Ignition OPC UA Setup: Industrial Communication Standard

# Ignition Gateway > Config > OPC UA > Server Settings
# ─────────────────────────────────────────────────────
# Endpoint URL:     opc.tcp://ignition-server:62541
# Bind Address:     0.0.0.0
# Security Policies:
#   - Basic256Sha256 (recommended)
#   - Aes128_Sha256_RsaOaep
#   - None (development only)
# Message Security:
#   - Sign
#   - SignAndEncrypt (recommended for production)

# Verify the OPC UA server is running via scripting:
server_state = system.opc.getServerState("Ignition OPC UA Server")
print("OPC UA Server State: %s" % server_state)
# Expected output: RUNNING

# Ignition Gateway > Config > OPC Connections > Servers
# ─────────────────────────────────────────────────────
# Connection Name:    Kepware_Production
# Discovery URL:      opc.tcp://kepware-server:49320
# Security Policy:    Basic256Sha256
# Message Security:   SignAndEncrypt
# Authentication:     Certificate (or Username/Password)

# For Siemens S7-1500 native OPC UA:
# Discovery URL:      opc.tcp://192.168.1.10:4840
# Security Policy:    Basic256Sha256
# Username:           OpcUaClient
# Password:           ********

# Verify connection status via scripting:
servers = system.opc.getServers()
for server in servers:
    state = system.opc.getServerState(server)
    print("Server: %s | State: %s" % (server, state))

# Ignition Gateway > Config > OPC UA > Security
# ─────────────────────────────────────────────────────
# Certificate Management:
#   - Server Certificate:   Auto-generated on first start
#   - Trusted Clients:      Quarantined until approved
#   - Rejected Certificates: Moved to rejected folder

# Certificate file locations (Linux):
# /usr/local/bin/ignition/data/opcua/server/security/
#   ├── pki/
#   │   ├── trusted/certs/        # Trusted client certificates
#   │   ├── rejected/certs/       # Rejected certificates
#   │   └── issuers/certs/        # CA certificates
#   └── server.pfx                # Server certificate keystore

# Export server certificate for Kepware trust:
# Gateway > OPC UA > Security > Export Server Certificate

# Programmatically check OPC UA connection security:
import system.opc
connection = "Kepware_Production"
state = system.opc.getServerState(connection)
print("Connection: %s | State: %s" % (connection, state))

# In Ignition Designer > OPC Browser Panel
# ─────────────────────────────────────────────────────
# 1. Select the OPC server connection (e.g., Kepware_Production)
# 2. Browse the address space tree:
#    └── Objects
#        └── Channel1
#            └── Device1
#                ├── Tag_Temperature    (Float)
#                ├── Tag_Pressure       (Double)
#                └── Tag_Status         (Boolean)
# 3. Drag tags to the Tag Browser to create OPC tags

# Programmatic tag browsing:
server = "Kepware_Production"
results = system.opc.browse(server, "")
for node in results:
    print("Node: %s | Type: %s" % (node.getDisplayName(), node.getNodeClass()))

# Read OPC UA values directly:
values = system.opc.readValues(server, [
    "[Kepware_Production]Channel1.Device1.Tag_Temperature",
    "[Kepware_Production]Channel1.Device1.Tag_Pressure"
])
for val in values:
    print("Value: %s | Quality: %s" % (val.getValue(), val.getQuality()))

# Configure scan class for optimized polling:
# Tag Editor > OPC Scan Class: Default (1000ms)
# For fast-changing values: 100ms or 250ms
# For slow-changing values: 5000ms or 10000ms