Adding OPC-UA and MQTT Devices

Last updated

Note: Modbus TCP and Modbus RTU have their own page: Adding Modbus Devices.

OPC-UA

Connects as a client to any OPC-UA server: Kepware, Ignition, Siemens S7-1500, Beckhoff, Omron NX, B&R, or another Scada.Ink appliance.

Connection fields

Field	Value
IP Address	Server host.
Port	Server port, default 4840 (Kepware often 49320).

The endpoint used is opc.tcp://IP:port with no path. Servers that only accept an endpoint path (e.g. /OPCUA/SimulationServer) may refuse the connection.

Security and sign-in (under Driver Settings)

• Security policy defaults to None (no signing or encryption). Pick the policy your server offers — Basic256Sha256 on most servers; Aes128Sha256RsaOaep and Aes256Sha256RsaPss on newer ones; Basic256 and Basic128Rsa15 only for old servers — and a Security mode, Sign and encrypt or Sign only. The server must offer that exact policy and mode, or the connection fails with No matching endpoints. The appliance never falls back to None.
• A secured connection uses the appliance's own client certificate. The appliance creates it the first time a device connects with a policy other than None and uses the same one for every OPC-UA device. It's valid for a year and renewed automatically, and it's also renewed if the appliance's hostname changes. Most servers refuse an unknown certificate at first: open the server's certificate list (in Kepware, OPC UA Configuration → Trusted Clients; in Ignition, OPC UA → Security), trust the Scada.Ink client certificate, then Disconnect/Connect. A renewed certificate has to be trusted again.
• Sign-in picks the user identity: Anonymous, User name and password (the default; with Username left empty it signs in anonymously, so existing devices behave as before), or User certificate (X.509). A saved password shows as dots and is never sent back to the browser.
• For a user certificate, paste the certificate (PEM, or base64 of the DER file) into User certificate and its PEM private key into User certificate private key — or use Load file… next to each — and fill in Key passphrase if the key is encrypted. The key is stored like a password: it is never shown again, and leaving the field alone keeps it. The server has to trust the certificate for a user (in Kepware, OPC UA Configuration → Trusted Clients or the user manager; in Ignition, the User Certificate trust list). A certificate or key that can't be read fails the connection with the reason in the log; the appliance never falls back to anonymous.

Browse Tags walks the address space from the Objects folder, up to 5 folder levels deep, and lists the first 500 variables. Tags nest under the server's folders and are labeled by display name. Namespace 0 (the server's built-in nodes) is hidden; set browse_include_builtin to true or list namespaces in namespace_filter to change that. The browse also reads each variable once to learn its type, so on large servers it can hit the 8-second limit (see Polling & Reconnect) and fail on this device alone; subscribe by node id instead.

Tag path is the node id string:

Example	Meaning
ns=2;s=Channel1.Device1.Speed	string identifier (Kepware style)
ns=3;i=1005	numeric identifier
ns=4;g=…	GUID identifier

The type is taken from the value: Boolean → bool, integers → int, Float/Double → float, anything else (DateTime, arrays, structures) → string.

Reads: through an OPC-UA subscription by default. The first time a tag is polled, the driver adds it to the device's subscription as a monitored item; from then on the server sends changes and each poll publishes the latest value it sent. Under Driver Settings: Publishing interval (ms) (default 1000) is how often the server sends what changed, and Sampling interval (ms) (default: the publishing interval) how often it checks each value. The driver falls back to reading tags directly rather than going quiet:

• a tag the server refuses to monitor is read on every poll from then on;
• a tag whose first notification hasn't arrived yet is read directly until it does;
• if the server refuses to create the subscription, or reports it lost (e.g. BadTimeout), every tag is read directly until the next connect.

Set Subscriptions to Off to read every tag on every poll, as earlier versions did. The device info (GET /api/devices/:id/info) shows subscription (active, failed and polling, off) and how many items are monitored and polled. A value whose status code isn't Good reads Bad.

Writes: the driver reads the node's current type and converts your value to it (e.g. "true"/1 to Boolean, 12.7 to Int32 as 12). The node must be writable for the user.

