---
name: data-access
description: >-
  CI Server R1.05 ACCESS Service: OPC UA, OPC DA, OPC A&E, ODBC and the RESTful API. Use when
  the user wants to connect CI Server to an OPC UA server (OPC UA client line, station,
  subscription, points, certificates, node IDs, browse, OPC UA methods MTD_KEY / MTD_TRG,
  OPCUAC_METHOD_CALL2_DF), let another application read CI Server data over OPC UA, OPC DA or
  OPC A&E (CI Server as OPC server, OPC visible / read / write, port 34493, endpoints, security
  policy, trusting client certificates, UaExpert, extended OPC UA functions for alarms, history
  and PubSub, OPC UA Information Model Mapper, NodeSet / imported information model), check why
  an OPC connection fails (BadCertificateUntrusted, BadSecurityChecksFailed, item stays NOT INIT,
  certificate expiry warning), configure DCOM or DCOM tunnelling for OPC Classic, use ODBC /
  SimbaClient / SQL on datasets, or check the ODBC server (odbsrv, port 1583, SSL certificate),
  use the RESTful API (jrstsrv, port 34597, API key, x-api-key), or copy item values and
  timestamps into Microsoft SQL Server with RDBMS data exposure (dbc.sup, DEM_CONNECTION, DBCSND,
  DBCDEM, DATA_EXPOSURE_DF, data exposure aggregation interval AGG_INTERVAL, ITEM_VALUES, SQL
  login, DSS-E-FLT_SYN_ERR). Sources IM 36K10L45-01EN, IM 36K10E20-01EN, IM 36K10G10-01EN ch. 10.
---

# Data access: OPC, ODBC, RESTful API and RDBMS data exposure (R1.05; first written for R1.03)

Background: `knowledge/manuals/IM36K10L45-01EN.md` (ODBC, RESTful API, OPC DA/A&E/UA client and
server, setup files), `IM36K10E20-01EN.md` (Engineering Module forms, certificates, Information
Model Mapper, PubSub). Equipment lines/stations/points in general: skill `equipment`.

Rules:
- Run `system-check` first; follow the user's chosen way of working.
- **Trusting certificates is the user's decision.** Show the certificate (folder, file name,
  common name) and let the user trust it (Engineering Module or moving the file); do not move
  certificate files yourself.
- Making items OPC visible / writable exposes them to every OPC client on the network: only
  with the user's approval, and prefer read-only. The same applies to the RESTful API (keep its
  read-only mode, the product default, unless the user decides otherwise).
- Never connect a CI Server OPC **DA or A&E** client to the same node's (or a DURM-connected
  node's) DA/A&E server: deadlock (IM 36K10L45 5th ed. §6.3). The OPC **UA** loopback is fine.
- **Extended OPC UA functions are off by default since R1.04.** The OPC UA server offers only
  Data Access and methods unless `OPXUAS_ENABLE_EXTENDED_FUNC = YES` in `opxuas.sup` (needed for
  Alarms & Conditions, HistoryRead and PubSub); the OPC UA client receives no alarms unless
  `OPXC_ENABLE_EXTENDED_FUNC = YES` in its `<process>.sup`. Both are `NO` on the R1.05 test
  server (verified 2026-10-08). Source: IM 36K10L45 5th ed. ch. 11 intro, §10.4, §10.11,
  §11.6.2, App. 1.3.
- Changing `opxsys.sup`, `opxuas.sup`, `<process>.sup`, `odbsrv.sup`, `jrstsrv.sup` or
  `ServerConfig.xml` needs admin rights and a restart: hand it to the user (skill
  `portal-setup`, task `change-setup-file.md`).
- The same applies to `dbc.sup` (RDBMS data exposure). SQL Server changes (mixed mode, logins,
  jobs) are on another system: only with the user's and the SQL Server owner's agreement.

| Task | File | Status |
|---|---|---|
| OPC UA client to an OPC UA server (sample: loopback to CI Server's own server): line, station, subscription, points, certificate exchange, node IDs, browse via dataset | `tasks/opcua-client.md` | verified on R1.03 and R1.05 (loopback re-tested 2026-10-08) |
| Make CI Server data available to OPC clients (OPC visible / Read / Write); CI Server OPC UA server endpoints, node IDs, certificates | `tasks/opcua-client.md` §1, §5 | verified on R1.03 (UA); DA/A&E from docs |
| Read-only checks: ACCESS processes, ports (34493, 1583, 34597), OPC UA server config and PKI, extended functions, certificate validity, ODBC server state | `tasks/access-checks.md` | verified on R1.05 (2026-10-08) |
| OPC UA client methods (`MTD_*` object, method form, `CIX_UAC_MTD` point) and R1.03 → R1.04 method upgrade | `tasks/opcua-client.md` §7 | from docs |
| OPC DA / A&E client and server, DCOM, DCOM tunnelling | L45 summary §3–§5 | from docs (DA loopback not allowed) |
| ODBC with SimbaClient | L45 summary §1 | from docs; ODBC server not running on the R1.03 and R1.05 test systems (ISS-008) |
| RESTful API (`jrstsrv`, port 34597, API key, functions) | L45 summary §9 | from docs; port and setup keywords verified on R1.05 |
| OPC UA alarms (external alarms), model change events, PubSub, imported information model / Information Model Mapper | L45 summary §6–§7, E20 summary §2–§5 | from docs |
| RDBMS data exposure to SQL Server: SQL login, `dbc.sup` `DEM_CONNECTION`, `DATA_EXPOSURE_DF` (filter syntax), item aggregation interval, checks, table behaviour, SQL-side retention | `tasks/rdbms-exposure.md` | tested in R1.05 only (`ITEM_VALUES`); `ITEM_HISTORY` / `ITEM_INPUTS` not tested |