OPC-UA Server

Last updated

The appliance has a built-in OPC-UA server that lets other systems — a plant SCADA, an MES, a historian, UaExpert — browse and read the tags you choose, and optionally write to them. It is off by default, and nothing is exposed until you pick tags.

This article covers the server. Choosing which tags to expose is also covered in Writing Tag Values & OPC-UA Exposure. To read from another OPC-UA server, add an OPC-UA device instead — see Open Standards.

Where and who

System → Settings, card OPC-UA Server. Needs admin. The server is part of every edition — there is no separate license feature. Its state also appears on Driver Health.

Turn the server on

1. Open System → Settings and find OPC-UA Server.
2. Tick Enable server.
3. Leave Port at 4840 unless something else uses it.
4. Leave Security Policy at Basic256Sha256 and Security Mode at SignAndEncrypt unless a client cannot support them.
5. Set Username and Password for clients, or tick Allow anonymous access on an isolated network.
6. Click Save & apply. The badge next to the title changes to Running.
7. Expose tags (next procedure). Until you do, the address space is empty.

Settings

Field	What it does	Default	Allowed values
Enable server	Start the server now and at every API start	off	on / off
Port	TCP port clients connect to	4840	1–65535; Port must be between 1 and 65535 otherwise
Allow anonymous access	Accept clients without a user name. Also adds security policy None and mode None to the endpoints	off	on / off
Security Policy	Encryption algorithm set offered to clients	Basic256Sha256	Basic256Sha256, Aes128_Sha256_RsaOaep, Aes256_Sha256_RsaPss, None
Security Mode	Message protection	SignAndEncrypt	SignAndEncrypt, Sign, None
Username	The one user name clients may sign in with	opcua	any text
Password	That user's password; stored encrypted. Shows (set — leave blank to keep) once set	none	cannot be cleared from the form once set

• One account. The server does not use Scada.Ink user accounts or roles. Every client that signs in uses the single Username/Password pair, and every signed-in (or anonymous) session has the same rights.
• With anonymous off and no password, the form warns Set a password — with anonymous off and no password, no client can connect.
• Choose policy and mode as a pair: None with None, or a secure policy with Sign or SignAndEncrypt. The form does not stop you choosing None with SignAndEncrypt, which clients cannot use.

Endpoint

opc.tcp://<appliance-address>:4840/scadaink/server

The server advertises the appliance's host name and every IPv4 address it has. If clients reach it through a different name (NAT, DNS alias), set the environment variable OPCUA_ALTERNATE_HOSTNAMES (comma-separated) for the API service.

Certificates

• The server creates its own self-signed application certificate on first start and keeps it in the opcua-pki folder next to the database (or OPCUA_PKI_DIR). It survives restarts, so clients only need to trust it once.
• New client certificates are refused by default. A client connecting to a secure endpoint (Sign or Sign & Encrypt) for the first time is refused and its certificate listed under Pending on the OPC-UA Server card — trust it there to let that client connect, no restart needed. Turn on Accept new client certificates automatically (off by default) while commissioning to trust every new client on first connect, then turn it back off. Anonymous connections with security None don't use a client certificate and are unaffected.
• Trusted clients are still accepted even if their certificate has expired or its start date hasn't arrived yet — PLC and HMI clocks are often wrong and their certificates rarely get renewed. The card marks an out-of-date trusted certificate as expired — still accepted rather than an error.
• In the client, trust the server certificate when prompted (UaExpert: Accept the server certificate permanently).

Expose tags

Kind of tag	Where	Controls
Device tags	Devices → device → Manage Tags tab, edit a row	Expose, server name, Writable
Local tags	Local Tags, the OPC-UA pill on a row	Expose on OPC-UA, Server name, Writable, Save
Expression tags	Expression Tags, the OPC-UA icon on a row	Expose on OPC-UA (read-only), Server name, Save
UDT instances	Tag UDTs, the OPC-UA pill on an instance	Exposes (and optionally makes writable) every member tag

Rows show OPC R or OPC R/W once exposed. Only enabled tags appear.

