ci-server-engineer/knowledge/manuals/IM36K10R10-01EN.md

---
manual: IM 36K10R10-01EN
title: CI Portal Setup
edition: 5th Edition, Feb. 2026 (first written from the 3rd Edition, Sep. 2023)
version: R1.05 (first written for R1.03)
status: from docs; setup file names, keywords and default values checked read-only on the R1.03 test system (2026-09-30) and on the R1.05 test server (2026-10-08); separate CI Portal node not tested (both test systems are single nodes)
---

# CI Portal Setup (R1.05)

How the user-interface programs reach CI Server data, when to use CI Portal or CI View, how
to set up a CI Portal node, and the setup files of the user interface. Section numbers refer
to the manual. "Seen on test system" values come from the R1.03.00 test machine
(standalone node) and are the installed defaults there; R1.05 differences are marked.

**R1.03 to R1.05 (full text diff, 2026-10-08):** section numbering unchanged. R1.04 (4th
Edition): §3.1 installs from an ISO file instead of the DVD (not in the revision table,
ISS-108) and §3.3 gained a link to BUS Service Engineering (listed as "3.3 Updated
descriptions"; the `dur.sup` figure may also have changed, figures are not compared).
R1.05 (5th Edition): contact information only. Installed files: `dur.sup` and `jwuiisg.sup`
gained keywords the manual does not describe (§3, §4.3; ISS-109 to ISS-112); the WFL
files, `jwuiged.sup` and `jwuiaan.sup` are unchanged and `jhmiset.sup` differs only in
spacing.

## 1. User-interface processes

**Operator interface (§1.1)**
- A display is loaded by both the operator interface (`JWUIPOI`) and the Web-HMI server
  (`JWUIISG`). Only the display being shown gets live updates.
- `JWUIISG` does not talk to the CI Server processes directly; it goes through the four
  **WFL** (Web Foundation Layer) processes on the local node:
  - `WFLADI`: alarms
  - `WFLIDI`: real-time item values and status
  - `WFLCDI`: trend/history data
  - `WFLGDI`: everything else
- At startup `JWUIISG` reads the component descriptions (XML) in
  `%TLS_WAP_PATH%\cfg\operatorInterfaces\deploy\components`.
- Values and alarms are polled every 50 ms (`jwuiisg.sup`, *Tuning*). Configuration data of
  items on the display (alarm colours, mnemonics, …) is **cached** while the display is
  open and dropped 20 s after it closes (`wflidi.sup`, *Clear cache after*).
- **Consequence:** after changing a display (Edit Module) or an item definition
  (Engineering Module), the operator interface may still show the old data. To see the
  change: close the display (or the operator interface) for longer than the cache time,
  restart USER Service from the performance monitor, or restart CI Server. The Edit Module
  has its own cache (e.g. List Items) that cannot be tuned.
- From CI View (Remote Connect) the same processes are used; visualisation data passes
  through a servlet.

**Engineering Module / Edit Module (§1.2)**: opened on CI Portal they read displays and items
directly from disk; opened from CI View they go through servlets (JDSS, JGIN) to the database.

## 2. CI Portal and CI View

**CI Portal (§2.1)** runs on the CI Core node or on its own node.
- Needs the CI Server software, a **CI Portal licence** and a **DURM** connection to CI Core.
- Runs BUS, DATABASE, USER and INTEGRATION Services locally.
- Connects to **one** CI Core only (except in an enterprise configuration).
- Advantages over CI View:
  1. Quick load (`dssqld`) and other command-line tools can be used there (CI View only has
     the Engineering Module).
  2. Its own processes, DURM links and disks can be monitored (`int*.sup`).
  3. After a HAC switchover DURM reconnects to the active server automatically; CI View must
     be reconnected by hand to the active computer's IP address.
  4. Display, symbol and layout files are local files (layouts can only be edited as text).
- Costs: needs a dedicated computer; displays changed on one CI Portal must be copied to
  every other CI Portal.

