MatrikonOPC Server For SCADA DNP3 User Manual
MatrikonOPC Server For SCADA DNP3 User Manual
User's Manual
MatrikonOPC Server for SCADA DNP3
User's Manual
Phone: +1.780.448.1010
Fax: +1.780.448.9191
www.matrikonopc.com
Document
Date Description Author
Version
2002-10-15 1.0 Initial document. JC
2004-01-09 1.1 Minor change to Time Bias field. RS
Changes to timestamps, DNP3 objects, and
2004-04-05 1.2 protocol fragment handling. Added Chapter 6. RS
Minor revisions throughout manual.
2004-06-22 1.3 Added Appendix D. RS
Version: 1.2.3.0
DOCUMENT VERSION
Version: 6.0
COPYRIGHT INFORMATION
Copyright 1997 - 2013, Matrikon Inc. All rights reserved. No part of this document may be reproduced, stored in
a retrieval system, translated, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording,
or otherwise, without prior written permission of Matrikon Inc.
CONFIDENTIAL
The information contained herein is confidential and proprietary to Matrikon Inc. It may not be disclosed or transferred,
directly or indirectly, to any third party without the explicit written permission of Matrikon Inc.
LIMITATIONS
Matrikon has made its best effort to prepare this manual. Matrikon makes no representation or warranties of
any kind with regard to the completeness or accuracy of the contents herein and accepts no liability of any kind
including without limitation warranties of merchantable quality, satisfactory quality, merchantability and
fitness for a particular purpose on those arising by law, statute, usage of trade, course of dealing or otherwise.
Matrikon shall not be liable for any losses or damages of any kind caused or alleged to be caused directly or
indirectly from this manual.
LICENSE AGREEMENT
This document and the software described in this document are supplied under a license agreement and may only be used
in accordance with the terms of that agreement. Matrikon reserves the right to make any improvements and/or changes to
product specifications at any time without notice.
TRADEMARK INFORMATION
The following are either trademarks or registered trademarks of their respective organizations:
OTHER
Table of Appendices
Appendix A Distributed COM (DCOM) ...................................................................... 119
DCOM Configuration Utility ............................................................................................. 119
Default Properties .......................................................................................................... 119
Security Permissions ...................................................................................................... 120
Server Identity .............................................................................................................. 124
Default Protocols ........................................................................................................... 124
Remote Program ID ....................................................................................................... 125
Appendix B Aliases .................................................................................................. 126
Scaling Expressions ....................................................................................................... 126
Scaling Calculations ....................................................................................................... 127
CSV File Format ............................................................................................................ 129
Scaling Algorithms ......................................................................................................... 131
Appendix C Standard Data Types ............................................................................. 132
Appendix D Microsoft Excel as a DDE Client ............................................................. 133
DDE Read ..................................................................................................................... 133
DDE Write .................................................................................................................... 133
Net DDE ....................................................................................................................... 134
Appendix E Security ................................................................................................ 135
Introduction .................................................................................................................. 135
OPC Security Implementation ......................................................................................... 135
MatrikonOPC Tag Security Configuration Utility ................................................................. 136
Table of Figures
Figure 1 - InstallAware Wizard Verification Window ...................................................... 15
Figure 2 - License Agreement Screen ............................................................................. 16
Figure 3 - Setup Type Window ....................................................................................... 17
Figure 4 - Destination Folder Screen .............................................................................. 18
Figure 5 - Start Menu Screen .......................................................................................... 19
Figure 6 - Enter Password Screen .................................................................................. 20
Figure 7 - Licensing Screen ............................................................................................ 21
Figure 8 - Ready to Install Screen .................................................................................. 22
Figure 9 - Installing MatrikonOPC Server for SCADA DNP3 Screen ................................. 23
Figure 10 - MatrikonOPC Server for SCADA DNP3 Setup Complete Screen ..................... 24
Figure 11 - Tool Tray ...................................................................................................... 29
Figure 12 - Tool Tray Menu............................................................................................. 30
Figure 13 - Control Panel ............................................................................................... 30
Figure 14 - Configuration Window .................................................................................. 32
Figure 15 - General Options Tab ..................................................................................... 36
Figure 16 - General Logging Options Tab ....................................................................... 37
Figure 17 - Interface Logging Options Tab ..................................................................... 39
Figure 18 - Advanced Options Tab .................................................................................. 40
Figure 19 - Insert New Object Window .......................................................................... 41
Figure 20 - Create New Fail-Over Channel Window ........................................................ 43
Figure 21 - Fail-Over Channel - Communication Tab ...................................................... 44
Figure 22 - Fail-Over Channel - Load Distribution Tab .................................................... 45
Table of Tables
Table 1 - Terms and Definitions...................................................................................... 13
Table 2 - Files Installed in "SCADA DNP3" Folder ........................................................... 26
Table 3 - Files Installed in "Common" Folder ................................................................. 26
Table 4 - Files Installed in "system32" Folder ................................................................ 26
Table 5 - MatrikonOPC Support Regional Contact Information ....................................... 27
Table 6 - After-Hours Support ........................................................................................ 27
Table 7 - Tool Tray Menu Commands .............................................................................. 30
Table 8 - Control Panel Commands ................................................................................. 31
Table 9 - Configuration Window Commands ................................................................... 33
Table 10 - File Menu Commands ..................................................................................... 33
Table 11 - Edit Menu Commands (Server Configuration) ................................................ 34
Table 12 - Edit Menu Commands (Alias Configuration)................................................... 34
Table 13 - View Menu Commands ................................................................................... 34
Table 14 - Tools Menu Commands .................................................................................. 35
Table 15 - Help Menu Commands ................................................................................... 35
Table 16 - General Options Tab Fields ............................................................................ 37
Table 17 - General Logging Options Tab Fields ............................................................... 38
Table 18 - Interface Logging Options Tab Fields ............................................................ 39
Table 19 - Advanced Options Tab Fields ......................................................................... 40
Table 20 - Insert New Object Window Options ............................................................... 42
Table 21 - Fail-Over Channel - Communication Tab Components .................................... 45
Table 22 - Create New Network Channel Window Components ...................................... 48
Table 23 - Create New Serial Channel Window - Communication Tab Components ........ 52
Table 24 - Create New Serial Channel Window - Data Acquisition Tab Components ....... 53
Overview of Manual
This manual uses icons to highlight valuable information. Remember these icons and what they
mean, as they will assist you throughout the manual.
The Users Manual has been designed so that you can click on references in the document to jump
to that referenced point without having to scroll through several pages (in some cases). For
example, if you were to see the sentence Refer to Figure 1 for more information, pressing the
CTRL key and clicking your mouse on the text Figure 1 will automatically take you to the location
of Figure 1 within the document.
This manual consists of several chapters and is structured as follows:
Introduction this introductory chapter.
Getting Started provides instructions for installing the software, and MatrikonOPC
Support team contact information.
References
This document references information found within the following documents/sites:
www.opcfoundation.org
www.matrikonopc.com
www.opcsupport.com
http://www.dnp.org
International Standard DNP3
DNP3 Specification, Volume 7: IP Networking
OPC Overview 1.0
OPC Common Definitions and Interfaces 1.0
OPC Security Custom Interface 1.0
OPC Alarms and Events Interface Standard 1.10
Terminology
The terms screen and window are used interchangeably throughout this document.
Table 1 provides a list of definitions for terms used throughout this document.
Term/Abbreviation Description
ADT Asynchronous Data Transfer.
API Application Programming Interface.
Component Object Model. A method for organizing software, specifying how to
COM
build components that can be dynamically interchanged.
DA OPC Data Access. Provides access to real-time process data.
Distributed Component Object Model. An extension of COM that allows
DCOM
communication between COM components over a network.
Dynamic Data Exchange. Allows the transfer of data between two running
DDE
applications.
Matrikon Matrikon Inc.
MatrikonOPC Matrikons brand name for its OPC servers and clients.
The communication standards published by the OPC Foundation. Refer to
OPC
www.opcfoundation.org for more information.
PLC Programmable Logic Controller.
Supervisory Control And Data Acquisition. Software that is interfaced to
SCADA
hardware via a PLC or other API.
The Distributed Network Protocol. DNP3 is defined and managed by the DNP
DNP3
Users Group. Refer to www.dnp.org for more information.
Table 1 - Terms and Definitions
System Requirements
The software has Software and Hardware system requirements. These requirements must be
met for the software to function properly.
Software Requirements
The following software is required:
Microsoft Windows XP SP0, or
Microsoft Windows 2003 SP0, or
Microsoft Windows Server 2000 SP3
Microsoft .NET 1.1 Framework (included with installation package)
Your system must have the following additional software to use the corresponding functionality:
TCP/IP or UDP/IP terminal server
Hardware Requirements
The following hardware is required:
Intel Pentium 4 Processor
512 MB RAM
40 GB 7200 RPM Hard Drive
The server requires the following additional hardware to make use of additional functionality:
Serial communications port
RS-232/422/485 cabling and/or converter
Installation
Once the system requirements have been met, you are ready to install the software.
3. Read the Software License Agreement, using the scroll bar to view the entire message.
4. Select the I accept the license agreement option button.
5. Click on the Next button. The Setup Type screen (Figure 3) appears.
8. Select the folder in which to install MatrikonOPC Server for SCADA DNP3, or accept the
default location displayed in the Folder path field.
9. Click on the Next button. The Start Menu screen (Figure 5) appears.
10. Select the Start Menu group and specify whether you want shortcuts created only for
yourself, or for all users, by selecting the applicable option button.
11. Click on the Next button. The Enter Password screen (Figure 6) appears.
12. A default password is supplied for you in the Password and Confirm Password fields.
Notes:
The default password provided for you is MatrikonOPC. Note
this password for future reference.
If you need to change the password at a later date, access the
Tag Security shortcut from the Start menu. Click on the
Windows Start button. Select Programs -> MatrikonOPC ->
<OPC Server Name> -> Tag Security. For more
information, refer to Appendix E Security.
13. Click on the Next button to accept the default password. The Licensing screen (Figure 7)
appears.
16. Click on the Next button. The Installing MatrikonOPC Server for SCADA DNP3 screen
(Figure 9) appears, installation begins, and the product files are copied to the computer.
