OPC UA server
The OPC UA server driver publishes the signals of the project to other systems, for example an MES, a historian or a higher-level SCADA. They connect to YTCC as OPC UA clients. For what all drivers have in common, see How drivers work.
Protocol and role
| Role | OPC UA server. Other systems connect to YTCC. |
| Endpoint | opc.tcp://<server>:<port><endpoint path>, by default opc.tcp://<server>:4840/scada |
| Listens on | All network interfaces of the server |
| Devices | None. The server is a driver without devices. |
| Driver type | Opc ua server (opc_ua_server) |
Several OPC UA servers can run on one machine if they use different ports.
Parameters
Set these on the driver in Drivers → devices. Changes take effect only after the driver restarts: Apply shows requires a restart, and a strip offers Restart for the driver. The help mark next to each parameter shows a short description.
| Parameter | Default for a new server | Meaning |
|---|---|---|
| Port | 4840 | TCP port, 1–65535. |
| Endpoint path | /scada | Path part of the endpoint URL. |
| Namespace uri | urn:ytcc:scada | The namespace of the YTCC nodes. |
| Security policies | ["Basic256Sha256"] | One endpoint per entry: None (no signing, no encryption) and Basic256Sha256 (sign and encrypt). |
| Allow anonymous | off | Allow clients to connect without a user. |
| Users | one user ytcc with a random password | User names and passwords for clients, as a JSON list. |
| Trust client certs | off | Trust every client certificate without checking. |
| Allow writes | off | Keep it off. See Writes. |
A server created in the editor starts with Allow anonymous and Trust client certs off; keep them off.
The application name is YTCC OPC-UA Server.
Security
- Policies. Keep only
Basic256Sha256in production. WithNone, the data and the passwords travel unprotected. - Users. Give each client system its own user and password. The passwords are stored in the driver settings as text, so restrict who may edit the configuration.
- Certificates. The server creates its own self-signed certificate when it first starts. Client certificates are
checked against the trusted folder of the server (
pki-opcua-server/trusted); a certificate of an unknown client is put inpki-opcua-server/rejected. Move it totrustedafter you have checked it. The client must trust the server certificate as well. - Network. The server listens on every network interface. Allow port 4840 (or your port) only from the systems that need it, with the firewall of the server.
Address space
- Every active signal of the project is published. To hide a signal, make it inactive.
- All nodes lie directly under the Objects folder, without subfolders.
- The node ID is the namespace of Namespace uri and the full signal path, for example
ns=2;s=Station.OutletFlow. The browse name and the display name are the full path too. The namespace index is assigned when the server starts; clients should resolve it from the namespace URI. - Only the main value of each signal is published, with its status code and a time stamp.
- Signals added, removed or deactivated after the start appear after the driver restarts.
Data types
| Signal type | OPC UA type |
|---|---|
| Bit | Boolean |
| Int16, UInt16 | Int16, UInt16 |
| Int32, UInt32 | Int32, UInt32 |
| Int64, UInt64 | Int64, UInt64 |
| Float32 | Float |
| Float64 | Double |
| Text | String |
| Time | DateTime |
| other | BaseDataType |
Until the first live value arrives, a node has no value.
Status codes and time stamps
| Quality in YTCC | Status code |
|---|---|
| Good | Good |
| Uncertain | Uncertain |
| Bad · Not connected | BadNotConnected |
| any other | Bad |
The time stamp of a value is the time the server received it from YTCC, not the device time.
Values are sent to subscribed clients as they change. If a client is very slow, updates can be dropped.
Writes
OPC UA clients read the YTCC signals. Keep Allow writes off: every write is then refused with BadUserAccessDenied. The driver log warns when it is on.
Diagnostics
The state of the server is in the driver log: the number of nodes at start, the port and namespace, and warnings about trusted certificates and writes. If the server cannot start, the driver stops with an error and the process manager restarts it.
| What the client sees | Likely cause |
|---|---|
| Cannot connect | Firewall; wrong port or endpoint path; the driver is not running |
| Secure connection refused | The client certificate is in rejected, or the client does not trust the server certificate |
| User rejected | Wrong user or password; anonymous access is off |
| Node not found | Wrong namespace index or path; the signal is inactive or was added after the start |
| Value empty | No live value has arrived yet for that signal |
| Write refused with BadUserAccessDenied | Allow writes is off, as recommended |
Supported services
| Service | Supported |
|---|---|
| Discovery (GetEndpoints) | Yes |
| Session with anonymous or user name identity | Yes |
| Read | Yes |
| Subscriptions and monitored items (data change) | Yes |
| Browse and TranslateBrowsePaths | Yes, flat address space |