203 lines
14 KiB
Markdown
203 lines
14 KiB
Markdown
---
|
||
manual: IM 36K10L45-01EN
|
||
title: Data Access Engineering
|
||
edition: 3rd Edition, Sep. 2023
|
||
version: R1.03
|
||
status: from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs
|
||
---
|
||
|
||
# Data Access Engineering (R1.03)
|
||
|
||
ACCESS Service connects CI Server data to other software: **ODBC** (SQL on datasets), **OPC
|
||
Classic** (DA and A&E, client and server, DCOM) and **OPC UA** (client and server). Section
|
||
numbers refer to the manual. Engineering Module forms: `IM36K10E20-01EN.md`. Hands-on:
|
||
skill `data-access`.
|
||
|
||
## 1. ODBC (§1–§3)
|
||
|
||
- Multi-tier: ODBC application + driver manager + **SimbaClient** driver on the client;
|
||
**SimbaServer** + ACCESS Service ODBC engine (`odbsrv`) on the CI Server. Read and write of
|
||
existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be
|
||
created or deleted over ODBC. Needs an ODBC licence.
|
||
- `odbsrv.sup`: `PORT` (1583), `USESSL` (default on; certificate
|
||
`%TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem`, key `SampleServerKey.pem`),
|
||
`REMOVE_PADDING_SPACES`, trace (`TRACE`, `VERBOSE`, `TRACE_FILE`), hidden data
|
||
(`TABLE_SUPPRESSION`, `FIELD_SUPPRESSION`, `FIELD_CONCEAL`, all on).
|
||
- Client: install the VC++ 2019 redistributable and `SimbaClientDriverxx.zip` from the medium
|
||
(`install.bat` as administrator); define a DSN with driver `CiSimbaClientDriver` (64-bit) or
|
||
`CiSimbaClientDriver32`, server IP and port 1583. Before R1.03, uninstall the old Simba parts.
|
||
- SQL wildcards `%`/`_` vs. MS Office `*`/`?`: escape `_` and `%` in names with `\`.
|
||
- Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not
|
||
running / port mismatch / BUS Service not reachable.
|
||
|
||
**Installed (test system)**: `odbsrv.sup` `PORT 1583`, `USESSL YES`, but the folder
|
||
`%TLS_ROOT_PATH%\tls\pki\odbsrv` does not exist and no sample certificate is shipped, so
|
||
`odbsrv` stops at every start (`CppServerAPI::Run() failed: InitializeSslCtx():
|
||
SSL_CTX_use_certificate_chain_file() failed`, then `DUR-W-REM_PROC, Process ODBSRV exited
|
||
unexpectedly`); port 1583 does not listen. Fix: put a certificate and key there, or set
|
||
`USESSL = NO` (admin; not applied, ISS-008). `access_start.cmd` writes the ODBC registry
|
||
defaults once (when `%TLS_DAT_PATH%\access.new` exists).
|
||
|
||
## 2. OPC Classic basics (§4)
|
||
|
||
DCOM-based, Windows only. CI Server has DA client (`opxdac`), DA server (`opxdas12`, DA 1.0A
|
||
and 2.0, custom + automation interfaces), A&E client (`opxaec`), A&E server (`opxaes`).
|
||
- Quality: OPC DA quality goes to the **lower** 16 bits of the CI Server quality word, OPC A&E
|
||
quality to the **upper** 16 bits. Item to OPC: CI Server quality low byte → OPC high byte;
|
||
OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised →
|
||
NOT_CONNECTED, else GOOD.
|
||
- Types: `VT_UI1/UI2/INT/I1/I2/I4` → Integer, `VT_UI4/UINT/R4/R8` → Real, `VT_BSTR` → String,
|
||
`VT_BOOL` → Boolean.
|
||
- Items, sections and objects appear to OPC servers (DA, A&E **and UA**) only with *OPC
|
||
visible* (and every parent section visible).
|
||
|
||
## 3. OPC DA client (§5)
|
||
|
||
- One client process per DA line (name given in the line), started/stopped with CI Server;
|
||
stop one with `durstp -msk -t10 -p <client>`. Uses a save file in `%TLS_SAV_PATH%` named
|
||
after the process; delete it (client stopped) if it gets inconsistent.
