OPC UA Client Driver
OPC UA Client Driver
iFIX
OPC UA Client Driver
Proprietary Notice
The information contained in this publication is believed to be accurate and reliable.
However, GE Vernova assumes no responsibilities for any errors, omissions or
inaccuracies. Information contained in the publication is subject to change without notice.
Trademark Notices
“VERNOVA” is a registered trademark of GE Vernova. “GE VERNOVA” is a registered
trademark of GE Aerospace exclusively licensed to GE Vernova. The terms “GE” and the
GE Monogram are trademarks of GE Aerospace, and are used with permission. All other
trademarks are the property of their respective owners.
We want to hear from you. If you have any comments, questions, or suggestions about our
documentation, send them to the following email address:
[email protected]
Table of Contents
Introduction 1
Limitations 3
Security 3
Security Considerations 4
Configuration 4
How to Add User Privileges for the OPC UA Client Driver in iFIX 5
Server Configuration 8
Group Configuration 11
Delete a Group 12
Redundancy Configuration 12
Configure Redundancy 13
The iFIX OPC UA (OPC Unified Architecture) Client is a device communications module that can con-
nect to OPC UA Servers and collect data from UA variables. This help provides information on how to
configure and use this client.
l Introduction
l Security
l Configuration
Introduction
For a brief introduction on the iFIX OPC UA Client, refer to the sections below.
OPC UA defines a platform independent communication system that has a useful and adaptive Information
Model for both industrial and business application needs. Like iFIX, OPC UA builds on the success and
strength of common industrial standards. Developed by the OPC Foundation and meant to be platform inde-
pendent, OPC UA can provide lower costs and increased productivity for end-users, systems integrators,
and process control vendors alike by focusing communications issues on a single technology and strategy.
The iFIX OPC UA (OPC Unified Architecture) Client is a device communications module that can connect
to OPC UA Servers to browse and collect data from items in the OPC UA address space. Use the Con-
figuration Hub tool to browse an OPC UA Server and automatically create driver tags in iFIX.
The OPC UA Client can be configured in a few simple steps. For details on these steps, refer to the "Quick
Start: OPC UA Client Configuration" on page 4 topic.
Basic components for iFIX OPC UA Client communication and the general connectivity hierarchy is out-
lined in the following figure.
Limitations
When using the OPC UA Client (OUA) Driver with iFIX, be aware of the following limitations:
l While the OPC Driver supports Suppression of COMM alarms and Data Latching, the
OPC UA Client driver does not.
l Array indexes greater than 65535 are not supported.
l Autocreating a driver tag in the Database Manager with an index into an array is not supported.
l Matrices are not supported. While OPC UA supports scalar values, arrays, and matrices,
Matrices are not supported in the OPC UA Client Driver.
l Writing values greater than 256 bytes is not supported. This could be as few as 128 characters.
l The OPC UA Client Driver has been tested with up to 50 configured servers, and 250 groups. Per-
formance or connectivity issues may be encountered when exceeding those limits.
l The OPC UA Client Driver can only write to individual elements (1 array index at a time). You can-
not write to the whole array at the same time. Servers that do not support writing to individual
array elements will reject the individual index write and may return an error such as
BadWriteNotSupported.
l Servers that do not support subscriptions are unsupported. We require the server to support sub-
scriptions.
l Autocreate of tags in the Database Manager only works for node IDs no longer than 80 char-
acters (the I/O address field in database).
l Complex data types are not supported. Arrays of complex data types will report BadOutOfRange
errors in the iFixUaClient_OUASPOLL.log file. Examples of complex types include:
l DataValue
l DiagnosticInfo
l Enumeration
l Structure
l XmlElement (can read a single element as a string, but arrays are unreadable)
Security
Security is based on OPC UA standards. The OPC UA Client Driver uses the Configuration Hub tool for
configuration. From this powerful web client you can configure a connection to an OPC UA Server,
browse for data sources, and automatically populate the iFIX database with new tags.
Use of the Configuration Hub tool will require you to enable security in iFIX.
Security Considerations
l Configuration Hub is provided for driver configuration. This tool integrates with the iFIX security
for user authentication and authorization.
l The user must provide a valid iFIX user name and password in order to successfully connect to
iFIX from Configuration Hub.
l In order to login to Configuration Hub, the iFIX user must belong to the Application Designer
security group in iFIX.
l After a session has been established with the OPC UA Server, the user’s permissions and priv-
ileges are enforced by the iFIX security system. If the logged-in user does not have permission to
write to a given tag or acknowledge its alarms (based on the tag’s security areas configuration),
then the operation will fail.
l When using Enhanced Failover, the OPC UA Client will not allow you to make changes unless
the primary node is in Maintenance Mode.
Configuration
The OPC UA Client Driver is added to iFIX the same way you would add other drivers, using the System
Configuration (SCU) tool. After you add the driver and restart iFIX, you can then configure the driver
using Configuration Hub. The following steps outline how to quickly add and configure your driver.