**CI View (§2.2)** is any PC with **Remote Connect**, which runs the operator interface, Edit
Module and Engineering Module as Java applications.
- Download page: `http://<portal>:8080/`. Traffic is then secured over **8443** (HTTPS) by
  default; ports are set in `jwuiisg.sup`. `http://localhost:8080/` on the portal itself is
  not secure. Open both ports in the firewall.
- Start-menu entries ask for the CI Portal host name or IP address; no port is needed.
- Each CI Portal includes **one** USER Service client licence, i.e. one operator interface at
  a time (on the portal or a CI View). More simultaneous operator interfaces need more client
  licences. Edit and Engineering Modules from CI View need none.
- CI View plays sound only from a display's sound component, not from ALDACO (which sounds on
  the CI Core computer).

**Choosing (§2.3)** — rules of thumb:

| System | Recommendation |
|---|---|
| < 8000 I/O, no HAC, < 5 operator stations, no portal-only functions | CI View only |
| < 8000 I/O with HAC | at least one CI Portal (on its own node, so CI Views need not follow switchovers), CI View for the rest |
| Portal-only functions needed | CI Portal |
| ≥ 8000 I/O | at least one CI Portal; one portal serves more than 25 CI Views |

## 3. Setting up a CI Portal node

1. Install CI Server (§3.1): R1.04 and later run setup from the product ISO file mounted on
   the computer (R1.03: from the DVD). Setup always installs everything; the licence
   decides the package.
2. Apply the **CI Portal licence** with the License Authorization Wizard; the licence decides
   the package (§3.2).
3. Configure the DURM line to CI Core and set the **host node** (CI Core node number) in
   `dur.sup` (`host_node`, label *Host node*, on the editor's *General* tab; 0 on a
   single-node system) (§3.3). R1.04 and later point to IM 36K10L30 ch. 3 (inter-node
   communication) for the connection itself.
4. Restart CI Server on the portal (§3.4).
5. Copy the visualisations from CI Core or another portal into
   `%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (sub-folders seen on test system:
   `components`, `displays`, `layouts`, `locales`, `symbols`, `thresholds`).

DURM lines and node layouts: `IM36K10J10-01EN.md` (system layouts) and phase 7 (BUS Service).

**Gateway core (R1.04 and later; not in this manual, ISS-109).** The installed `dur.sup`
has a new switch `gateway_core` (label *Gateway Core*, *General* tab, installed `No`).
IM 36K10J10 §3.2.6 (5th Edition) describes the gateway configuration: a CI Core with a
gateway licence collects and passes on data but has **no operator interface**, neither on
itself nor on a CI Portal or CI View connected to it. The switch must match the licence;
otherwise a mismatch message goes to the message log (UMHLOG). A regular CI Core connected
to a gateway core keeps its operator interface. Also new in the R1.05 `dur.sup`: an adaptive
queue set for `ADTSTO` (1.00). From docs; the R1.05 test server is a regular single node
(`gateway_core = No`, `host_node = 0`).

## 4. User-interface setup files (§4)

Edited with the Setup File Editor (`IM36K10R20-01EN.md`); normally only the logon method
needs changing. Changes take effect after a restart of CI Server (the proxy service needs a
CI Portal restart). All files are in `%TLS_ROOT_PATH%\tls\sup`.