|
||
- Server check every `OPXDAC_SRV_ALIVE` ms (default 30000); station status item: 1 running,
|
||
2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group
|
||
status item: 1 active / 0 not active (items offline).
|
||
- Setup (`<client>.sup`, else `opxsys.sup`): `OPXDAC_SAFE_CON` (allow connecting to a CI Server
|
||
DA server — **never to the own node or a DURM-connected node: deadlock**), `OPXDAC_PING`
|
||
(ICMP check before DCOM, fast failure), `…_PING_TIMEOUT` (3 s), `…_DUR_QSZ`, `…_HBEAT`
|
||
(100 ms), `…_ITMBUF`, `…_FLUSH_GRPQUE` (500 ms), `…_BROWSE_CACHE`, `…_DISABLE_BROWSING`,
|
||
`…_CHECK_MAPPING`, `…_ASYNC_WRITE`, `…_USE_CANONICAL_DATA_TYPE` (default asks VT_R8),
|
||
`…_IGNORE_BAD_QC_UPDATES`, `…_CLEAR_SAV_FILE`, `…_DISABLE_STATUS_UPDATE`.
|
||
- Advice: one OPC server per client process (a DCOM time-out blocks the whole process).
|
||
Quick-load templates: export `LINE_DF`, `STATION_DF`, `OPC_GROUP_DF`, `ITEM_DF`,
|
||
`POINT_DF` of one station made in the Engineering Module.
|
||
- **DCOM tunnelling**: run the client on a PC in the OPC server's domain (CI Server with BUS,
|
||
DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (`durm_<n>_udp.sup`,
|
||
port ≥ 20000, `dur.sup` host node = CI Core), *use DCOM tunnelling to host* on the client's
|
||
setup file; on the host add the line with *Equipment node* = tunneller node. Use `intmon`
|
||
node monitoring with *Set slave items offline when node unavailable*.
|
||
|
||
## 4. OPC DA server (§6)
|
||
|
||
- COM server `opxdas12.exe`, ProgID `Yokogawa.CIOpcDas.<version>`, DUR name `OPXDAS`; started by
|
||
COM on the first client connect; stop with `durstp -p opxdas` (clients get a shutdown).
|
||
- Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE
|
||
pattern). *Cache read* is fast and correct; *device read* blocks — use only after queue
|
||
overflow. Timestamp = time written into the server cache.
|
||
- `opxsys.sup` *Data Access Server* tab: `OPXDAS_DUR_QSZ` (100 kB), `…_HBEAT`, `…_ITMBUF`,
|
||
`OPXDAS_USER` (log on as a CI Server user to apply its authorisation; empty = full access,
|
||
fastest), `OPXDAS_DCOM_TUN`, `OPXDAS_IGNORE_FTQ`. Installed also: `OPXDAS_SET_LOG_LEVEL`
|
||
(not described).
|
||
- Remote access needs DCOM configuration (`dcomcnfg`: authentication Connect, impersonation
|
||
Identify, access/launch permissions for an OPC account; identity of the server = that account),
|
||
`secpol` (*Create permanent shared objects*, *Network access: Classic*), firewall rules for
|
||
`opxdas12.exe`, `opxdac.exe`, `opcenum.exe`, `mmc.exe` and DCOM — not needed where the IT
|
||
Security Tool is applied. Same account/password on both sides in a workgroup.
|
||
- Troubleshooting: `OCSRegistryCheck.exe` (GUI; installed), `opxdas12 /RegServer`,
|
||
`opccommonsetup` / `opcenum /RegServer` / `opcenum /Service` (set the service to automatic),
|
||
`regsvr32 opcproxy.dll` and `opccomn_ps.dll` in `%WINDIR%\SysWOW64`. Test locally first.
|
||
|
||
## 5. OPC A&E client and server (§7, §8)
|
||
|
||
- Client `opxaec` (default name `OPXAEC`, `-n` for more), setup `<name>.sup` or `opxsys.sup`
|
||
(`OPXAEC_SAFE_CON` — same deadlock rule, `…_DUR_QSZ`, `…_SRV_ALIVE`, `…_PING_TIMEOUT`,
|
||
`…_TRACE`); maps condition events to items; one server per client advised.
