cliu/ci-server-engineer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ci-server-engineer/knowledge/manuals/IM36K10L45-01EN.md
cliu 28f5b7f7ee Record RDBMS exposure in manual summaries, progress and issues ISS-057..061 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-02 14:47:33 +10:00

14 KiB
Raw Permalink Blame History

manual title edition version status
IM 36K10L45-01EN Data Access Engineering 3rd Edition, Sep. 2023 R1.03 from docs; installed setup files (odbsrv.sup, opxsys.sup, opxuas.sup, ServerConfig.xml), access_start.cmd, PKI folders, processes and ports checked 2026-10-01; OPC UA client → own OPC UA server loopback verified with CI-Eng-Sample (station CIENG_UA); ODBC not working on the test system (ISS-008); OPC DA/A&E from docs

Data Access Engineering (R1.03)

ACCESS Service connects CI Server data to other software: ODBC (SQL on datasets), OPC Classic (DA and A&E, client and server, DCOM) and OPC UA (client and server). Section numbers refer to the manual. Engineering Module forms: IM36K10E20-01EN.md. Hands-on: skill data-access.

1. ODBC (§1–§3)

  • Multi-tier: ODBC application + driver manager + SimbaClient driver on the client; SimbaServer + ACCESS Service ODBC engine (odbsrv) on the CI Server. Read and write of existing dataset records with SQL (API level Core, SQL level minimum); datasets cannot be created or deleted over ODBC. Needs an ODBC licence.
  • odbsrv.sup: PORT (1583), USESSL (default on; certificate %TLS_ROOT_PATH%\tls\pki\odbsrv\SampleServerCertificate.pem, key SampleServerKey.pem), REMOVE_PADDING_SPACES, trace (TRACE, VERBOSE, TRACE_FILE), hidden data (TABLE_SUPPRESSION, FIELD_SUPPRESSION, FIELD_CONCEAL, all on).
  • Client: install the VC++ 2019 redistributable and SimbaClientDriverxx.zip from the medium (install.bat as administrator); define a DSN with driver CiSimbaClientDriver (64-bit) or CiSimbaClientDriver32, server IP and port 1583. Before R1.03, uninstall the old Simba parts.
  • SQL wildcards %/_ vs. MS Office */?: escape _ and % in names with \.
  • Common errors (§2.3): IM003 driver missing; IM002 DSN unknown; 08S01 SimbaServer not running / port mismatch / BUS Service not reachable.

Installed (test system): odbsrv.sup PORT 1583, USESSL YES, but the folder %TLS_ROOT_PATH%\tls\pki\odbsrv does not exist and no sample certificate is shipped, so odbsrv stops at every start (CppServerAPI::Run() failed: InitializeSslCtx(): SSL_CTX_use_certificate_chain_file() failed, then DUR-W-REM_PROC, Process ODBSRV exited unexpectedly); port 1583 does not listen. Fix: put a certificate and key there, or set USESSL = NO (admin; not applied, ISS-008). access_start.cmd writes the ODBC registry defaults once (when %TLS_DAT_PATH%\access.new exists).

2. OPC Classic basics (§4)

DCOM-based, Windows only. CI Server has DA client (opxdac), DA server (opxdas12, DA 1.0A and 2.0, custom + automation interfaces), A&E client (opxaec), A&E server (opxaes).

  • Quality: OPC DA quality goes to the lower 16 bits of the CI Server quality word, OPC A&E quality to the upper 16 bits. Item to OPC: CI Server quality low byte → OPC high byte; OPC low byte = offline → LAST_KNOWN, blocked → LOCAL_OVERRIDE, not initialised → NOT_CONNECTED, else GOOD.
  • Types: VT_UI1/UI2/INT/I1/I2/I4 → Integer, VT_UI4/UINT/R4/R8 → Real, VT_BSTR → String, VT_BOOL → Boolean.
  • Items, sections and objects appear to OPC servers (DA, A&E and UA) only with OPC visible (and every parent section visible).

