AVEVA System Platform OPC UA Client to DataHub OPC UA Server for Expanded Connectivity

AVEVA™ users already have a wide range of connectivity options for interfacing with different systems. Cogent DataHub® also supports an extensive selection of connectivity to different systems that users sometimes need to access from AVEVA System Platform. Users of AVEVA System Platform have traditionally connected to DataHub via OPC DA Classic. AVEVA's OI Gateway provides those users the additional option of connecting to OPC UA data sources, for easier and more secure remote connections to such data sources.

In this blog post, we will cover the basic steps to connect AVEVA System Platform to Cogent DataHub via OPC UA, expanding connectivity options for AVEVA users.

While AVEVA™ users certainly have their own options for connectivity, it's commonly needed to expand those connectivity options using Cogent DataHub's own array of supported connectivity interfaces. While System Platform can connect directly to Cogent DataHub via OPC DA, if your system architecture requires that System Platform and DataHub reside on different remote machines, OPC UA is an easier to configure option that provides greater security, as well.

To that end, Cogent DataHub has a native OPC UA server interface. And System Platform can access OPC UA server data sources through the OI Gateway acting as an OPC UA client.

There are five basic steps AVEVA users will need to follow to get System Platform connected to DataHub using OPC UA.

1. Configuring Data Sources in Cogent DataHub

With DataHub, once the data is in a data domain in DataHub, it is just data. It can be used with any of the other supported connectivity interfaces that DataHub supports, including OPC DA client/server, MQTT client/broker (including Sparkplug B), and more simply by selecting/referencing any of the points/items in the data domain that was specified in the source connection.

In this case, any of those data domains accessible from other data sources will be browsable by OPC UA clients and can be added as nodes/tags/items in the client (i.e. AVEVA OI Gateway, in this instance).

For tutorials on configuring specific data sources in Cogent DataHub, here is our list of on-demand DataHub training videos.

2. Configuring Cogent DataHub as an OPC UA Server

From that point, enabling the OPC UA Server interface of Cogent DataHub is very straightforward. Under the consolidated OPC UA settings section of the Cogent DataHub, the first step is enabling the setting "Act as an OPC UA Server". And, to use the default Port settings and Endpoint Name, that's essentially all that is necessary to make DataHub data sources available as OPC UA server data.

DataHub exposes OPC UA server endpoints for three different protocols (opc.tcp, http, and https) depending on what a client requires. For connections from OI Gateway, the "opc.tcp" endpoint is the correct one, so you can actually highlight that endpoint in the list and click the "Copy Endpoint to Clipboard" button, which makes it easy to paste into the OPC UA client configuration in OI Gateway (or for reference, if OI Gateway is on a different machine and pasting to that remote machine isn't possible).

And, while DataHub has all Security Policies and User Token Policies enabled by default, you can click the "Advanced" button to confirm what security policies and authentication options are possible for use in configuring OI Gateway. The steps in this post will use an Anonymous connection; however, for secure applications, it is recommended to use user authentication - for full details on configuring UserName/Password authentication for use with OPC UA, view this how-to.

Now it will be necessary to return to DataHub during the OI Gateway configuration during the certificate exchange process but, for now, clicking the "Apply" button completes the configuration and DataHub is ready to be connected. Make sure to confirm that the "Status" display in DataHub shows a status of "Started".

3. Configuring AVEVA OI Gateway as an OPC UA Client to DataHub

Next, you need to configure OI Gateway as an OPC UA client and connect it to DataHub. In the AVEVA System Platform Management Console (SMC), you'll expand "Operations Integration Server Manager" in the tree view, the Node group, the desired Node, then the Operations Integration Supervisory Servers group, then the OI Gateway OPC DA ProgID ("OI.GATEWAY.3").

Click on "Configuration", then right-click and select "Add OPCUA Connection" and give the connection a meaningful name such as "CogentDataHub".

For the "OPCUA Server Details", if DataHub is on the same machine as OI Gateway, you can leave the "Server Node" as "localhost". If they are on separate machines, the "Server Node" will need to be the IP Address or Hostname of the Cogent DataHub machine. And the "OPCUA Server" field should be the endpoint that was copied from the Cogent DataHub OPC UA server settings.

By default, OI Gateway uses the most secure options for "Security Policy" and "Security Message Mode" - if you prefer to use a lower level of security for the connection, you will need to change those settings (DataHub supports the same options as OI Gateway and, since they are enabled by default, any option will technically work if you decide to change either or both of these).

For Anonymous authentication, the "Anonymous User" setting needs to be enabled in OI Gateway under "User Credentials".

At this point, you can click the "Test" button to the right of where you entered the "OPCUA Server" endpoint. You'll get the following message indicating the connection failed.

