learn · South Africa
OPC UA Basics: Nodes, Namespaces, Queues and Security
Learn OPC UA basics with namespace mapping, sampling and queue examples, data quality, certificate trust and practical South African course questions.
OPC UA basics help a PLC learner explain how a client identifies data, receives updates and checks the application it is communicating with. A connection that opens successfully is only the beginning. You still need the correct node, usable data quality, suitable update behaviour and permissions appropriate to the task.
This guide covers OPC UA client/server data access for South African PLC, HMI and SCADA learners. It uses fictional namespace tables and a checked sampling timeline. The examples are reasoning exercises, not a claim that this website's linked PLC simulator runs a native OPC UA server or an external OPC UA client.
For the surrounding integration skills, compare industrial networking training in South Africa. Ask a provider to name the actual client, server, software versions and practical assessment used for OPC UA work.
Practise PLC and HMI foundations →Identify the client, server and data source
In the arrangement studied here, an OPC UA server exposes information and a client browses, reads or monitors it. The underlying source might be a controller, another system or a teaching model. Draw those components separately so that a problem at one layer does not automatically become a “PLC fault”.
For example, a classroom display may be connected to its server while the server cannot obtain a current value from the source. Another display may be disconnected while still showing its last stored number. Both situations can look plausible unless the interface makes connection and data-quality states visible.
Record which application is the client, which is the server, where the value originates and where it is displayed or recorded. Add the endpoint address and versions from the actual exercise. A port number or vendor logo does not establish that a particular server feature is enabled, licensed or configured.
This article studies client/server subscriptions. OPC UA also has other communication arrangements; do not treat the word “subscription” here as a complete description of every OPC UA PubSub configuration. Keep the scope of the lab explicit.
Nodes, attributes and references
The address space contains nodes connected by references. A client often presents a convenient browse tree, but that display does not make the entire information model a simple folder tree. Nodes can describe different kinds of information and relationships.
An Object and a Variable are different NodeClasses. A Variable can expose a Value attribute; it is incorrect to assume every Object, Method or type node has a live process value to read. The OPC Foundation's standard NodeClasses reference identifies these distinctions.
For a fictional training model, an Object called MotorA could organise Variables called Command, Feedback and Temperature. Browse the actual nodes and inspect their attributes. Do not infer that a node called Feedback is Boolean or that a temperature number is in degrees Celsius merely from its displayed name.
A NodeId identifies a node; a BrowseName supports browsing and naming within the model. A human-facing label is useful for operators but should not be confused with a complete durable identifier. When a screen reads the wrong motor's value, compare the resolved node and binding rather than only the label.
The HMI tag-binding guide develops this separation between a display, its selected equipment and the value it actually reads. OPC UA identification adds another layer that should be recorded alongside the HMI binding.
Namespace URI and namespace index
A NodeId uses a namespace index together with an identifier and its identifier type. Identifiers can be numeric, strings, GUIDs or byte strings. The namespace index refers to the server's NamespaceArray; the entry supplies the namespace URI.
The OPC Foundation's NamespaceIndex definition explains this mapping. Index zero identifies the standard OPC UA namespace. Namespace URIs are case-sensitive. Other numeric indexes should be interpreted from the current server table, rather than assigned universal vendor meanings.
For configuration that will be reused later, preserve the namespace URI and the identifier's type and value. Resolve the URI against the current table when establishing the relevant connection. An index can change between configurations or sessions; it does not necessarily change on every restart.
Worked namespace-resolution example
Our fictional target uses namespace URI urn:training:plant and string identifier MotorA.Feedback. The following two server configurations contain the same training namespace at different indexes.
| Index | Table A | Table B |
|---|---|---|
| 0 | http://opcfoundation.org/UA/ | http://opcfoundation.org/UA/ |
| 1 | urn:training:server | urn:training:server |
| 2 | urn:training:plant | urn:training:vendor |
| 3 | urn:training:vendor | urn:training:plant |
With Table A, the resolved identifier is ns=2;s=MotorA.Feedback. With Table B, it is ns=3;s=MotorA.Feedback. Reusing the old number 2 selects the vendor namespace in Table B, which is not the intended result.
Do not guess another index if the desired URI is missing. In this exercise, resolution returns an explicit “namespace unavailable” result and the application does not create that binding. Similarly, urn:training:Plant does not match urn:training:plant in our case-sensitive lookup.
URI resolution does not repair every model change. The identifier may have been removed, its data type may have changed, or the server may expose a different model version. After resolving the namespace, still verify the selected node and expected attributes.
Sampling, filtering, queuing and publishing
Treat these as separate stages. Sampling obtains an observation of the underlying source. A filter determines whether an observation produces a notification. A MonitoredItem queue retains notifications pending delivery. The subscription's publishing behaviour determines when notifications are returned to the client.
