OPC UA integration

Where OPC UA appears

Typical servers include PLC-embedded servers on Siemens S7-1500 or Beckhoff TwinCAT controllers, SCADA platforms that aggregate many devices, and gateway products that translate older protocols. Wind turbine SCADA, packaging lines and building plant often publish through OPC UA. Companion specifications, such as those for machine tools or packaging machines, give some servers a predictable information model, but many servers expose vendor-specific trees.

Transport and security

Connections use the binary opc.tcp transport, usually on port 4840 or a vendor-specific port. A security policy such as Basic256Sha256 with SignAndEncrypt is preferred. The client presents an application instance certificate that the server administrator must trust, and the server certificate is checked in return. Anonymous access, or None security mode, should only be used on isolated test benches. User authentication can be username and password or certificate based, depending on server support.

Prerequisites

• The endpoint URL and the security policies the server offers.
• A read-only user or role, and acceptance of the ALLINLET client certificate on the server.
• A list of NodeIds to read, preferably exported from the server or from engineering tools, rather than discovered ad hoc in production.
• Network permission from the integration zone to the server, often through a DMZ.

Reading and payload meaning

Each OPC UA value arrives as a DataValue: the value with its data type, a StatusCode, a SourceTimestamp and a ServerTimestamp. ALLINLET keeps the source timestamp as the measurement time and records a non-Good status code as a quality flag rather than discarding the context. Engineering units may be available through the EUInformation property of analog items; where they are absent, units are set in the mapping. Subscriptions with monitored items are suited to changing values, while periodic reads may suit slow tags.

Limitations

• Browsing a large address space live can load a server; node lists should be agreed in advance.
• Methods, writes and alarm acknowledgement are out of scope; the integration is read-oriented.
• Complex structured types may need specific decoding and are validated per server.
• Server certificate expiry and session limits are frequent causes of interruptions and should be monitored by the server owner.
• Listing OPC UA in the catalogue does not mean every vendor server has been tested; compatibility is confirmed during the project.

Related paths

Where a device only offers registers, Modbus may be simpler. Where a site gateway already publishes to a broker, MQTT can carry the same values with fewer firewall openings.

Further reading

• Iiot guide
• Protocols guide
• Predictive maintenance guide
• All resources
• Connector catalogue
• Industries
• Products

Catalogue listings describe possible integration paths. Implementation and validation status is confirmed for each source during project scoping; no certification, service level or price is implied by this page.