Connect OPC UA to KEPServerEX / Kepware

Before you start

• A licence covering each driver you need and the client and connection counts you intend to run. Driver licensing is the part that surprises projects; confirm it with PTC before committing a design.
• A Windows host with the resources to scan every tag you import, plus a decision about whether it is a virtual machine, and whether that machine is in scope for OT patching.
• Network paths from the host to each controller on the industrial protocol, and from your clients to its OPC UA endpoint.
• Reviewed tag lists exported from the controller projects, so the imported tag set is deliberate rather than whatever browsing returned.

Setting it up

1. Build the channel, device, tag hierarchy deliberatelyA channel carries a driver and its communication settings, a device is one controller on that channel, and tags hang under devices. This three-level structure becomes your OPC UA browse path and your NodeId identifiers, so name it for the plant, not for the commissioning order.
2. Import tags rather than typing them, then pruneUse the driver's automatic tag generation or import from a controller export, then delete what you do not need. Every retained tag is scan load and a candidate monitored item, and an over-imported server is the usual reason a gateway host runs hot.
3. Set scan rates per device and per tag groupThe device scan rate is the true resolution of everything downstream. Give counters and state words a fast group and analogs a slow one. No OPC UA sampling interval can be finer than the scan that feeds it.
4. Configure the OPC UA endpoint in the configuration managerThe OPC UA endpoint, its security policies and its client trust list are configured in the separate configuration manager rather than in the main project tree. Note that endpoint and certificate changes generally require the runtime service to be reinitialised or restarted before they take effect.
5. Trust the client certificate explicitlyConnect once from your client, let it fail, then approve the client certificate in the configuration manager's client trust list, and trust the server's certificate on the client side. This two-sided step is where most first-day integrations stall.
6. Verify what happens when the controller goes awayPull the controller connection and watch the OPC UA side. You want the affected items to report a Bad status rather than to hold a stale value presented as good, because every downtime calculation downstream depends on being able to tell those apart.
7. Record the namespace URI and identifier formatRead the NamespaceArray and note the URI for the tag namespace. Identifiers follow the channel, device and tag path, so store namespace URI plus identifier string in configuration and resolve the index at connect.

What the address space looks like

The address space mirrors the project tree: a namespace containing nodes whose string identifiers are the dotted channel, device and tag path, so a tag arrives as something like ns=2;s=Channel1.Device1.MachineState. It is a tag list with folders, not an information model. There is no machine identity, no standard state machine, no standard counter and no companion-specification content, and there cannot be, because the driver only sees what the industrial protocol exposes. The naming discipline you apply to channels, devices and tags is therefore the only semantics your consumers get, which is why it is worth treating the project tree as a published interface with a change process rather than as internal configuration.

The traps

• Driver and connection licensing is the schedule risk. A project that discovers mid-commissioning that a second controller family needs another driver licence loses days to procurement, not to engineering. Establish the licence scope with PTC up front.
• Timestamps originate at the gateway's scan, not in the controller. SourceTimestamp is effectively poll time, so event timing is quantised to the scan rate. If you need precise transition times, timestamp in the PLC and publish that as a value.
• Renaming a channel, device or tag changes the NodeId identifier and breaks every client that stored it, with BadNodeIdUnknown on nodes that appear to still be there. Renaming during a tidy-up is a genuine outage cause.
• Certificate trust is the biggest practical deployment hurdle, and it sits in a separate configuration manager that engineers new to the product do not know exists.
• Endpoint and security changes often need a runtime restart, which drops every connected client at once. Schedule them.
• A tag configured with an inappropriate data type will read but write badly, returning BadTypeMismatch or silently truncating. Check the tag's configured type against the controller's actual type rather than trusting automatic generation.
• The gateway is now a production dependency that needs backup, version control of its project file, patching and monitoring like any other server.

Getting OEE data out of it

A gateway gives you counts, a state signal and reason codes, and stops there. Availability derived from a scanned running bit will miss stops shorter than the scan interval and will place the rest imprecisely, so the accurate pattern is to maintain state, counters and a reason code in the controller and let the gateway carry them as values. Rollover and reset handling belongs downstream and must be explicit. Nothing in a gateway address space is standardised, so the map from tag names to OEE meaning is per controller program, must be documented as project data, and has to be redone for the next machine. Planned production time, shift calendars, order context and standard cycle times are not available here at any configuration effort.

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.