OPC UA server

Live exposes the tags you select to the outside as an OPC UA server: an MES, another SCADA or a data acquisition program reads these tags, subscribes to them and, if you have allowed it, writes to them. License, Studio settings, tag selection, address space, write rules, quality codes and logging.

The server runs inside the Live program. An external OPC UA client connects to Live and sees only the tags that you have given access to. The steps for connecting the client on the Live side are in the Connecting a client to the OPC UA server topic.

License and trial version

The server is off by default in the project. When turned on, it behaves as follows, depending on the license:

Loading license files is described in License and activation.

Turning on the server

1. Open the section

   In the project tree, click the OPC UA Server section.

   1234567

   1. OPC UA server — On / Off. Default Off.
   2. Port — default 4841.
   3. Endpoint path — the part of the address after the port.
   4. Summary — state, address and the number of tags with access.
   5. Security modes — the endpoints the client can select.
   6. Anonymous login — an anonymous client can only read.
   7. Certificate acceptance — while it is off, a new client waits for approval in Live.

2. Turn on the server

   On the General tab, set the OPC UA server switch to On.

3. Check the address

   Change the Port and Endpoint path defaults if necessary.

4. Select the security modes

   By default, only the signed + encrypted mode is on. Select the modes according to the Security section.

5. Add a user

   Define one user per client on the Users tab (Users).

6. Give access to the tags

   Fill in the HMI tags column of the OPC UA access table (Tag selection).

7. Fix the warnings

   The Info tab of the Inspector lists what is missing: it warns if no tag has been given access, if no user has a password, or if there are tags with write access but no user with write permission. If the port is invalid or is the same as the browser monitoring port, it reports an error.

8. Upload the project to Live

   A running Live does not pick up the new version by itself (Uploading the project to Live). Live starts the server when it opens the project. Because the server certificate is generated at the first start, starting can take a few seconds.

9. Check the state

   In Live, open the OPC UA server… window from the system menu and confirm that it shows Running (Connecting a client to the OPC UA server).

General settings

The address has this format: opc.tcp://<bilgisayar>:<port>/<yol>. Example with the default settings: opc.tcp://192.168.0.10:4841/FabyaVision.

Security

• If no mode is selected, Live opens only the signed + encrypted mode.
• Logon with a user name is always offered. If no user is defined and anonymous login is off, no client can connect.
• The user password is sent encrypted in every mode. On the Unsecured endpoint too, the password is encrypted with the server certificate; values and write commands, however, remain unencrypted.

Users

These users are only for the logon of OPC UA clients. They are separate from Live and browser users.

123

1. Name — the user name the client enters.
2. Password — at least 6 characters; its hash is stored and it is not displayed.
3. Write permission — while it is off, the user can only read.

Tag selection: OPC UA access column

The HMI tags column in the OPC UA access table determines whether each tag is exposed.

1

1. OPC UA access — Off (a dash in the cell), Read or Read + Write.

• The column affects only OPC UA clients. It does not change writing by operators and scripts.
• For Per screen tags the column is locked; these tags are not exposed.
• The column is also included in the Export to Excel output (Transferring tags with Excel).

Address space

The client sees the nodes in the FabyaVision folder under Objects. Tag groups and structure instances become folders:

Objects
└─ FabyaVision
   ├─ Proses                  (tag grubu)
   │  ├─ T101_Seviye          ns=2;s=T101_Seviye
   │  └─ P101_Hiz             ns=2;s=P101_Hiz
   └─ Yapilar                 (tag grubu)
      └─ Pompa_P101           (yapı örneği)
         └─ Hiz               ns=2;s=Pompa_P101.Hiz

Node ID

ns=2;s=<tag adı>. The identifier is the full name of the tag in Studio. Folders are not part of the identifier; for a structure member, the full name contains a dot (Pompa_P101.Hiz).

Namespace

urn:fabyavision:live:tags. If your client supports it, enter the address instead of the number: nsu=urn:fabyavision:live:tags;s=T101_Seviye.

Display name

The last part of the tag name (Hiz). A tag without a group is directly under FabyaVision.

Description

The Description text of the tag; if there is a unit, it is added at the end in square brackets ([%]).

Data types

A tag with scaling on is exposed as Double, whatever its type: the client sees and writes the engineering value (Scaling and quality).

Live sends changed values to the server at most once every 200 ms. The value of a tag is not refreshed faster than the Acquisition cycle of the tag. The timestamp is the moment the value was written to the server, not the PLC clock.

How a write is processed

A client write is checked in the order below. A failed check stops the write and a status code is returned to the client.

• A write goes through the normal write path of Live: for a scaled tag, the value is converted to the raw value, and a PLC tag goes to the driver. In a redundant pair, a write arriving at the standby server is forwarded to the master.
• The authorization of the user logged on in Live is not checked. The right to write is determined only by the Write permission of the OPC UA user.
• The connection status tag cannot be written; the client receives BadDeviceFailure.

Quality codes

• When the connection is lost, the last value stays in the node. The client must evaluate the value together with its quality.
• Internal and simulator tags are not affected by the connection state.

What is logged

Clients connecting or disconnecting, rejected logons, rejected writes and read operations are not logged. To see the currently connected clients, use the Live window. Log files: Log files.

Limits