3. OPC DA client (§5)

  • One client process per DA line (name given in the line), started/stopped with CI Server; stop one with durstp -msk -t10 -p <client>. Uses a save file in %TLS_SAV_PATH% named after the process; delete it (client stopped) if it gets inconsistent.
  • Server check every OPXDAC_SRV_ALIVE ms (default 30000); station status item: 1 running, 2 failed, 3 no config, 4 suspended, 5 test. Not connected → mapped items OFFLINE. Group status item: 1 active / 0 not active (items offline).
  • Setup (<client>.sup, else opxsys.sup): OPXDAC_SAFE_CON (allow connecting to a CI Server DA server — never to the own node or a DURM-connected node: deadlock), OPXDAC_PING (ICMP check before DCOM, fast failure), …_PING_TIMEOUT (3 s), …_DUR_QSZ, …_HBEAT (100 ms), …_ITMBUF, …_FLUSH_GRPQUE (500 ms), …_BROWSE_CACHE, …_DISABLE_BROWSING, …_CHECK_MAPPING, …_ASYNC_WRITE, …_USE_CANONICAL_DATA_TYPE (default asks VT_R8), …_IGNORE_BAD_QC_UPDATES, …_CLEAR_SAV_FILE, …_DISABLE_STATUS_UPDATE.
  • Advice: one OPC server per client process (a DCOM time-out blocks the whole process). Quick-load templates: export LINE_DF, STATION_DF, OPC_GROUP_DF, ITEM_DF, POINT_DF of one station made in the Engineering Module.
  • DCOM tunnelling: run the client on a PC in the OPC server's domain (CI Server with BUS, DATABASE, EQUIPMENT, ACCESS licence) connected to the host by MDUR (durm_<n>_udp.sup, port ≥ 20000, dur.sup host node = CI Core), use DCOM tunnelling to host on the client's setup file; on the host add the line with Equipment node = tunneller node. Use intmon node monitoring with Set slave items offline when node unavailable.

4. OPC DA server (§6)

  • COM server opxdas12.exe, ProgID Yokogawa.CIOpcDas.<version>, DUR name OPXDAS; started by COM on the first client connect; stop with durstp -p opxdas (clients get a shutdown).
  • Namespace = sections/items/sub-items (hierarchical or flat), filters (type, access, VB LIKE pattern). Cache read is fast and correct; device read blocks — use only after queue overflow. Timestamp = time written into the server cache.
  • opxsys.sup Data Access Server tab: OPXDAS_DUR_QSZ (100 kB), …_HBEAT, …_ITMBUF, OPXDAS_USER (log on as a CI Server user to apply its authorisation; empty = full access, fastest), OPXDAS_DCOM_TUN, OPXDAS_IGNORE_FTQ. Installed also: OPXDAS_SET_LOG_LEVEL (not described).
  • Remote access needs DCOM configuration (dcomcnfg: authentication Connect, impersonation Identify, access/launch permissions for an OPC account; identity of the server = that account), secpol (Create permanent shared objects, Network access: Classic), firewall rules for opxdas12.exe, opxdac.exe, opcenum.exe, mmc.exe and DCOM — not needed where the IT Security Tool is applied. Same account/password on both sides in a workgroup.
  • Troubleshooting: OCSRegistryCheck.exe (GUI; installed), opxdas12 /RegServer, opccommonsetup / opcenum /RegServer / opcenum /Service (set the service to automatic), regsvr32 opcproxy.dll and opccomn_ps.dll in %WINDIR%\SysWOW64. Test locally first.

5. OPC A&E client and server (§7, §8)

  • Client opxaec (default name OPXAEC, -n for more), setup <name>.sup or opxsys.sup (OPXAEC_SAFE_CON — same deadlock rule, …_DUR_QSZ, …_SRV_ALIVE, …_PING_TIMEOUT, …_TRACE); maps condition events to items; one server per client advised.
  • Server opxaes, ProgID Yokogawa.CIOpcAes.<version>, DUR name OPXAES; publishes items with alarm monitoring as conditions; OPXAES_ACK_ALLOWED (acknowledge from clients), …_ALM_REC_DELAY (30 s), …_BROWSE_PREP_INI, and OPXAES_EC_ATTR_* switches for the CI Server-specific event attributes (old/new value, quality, status, alarm state, item description, units, node, group, number, sub-number). Installed: all on.