Assuming the following are true (which are actually conveniently detailed in the error message itself), this is due to the fact that DataHub doesn't currently trust OI Gateway's security certificate and OI Gateway doesn't currently trust DataHub's security certificate:

• The "Server Node" and "OPCUA Server" endpoint fields are correct
• The selected Security Policy, Security Message Mode and User Credentials match what is configured in DataHub
• Where applicable, an exception has been added to any firewalls for the port used by DataHub's OPC UA server.

So, to allow the Test functionality to work, you need to go back into DataHub. Back in the OPC UA section, you should now notice the "Rejected Certificates" counter has incremented from 0 to 1. Now, if you trust that this certificate is for the OI Gateway connection you just attempted, you can simply click the "Accept All" button to the right of that counter.

Alternately, if you want to inspect what client the rejected certificate was for, you can click the "Manage Certificates" button. With the "Rejected Certificates" option selected in the "Certificate Store" dropdown at the top, you should see the certificate for OI Gateway in the list - if you highlight it, you can click "View" to see more details. And you can click the "Accept" button to trust the certificate, allowing OI Gateway to connect to DataHub, then click "OK".

Back in the main DataHub configuration, make sure to click "Apply" at the bottom to accept all changes. You can now go back to OI Gateway and the "Test" button will result in a successful test connection (OI Gateway doesn't have any certificate management interface and trusts certificates by default - there is a folder structure under C:\ProgramData\Wonderware\OI-Server\$Operations Integration Supervisory Servers$\OI.GATEWAY\CertificateStores .

The "trusted" folder contains OPC UA server certificates that have previously been trusted (the filename of the certificate is the thumbprint of that certificate - not particularly user-friendly but you can compare these filenames to the Thumbprint field of DataHub's certificate (accessible by clicking the "Application Certificate" button in the DataHub OPC UA properties - the Thumbprint field is as the very bottom).

Because DataHub's certificate is in the Trusted folder and we've trusted OI Gateway's certificate in DataHub, this allows OI Gateway to securely connect because the client and server trust each other now. You can confirm the Test now works (no, unfortunately, there isn't a message that explicitly confirms the test was successful), you'll notice the OPC UA Namespace at the bottom of the configuration in OI Gateway is now populated for DataHub.

So we can go ahead and Save our settings by clicking the Save button in the upper right corner of the configuration.

The next step is adding some nodes/tags/items from the DataHub that you want to access with System Platform (or other OPC DA or SuiteLink clients that connect to OI Gateway). So you need to right-click on the OPC UA server under the Configuration branch in the tree view and select "Add OPCUAGroup Connection" - you'll want to enter a meaningful name.

The "Browse OPCUA Server" button will allow you to browse the DataHub address space.

You can then select the desired data points that you wish to access in the OPCUA Tag Browser window that appears (be patient - I observed that it can take a few seconds and appear that nothing happened when you click the button).

The "Add to list" button then adds the selected items.

Click "OK" once all of the desired points have been added - for our purposes, there are DataSim points in this DataHub that will simulate changing data.

Back in the main configuration, you can then go to the "Device Items" tab and confirm that your points have been added to the item list here. Optionally, you may also choose to rename the items here with a more user-friendly name - this is helpful since the "Name" defined here will be used in the SuiteLink Topic attributes as the Item Reference in System Platform . Clicking the Save button at the top-right corner applies the additions.

Now, if your OI Gateway has been deactivated, you'll need to right-click on the top level "OI.GATEWAY.3" in the tree view and select "Activate". Otherwise, you'll need to deactivate then activate to apply the changes to the runtime. Now that OI Gateway is configured, it is typically a good idea to confirm that your configuration is working as expected prior to moving on to the next step.

To that end, you can connect to OI Gateway using a SuiteLink or  OPC DA test client (the OPC Quick Client that installs with TOP Server, as shown below, or the Software Toolbox OPC Test Client is available as a standalone installation you can request here). As you can see from the image below, the test client successfully connects to the OPC DA ProgID "OI.GATEWAY.3" and is receiving good quality and values from the DataHub points configured for the OPC UA connection.

The next step is accessing OI Gateway from System Platform.

4. Configuring AVEVA System Platform DI Objects

The first step is creating/adding an instance of the OPC or SuiteLink Device Integration (DI) object in the desired System Platform (ArchestrA) galaxy, since OI Gateway supports either interface for client connectivity. The following assumes that you already have a WinPlatform, AppEngine and Area created where either of the DI objects can be assigned. For our purposes, we'll use a SuiteLink DI Object below.

Adding a SuiteLink Device Integration Object

In the ArchestrA IDE for the galaxy you want to connect to DataHub, go to the Template Toolbox under System objects and find the $DDESuiteLinkClient DI object template. Right-click and select New -> Instance which will create a new instance in the "Unassigned Host" folder in the Deployment view which you can rename to something meaningful such as "OIGW_DataHub".