The OPC Foundation's sampling-interval definition describes a best-effort interval and allows a server to return a revised supported value. Requested timing is therefore not sufficient evidence of achieved timing. Record the server's response as well as the requested setting.
The underlying system can update more slowly than the sampling interval. Repeated sampling cannot create new source measurements. Conversely, changes that occur and disappear between the relevant observations may never enter the queue at all.
A timeline with several changes in one publish
Define this ideal classroom model precisely. The initial value 0 has already been delivered at time 0. Sampling occurs at 100, 200, 300, 400 and 500 ms. A value-change filter generates a notification only when the sampled value differs from the previous sampled value. All observations have good quality, and timestamp-only changes are ignored.
The queue initially is empty, has capacity ten, and is drained at the 500 ms publishing point after that point's sample is processed. Assume sufficient delivery capacity and no communication delay. These timing choices describe our model, not a promise about a real server scheduler.
| Sample time | Sampled value | New notification? | Queue before publishing |
|---|---|---|---|
| 100 ms | 1 | Yes | 1 |
| 200 ms | 2 | Yes | 1, 2 |
| 300 ms | 3 | Yes | 1, 2, 3 |
| 400 ms | 4 | Yes | 1, 2, 3, 4 |
| 500 ms | 4 | No | 1, 2, 3, 4 |
At 500 ms, the client receives four queued values in order. It did not receive only the last value merely because publishing was slower than sampling. A display that renders just its latest value can still hide intermediate received notifications; inspect the received records when testing this behaviour.
The OPC UA queue rules distinguish queuing multiple notifications from a one-value buffer. They also specify ordered delivery for an item's queued notifications. The teaching timeline makes that distinction visible.
Change the queue capacity
Repeat the same four generated notifications with capacity three. With discardOldest=true, the final retained values are 2, 3, 4. With discardOldest=false, the last queued entry is replaced when full, producing 1, 2, 4. The latter does not mean “always throw away the newly arriving value”.
With capacity one, the newest notification replaces the previous one, so the retained value is 4 regardless of the discard policy. For queues larger than one, overflow also has status signalling specified by the standard; a production check should inspect that information rather than counting values alone.
This comparison concerns the MonitoredItem queue. Do not confuse it with notification-message retransmission or historical storage. A larger item queue cannot reconstruct a transition that sampling never observed.
A short pulse can disappear before queuing
Consider a Boolean source sampled at 0, 100, 200 and 300 ms. It is false initially, becomes true at 150 ms and returns false at 190 ms. Every sample is false. The value-change filter therefore sees no true state, whether the queue capacity is one or one thousand.
Now move the pulse to the interval from 90 ms up to, but not including, 110 ms. The 100 ms sample sees true and the 200 ms sample sees false. Both transitions can enter the queue in our ideal model.
This is why a diagnostic question should identify the stage where information disappeared. Was the source state observed? Did it pass the filter? Was it retained? Was it delivered? Did the display or historian retain the delivered detail?
If capturing every occurrence is a requirement, investigate a suitable source-side event, counter or recording design with the relevant platform capabilities. Do not promise that changing only a publishing interval guarantees capture. The PLC scan-cycle explanation provides a related example of events occurring between observations.
Read a DataValue, not just a number
The OPC Foundation's DataValue definition includes the value, a StatusCode and associated timestamp fields. Those fields help distinguish a usable observation from an error or an old displayed result. A value associated with an error must not be treated as a valid current measurement.
For a display exercise, provide three separate cases: a confirmed good Boolean false, a confirmed good Boolean true, and unavailable data. The third case should not silently display the same “off” indication as a valid false. That distinction matters when someone uses the screen to decide what to investigate next.
A retained last-good value can be useful if it is clearly identified as retained. Keep its status separate from current data availability. Otherwise a plausible old temperature or motor state can conceal a failed source connection.
Do not calculate data age by subtracting timestamps from unrelated clocks without understanding their meanings and synchronisation. Record the timestamp field used, the observation time and the client's own receipt time where relevant. A value remaining constant is not by itself proof that communication has stopped.
Security mode, security policy and user identity
These are separate configuration concepts. The standard's MessageSecurityMode definition distinguishes None, Sign and SignAndEncrypt. Signing addresses message integrity and authentication within the protocol; encryption adds confidentiality. None provides no message security through that mode.
A SecurityPolicy URI identifies the applicable policy, rather than being another name for the mode. User identity is another choice, such as a supported identity-token mechanism. The server's EndpointDescription reports these as separate fields, including accepted user identity tokens.
As a concrete implementation reference, the CODESYS Datasource OpcUa configuration exposes SecurityPolicyUri, SecurityMode and TokenType separately. Read the installed version's documentation; a library's displayed default is not an automatic recommendation for your deployment.
