Confirm the Settings for an OPC UA Server

To confirm that an OPC UA Server is ready for operation, you should check that you have completed the following steps.

Connect all your Plant SCADA computers to a System Management Server

The System Management Server facilitates encrypted communications for your Plant SCADA system. To connect a computer to a System Management Server, use the System Management Server page in Configurator. See Connect a Computer to a System Management Server.

Set up deployment

If your OPC UA Server is running on a remote computer, set it up for deployment.

• Set up a deployment server in your system (see Configure a Deployment Server).

• Configure a deployment client on the OPC UA Server so that it can receive project versions from the deployment server (see Configure a Deployment Client).

Confirm the Configurator settings for the OPC UA Server

The required settings are available on the OPC UA Server page within the Plant SCADA branch of Configurator. See Use Configurator to Set Up an OPC UA Server.

Enable encryption

An OPC UA Server will only connect to your Plant SCADA servers over an encrypted connection. You need to confirm the following:

• Plant SCADA is configured to run with encryption enabled. This is achieved via the Encryption page in Configurator (see Enable Encryption).

Running in mixed mode is acceptable as long the remaining prerequisites are also met.

• Runtime Manager needs to be configured to run as a service.

  This is required to enable encryption. The required settings are available on Configurator's Computer Setup page (see Configure a Runtime Computer for Encryption).

• In your project settings, confirm the DNS Name field is configured for each entry in the Computers activity. This is also required to enable encryption.

• Run the Computer Setup Wizard and confirm on the Network Model page that networking is enabled. This is required even if you are running the OPC UA Server and the Plant SCADA servers on a single computer.

Set up user authentication

If Enable Anonymous Access is disabled for the OPC UA Server, a user name and password will be required to connect to the OPC UA server. Only authentication with Windows® users is supported (Plant SCADA users are not supported).

The user must also be a member of a Windows group that is mapped to a valid Role within your Plant SCADA project. See the topic Roles within the Runtime System Security section of the Plant SCADA documentation.

Anonymous access needs to be disabled to support tag writes from an OPC UA client application.

Enable tag writes for your variable tags

Your variable tags can be configured to support writes from an OPC UA client application.

Note: Tag writes will only work if anonymous access is disabled for the OPC UA Server.

To enable tag writes, you need to set the Write Roles property for each variable tag that will have writes enabled. The Property Grid allows you to select one of the roles configured in your Plant SCADA project, or you can manually enter a comma-separated list to include multiple roles.

To write to a variable tag, the user that is currently logged in to the OPCUA client application needs to be part of a Windows™ domain group that is associated with the role specified in the Write Roles property.

Note:
• Plant SCADA runtime does not support online changes for variables, which means any changes you make to the Write Roles setting for a variable tag will not be implemented until you restart the I/O server.
• If you have renamed any Roles, you should also restart the I/O server to synchronize the changes at runtime, particularly if you use the Cicode function UserUpdateRecord to recompile a local project configuration.