You can drag-and-drop the new instance to the desired AppEngine. Then you can double-click on the new instance to open the properties.

The SuiteLink DI object involves configuring the following:

• Defining the "Server node" or IP / DNS name of the machine where OI Gateway is installed on your network (if OI Gateway is installed on the same machine as System Platform (which is most likely), the Server node gets left blank).
• Entering the "Server name" for OI Gateway (the SuiteLink service name for OI Gateway is just "Gateway").
• The "Communication protocol" should remain at the default of "SuiteLink".
• Creating a Topic under the "Topic" section (this needs to match the Device Group Name from the OPC UA group defined in OI Gateway from earlier - you can go back to OI Gateway and copy/paste the name from there, if needed.
  
  
  
  
• Adding Attributes to that Topic - you basically need to define an Attribute here for each Item that you want to access from OI Gateway using the "+" button above the "Associated attributes" section. For the "Item Reference" you'll use the "Name" for the item from your "Device Items" section in OI Gateway (the "Attribute" name itself can be the same or different). You can also use CSV import/export to populate this list, if you have a lot of attributes to add.
  
  
  
  
• Once finished, just click the Save button at the top right of the DI object properties and check the object back in.

These are the high level settings that get System Platform connected to OI Gateway via the SuiteLink DI Object.

2. Adding AnalogDevice Object for Attributes

Once the SuiteLink DI object is configured and checked back in, it will be necessary to define an instance of the $AnalogDevice object. So back in the Template Toolbox under System, you need to right-click on $AnalogDevice and select New -> Instance which will add the instance to the "Unassigned Host" folder where you can give it a meaningful name to represent the data points it will be linked to. You can drag-and-drop the instance to the desired Area to assign it.

Double-clicking on the object will open its properties where you need to go to the "Attributes" tab.

Here you need to click the "+" button at the top center of the tab to add an attribute.

Then configure the following:

• Name - this should be a meaningful to represent the specific item you want this object to access from OI Gateway - for simplicity, we're using the same name as the attribute in the Topic that was just configured.
• Data Type - this should match the corresponding data type of the item you're accessing from DataHub.
• Available Features - Enable "I/O" here which allows you to select the input source.
  • Read from / Write to - this is where you map to the item in OI Gateway that corresponds to the DataHub point/item you want this object to represent.
    • You can click the "..." ellipses button to browse available attributes (which will allow you to select from the list of attributes you defined earlier in the SuiteLink DI Object Topic).
      • This brings up the Galaxy Browser, where you can select the instance of the SuiteLink DI object you just configured and you'll find the associated attributes listed to the right - select the desired attribute and click "OK".
        
        
        
        
    • Alternately, you can manually enter the path to the item - either of the following syntax is valid:
      • <SuiteLinkDIObjectName>.<TopicName>.<DeviceItemName> (for directly accessing items from OI Gateway)
      • <SuiteLinkDIObjectName>.<TopicName>.<AttributeName> (for accessing the attribute name defined in the Topic in the SuiteLink DI Object)
    • Honestly, with the attributes already defined in the SuiteLink DI Object, browsing and selecting is the easiest method here.
  • You'll need to do the same thing to add each of the additional attributes that you defined earlier in the Topic of your SuiteLink DI Object.
  • Then all that remains is clicking the Save button at the top right, accept any warnings and check the object back in.

5. Deploying the Device Integration Object in System Platform

And last, but not least, once the SuiteLink DI object is configured with the desired items/tags and assigned appropriately depending on your galaxy architecture, it's necessary to deploy the SuiteLink DI object and related Application Objects for the associated tags. This deployment is accomplished the same way as for deploying any other objects and changes in System Platform - by right-clicking on the Galaxy object in System Platform (in the Deployment view) and selecting the "Deploy" option.

And the System Platform Object Viewer can then be used to confirm you are successfully connected and communicating by right-clicking on the AnalogDevice object and selecting "View in Object Viewer".

You can find the points/attributes that you added to the AnalogDevice object, highlight them and "Add to Watch" if you'd like to watch them update in real-time (though you can already see values and good quality).

Once the points have initialized, you can watch the selected attributes/items updating per their defined update rate with good values and quality.

This indicates you're receiving data all the way from DataHub through the OI Gateway and into System Platform via OPC UA, for easy access to all of the data sources supported by Cogent DataHub over secure remote OPC UA connections.

Don't forget to subscribe to our blog to not only be notified of future posts on DataHub and AVEVA applications but to also find out about more relevant technical topics applying to industrial process automation and solving related challenges.

Want to try the latest Cogent DataHub for yourself with AVEVA System Platform?  Download the free trial.