|
||
- Server `opxaes`, ProgID `Yokogawa.CIOpcAes.<version>`, DUR name `OPXAES`; publishes items
|
||
with alarm monitoring as conditions; `OPXAES_ACK_ALLOWED` (acknowledge from clients),
|
||
`…_ALM_REC_DELAY` (30 s), `…_BROWSE_PREP_INI`, and `OPXAES_EC_ATTR_*` switches for the
|
||
CI Server-specific event attributes (old/new value, quality, status, alarm state, item
|
||
description, units, node, group, number, sub-number). Installed: all on.
|
||
|
||
## 6. OPC UA client (§9)
|
||
|
||
- OPC UA TCP only; security by X.509 certificates (application authentication), user
|
||
anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256,
|
||
Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
|
||
- Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in
|
||
Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good,
|
||
1 bad, 2 uncertain.
|
||
- A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other
|
||
events INFORMATIONAL; filters by event type, component, event node; severity → priority
|
||
table (901–1000 → 1 … 1–100 → 15), per station; don't manage
|
||
NonExclusiveLimitAlarmType. Only `NodeDeleted` model changes are handled.
|
||
- Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold
|
||
backup with two endpoints (*Active server item* 0/1/2).
|
||
- Engineering objects: line (starts a client process; **name must start with `OPX`**, max 11
|
||
characters), station (= session), subscription, point (= monitored item), alarm component /
|
||
event type filter / event node / template settings, method.
|
||
- Certificates: the client process creates `<host>_<PROCESS>.der` in
|
||
`%TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs` (also listed in dataset
|
||
`OPCUAC_PKI_CERTIFICATES_DF`); server certificates arrive in `…\pkiclient\rejected` and must be
|
||
trusted (Engineering Module, or move to `…\pkiclient\trusted\certs`); folders `deleted`,
|
||
`rejected` added by CI Server. The server must trust the client's certificate too.
|
||
- Setup (`<process>.sup`, else `opxuac.sup`): `OPXC_DUR_QUEUE_SIZE` (10000 kB), heartbeats,
|
||
buffers, `OPXC_COM_STAT_CHK_INTERVAL` (10 s), `OPXC_STATION_CON_TRY_INTERVAL` (30 s; observed
|
||
retries every ~35 s), `OPXC_TIMESTAMP_OPTION` (SERVER/SOURCE), `OPXC_LOG_LEVEL`, service and
|
||
session time-outs, `OPXC_SERVICE_COMPLIANCE`. Log file `%TLS_LOG_PATH%\<PROCESS>.log`.
|
||
- Quick load (§9.10–9.11): `OPCUAC_LINE_DF`, `…_STATION_DF`, `…_SUBSCRIPTION_DF`, `…_POINT_DF`
|
||
(+ alarm and method datasets). Dataset `OPCUAC_TAG_DF` browses a connected server
|
||
(filter on `OPC_STATION_NAME` and `OPC_TAG_PATH`).
|
||
- Installed: `opxuac_mon` (a monitor instance) is started by `access_start.cmd`.
|
||
|
||
## 7. OPC UA server (§10)
|
||
|
||
- Process `OPXUAS` (`opxuas -n opxuas`, started by `access_start.cmd`; stop `durstp -m -p
|
||
opxuas`), Unified Automation C++ SDK, port **34493**. Log `%TLS_ALLUSERS_PATH%\log\OPXUAS.log`
|
||
and `OpxUas_Sdk*.log`.
|
||
- Visible data: sections, objects, items with *OPC visible*; items also need **Read** (read
|
||
values, browse into the item) and **Write** (write values, alarm methods). Parent sections must
|
||
be visible. Without Read the item is listed but browsing into it fails
|
||
(`UncertainNotAllNodesAvailable`).
|
||
- Users: anonymous = like `OPC_UA_SERVER_READ`; authorisation actions `OPC_UA_SERVER_READ`
|
||
(browse, read, history) and `OPC_UA_SERVER_MODIFY` (+ write, methods).
|
||
- Address space: `Objects` → sections (folders) → objects → items (`CIItemNumericType`,
|
||
`…BooleanType`, `…StringType`, `…NumericSubType`) with child nodes such as `Value`,
|
||
`Status`, `Blocked`, `Offline`, `HMIInfo`, and alarm condition nodes. Types are in
|
||
`http://www.yokogawa.com/CI_Server/` (ns 3 in the manual). **CI Server entities (sections,
|
||
items) are in namespace `urn:Yokogawa:CI_SERVER_OPC_UA_SERVER`** (verified by browsing;
|
||
the manual does not name it, ISS-032).
