We have just installed our first Ignition server and are having trouble with tag values in OPC-DA connections. The COM client in Ignition can connect to our legacy OPC Server (DA vers. 2 compliant Think & Do). We can see the tags in the sever and can use the OPC Quick Client to read values from the tags. When we add an OPC tag in the designer, either by drag and drop or manually, we get null values. With the tag added in the designer, the OPC Quick Client fails to read the tag (Status: Bad_NodeIdUnknown). We can delete the tag from the designer and the OPC Quick Client reads the tag values fine. Our test bed system for Ignition does not have this problem.
The test bed system is as follows: Ignition vers. 7.07 running on XP SP2 connected to a remote PC running Think&Do OPC server (XP SP2).
Problem system is as follows: Ignition vers. 7.1.6 running on Windows Server 2008 SP1
No firewalls anywhere. DCOM configured with “everyone” and “anonymous” full access all four buttons on the COM security tab (both PCs). Thanks for any and all help.
Are there any error messages in the console that might indicate a bit better what’s happening? The easiest way to check is to look at the wrapper.log file in the install directory. Keep your eye out for any COM exceptions. I suspect that it still has something to do with the DCOM settings, since you can connect and browse. The subscriptions, in which the server connects back into Ignition, often can be tricky to get set up correctly. But, you should see some indication of this in the log.
OK - Solved the problem. It is definitely a DCOM settings issue. Changed the account in the OPC Server PC to match the Ignition Server PC account and everything seems to work. The wrapper.log indicated problems with callbacks from the OPC server. Not looking forward to connecting several more legacy OPC-DA server boxes to the Win server and getting this all locked down in COM settings on clustered Ignition servers. Will probably have to add the accounts from all the control PCs to the Ignition servers and allow COM access.
If the computers are all on the same domain, or if you can put them on a domain, it might be a bit easier to set them all up. You can then make a group for “domain users” and add that to the DCOM settings on the Ignition machine. With the Ignition gateway running as a domain account, you should be OK.
The other option might be using an OPC-UA wrapper in order to “tunnel” over UA instead of DCOM. I’m not sure if the foundation’s wrapper is publically available, but I can ask today- I’m actually currently at an OPC Interoperability event in Germany, and was testing with the wrapper yesterday. It would add one more software layer, which is annoying, but hopefully less annoying than using DCOM.
Had to close up shop yesterday so I didn’t see the last post. I messed around with the OPC-UA wrapper some while testing (30 day trial from Matrikon). The wrapper would be my preference if we could make it work. We will be setting up a domain and users for now. I hope to be able to secure everything including turning on the firewalls before we go live. If not, we will have to keep our HMI net isolated.
Any information on setting up the OPC-UA wrapper would be greatly appreciated.
So, the way it goes is that the OPC foundation is never going to release the wrapper- they’re going to allow members to release and support it. So, that’s what Matrikon is doing. I recommend contacting them for help.
I’ve been thinking about different ideas for solving this problem for a while- we really should have some easy (enough) way to tunnel classic OPC. There are tons of tunnelers out there, but our customers virtually never want to spend the amount of money that the vendors want for them. The OPC-UA wrapper is promising, if a bit intimidating to get started with. Perhaps a good how-to guide would be a place to start. I’ll take another look at the state of things when I get back on monday.
Actually, the Matrikon UA wrapper for Com OPC servers is a free download (apologies to Matrikon if I have this wrong). I didn’t spend much time testing this but will definitely get back to it.
Ah, yeah, that might be true. In regards to price, I was talking more about the “tunneller” product that they, and several other vendors, offer. It’s worth noting the difference between a tunneller and the OPC-UA proxy wrapper: the tunneller will try to make the remote servers look as they would if you were on the local machine. The OPC-UA wrapper will translate the server’s address space into an appropriate UA info model, which you can then easily access remotely. So, while both will make remote access easier, the tunneller will be more of a “drop-in” DCOM replacement. The UA wrapper will work, you’ll just have much different item paths.
I just downloaded and installed the Matrikon OPC-UA wrapper and found it pretty easy to get going. Certain parts can seem intimidating if you’re not used to UA, but it’s not too bad.
Here’s what I did:
Install the wrapper - it automatically starts as a service. Take a look at the user manual, there’s a lot of info there.
Stop the service (Control Panel>Administrative Tools>Services>Matrikon OPC-UA Wrapper).
Go to the install directory, run the executable. This will start it in “application mode”, where you can configure the wrapped server through a UI, instead of with XML.
Add a wrapped server from the “Config” menu.
Hit Ok to save, close application (or restart it, if you want to test with it running as an application).
Start the service.
In Ignition, set up a new OPC-UA connection. Put in the address and port 21381. Set “Security Policy” and “Message Security” to “None”*.
8 ) Click OK- you should now be connected and should be able to browse in the designer.
*Note about security: Strangely enough, I was able to connect without a problem with encryption when running the wrapper in application mode. However, as a service, the Ignition certificate was rejected, and I was only able to connect once I accepted it using the foundation’s “OPC-UA Configuration Tool”. I won’t get into that right now, but the point is that you should be able to get connected easily with no encryption, and then get encryption working later if desired.
Thanks Colby,
I had an older version of the wrapper which required the xml config file to be edited. Installed the latest version from Matrikon - followed your directions and everything looks good.
BTW - during install, the 30 day trial was selected by default. Since I don’t have a license I went with the defaults. Not sure if this will actually expire but at least I can test it. I have downloaded a trial of their tunneler and time permitting, may test that as well. The ua wrapper seems like a good fit for our application. Thanks again, your last post was very helpful.
Matrikon’s OPC UA Wrapper costs around $5,000 so it is definitly not free. Their OPC Tunneler program is around $600 which would be a much more cost effective solution if necessary.
$5000? I find that a bit hard to believe, since the tunneller is so much cheaper. Remember that with the tunneller, you’ll need at least 2 nodes though, so that will increase the price a bit.
There are other companies providing OPC UA gateways, for example Prosys (http://www.prosysopc.com/opc-ua-gateway.php). I don’t know how much theirs costs, and can’t find a download link, but I’ve sent them an email, so hopefully I’ll find out soon. I know it exists and works, because I just tested it this week at the OPC interop event
So, the Prosys Gateway is really the Unified Automation gateway, and costs $700. Probably more than you’d want to spend, but the experience is pretty decent. I just installed it and got my server setup without much problem- the UI aspect is a bit more complete than matrikon (mainly in that there’s a client that can connect to the service, so you don’t need to stop the service first. There’s also a handy tool for creating certificates so that you can connect securely). Strangely enough, you can’t browse the OPC-DA servers on your machine to add them, you need to know their ProgIDs. After that, though, everything is good.
Just to clarify the pricing here. The price for MatrikonOPC UA Wrapper for DA pricing is $1,200 US. It was $5,000 long time ago.
The UA Wrapper from MarikonOPC UA Wrapper supports DA, HDA, A&E interfaces.
I just talked with a rep from Matrikon and have been told the wrapper is $600 per license. I think this would be cheaper than using the tunneler because you would only need one license for each server PC and no license at the UA client end. You can actually wrap multiple servers on multiple PCs but would be back to using dcom for the remote PCs and would create a single point of failure at the wrapper. Since we have several servers running on multiple PCs, we will probably set up a domain and use Ignition DA client connections.
