Create OPCUA.md #10

esmith1729 · 2025-05-06T09:38:30Z

Add file for general OPCUA knowledge

Tom-Willemsen

Thanks, this is looking close.

A few comments to improve readability below

Tom-Willemsen · 2025-05-12T11:46:15Z

doc/specific_iocs/plcs/OPCUA.md

+More info can be found [here on Wikipedia for a general overview](https://en.wikipedia.org/wiki/OPC_Unified_Architecture), or for a more detailed description from [OPC Foundation](https://opcfoundation.org/about/what-is-opc/).
+
+## How is authentication handled?
+Currently, the IOC does not seem to be able to support encrypted message security policy. It does, however, support “None” security mode, and connecting with a username and password, which also appears to require sending the password encrypted with Basic256 (username and password connection works with None security mode, but does not work if there is no certificate and private key provided via the `opcuaCLientCertificate` option in the `st-common.cmd` or `st.cmd` file, which loads the IOC with some other options.  


Suggested change

Currently, the IOC does not seem to be able to support encrypted message security policy. It does, however, support “None” security mode, and connecting with a username and password, which also appears to require sending the password encrypted with Basic256 (username and password connection works with None security mode, but does not work if there is no certificate and private key provided via the `opcuaCLientCertificate` option in the `st-common.cmd` or `st.cmd` file, which loads the IOC with some other options.

Currently, the IOC does not seem to be able to support encrypted message security policy. It does, however, support "None" security mode, and connecting with a username and password, which also appears to require sending the password encrypted with Basic256 (username and password connection works with None security mode, but does not work if there is no certificate and private key provided via the `opcuaCLientCertificate` option in the `st-common.cmd` or `st.cmd` file, which loads the IOC with some other options.

which loads the IOC with some other options.

It's unclear to me exactly what this means or refers to?

Tom-Willemsen · 2025-05-12T11:47:42Z

doc/specific_iocs/plcs/OPCUA.md

+
+More info can be found [here on Wikipedia for a general overview](https://en.wikipedia.org/wiki/OPC_Unified_Architecture), or for a more detailed description from [OPC Foundation](https://opcfoundation.org/about/what-is-opc/).
+
+## How is authentication handled?


I get that you probably copied these headers from a message/comment I sent previously - but I think they might be clearer on the wiki as headings like "Authentication", "Communication", "Troubleshooting" etc.

I've put this comment once but applies to most of the headers in this file

Tom-Willemsen · 2025-05-12T11:52:04Z

doc/specific_iocs/plcs/OPCUA.md

+Currently, authentication configurations in Windows only seem to work with username and password. This is likely due to functionality missing from the `open62541` library, the open source library that we use in conjunction with `opcua` EPICS module. A username and password is set on the PLC itself, and those values can be read at IOC startup to authenticate, and sent via Basic256 encryption to the PLC to sign in. When implementing/installing onto a new instrument, the `client_private_key.pem`, `cert.txt` (which will need to be edited to reflect current username and password for the target PLC/server), and `OPCUA_01.cmd` should be moved from the Experiment Controls non-public share `OPCUA` folder, to the instrument's configurations area, in a new folder that should be named `opcua`. If done properly, the `opcua` EPICS module should be able to pick up the user name and password, log in to the OPC server properly, and begin a connection. 
+
+## Do any settings in the PLC side need to be adjusted to get communicating properly?
+On occasion, a client certificate needs to be trusted manually, from the PLC technician side. However, things *_should_* be set up on our PLCs currently deployed; this step is done in deployment/implementation. A security policy might be set that is not what the IOC is trying to use, if everything else seems fine but you are unable to connect. Lastly, another person might be connected to the server (perhaps testing an IOC or something), and they would need to be kicked off in order for the IOC to communicate properly. Speak with Tim Carter or a member of his team to see if this is the case.


or a member of his team to see if this is the case.

Which team is this?

Tom-Willemsen · 2025-05-12T11:52:07Z

doc/specific_iocs/plcs/OPCUA.md

+## How is authentication handled?
+Currently, the IOC does not seem to be able to support encrypted message security policy. It does, however, support “None” security mode, and connecting with a username and password, which also appears to require sending the password encrypted with Basic256 (username and password connection works with None security mode, but does not work if there is no certificate and private key provided via the `opcuaCLientCertificate` option in the `st-common.cmd` or `st.cmd` file, which loads the IOC with some other options.  
+
+Currently, authentication configurations in Windows only seem to work with username and password. This is likely due to functionality missing from the `open62541` library, the open source library that we use in conjunction with `opcua` EPICS module. A username and password is set on the PLC itself, and those values can be read at IOC startup to authenticate, and sent via Basic256 encryption to the PLC to sign in. When implementing/installing onto a new instrument, the `client_private_key.pem`, `cert.txt` (which will need to be edited to reflect current username and password for the target PLC/server), and `OPCUA_01.cmd` should be moved from the Experiment Controls non-public share `OPCUA` folder, to the instrument's configurations area, in a new folder that should be named `opcua`. If done properly, the `opcua` EPICS module should be able to pick up the user name and password, log in to the OPC server properly, and begin a connection. 


client_private_key.pem, cert.txt

How does one acquire or generate these files? Are they something that was exported from the PLC, or something you generated?

