--- description: Configure the OPC UA connection between Connect IoT and the machine's OPC UA Server, including profile selection and timeouts. alias: userguide-equipment-integration-opcua-standard-opcua-connection --- # Configure the OPC UA Connection ## Purpose This procedure establishes communication between **Connect IoT** and the machine's **OPC UA Server**. It is the canonical reference for OPC UA Server profile selection, connection fields, `Namespace`, and automation timeout settings. ## Responsibility and Inputs | Area | Owner | Required input | | --------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------- | | Network connectivity | Infrastructure team | Provide the endpoint hostname, port, route, DNS, and firewall access from the **Automation Manager** | | OPC UA endpoint | Machine supplier/ Automation Team | Provide the endpoint URL and supported `SecurityPolicy` and `SecurityMode` combinations | | Profile configuration | Automation team | Configure OPC UA Server connection settings | | Resource addressing | MES and automation teams | Agree the namespace and hierarchy that identify the machine Resource | | Node permissions | Machine supplier/ Automation Team | Grant browse, read, write, and subscription access according to node ownership | ## 1. Verify Network Connectivity From the **Connect IoT Runtime** environment: 1. Verify that the OPC UA endpoint is reachable. 2. Confirm that routing, firewall, or load-balancing behavior does not change the intended endpoint identity. 3. Confirm that production and non-production endpoints cannot be confused. ## 2. Configure the Selected OPC UA Server Profile Resolve the profile by using the [Profile Selection Rule](#profile-selection-rule), then configure every required value in that selected profile. A Resource-specific profile and the `Default` profile are alternatives; they are not merged. ## 3. Establish Security and Trust 1. Select the endpoint whose `SecurityPolicy` and `SecurityMode` match the approved security design. 2. Configure the required OPC UA identity. 3. Provision the **Connect IoT** client certificate and protect its private key when certificates are used. 4. Trust the client certificate on the **OPC UA Server**. 5. Trust the server or issuing certificate on the **Connect IoT OPC UA Client** side when required. ## 4. Resolve the Resource Node The selected profile's `Namespace` and the Resource's MES hierarchy are combined during setup. The result is stored in the read-only Resource attribute `IndEqOpcUaBaseNodeId` as a fully qualified string NodeId: ```text ns=;s= ``` For example: ```text ns=2;s=Northwind.PortoPlant.PackagingHall.FillingArea.Line01.Filler01 ``` Validate that: 1. `Namespace` matches the namespace that contains the machine's Resource tree in the target server. 2. `IndEqOpcUaBaseNodeId` contains the expected namespace and hierarchy path after controller setup. 3. The generated base node identifies the intended Resource. 4. The required `Operation`, `Recipe`, `DataCollection`, and `State` paths can be browsed below it. Do not assume that a namespace index copied from another environment remains valid. See [OPC UA Address Space](../modeling/opcua-address-space.md) for relative-node construction and [Configure MES and the Resource](mes-resource-configuration.md#3-verify-the-generated-opc-ua-base-node) for Resource-level verification. ## 5. Validate Access by Ownership | Node owner and category | Required **Connect IoT** access | | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | Machine-owned requests, payloads, confirmations, Data Collection values, and state values | **Connect IoT** reads these nodes and subscribes to nodes that trigger processing | | `MESOperationPerformed` and `MESPostDataPerformed` | **Connect IoT** writes these nodes after the related MES action succeeds | | Recipe Parameters | **Connect IoT** writes the values resolved by MES | | Resource folders and objects | **Connect IoT** browses these nodes during configuration and validation | | Nodes outside the enabled features | No access is required by this standard | The following reference defines the complete profile-selection rule and the supported connection settings. ## OPC UA Server Settings ### Available Profiles The standard supports two profile locations: - one shared `Default` profile. - one optional Resource-specific profile named exactly after an MES Resource. Shared profile: ```text /IndEq/Automation/OpcUaServer/Default/ ``` Resource-specific profile: ```text /IndEq/Automation/OpcUaServer// ``` ### Profile Selection Rule For each Resource, the integration performs one lookup: 1. Look for `/IndEq/Automation/OpcUaServer//`. 