1. In iFIX, add user privileges (add user to Application Designer group) and enable security.
2. In the iFIX System Configuration Utility, add the OPC UA Client driver, if it is not already added.
3. Start or restart iFIX.
4. Start Configuration Hub from the iFIX WorkSpace (in the system tree, select the OUA entry in
the I/O Drivers folder). Use the iFIX user name and password that you created in the previous
steps to log in.
5. Confirm that your OPC UA Server is up and running.
6. In the Configuration Hub tool, click Connections, and on the OPC UA tab, click the New button to
add a server. In the Details panel, specify user credentials, and a security policy.
7. On the Connection tab, click Test Connection to begin the certificate trust process:
a. On the iFIX SCADA for Configuration Hub, trust the server..
b. On the OPC UA Server, in its certificate management tool, trust the OPC UA Client.
c. In the Configuration Hub tool, click Test Connection again. The connection should suc-
ceed.
How to Add User Privileges for the OPC UA Client Driver in iFIX
1. Start iFIX.
2. In the WorkSpace, on the Applications tab, click Security and then Security Configuration Utility.
3. On the Edit menu select User Accounts. The User Accounts dialog box appears.
4. Click Add. The User Profile dialog box appears.
5. If using Windows users, select Use Windows Security.
6. In the User Name field, enter the user that you created for use with iFIX.
7. If needed, enter the Domain.
8. Add the Application Designer group to the user in order to use Configuration Hub.
9. Modify other groups, security areas, and application features as appropriate. Do not delete Database
Save and Database Block Add-Delete application features as those are needed to add tags.
10. Click OK, and OK again.
11. On the File menu, click Save.
The server selection screen for Configuration Hub appears in a web browser.
3. Select the iFIX Server you want to connect to. The login screen appears for that selected server.
4. Enter the user name and password of the account configured to use the Configuration Hub tool.
NOTE: Configuration Hub is currently not supported in Internet Explorer.
1. On the computer where your OPC UA Server resides, confirm that your server is up and running.
This step is important to ensure that you can retrieve the policies when configuring your server. You
must do this before making any configuration additions or changes in the Configuration Hub tool.
2. From the Configuration Hub tool, on the Connection tab, click OPC UA, and then click the New but-
ton to add a server. The New OPC UA Server Connection dialog box appears.
4. In the Endpoint URL field, enter the host name or IP address and port used to connect with the
OPC UA Server. For example: opc.tcp://MyServer:51400/. The format of this URL (with the machine
name, IP address, or fully qualified domain name) is defined on your OPC UA Server.
5. On the Details panel, select the Security Mode (None, Sign, or Sign and Encrypt).
6. In the Security Policy Uri field, select a security policy to apply to this connection: Basic128Rsa15,
Basic256, Basic256Sha256, Aes128_Sha256_RsaOaep, or Aes256_Sha256_RsaPss.
NOTE: If you are not sure what to select for Security Mode and Security Policy or simply want to test a con-
nection, select None. Be sure that you go back and change this setting later, however, to ensure you have
adequate security enabled for your connections.
7. Also on the Details panel, confirm that Disable is set to False so that you can use this driver to cre-
ate groups and tags for iFIX. When the Disabled field is set to True, the configuration exists, but it is
not available for use yet.
9. If UserName/Password is selected, enter the user name and password to connect to the OPC UA
Server.
10. Click Test Connection near the top of the Details panel to test the server configuration.
1. From Configuration Hub, select the configured server on the Connection tab. (The server name, end-
point URL, security mode, security policy, and authentication settings should already be configured.)
2. Click Test Connection. Based on the server security policies, the connection will fail with a ‘Server
Not trusted’ message.
3. On the SCADA Server, trust the OPC UA Server's certificate:
a. From the iFIX WorkSpace, on the Application tab, click OPC UA Configuration. The
OPC UA Server Configuration Tool appears.
b. Click the Trust List.
c. Select the server name and click Trust. A message appears.
d. Click Yes to continue.
4. Click Test Connection again. The test will fail again, this time with a ‘Server doesn’t trust this client’
message.
Server Configuration
Use the Connection screen in the Configuration Hub tool to add your OPC UA server, and configure your
connection to the OPC UA Server, as shown in the following figure. From the Details panel, you can spe-
cify the OPC UA Server name, endpoint URL, security mode (signing options), security policy (encryp-
tion type), and authentication settings (anonymous or a specified user). Typically, the OPC UA Server is
remote to the iFIX SCADA install.
After you add the connection, you must trust the server and client certificates before you can establish a
connection with the server. A server must be enabled before you can add groups or driver tags.
The following text explains how to add a server and make a connection to it, so that you can sub-
sequently add groups and tags.
IMPORTANT: After you have successfully connected to an OPC UA Server and created Driver Tags, you
should not change the configured Endpoint URL of the server unless the server instance has been moved or
its endpoint has changed (such as if it now uses a different port). Changing the Endpoint URL to point to a dif-
ferent server can result in no data being available for some or all Driver Tags from that server. It is recom-
mended to always create new server connections if connecting to a different server.