Note: Prior to starting the installation, you have the option of clicking on the Back button
to change any of the installation information. Click on the Cancel button if you wish to stop
or cancel the installation.
17. When the installation has finished, the MatrikonOPC Server for SCADA DNP3 Setup
Complete screen (Figure 10) appears stating that MatrikonOPC Server for SCADA DNP3 has
been successfully installed.
18. At this point you have the option of launching any or all of the following by selecting the
necessary checkbox or checkboxes:
Configuration panel
Quick Start Guide
Users Manual
Release Notes
19. Click on the Finish button to complete the installation and exit the Wizard.
20. The necessary files have now been copied to the target computer, the software components
are registered, and shortcut icons are created in the Start menu.
The files listed in Table 3 are installed by default, in the following location:
C:\Program Files\Common Files\MatrikonOPC\Common
Licensing
Most MatrikonOPC products require some form of licensing criteria be met to ensure that it
functions successfully
IMPORTANT TO NOTE:
The following licensing information is described in detail within the
Licensing Procedures document which accompanies the MatrikonOPC
Server for SCADA DNP3 software and Users Manual:
Hardware and software key licensing information.
Information about the MatrikonOPC Licensing Utility that is
used to license software, and the variety of ways in which
licenses can be obtained (e.g., Internet Connection, Web Page,
Email).
Licensing Q&A and Troubleshooting.
Contacting Support
The MatrikonOPC Customer Services department (www.opcsupport.com) is available 24 hours a
day, seven days a week.
Contact MatrikonOPC Support using the information below, or send an email
([email protected]).
For Monday to Friday daytime support requests, contact MatrikonOPC Support using the regional
phone numbers provided in Table 5.
For after-hours support in all regions, please use either of the following numbers. There is no
extra charge from MatrikonOPC for calling their after-hours support numbers.
If the server is not installed as a Windows service, the Welcome screen appears briefly
when the server starts up.
Notes:
If the server is not installed as a service, the server will
automatically start up when a client (such as MatrikonOPC
Explorer) first tries to connect to it.
If the server is installed as a service, users can choose to run it
as an application by re-registering the OPC server executable
using the /REGSERVER command-line switch.
Command Description
Show Control Panel Displays the configuration control panel.
Control Panel
Note: If the server is installed as a Windows service, the Control Panel is not available.
The Control Panel displays the servers status, system time, and number of clients connected to
the server. The Control Panel allows users to:
Access the Configuration window.
Access the About screen.
Execute the command to shut down the server.
The Control Panel stays on top of every other window on the desktop to help monitor the status
of the server.
5. To window shade the Control Panel so that it displays only the client count, double-click
your mouse on the title bar.
Command Description
Status Displays the current status of the server.
Time Displays the current time.
Clients Displays the total number of OPC clients presently connected to the server.
Configure Displays the main Configuration window.
Shutdown Shuts down the server.
About Displays the servers Welcome screen, which includes information about the software.
Table 8 - Control Panel Commands
Configuration Window
Note: If the server is installed as a Windows service, the Tool Tray Menu and Control Panel are
not available. In this case, the Configuration window is then accessed via the Windows Start
menu.
The Configuration window is used to configure the server. It displays the current configuration
and allows users to change configuration parameters.
To view the Configuration window:
1. From the Tool Tray Menu or the Control Panel, select Configure.
2. The Configuration window (Figure 14) appears.
Command Description
Main Menu Provides access to the File, Edit, View, Tools, and Help menus.
Main Toolbar Provides shortcut buttons for commands in the Main Menu.
Displays a tree of configuration objects currently defined in the server.
Current Configuration
Select an object to display its current settings in the right-hand panel.
Objects under this node affect how the server communicates with the data
Server Configuration
source.
Alias Configuration Define aliases and alias groups under this node.
Object Settings Panel Displays the current settings of the object presently selected in the tree.
Statistics Panel Displays available statistics for the object presently selected in the tree:
The following sections describe the menus available from the Configuration window, and what
they are used for.
File Menu
Table 10 describes the File menu commands.
Command Description
Clears the current configuration and starts a new one. If OPC clients are still
New connected to the server, the user is prompted for confirmation before
continuing.
Clears the current configuration and loads a new one from an existing file.
Displays the Open Configuration window to prompt for the file name. If
Open
OPC clients are still connected to the server, the user is prompted for
confirmation before continuing.
Saves the current configuration to an XML file. Displays the Save
Save Configuration window to prompt for a new file name if the configuration is
new and has not been saved before.
Saves the current configuration to an XML file. Displays the Save
Save As
Configuration window to prompt for a new file name.
Exports all currently configured aliases to a CSV file. Displays the Export
Export Aliases
Aliases window to prompt for a file name.
Clears all aliases and imports new ones from a CSV file. Displays the Import
Import Aliases
Aliases window to prompt for an existing file name.
Closes the current configuration and shuts down the server after signaling
Shutdown Server the shutdown event to all connected clients. If OPC clients are still connected
to the server, the user is prompted for confirmation before continuing.
Hides the main Configuration window. The server shuts down after a short
Close
delay if no OPC clients are currently connected to the server.
Table 10 - File Menu Commands
Edit Menu
Table 11 describes the Edit menu commands that appear when the currently selected object
appears under the Server Configuration node.
Command Description
Undo/Cant Undo Not implemented.
Table 12 describes the Edit menu commands that appear when the currently selected object
appears under the Alias Configuration node.
Command Description
Undo/Cant Undo Not implemented.
Removes the currently selected alias group and all subordinate groups and
Delete Alias Group
aliases.
Delete Alias Removes the currently selected aliases.
Insert Alias Group Creates a new alias group under the currently selected alias group.
Displays the Insert New Alias window used to create a new alias under the
Insert New Alias
currently selected alias group.
Table 12 - Edit Menu Commands (Alias Configuration)
View Menu
Table 13 describes the View menu commands.
Command Description
Displays/hides general communication statistics for the currently selected
Statistics
object.
Reset Statistics Resets all statistics for the currently selected object to zero.
Displays the Server Defaults window used to configure the default settings
Defaults
for the various types of communication objects available in the server.
Rebuilds the tree display of the server configuration and fully expands all
Refresh
branches.
Options Displays the Options window used to change general server options.
Table 13 - View Menu Commands
Tools Menu
Table 14 describes the Tools menu commands.
Command Description
Launches the Microsoft Distributed COM Configuration Properties
DCOM Configurator
utility. This utility can be used to edit DCOM settings for specific COM
Help Menu
Table 15 describes the Help menu commands.
Command Description
MatrikonOPC on the Opens a link to the Matrikon web site.
Web
Displays the Welcome screen, which includes information about the
About
software version.
Table 15 - Help Menu Commands
Options Window
The Options window is used to edit the servers options and contains three tabs: General,
General Logging, and Interface Logging.
General Options
The General tab allows users to edit general server options (i.e., settings).
To view the General options:
1. On the Configuration window, from the View menu, select the Options menu item.
2. The Options window appears.
3. From the Options window, select the General tab (Figure 15).
Field Description
Save current Automatically saves the current configuration to the specified file before
configuration on shutting down, if selected.
shutdown
Automatically keeps up to the specified number (i.e., X) of backup copies of
Backup: X copies
the configuration file when saving the configuration.
Load configuration on Automatically loads a configuration from the specified file when starting up,
startup if selected.
Displays the full path of an existing file for load and save operations. Click on
Filename the ellipsis button ( ) to display the Open window used to select an
existing file name.
Launch configuration Automatically launches the configuration utility when starting up as a local
program on startup executable (rather than a Windows service), if selected.
Restrict items to Allows you to control which items an OPC client can add. Selecting this
preconfigured aliases checkbox indicates the restriction of items to pre-configured aliases only.
Note: The server loads these settings from the Windows registry upon start-up. Changes to the
General options settings take effect when the server is restarted.
Field Description
Enable activity logging Enables/disables general activity logging at the specified detail level
Field Description
Enables/disables interface logging at the specified detail level (High,
Medium, Low, or None), if selected. Generates a separate log file for
each client named PST###.TMP in the server installation directory.
Enable logging
Note: This option should not be selected unless users are debugging
a problem as this will have a negative effect on performance of the
OPC server.
Purges the file buffer after each message is logged in the event of an
Commit all log file writes
unexpected server shut down.
Table 18 - Interface Logging Options Tab Fields
Note: Interface Logging options settings take effect when the next OPC client connects to the
server.
Advanced Options
The Advanced tab allows users to view and edit advanced server options.
Field Description
Minimum update rate (milliseconds) allowed for an OPC group.
OPC Group Update Rate Prevents OPC clients from requesting update rates that are impossible
(minimum) to achieve or that cause heavy CPU loads. The default value is 100
ms.
OPC Server group scan thread interval (milliseconds). Determines the
maximum resolution for data change detection. Time granularity
Time granularity
should always be equal to or less than the minimum group update
rate.
DDE Configures the way the server provides data through DDE.
Table 19 - Advanced Options Tab Fields
Server Configuration
The server requires minimal configuration for it to run properly. You can also customize the
servers behavior as required. This section shows you how to create and edit objects using the
Configuration window.
Table 20 describes the types of objects that are available for insertion as a child in the Insert New
Object window, depending on which object is currently selected.
Once a Fail-over Channel object has been created, and you select it in Current configuration
pane, the settings panel is displayed and consists of two tabs:
Communication
Load Distribution
The Communication tab (Figure 21) is not available until you have already created the Fail-over
Channel. To display this tab, select the Fail-over Channel in the Current Configuration list and it
will appear in the Fail-over Channel Settings window.
Communication Tab
Figure 21 displays the Fail-over Channel Communication tab.
Component Description
Allows you to enter the name of the device link, which becomes an
element of the item ID for data items. The full path of the device link must
Name be entered.
Automatically converted to title case for display purposes.
Note: This information stays consistent across both tabs.
Use this checkbox to enable (i.e., checkbox is selected) or disable (i.e.,
checkbox is cleared) communication for the object.
Enabled
By default, the checkbox is selected.
Note: This information stays consistent across both tabs.
This field is optional and takes any user-defined text (64-character
Description maximum) for documentation purposes.
Note: This information stays consistent across both tabs.
Available Channels list Lists those communication channels not currently used in the fail-over
policy.
Select Channels list Describes the fail-over policy and the load distribution criteria for standby
channels as an XML string.