Tom-Willemsen · 2025-05-12T11:52:43Z

doc/specific_iocs/plcs/OPCUA.md

+On occasion, a client certificate needs to be trusted manually, from the PLC technician side. However, things *_should_* be set up on our PLCs currently deployed; this step is done in deployment/implementation. A security policy might be set that is not what the IOC is trying to use, if everything else seems fine but you are unable to connect. Lastly, another person might be connected to the server (perhaps testing an IOC or something), and they would need to be kicked off in order for the IOC to communicate properly. Speak with Tim Carter or a member of his team to see if this is the case.
+
+## Where are instrument-specific configs loaded from 
+We load instrument specific configs from the $(INSTRUMENT)/configurations/opcua/ folder. This `opcua` folder is created at implementation time, on the `NDX` machine. It should contain a `OPCUA_01.cmd` file, which contains any `DbLoadRecords` calls, and where paths are specified to the `db` files for that `NDX`'s specific `OPCUA` IOC. If an `NDX` is missing an `opcua` folder, create one; if you cannot find it's `OPCUA_01.cmd` file, it _should_ be placed in the Experiment Controls non-public network share, in the `OPCUA` folder, in a folder specific to that `NDX`. For example, `NDXMAPS`'s `OPCUA_01.cmd` file is in `<network share>/OPCUA/MAPS_OPCUA/`.


Suggested change

We load instrument specific configs from the $(INSTRUMENT)/configurations/opcua/ folder. This `opcua` folder is created at implementation time, on the `NDX` machine. It should contain a `OPCUA_01.cmd` file, which contains any `DbLoadRecords` calls, and where paths are specified to the `db` files for that `NDX`'s specific `OPCUA` IOC. If an `NDX` is missing an `opcua` folder, create one; if you cannot find it's `OPCUA_01.cmd` file, it _should_ be placed in the Experiment Controls non-public network share, in the `OPCUA` folder, in a folder specific to that `NDX`. For example, `NDXMAPS`'s `OPCUA_01.cmd` file is in `<network share>/OPCUA/MAPS_OPCUA/`.

We load instrument specific configs from the `$(INSTRUMENT)/configurations/opcua/` folder. This `opcua` folder is created at implementation time, on the `NDX` machine. It should contain a `OPCUA_01.cmd` file, which contains any `dbLoadRecords` calls, and where paths are specified to the `db` files for that `NDX`'s specific `OPCUA` IOC. If an `NDX` is missing an `opcua` folder, create one; if you cannot find it's `OPCUA_01.cmd` file, it _should_ be placed in the Experiment Controls non-public network share, in the `OPCUA` folder, in a folder specific to that `NDX`. For example, `NDXMAPS`'s `OPCUA_01.cmd` file is in `<network share>/OPCUA/MAPS_OPCUA/`.

Tom-Willemsen · 2025-05-12T11:56:46Z

doc/spelling_wordlist.txt

+opc
+opcua


Is this the preferred stylisation - I thought it was generally OPCUA?

I think it's technically "OPC UA" annoyingly

OK - then probably we just need OPC and UA in the wordlist (and maybe OPCUA if we want to refer to the ioc name). But probably not opcua.

esmith1729 and others added 3 commits May 6, 2025 10:38

Create OPCUA.cmd

9733f24

Add file for general OPCUA knowledge

Update OPCUA.cmd

17368a6

Add docs for OPC UA and MAPS System

5fd8f86

esmith1729 linked an issue May 8, 2025 that may be closed by this pull request

MAPS: Provide support to read pressure values from vacuum PLC ISISComputingGroup/IBEX#8586

Open

3 tasks

esmith1729 changed the title ~~Create OPCUA.cmd~~ Create OPCUA.md May 8, 2025

Tom-Willemsen reviewed May 12, 2025

View reviewed changes

Added clarity, changed headers,

42d478c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Create OPCUA.md #10

Create OPCUA.md #10

Uh oh!

esmith1729 commented May 6, 2025

Uh oh!

Tom-Willemsen left a comment

Uh oh!

Tom-Willemsen May 12, 2025

Uh oh!

Tom-Willemsen May 12, 2025

Uh oh!

Tom-Willemsen May 12, 2025

Uh oh!

Tom-Willemsen May 12, 2025

Uh oh!

Tom-Willemsen May 12, 2025

Uh oh!

Tom-Willemsen May 12, 2025

Uh oh!

Tom-Willemsen May 12, 2025

Uh oh!

esmith1729 Jun 3, 2025

Uh oh!

Tom-Willemsen Jun 3, 2025

Uh oh!

Uh oh!


		More info can be found [here on Wikipedia for a general overview](https://en.wikipedia.org/wiki/OPC_Unified_Architecture), or for a more detailed description from [OPC Foundation](https://opcfoundation.org/about/what-is-opc/).

		## How is authentication handled?

		opc
		opcua

Create OPCUA.md #10

Are you sure you want to change the base?

Create OPCUA.md #10

Uh oh!

Conversation

esmith1729 commented May 6, 2025

Uh oh!

Tom-Willemsen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!