation.org/UA/` | NUMERIC | `2259` |
+
+In a `.qli` file double the quotes inside the field:
+`"{""0"":""Value"",""itnm"":""CI-Eng-Sample.TANK1.LEVEL""}"`.
+
+Pitfalls found on the test system:
+- Namespace `http://www.yokogawa.com/CI_Server/` (the one the manual shows) holds only the
+  **types**; with it the point is silently not monitored (ISS-032).
+- The Engineering Module's *Browse path* stops at the item and stores the **object**
+  (`{"nsid":"<n>"}`), which has no value: *Last value* stays empty, the item stays status 13.
+  Type the `Value` node ID by hand (ISS-033).
+- `nsid` numbers change when the item is deleted and created again (e.g. sample reload).
+
+A point that is not accepted shows `REVISED_SAMPLING_INTERVAL` 0 in `OPCUAC_POINT_DF` and the
+log line `Can't find Point [<point>] in subscription` when changed; a monitored point gets the
+revised interval (e.g. 1000).
+
+**Browse the server from the command line** (station connected): export `OPCUAC_TAG_DF` with
+a filter; start with an empty path, then `Objects`:
+
+```
+@SELECT
+'OPC_STATION_NAME = "CIENG_UA" and OPC_TAG_PATH = "Objects"'
+@OPCUAC_TAG_DF
+```
+
+Each record shows display name, namespace URI and node ID (inside `OPC_TAG_INFO`). Deeper
+paths were not found yet (`Objects.CI-Eng-Sample` returned nothing).
+
+## 4. Certificate exchange (first connection; the user does it)
+
+| Step | Where it shows | What the user does |
+|---|---|---|
+| 1. Client rejects the server | `OPXC-E-CER_NO_TRU … BadCertificateUntrusted` in `umhlog.log`; file `<thumbprint>.der` in `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\rejected` | Trust it: Engineering Module *OPC UA Client → Certificates → Rejected* → *Trusted*, or move the file to `…\pkiclient\trusted\certs` |
+| 2. Server rejects the client | client log `BadSecurityChecksFailed`; file `CI_SERVER_OPCUA_CLIENT_<PROCESS> [<thumbprint>].der` in `…\pki\opxuas\pkiserver\rejected` (folder created now) | Move it to `…\pki\opxuas\pkiserver\trusted\certs` |
+
+PowerShell: file names with `[ ]` need `-LiteralPath`, otherwise `Move-Item` silently does
+nothing:
+
+```powershell
+Move-Item -LiteralPath "<rejected folder>\<file>.der" -Destination "<trusted folder>\"
+```
+
+The client retries every ~35 s (`OPXC_STATION_CON_TRY_INTERVAL` 30 s); then `OPXC-I-SRV_CONN`
+and the status item goes to 1. Certificates and trust stay when the line is removed and loaded
+again (verified: reload connected within 5 s without a new exchange). For an external server,
+its certificate arrives the same way; the client certificate
+(`…\pkiclient\own\certs\<host>_<PROCESS>.der`) must be trusted on that server.
+
+## 5. Check
+
+- `itmval -g -n CI-Eng-Sample.UA.COMM_OK` → 1; `UA.SRV_STATE` → 0 status 9;
+  `UA.LEVEL_COPY` follows `TANK1.LEVEL` within ~1 s (verified 55, 62.5, 71, 33, 44.4).
+- Client log: `%TLS_LOG_PATH%\<PROCESS>.log` (`Successfully connected station`, errors with
+  status codes); server logs `OPXUAS.log`, `OpxUas_Sdk.log` (`CreateMonitoredItems`).
+- Off-scan/on-scan: `OPCUAC_STATION_DF` `ON_SCAN` 0/1 with `dssqld -m` disconnects/reconnects.
+
+## 6. Remove
+
+Items (`76_`), then points, subscription, station (`77_`), then the line (`78_`, stops the
+client process). Reset the OPC flags only if they were not there before.

.claude/skills/equipment/SKILL.md

@@ -31,4 +31,5 @@ Rules:
 | CI Server as Modbus slave (mirror `eqpmdcmem` + `eqpmdcslvtcp`) | `tasks/modbus-station.md` §1 | verified (by hand and via start file after a restart) |
 | Read-only equipment manager status with `eqpdbg` | `system-management` task `tuning-checks.md` | verified |
 | Forced scan (`eqpfrcscn`), hourly statistics (`eqpiostat`) | L40 summary | from docs (statistics empty, ISS-021) |
+| OPC UA client lines/stations/points (also OPC DA/A&E) | skill `data-access`, task `opcua-client.md` | verified (OPC UA loopback) |
 | Other protocols | L41 summary §3.8–3.40 | from docs (no hardware) |

.claude/skills/system-check/SKILL.md

@@ -77,6 +77,12 @@ prompt. Setup files (`*.sup`) are plain text (CRLF); edit them with the Setup Fi
   (elevated): `Stop-Service StartCIServer` then `Start-Service StartCIServer`. Before a long
   task on an unlicensed system, note the start time (`(Get-Process ciserv).StartTime`) and
   restart first if the hour is nearly up.
+  Time left is in the health snapshots: `License time left : <s>` in
+  `%TLS_LOG_PATH%\smd_<node>_LOW_smdsnp_general.log` (3600 s after a start, −600 per 10 min);
+  `*** license problem : 3 ***` once it has run out. The count pauses while the PC sleeps
+  (observed 2026-10-01: a run started 17:25 ran out at 09:52 the next morning after a sleep);
+  some processes (e.g. `umh`) stay attached, but `dssqld`/`itmval` fail and the log shows
+  `ISF-F-LIC_PROB, DATABASE Service is not licensed`.
 