The default is <CFailoverDevlink/>)*
Primary Designates the channel as a Primary fail-over channel and transfers it to
the Selected channels list.
Secondary Designates the channel as a Secondary fail-over channel and transfers it
to the Selected channels list.
Standby Designates the channel as a Standby fail-over channel and transfers it to
the Selected channels list.
Like the Communication tab, the Load Distribution tab (Figure 22) is only available after you
have created the fail-over channel, in the Fail-over Channel Settings window.
The Fail-over Channel works on a tag by tag basis. If one tag is not available in Primary channel
it will check the next connection in the list to attempt to get data for the tag. This also means that
data can be collected from multiple different channels at the same time for different tags.
Notes:
An asterisk (*) indicates all items. [] indicates no items. A load distribution can be done by
typing a part of the tag string under the desired Network channel in between two asterisk
(*) symbols. For example, if Net 1 is desired to browse all tags that belong to register 4X
and Net 2 is desired to browse all tags that belong to register 3X, then you will have to
type *4000* (or 4:) under Net1 and *3000* (or 3:) under Net2.
Table 22 describes the components of the Create New Network Channel window.
Component Description
Allows you to enter the name of the device link, which becomes an
element of the item ID for data items. The full path of the device link must
Name be entered.
Automatically converted to title case for display purposes.
Use this checkbox to enable (i.e., checkbox is selected) or disable (i.e.,
Enabled checkbox is cleared) communication for the object.
By default, the checkbox is selected.
This field is optional and takes any user-defined text (64-character
Description maximum) for documentation purposes.
By default, this field is blank.
Protocol Allows you to select an Internet Protocol (IP) type from the drop down list.
Table 23 describes the components of the Create New Serial Channel Communication tab.
Component Description
Allows you to enter the name of the device link, which becomes an
element of the item ID for data items. The full path of the device link must
Name be entered.
Automatically converted to title case for display purposes.
Note: This information stays consistent across both tabs.
Use this checkbox to enable (i.e., checkbox is selected) or disable (i.e.,
checkbox is cleared) communication for the object.
Enabled
By default, the checkbox is selected.
Note: This information stays consistent across both tabs.
This field is optional and takes any user-defined text (64-character
Description
maximum) for documentation purposes.
Table 24 describes the components of the Create New Serial Channel Data Acquisition tab.
Component Description
Allows you to enter or select a value specifying the minimum amount of
time (in milliseconds) between the last request/response to/from one unit
Inter-device delay and the next request to another unit on this channel. If this option is set to
0 then it will be disabled.
Default = 0.
Reconnect delay Allows you to enter or select a value specifying the minimum amount of
Table 25 describes the components of the Create New Network Host window.
Component Description
Allows you to enter the name of the device link, which becomes an
element of the item ID for data items. The full path of the device link must
Name be entered.
Automatically converted to title case for display purposes.
Use this checkbox to enable (i.e., checkbox is selected) or disable (i.e.,
Enabled checkbox is cleared) communication for the object.
By default, the checkbox is selected.
This field is optional and takes any user-defined text (64-character
Description maximum) for documentation purposes.
By default, this field is blank.
Host name/IP Allows you to define the network name/IP address of the device.
Service name/Port Allows you to define the service name/port for the device.
Allows you to specify the time (in milliseconds) to wait for a response on
Socket Timeout
the socket.
Table 26 describes the components of the Create New Dial-up Connection Dial-up tab.
Component Description
Allows you to enter the name of the device link, which becomes an
element of the item ID for data items. The full path of the device link must
Name be entered.
Automatically converted to title case for display purposes.
Note: This information stays consistent across all tabs.
Use this checkbox to enable (i.e., checkbox is selected) or disable (i.e.,
checkbox is cleared) communication for the object.
Enabled
By default, the checkbox is selected.
Note: This information stays consistent across all tabs.
This field is optional and takes any user-defined text (64-character
maximum) for documentation purposes.
Description
By default, this field is blank.
Note: This information stays consistent across all tabs.
Dial command Allows you to enter any valid sequence of characters that can follow an
Modem Tab
Figure 33 displays the settings available on the Create New Dial-up Connection - Modem tab.
Table 27 describes the components of the Create New Dial-Up Connection Modem tab.
Component Description
Allows you to select, from the drop-down list, a modem reset command.
Reset command
This command is sent before initialization commands.
Allows you to enter or select a value specifying the amount of time (in
Reset delay
milliseconds) to wait after the reset command completes.
Allows you to enter modem initialization command or commands, issued
Initialize command before dialling out and after hanging up. The command should always end
with E0Q0V1.
Allows you enter or select a value to define the maximum number of times
Command retries to resend a command wait for a response before concluding that
communication has failed with the modem.
Select this button to save any changes and close the window.
OK
Note: This information stays consistent across all tabs.
Closes the window without saving any changes made.
Cancel
Note: This information stays consistent across all tabs.
Table 27 - Create New Dial-Up Connection Window - Modem Tab Components
Table 28 describes the components of the Create New Dial-up Connection - Advanced tab.
Component Description
Allows you to enter or select a value defining the maximum amount of
Command timeout time (in seconds) to wait for the modem to respond to AT commands with
a valid result code.
Allows you to enter or select a value defining the maximum amount of
Dial timeout time (in seconds) to wait for the modem to receive a carrier from the
dialed connection before aborting the call.
Allows you to enter or select a value defining the maximum amount of
Hang-up timeout time (in seconds) to wait for the modem to hang up after issuing the ATH0
command.
Allows you to enter or select a value defining the maximum amount of
Idle timeout time (in seconds) to allow an idle connection to continue (i.e., no
communication) before hanging up.
Command terminator Allows you to enter or select a value defining an ASCII character to be
Table 29 describes the components of the DNP3 Unit Settings - Communication tab.
Component Description
Allows you to enter the name of the device link, which becomes an element
of the item ID for data items. The full path of the device link must be
Name entered.
Automatically converted to title case for display purposes.
Note: This information stays consistent across all tabs.
Use this checkbox to enable (i.e., checkbox is selected) or disable (i.e.,
checkbox is cleared) communication for the object.
Enabled
By default, the checkbox is selected.
Note: This information stays consistent across all tabs.
This field is optional and takes any user-defined text (64-character
maximum) for documentation purposes.
Description
By default, this field is blank.
Note: This information stays consistent across all tabs.
Master Allows you to enter or select a value defining the DNP3 master address.
Changing this option requires the server to reset communication with this
Component Description
Allows you to enter or select a value defining the minimum amount of time (in
Inter-message delay milliseconds) between the last request/response to/from this unit and the
next request to this same unit.
Allows you to enter or select a value defining the maximum amount of time
Reply timeout
(in milliseconds) to wait for the response to a request.
Allows you to enter or select a value defining the maximum number of times
Retries to resend a request and wait for a response before concluding that
communication has failed with the unit.
Allows you to enter or select a value defining the minimum amount of time (in
Reconnect delay seconds) to wait before attempting to reconnect after communication has
failed with a unit.
Allows you to enter or select a value defining the maximum number of times
Reconnect retries to resend a request and wait for a response when trying to reconnect after
communication has failed with a unit.
Max interrogate time Allows you to enter or select a value defining the maximum amount of time
(seconds) to allow a unit to be interrogated. A value of zero indicates that
Optimization Tab
The DNP3 Unit Settings - Optimization settings (Figure 38) include those for setting data link
and application confirmations, as well as maximum outputs, events, and fragment size.
Table 31 describes all the components of the DNP3 Unit Settings, Optimization settings.
Component Description
Allows you to select, from the drop-down list, how often to request
Data link confirmations confirmation for FT3 frames: never, multi-frame messages only, or
always.
Allows you to select, from the drop-down list, how often to request
Application confirmations confirmation for application fragments: messages containing event
data only, multi-fragment messages only, or always.
Component Description
Allows you to enter the name of the device link, which becomes an
element of the item ID for data items. The full path of the device link must
Name be entered.
Automatically converted to title case for display purposes.
Use this checkbox to enable (i.e., checkbox is selected) or disable (i.e.,
Enabled checkbox is cleared) communication for the object.
By default, the checkbox is selected.
This field is optional and takes any user-defined text (64-character
Description maximum) for documentation purposes.
By default, this field is blank.
Allows you to enter or select a value defining the minimum amount of time
RTS key up (in milliseconds) to wait after setting the RTS signal to allow the
transceiver to warm up.
RTS key down Allows you to enter or select a value defining the minimum amount of time
(in milliseconds) to wait before clearing the RTS signal to allow the
Changing Objects
To change an objects configuration:
1. Once an object is created, select it in the tree view (i.e., Current configuration) panel.
2. In the configuration panel (i.e., panel on the right), make the applicable changes.
3. Click on the Apply button to accept the changes, or click on the Cancel button to discard
them.
Removing Objects
Note: Users can easily remove any object that they have created, but a warning message (Figure
42) will appear when users remove an object that has data items to which one or more OPC clients
hold reference.
To remove an object:
1. In the Configuration window, under Server Configuration, select the object to be
removed.
2. From the Edit menu, select the Delete menu option (or click on the button).
Alias Configuration
MatrikonOPC servers, including this one, provide the ability to create user-defined aliases that can
be used in place of regular OPC items. This feature is particularly useful when the item path for a
given server is very complex or difficult to remember, for example: Com1.Radio1.Unit1.41.4.123.
Servers can also be configured so that client applications have access to configured aliases only,
rather than every available item.
This section of the manual describes how to create and edit aliases using the Configuration
window.
Note: It is not necessary to define aliases before accessing server data items from an OPC client.
2. From the Edit menu, choose Insert Alias Group or click on the button.
3. A new Alias Group folder appears.
4. Enter a new name for the Alias Group, and press Enter.
5. The Alias Group is renamed.
Component Description
Name Name for the alias (unique within the alias group).
Fully-qualified item ID for the OPC item to which the alias refers. Click
on the ellipsis button ( ) to display the Item Path Browser window
used to select an existing OPC item on the server.
Alternatively, leave the item path blank to use the alias as a general
Item Path in-memory variable. When doing so, either define the data type for
the alias point as something other than Default, or have the alias set
for reading and define the data type while writing values to the alias
from an OPC client.
