cliu
b85a65250c
Read-only re-check on the shared R1.05 test server plus a diff of the R1.03 and R1.05 manual editions. - installation-security: R1.05 OS list, Defender exceptions, IT security 2.0/3.0, LAPS, automatic configuration merge (jupgutl), PRM chapter, port 34597; setup_check.ps1 gets -Version (default 1.05.00). - data-access: L45 renumbered (new ch. 4 RESTful API), extended OPC UA functions off by default, OPC UA methods (OPCUAC_METHOD_CALL2_DF), Information Model Mapper, ServerConfig.xml in %TLS_SAV_PATH%. - equipment: Modbus unchanged; IEC 104/61850 run as EQT managers (eqtdbg, eqtfrcscn), IEC 61850 report control blocks, upgrade steps. - Issues ISS-076..090; R1.05 notes on ISS-003/008/032/034/061; progress and version-differences updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
287 lines
19 KiB
Markdown
287 lines
19 KiB
Markdown
---
|
||
manual: IM 36K01C10-01EN
|
||
title: CI Server Setup
|
||
edition: 5th Edition, Feb. 2026
|
||
version: R1.05 (first written for R1.03, 3rd Edition, Sep. 2023)
|
||
status: from docs (Windows settings, services, ports and upgrade-merge files checked read-only on the R1.03 test system and the R1.05 test server, 2026-10-08; IT security not verifiable on the R1.05 test server)
|
||
---
|
||
|
||
# CI Server Setup (R1.05)
|
||
|
||
New installation, maintenance (start/stop, reinstall, upgrade, licence, uninstall), network
|
||
tools and, new in R1.05, connection to other Yokogawa products (PRM). Section numbers refer to
|
||
the 5th edition. The manual prints the default paths (`C:\Program Files (x86)\Yokogawa\CIServer`,
|
||
`C:\Users\Public\Yokogawa\tls`); on a machine installed elsewhere use the `TLS_*` variables
|
||
(ISS-086).
|
||
|
||
## 1. Before you start
|
||
|
||
- Needed: the CI Server ISO file and one **Activated License File per server** (an upgrade
|
||
needs one that includes the Upgrade License).
|
||
- Supported OS for R1.05 (§1.3.2), all 64-bit: Windows 10 Enterprise / IoT Enterprise LTSC
|
||
2019 and 2021; Windows 11 Pro and Enterprise; Windows 11 Enterprise / IoT Enterprise LTSC
|
||
2024; Windows Server 2019 / IoT 2019, 2022 / IoT 2022 and 2025 / IoT 2025 (Standard).
|
||
- On **Windows 11 Pro/Enterprise and Server 2025 the Vnet/IP drivers and the IT Security
|
||
Tool are not supported**; the other OSs also allow CI Server and PRM on one computer.
|
||
- Gone since R1.03: Windows 10 Pro/Enterprise (non-LTSC), LTSB 2016, Server 2016. The R1.03
|
||
rule "VMs run Windows Server 2019" is no longer in the manual.
|
||
- Verified (R1.05 test server, 2026-10-08): CI Server R1.05 runs on Windows Server 2025
|
||
Datacenter, an edition the list does not name.
|
||
- Only listed software may coexist (§1.3.3): Chrome 130, Firefox 131, Edge 130; Microsoft
|
||
Office 2024 / Microsoft 365 (Excel Add-in); PI AF SDK 2.10.5 + .NET 4.6.2; Python 3.12
|
||
(pyTOOLS); SimbaClient ODBC driver 10.2; Adobe Acrobat / Acrobat Reader DC; Yokogawa standard
|
||
antivirus; Standard Whitelisting Software for Endpoint Security (not on Windows 11 Pro or
|
||
Server 2025; ask Yokogawa before using it on VMs). Anything else may disturb CI Server.
|
||
|
||
## 2. New setup
|
||
|
||
### Order of work (§2.1, physical machine)
|
||
|
||
1. (Vnet/IP only) Set DIP switches and fit the Vnet/IP card (VI702).
|
||
2. Configure Windows settings (below).
|
||
3. (Vnet/IP only) Install control bus driver and Vnet/IP open communication driver, then set
|
||
Windows network settings.