Additionally, on the Connection tab, you can also specify the redundancy settings for your
OPC UA Server connection, if you have this feature enabled on your OPC UA Server. On the Details
panel, scroll to the end of the details to view the Redundancy settings, as show in the following figure.
You can configure up to 3 backup servers (endpoint URLs).
For details on these steps, refer to the "Quick Start: OPC UA Client Configuration" on page 4 topic.
1. On the computer where your OPC UA Server resides, confirm that your server is up and running.
This step is important to ensure that you can retrieve the policies when configuring your server.
You must do this before making any configuration additions or changes in the Configuration Hub
2. From the Configuration Hub tool, on the Connection tab, click OPC UA, and then click the New
button to add a server. The New OPC UA Server Connection dialog box appears.
3. In the Server Name field, enter the logical name of the computer where the OPC UA Server is run-
ning (include the fully qualified domain name if on a domain).
4. In the Endpoint URL field, enter the host name or IP address and port used to connect with the
OPC UA Server. For example: opc.tcp://MyServer:51400/. The format of this URL (with the
machine name, IP address, or fully qualified domain name) is defined on your OPC UA Server.
5. On the Details panel, select the Security Mode (None, Sign, or Sign and Encrypt).
6. In the Security Policy Uri field, select a security policy to apply to this connection:
Basic128Rsa15, Basic256, Basic256Sha256, Aes128_Sha256_RsaOaep, or Aes256_Sha256_
RsaPss.
NOTE: If you are not sure what to select for Security Mode and Security Policy or simply want to test a
connection, select None. Be sure that you go back and change this setting later, however, to ensure
you have adequate security enabled for your connections.
7. Also on the Details panel, confirm that Disable is set to False so that you can use this driver to
create groups and tags for iFIX. When the Disabled field is set to True, the configuration exists,
but it is not available for use yet.
9. If UserName/Password is selected, enter the user name and password to connect to the
OPC UA Server.
10. Click Test Connection near the top of the Details panel to test the server configuration.
1. From the Configuration Hub tool, select the configured server on the Connection tab. (The server
name, endpoint URL, security mode, security policy, and authentication settings should already
be configured.)
2. Click Test Connection. Based on the server security policies, the connection will fail with a
‘Server Not trusted’ message.
Group Configuration
The Connections tab allows you to create, manage, and view groups added or associated with your
OPC UA Server. In the New OPC UA Group Creation dialog box or in the Details panel for the specified
group, you can configure the publishing interval and sampling interval for each group. Any application
requesting data from the OPC UA Server uses group names to access items in the group. Group names
can be up to 19 alphanumeric characters including underscores ( _ ) and hyphens ( - ).
You must have an enabled OPC UA Server configured and a connection established before you add a
group.
Delete a Group
1. Select the row of the group name you want to delete.
2. Click the ellipses (...) button next to group name you want to delete.
3. Click Delete.
4. Click Save to complete the deletion and update the server.
Redundancy Configuration
On the Connection tab, you can also specify the redundancy settings for your OPC UA Server con-
nection, if you have this feature enabled on your OPC UA Server. Scroll to view the Redundancy set-
tings on the Connection tab, as show in the following figure. You can configure Cold, Warm, or Hot
redundancy.
According to the OPC Foundation: Cold redundancy requires an OPC UA Client to reconnect to a
backup server after the initial server has failed. Warm redundancy allows a client to connect to multiple
servers, but only one server will be providing data values. In Hot redundancy, In Hot redundancy, sub-
scriptions are created in multiple servers but only 1 server is active and providing data to the client at a
time.
If using Enhanced Failover, you must be in Maintenance Mode before you log in the Configuration Hub
UI. Maintenance Mode allows you to temporarily suspend synchronization between the two SCADA
nodes in an Enhanced Failover pair. This allows you to add or modify groups and tags in your iFIX
Configuration Hub will not allow you to make changes unless the primary node is in Maintenance Mode.
It will also not allow any configuration on the Secondary node (you cannot login). All changes to a Fail-
over pair’s configuration must be made on the Primary node.
NOTE: If you are manually copying configuration files into the PDB\iFixUaClient subfolders on your Primary
SCADA, you must do the same on your Secondary SCADA.
IMPORTANT: Be aware that if you add a server to the primary, you will need to deal with certificate man-
agement on the secondary as well.
Server and Group configuration files are found in the PDB\iFixUaClient folder, in Servers and Groups
folders, respectively. Each server and group has its own file. In each of these folders, compare the con-
tents on the Primary node to those on the Secondary. If a file exists on the Secondary but not on the
Primary then open the file in a text editor and verify that it is a server or group that was deleted from the
Primary. If so, delete that file from the Secondary. Do not delete the Group file for the group named
OUA_DIAGNOSTICS. This is an internal group used by the OPC UA Client Driver. The file may be
named differently on the Secondary than it is on the Primary node, but that is expected, and it should not
be deleted.
For all other operations, the synchronization works as expected such as: Server Create, Driver tag dele-
tions or updates, Group updates, and so on.
Enhanced Failover 13
Group Configuration 11
Limitations 3
OPC UA Driver 1
Quick Start 4
Redundancy 12
Server Configuration 8