 ## 4. Time synchronization
 

.claude/skills/system-management/SKILL.md

@@ -6,7 +6,9 @@ description: >-
   (dssqld, .qli), create sections or items in bulk, read or write item values or limits (itmval), load or import history,
   check database consistency (dsschk), monitor processes/CPU/disk/network, back up or migrate
   a system, tune or debug CI Server, or plan a system layout (standalone, separate portal, HAC,
-  host-to-host, enterprise) or time synchronization. Source IM 36K10J10-01EN.
+  host-to-host, enterprise) or time synchronization, check whether a CI Server process is
+  running (durwfp), stop a single process (durstp), read the message log (umhlog), or check
+  BUS Service queues (adaptive queues, dur.sup). Sources IM 36K10J10-01EN, IM 36K10L30-01EN.
 ---
 
 # System management (R1.03)
@@ -31,3 +33,4 @@ Rules for every task:
 | Monitor CPU, disk, network, processes; run a command on an item change | `tasks/monitoring-processes.md` | verified |
 | Database consistency check (`dsschk`) | `tasks/consistency-check.md` | verified (check only) |
 | Tuning checks: limits and health snapshots | `tasks/tuning-checks.md` | verified (read-only) |
+| BUS Service utilities: is a process attached (`durwfp`), stop one process (`durstp`), message tools, adaptive queues | `tasks/bus-utilities.md` | verified (`durwfp`, read-only checks); message tools fail (ISS-030) |

.claude/skills/system-management/tasks/bus-utilities.md

@@ -0,0 +1,51 @@
+---
+task: BUS Service utilities - process checks, stopping single processes, message tools, adaptive queues
+version: R1.03
+source: IM 36K10L30-01EN §1, §5, §6, §10, §14; checked on the test system 2026-10-01
+status: verified for durwfp and the read-only setup file checks; umhman, umhtestprog, umhmsg fail on the test system (ISS-030)
+---
+
+# BUS Service utilities
+
+Background: `knowledge/manuals/IM36K10L30-01EN.md`.
+
+## Is a CI Server process attached?
+
+`durwfp -p <DUR name> -t 0` → exit code **0** = attached (running), **1** = not. Without
+`-t 0` it waits up to 60 s for the process to appear; `-e` waits for it to go away. Verified:
+`umh`, `opcman`, `durm_1` → 0; unknown name → 1. Bash: `durwfp -p opcman -t 0; echo $?`.
+DUR names are those given with `-n` (e.g. `OPXCIENG`, `EQPCIENG`, `opxuas`).
+
+## Stop or kill one process (only with the user's approval)
+
+`durstp -m -p <name>` sends a stop message (clean stop); `durstp -m -k -t 10 -p <name>` stops,
+then kills after 10 s. `*` wildcards stop many processes (`-p alm\*`). Never `durstp -k -p \*`
+(kills `durtim` and leaves DUR memory locked). Restart a process by hand with
+`<exe> -n <name>` from `tls\exe` or by restarting CI Server.
+
+## Messages
+
+- Message log: `%TLS_LOG_PATH%\umhlog.log` (`--> From: <PROCESS> (<node>) on <time>`, then
+  `FAC-S-CODE, text` lines). `UMH Message Text Error: Message number <hex> (…)` = the text
+  could not be formatted (e.g. `%` in a PRINT text, ISS-025).
+- `umhman` (hex code → text), `umhtestprog` (test the log path) and `umhmsg <hex> [<var>
+  <value>]` (log a message from a script) **did not work on the test system**: `umhman`
+  crashes with redirected input (run it interactively), `umhtestprog` crashes, `umhmsg` stops
+  with `license expired` on the unlicensed node (ISS-030).
+
+## Adaptive queues (read-only check)
+
+`tls\sup\dur.sup`, tab *Adaptive queues*: `ADAPTIVE_QUEUE_SETS = <process>, <percent>`
+(wildcard `*` allowed, max 40 %). Installed: `ALM` 10, `ALH` 10, `WFLGDI` 20, `WFLCDI`,
+`WFLIDI`, `WFLADI`, `ITHEIX`, `ITHSER` 2, `DSSSDA*`, `DSSEVT*`, `OPCEXE` 1. Add entries for
+new busy processes (extra executors, equipment managers, custom processes); `OPCEXE` without
+`*` may not cover the installed `OPCEXE1`…`4` (ISS-026). Changing `dur.sup` needs admin and a
+restart (skill `portal-setup`). Queue use per process: health snapshots
+(`tuning-checks.md`) or the performance monitor (*Minimum/Maximum/Current KB*, high queue
+100 % = the queue had to grow → raise its size).
+
+## Node links (MDUR)
+
+`tls\sup\durm_<line>_udp.sup` and `tls\com\durm_start.cmd`; single-node installs still run
+`durm_1` (`durm_1_udp.sup`: line 1, quality 500, port 17001). Multi-node set-up is in the L30
+summary §2; not practiced (one node).