|
||
4. Install CI Server (with or without the IT Security Tool).
|
||
5. Apply IT security settings (IT Security Tool; Domain Link Management Tool for linked domain).
|
||
Use the same security model as the Yokogawa products it connects to or shares the PC with.
|
||
6. Apply the CI Server licence.
|
||
|
||
On a VM (§2.2): mount the ISO, Windows settings, (Vnet/IP) **Vnet/IP Interface Package**
|
||
instead of drivers/card, VM network settings, install, IT security, licence, then VM
|
||
settings (auto start/shutdown with host, allow RDP from thin clients, disable NetBIOS over
|
||
TCP/IP, network metrics favouring the plant network). On VMs, adapters not used for Vnet/IP
|
||
must not use 192.168.0.0/16. The Vnet/IP Interface Package works only with IT security
|
||
applied. Mounting the ISO from Hyper-V Manager needs a Server 2019 or 2022 Datacenter host
|
||
with the Hyper-V role (§2.2.1). Dual-redundant platform: see §2.3 and IM 30A05C30.
|
||
|
||
### Windows settings (§2.1.2)
|
||
|
||
| Setting | Required value |
|
||
|---|---|
|
||
| Security patches | Apply per company policy before going live; patch promptly later |
|
||
| Visual effects | *Let Windows choose what's best* |
|
||
| Processor scheduling | *Programs* |
|
||
| Virtual memory | Custom size, initial = maximum = 1.5 × RAM (e.g. 6 GB RAM → 9216 MB); restart |
|
||
| Power | *High performance*; disk, sleep, hibernate, display: never; hybrid sleep off; wake timers off; adaptive brightness off; power button = shut down |
|
||
| Fast startup | Off: run `<ISO drive>\Windows\Tool\HiberbootDisabled.bat` as administrator (`HiberbootEnabled` = 0); required before Vnet/IP drivers on Win10 |
|
||
| Microsoft Defender Antivirus | Turned off by group policy *Turn off Microsoft Defender Antivirus*. Exceptions: on Windows 11 Pro 24H2 keep it on; on Win10 LTSC 2021 and Win11 LTSC 2024 it cannot be turned off |
|
||
| Automatic Windows updates | Disabled by group policy (*Configure Automatic Updates* = Disabled). With WSUS: install CI Server first, then disable from WSUS |
|
||
| Drive optimization | Scheduled optimization off |
|
||
| Automatic cleanup | Task Scheduler › Microsoft › Windows › Servicing › `StartComponentCleanup` disabled |
|
||
| Windows updates | Apply the per-OS list of cumulative OS and .NET updates in §2.1.2 (state of Feb. 2026; Yokogawa's Endpoint Security Service has the current list), or some install-folder rights may be wrong. Replaces the single R1.03 update KB5023702 |
|
||
| .NET Framework 3.5.1 | Installed on all listed OSs (`dism /online /enable-feature /featurename:NetFX3 /all /Source:<drive>:\sources\sxs /limitaccess` from the Windows medium, or the Server Manager feature) |
|
||
| DCOM | Default Authentication Level = *Connect* (needed for OPC Classic on a CI Core); restart |
|
||
| Display | Scale 100 % |
|
||
| 8dot3 names | `fsutil behavior set disable8dot3 2`; restart |
|
||
| Japanese keyboards (new) | On Win10 LTSC 2021 / Win11 LTSC 2024 switch to the previous Microsoft IME version |
|
||
|
||
Verified (R1.05 test server, 2026-10-08): a server can run CI Server with several of these
|
||
not applied (Defender on, updates and cleanup not disabled, no .NET 3.5); the manual still
|
||
requires them for operation.
|
||
|
||
### Vnet/IP (§2.1.1, §2.1.3, §2.1.4)
|
||
|
||
- Card DIP switches: domain 1–16, station 1–64 (start from 64 downwards), each with odd
|
||
parity; action-mode switch all OFF. One card per computer; card before drivers.
|
||
- Which drivers: Vnet/IP and Ethernet on the same computer → control bus driver only (no open
|
||
communication driver); Vnet/IP only → both; no Vnet/IP → neither.
