Connecting a DCS (OPC UA)

A DCS is connected through the OPC UA server the DCS provides, not through a dedicated driver. Edge connects to that server as an OPC UA client (the OPCUA driver) and reads values. There is no separate driver for each DCS.

Verified on real equipment: not yet (0)

None of the DCSs below has been verified against Edge on real site equipment. There are no customer installations yet either. Test in a test environment before connecting to a production DCS.

Target DCSs and manufacturer information

All are connected the same way: the DCS's OPC UA server → the Edge OPCUA driver. The "Confirmed" column in the table below lists only what was confirmed in official manufacturer documents. Anything not confirmed in official documents is marked "to be confirmed".

System	Connection	Confirmed	Source
Honeywell Experion PKS	The DCS's OPC UA server	To be confirmed	—
Yokogawa CENTUM VP	Exaopc OPC UA Interface Package	R3.82 — DA · A&C compatible, runs on an Exaopc PC with Windows Server 2022 Standard / Windows 11 Enterprise LTSC 2024, supports CENTUM VP R6.12 / R7.01. Security policies (per OPC Foundation certification data): None · Basic128Rsa15 · Basic256 · Basic256Sha256 · Aes128-Sha256-RsaOaep · Aes256-Sha256-RsaPss, users Anonymous · UserName · X509. Default port not publicly documented	Yokogawa Exaopc · OPC Foundation certification
Emerson DeltaV	DeltaV OPC UA Server (Application Station · ProfessionalPLUS, or built into the PK Controller)	The workstation server is a COM→UA wrapper around classic OPC DA · A&E · HDA and needs the OPC UA Activation License VE2200 plus classic OPC server licences. The PK Controller's built-in server provides DA only and needs no activation licence. Supports signing · 128/256-bit encryption · certificates. Default port not in the datasheet. See Emerson DeltaV	Emerson datasheet
ABB 800xA	The DCS's OPC UA server	To be confirmed	—
Siemens PCS 7	OpenPCS 7 OPC UA server (Windows service on the OpenPCS 7 station / OS)	Per the OpenPCS 7 V8.2 manual (2016) — separate licence required, default port 4863 (opc.tcp://[HostName]:[Port]), supports Alarms & Conditions. A client certificate placed in [ApplicationPath]\PKI\CA\certs is trusted; an untrusted certificate is moved to [ApplicationPath]\PKI\CA\rejected and secure communication is refused. May differ in later releases	OpenPCS 7 V8.2 manual
Siemens PCS neo	The DCS's OPC UA server	To be confirmed	—
Schneider Foxboro	The DCS's OPC UA server	To be confirmed	—
Emerson Ovation	Ovation UA application (part of the Ovation SCADA server · CPS, client and server)	Runs on Workstation · ELC · OCC100 · OCR3000. X.509 certificate authentication · message signing · session encryption. Default port not publicly documented	Emerson — OPC UA Interoperability in Ovation
Rockwell PlantPAx	The DCS's OPC UA server	To be confirmed	—

Default ports and security policies are mostly not published

Most manufacturers do not publish their default port and security policies. Once you know the IP and port, [Find endpoints] on the Edge connection screen shows the security modes, policies and user authentication the DCS offers — see step 4 below.

---

1. Turn on the OPC UA server on the DCS side

How to turn on the OPC UA server, and the licence it needs, differ from DCS to DCS. Licences confirmed in public documents are listed in the table above. For the procedure, follow the DCS manufacturer's manual. This document does not cover menus or procedures on the DCS side. Work through it together with the DCS administrator.

2. Check the endpoint URL and port

Get the IP and port of the OPC UA server from the DCS administrator. The endpoint URL has this form:

opc.tcp://<IP>:<port>/<path>

• Confirm the port with the DCS administrator. 4840 is only the OPC UA default port; the DCS may use a different one (e.g. the PCS 7 manual in the table above gives 4863).
• Put <path> in the Server name field of the Edge screen. If there is no path, leave it empty.
• Even if the endpoint address advertised by the server contains a host name, Edge replaces that host with the IP you entered when connecting (port and path stay as they are).
• You do not need to be given the security mode and policy. Press [Find endpoints] on the connection screen to see the endpoints the DCS offers as a table, and fill them in with [Use] — see Endpoint lookup.

3. Use a read-only account

Create a read-only account on the DCS's OPC UA server and connect with it. The Edge OPCUA driver supports writes, so writes must be blocked at the account to keep tag writes from the Edge side (REST · Node-RED) from changing DCS values.

4. Secure connection (Sign / SignAndEncrypt)

A secure connection is recommended for a DCS. A connection newly created from the DCS card on the add-connection screen starts with security mode SignAndEncrypt. If you created it from the generic OPC UA screen, change the security mode.

1. In the Security (channel encryption) group of the connection screen press [Find endpoints], press [Use] on the row of the DCS endpoint you want, then save.
2. On the first connect the DCS's server certificate is refused and a notice appears. Compare the thumbprint with the DCS certificate's thumbprint, then press [Trust this certificate]. The edge reconnects shortly.
3. If the DCS refuses the edge certificate («The server refused the secure channel…»), download that connection's edge certificate (.der) on the OPC UA server › Client connection certificates tab and add it to the DCS trust list. Follow the DCS manufacturer's manual and work with the DCS administrator.

The screens and error texts are in OPC-UA — Secure connection. In an HA setup, trust is granted on each box separately.

5. Add the connection in Edge — with today's screen

For now, add it with the existing OPC UA connection registration screen (/ui/connect/opcua).

Field	Value to enter
IP address	IP of the DCS OPC UA server
Port	The port confirmed in step 2
Server name	The path part of the endpoint URL. Empty if there is none
User / Password	The read-only account from step 3. Leave both empty for anonymous access
Security mode / Security policy	The values filled in with [Use] in step 4
Discovery	false recommended. true walks the whole node tree at boot, which puts a heavy load on large servers

In the tag's PLC address, enter the NodeId — ns=<number>;s=<string> or ns=<number>;i=<integer>. NodeIds differ for each DCS, so get them from the DCS administrator or check them with an OPC UA browser tool.

Detailed explanations of the fields and address notation are in these documents.

• OPC-UA connection
• OPC-UA driver

---

Related documents

• Connecting robots (OPC UA)
• Emerson DeltaV