Note: This component is disabled when the Calculation form of
scaling is used. Item paths are specified in the calculation itself.
Set the value of the OPC item to the specified type unless Default is
Data Type
selected. Also serves as the canonical data type for the alias.
When this checkbox is selected, it prevents OPC clients from writing
values to the alias.
Read only
Note: This option is not available for Calculation aliases, as they are
read-only.
Update Rate Update rate (milliseconds) to use with the Poll when inactive option.
If selected, continues updating the value for the alias at the specified
Poll when inactive update rate even if there are no OPC clients currently accessing the
alias.
Save Save changes to the alias and hide the window.
Save & Create New Save changes to the alias and begin configuring a new one.
Pressing Enter activates the Save & Create New button rather than
Default to new
the Save button, if selected.
Scaling >> Enables scaling for the alias (displays scaling options).
<< No Scaling Disables scaling for the alias (hides scaling options).
Cancel Discards changes to (abandon creation of) the alias and hides the
By selecting the Scaling >> button, the Insert New Alias window can be expanded to display
Scaling Options (Figure 44). The available forms of scaling include: Simple text Expressions,
Calculation, Linear, Square Root, and Gain/Offset.
Table 34 describes the Scaling Options for the Insert New Alias window.
Editing Aliases
Note: Aliases can be edited after they have been created using the Edit Alias window. This is
virtually the same as the Insert New Alias window (Figure 43), with the exception that it appears
after the alias has been created.
To edit an alias:
1. On the Configuration window, select the alias you want to change, and then double-click
or press Enter.
2. The Edit Alias window appears.
3. Make the changes as required.
Removing Aliases
Note: Any alias that was created can be removed.
To remove an alias:
1. On the Configuration Window, select one or more aliases that you want to remove.
2. From the Edit menu, choose the Delete Alias menu option.
3. The alias is removed.
2. From the Edit menu, select the Delete Alias Group menu option or click on the button.
3. The Alias Group is removed.
Exporting Aliases
Note: Use the Export Aliases window to export all currently configured aliases to a CSV file.
To export all currently configured aliases:
1. From the File menu, select the Export Aliases menu option or click on the button.
2. The Export Aliases window appears.
3. Enter a file name for the CSV export file.
4. Click Save.
Importing Aliases
Note: Use the Import Aliases window to clear all aliases and import new ones from a CSV file.
To import aliases from a CSV file:
1. From the File menu, select the Import Aliases menu option or click on the button.
2. The Import Aliases window appears.
3. Browse to the CSV file name.
4. Click Open.
5. The old aliases are cleared and the new ones are imported.
Expression Wizard
The Expression form of scaling uses an Expression Wizard to build formulas. The created
formula is a simple text equation that is applied to either incoming values (i.e., reads), or outgoing
values (i.e., writes).
Table 35 describes the Expression Wizard fields.
Component Description
Displays the expression as it is created. This field is free-form which
allows you to manually enter or edit information. This field reads
Input/Output Expression Input Expression when creating an input or read expression. It
reads Output Expression when creating an output or write
expression.
Database field This button is reserved for future enhancements.
Select this button to display the Select function window which allows
Function
you to select the necessary function from those available.
Select this button to display the Select variable window which allows
Variable
you to select the necessary variable from those available.
Select the applicable button to add the corresponding operator or
Operators
operators to the expression.
Clear Select this button to clear the Input/Output Expression field.
Select this button to validate the expression that appears in the
Input/Output Expression field. If the expression is invalid, an error
Validate message is displayed. If the expression is valid, a message is
displayed indicating there are no errors and also stating what the
result is.
Select this button to accept changes to (or the creation of) the
OK
expression.
Select this button to discard changes to (or abandon the creation of)
Cancel
the expression.
Table 35 - Expression Wizard Options
7. Click on the ellipsis button adjacent to the Input field (or Output field).
8. The Expression Wizard (Figure 47) is displayed.
9. Manually enter your new expression in the Input/Output Expression field and proceed to
step 14, or
Perform steps 9 through 13 using a combination of the Function, Variable, and Operators
buttons to create your expression, which will be displayed in the Input/Output
Expression field as you build it.
10. Click on the Function button to go to the Select function (Figure 48) window. After
selecting the required function, click on the Continue button to close the Select function
window and return to the Expression Wizard.
11. Click on the Variable button to go to the Select variable (Figure 49) window. After
selecting the required variable, click on the OK button to close the Select variable window
and return to the Expression Wizard.
12. If required, from the Select variable window, click on the Modify variables button to
access the User Defined Functions Editor (Figure 50) which allows you to add, change,
or delete variables.
13. The Operators buttons (Figure 51) allow you to enter an operation descriptor based on the
selected button.
14. Click on the Validate button to determine whether or not the expression is valid.
Component Description
Displays the branch hierarchy of the OPC server when browsing actions
are being performed. The +/- symbols can be used to display/hide the
Branch Hierarchy
branches below the specified branch. Left-clicking a branch displays its
leaves in the Leaf List component.
Displays the list of leaves belonging to a selected branch from the
Leaf List
Branch Hierarchy. Left-clicking a leaf enables the OK button.
Select this button to add the selected item from the Leaf List to the
OK
Input/Output component of the Insert New Alias form.
Select this button to exit the Item Path Browser without adding any
Cancel
item paths.
Select this button to refresh the browsing hierarchy in the Branch
Refresh
Hierarchy component.
Table 36 - Item Path Browser Options
Note: The Item Path Browser appears and functions the same for an input calculation as it does
for an output calculation.
6. Click on the ellipsis button adjacent to the Input field (or Output field).
7. The Item Path Browser (Figure 53) is displayed.
8. Browse the Branch Hierarchy until you find the branch containing the leaf you are
interested in.
9. Left-click your mouse on the leaf in the Leaf List and press the OK button. The item path is
inserted (surrounded by square brackets) into the Input/Output component of the Insert
New Alias form.
10. Edit the calculation in the Input/Output component until the syntax is finalized. Refer to
Table 45 and Table 46 for more information on the calculation syntax.
11. Perform steps 9 through 11 for any additional item paths you wish to add to the calculation.
12. From either the Insert New Alias or Edit Alias window, click on the Save button.
13. The Insert New Alias or Edit Alias window closes and you are returned to the
Configuration window.
1. From the File menu, select the Save As menu option or click on the button
(alternatively, users can choose Save or click ).
Clearing a Configuration
Note: Starting a new configuration will clear the existing one.
To clear a configuration:
1. From the File menu, choose the New menu option or click on the button.
2. If OPC clients are still connected to the server, a warning message appears.
3. Click OK.
4. The configuration is cleared.
1. From the File menu, select the Open menu option or click on the button.
2. The Open Configuration window appears.
3. Browse for the configuration file that you want to load.
4. Click Open.
5. If OPC clients are still connected to the server, a warning message appears.
Notes:
At this stage, the connection between the server and the client needs to be broken.
When the new configuration is completely loaded, the changes will take effect in the
OPC client.
6. Click OK.
7. The old configuration is cleared and the new configuration is loaded from the file.
Note: The shutdown command is not available for the server if it runs
as a Windows service. Services can be shut down only from the
Service Control Manager applet in the Windows Control Panel.
Component Description
Indicates that the server polls this item when communication is first established (or re-
established) with the unit, even if its scan interval is greater than the threshold rate.
+
These items are optimized separately from other items scheduled at the same scan
interval.
Scan interval (milliseconds) for the item. It overrides the update rate for the OPC group
interval where the item is added. If the same item is requested several times at different scan
intervals, then fastest one is used.
Indicates that the server polls the item at a high priority (honoring fastest scan rate). If
! the same item is requested several times, then the item is polled at high priority if any of
the requested access paths contain this flag.
Any combination of the communication options is valid provided it maintains the order initial poll,
interval, priority. Alternatively, if the access path contains just a dash (-), then this indicates that
the server does not poll the individual item (quiescent). Use this latter option when receiving
unsolicited updates or some alternative form of polling.
The MatrikonOPC Server for SCADA DNP3 supplies the data items listed in the following sections,
with the specified data type, read access (R), and write access (W), for each DNP3 unit.
Device Attributes
Device Attributes, listed in Table 38, provide configuration information about the DNP3 unit. Unlike
other object types, variations represent different values, rather than different views of the same
value. Devices may have more than one set of attributes, which are addressed through the index.
Each attribute is listed by its Item ID. By default, each attribute has a text description that may be
modified or omitted by the client.
Example: COM1.RTU1.DevAttrDeviceManuName 000.252.x
Static Objects
Static objects, listed in Table 39, represent the current state of inputs, measurements, and other
information on the outstation. Each object may have an associated status value (S) and/or a
timestamp (T) supplied by the outstation. Some items may have event history (E) and some items
may be broadcast (B).
Each object is listed by its Item ID. By default each object has a text description that may be
modified or omitted by the client.
Example: COM1.RTU1.AnalogInput 30.0.x
Note: Use the quiescent option (-) with indexed items when
communicating with a level 1 or level 2 device. Use a poll option item
to indicate the actual method of acquiring the data.
Output Objects
Output objects, listed in Table 40, provide a mechanism for controlling outputs on the outstation
using the OPC write functionality. The current value for this type of item is the status of the last
operation performed on that object. The server supports supervisory control using single-
destination and broadcast commands.
Poll Options
The items listed in Table 41 provide a means to control the polling method used by the server to
acquire data for static objects. The current value for this type of item is meaningless, but simply
referencing the item is enough to cause the server to use the specified polling technique.
Each object is listed by its Item ID. By default each object has a text description that may be
modified or omitted by the client.
Example: COM1.RTU1.BinaryInputAny 001.0
The MatrikonOPC Server for SCADA DNP3 supplies the communication configuration parameters
listed in Table 42 for all DNP3 units.
Logging
All MatrikonOPC servers produce log files that record errors and debugging information. The log
files can be extremely valuable for troubleshooting. As such, it is important to note that the default
log level is set to low. The General Logging tab of the Options dialogue in the main configuration
window contains settings to control server logging.
General Activity Logging records information about the internal workings of the OPC server. It is
useful for troubleshooting problems with configuration and device communication. Interface
Activity Logging records information about the client/server OPC communication. It is useful for
troubleshooting compliance issues.