|
||
- Before the open communication driver on Win10 LTSC 2019, Server 2019 or Server 2022, check
|
||
in `msinfo32` that **Kernel DMA Protection** is Off (switch it off in the BIOS if needed).
|
||
- Drivers from `<ISO drive>\Windows\VnetVirtualProduct\VirtualProduct_CIServer_package*.zip` →
|
||
`installVirtProd.cmd` (VM: `installVirtProdVPF.cmd`), as administrator, antivirus off.
|
||
- Rename connections: *Ethernet*, *Vnet*, *VnetIPOpen* (VM: *VnetIPBUS1*, *VnetIPBUS2*,
|
||
*RemoteUINetwork*). Disable IPv6; Vnet uses only *Yokogawa Vnet Protocol* + IPv4.
|
||
- Default addresses: Ethernet `172.17.<domain>.<station>`/16; control bus `172.16.<domain>.<station>`/16;
|
||
Vnet/IP open `192.168.<128+domain>.<129+station>`/24; VM remote UI `172.18.<domain>.<station>`/16.
|
||
- Computer name = station name. Check `sc query VLTDI` = RUNNING.
|
||
- Never use Internet Connection Sharing, bridge connections or Homegroup.
|
||
- Run the TCP/IP Inconsistency Detect Tool before installing CI Server (§3.9).
|
||
|
||
### Installing CI Server (§2.1.5)
|
||
|
||
- Run as a local administrator (domain types: domain admin or local admin + domain credentials);
|
||
join the domain first for domain/combination management.
|
||
- Close applications, disable antivirus, never run two installers, never install where CI
|
||
Server Remote Connect is installed.
|
||
- `<ISO drive>\Windows\CIServer\ciserver-R<ver>-r<build>M-setup.exe` = CI Server only;
|
||
`…-ITSecurity.exe` = CI Server + IT Security Tool (also installs VAGW modules; install type
|
||
*CI Server and IT Security Tool*). Choose the install folder (no spaces if non-default,
|
||
see known issues). An upgrade keeps the first install folder.
|
||
- Upgrade to R1.05 or later: the installer offers *Automatic upgrade CI Server configuration*
|
||
(ticked by default). See §3.
|
||
- At the end: tick *I want to set up IT Security Tool Now* for IT security 2.0, untick it
|
||
for 3.0 (below); then reboot.
|
||
- **Change the initial passwords of the predefined CI Server user accounts** (Engineering
|
||
Module manual).
|
||
|
||
### IT security (§2.1.6)
|
||
|
||
The IT Security Tool now offers **IT security version 2.0 or 3.0**. A full list of the 3.0
|
||
settings comes as a PDF with the tool. Common rules:
|
||
- The security model must be the same across the system; linked domain management: apply
|
||
*Standalone* first, join the domain, then link with the Domain Link Management Tool.
|
||
- Export the settings if you change defaults. Running the tool (also during an upgrade)
|
||
overwrites security changes made by other means.
|
||
|
||
**Version 2.0**: at the end of the install keep the checkbox ticked, choose version 2.0,
|
||
*Standard Model*, the user management type, keep default items, restart.
|
||
|
||
**Version 3.0** (needs a v3.0 licence number per computer, from the licence certificate):
|
||
1. Unblock the ISO file (file properties) so the script runs properly.
|
||
2. Untick the IT Security checkbox at the end of the install.
|
||
3. As administrator run `<ISO drive>\Windows\CIServer\ITSecurity\Installer\ITSec_3_InstalledSoftwareForCIX.cmd`
|
||
and enter the licence number (up to 20 letters/digits, no hyphens).
|
||
4. Start the IT Security Tool, *Setup*, version 3.0 (Standard model and Standalone are
|
||
preselected), restart.
|
||
- The GPO file `CIX_Standard_3.0.zip` and the settings PDF are placed under
|
||
`C:\ProgramData\Yokogawa\IA\iPCS\Platform\Security\GPOFiles\3.0` and `…\Document\3.0`.
|
||
- CI Mobile View or a domain controller: run `ITSec_3_ForCIViewHTML.cmd` or
|
||
`ITSec_3_DCForCIX.cmd` from the same folder, then `ciserver-…-ITSecurity.exe` with install
|
||
type *Apply IT Security only*, version 3.0, model *CI View standard Model Standalone Management*.