6. OPC UA client (§9)

  • OPC UA TCP only; security by X.509 certificates (application authentication), user anonymous or name/password; modes None/Sign/SignAndEncrypt; policies Basic256Sha256, Aes128-Sha256-RsaOaep, Aes256-Sha256-RsaPss recommended (None, Basic128Rsa15, Basic256 not).
  • Data types supported: Boolean, (S)Byte, (U)Int16/32, Float, Double, String and others as in Table 9.4.2-2; 1-D and 2-D arrays by element. OPC UA status → CI Server quality: 0 good, 1 bad, 2 uncertain.
  • A&C: external alarms from ConditionType and derived types (ALARM/NORMAL events), other events INFORMATIONAL; filters by event type, component, event node; severity → priority table (901–1000 → 1 … 1–100 → 15), per station; don't manage NonExclusiveLimitAlarmType. Only NodeDeleted model changes are handled.
  • Redundancy: no client redundancy (use HAC); servers: transparent, or non-transparent cold backup with two endpoints (Active server item 0/1/2).
  • Engineering objects: line (starts a client process; name must start with OPX, max 11 characters), station (= session), subscription, point (= monitored item), alarm component / event type filter / event node / template settings, method.
  • Certificates: the client process creates <host>_<PROCESS>.der in %TLS_ALLUSERS_PATH%\pki\opxuac\pkiclient\own\certs (also listed in dataset OPCUAC_PKI_CERTIFICATES_DF); server certificates arrive in …\pkiclient\rejected and must be trusted (Engineering Module, or move to …\pkiclient\trusted\certs); folders deleted, rejected added by CI Server. The server must trust the client's certificate too.
  • Setup (<process>.sup, else opxuac.sup): OPXC_DUR_QUEUE_SIZE (10000 kB), heartbeats, buffers, OPXC_COM_STAT_CHK_INTERVAL (10 s), OPXC_STATION_CON_TRY_INTERVAL (30 s; observed retries every ~35 s), OPXC_TIMESTAMP_OPTION (SERVER/SOURCE), OPXC_LOG_LEVEL, service and session time-outs, OPXC_SERVICE_COMPLIANCE. Log file %TLS_LOG_PATH%\<PROCESS>.log.
  • Quick load (§9.10–9.11): OPCUAC_LINE_DF, …_STATION_DF, …_SUBSCRIPTION_DF, …_POINT_DF (+ alarm and method datasets). Dataset OPCUAC_TAG_DF browses a connected server (filter on OPC_STATION_NAME and OPC_TAG_PATH).
  • Installed: opxuac_mon (a monitor instance) is started by access_start.cmd.