Address space

Objects
├── Devices
│   ├── Press 4 (#3)            ns=1;s=device:3
│   │   └── Press_4_HR100      ns=1;s=dev3:Press_4_HR100
│   └── Local Tags (#1)
│       └── Local_BatchCount   ns=1;s=dev1:Local_BatchCount
└── Expression Tags            ns=1;s=expressions
    └── OEE_Line3              ns=1;s=expr:12

• Browse name is the Server name you typed, or by default the device name and tag path joined with _ (/, :, . and spaces become _). Give each exposed tag a unique name within its device. When two tags share one, the tag already on the server keeps it and the other is served with a number added (Speed_2); the OPC-UA Server card lists each such tag by name until you rename one.
• NodeIds are strings built from the device id and browse name, so renaming a tag's server name changes its NodeId and breaks clients that stored it. The namespace index is normally 1; browse rather than hard-code it.
• Data types: float/real/double → Double; int/integer → Int32; bool → Boolean; anything else → String.
• Values come from the appliance's live cache when a client reads; the minimum sampling interval is 500 ms.
• Quality is not passed on. Every value reads with status Good and no source timestamp. A tag whose device is offline reads 0, false or an empty string. If a client must detect stale data, also expose the device's _STATUS/Connected tag.

Writes

A client can write to a node only when all of these are true:

1. The tag is exposed with Writable ticked (expression tags are never writable).
2. The device has Allow Tag Writes turned on. Otherwise the write is refused with BadUserAccessDenied.

Note: Local tags are the exception. A tag on the built-in Local Tags device only needs to be exposed as writable; that device's Allow Tag Writes switch is not checked, the same as for writes from the Local Tags page and the REST API.

Things to know:

• No per-user control. Security levels and roles do not apply to OPC-UA; any session that can connect can write every writable node.
• Device writes are confirmed. For a PLC or other driver device, the server waits for the device's answer before replying. Good means the device took the value. If the device refuses the write or can't be reached, the client gets BadDeviceFailure, or BadCommunicationError when the driver service itself is down, and the API log shows OPC-UA write to … did NOT apply: … with the reason. When the device is slow or unreachable the reply can take several seconds, so give the client a request timeout of at least 10 seconds.
• Every write that is applied is recorded in the Audit Log as opcua_write with the value, tag and device. Refused and failed writes are not.

Restarts and live changes

• Save & apply restarts the server when a server setting changed (port, security, user name, password, certificate acceptance). Connected clients are disconnected and must reconnect.
• Tag changes don't restart it. Exposing a tag, changing its server name or Writable flag (on any page) adds, replaces or removes just that node about half a second later; connected clients stay connected. A client monitoring a node that was removed gets a bad status for it.
• Deleting a tag or device, disabling a tag, or renaming a device is picked up within 15 seconds: the node is removed, or the device folder is renamed.
• When the API starts, the server starts automatically if Enable server is on.

Status

• The Running / Stopped badge on the settings card.
• Driver Health shows OPC-UA server running — Exposing tags on port 4840, or OPC-UA server enabled but not running when it failed to start.
• If the server can't start, Save & apply shows the error, and while it stays stopped the card shows the reason under the settings (for example listen EADDRINUSE: address already in use :::4840).

Method	Path	Role	Purpose
GET	/api/opcua/settings	admin	Settings plus hasPassword, running, lastError and nameConflicts
PUT	/api/opcua/settings	admin	Save and apply; answers { running }, or 500 with the reason when the server can't start
GET	/api/driver-health	viewer	Includes opcuaServer: { enabled, running, port, lastError, nameConflicts }

Troubleshooting

Symptom	Cause	Fix
Badge shows Stopped after Save & apply	Port already in use, or another start error — the card shows which	Try a different port, then Save & apply again; contact Scada.Ink support if it still won't start
Card lists tags that share a browse name	Two exposed tags on one device have the same server name	Give one of them its own Server name
Client: BadUserAccessDenied / BadIdentityTokenRejected on connect	Wrong user name or password, or anonymous off	Use the Username/Password from the card
Client cannot find an endpoint matching its security	Client wants None but anonymous is off, or a policy it does not support	Match the client to the policy/mode shown, or change them
Client connects, Devices folder empty	No tags exposed, or the exposed tags are disabled	Expose tags from Manage Tags / Local Tags
Write returns BadUserAccessDenied	Allow Tag Writes is off on the device (not checked for Local Tags)	Turn it on in the device's Settings tab
Write returns BadNotWritable	Tag exposed read-only	Tick Writable
Write returns BadDeviceFailure	The device refused the write or didn't answer (offline, wrong address, or the PLC rejected the value)	Check the API log for did NOT apply and the reason; confirm the device is Connected
Write returns BadCommunicationError	The driver service isn't running	Check Driver Health and the driver service log
Clients disconnect now and then	Someone saved changed server settings, which restarts the server	Configure clients to reconnect
Endpoint URL uses a host name clients cannot resolve	Server advertises the appliance host name	Connect by IP, or set OPCUA_ALTERNATE_HOSTNAMES

See also

• Writing Tag Values & OPC-UA Exposure
• Local Tags
• MQTT Sparkplug B
• System Settings
• Integrations: Choosing the Right Interface