|
||
|
||
**Other Yokogawa products on the same PC**: if CI Server is installed after a product that has
|
||
IT security 3.0, CI Server may use 2.0 or 3.0; after a product with 2.0, only 2.0. If the
|
||
other product is installed later, its own supported versions decide (a 2.0-only product
|
||
forces 2.0).
|
||
|
||
**LAPS** (Local Administrator Password Solution; only with linked domain management and IT
|
||
security 3.0, after the v3.0 GPO is applied to the clients):
|
||
- Install `<ISO drive>\Windows\ThirdParty\LAPS\LAPS.x64.msi`: on the domain controller only
|
||
the management tools, on the clients only the AdmPwd GPO extension.
|
||
- On the domain controller, as a member of Enterprise Admins and Schema Admins, in an
|
||
elevated PowerShell: `Import-module AdmPwd.PS`, `Update-AdmPwdADSchema`,
|
||
`Set-AdmPwdComputerSelfPermission -OrgUnit "<OU>"`. Then enable the policy (Security Guide
|
||
summary §7).
|
||
- With software restriction policies applied, start the msi from an elevated command prompt.
|
||
|
||
### Licence (§2.1.7)
|
||
|
||
Start menu › *License Authorization Wizard* (admin) › select the activated licence file › Finish.
|
||
|
||
### CI Server Remote Connect (§2.4)
|
||
|
||
On a CI View PC (never on a Portal or Core): browse to `http(s)://<portal>:<port>` (defaults
|
||
8080 / 8443), *Download (Windows)*, run `CI-rc-setup.exe`. Portal ports are in `jwuiisg.sup`
|
||
(Setup File Editor › *Client communication* tab); open them in the firewalls.
|
||
- Moving Remote Connect to a later *version* means uninstall, then install the new one; a
|
||
later revision of the same version can be installed over it.
|
||
- With software restriction policies applied, switch them off before upgrading Remote Connect
|
||
and on again afterwards.
|
||
- IT security on a Remote Connect PC: run `ciserver-…-ITSecurity.exe` with install type
|
||
*IT Security for multi-product environment*, then version 2.0 (checkbox) or 3.0
|
||
(`ITSec_3_InstalledSoftwareForCIViewRC.cmd`, then the tool).
|
||
|
||
### Virtualization extras (§2.5)
|
||
|
||
RD Session Host + RD Licensing (per device) for USB redirection; limit connections to 1;
|
||
allow multiple sessions per user; enable *Windows Audio* and the *System Sound Service* task
|
||
for sound over RDP. Before applying IT security 3.0 there, set the *Windows Remote Management
|
||
(WS-Management)* service to Automatic and the policy *Allow Remote Shell Access* to Not
|
||
Configured, then restart.
|
||
|
||
## 3. Maintenance
|
||
|
||
**Start/stop CI Server (§3.1)**: Start menu › CI Server › *Start CI Server* / *Stop CI
|
||
Server*, or the *CI Service* Windows service (service name `StartCIServer`; startup type
|
||
*Automatic* for automatic start). An expired licence gives an error at start.
|
||
|
||
**Start/stop VAGW Bossd (§3.2, new)**: from R1.04, as a `CIX_MAINTENANCE` administrator in an
|
||
elevated prompt: `%TLS_ROOT_PATH%\tls\vagw\program(x64)\vagwstarter.exe -s` (start) or `-e`
|
||
(stop); log in `C:\ProgramData\Yokogawa\IA\iPCS\Products\CENTUMVP\UACS\Server\Log`. On R1.03
|
||
use the Services console. VAGW exists only when installed with the IT Security Tool.
|
||
|
||
**Reinstall / upgrade (§3.3)**: direct upgrade from R1.01 or later; apply the Product
|
||
Maintenance Licence to the Portal/Core first. If CI Server was installed with the IT Security
|
||
Tool, the reinstall/upgrade must include it too.