Worked example — Kepware: add an OPC-UA device at 10.0.0.5, Port 49320. Browse → Channel1 › Press1 → tick Tonnage and StrokeCount → Subscribe Selected.

Tip: Reading tags from another Scada.Ink appliance: enable its OPC-UA server and expose tags from Manage Tags (OPC-UA column) on that appliance, then add it here.

Troubleshooting

Symptom	Cause	Fix
Error — Could not reach device at IP:4840	Server down, wrong port, the server doesn't offer the chosen Security policy and mode, the server hasn't trusted the appliance's certificate yet, or anonymous access disabled.	Match the policy and mode to an endpoint the server offers, trust the certificate on the server, or fill in Username/Password; check the driver log for [OPC-UA] Connection error.
Browse lists nothing useful	Variables are deeper than 5 levels or beyond the first 500.	Add node ids with Add Tag (copy them from UaExpert).
Names show as ns=1;s=…	The server has no display name for the node.	Rename on the server side.
Write fails	Node read-only or user lacks rights.	Check the node's AccessLevel.

MQTT

The MQTT driver subscribes to a broker and turns each received topic into a tag.

Connection fields: IP Address of the broker, Port 1883 — or 8883 for TLS (the wizard switches between the two when you turn TLS on or off, as long as you haven't typed another port).

TLS (under Driver Settings): turn TLS on to connect encrypted. Verify broker certificate (on by default) checks the broker's certificate chain and that it was issued for the address you entered — so if you connect by IP address, the certificate must list that IP. Put the CA that signed the broker's certificate in CA certificate (PEM; Load file… reads a .pem/.crt file); leave it empty to trust the appliance's built-in public CAs. For brokers that require client certificates, fill in Client certificate, Client private key and, for an encrypted key, Key passphrase; the key is stored like a password and never shown again. Turning verification off accepts any certificate — the link is still encrypted but the broker isn't proven — so use it only for testing. Certificate settings that can't be loaded fail the connection straight away, with the reason in the driver log.

Driver Settings (in the wizard, or later under Settings):

Field	Meaning
Topics	One topic filter per line, e.g. plant/line1/# and sensors/+/temperature. Empty means # (everything on the broker).
QoS	0, 1 or 2 for the subscriptions. Default 0.
Client ID	Empty means scadaink- plus the device ID. Must be unique on the broker: two clients with the same ID keep disconnecting each other.
Username, Password	For brokers that require sign-in. A saved password shows as dots.

• Tag path is the full topic, e.g. plant/line1/speed. The value is the raw payload text, typed string.
• JSON payloads: add # and a JSON path to the topic to read one value out of a JSON message: plant/line1/sensor#data.temp reads 21.5 from {"data":{"temp":21.5}}. The path can start with $., index lists with [0] (or .0), and quote odd keys as ['key.with.dots']. Numbers come through as int or float and true/false as bool; an object or list comes through as JSON text. A # at the very end is the MQTT wildcard, not a JSON path, and a wildcard topic can take a path too: plant/+/sensor#temp. The tag reads Uncertain while the path isn't in the latest message and Bad if the message isn't JSON.
• Browse Tags lists topics received since the device connected and, for JSON messages, one topic#path entry per value inside them (up to 50 per topic), plus any wildcard patterns not yet matched.
• Writes publish the value as text to the topic at QoS 1 (Allow Tag Writes must be on). Writing to a JSON-path tag publishes the smallest JSON message with the value at that path: writing 21.5 to plant/line1/cmd#data.setpoint publishes {"data":{"setpoint":21.5}}. Numbers and true/false are sent as JSON numbers and booleans. A path that indexes a list can't be written.
• Adding a tag whose path isn't covered by topics (e.g. one outside a configured wildcard) subscribes to it individually the first time it's read — it reads Uncertain until the next matching publish arrives.
• If the broker restarts or drops the connection, the driver reconnects automatically — after 1 second, then backing off to at most 60 seconds between tries — and resubscribes to everything; tags read Bad while it's down and recover once it reconnects.

See also

• Adding Modbus Devices (TCP and RTU)
• Advanced Driver Settings (driverConfig)
• Device Detail Page
• Polling, Reconnect and Connection Status
• Tags & the Tag Browser
• MQTT Sparkplug B