| File | Program | Tabs | Main keywords (seen on test system) |
|---|---|---|---|
| `jhmiset.sup` | Engineering Module | Item Search Utility, Report viewing and printing, Tuning | `JHMI_ISU_ONLY_PA = N` (item search limited to the user's process areas), `VIEW_FONT`/`VIEW_FONT_SIZE = Courier`/`12`, `PRINT_FONT`/`PRINT_FONT_SIZE = Courier`/`8`, `PRINT_ORIENTATION = Portrait`, `JBUS_MSG_FETCH_INTERVAL = 50`, `JDSS_MSG_FETCH_INTERVAL = 100` (ms) |
| `jwuiged.sup` | Edit Module | Tuning | `JBUS_MSG_FETCH_INTERVAL = 50`, `JDSS_MSG_FETCH_INTERVAL = 100` |
| `jwuiisg.sup` | Web-HMI server (operator interface, CI View) | Information, General, Client communication, Enterprise, Tuning, Compatibility, Mobile Operator, Proxy Service, Security; R1.05 adds *Access Control* | see below |
| `wfla_display.sup` | Alarm item/display relation (§4.4.1) | General, Debug (General = keywords before the first `!TAB`, ISS-015) | `RELATION_LOCATION = Location of item`, `DISPLAY_LOCATION = Location as Relation Location`, `DUR_QUEUE_SIZE = 1000`, `TIME_OUT_SEC = 60`, `TIMER_INTERVAL = 10` |
| `wfladi.sup` | WFLADI alarm destination (§4.4.2) | General | `EVENTS = alarm,repeat,ackn,deact,info,recov,diag,firstup` |
| `wflcdi.sup` | WFLCDI trend/history (§4.4.3) | General, Time, Debug | `HIST_NODE = -1`, `BUFFER_SIZE = 50` (MB), `TIME_OUT_SEC = 60`, `TIMER_INTERVAL = 10` |
| `wflgdi.sup` | WFLGDI miscellaneous (§4.4.4) | none | `ALERT_POPUP = YES`, `REPORT_UNAVAILABLE_ITEMS = YES`, `DUR_QUEUE_SIZE = 252`, `LOGGING_SIZE = 0`, `LOGGING_LEVEL = 0 None`, `DEBUG = NO` |
| `wflidi.sup` | WFLIDI item information (§4.4.5) | General, Scan | `FLOW_CONTROL = 30`, `TIMER = 20` (clear cache), `LOCK_TIMEOUT = 60`, `SCAN_TIME = 0`, `RETRY_COUNT = 3`, `QUEUE_BUSY_LEVEL = 10`, `DUR_QUEUE_SIZE = 500`, `NODE = -1, 1000, 0.1, 30` |

Where the manual and the installed software differ, this repo follows the **installed
files** (user decision 2026-09-30):
- The relation file is `wfla_display.sup`; the manual says `wfla_displays.sup` (ISS-012).
- Installed values are given as the defaults: `wfla_display` queue 1000 kB (manual 500),
  `wflgdi` queue 252 kB (manual 1000), `TIMER_INTERVAL = 10` in `wfla_display`/`wflcdi`
  (manual: 1 s when not set) (ISS-013). `wflcdi` buffer is 50 MB; the manual's 5 MB is only
  a sizing example.
- `jwuiisg.sup` has a *Security* tab not in the manual; described below from the file's
  own help (ISS-014).
- `wfla_display.sup` defines only a *Debug* tab in the file, but the editor shows the other
  settings on a *General* tab, as the manual shows (ISS-015, checked in the GUI).

Other `wfl*.sup` files (`wfldts`, `wflini`, `wflmap`, `wflpti`) are not described in the
manual. On R1.05 they are identical to R1.03 except `wflini.sup`, which holds
node-specific licence data written at install time.

Checked in the R1.03 Setup File Editor (2026-09-30): `wfla_display.sup`, `wflgdi.sup` and all
nine tabs of `jwuiisg.sup` show exactly the fields and values in the files, in the order
of their `!KEYWORD` blocks. String values are shown without their quotes. Both *Tuning*
fields are labelled "Event fetch interval": the first is `JBUS_MSG_FETCH_INTERVAL`, the
second `JDSS_MSG_FETCH_INTERVAL`. The R1.05 editor (ten tabs in `jwuiisg.sup`) is not yet
checked in the GUI (ISS-112, ISS-113).