|
||
1. (§3.3.1) Note the instance setup files (one per equipment line: equipment process name +
|
||
`.sup`, Engineering Module › Equipment › Lines) and their templates (Setup File Editor ›
|
||
*Templates*, `*_eqp.sup` / `*_eqt.sup`; since R1.04 `eqa850_eqp.sup` is `eta850_eqt.sup`).
|
||
2. Database consistency: `dsschk`, `dsschk -r`, `dsschk -e`, `dsschk -e -r` (upgrade only).
|
||
3. (§3.3.3, Vnet/IP on a VM, from R1.01–R1.03 to R1.04+) Set the device of every Vnet line
|
||
back to `/dev/bk00` in the Engineering Module.
|
||
4. Stop CI Server; set *CI Service* to *Manual*. Stop VAGW Bossd (above) and set it to *Manual*.
|
||
5. Back up `%TLS_ALLUSERS_PATH%` and `%TLS_ROOT_PATH%\tls` (plus project files).
|
||
6. On the Core (upgrade): delete in `%TLS_SAV_PATH%` `eqp*_main.*`, `eqp*_item.*`, `opx*.*`
|
||
(`.sav/.d01/.k01`) and `*.sqlite`.
|
||
7. Note changed setup files (Setup File Editor, *Status* = Changed) and copy
|
||
`tls\com`, `sup`, `tpl`, `src`, `exe\ServerConfig.xml` and `%TLS_ALLUSERS_PATH%\wap`.
|
||
8. (Vnet/IP) Update drivers (uninstall, reinstall, restart) and network settings.
|
||
9. Install over the top (no uninstall), keeping the automatic merge ticked unless you want to
|
||
merge everything by hand.
|
||
10. IT security (version 3.0: run `ITSec_3_InstalledSoftwareForCIX.cmd` first), licence; start
|
||
CI Server once to confirm, then stop it.
|
||
11. Restore (§3.3.14): check the merge report and conflict log (below) and merge by hand what
|
||
was not merged. Compare instance setup files with the **new templates** and copy new
|
||
keywords into each; compare other setup files with the newly installed ones; never copy
|
||
old files over new ones. Layouts (`wap\cfg\operatorInterfaces\DEPLOY\layouts\`): check
|
||
them if merged automatically, merge by hand otherwise. Re-apply IT security.
|
||
12. Verify (§3.3.15): start, `dsschk -e -r` three times, stop, start VAGW Bossd, start,
|
||
check `%TLS_LOG_PATH%\ci_start.log`; from R1.01/R1.02 compile all alarm selection area
|
||
expressions; restore the startup types (VAGW Bossd back to Automatic).
|
||
- Product-specific upgrade notes live elsewhere: ODBC from R1.02 or older (IM 36K10L45
|
||
"Notes for upgrading to R1.03.00"), OPC UA client/server (IM 36K10L45 "Notes for upgrading
|
||
to R1.04.00"), IEC 61850 (IM 36K10L41 App. 1), RGS with EAL from R1.03 (merge the OPC UA
|
||
client setup file, download the project common section and tag list from the ENG HIS).
|
||
The R1.03 Simba client/server reinstall notes are no longer in this manual.
|
||
- Passwords of predefined CI Server accounts are reset to the initial ones: change them
|
||
again (running the IT Security Tool does not reset them).
|
||
|
||
**Automatic merge of configuration files (R1.05+, §2.1.5, §3.3.8, §3.3.14, §3.3.15)**
|
||
- The installer copies user files to `%TLS_ROOT_PATH%\tls\upg\to-<new>\util\backup\user\tls`
|
||
(`com`, `sup`, and `wap\cfg\operatorInterfaces\DEPLOY\layouts`, `colors`, `chartGroups`)
|
||
and merges them with the new version.
|
||
- Results: `upgrade-report-<old>-to-<new>-<date>.csv` (columns File name, Attribute, Conf
|
||
value, Default old, Default new, Merged value, Reason) and `upgrade-conflicts-…log`, in
|
||
`%TLS_LOG_PATH%\jmrg` (the manual prints the default path).