For General logging, the higher the log level, the more information that is recorded. However,
server performance may decrease at higher log levels. The recommended operating level is
Medium. More log levels are available for both types of logging which record more detailed
information, as well as the ability to output log statements to a console window at run time.
Contact MatrikonOPC Support for further instructions on how to enable the higher log levels and
console logging.
For Interface logging, the log level can be considered very high and therefore should never be used
during normal operation of the OPC server unless specifically working on problems related to
interfacing.
MatrikonOPC Sniffer is a useful tool for logging OPC client/server communication. It enhances
the Interface Activity Logging by recording the client-side transactions. It can also be used with
other OPC servers. MatrikonOPC Sniffer is a utility used to troubleshoot OPC client/server
interoperability issues. Contact the MatrikonOPC Sales department for further information about
this product, or use the following link to access the Matrikon Sniffer Download.
In general, the server logs all errors and other information of immediate importance to the user at
the low detail level, all warnings and other information of moderate importance to the user at a
medium detail level, and additional information concerning the normal functioning of the software
at a high detail level. The server also logs further information of concern to support personnel at
the debug log level.
Note: The higher the log level, the slower the performance of the
server. It is recommended that the log level be left at the default,
unless troubleshooting needs to be performed.
Subset Level 3
The MatrikonOPC Server for SCADA DNP3 User's Manual supports the following application
commands as a master.
Function 1 Read
Function 2 Write
Functions 3 and 4 Select and Operate
Functions 5 and 6 Direct Operate (with and without acknowledgement)
Functions 7 and 8 Immediate Freeze (with and without acknowledgement)
Functions 9 and 10 Freeze and Clear (with and without acknowledgement)
Functions 13/14 Cold/Warm Restart
Function 20/21 Enable/Disable Unsolicited Messages
Function 23/24 Delay Measurement/Record Current Time (for time synchronization)
The server supports broadcast to (hexadecimal) station addresses FFFF, FFFE, and FFFD for
functions 6, 8, and 10 (no request for confirmation).
The server implements the data objects, variations (VA), function codes (FC), and range qualifiers
(Q) listed in Table 43 to comply with the level 1, level 2, and level 3 DNP subset requirements and
support common vendor extensions.
Table 43 - Implemented Data Objects, Variations, Function Codes, and Range Qualifiers
2
The specified function/object/variation/qualifier combination requires a DNP level 2 device.
3
The specified function/object/variation/qualifier combination requires a DNP level 3 device.
+
The specified function/object/variation/qualifier combination requires an extended DNP device.
Additionally, the server parses range qualifiers 18, 19, 27, 29, 37, 38, 40, 41, 42, 50, 51, 52, 60,
61, and 62 (hexadecimal) if they occur in a slave response.
Note: Not all DNP units support the same data objects, variations, function codes, or range
qualifiers.
The server records the internal indication bits received with each response from an outstation in
the item cache for the 80.1.x objects. The server clears 80.1.7 (restart) with a write command
(function 2) as soon as it receives this notification. The server continues to poll class 1/2/3 data
(function 1) while 80.1.1/2/3 are set in order to completely empty the buffers.
1. The MatrikonOPC Server for SCADA DNP3 User's Manual does not support the DNP data link
function 1 (Reset User Process). This function is deprecated.
2. The server does not support explicit polling for specific (non-zero) variations of data objects
that support variation zero at this time.
3. The server does not support DNP device application commands at this time. The specific
functions and data objects not supported are as follows.
Function 16 Initialize Application
Function 17 Start Application
Function 18 Stop Application
Function 19 Save Configuration
Object 90 Variation 1 Application Identifier
4. The server does not support DNP file commands at this time. The specific functions, range
qualifiers, and data objects not supported are as follows.
Functions 25 and 26 Open and Close
Function 27 Delete
Function 28 Get File Information
Function 29 Authenticate
Function 30 Abort
Qualifiers 1B, 2B, 3B, 4B, 5B, and 6B (hexadecimal) Free-format
Object 70 Variation 1 File Identifier (deprecated)
Object 70 Variation 2 Authentication
Object 70 Variation 3 File Command
Object 70 Variation 4 File Command Status
Object 70 Variation 5 File Transport
Object 70 Variation 6 File Transport Status
5. The server does not support the following DNP application functions at this time.
Functions 11 and 12 Freeze with Time (with and without acknowledgement)
Function 15 Initialize Data (reset object to initial or default settings)
6. The server does not support the DNP application function 22 (Assign Classes) at this time.
Although this functionality is technically required for DNP Level 3 compliance, it is not
generally used.
7. The server does not support the following DNP data objects at this time.
Object 50 Variation 2 Time and Date with Interval
Object 82 Variation 1 Device Profile
Object 83 Variation 1 Private Registration Object
Refer to the MatrikonOPC Server for SCADA DNP3 Release Notes for known issues.
Problem: The server stops updating the client with item values after two hours.
Solution: The server may be licensed with a hardware key and the hardware key may not be
properly detected.
Alternatively, try running the MatrikonOPC Licensing utility from the shortcut menu.
Click on the Check Licenses button to see the status of all MatrikonOPC product licenses.
Then, run the HINSTALL program that is located in the Program Files\Common
Files\MatrikonOPC\Common directory.
Problem: The server stops updating the client with item values after 30 days.
Solution: The evaluation period for the license has expired. Contact the MatrikonOPC Support team.
Problem: The server automatically shuts down after five minutes when there are no clients
connected.
Solution: This is standard behavior for COM servers. However, this behavior can be overridden as
shown in the following example:
Problem: The OPC client does not provide a means to configure access paths, making it difficult to
correctly specify the data acquisition options for the items.
Solution: The server provides a global parameter for configuring an escape character, to allow
users to append communication options to the end of an item ID which would
accommodate clients that do not support access paths.
Perform the following steps as shown (with example) below:
More than one HASP attached to parallel port, but only first one is recognized
Problem: There is more than one HASP hardware key from Matrikon attached to the parallel port,
but the software recognizes only the first one.
HASP keys from the same vendor cannot be chained together. Send an email to the
Solution:
MatrikonOPC Support team to obtain a HASP key containing the combined codes of all
installed MatrikonOPC Servers.
Problem: The server cannot be configured because there is no MatrikonOPC logo in the Tool
Tray.
Solution: If the Server is running as a service, the MatrikonOPC logo does not appear in the
Tool Tray.
To configure the server, start the configuration utility by using the shortcut to the OPC
OPC client unable to create or read items under configured object (device)
Problem: The OPC client is unable to create or read items under a configured object or device.
Check the object configuration. Ensure that the Enabled checkbox is selected, and verify
Solution:
the access credentials are correct (e.g., Username, Password).
Problem: The server does not retain its previous settings and needs to be reconfigured each time it
starts up.
In the Configuration window, choose Options from the View menu. Under the General
Solution:
tab, ensure that the Load configuration on start-up checkbox is selected and that the
correct file name appears in the edit box (see General Options).
Problem: The OPC server cannot save the configuration in XML format.
Solution: Microsoft Internet Explorer 4.01 (or later) must be installed to use the XML format.
Server does not show up in the list of locally available program IDs in OPC client
application
Problem: The server does not show up in a list of locally available program IDs in the OPC client
application.
Make sure that a user with local administrative rights installs the OPC server so that it can
Solution:
create the necessary entries in the registry.
Ensure OPCEnum is registered as a service, DCOM permissions are configured properly,
and the OPCEnum service is running.
Also, especially for older OPC clients that do not use the OPC server browser, make sure
the client is running as a user that has read access to the registry.
Problem: The server does not show up in a list of available program IDs in the OPC client application
on a remote machine.
Follow the steps found in DCOM Manual to copy the program ID from the server machine
Solution:
to the OPC client machine.
Problem: Access Denied error message appears, or time out occurs when trying to connect to a
remote OPC server via DCOM.
Ensure that the access and launch permissions for the OPC server are set correctly on the
Solution:
server machine. For more information, refer to the DCOM Manual.
Problem: A client tries to connect to the server and fails, or the server does not start up.
Ensure that the access and launch permissions for the OPC server are set correctly. For
Solution:
more information, refer to the DCOM Manual.
Problem: The About screen and Configuration window do not show up when a remotely-connected
client, or a client that runs as an NT service (such as Aspen Technologies CIMIO OPC
Manager) tries to launch the OPC server.
Either set the identity for the OPC server to the interactive user, or else consider running
Solution:
the server as an NT service. For more information, refer to the DCOM Manual.
Problem: After installing an older OPC server, DA 2.0 asynchronous I/O no longer works.
The old installation program installed and registered its own (older) version of the OPC
Solution:
proxy/stub DLL.
Reinstall the standard OPC proxy/stub DLLs, using an up-to-date installation program or
re-register them using the REGSVR32 command-line utility (refer to the OPC
Compliance - Installation section in this manual).
Problem: I dont have any familiarity with RS-485/RS-422. Is it similar to RS-232? How can my
computer talk to an RS-485/RS-422 device? Can I connect it to my computers serial
ports?
Solution: Computers come standard with RS-232 serial ports. RS-485 serial ports must either be
specially purchased, or an RS-232/RS-485 converter must be purchased.
RS-485 and RS-422 allow you to serially chain all of the devices to a single
communications port. The devices then take turns on the communication port. This allows
reduced cost due to having to provide only a single communication port. This also results
in reduced bandwidth since the total bandwidth provided to all devices cannot exceed the
bandwidth of the communications port.
Problem: How can I access OPC data in Microsoft Excel, Microsoft Word, or another application with
support for Visual Basic, VBA, or VB Script?
Solution: Use the MatrikonOPC Automation Component to create a Visual Basic script that
connects to a server, creates groups and items, and receives data change updates.
Contact MatrikonOPC Support for examples of how to do this in Excel, Visual Basic, or in
an HTML document.
Problem: I need more options to schedule my polls at specific times or better manage the fairness
of data access among devices.
MatrikonOPC Server for SCADA DNP3 allows significantly more configuration options and is
Solution:
preferable in SCADA environments.
Problem: My device does not seem to wish to communicate. All of my reads and writes time out.
Check your configuration to make sure it matches the configuration of your Modbus
Solution:
device. In particular, make sure that the data/parity/stop settings match (serial), make
sure you are using the correct node number or numbers, and make sure you have the
correct IP address and port number (Ethernet Modbus).
