How to Provide Data Services via OPC UA Server in E2C Trinity

Document Header

Overview

This article shows you how to enable the built-in OPC UA Server in E2C Trinity and map your collected tag data to OPC UA nodes, so that external OPC UA client applications — such as SCADA (Supervisory Control and Data Acquisition) systems, MES (Manufacturing Execution Systems), or custom dashboards — can browse and read your industrial data in real time.

Stage 1 — Southbound Collection: E2C Trinity reads data from your industrial devices (PLC, sensor, meter, etc.) using protocols like Modbus TCP, OPC UA, or BACnet, and stores the values as internal tags.

Stage 2 — OPC UA Server Mapping (this guide): You enable the OPC UA Server service in E2C Trinity, configure the server endpoint settings, and map your existing tags to OPC UA nodes. Once configured, any compatible OPC UA client with the required network access, credentials, and supported security settings can connect and browse the node tree.

Stage 3 — External Client Consumption: Third-party OPC UA client applications (SCADA, MES, Historian, or custom software) connect to the E2C Trinity gateway and read the exposed tag data in real time.

Core Concepts & Glossary

If you are new to OPC UA, this section explains the key terms you will encounter throughout this guide.

Example Configuration Used in This Guide

To make it easier to follow, all steps in this guide use the same example values:

Before You Start

Before beginning the configuration, make sure you have:

• An E2C Trinity gateway with live tag data already being collected from your industrial devices. If you have not yet configured data collection, refer to the relevant protocol guide (e.g., "How to Configure Modbus TCP Data Collection in E2C Factory") on the Robustel Support Center.
• An OPC UA client tool for testing. We recommend UaExpert (free, Windows/Linux) for verification.
• The gateway's IP address — you will need this to form the OPC UA endpoint URL.
• Network access: the OPC UA client must be able to reach the gateway on the configured OPC UA port. Ensure no firewall blocks this port between the client and the gateway.

If you plan to use encryption, you will also need:

• A Server Certificate and Server Private Key pair for the OPC UA Server. These can be generated using OpenSSL or another PKI (Public Key Infrastructure) tool. See the Certificate Management section in Advanced Topics for certificate requirements and file-placement guidance.
• For the OPC UA client (UaExpert), you will need the CA certificate that signed the server certificate (to verify the server's identity), and optionally a Client Certificate (if the server requires mutual authentication). See the Certificate Management section for details.

Security Notice: The OPC UA Server makes your industrial data accessible over the network. In production environments, always upload a Server Certificate and Private Key to enable encryption, and configure User authentication to prevent unauthorized access. For quick testing, you can skip certificate upload and use Anonymous authentication — this guide demonstrates a production-oriented setup with certificates and User authentication.

Step-by-Step Configuration

Important: The screenshots use E2C Factory as an example. The workflow is also applicable to E2C Field, although some menu names or interface details may differ depending on the software version.

Workflow Overview

Step 1: Verify Live Tag Data

Purpose: The OPC UA Server only exposes data that already exists as live tags in E2C Trinity. Before configuring anything, confirm that your data collection is working.

1. In the E2C Trinity web interface, navigate to Data Collection in the left sidebar.
2. Verify that your device is listed and shows a green status icon.
3. Confirm that the Latest Value column shows real-time data and the Update Time is current.

If you do not see live data, complete the device and tag configuration first. Refer to the relevant protocol guide on the Robustel Support Center.

Step 2: Create and Enable the OPC UA Server

Purpose: Create an OPC UA Server data forwarding instance in E2C Trinity so it can accept incoming client connections.

2.1 Navigate to Data Forwarding

1. In the left sidebar, click Data Forwarding.

2.2 Create the OPC UA Server Instance

1. Click the + Create button at the top-left corner.
2. In the Add Data Forwarding dialog, click the Driver dropdown and select OPCUA Server.

3. Click Save. The OPCUA Server instance appears in the list.

2.3 Activate the OPC UA Server

1. Click the Configuration tab.
2. Toggle the OPCUA Server Configuration switch to the ON (green) position.

Then you need to configure its settings in Step 3 before it can accept client connections.

Step 3: Configure the OPC UA Server Settings

Purpose: Define how OPC UA clients connect to your E2C Trinity gateway — the port number, security settings, authentication, and certificates.

3.1 Basic Settings

Fill in the Basic Settings section:

3.2 Authentication Settings

Configure the Authentication Mode:

Note for testing: If you only want to verify that the OPC UA Server is working and do not need security, you can set Authentication Mode to Anonymous and skip the certificate upload in the next section. However, for any production or network-connected deployment, always use User authentication with certificates.