### jwuiisg.sup (§4.3)

The file's *Information* tab says the **login method and login control settings have moved
to `dssana.sup`** (authentication and authorization setup file), so in R1.03 the logon
setup mentioned in §4 is not in `jwuiisg.sup` (ISS-017). Same *Information* text in R1.05.

| Tab | Keyword (test system value) | Meaning |
|---|---|---|
| General | `STORE_ITEM_IDS_IN_DISPLAYS = YES` | Store internal item/signal IDs in display and symbol files when validated: faster. Set NO when one portal may be switched between CI Cores that have the same item names (IDs differ per core), so displays need not be re-validated. |
| | R1.05: `SERVER_FILE_CACHE = 0` | Not in the manual (ISS-110); from the file's help: how long (ms) the web server caches remote files; 0 = no cache |
| Client communication | R1.05: `HTTP_TO_HTTPS_REDIRECT = NO` | Not in the manual (ISS-110): YES redirects HTTP requests to HTTPS |
| | `SECURE_PORT_NUMBER = 8443`, `NON_SECURE_PORT_NUMBER = 8080` | HTTPS / HTTP ports for clients |
| | `REQUEST_HEADER_SIZE = 8192` | Request header size |
| | `CLIENT_QUEUE = 10000` | Messages buffered while a client cannot receive; too small → lost real-time data on reconnect. Check the *Failed* column of `jwuiisg` in the performance monitor. |
| | R1.05: `RECONNECT_TIMEOUT_OVERRIDE` (no active line, not in `!DEFAULT`) | Not in the manual (ISS-110); from the file's help: seconds the server keeps buffering for a client whose connection dropped, so it can reconnect; 0 = use the value the client asks for (client default 300 s) |
| Enterprise | `PRIMARY_DATA_LOCATION = "$display$"` | Where to look for item attributes/object signals not specified in the display: node name/number, `$host$` (portal the operator interface is connected to) or `$display$` (portal the display was loaded from, default). A secondary location (default none) is used for enterprise displays only. |
| Tuning | `JBUS_MSG_FETCH_INTERVAL = 50`, `JDSS_MSG_FETCH_INTERVAL = 100` | Polling of BUS Service and DSS event queues (ms) |
| Compatibility | `R1001_COMPATIBLE_NUMBER_HANDLING = NO`, `APPLY_TEXT_SMOOTHING = NO` | Number handling (from the file's help; the manual gives none): YES = R10.01 behaviour, numbers shown and parsed in Java notation (e.g. `12345.67`) unless a format string is used; NO = the user's locale format. Text smoothing keeps labels in grouped symbols the same size when scaled |
| Mobile Operator | `MO_CACHE_DISPLAYS = YES`, `MO_CACHE_SYMBOLS = YES`, `MO_SHAPE_RENDERING = AUTO`, `MO_BUFFER_MS = 200` | Browser caching of displays/symbols (memory vs network load). From the file's help (not in the manual): *Shape rendering* is the SVG rendering trade-off — `AUTO` (balanced, favours precision), `OPTIMIZE_SPEED` (may turn off anti-aliasing), `CRISP_EDGES`, `GEOMETRIC_PRECISION`; *Buffer alarms timer* (ms) is how long alarms are buffered before being drawn — raise it for large alarm bursts |
| Proxy Service | (none set) | Alias, remote WMS URL, optional HTTP proxy address/port for the Edit Module map viewer (IM 36K10C50 §2.37). Needs a portal restart. |
| Security | `SECURITY_ENABLED = YES`, `CORS_ENTRY = <parameter>, <value>` (repeated), `HEADER_ENTRY = <action>, <header>, <value>` | Not in the manual (ISS-014); from the file's help: YES applies the CORS and header settings, NO uses server defaults. CORS parameters: `allowedOrigins` (installed `"*"` = all origins), `allowedTimingOrigins`, `allowedMethods` (`GET;POST;HEAD`), `allowedHeaders`, `preflightMaxAge` (1800), `allowCredentials`, `exposedHeaders`, `chainPreflight`. Header actions `set`, `add`, `setDate`, `addDate`. A third frame, *Content Security Policy (CSP)* (`CSP_ENTRY = <directive>, <value>`, directives such as `default-src`, `script-src`, `frame-ancestors`). **R1.03** installed only `set, X-Frame-Options, "sameorigin"` and no CSP. **R1.05** (ISS-111) installs seven headers (`X-Content-Type-Options nosniff`, `X-Frame-Options sameorigin`, `Strict-Transport-Security max-age=31536000;includeSubDomains`, `X-XSS-Protection 1;mode=block`, `Cache-Control no-store`, `Referrer-Policy no-referrer`, `X-Permitted-Cross-Domain-Policies none`; the header choice list gained `Cache-Control`, `Pragma`, `Referrer-Policy`) and nine CSP entries that allow scripts, fonts and images only from the server itself (plus inline/eval scripts and `data:` images/fonts). Verified in the HTTP responses on 8080 and 8443 (2026-10-08). Content from other hosts in displays (e.g. web components, external images) may be blocked by this policy; not tested. |
| Access Control (R1.05) | `RESTRICT_IP_ACCESS = NO`, `HOSTNAME_WHITELISTING = "*"` (repeatable) | Not in the manual (ISS-110); from the file's help: restrict web-server access by IP (the file has no keyword listing allowed addresses; effect unclear, ISS-112); answer only requests for the listed host names (`"*"` = any; the help recommends listing only the allowed names). |

