OPC UA Server

The standard installation of CODESYS includes an OPC UA Server. You can use it to access the variable interface of the controller via a client. The OPC UA Server communicates with connected OPC UA Clients over a separate TCP connection. That is why these connections have to be examined again separately with regard to security.

The OPC UA Server can now be safeguarded by using encrypted communication to the client and OPC UA user management. You will find the possible settings for this in the following sections.

Important

In runtime version 3.5 SP17 and higher, a device user management has to be set up by default for access to the CODESYS runtime systems. However, for the OPC UA Server it is possible to continue to allow for anonymous access if this is explicitly permitted. This permission is granted in the Change Communication Policy dialog on the Communication Settings tab of the device editor.

. The CODESYS OPC UA server supports the following features:

Browsing of data types and variables
Standard read/write services
Notification for value changes: subscription and monitored item services
Encrypted communication according to "OPC UA standard (profile: Basic256SHA256)"
Imaging of the IEC application according to "OPC UA Information Model for IEC 61131-3"
Supported profile: "Micro Embedded Device Server Profile"
Number of sessions
By default, monitored items and subscriptions are not restricted. The number depends on the performance of the respective platform.
Sending of events according to the OPC UA standard
Communication with a data source OPC UA Client
For more information, see: Establishing the Connection of a Data Source OPC UA Client to an OPC UA Server

Tip

The OPC UA Client UAExpert is cited many times in this chapter. UAExpert is a product of the vendor "Unified Automation".

For more information, see: Unified Automation

Creating a project for OPC UA access

Create a new project with a CODESYS Control Win V3 controller.
Declare some variables of different types in the program PLC_PRG.
Insert a Symbol Configuration object below the application.
In the Add Symbol Configuration dialog, select the Support OPC UA features option.
Open the symbol configuration in the editor.
Click the Build command.
The variables are displayed in a tree structure.
Select the variables that you want to change with an OPC UA Client. Specify the access rights.
Download the project to the controller.

Configuration and commissioning of the OPC UA Server

The OPC UA Server can be adapted to the requirements of different environments. A number of different security settings are available for this purpose. Changing these settings requires the PLC to be restarted. These values can be set by means of the Device Security Settings (OPC UA Server) of the PLC.

For more information, see CA-Signed Certificates Preferred and Certificate Expired.

Configuration of the OPC UA certificates

Procedure. Generating a certificate for the CODESYS OPC UA Server

In order to encrypt data and exchange it with the client safely, the server needs a certificate that the client must classify as "trusted" when a connection is established for the first time.

Requirement: The active path to the controller is set.

Install the CODESYS Security Agent add-on.
Click View → Security Screen.
Select the Devices tab.
In the view on the left, select the controller.
In the right view, all services of the controller which require a certificate are displayed.
Select the OPC UA Server service.
Create a new certificate for the device. To do this, click the icon.
The Certificate Settings dialog opens.
Define the certificate parameters and click OK to close the dialog.
The certificate is created on the controller.
Restart the runtime system.

Procedure. Installing trusted certificates

To use signed certificates in the OPC UA Server, the certificates of the trusted certificate authorities (CA) have to be installed under "Trusted Certificates".

To install certificate revocation lists (CRL) of the CAs, the following steps are required:

Transfer of the CRLs per file transfer into the cert/import directory
Execution of the PLC shell command "cert-importcrl"

In case the client certificates are not signed directly by the trusted CA, but rather have a longer chain, then the certificates of the intermediate CAs have to be installed separately. These are transferred per file transfer to the directory "OPCUAServer/Intermediate". After the transfer, these certificates are automatically used by the OPC UA Server.

Note

In order to also set up an encrypted access to the OPC UA Server purely for browsing, a certificate can be created solely for this purpose in the Communication Settings dialog of the data source manager.

Specification-compliant configuration of the OPC UA Server

To operate the OPC UA Server according to the OPC UA specification, the following settings are required:

The City location has to be configured for the certificate.
An OPC UA Server certificate has to be generated
The CRL checks EnableCRLChecks have to be enabled.
The CommunicationMode has to be set to MIN_SIGNED or SIGNED_AND_ENCRYPTED.

Setting up an encrypted connection with the "UaExpert" client

The "UaExpert" OPC UA Client is freely accessible software that you can download from the Internet. You can use this client to connect to the CODESYS OPC UA Server. The following description refers to this program. Other OPC UA Clients work in a similar way.

