OPC UA server

The server runs inside the Live program. An external OPC UA client connects to Live and sees only the tags you gave access to. You select the tags in Studio. By default no tag is exposed.

• The client reads tags and subscribes to changes.
• A permitted user writes to tags that allow writing.
• Live sends changed values to the server every 200 ms at most.
• Every value arrives with a quality code.

To bring data from another server into Live, use the OPC UA driver.

The column in the HMI tags table is set for each tag. It affects OPC UA clients only and leaves operator and script writes unchanged. Per-screen tags are never exposed.

The client finds the nodes in the FabyaVision folder under Objects. Tag groups and structure instances become folders. The node ID is the full tag name, without the folder path, so moving a tag to another group leaves its ID unchanged.

A tag with scaling on is exposed as Double. The client sees and writes the engineering value.

• These users are for OPC UA only, separate from Live and browser users.
• The user password travels encrypted in every mode. The project file keeps only a salted SHA-256 hash of it.
• Anonymous login is off by default. If you turn it on, anonymous clients can read but cannot write.
• A new client’s certificate is rejected and waits for approval in Live. The Accept client certificates automatically option removes this step.

A write is applied when:

• The tag is exposed as Read + Write.
• The user has write permission.
• The value fits the tag’s type and is within the lower and upper limits.

The write takes Live’s normal write path: on a scaled tag the value is converted to the raw value, and a PLC tag goes to the driver. The OPC UA user’s permission decides; the permissions of the user logged on in Live play no part.

When a write is rejected, the client gets a status code such as BadNotWritable, BadUserAccessDenied or BadOutOfRange. A successful write goes into the event log with the tag, the value and the user name. One line is written per tag every 10 seconds at most.

When a connection is lost, the node keeps the last value. Internal and simulator tags are not affected by the connection state.

The OPC UA server… window in the system menu shows the state of the server.

• Connection addresses: by computer name and by IPv4 address.
• Connected clients: application, user, security mode and connection time.
• Client certificates awaiting approval: compare the thumbprint, then click Trust.
• The Add firewall permission button adds an inbound rule for this port in Windows and asks for administrator approval.

If a local discovery server (LDS) is installed on the computer, Live registers with it by itself and appears in client lists as FabyaVision Live. Without an LDS, enter the address in the client by hand.

• There is no historical access, no alarms and conditions and no event notification.
• FabyaVision nodes have no method calls.
• There is no access filter by IP address.
• Nodes hold a single value. Structure members are separate nodes, and there are no array nodes.
• Basic256Sha256 is the only security policy. There are no X.509 user certificates.
• Access is not set per tag and user pair: every user reads all exposed tags.
• The server accepts 50 sessions at most.
• In a redundant server pair, each Live opens its own server. A client does not move to the other address by itself.