2. If that profile exists, use the complete Resource-specific profile. 3. If it does not exist, use the complete `Default` profile. 4. If the selected profile is missing required settings, report a configuration error. !!! important "Profiles are not merged" The integration does not combine individual Resource-specific settings with values from `Default`. The `Default` profile is selected only when the Resource-specific profile is not found. Therefore, when a Resource-specific profile is created, configure every required setting under that Resource path. ### Connection Settings The following fields belong to each `Default` or Resource-specific profile. | Setting | Example `Default` path | Delivered default | Purpose | | --- | --- | --- | --- | | `Namespace` | `/IndEq/Automation/OpcUaServer/Default/Namespace/` | `2` | Namespace index containing the Resource node tree; used to generate `IndEqOpcUaBaseNodeId` | | `Address` | `/IndEq/Automation/OpcUaServer/Default/Address/` | `opc.tcp://localhost:4338` | OPC UA Server endpoint address | | `Username` | `/IndEq/Automation/OpcUaServer/Default/Username/` | Empty | Username used to access the OPC UA Server | | `Password` | `/IndEq/Automation/OpcUaServer/Default/Password/` | Empty | Protected password used to access the OPC UA Server | | `SecurityPolicy` | `/IndEq/Automation/OpcUaServer/Default/SecurityPolicy/` | `None` | Endpoint security policy: `None`, `Basic128`, `Basic192`, `Basic256`, or `Basic256Sha256` | | `SecurityMode` | `/IndEq/Automation/OpcUaServer/Default/SecurityMode/` | `None` | Message security mode: `None`, `Sign`, or `SignAndEncrypt` | | `Certificate` | `/IndEq/Automation/OpcUaServer/Default/Certificate/` | Empty | Client certificate as a PEM file path or PEM content | | `PrivateKey` | `/IndEq/Automation/OpcUaServer/Default/PrivateKey/` | Empty | Private key as a PEM file path or PEM content | For a Resource-specific profile, replace `Default` with the exact MES Resource name in every path. ### Automation Timeout Settings The timeout settings are global to the OPC UA Standard integration behavior; they are not part of a `Default` or Resource-specific profile. | Setting | Path | Delivered default | Purpose | | --- | --- | --- | --- | | `ConnectIoTRequestTimeout` | `/IndEq/Automation/ConnectIoTRequestTimeout/` | `60000` ms | Maximum time MES waits for a reply after sending a request to Connect IoT | | `MachineReplyTimeout` | `/IndEq/Automation/OpcUaServer/MachineReplyTimeout/` | `10000` ms | Maximum time to wait for `MachineOperationConfirmed = true` after notifying the machine of **Track In**, **Track Out**, or **Abort** | Configure `MachineReplyTimeout` to allow the PLC scan, machine processing, and OPC UA communication to complete under normal conditions. If the confirmation is not received within this period, the command fails, the MES operation does not succeed, and its transaction is rolled back. Coordinate both timeout values so the enclosing MES-to-IoT request does not expire before the machine-confirmation path has had time to complete. Validate the selected values under representative production network and PLC-load conditions. ### Examples Resources without individual profiles use the shared profile: ```text Filler01 -> /IndEq/Automation/OpcUaServer/Default/ Labeler01 -> /IndEq/Automation/OpcUaServer/Default/ ``` A Resource with its own profile uses only that profile: ```text Tester01 -> /IndEq/Automation/OpcUaServer/Tester01/ ``` The presence of `Tester01` does not affect any other Resource. ### Security Rules - Prefer signed and encrypted endpoints for production. - Trust the Connect IoT client certificate on the server when certificate authentication is used. - Grant read/write rights only for nodes required by enabled features. - Protect credentials and private keys. - Validate certificate expiry, hostname, endpoint, and trust stores during commissioning.