If your device is a Daniel (32-bit) device supporting Modbus-like protocol, you will need to
use the 3W and 4W registers because this device will send and receive twice as much data
per register as a normal Modbus device.
Problem: Serial Device links do not work as fast as TCP Device links
Serial communications are much slower than TCP communications. As the number of items
Solution:
increase, The time it will take to update all items will increase as well
Solution: Re-register the OPC server executable using the /REGSERVER command-line switch.
Problem: Does the server need to be started manually when it is installed as a service?
Solution: No, the first OPC client that tries to connect will start the OPC server.
Search the MatrikonOPC Support Knowledge Base at www.opcsupport.com to find the answers
to other commonly-asked MatrikonOPC Server for SCADA DNP3 questions.
5. Click on the Remove button associated with the MatrikonOPC Server for SCADA DNP3
program to initiate the un-install process.
6. The MatrikonOPC Server for SCADA DNP3 InstallAware Wizard appears, and the
Welcome to MatrikonOPC Server for SCADA DNP3 Maintenance screen (Figure 57) is
displayed.
7. Ensure the Remove option button is selected to un-install MatrikonOPC Server for SCADA
DNP3 entirely.
8. Click on the Next button. The Ready to Uninstall screen (Figure 58) is displayed.
11. When the un-install has finished, the MatrikonOPC Server for SCADA DNP3 Setup
Complete screen (Figure 60) appears stating that MatrikonOPC Server for SCADA DNP3
was successfully un-installed.
12. Click on the Finish button to complete the un-install and exit the Wizard.
13. The program no longer appears listed in the Add or Remove Programs window.
Installation
The server is by default installed as a local out-of-process COM server and enters its registration
information in the Windows registry when instructed to do so with the /REGSERVER command-
line option. The server installs itself as a Windows service and enters its registration information in
the Windows registry when instructed to do so with the /SERVICE command-line option.
Version-independent program ID is Matrikon.OPC.DNP.
Version-specific program ID is Matrikon.OPC.DNP.1.
OPC sub-key and vendor information string.
Globally unique application ID (e.g., 81BD69CB-47A4-49bc-B5BD-2CD55ACC2DDE).
Globally unique class ID number (e.g., F1F07BB3-D2CB-4e68-A4BF-488CE1FD9F2).
Full path of 32-bit local server executable.
OPC Data Access Server 1.0 and 2.05a implemented component categories.
The server removes its registration information from the Windows registry when commanded to do
so with the /UNREGSERVER command-line option.
Common Interfaces
The server supports the mandatory functionality specified in OPC Common Definitions and
Interfaces. The server supports the following locales for result code translation:
US English (0x0409)
System default (0x0800)
User default (0x0400)
Neutral (0x0000).
The server allows the client to set the client name for each connection. The server supports the
shutdown event notification client-side interface.
Data Access
The server supports the mandatory functionality specified in the OPC Data Access Custom Interface
Standard.
Items
The server supports the addition, removal, and validation of items in a group. The server allows the
client to manage item configuration.
Active state
Requested data type
Dead-band (percent of analog item high-low range)
Sampling rate
Buffer values (used only when sampling rate is enabled and is sampling faster than the
group update rate).
I/O Operations
The server supports synchronous I/O operations.
Read active item values from cache.
Read item values from device.
Read items value from device based on how old the cache items value is.
Read items without adding the item to an OPC group.
Write control values to items (on device).
Notes:
The following steps are suggestions only. Ask your Windows
Network Administrator for more information about the settings
that you should use, especially between different domains.
The steps provided in this appendix apply to Windows NT
operating systems only. For information on how to configure
DCOM settings for newer Windows operating systems, please
refer to the MatrikonOPC Online Support page on DCOM
Settings.
Note: DCOM settings are stored in the registry and loaded by COM
(and OPC) servers at start-up. Therefore, server processes must be
shut down and re-started for these changes to take effect.
Default Properties
The Default Properties tab contains settings that affect all DCOM communication on the machine.
First of all, ensure that the Enable Distributed COM on this computer is selected in
so that the machine is available to others via DCOM.
Select the Enable COM Internet Services on this computer to allow DCOM access to
the machine from the Internet (check with your administrator).
In general, the other settings do not need to be changed.
The Authentication Level specifies when COM should authenticate the identity of calling clients
(each call, each packet, etc).
Normally, it should be set to Connect, indicating that COM should authenticate clients
when they first connect to a server. If it is set to None, then COM performs no
authentication and ignores any access permission settings.
Security Permissions
The most important DCOM settings for an OPC server are the security permissions. There are two
ways for you to set these:
1. Change the specific settings for the server (recommended).
2. Change the default settings (not recommended) and make sure that the OPC server will use
these.
Either way, be certain that the access and launch permissions are correct for the server.
4. Click on the Security tab to set the security for the server.
5. The Distributed COM Configuration Security tab (Figure 62) appears.
Notes:
The Access Permissions contain an Access Control List of principals that are
allowed to interact with objects supplied by a server.
The Launch Permissions contain an Access Control List of principals that are
allowed to start up a server process or service.
6. Include the names of users or user groups from trusted domains that you wish to be able to
use the OPC server on this machine. Include the Everyone group to allow access to all
users on a particular domain.
7. To set the Access permissions, click Use custom access permissions and then click Edit.
8. The Registry Value Permissions window (Figure 63) appears.
11. To add a user to the list, select the user, and then click Add. If the user you wish to add
does not appear then click Show Users.
Server Identity
The Identity tab for a selected COM (or OPC) server specifies the user account that should be
used when COM starts up the process. The available settings are different for servers that run as
local executables as opposed to those that run as NT services.
Default Protocols
The Default Protocols tab specifies the communication protocols available to DCOM. The order
that protocols appear in the list indicates the priority in which they will be used (the topmost
having the highest priority).
The more protocols that appear in the list, the better the chances of connecting to an OPC server
on an unknown remote machine (such as at an OPC Interoperability Workshop). However, it may
also take longer for DCOM to time out if a server machine is not present since it has to try each
protocol in turn.
For most situations, it is best to remove all unused protocols from the list and only include those
that are necessary for your network. For example, on a TCP/IP network, one would include the
Connection-oriented TCP/IP protocol. Contact your IT personnel for more information about
your network.
Remote Program ID
Before the OPC Server Browser became available, OPC client applications had to search the
registry to generate a list of available OPC servers. Therefore, some older OPC clients need to have
a program ID in the local registry in order to connect to a particular OPC server.
The simplest solution is to install the OPC server software on the client machine even if it is not
used. Alternatively, use the following steps to copy a program ID to the client machine.
Note: This method may not work for every OPC client. Please check the client documentation for
more information.
Scaling Calculations
Calculations may contain references to any OPC item in the servers syntax. However, they may
not contain references to other alias items. There are no limits on how many items can be used in
a calculation. The only limiting factor may be performance related. To reference another OPC item
in the calculation, wrap the items full item path in square brackets. For example to add the items
Com1.Rtu.Reg1 and Com1.Rtu.Reg2 together, the correct expression would be:
[Com1.Rtu.Reg1] + [Com1.Rtu.Reg2]
If the OPC item being referenced in a calculation is not found within the servers address space, the
server attempts to add it. If successful, the OPC server uses the update rate of the alias to update
the OPC item.
If the OPC item being referenced in a calculation is found within the servers address space, the
server creates a subscription to it using the lowest update rate of the item and the alias. For
example, if the update rate of Com1.Rtu.Reg1 is ten seconds and a subscription is created to an
alias with an update rate of one second, the new update rate of the OPC item is one second.
When the subscription to the alias is cancelled, the item returns to using the previous update rate.
However, if the option Poll Always is enabled for the alias, the server will always have a
subscription to that alias and therefore the lower update rate of the alias is used.
In the event that the server cannot create a subscription to the OPC item, the alias quality reports
Bad, bad configuration.
Alias scaling calculations may use any of the operators listed in Table 45.
Alias scaling calculations may use any of the functions listed in Table 46.
solve(expression,
Finds the variable's value that
solve yields the desired result using the variable, result, [v0=0],
Newton's numerical approximation method. [tol=0.01],[maxIter=100])
sqrt Square root. sqrt(x)
sum Returns the sum of a set of values. sum(v1,v2,v3,...)
tan Tangent. tan(x)
tanh Hyperbolic tangent. tanh(x)
trapezoid(expression,
Compute a numerical
trapezoid approximation to the integral variable, a, b,
between a and b. [step=0.1])
Table 46 - Calculation Functions for Alias Scaling
Field Description
Alias Group Name of the alias group folder where the alias belongs. Periods in the name indicate
subfolders below the root (e.g., North.FIC101 = alias group North under the Alias
When the scaling field specifies linear (1) or square root (2) scaling, the line contains the additional
fields listed in Table 48.
Field Description
High Raw Raw value range (double-precision real).
Low Raw
High Scaled Scaled value range (double-precision real).
Low Scaled
Clamp options.
0 = none
Clamp 1 = clamp low value
2 = clamp high value
3 = clamp both high and low values
Table 48 - Additional File Import/Export Field Descriptions - Linear/Square Root Scaling
When the scaling field specifies gain/offset (3) scaling, the line contains the additional fields listed
in Table 49.
Field Description
Gain Scaling factor (double-precision real).
Offset Scaling offset (double-precision real).
Table 49 - Additional File Import/Export Field Descriptions - Offset Scaling
Field Description
Input Expression Simple formula applied to the value read from the OPC item.
Simple formula applied to values written to the OPC item. The
Output Expression
output formula should be the reciprocal of the input formula.
Table 50 - Additional File Import/Export Field Descriptions - Expression Scaling
When the scaling field specifies calculation (5) scaling, the line contains the additional fields listed
in Table 51.
Field Description
Input Calculation Calculation applied to the value read from the OPC item.
Table 51 - Additional File Import/Export Field Descriptions - Calculation Scaling
Scaling Algorithms
For each type of scaling, a different algorithm (Table 52) is applied to values read from the OPC
item. A reverse algorithm is applied to any values written to the OPC item.