### WFL process files (§4.4)

- **Alarm item/display relation** (`wfla_display.sup`, also set in the Engineering Module;
  keywords `RELATION_LOCATION`, `RELATION_NODE`, `DISPLAY_LOCATION`, `DISPLAY_NODE`):
  lets an operator open the display linked to an item from the alarm overview. Choose where
  the relation database is (location of item, host, CI Portal, or a given node) and where
  the display is (as the relation, location of item, host, CI Portal, or a given node).
  Also DUR queue size, response timeout from `ith` (60 s), timer resolution, stdout debug.
- **Alarm destination** (`wfladi.sup`): which alarm event types an alarm overview shows —
  DIRECT, ALARM, REPEAT, ACKN, INFO, DEACT, RECOV, DIAG, QUAL, PRIO, FFIRSTUP — plus an
  optional alarm selection area, the node running the alarm process, and an optional alarm
  destination manager (node + process). An alarm overview component can point to this
  file or a copy of it (Edit Module, component property *Advanced*).
- **Trend/history** (`wflcdi.sup`): default node with the item definitions (blank = host
  node from `dur.sup`), history node (-1 = host node, used when the storage group names no
  node), memory pool (5 MB ≈ 100 concurrent requests ≈ 100 pens), timeout and timer.
- **Miscellaneous** (`wflgdi.sup`): operator alert pop-ups (off → written to the system log
  instead), reporting of unavailable items when a display opens (alternative: the item
  *Available* property in the enterprise Edit Module), DUR queue size, debug, and a log file
  `%TLS_ALLUSERS_PATH%\log\wflgdilog` with size (MB, 0 = none; up to twice the size is used)
  and level 0–3 (none, basic, + item values, + DUR message dumps).
- **Item information** (`wflidi.sup`):
  - *Flow control interval* (30 s): if the portal hears nothing from CI Core in this time,
    items go offline. 0 = off. Change only for slow links (e.g. satellite).
  - *Item events* (`NODE = node, buffer size, buffer time, flow control`): how `itm` sends
    updates to `wflidi`, per node (0 = own, -1 = all). Buffer size/time 0 = send each event;
    otherwise events are sent when the buffer is full or the time expires.
  - *DUR queue size* (500 kB), *Clear cache after* (20 s), *Unlock item after* (60 s; item
    lock used for exclusive faceplates, also checked by the Engineering Module value form).
  - *Scan* tab: scan interval (0 = event-based; scanning is better for fast-changing items),
    update retries before logging an error (3), queue busy level (10 messages); the last two
    apply only with scanning.

## See also

- Remote Connect install and web ports: `IM36K01C10-01EN.md` §2.4; firewall: `IM36K01C30-01EN.md`.
- Gateway configuration: `IM36K10J10-01EN.md` (J10 §3.2.6 in the 5th Edition).
- Displays, alarm overview component, map viewer: Edit Module (phase 10).