7. OPC UA server (§10)

  • Process OPXUAS (opxuas -n opxuas, started by access_start.cmd; stop durstp -m -p opxuas), Unified Automation C++ SDK, port 34493. Log %TLS_ALLUSERS_PATH%\log\OPXUAS.log and OpxUas_Sdk*.log.
  • Visible data: sections, objects, items with OPC visible; items also need Read (read values, browse into the item) and Write (write values, alarm methods). Parent sections must be visible. Without Read the item is listed but browsing into it fails (UncertainNotAllNodesAvailable).
  • Users: anonymous = like OPC_UA_SERVER_READ; authorisation actions OPC_UA_SERVER_READ (browse, read, history) and OPC_UA_SERVER_MODIFY (+ write, methods).
  • Address space: Objects → sections (folders) → objects → items (CIItemNumericType, …BooleanType, …StringType, …NumericSubType) with child nodes such as Value, Status, Blocked, Offline, HMIInfo, and alarm condition nodes. Types are in http://www.yokogawa.com/CI_Server/ (ns 3 in the manual). CI Server entities (sections, items) are in namespace urn:Yokogawa:CI_SERVER_OPC_UA_SERVER (verified by browsing; the manual does not name it, ISS-032).
  • NodeIds are JSON strings: {"nsid":"<namespace id>"} for the entity, {"0":"Value","nsid":"<n>"} for its value; or by name: {"0":"Value","itnm":"<item>"} (case sensitive; verified). The nsid changes when the item is recreated — prefer itnm. OPXUAS_USE_NAME_NODEIDS makes the server use names in its own IDs.
  • Status mapping: NORMAL → Good; NOT_INIT, UPD_OFF, OFFSCAN, OFFLINE, UNREACH → BadNoCommunication; BAD_VALUE → Bad. Types: Boolean, Int32, Double, String. Priority → severity: 1 → 1000, 2 → 900 … 15 → 50, 0 → 1 (changed in R1.03).
  • History: items in a history group show HistoryRead; max 5000 values per node per call.
  • Alarm methods: Acknowledge, Confirm (= acknowledge), Disable/Enable (force to normal); external alarms Acknowledge/Confirm passed to the source; CIManualReset for CENTUM.
  • opxuas.sup: General (FTFW_* queue, heartbeat, log), OPC UA Server tab (OPXUAS_OPTIONAL_NODES, …_MODEL_CHANGE_EVENTS, …_USE_NAME_NODEIDS, …_USE_DYNAMIC_SCANRATE, …_SOURCE_TIME_STAMPS, …_USE_RAW_STATUS, …_VARIABLE_CACHE_SIZE 100000, …_NUM_VALUES_PER_NODE 5000), Alarm settings (EVENTS = ALARM, ACKN, DEACT, INFO), Logging. Installed keyword names: OPXUAS_DYNAMIC_SCANRATE (manual …_USE_DYNAMIC_SCANRATE) and extra OPXUAS_SET_HIGH_PRIO_15 (ISS-034).
  • %TLS_ROOT_PATH%\tls\exe\ServerConfig.xml: endpoint opc.tcp://[NodeName]:34493; trust list …\pki\opxuas\pkiserver\trusted\certs, rejected …\pkiserver\rejected (created at the first rejection), own certificate ciserveruaserver.der. Installed: only Basic256Sha256, Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss with Sign / SignAndEncrypt (no None endpoint); anonymous, user/password and certificate user tokens enabled (manual: certificate off, ISS-034); AutomaticallyTrustAllClientCertificates false.
  • First connection of any client: trust the server certificate on the client, then move the client certificate from the server's rejected to trusted\certs. UaExpert is the suggested test client.
  • Discovery: LDS on 4840 only when several servers are on a host; GDS for central certificate management (concepts only).

8. RDBMS data exposure (not in this manual)

IM 36K10L45 does not describe RDBMS data exposure; it is in the Tutorial (IM 36K10G10 ch. 10) and the item form (IM 36K10C10 §3.3). Summary here because it is an ACCESS-type interface; tested in R1.05 only (user system, 2026-10-02; R1.03 files checked read-only and identical). Procedure: skill data-access, task rdbms-exposure.md.

  • Processes DBCSND (sender, subscribes to DSS data) and DBCDEM (receiver, writes to MS SQL Server via ODBC); setup file dbc.sup (sender and receiver tabs; connection string DEM_CONNECTION, default Driver={SQL Server};Server=localhost\SQLEXPRESS;…).
  • Exposures are records in DATA_EXPOSURE_DF (source dataset, remote table, filter RECORDS, up to 32 field → column pairs or all fields). The target table is created by CI Server.
  • ITEM_VALUES exposure is driven by the per-item aggregation interval ITEM_DF.AGG_INTERVAL (60 s–7 days, 0 = off): value, min, max, average, count and a local-time TIMESTAMP (seconds since 1970) per interval.
  • Filter field names must not be quoted (NAME LIKE "<Section>*"); the manual's quoted example fails and stops all exposures (ISS-057). ITEM_HISTORY exposure: manual vs installed change log disagree (ISS-058).
  • The CI Service account .\CIX_PROCESS is local, so a remote SQL Server needs a SQL login and mixed mode (ISS-059).