Concept

Introduction

The server

Start

This is what happens when you call the Start method:

1. The server checks whether an address is set (property OpcServer.Address). If none is set, the server uses the address opc.tcp://localhost:4840. If all addresses have been unregistered again, Start throws an InvalidOperationException.
2. The server checks its license and changes its state (property OpcServer.State) to the value Starting. If the server is not in the Created or Stopped state, the call has no effect.
3. The server checks its configuration for validity and consistency.
4. Next, the server tries to create a host for each endpoint description.
5. Then the server starts all managers, for example the node managers and the SessionManager.
6. Finally, the server starts each host it created. The hosts handle the endpoint-specific communication with the clients.
7. The server changes its state (property OpcServer.State) to the value Started.

Stop

This is what happens when you call the Stop method:

1. The server changes its state (property OpcServer.State) to the value Stopping.
2. The server stops all managers, for example the node managers and the SessionManager.
3. The server releases all acquired resources.
4. The server stops the hosts of the endpoint descriptions.
5. The server changes its state (property OpcServer.State) to the value Stopped.

You can also stop a server from the Suspended state.

Suspend and resume

To mark the server as temporarily unavailable for maintenance without stopping it, call the Suspend method. The server then passes through the Suspending state into the Suspended state and reports the state Suspended to its clients through the server status. Its endpoints remain reachable. Beforehand, the server can tell the clients through the OpcServer.EstimatedReturnTime property when it expects to be available again. You can set this property only in the Started state. The Resume method returns the server to the Started state through Starting. Both methods take effect only from the matching state: Suspend from Started, Resume from Suspended.

C#

// Announce the expected end of the maintenance to the clients.
server.EstimatedReturnTime = DateTime.UtcNow.AddMinutes(10);
server.Suspend();
...
server.Resume();

VB.NET

'Announce the expected end of the maintenance to the clients.
server.EstimatedReturnTime = DateTime.UtcNow.AddMinutes(10)
server.Suspend()
...
server.Resume()

Address and parameters

To let the server give clients access to its OPC UA services, set the right parameters. The server always needs the address at which it is reachable (property OpcServer.Address). The address is a URI (Uniform Resource Identifier) and gives all clients the essential information about the server. For example, the server address opc.tcp://192.168.0.80:4840 contains the scheme opc.tcp. The scheme defines the protocol and the way the data is exchanged. The possible schemes are opc.tcp and https. For OPC UA servers in the local network, we recommend opc.tcp. For servers outside the local network, https can be a good choice. The address also states that the server runs on the computer with the IP address 192.168.0.80 and listens for requests on port 4840. This is the default port for OPC UA, and custom port numbers are possible as well. Instead of the static IP address, you can also use the DNS name of the computer, for example localhost instead of 127.0.0.1.

If the server should not provide an endpoint whose policy has the security mode None, configure at least one endpoint policy (property OpcServer.Security.EndpointPolicies). The other possible security modes are Sign and SignAndEncrypt. If the server does provide an endpoint with the policy None, a client can select it automatically for a simple and fast connection. The SDK assigns a policy level, a number, to each endpoint policy. The SDK calculates it from the security mode and the security algorithm and reports it to the clients (property OpcSecurityPolicy.Level). You cannot assign the level yourself. The OPC Foundation specifies that the higher the policy level of an endpoint, the better the endpoint. This is only a guideline that nobody checks or enforces.

If the server should use access control, for example through an ACL (access control list), define the valid identities of its users. This also works while the server is running. You can define user identities as a user name and password pair (class OpcServerIdentity) or as a certificate (class OpcCertificateIdentity). Pass the identities to the server with the OpcServer.Security.UserNameAcl and OpcServer.Security.CertificateAcl properties. For the server to apply these access control lists, enable them with their IsEnabled property. The access control list for anonymous users (property OpcServer.Security.AnonymousAcl) is only active as long as no other access control list is active, unless its IsEnabled property is set explicitly. So if you enable the UserNameAcl, for example, you turn off anonymous access. The Secure servers page describes further options such as roles and custom access control lists.

Endpoints

The endpoints result from the cross product of the base addresses of the server and the security policies that the server supports. Each base address results from a supported pair of scheme and port. For data exchange, you can set several schemes (opc.tcp and https are possible) on different ports. The policies combined with them define how data is exchanged. Each policy consists of the policy level, the security mode, and the security algorithm, and so defines the kind of secure data exchange.

Suppose the server supports two security policies:

• Security policy A: level 0, security mode None, security algorithm None
• Security policy B: level 1, security mode Sign, security algorithm Basic256Sha256

In addition, there are three base addresses for different schemes:

• Base address A: https://mydomain.com/
• Base address B: opc.tcp://192.168.0.123:4840/
• Base address C: opc.tcp://192.168.0.123:12345/

The cross product results in the following endpoint descriptions:

• Endpoint 1: address https://mydomain.com/, level 0, security mode None, security algorithm None
• Endpoint 2: address https://mydomain.com/, level 1, security mode Sign, security algorithm Basic256Sha256
• Endpoint 3: address opc.tcp://192.168.0.123:4840/, level 0, security mode None, security algorithm None
• Endpoint 4: address opc.tcp://192.168.0.123:4840/, level 1, security mode Sign, security algorithm Basic256Sha256
• Endpoint 5: address opc.tcp://192.168.0.123:12345/, level 0, security mode None, security algorithm None
• Endpoint 6: address opc.tcp://192.168.0.123:12345/, level 1, security mode Sign, security algorithm Basic256Sha256

The server always defines the address part of the endpoint, either through the constructor or through the Address property. As long as no policy is configured, the server defines one endpoint with the security mode None. If the server should use other policies instead or in addition, configure them with the OpcServer.Security.EndpointPolicies property.

Certificates and security

The SDK aims to make getting started with OPC UA as easy as possible. For this reason, the connection between client and server is not fully secured unless you configure the server further. As soon as you have implemented and tested the final spike, you should turn to security:

• The Understand certificates page describes how certificates identify client and server, where they are stored, and how the applications check them.
• The Users and roles page describes how users log on and which permissions they receive.
• The Harden for production section contains all settings for production and a checklist.