Start the UaExpert program.
Click Server → Add.
The Add Server dialog opens.
In the tree view, expand Local → OPCUAServer@.
Select the connection type Basic256Sha256 – Sign & Encrypt (uatcp-uasc-uabinary) and click OK to close the dialog.
Click Server → Connect.
The Certificate Validation dialog opens with an error message.
Select the Accept the server certificate temporarily for this session option and click Continue.
In CODESYS, click the symbol.
The view is refreshed.
Select the Quarantined Certificates folder.
The UaExpert@ client certificate is displayed in the right view.
Drag the certificate to the Trusted Certificates folder.
Now the client certificate is classified as "trusted" by the server.
In the UaExpert client, click Server → Connect.
The Certificate Validation dialog opens with an error message.
Select the Accept the server certificate temporarily for this session option and click Continue.
The connection is established and objects are displayed in the Address Space view.

User management in OPC UA

The CODESYS OPC UA server supports the CODESYS user management. You set the access rights on the server from the Access Rights tab on the controller. To do this, select the RuntimeSystemObjects → RemoteConnections → OPCUAServer object.

If anonymous access to the OPC UA Server is permitted despite an active user management, then the access rights can also be configured for this access by granting corresponding permissions for the implicitly available group "Anonymous_OPCUAServer". The permission for anonymous access to the OPC UA Server is granted in the Change Communication Policy dialog. For a description of this dialog, see the help page for of Tab: Communication Settings.

Access rights can be checked at both the service and objects levels. This means that a variable cannot be written by a user, although this user is generally allowed to write to the OPC UA Server.

OPC UA Service	Permission
AttributeRead	View
AttributeRead	Modify
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View
AttributeRead	View

For more information, see: Handling of Device User Management

Using the OPC UA Client to change a variable

In the Address Space view, in the UaExpert client, expand the Objects → DeviceSet → |tvOPCUA| → Application → Global Vars → GVL object.
The variables of the global variable list are visible.
Select the variables and drag them to the Data Access View.
The variables and their current values are shown.
Change the variable values by double-clicking the Value field.

Using events or alarms in the CODESYS project

The CODESYS OPC UA Server provides the capability of sending standard OPC UA events and mapping alarms in a simplified form.

Caution

The mapping of alarms from the alarm management does not meet all requirements from the OPC UA specification. In particular, the state machines are different and no comments can be assigned. The mapping is used to provide the possibility of basic interaction between an OPC UA Client and the alarm management.

Procedure. Creating alarms and events

Create a new project with a CODESYS Control Win V3 controller.
Insert an Alarm configuration object below the application.
Add the library CmpOPCUAProviderAlarmConfiguration to the Library Manager.
When the library is added, it connects automatically as a client to the alarm configuration and sends the events to the OPC UA Server.
Insert a Symbol Configuration object below the application.
Insert a Visualization object below the Application.
Download the project to the controller and start it.

Alarms are used and generated normally. No special steps are required here.

If you want to create events, then the following additional steps are required.

Insert an AlarmClass object below the Alarm Configuration. Specify a name (example: Event).
The new alarm class opens in the editor.
Select the acknowledgment method REP.
Insert an Alarm Group object below the Alarm Configuration. Specify a name (example: ApplicationEvent).
The new alarm group opens in the editor.
. Change the following parameters:
- Observation type: Event
- Class: Event
- Message: "Message 1"

In the Program (for example, POU PLC_PRG), add a program call for triggering the event alarm.

AlarmManager.AlarmGlobals.g_AlarmHandler.RaiseEvent(Alm_AlarmConfiguration_Alarmgroup_IDs.ID_ApplicationEvent, Alm_ApplicationEvent_Alarm_IDs.ID_0);

For more information about alarm management and alarm visualization, see: Alarm Management and Alarm Visualization

Observing an event via the "UaExpert" OPC UA Client

Start the UaExpert program.
Click Server → Add.
The Add Server dialog opens.
In the tree view, expand Local → OPCUAServer@.
Select the connection type None and click OK to close the dialog.
Click Server → Connect.
An object tree is displayed in the Address Space view.
Click Documents → Add.
The Add Document dialog opens.
Select the Event View as the "Document Type".
The Event View tab opens.
In the Address Space view, expand the Objects → DeviceSet CODESYSCODESYS Control Win V3. object.
In Address Space, select the "CODESYS Control Win V3" object and drag it to the Event View.
The events are displayed.