OPC-UA

OPC Unified Architecture is the primary way QUBIQ talks to PLCs, DCS and gateways. QUBIQ acts as an OPC-UA client, maintaining a pooled session per connection and subscriptions on behalf of every bound tag.

Configuration

Field	Description
Name	Connection identifier used by bindings and pipeline nodes.
Endpoint	The endpoint URL, e.g. opc.tcp://192.168.1.10:4840.
Security mode	None, Sign, or SignAndEncrypt.
Security policy	None, Basic128Rsa15, Basic256, Basic256Sha256. Match what the server offers.
Username / Password	Optional user-identity token. Leave blank for anonymous.
Certificate / Private key	Client certificate for certificate-based identity or encrypted channels.
Trusted thumbprint	The server certificate QUBIQ has been told to trust.
Trusted server name	The application name recorded when the certificate was trusted.

Discovering endpoints

Rather than guessing the security combinations a server supports, ask it:

Use Discover in the connection form (needs Create connections). The response lists every endpoint the server advertises with its security mode, policy and certificate. Pick one and the form fills itself in.

This is the reliable way to resolve "connects with None, fails with SignAndEncrypt" — the server usually offers a different endpoint URL per security level.

Certificate trust

With Sign or SignAndEncrypt, QUBIQ must trust the server's certificate and the server must trust QUBIQ's.

Trusting the server:

Use Trust beside the discovered endpoint (needs Create connections). Discovery returns the server certificate; trusting it records the thumbprint and application name on the connection. Subsequent sessions verify against exactly that certificate — a substituted certificate fails rather than silently connecting.

Being trusted by the server: most servers reject an unknown client on first attempt and place its certificate in a rejected list. Move it to the trusted store on the server, then retry. This is normal and is a one-time step per client.

None is for commissioning

Security mode None sends credentials and process data in the clear. Use it to prove reachability, then move to SignAndEncrypt with Basic256Sha256 before production.

Binding tags

An OPC-UA binding needs a connection, a node address and a polling mode.

Field	Notes
Address	The NodeId, e.g. ns=2;s=Motor1.Speed, ns=3;i=1042, ns=2;g={...}.
Polling mode	subscribe (server pushes on change — preferred), poll (QUBIQ reads on an interval), read (on demand), write (write-only).
Sampling rate	Milliseconds. For subscribe, the requested publishing interval; for poll, the read period.
Deadband	Change threshold below which an update is not propagated.

Prefer subscribe. It shifts change detection to the server, cuts network traffic, and gives you the server's own timestamps.

→ Protocol bindings

Browsing the address space

Browse (needs View connections) walks the server's address space so you can pick nodes in the binding editor instead of typing NodeIds. Browse results include the data type, so QUBIQ can pre-fill the tag's data type correctly.

Node quarantine

If a subscribed node repeatedly fails — it was deleted, renamed, or its type changed — QUBIQ quarantines it rather than letting one bad node degrade the whole subscription. A quarantined node stops being requested; the rest of the subscription keeps working.

Action	Permission
List quarantined nodes	View connections
Release specific nodes back into service	Edit connections
Clear the whole quarantine	Edit connections

Quarantine is a symptom, not a fix. Read the list after a PLC program download — it is usually a precise list of the addresses that changed.

Data types

OPC-UA types map onto QUBIQ tag data types directly: Boolean, SByte/Byte, Int16/UInt16, Int32/UInt32, Int64/UInt64, Float, Double, String, DateTime. Arrays are supported and carry their dimensions through to the tag.

Set the tag's data type to match the node's. A mismatch surfaces as a conversion failure with Bad quality rather than a silently wrong value.

Quality and timestamps

OPC-UA status codes map to QUBIQ tag quality:

OPC-UA status	Tag quality
Good	Good
Uncertain*	Uncertain
Bad*	Bad
Node not found	NotFound

Both the source timestamp (when the device sampled the value) and the server timestamp (when the OPC-UA server processed it) are carried through to scripts and the historian.

Troubleshooting

Symptom	Check
BadTcpEndpointUrlInvalid	The endpoint hostname must match what the server advertises — use the discovered URL, not the IP you typed.
Connects, then drops every few minutes	Session or subscription timeout too short relative to the publishing interval.
BadCertificateUntrusted	The server has not trusted QUBIQ's client certificate yet.
BadUserAccessDenied	Credentials are valid but the account lacks read/browse rights on the node.
Some tags Bad, most Good	Check the quarantine list — those nodes probably no longer exist.
Values update far slower than expected	The server may be clamping the requested publishing interval; raise the sampling rate and compare.

Next

→ MQTT & Sparkplug B · Binding tags