OPC UA communication

The OPC UA driver connects as a client to an OPC UA server. The server can be inside a PLC (for example the OPC UA server of an S7-1500), in a gateway or on another computer. The tag address is the NodeId of the node on the server.

The driver is chosen for two jobs: reaching Siemens data blocks that have Optimized block access turned on by symbolic name, and communicating with signing or encryption. It is the only driver that offers signed and encrypted communication. FabyaVision contains no OPC UA server; it is a client only.

In secure mode (signed, or signed and encrypted) Live creates an application certificate for this computer: RSA 2048, SHA-256, self-signed, valid for about 20 years. It trusts the certificate of the server as follows:

• Trust on first use: on the first secure connection to a server (address and port), the certificate of the server is accepted and saved to the %LOCALAPPDATA%\FabyaVision\OpcUa\sunucular folder as adres_port.der. On later connections only this certificate is accepted.
• If the certificate changes, the connection is rejected and the message gives the path of the file to delete. If the certificate was renewed on purpose, delete that file; the driver applies trust on first use again.
• Manual trust: certificates placed in the %LOCALAPPDATA%\FabyaVision\OpcUa\pki\trusted folder, and the certificates signed by them, are always trusted.
• The server trusting Live: many servers reject a client they do not recognize. The certificate of this computer is in the %LOCALAPPDATA%\FabyaVision\OpcUa\pki\own\certs folder; add the .der file to the list of trusted clients of the server.

With Security None and anonymous login, the certificate is not checked at all. If a user name and password are used with None, the password is sent encrypted with the certificate of the server, while the rest of the channel is unencrypted.

• Get the namespace number (ns) from the server. The text identifier may contain ; and =; everything after s= is the identifier.
• Identifier types: s= string, i= number, g= GUID, b= byte string.
• The number of a namespace given with nsu= is looked up on the server in every session.

• WString is not supported; OPC UA strings are already Unicode, so use String.
• Array and structure nodes cannot be read as a single-value tag.
• The value read is converted to the tag type by rounding. If it does not fit the range of the type, the tag gets an error; the value is not clipped.
• When writing, the value is converted to the type of the node: an Int tag can be written to a Double node.
• If the server sends a UTC date, it is reflected in the DateTime tag in the local time of this computer.

• Subscriptions are not used. In every read cycle the tags are read with a bulk Read request.
• A write goes to a single node and the written tag is read back at once.
• If the connection drops, the driver retries after 1 s, 2 s and 5 s, then every 10 s. For the behavior common to all drivers see the communication drivers page.

• There is no node selection (browse) from the server, no X.509 user certificate, no security policy other than Basic256Sha256 and no certificate management screen.
• The password you enter is stored unencrypted in the baglanti_sifreleri.json file on the Live computer. Open the project data folder with Windows permissions only to the account that runs Live.

Connection messages appear in the Connections section of the system menu in Live. For tag errors during reading no message is shown; the tag only gets bad quality.