Skip to content
View as markdown Ask ChatGPT Ask Claude

Configure the OPC UA Connection#

Purpose#

This procedure establishes communication between Connect IoT and the machine's OPC UA Server. It is the canonical reference for OPC UA Server profile selection, connection fields, Namespace, and automation timeout settings.

Responsibility and Inputs#

Area Owner Required input
Network connectivity Infrastructure team Provide the endpoint hostname, port, route, DNS, and firewall access from the Automation Manager
OPC UA endpoint Machine supplier/ Automation Team Provide the endpoint URL and supported SecurityPolicy and SecurityMode combinations
Profile configuration Automation team Configure OPC UA Server connection settings
Resource addressing MES and automation teams Agree the namespace and hierarchy that identify the machine Resource
Node permissions Machine supplier/ Automation Team Grant browse, read, write, and subscription access according to node ownership

1. Verify Network Connectivity#

From the Connect IoT Runtime environment:

  1. Verify that the OPC UA endpoint is reachable.
  2. Confirm that routing, firewall, or load-balancing behavior does not change the intended endpoint identity.
  3. Confirm that production and non-production endpoints cannot be confused.

2. Configure the Selected OPC UA Server Profile#

Resolve the profile by using the Profile Selection Rule, then configure every required value in that selected profile. A Resource-specific profile and the Default profile are alternatives; they are not merged.

3. Establish Security and Trust#

  1. Select the endpoint whose SecurityPolicy and SecurityMode match the approved security design.
  2. Configure the required OPC UA identity.
  3. Provision the Connect IoT client certificate and protect its private key when certificates are used.
  4. Trust the client certificate on the OPC UA Server.
  5. Trust the server or issuing certificate on the Connect IoT OPC UA Client side when required.

4. Resolve the Resource Node#

The selected profile's Namespace and the Resource's MES hierarchy are combined during setup. The result is stored in the read-only Resource attribute IndEqOpcUaBaseNodeId as a fully qualified string NodeId:

ns=<Namespace>;s=<HierarchyPath>

For example:

ns=2;s=Northwind.PortoPlant.PackagingHall.FillingArea.Line01.Filler01

Validate that:

  1. Namespace matches the namespace that contains the machine's Resource tree in the target server.
  2. IndEqOpcUaBaseNodeId contains the expected namespace and hierarchy path after controller setup.
  3. The generated base node identifies the intended Resource.
  4. The required Operation, Recipe, DataCollection, and State paths can be browsed below it.

Do not assume that a namespace index copied from another environment remains valid. See OPC UA Address Space for relative-node construction and Configure MES and the Resource for Resource-level verification.

5. Validate Access by Ownership#

Node owner and category Required Connect IoT access
Machine-owned requests, payloads, confirmations, Data Collection values, and state values Connect IoT reads these nodes and subscribes to nodes that trigger processing
MESOperationPerformed and MESPostDataPerformed Connect IoT writes these nodes after the related MES action succeeds
Recipe Parameters Connect IoT writes the values resolved by MES
Resource folders and objects Connect IoT browses these nodes during configuration and validation
Nodes outside the enabled features No access is required by this standard

The following reference defines the complete profile-selection rule and the supported connection settings.

OPC UA Server Settings#

Available Profiles#

The standard supports two profile locations:

  • one shared Default profile.
  • one optional Resource-specific profile named exactly after an MES Resource.

Shared profile:

/IndEq/Automation/OpcUaServer/Default/

Resource-specific profile:

/IndEq/Automation/OpcUaServer/<ResourceName>/

Profile Selection Rule#

For each Resource, the integration performs one lookup:

  1. Look for /IndEq/Automation/OpcUaServer/<ResourceName>/.
  2. If that profile exists, use the complete Resource-specific profile.
  3. If it does not exist, use the complete Default profile.
  4. If the selected profile is missing required settings, report a configuration error.

Profiles are not merged

The integration does not combine individual Resource-specific settings with values from Default. The Default profile is selected only when the Resource-specific profile is not found. Therefore, when a Resource-specific profile is created, configure every required setting under that Resource path.

Connection Settings#

The following fields belong to each Default or Resource-specific profile.

Setting Example Default path Delivered default Purpose
Namespace /IndEq/Automation/OpcUaServer/Default/Namespace/ 2 Namespace index containing the Resource node tree; used to generate IndEqOpcUaBaseNodeId
Address /IndEq/Automation/OpcUaServer/Default/Address/ opc.tcp://localhost:4338 OPC UA Server endpoint address
Username /IndEq/Automation/OpcUaServer/Default/Username/ Empty Username used to access the OPC UA Server
Password /IndEq/Automation/OpcUaServer/Default/Password/ Empty Protected password used to access the OPC UA Server
SecurityPolicy /IndEq/Automation/OpcUaServer/Default/SecurityPolicy/ None Endpoint security policy: None, Basic128, Basic192, Basic256, or Basic256Sha256
SecurityMode /IndEq/Automation/OpcUaServer/Default/SecurityMode/ None Message security mode: None, Sign, or SignAndEncrypt
Certificate /IndEq/Automation/OpcUaServer/Default/Certificate/ Empty Client certificate as a PEM file path or PEM content
PrivateKey /IndEq/Automation/OpcUaServer/Default/PrivateKey/ Empty Private key as a PEM file path or PEM content

For a Resource-specific profile, replace Default with the exact MES Resource name in every path.

Automation Timeout Settings#

The timeout settings are global to the OPC UA Standard integration behavior; they are not part of a Default or Resource-specific profile.

Setting Path Delivered default Purpose
ConnectIoTRequestTimeout /IndEq/Automation/ConnectIoTRequestTimeout/ 60000 ms Maximum time MES waits for a reply after sending a request to Connect IoT
MachineReplyTimeout /IndEq/Automation/OpcUaServer/MachineReplyTimeout/ 10000 ms Maximum time to wait for MachineOperationConfirmed = true after notifying the machine of Track In, Track Out, or Abort

Configure MachineReplyTimeout to allow the PLC scan, machine processing, and OPC UA communication to complete under normal conditions. If the confirmation is not received within this period, the command fails, the MES operation does not succeed, and its transaction is rolled back.

Coordinate both timeout values so the enclosing MES-to-IoT request does not expire before the machine-confirmation path has had time to complete. Validate the selected values under representative production network and PLC-load conditions.

Examples#

Resources without individual profiles use the shared profile:

Filler01  -> /IndEq/Automation/OpcUaServer/Default/
Labeler01 -> /IndEq/Automation/OpcUaServer/Default/

A Resource with its own profile uses only that profile:

Tester01 -> /IndEq/Automation/OpcUaServer/Tester01/

The presence of Tester01 does not affect any other Resource.

Security Rules#

  • Prefer signed and encrypted endpoints for production.
  • Trust the Connect IoT client certificate on the server when certificate authentication is used.
  • Grant read/write rights only for nodes required by enabled features.
  • Protect credentials and private keys.
  • Validate certificate expiry, hostname, endpoint, and trust stores during commissioning.