# OPC UA

OPC UA server tags, history and alarms right in the chat

Теги сервера OPC UA (Kepware, Ignition, SCADA, ПЛК) через шлюз, только чтение

## How the agent works with OPC UA

The gateway runs as a service on a computer on the site network and connects to the OPC UA server itself at the opc.tcp address you give, with a login and password or anonymously. It sends data out over an outbound connection only. The connection is assigned to the gateway on the Gateways tab of the connection settings.

The gateway browses the address space from Objects or from the root you name, takes units and range for numeric variables and subscribes to changes instead of polling tags. The deadband goes to the server as a data change filter. Alarms are read through Alarms & Conditions, and on a server with the umati model the gateway recognises machines, their state and active program.

By default the gateway picks the server's strongest secured policy and never falls back to None on its own: an open channel is the owner's choice only. The deprecated Basic128Rsa15 and Basic256 are not supported, and an unknown server certificate is not trusted. The gateway session can only read: it has no value writes and no method calls, except asking for current alarms (ConditionRefresh).

If the link to the server drops, after reconnecting the gateway reads what it missed from the server history (HistoryRead), but no further back than a week. Kepware and Ignition as OPC UA servers usually keep no history, and then the break stays a gap. While the cloud is unreachable, values pile up on the gateway disk and arrive once the link is back.

## Integration scenarios

### What is on the line now
The agent finds tags by name or description and shows current values with units, source time and quality.

### A shift trend
The agent reads a tag's history for a shift or a week and names the minimum, maximum, average and the moments the value left its range.

### Active alarms
The agent collects the server's Alarms & Conditions: which stand now, which are acknowledged and when they were raised.

### Machine state
On a server with the umati model the agent shows each machine, its state, operation mode, channel state, feed override and active program.

### A threshold message
In an event task the agent tells you when a tag's value crosses a threshold and holds for the set time, and when it is back to normal.

### Link to the site
The agent tells you when the gateway went offline and came back, and shows a gap in a tag's history if the server could not fill it.

## How to connect

**Before you connect**

- An OPC UA server reachable over opc.tcp from the gateway computer
- A computer on the site network for the gateway service
- A server user with read rights, or anonymous sign-in allowed
- Mutual trust of the gateway and server certificates in secured mode

### Find the server's endpoint address
The opc.tcp://host:port address is in the OPC UA server settings (the standard port is 4840). Open that port from the gateway computer to the server.

### Add a user with read rights
Create a server user allowed to read tags and their history. Without a login and password the gateway signs in anonymously, if the server allows it.

### Trust the gateway certificate on the server
The gateway presents its own application certificate. If the server rejected it on the first attempt, move that certificate to the trusted list on the server.

### Trust the server certificate on the gateway
The gateway puts an unknown server certificate into pki/opcua/rejected/certs/ in its data folder. Move it to pki/opcua/trusted/certs/.

## FAQ

### How do I connect OPC UA?
Install the gateway on a computer on the site network and add it on the Gateways tab. In the connection enter an address such as opc.tcp://10.0.12.5:4840, plus a user and password if the server asks for them. Then trust the gateway certificate on the server and the server certificate on the gateway.

### What does the agent see in OPC UA?
The server tree's variables with type, units, range and description, their current values and history, Alarms & Conditions, and on servers with the umati model also machines with their state and program. The browse can be narrowed by a root or a list of NodeIds.

### Does the agent change values?
No. The gateway session cannot write values or call methods. Its one call, ConditionRefresh, only asks the server to send current alarms again. The agent cannot acknowledge alarms either.

### The connection is refused over a certificate. What now?
The gateway puts an unknown server certificate into pki/opcua/rejected/certs/ in its data folder. Move the file to pki/opcua/trusted/certs/, or put the certificate of the issuing authority into pki/opcua/issuer/certs/. The server in turn has to trust the gateway certificate.