OPC UA and OPC HDA
Three OPC connectors — live UA, historical UA, and classic HDA — and the certificate trust step that catches everyone.
OPC is the lingua franca of industrial data, and Infohub provides three connectors for it. Choosing between them is the first decision, and OPC UA certificate trust is the thing that turns a five-minute job into an afternoon.
Which connector#
| Connector | Reads | Use when |
|---|---|---|
| OPC UA Historian | Stored history via OPC UA | The server supports historical access — the usual choice |
| OPC UA | Live current values only | No historical access exists |
| OPC HDA Historian | Stored history via classic OPC HDA | Older servers, or a historian with no dedicated Infohub connector |
Prefer historical access. Infohub calculates over periods, and a live-only source cannot answer "what was the average last Tuesday" — it can only report the value now. With a live source, your history begins the day you deploy.
OPC HDA remains genuinely useful as a universal fallback: many historians expose HDA even when they have no dedicated Infohub connector, so it is often the way to reach an unusual or legacy system.
OPC UA certificates#
OPC UA is secure by default, and both ends must trust each other. This is the single most common reason an OPC UA connection will not come up.
Both connectors expose a Certificate Name property, identifying the client certificate Infohub presents.
The trust exchange has to happen in both directions:
- Infohub presents its client certificate to the OPC UA server.
- The server rejects it, because it has never seen it, and files it in a rejected-certificates folder.
- An administrator moves that certificate into the server's trusted store.
- Infohub must trust the server's certificate in return.
- The connection then succeeds.
The first connection attempt is supposed to fail. Step 2 is not an error to be diagnosed — it is how OPC UA works. The failed attempt is what delivers Infohub's certificate to the server so it can be trusted. Attempt the connection, then ask the server administrator to promote the rejected certificate, then try again. Retrying without step 3 will fail identically every time.
Two further points that cost time:
The certificate belongs to the machine hosting the connection — the Platform host running Flow Bootstrap — not to the modeller's workstation. Trust established for a workstation does not transfer to the server, so a connection that works in Flow Config can fail once deployed.
Certificates expire. An OPC UA connection that has worked for a year and suddenly stops is very often an expired certificate at one end or the other.
OPC UA Historian properties#
| Property | Notes |
|---|---|
| Port | The server's endpoint port |
| Connection Timeout | How long to wait when establishing a session |
| Certificate Name | Infohub's client certificate |
| Maximum Concurrent Connections | Parallel request limit |
Per-measure, it offers the standard historian set: Tag, Aggregation, Scaling Factor, Rollover, Deadband, State Comparator / State, the Filter Tag group, and Expression. See How Infohub Retrieves Data for overlap and filtering.
OPC UA (live) properties#
The live connector is a different shape, because it subscribes rather than queries.
| Property | Notes |
|---|---|
| Sampling Interval | How often the server samples the value for this subscription |
| Monitoring Mode | How the item is monitored — whether values are reported |
| Tag Delimiter | Character separating levels in the browse path |
| Purge Age | How long Infohub retains buffered live values |
| Certificate Name, Port, Connection Timeout | As above |
Sampling Interval is the property to think about. Requesting a fast sample on thousands of items puts real load on the OPC server and produces far more data than most reporting needs. Match it to what the measure is for: a one-second sample for a value you report hourly is waste.
Purge Age controls how long live values are held before being discarded. It needs to comfortably exceed the interval you aggregate to, or values will be purged before the engine has used them.
A live source means history starts now. There is no back-fill from a live OPC UA source. If Infohub is becoming the record for a tag, the first day you deploy is the first day you have. Where the value matters historically, find a historian for it, or accept the gap and document it.
OPC HDA properties#
| Property | Notes |
|---|---|
| Convert to null | When to treat a retrieved value as absent rather than as a number |
| Maximum Concurrent Connections | Parallel request limit |
Per-measure it offers the same historian set as OPC UA Historian.
Convert to null is worth using deliberately. HDA servers vary in how they represent bad or missing data, and some return a numeric placeholder rather than nothing. Configuring those to convert to null keeps them out of averages instead of dragging them down — the alternative is a monthly average quietly polluted by a sensor fault that reported zero for six hours.
Note that OPC HDA is a DCOM-based classic OPC technology. Where it is used across machines, DCOM configuration and Windows authentication are part of the job, and are usually the reason a remote HDA connection is harder to establish than a local one. Hosting the connection on a Platform close to the server avoids most of that.
Browse the namespace#
All three connectors can enumerate the server's address space. Browse rather than typing paths:
- OPC browse paths are deeper and more structured than people expect.
- The Tag Delimiter must match how the server separates levels.
- Browsing proves the connection, the certificate trust, and the credentials in one action.
If browsing works but a specific tag returns nothing, the tag exists and the problem is in retrieval — period, overlap, or the server's history for that node.
The service account#
OPC frequently uses Windows authentication. A connection tested in Flow Config authenticates as you; deployed, it authenticates as the Flow Bootstrap service account.
For OPC, plan on running Bootstrap as a domain account with rights on the OPC server. Leaving it as NT AUTHORITY\SYSTEM and expecting a remote OPC connection to work is a common false start.
Diagnosing#
| Symptom | Check |
|---|---|
| UA connection refused on first attempt | Expected — have the rejected certificate trusted on the server |
| Still refused after trusting | Infohub must also trust the server's certificate; confirm the Platform host, not the workstation |
| Worked for a year, now fails | Certificate expiry at one end |
| Works in Config, fails deployed | Certificate or Windows rights belong to the Bootstrap service account |
| Namespace browse empty | Credentials, or the account cannot browse the address space |
| Tag not found | Tag Delimiter, or the path was typed rather than browsed |
| Live values stop appearing after a while | Purge Age too short for the aggregation interval |
| OPC server under heavy load | Sampling Interval too fast, or concurrency too high |
| Averages polluted by fault values | Configure Convert to null (HDA) |
| Remote HDA will not connect | DCOM and Windows authentication — consider hosting the connection locally on a Platform |