Important: The username and password shown in this guide are examples only. Use a unique username and a strong password in production.

3.3 Upload the Server Certificate and Private Key (Required for Encrypted Connections)

To enable encrypted connections, upload a Server Certificate and its matching Private Key. These files cryptographically identify your OPC UA Server to clients. If you do not upload certificates, the OPC UA Server will only accept unencrypted connections.

1. Click Select Certificate File to upload your server certificate. E2C Trinity supports .crt format.
2. Click Select Private Key File to upload the corresponding private key. E2C Trinity supports .key format.

Important: The certificate and private key must be a matching pair. The private key must correspond to the public key embedded in the server certificate. If they do not match, client connections will fail with a security error.

For certificate requirements and file-placement details, see the Certificate Management section in Advanced Topics.

3.4 Submit and Publish

Critical Step: After completing all configuration, you must apply the changes in two steps:

1. Click the Submit button at the bottom of the configuration form to save the settings.
2. Click the Publish button at the top-right corner of the page to deploy the configuration to the runtime. The OPC UA Server will start listening on the configured port only after you click Publish.

Important: Changes to the OPC UA Server configuration are not applied until you click both Submit and Publish. If you only click Submit, the settings are saved but not activated.

Step 4: Map Tags to OPC UA Nodes

Purpose: This is the core step — you select which E2C Trinity tags to expose as OPC UA nodes, so that OPC UA clients can browse and read them.

4.1 Open the OPCUA Mapping Table

1. Below the OPC UA Server configuration form, click the OPCUA Mapping Table link.

4.2 Add Tags to the Mapping Table

1. Click the Add button above the table.
2. In the Add Mapping dialog, use the Select Device dropdown to choose the device whose tags you want to expose (e.g., A_CNC_Machine).
3. The table lists all available tags from the selected device. Check the checkbox next to each tag you want to expose as an OPC UA node. You can use the Enter Tag search field to filter tags by name.
4. For each tag, configure the mapping parameters:

5. Click Save to add the selected tags to the mapping table.

4.3 Review the Mapping Table

After saving, the mapping table shows all mapped tags with their configuration:

• To remove a tag from the mapping, click the delete (trash) icon in the Operate column.
• To remove multiple tags at once, check their checkboxes and click Batch Delete.

Note: After adding or modifying mappings, click Publish at the top-right corner to apply the changes to the running OPC UA Server.

Step 5: Verify the OPC UA Server Using UaExpert

Purpose: Confirm that the OPC UA Server is working and that external clients can browse and read your mapped tag data.

5.1 Launch UaExpert

1. Download and install UaExpert on a computer that has network access to the E2C Trinity gateway.
2. Open UaExpert. The main interface shows a Project panel on the left, a Data Access View in the center, and an Attributes panel on the right.

5.2 Add the OPC UA Server

1. In the toolbar, click the + (Add Server) icon, or right-click Servers in the Project panel and select Add.
2. In the Add Server dialog, go to the Custom Discovery section and double-click < Double click to Add Server… >.
3. In the Enter URL dialog, enter the endpoint URL of your E2C Trinity OPC UA Server:

opc.tcp://192.168.0.10:4843

Replace 192.168.0.10 with your gateway's actual IP address.

4. Click OK. UaExpert discovers the server and lists the available endpoints, including their Security Policy and Message Security Mode combinations.

5.3 Select the Security Policy and Message Security Mode

1. Expand the server entry in the tree to see all available endpoints.
2. Select the endpoint that matches your server configuration. Since we uploaded a Server Certificate and Private Key in Step 3.3, the server supports encrypted endpoints. In UaExpert, each endpoint is displayed as a combined string of Security Policy and Message Security Mode (e.g., Basic256Sha256 - Sign & Encrypt). Double-click Basic256Sha256 - Sign & Encrypt (uacp-uasc-uabinary). Click OK to continue.

Note: If you are testing without certificates (no encryption), select the None - None (uacp-uasc-uabinary) endpoint instead. In UaExpert's display, this means Security Policy = None and Message Security Mode = None.

3. When UaExpert attempts to connect, it will prompt you to enter user credentials. Enter the username and password you configured in Step 3.2 (e.g., UserA / 123abc).