Gain/ x Offset
Gain x Offset
Offset Gain
Expression SQRT(INPUT) + 5 (OUTPUT 5) * (OUTPUT 5)
Calculation round([Random.Real4]) N/A
Table 52 - Scaling Algorithms
DDE Read
To perform a DDE Read using Excel, simply enter a DDE Item as a formula in some spreadsheet
cell:
=SERVICE|TOPIC! NAME
Excel will initiate a DDE Advise loop, or hot link, to the topic and item within the service. The DDE
Management system (in this case, Windows) will forward any update sent by the DDE service, to
the appropriate DDE client (in this case, Microsoft Excel). The DDE service is responsible for update
rate/behavior.
To disable a specific hotlink in Excel, use the Links menu option under the Edit menu.
DDE Write
To perform any DDE command other than requests (read) or advise (hot link), a Visual Basic (VB)
function must be used. Most DDE commands are available by using the application object. For
example, the following function will poke (write) the contents of column 1, row 1 to an item in the
OPC Simulation server:
Sub WriteToDDE()
End Sub
NetDDE must first be configured using the DDEShare application (DDEShare.exe) as shown in
Figure 65. Each SERVICE and TOPIC pair, or NetDDE Share, that is to be available through
NetDDE must be assigned a unique name.
Appendix Structure
This appendix is structured as follows:
Introduction this introductory section.
OPC Security Implementation description of user access dependencies.
MatrikonOPC Tag Security Configuration Utility describes the utility that is used to
configure security for MatrikonOPC servers.
Security Details describes how permissions are applied, how security settings are
stored, and other important details.
Identity
Using the IOPCSecurityNT interface for OPC Security, the identity of the OPC client is the domain
user that is running the OPC client and connecting to the OPC server. The OPC Framework will
attempt to impersonate the client that is connected to the server, and use the name from those
credentials for access control. This method does not require any implementation of OPC Security by
the OPC client, since no interface calls are necessary.
Using the IOPCSecurityPrivate interface for OPC Security, the OPC client must make a call to the
OPC server to log on with a user name and password. In this scenario, the OPC client must
implement and follow the OPC Security specification in terms of following the calls necessary to
provide credentials. The credentials provided through the private interface override those provided
from the NT interface. The OPC client may choose to log off, at which point the NT credentials are
used until the log on call is made again.
Location
Some of the interface calls made from an OPC client to an OPC server require the client to provide
an OPC item ID. The OPC Framework will take the OPC item ID provided, and determine whether
access to that location is allowed or not. A particular server installation may want to control access
to a particular device or branch in the hierarchy, and is able to do so by setting permissions for a
partial item ID or path.
Type
There are four types of interface functionality in the OPC Framework (specifically the OPC Outer
Layer) that are controlled using OPC Security:
1. Browsing
2. Adding items
3. Reading
4. Writing
Browsing is the least intrusive, followed by adding items, reading values from the items, and finally
writing to the items being the most intrusive. There are multiple interfaces, and functions within
those interfaces, that can be used to perform the types of functionality listed above. Thus, security
control has been added to each possible entry. For example, read control has been added to group
subscriptions call-backs as well as synchronous reads and asynchronous reads denying read
control would disable reads for the possible types.
A location that is being accessed by an OPC client may have different permissions for the different
types of access. For example, one particular item may be browseable, added, and read, but the
writing permissions might be restricted so that the user cannot interfere with the operation of the
end device.
Note: Of the four functionality types listed above, three of them make use of the full OPC item ID
when an interface call is made from the client to the server: Adding Items, Reading, or Writing.
When browsing, only a partial path leading to an OPC item may be known at any location in the
browsing hierarchy.
2. Enter the password created during the installation of the OPC server.
Note: The default password provided for you during installation (if you chose to use the
default) is MatrikonOPC.
3. Click on the OK button.
4. The MatrikonOPC Tag Security Configuration Utility screen (Figure 68) appears.
The MatrikonOPC Tag Security Configuration Utility screen displays the name of the OPC
server that is being configured for tag security. In Figure 68 above, the Utility screen shows that
the MatrikonOPC Server for Simulation and Testing tag security is being configured.
The left-hand side of the Utility screen shows a column of action icons that can be clicked upon.
These actions are further described later in this appendix. Some actions may not be applicable,
depending on the context in which they are used, and are identified by grayed-out icons.
In the center of the Utility screen there are descriptions for each of the actions that can be
performed. The appearance of these descriptions can be toggled at any time by clicking on the
Hide Help/Show Help link that exists in the bottom-right corner of the Utility screen. When the
Help screen is hidden, a list of users and groups that have been added appears (Figure 69). By
default, there is always a user named Everyone in the Users & Groups list. This user defines the
permissions used for other NT users that are not configured.
Note: After any action is performed, the changes made do not take effect until either the OK or
Apply button has been selected. Clicking on the OK button saves the changes and closes the
Utility screen. Clicking on the Apply button saves the changes and keeps the Utility screen open.
Clicking on the Cancel button or the X button on the top-right of the screen, discards any changes
made.
Add User
There are two types of users for which security can be configured: NT Users and Private Users.
Adding a user to the configuration will allow permissions to be defined for that user. For NT users,
the IOPCSecurityNT interface is used, and for Private users, the IOPCSecurityPrivate interface is
used.
NT User
To add an NT user:
1. From the MatrikonOPC Tag Security Configuration Utility main screen, click on the Add
User button.
3. By default, the local machine name appears in the From this Location field. To browse to
a different location, click the Locations button.
4. The User field can be entered manually. Clicking on the Check Name button performs
validation on the entered user. The user names are the same as the Windows NT domain
names used on the network. To avoid manually entering a user, click on the Search button,
and select a user from the displayed list of users.
5. To add the selected user, click on the OK button. The user is then added to the list of users
and/or groups currently defined (refer to Figure 71 for a sample list of defined users and
groups).
6. The Edit <Username> window (Figure 76) appears. Follow the instructions in the Edit
User section for adding permissions.
Private User
Private users have names and passwords associated with them, custom to the OPC client
application, which must implement the OPC Security Private interface for this section to be
meaningful. Private users exist only in the OPC server. They are not created in any NT domains.
To add a Private user:
1. From the MatrikonOPC Tag Security Configuration Utility main screen, click on the Add
User button.
2. The Add User window (Figure 70) appears.
3. Select the Private User option button (Figure 72).
Add Group
Groups are used to group users together so that they can share common permissions. Groups are
not necessary to use OPC Security. However, they are convenient when you need to apply common
permissions to multiple users. A group must contain at least one user, and any combination of
users can be grouped together.
Note: A user can exist in multiple groups, but if two or more of the groups have the same
configured path (refer to the Edit User section), and each group defines a permission (Allow/Deny)
for the type of access, then the group whose name alphabetically comes first is used.
There are two types of groups for which security can be configured: NT Groups and Private
Groups.
NT Group
To add an NT group:
1. From the MatrikonOPC Tag Security Configuration Utility main screen, click on the Add
Group button.
3. By default, the local machine name appears in the From this Location field. To browse to
a different location, click the Locations button.
4. The Group field can be entered manually. Clicking on the Check Group button performs
validation on the entered group. The group names are the same as the Windows NT domain
group names used on the network. To avoid manually entering a group, click on the Search
button, and select a group from the displayed list of groups.
5. To add the selected group, click on the OK button. The group is then added to the list of
users and/or groups currently defined (refer to Figure 71 for a sample list of defined users
and groups).
6. The Edit <Groupname> window (Figure 83) appears (for NT Groups, there is only the
Permissions tab). Follow the instructions in the Edit Group section for adding
permissions.
Private Group
To add a Private Group:
1. From the MatrikonOPC Tag Security Configuration Utility main screen, click on the Add
Group button.
2. The Add Group window (Figure 73) appears.
3. Select the Private Group option button (Figure 74).
4. Enter a name for the group to be created. The group is private and will only exist in the OPC
server. The group cannot be created if there is already a configured user or group with that
same name.
5. Click on the OK button to create the group. It will be added to the list of users and/or
groups currently defined (refer to Figure 71 for a sample list of defined users and groups).
6. The Edit <Groupname> window (Figure 83) appears. Follow the instructions in the Edit
Group section for adding permissions.
Duplicate
Another way to create a new user or group is to duplicate an existing one.
To create a new user or group via duplication:
1. From the MatrikonOPC Tag Security Configuration Utility main screen, right-click your
mouse on the user or group you wish to duplicate.
2. From the displayed menu, select Duplicate.
3. The Enter New Name window (Figure 75) appears.
Edit
Once the desired users and/or groups are defined, they must be edited to configure their
respective permissions.
Note: Permissions can also be defined for the user Everyone, which is defined as the default user.
For every NT user not configured in the MatrikonOPC Tag Security Configuration Utility, the user
Everyone is used for determining security permissions.
Permissions for allowing/denying browsing, adding items, reading items, and writing items can be
configured. Permissions are defined for users and groups for a particular location in the servers
address space hierarchy. A location can either be a tag (i.e., OPC Item ID) or a path leading up to
an item.
Edit User
To edit a user:
1. From the MatrikonOPC Tag Security Configuration Utility main screen, either:
Double-click your mouse on the user you wish to edit, or
Right-click your mouse on the required user and select Edit User from the displayed
menu, or
Click your mouse on the required user, and then select the Edit button.
2. The Edit <Username> window (Figure 76) appears.
Notes:
In this example, the user being edited is User1 so the windows title reads Edit
User1.
There are two tabs on this window: Permissions and General. The General tab
only appears for private users.
Permissions
On the Permissions tab, the permissions associated with this user relating to browsing, adding,
reading, and writing for any specific paths or OPC items are configured. The Configured Paths
screen section lists the paths and/or OPC items for which permissions are defined. The
Permissions screen section indicates those permissions with option buttons, which can be set to
Allow, Deny, or Unspecified. Selecting Unspecified directs the OPC Framework to look for the
permission higher up in the hierarchy.
From the Permissions tab, when the Add button is selected, the Add Permission screen is
displayed. In the Server Address Space screen section, folders and items are shown as nodes are
selected and expanded.
Red folders indicate a null branch. This means that the item names below this branch do not
contain the branch name, so permissions set on the branch will not reflect on Add, Write, and
Read permissions for the items below the branch. To properly set permissions on the items below
the branch, they have to be set on the items themselves.
Figure 77 provides an example of a null branch and items below it, all of which are outlined in
black.