|
||
- NodeIds are JSON strings: `{"nsid":"<namespace id>"}` for the entity,
|
||
`{"0":"Value","nsid":"<n>"}` for its value; or by name: `{"0":"Value","itnm":"<item>"}`
|
||
(case sensitive; verified). The `nsid` changes when the item is recreated — prefer `itnm`.
|
||
`OPXUAS_USE_NAME_NODEIDS` makes the server use names in its own IDs.
|
||
- Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH →
|
||
BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority →
|
||
severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03).
|
||
- History: items in a history group show HistoryRead; max 5000 values per node per call.
|
||
- Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal);
|
||
external alarms Acknowledge/Confirm passed to the source; `CIManualReset` for CENTUM.
|
||
- `opxuas.sup`: General (`FTFW_*` queue, heartbeat, log), OPC UA Server tab
|
||
(`OPXUAS_OPTIONAL_NODES`, `…_MODEL_CHANGE_EVENTS`, `…_USE_NAME_NODEIDS`,
|
||
`…_USE_DYNAMIC_SCANRATE`, `…_SOURCE_TIME_STAMPS`, `…_USE_RAW_STATUS`,
|
||
`…_VARIABLE_CACHE_SIZE` 100000, `…_NUM_VALUES_PER_NODE` 5000), Alarm settings (`EVENTS` =
|
||
ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: `OPXUAS_DYNAMIC_SCANRATE`
|
||
(manual `…_USE_DYNAMIC_SCANRATE`) and extra `OPXUAS_SET_HIGH_PRIO_15` (ISS-034).
|
||
- `%TLS_ROOT_PATH%\tls\exe\ServerConfig.xml`: endpoint `opc.tcp://[NodeName]:34493`; trust list
|
||
`…\pki\opxuas\pkiserver\trusted\certs`, rejected `…\pkiserver\rejected` (created at the first
|
||
rejection), own certificate `ciserveruaserver.der`. **Installed**: only Basic256Sha256,
|
||
Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint);
|
||
anonymous, user/password **and certificate** user tokens enabled (manual: certificate off,
|
||
ISS-034); `AutomaticallyTrustAllClientCertificates` false.
|
||
- First connection of any client: trust the server certificate on the client, then move the
|
||
client certificate from the server's `rejected` to `trusted\certs`. UaExpert is the
|
||
suggested test client.
|
||
- Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate
|
||
management (concepts only).
|
||
|
||
## 8. RDBMS data exposure (not in this manual)
|
||
|
||
IM 36K10L45 does not describe RDBMS data exposure; it is in the Tutorial (IM 36K10G10 ch. 10)
|
||
and the item form (IM 36K10C10 §3.3). Summary here because it is an ACCESS-type interface;
|
||
**tested in R1.05 only** (user system, 2026-10-02; R1.03 files checked read-only and identical).
|
||
Procedure: skill `data-access`, task `rdbms-exposure.md`.
|
||
|
||
- Processes `DBCSND` (sender, subscribes to DSS data) and `DBCDEM` (receiver, writes to MS SQL
|
||
Server via ODBC); setup file `dbc.sup` (sender and receiver tabs; connection string
|
||
`DEM_CONNECTION`, default `Driver={SQL Server};Server=localhost\SQLEXPRESS;…`).
|
||
- Exposures are records in `DATA_EXPOSURE_DF` (source dataset, remote table, filter `RECORDS`,
|
||
up to 32 field → column pairs or all fields). The target table is created by CI Server.
|
||
- `ITEM_VALUES` exposure is driven by the per-item aggregation interval `ITEM_DF.AGG_INTERVAL`
|
||
(60 s–7 days, 0 = off): value, min, max, average, count and a local-time `TIMESTAMP` (seconds
|
||
since 1970) per interval.
|
||
- Filter field names must not be quoted (`NAME LIKE "<Section>*"`); the manual's quoted example
|
||
fails and stops all exposures (ISS-057). `ITEM_HISTORY` exposure: manual vs installed change
|
||
log disagree (ISS-058).
|
||
- The CI Service account `.\CIX_PROCESS` is local, so a remote SQL Server needs a SQL login and
|
||
mixed mode (ISS-059).
|