4. Click OK. UaExpert connects to the server and the server icon turns green.

5.4 Browse and Monitor Tag Data

1. In the Address Space panel (bottom-left), expand the node tree: Root > Objects.
2. You should see all the tags you mapped in Step 4: Map Tags to OPC UA Nodes as individual nodes under the device folder.
3. Drag each node you want to monitor into the Data Access View (center panel). UaExpert subscribes to the values and displays them in real time.

4. Verify the following:
   • The Value column shows live data that updates in real time.
   • The Statuscode column shows Good for all items.
   • The Source Timestamp column is current.

If you see real-time tag values with Good status in UaExpert, your OPC UA Server configuration is complete.

Troubleshooting

Where to Find Logs

• Debug Logs: In E2C Trinity, navigate to Debug Logs in the left sidebar. Look for log entries related to "OPC UA" or "opcua."
• System Logs: In the gateway's management page (RobustOS Pro), go to Services > Syslog.
• UaExpert Log: The Log panel at the bottom of the UaExpert window shows detailed connection and data subscription messages. This is very helpful for diagnosing connection issues.

Advanced Topics

Security Policy and Message Security Mode

In E2C Trinity, you do not select a Security Policy or Message Security Mode directly. Instead, encryption is enabled by uploading a Server Certificate and Private Key in Step 3.3. These two concepts are selected by the OPC UA client (e.g., UaExpert) when connecting — they are separate settings that are used together to define an OPC UA endpoint:

Security Policy

Security Policy defines the cryptographic algorithms used to protect the connection. The E2C Trinity OPC UA Server supports the following Security Policies:

Message Security Mode

Message Security Mode defines the level of protection applied to each OPC UA message:

How They Work Together

Security Policy and Message Security Mode are combined to form an endpoint. In UaExpert, each endpoint is displayed as a combined string like Basic256Sha256 - Sign & Encrypt. When you select this endpoint in UaExpert, you are choosing:

• Security Policy = Basic256Sha256 (the algorithms)
• Message Security Mode = SignAndEncrypt (the protection level)

Note: If you do not upload certificates in E2C Trinity, the OPC UA Server will only advertise endpoints with Security Policy = None and Message Security Mode = None.

Certificate Management

This section explains the certificate requirements for a secure OPC UA connection. The information below is based on the setup used in this guide, where UaExpert acts as the OPC UA client and E2C Trinity acts as the OPC UA Server.

Certificate Files Required

Certificate Generation Requirements

Use OpenSSL or another PKI tool to create one self-signed CA, a CA-signed Server certificate, a CA-signed UaExpert Client certificate, and a valid CRL. The certificates should use RSA 2048-bit or stronger keys and SHA-256 signatures.

The Server certificate should contain:

• The E2C Trinity OPC UA Server Application URI
• The hostname or IP address used by UaExpert to connect
• Appropriate Server Authentication and digital-signature usages

The Client certificate should contain:

• The UaExpert Application URI
• Appropriate Client Authentication and digital-signature usages

UaExpert PKI Folder Structure

To open the UaExpert PKI directory, go to Settings > Manage Certificates > Open Certificate Location. A typical structure is:

pki
├── own
│   ├── certs          ← Place client certificate (.der) here
│   └── private        ← Place client private key (.pem/.key) here
├── trusted
│   ├── certs          ← Place CA certificate (.der) here
│   └── crl            ← Place CA CRL (.crl) here
├── issuers
│   ├── certs
│   └── crl
└── rejected

Authentication Relationship

Username/password and certificates serve different purposes in OPC UA:

• Server Certificate: UaExpert verifies that it is connecting to the correct E2C Trinity server.
• Client Certificate: E2C Trinity verifies that the connecting OPC UA application is trusted.
• Username and Password: E2C Trinity verifies the identity and permissions of the OPC UA user.

A successful secure connection requires both directions of trust — UaExpert trusts the server certificate (or its issuing CA), and E2C Trinity trusts the UaExpert client certificate (or its issuing CA). The CRL is strongly recommended for a complete deployment, though in a temporary test environment, revocation checking may be disabled in UaExpert.

User Authentication

E2C Trinity's OPC UA Server supports two authentication modes:

Note: For a fully secure setup, combine User authentication with uploaded certificates to enable encryption. This ensures both authentication and data protection.

Appendix

A. Related Articles

• How to Configure OPC UA Data Collection in E2C Factory — OPC UA as a southbound protocol (collecting data from OPC UA servers)
• How to Publish E2C Trinity Tag Data to an MQTT Broker — Alternative northbound method: forward data to cloud via MQTT
• E2C Factory Software Product User Manual
• E2C Field Software Product User Manual