A signed or encrypted connection does not grant every user permission to write every value. Application identity, user authentication and authorisation answer different questions. For a read-only training task, demonstrate the required read access and the expected rejection of an unauthorised operation in an isolated lab.
Certificate trust is an identity decision
When an application reports an untrusted certificate, first establish which application presented it and whether that is the intended peer. Check the expected identity and certificate information through the approved administration process. Do not automatically trust everything placed in a rejected-certificate list.
The OPC Foundation's certificate-trust procedure describes trusted certificates, issuer certificates and chain validation. Trust can involve a valid chain to an appropriately trusted authority; it is not always a manual exchange of two individual files.
Use the product's certificate-management interface or documented store. Directory names are implementation details, so a path copied from another tool may be irrelevant. Keep private keys private; importing a peer's public certificate is not a reason to copy that peer's private key.
For a classroom fault, change one known condition and record the resulting diagnostic. Distinguish an identity or trust problem from a connection failure or rejected user identity. A reconnect that succeeds after disabling protections has not established that the original trust problem was understood.
For broader learning, the industrial cybersecurity training guide explains how to evaluate course scope. This article provides terminology and lab questions, not a complete security architecture.
A practical troubleshooting sequence
Start by identifying the exact failed operation. “OPC UA is not working” could mean the endpoint cannot be reached, a session cannot be established, a node cannot be found, a read is denied, or monitored values are unavailable. Those observations suggest different next checks.
Use a small known dataset in an authorised lab. Record the endpoint selection, client and server versions, identity configuration, resolved node and expected data type. Capture the requested and revised monitoring parameters. Then introduce one controlled fault at a time and save the exact diagnostic.
For missing updates, compare source observations, notification records and final display behaviour. The queue exercise above gives a repeatable expected result. A screenshot of the final number alone cannot show whether intermediate values were sampled and delivered.
For reconnection, examine the client's documented retry and session-recovery behaviour. Measure repeated failures without creating an uncontrolled retry loop. Do not present a generic one-second-to-sixty-second schedule as a universal OPC UA requirement or assume every client uses it.
The PLC troubleshooting workflow helps organise observations, hypotheses and the next discriminating check. Keep the original fault evidence so a successful reconnect does not erase what you were trying to explain.
Choose an OPC UA course by the evidence it produces
For OPC UA training in Johannesburg, Pretoria, Durban, Cape Town or online, ask what each learner connects and diagnoses. A useful course description names the actual client/server combination, supported features, lab access and assessment. The city or the word “advanced” does not establish those details.
For example, the CODESYS OPC UA Client SL data sheet lists browsing, reading and subscription functions alongside runtime and licensing requirements. Use a capability document like this to check the proposed lab equipment before enrolling; an installed programming editor alone does not establish the complete lab configuration.
A suitable beginner task includes browsing an information model, resolving a namespace, reading a typed value with status, observing queued updates and explaining the selected endpoint settings. A more advanced task can investigate reconnection, access control or model changes in the named environment.
Bring a small portfolio rather than only a completion screenshot. Include the fictional namespace tables, the sampling timeline, both queue-overflow variants and a record showing unavailable data separately from a valid false. Explain what the lab demonstrated and what remains dependent on the actual product.
The HMI simulator learning resource is relevant for practising displays and tag-bound values. It is a related foundation, not a claim of native OPC UA connectivity. Use an actual supported OPC UA client and server for protocol-specific practical work.
Organise expected and observed outcomes with the PLC program testing resource. The useful habit is to preserve a repeatable input history and a clear acceptance condition.
Common OPC UA questions
Does the namespace index change every time a server restarts?
Not necessarily. It can remain the same, but configuration that depends on an old numeric index is fragile when the namespace table changes. Preserve the intended URI and identifier, resolve the current index and verify that the node still has the expected meaning.
Can a 500 ms publish include changes sampled 100 ms apart?
Yes, when notifications are generated, retained and delivered with sufficient capacity. Our example delivers values 1, 2, 3 and 4 together. A one-value buffer or a display that keeps only the latest value produces a different visible result.
Is SignAndEncrypt a security policy?
It is a message security mode. The endpoint also specifies a SecurityPolicy URI and supported user identity mechanisms. Record these separately when comparing configurations or diagnosing why two applications cannot establish the intended connection.
Will a larger queue capture every short pulse?
No. A queue stores generated notifications. If a pulse begins and ends between observations and no other capture mechanism records it, there is no notification for that queue to retain. Identify the acquisition requirement before choosing timing and storage settings.
Can I learn OPC UA without physical PLC hardware?
You can study the model and use a suitable software client/server lab where those functions are supported. Check the actual tool capabilities. A general PLC or HMI simulation lesson does not automatically include OPC UA endpoints, certificate management or server performance modelling.
Build your PLC and HMI foundations →