|
||
- If it did not run: copy the backup `com` and `sup` folders and the three wap folders into
|
||
that `upg` path, then in an elevated prompt in `%TLS_ROOT_PATH%\tls\com` run
|
||
`jupgutl.cmd -o <old version> -n <new version> -p "<tls root>" -c "<…\wap\cfg\properties>"`
|
||
(e.g. `-o 1.04.00 -n 1.05.00`). The text says `-c` is the `jmrgconfig.properties` file but
|
||
the examples pass its folder; not tested (ISS-086).
|
||
- Verified (R1.05 test server, 2026-10-08): `jupgutl.cmd` starts the Java tool in
|
||
`tls\exe\jmrg.jar`; `%TLS_WAP_PATH%\cfg\properties\jmrgconfig.properties` limits the merge
|
||
to `*_start*` / `*_stop*` files in `com`, `*.sup` in `sup` and `*.xml` in the three wap
|
||
folders; reference copies of the shipped files of R1.01.00–R1.04.00 are in
|
||
`%TLS_SAV_PATH%\jmrg\ref-data`. Other files (rest of `com`, `tpl`, `src`,
|
||
`ServerConfig.xml`) still need a manual compare.
|
||
|
||
**HAC upgrade (§3.4)**: stop standby, disconnect its network, upgrade and test offline, stop
|
||
standby, stop primary, reconnect standby and start it, upgrade primary, start it (sync
|
||
resumes). Keep one server running if several are upgraded at once.
|
||
|
||
**Extend licence (§3.5)**: License Authorization Wizard while running; node name/number must
|
||
match; takes effect within an hour. New features need CI Server stopped first.
|
||
|
||
**Uninstall (§3.6, §3.7)**: back up, stop CI Server and VAGW Bossd, Programs and Features ›
|
||
CI Server › Uninstall, restart. Remote Connect: uninstall it, then CI Server (IT Security
|
||
definitions), then run `<ISO drive>\Windows\CIServer\ITSecurity\DeleteITSecurity.cmd`.
|
||
|
||
**TCP/IP tools (§3.9)**: from the VirtualProduct package `XCM3003\Module\Tool`:
|
||
`TcpipInconsistencyDetector.cmd` (check) and `TcpipInconsistencyRepair.cmd` (resets all NIC
|
||
IPv4 settings: note them first, re-enter after restart).
|
||
|
||
## 4. Connecting Yokogawa products (new chapter)
|
||
|
||
- Each combination has an **integration code**: package code 1 – package code 2 – type –
|
||
revision. Type 01: same PC, no interaction; 02: separate PCs that interact (two type-02
|
||
products never on one PC); 03: same or separate PCs, working together; 04: as 03 with
|
||
limits. When manuals of two products disagree, use the one with the newer revision.
|
||
- Security model and user management type must match on both products.
|
||
- **CI Server + PRM Server** (§4.1.1): code 1901-0302-03-01; CI Server R1.04 or later, PRM
|
||
Server R4.08 or later (a note in the same section says R4.06; ISS-090); Standard model;
|
||
standalone or domain/combination management; the same IT security version on both.
|
||
- PRM first: (if VAGW or Vnet/IP is used) remove the Vnet driver with PRM Disc 1 and install
|
||
the one from the CI Server ISO; run the CI Server + IT Security installer until it
|
||
restarts; stop PRM with `<OS drive>:\PRM\Tool\PRMStop.bat`; finish the install; set
|
||
security; restart (PRM services start by themselves).
|
||
- CI Server first: stop CI Server and VAGW Bossd, set both to Manual, install PRM, restore
|
||
both startup types.
|
||
|
||
## Troubleshooting (Appendix 1)
|
||
|
||
| Problem | Workaround |
|
||
|---|---|
|
||
| Server Manager error, Microsoft updates fail (80070543), .NET install fails | Temporarily set DCOM Default Authentication Level to *Connect* (revert to *None* afterwards where the manual says so), restart |
|
||
| Cannot manage users in Control Panel | Use Computer Management › Local Users and Groups |
|
||
| Installed updates not listed | Manual: `wmic qfe list full`. WMIC is missing on Windows Server 2025 / 24H2 (verified, R1.05 test server, 2026-10-08): use `Get-HotFix` in PowerShell (ISS-088) |
|
||
| Cannot change the time zone (Server 2019 with UAC) | Run `timedate.cpl` as administrator |
|