When browsing, using the example in the diagram above, Simulation Items is a null branch
(identified by the red folder), Saw-toothed Waves is a non-null branch, and Int1 is an item.
Setting permissions on the Simulation Items branch does not affect Read, Write, and Add
permissions for the Saw-toothed Waves branch of the Int1 item below that. This is because
when adding the Int1 item, the item ID of the Int1 item is actually Saw-toothed Waves.Int1
and not Simulation Items\Saw-toothed Waves.Int1.
Setting Read, Write, and Add permissions for the Saw-toothed Waves branch will affect the
items below as Saw-toothed Waves is part of the item ID of the Int1 item (Saw-toothed
Waves.Int1), and therefore the Saw-toothed Waves folder does not appear as a red folder like
the Simulation Items folder does.
Note: User permissions override group permissions. For example, if a defined group is denied
writing privileges to an OPC item, Random.Int4, while a defined user (a member of that group) is
allowed writing privilege to Random items (Random.<itemID>), then the user permissions would
take precedence for that OPC item (even though the permissions relating to the group are a better
match for the OPC item, Random.Int4).
To edit a users permissions:
1. Click on the Add button to begin configuring permissions for the current user.
2. The Add User Permission window (Figure 78) appears. This window allows you to browse
the OPC server address space to find either a path in the hierarchy, or a particular OPC
item.
3. Expand on the server address spaces root node and continue to browse to the desired path
in the hierarchy, or the desired OPC item.
Note: Branches (i.e., folders) that are red in colour (see Figure 79) are not part of an items
path, but rather are used for browsing organization. Configuring permissions for adding,
reading, and writing will not affect items below it. For more information, refer to
Permissions.
On the General tab (Figure 81) of the Edit <Username> window, the name and password of the
user can be changed.
To edit a users name:
1. Enter a new name in the Name field.
2. Click on the OK button.
On the Permissions tab, the permissions associated with this group relating to browsing, adding,
reading, and writing for any specific paths or OPC items are configured. Refer to the Edit User
section regarding configuration on the Permissions tab. Group and user permissions are
configured in the same way.
On the Members tab (Figure 85), the users that are part of the current group are defined. By
default, the Group Members screen section is empty. In Figure 85, User1 has been added to
Group1.
2. The Members screen section lists all the defined users from which you may choose. Select
one or more desired users to become members of the group.
3. Click on the OK button. The selected user or users appear in the Group Members screen
section on the Members tab (Figure 85).
To remove a user from the group:
1. Select that user in the Group Members screen section.
2. Click on the Remove button.
Notes:
If a user name and a group name (to which the user belongs) have permissions
defined for the same location, the user name will be used. If a user belongs to two
groups that have permissions defined for the same location, the group that is
alphabetically first will be used.
The exact location (full item ID for reading, writing, and adding, or the full path for
browsing) is always looked for first when determining the permission for a particular
user. If the exact location is not found, or is found but does not contain a defined
permission, then the closest match in location is looked at next, and so on. The root
location (i.e., empty string) will always match, and is used if no partial location
match is made.
Delete
To delete a previously added user or group:
1. From the MatrikonOPC Tag Security Configuration Utility main screen, either:
Select the required user or group from the list and click on the Delete button
(Figure 71), or
Change Password
To change the security password for the OPC server:
1. From the MatrikonOPC Security Configuration Utility main screen, click on the Change
Password button (Figure 68).
2. The Change Password window (Figure 87) appears.
Examples
This section contains examples of tag security settings made via the MatrikonOPC Tag Security
Configuration Utility, and the impact of these settings.
Default
The default tag security configuration provided is quite simplistic as is shown in Table 54:
As no users or groups are defined, any NT user connecting to the OPC server will use the
Everyone default user for permissions. Only the root level location is defined under the
Configured Paths list, which gives full permissions to the entire OPC server. An administrator will
want to change these default settings for the OPC server to provide more security on its tags.
At this point, more users can be added which belong to a more restricted group. This group may be
denied write capability or restricted to certain areas in the server hierarchy.
Example 2
Following is an example of a tag security configuration for the MatrikonOPC Server for Simulation
and Testing, with sample use-cases. Table 56 lists all defined users and groups and their
associated permissions. Table 57 indicates which users are members of the defined groups.
Unspec. permission indicates Unspecified. Groups in this example are Private Groups.
Tip 1
Adding a user name and not defining any permissions for that user name (or any group it belongs
to), will completely restrict their access to information in the OPC server.
Security Details
ACL File
The permissions that the MatrikonOPC Tag Security Configuration Utility creates are stored in
a file named ACL.sec that is located in the same directory as the MatrikonOPC server executable:
C:\Program Files\Matrikon\OPC\< OPC Server Name >\.
ACL.sec is encrypted with 256-bit AES using the password key that was provided during
installation (or changed in the security utility).
If ACL.sec is missing from its location above, then the OPC server will deny all users access to all
browsing, adding, reading, and writing functionality.
Note: It is advised that this file is backed up and stored somewhere safe, once tag security
configuration has been completed. In the event that this file is lost or deleted by accident, simply
transfer the stored backup (if one was made) to the directory stated above. If ACL.sec becomes
deleted and no backup was made, tag security will need to be re-configured.
Determining Permission
Whenever a browsing, item addition, read, or write operation is performed by the OPC client, the
OPC Framework will call a permission routine to determine if permission is allowed or denied. Three
pieces of information are always sent to this routine call:
1. Identity
2. Location
3. Type
Identity is the user name described in the previous section either the NT domain name, a private
name, or the default user Everyone. In addition, identity includes any groups (private or NT) that
the user belongs to. Location is either the full item ID or a partial path in the server hierarchy.
Type is the access type: browsing, item addition, reading, or writing. Each piece of information is
checked in the order listed above.
The following information details the procedure used in determining permission rights:
1. Look for a permission match with the NT domain name or private name. This step occurs
only if the NT domain name or private name has been defined in the Users & Groups list.
The user DOMAIN\john.doe wants to read the item Random.Int4. The permission routine would
not be able to find an exact location match under the Configured Paths list. However, it would
loop through each partial match in the Configured Paths list looking for a defined permission. The
location Random.Int would be the closest match and the permission would be ALLOW.
The user DOMAIN\john.doe wants to read the item Random.Real4. The permission routine
would not be able to find an exact location match under the Configured Paths list. However, it
would loop through each partial match in the Configured Paths list looking for a defined permission.
The location Random would be the closest match and the permission would be DENY.
Operational Effects
When offline mode is enabled at a particular location in a servers hierarchy, there is no
communication between the server and the end-device/application to which the location refers.
To ensure that there is no communication when offline mode is enabled, the MatrikonOPC Server
Framework will disable the object associated with that branch. When an object is disabled due to
offline mode, the Enabled checkbox will be cleared (i.e., unselected) in its panel within the
configuration utility. Enabling the object will have no effect while the object has offline mode
enabled. When offline mode is disabled for that particular object, the MatrikonOPC Server
Framework will re-enable it and the Enabled checkbox will be selected (i.e., checked) once again.
Polling
Polling is described as the operation where the server requests and extracts data from the device.
As explained in the Introduction section of this appendix, polling is done in a round-robin
mechanism depending on which device links are currently being scanned.
Every Channel device link does its own polling for all of its sub-device links. If your server
configuration contains multiple Channel device links then they will do the polling independently of
each other.
Note: If a unit device link does not have any items added by an OPC client, it will disconnect until
a client requests items that belong to that unit device link. Some servers, like the MatrikonOPC
Server for SCADA DNP3, may have an option to force a unit device link to stay connected at all
times.
Figure 88 - Example
Round-Robin Example
As explained in Appendix G SCADA Servers Connection Logic, all of the MatrikonOPC SCADA
servers poll in a round-robin mechanism. The MatrikonOPC Server for SCADA DNP3 is not an
exception to that. The best way to explain that is by an example:
Example 1 (Unit Device Link Failure)
Suppose your OPC client is currently scanning the following items (or tags):
A1, A2, and A3 from device link Unit A
B1, B2, and B3 from device link Unit B
C1, C2, and C3 from device link Unit C.
During polling, scanning will go through device link Unit A followed by device link Unit B, and
finally device link Unit C. The items are then read in the following order:
A1, A2, A3, B1, B2, B3, C1, C2, C3
Figure 89 - Example 1
Suppose that the communication on Unit B failed for any reason. For this example, we will imagine
that the failure came from the unit device link itself and that all of its parent device links are fine.
In the next polling cycle, items A1, A2, and A3 are scanned and the server identifies the fact that
there is a problem accessing the items that belong to Unit B. The server then applies the number
of connection retries defined in the Retries field on the Data Acquisition tab.
After the specified number of retries is consumed, scanning will continue on to the next device link,
and then the next, in order. In the next polling cycle, if Unit B is still failing the server will check
2. The retry sequence is applied to Unit B and the server continues scanning the remaining
device links.
3. The server checks the Failed Polls Allowed counter. If the counter has not yet been
exceeded, the same retry sequence is applied to Unit B in the next poll, and the Quality
for the items stay Good.
4. After the Failed Polls Allowed counter has been exceeded, the Quality of the those items
that belong to Unit B will change to Bad and it is removed from the polling sequence.
5. The server checks the Reconnect delay interval and if it passes, the server tries to
reconnect to Unit B again.
6. Thereafter, the number of retries applied is that which has been defined in the Reconnect
retries field of Unit B.
Note: The reconnection logic applied depends on which type of device link failed to connect. For
example, if what fails is the Modbus Unit address (defined in the unit device link) then the
reconnection logic applied will depend on the options defined in the unit device link. On the other
hand, if what fails is the Socket then the reconnection logic applied will depend on the options
defined in the Network Host device link.
Note: These OPC items update at the rate the client requests. So, if the packets are sent out or
received faster than the update rate, the OPC client will miss some of the hexadecimal data.
In Figure 98 we can see that the number of read packets sent by Nc.H2.U (which is the full path of
the unit device link U) was 2811. The same unit device link received 5620 packets meaning that
for every request packet being sent by the server, there is an average of approximately 2 reply
packets received from the device.
We can also see that the total number of write requests that was sent by the server (i.e.,
TotalWritesSent) is 1 which means that only one write operation was done up until this point.
This write operation had 2 reply packets received from the device to indicate success or failure.