--- manual: IM 36K10L45-01EN title: Data Access Engineering edition: 3rd Edition, Sep. 2023 version: R1.03 status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs --- # Data Access Engineering (R1.03) ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on: skill `data-access`. ## 1. ODBC (§1–§3) - Multi-tier: ODBC application + driver manager + **SimbaClient** driver on the client; **SimbaServer** + ACCESS Service ODBC engine (`odbsrv`) on the CI Server. Read and write of existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be created or deleted over ODBC. Needs an ODBC licence. - `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate `%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`), `REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data (`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on). - Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium (`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or `CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts. - SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`. - Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not running / port mismatch / BUS Service not reachable. **Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder `%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so `odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set `USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry defaults once (when `%TLS_DAT_PATH%\access.new` exists). ## 2. OPC Classic basics (§4) DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`). - Quality: OPC DA quality goes to the **lower** 16 bits of the CI Server quality word, OPC A&E quality to the **upper** 16 bits. Item to OPC: CI Server quality low byte → OPC high byte; OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised → NOT_CONNECTED, else GOOD. - Types: `VT_UI1/UI2/INT/I1/I2/I4` → Integer, `VT_UI4/UINT/R4/R8` → Real, `VT_BSTR` → String, `VT_BOOL` → Boolean. - Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC visible* (and every parent section visible). ## 3. OPC DA client (§5) - One client process per DA line (name given in the line), started/stopped with CI Server; stop one with `durstp -msk -t10 -p `. Uses a save file in `%TLS_SAV_PATH%` named after the process; delete it (client stopped) if it gets inconsistent. - Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running, 2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group status item: 1 active / 0 not active (items offline). - Setup (`.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING` (ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT` (100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`, `…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8), `…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`. - Advice: one OPC server per client process (a DCOM time-out blocks the whole process). Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`, `POINT_DF` of one station made in the Engineering Module. - **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS, DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm__udp.sup`, port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon` node monitoring with *Set slave items offline when node unavailable*. ## 4. OPC DA server (§6) - COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.`, DUR name `OPXDAS`; started by COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown). - Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE pattern). *Cache read* is fast and correct; *device read* blocks — use only after queue overflow. Timestamp = time written into the server cache. - `opxsys.sup` *Data Access Server* tab: `OPXDAS_DUR_QSZ` (100 kB), `…_HBEAT`, `…_ITMBUF`, `OPXDAS_USER` (log on as a CI Server user to apply its authorisation; empty = full access, fastest), `OPXDAS_DCOM_TUN`, `OPXDAS_IGNORE_FTQ`. Installed also: `OPXDAS_SET_LOG_LEVEL` (not described). - Remote access needs DCOM configuration (`dcomcnfg`: authentication Connect, impersonation Identify, access/launch permissions for an OPC account; identity of the server = that account), `secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for `opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT Security Tool is applied. Same account/password on both sides in a workgroup. - Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`, `opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic), `regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first. ## 5. OPC A&E client and server (§7, §8) - Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `.sup` or `opxsys.sup` (`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`, `…_TRACE`); maps condition events to items; one server per client advised. - Server `opxaes`, ProgID `Yokogawa.CIOpcAes.`, DUR name `OPXAES`; publishes items with alarm monitoring as conditions; `OPXAES_ACK_ALLOWED` (acknowledge from clients), `…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the CI Server-specific event attributes (old/new value, quality, status, alarm state, item description, units, node, group, number, sub-number). Installed: all on. ## 6. OPC UA client (§9) - OPC UA TCP only; security by X.509 certificates (application authentication), user anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256, Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not). - Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good, 1 bad, 2 uncertain. - A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other events INFORMATIONAL; filters by event type, component, event node; severity → priority table (901–1000 → 1 … 1–100 → 15), per station; don't manage NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled. - Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold backup with two endpoints (*Active server item* 0/1/2). - Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11 characters), station (= session), subscription, point (= monitored item), alarm component / event type filter / event node / template settings, method. - Certificates: the client process creates `_.der` in `%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset `OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`, `rejected` added by CI Server. The server must trust the client's certificate too. - Setup (`.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats, buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\.log`. - Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF` (+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server (filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`). - Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`. ## 7. OPC UA server (§10) - Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log` and `OpxUas_Sdk*.log`. - Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read values, browse into the item) and **Write** (write values, alarm methods). Parent sections must be visible. Without Read the item is listed but browsing into it fails (`UncertainNotAllNodesAvailable`). - Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ` (browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods). - Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`, `…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`, `Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in `http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections, items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing; the manual does not name it, ISS-032). - NodeIds are JSON strings: `{"nsid":""}` for the entity, `{"0":"Value","nsid":""}` for its value; or by name: `{"0":"Value","itnm":""}` (case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`. `OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs. - Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH → BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority → severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03). - History: items in a history group show HistoryRead; max 5000 values per node per call. - Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal); external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM. - `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab (`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`, `…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`, `…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` = ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE` (manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034). - `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list `…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256, Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint); anonymous, user/password **and certificate** user tokens enabled (manual: certificate off, ISS-034); `AutomaticallyTrustAllClientCertificates` false. - First connection of any client: trust the server certificate on the client, then move the client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the suggested test client. - Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate management (concepts only). ## 8. RDBMS data exposure (not in this manual) IM 36K10L45 does not describe RDBMS data exposure; it is in the Tutorial (IM 36K10G10 ch. 10) and the item form (IM 36K10C10 §3.3). Summary here because it is an ACCESS-type interface; **tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical). Procedure: skill `data-access`, task `rdbms-exposure.md`. - Processes `DBCSND` (sender, subscribes to DSS data) and `DBCDEM` (receiver, writes to MS SQL Server via ODBC); setup file `dbc.sup` (sender and receiver tabs; connection string `DEM_CONNECTION`, default `Driver={SQL Server};Server=localhost\SQLEXPRESS;…`). - Exposures are records in `DATA_EXPOSURE_DF` (source dataset, remote table, filter `RECORDS`, up to 32 field → column pairs or all fields). The target table is created by CI Server. - `ITEM_VALUES` exposure is driven by the per-item aggregation interval `ITEM_DF.AGG_INTERVAL` (60 s–7 days, 0 = off): value, min, max, average, count and a local-time `TIMESTAMP` (seconds since 1970) per interval. - Filter field names must not be quoted (`NAME LIKE "
*"`); the manual's quoted example fails and stops all exposures (ISS-057). `ITEM_HISTORY` exposure: manual vs installed change log disagree (ISS-058). - The CI Service account `.\CIX_PROCESS` is local, so a remote SQL Server needs a SQL login and mixed mode (ISS-059).