OPC UA Guide

Overview

ControlBird's OPC UA (OPC Unified Architecture) integration provides bidirectional connectivity to industrial OPC UA servers and can expose ControlBird tags as OPC UA nodes for other clients to consume. It has two halves: a client connection that reads, writes, and subscribes to nodes on an external server, and a server connection that publishes ControlBird data in its own address space.

Everything is set up in the IO Manager app. Each OPC UA node you read or write is a tag with a dotted ID that is unique in your tenant, for example Plant.Boiler1.Pressure. See the IO Manager guide for the app as a whole.

Node IDs and addressing

A tag's source address is the OPC UA NodeId of the node it reads or writes. ControlBird accepts the standard forms and treats a bare identifier as a string identifier in namespace 0:

Read data from an OPC UA server

The client connects to a remote OPC UA server and keeps your tags in sync with the nodes they point at.

1. Add the connection

In the IO Manager, open the Tags section and choose Add tag to start Create Custom Device, then pick the OPC UA client protocol. Enter a Device Name and fill in the connection form:

The wizard also shows Node ID and Browse Path fields for each point; ControlBird ignores them, so leave them empty.

2. Add tags

In the Points step, choose Add Point for each value you want. You can also add points after the connection exists. For each tag:

• Tag ID: a dotted name that is unique in your tenant, such as Plant.Boiler1.Pressure.
• Source Path: the node's NodeId, such as ns=2;i=100 or ns=1;s=Temperature.
• Type and direction: the value type the tag holds, and whether ControlBird reads from the node or writes to it.
• Updates: tags subscribe by default (sampling interval 1000 ms). If a subscription fails, the tag polls every 1000 ms.

Find a node's NodeId in your server's own tooling or documentation, then paste it into the tag's source path.

Serve data as an OPC UA server

A server connection exposes ControlBird tags as OPC UA variable nodes so external SCADA and HMI clients can read them.

1. Add the server connection

Use Add tag, then Create Custom Device, and pick the OPC UA server protocol. Enter a Device Name and fill in the connection form:

The server offers only the security policy and mode you choose, with anonymous login. Policy None goes with mode None; every other policy needs Sign or SignAndEncrypt, and the connection reports an error for any other combination. A client that connects without the chosen security can still list the server's endpoints, but it cannot open a session.

A secured policy encrypts and signs the traffic, but it does not authenticate clients: the server accepts any client certificate, and every session is anonymous. Restrict who can reach the listen address with your network if only some clients may connect.

The server presents a self-signed certificate that ControlBird generates. It changes every time the OPC UA service restarts and every time the server fails over to another node, and each node presents its own. A client that pins the certificate has to trust the new one each time. To present a fixed certificate, choose one in the Certificate field when you create the connection, or later in the Security section of the endpoint's details.

2. Publish tags to it

Select a tag in the Tags section and choose Publish… on its detail, then pick the OPC UA server connection, then choose Expose read-only, Expose with write-back, or Configure… to edit the tag ID and address first.

The server starts when the connection is enabled. It creates a ControlBird folder inside the standard Objects folder and adds a variable node for each published tag.

Security

Security policy and message security mode are pick lists on both the client and the server connection form. The security policy offers None, Basic128Rsa15, Basic256, Basic256Sha256, Aes128Sha256RsaOaep, and Aes256Sha256RsaPss. The message security mode offers None, Sign, and SignAndEncrypt. A server endpoint pairs a policy of None only with a mode of None, and every other policy only with Sign or SignAndEncrypt; it refuses to start with any other pairing. The server accepts anonymous login only. Choose the certificate an endpoint presents in its Certificate field.

Data types

OPC UA values are converted to tag values and back. Bool, Int, Float, String, and byte string convert both ways; Timestamp converts on write only.

Operational notes

• The default OPC UA port is 4840 for both client and server.
• A slow consumer does not stall data coming from the server.
• The communication log records logical operations (node reads, writes, and subscription events) rather than raw network traffic.

For a step-by-step introduction to connecting devices, see the configuration walkthrough.