OPC UA Interoperability Testing with OpcCmd

This article is mainly for internal usage.

Test preparation - example: !set variable endpoint opc.tcp://opcua.demo-this.com:51210/UA/SampleServer

Session

CreateSession() over an insecure channel with UA TCP and SecurityPolicy =None

Example: uaClient read %(endpoint) i=2255 --EndpointAllowedMessagedSecurity SecurityNone

CreateSession() over a secure channel with UA TCP and SecurityPolicy=Basic128Rsa15 where the key length is minimum 2048.

Example: uaClient read %(endpoint) i=2255 --EndpointSecurityPolicyDisplayName Basic128Rsa15

ActivateSession() with user identity = username/password

Example: uaClient read opc.tcp://opcua.demo-this.com:58810/GlobalDiscoveryServer i=2255 --EndpointUser appadmin:demo

ActivateSession() with user identity = anonymous

Example: uaClient read %(endpoint) i=2255 --EndpointAnonymous True

However, the anonymous identity is the default, and as such is used in other tests unless other identity is explicitly specified.

ActivateSession - change user in an existing session.

Not supported (by API).

Use CloseSession() to end session. If possible, verify that the following service calls to the session are rejected.

Example:

uaClient --!option AmbientOutput=[Boolean]True --ConnectionMonitoring

read %(endpoint) i=2255

!option UserBreak [Boolean]False

!wait 00:00:15 False

exit

Create and use multiple sessions.

Example:

!option AmbientOutput [Boolean]True

uaClient --ConnectionMonitoring

getService uaClientConnectionControl lockConnection %(endpoint)

/uaClient --ConnectionMonitoring read %(endpoint) i=2255

exit

CreateSession() with an application instance certificate

Example: uaClient read %(endpoint) i=2255 --EndpointAllowedMessagedSecurity Secure

CreateSession() over a secure channel with HTTPS and SecurityPolicy =None.

Example: uaClient read https://opcua.demo-this.com:51212/UA/SampleServer i=2255 --EndpointAllowedMessagedSecurity SecurityNone

ActivateSession() with user identity = X509 certificate

Example: uaClient read %(endpoint) i=2255 --EndpointCertificateFileName MyCertificate.pfx

CreateSession() over a secure channel with UA TCP and SecurityPolicy=Basic256Sha256

Example: uaClient read %(endpoint) i=2255 --EndpointSecurityPolicyDisplayName Basic256Sha256

CreateSession() over a secure channel with UA TCP and SecurityPolicy=Aes128-Sha256-RsaOaep

Example: uaClient read %(endpoint) i=2255 --EndpointSecurityPolicyDisplayName Aes128-Sha256-RsaOaep

CreateSession() over a secure channel with UA TCP and SecurityPolicy=Aes256-Sha256-RsaPss

Example: uaClient read %(endpoint) i=2255 --EndpointSecurityPolicyDisplayName Aes256-Sha256-RsaPss

ActivateSession() with user identity = Issued Token - OAuth2

(tbd)

ActivateSession() with user identity = Issued Token - JSON Web Token (JWT)

(tbd)

CreateSession() over a secure channel with UA TCP and SecurityPolicy=ECC-nistP256

(tbd)

CreateSession() over a secure channel with UA TCP and SecurityPolicy=ECC-nistP384

(tbd)

CreateSession() over a secure channel with UA TCP and SecurityPolicy=ECC-brainpoolP256r1

(tbd)

CreateSession() over a secure channel with UA TCP and SecurityPolicy=ECC-brainpoolP384r1

(tbd)

CreateSession() over a secure channel with UA TCP and SecurityPolicy=ECC-curve25519

(tbd)

CreateSession() over a secure channel with UA TCP and SecurityPolicy=ECC-curve448

(tbd)

View Services

Call Browse() on a single node in the address space. Repeat with other nodes.

Example: uaClient browse %(endpoint)

Example: uaClient browse %(endpoint) --NodeStandardName Objects

Call Browse() by specifying more than one node in a single call. Walk through the address space.

Specifying more than one node in a single call: Not supported (by OpcCmd).

Example - Walk through the address space:

uaClient browse %(endpoint) --BrowseParametersStandardName AllHierarchicalReferences --tree

Call Browse() using various Reference filters; e.g. only hierarchical references.

Example: uaClient browse %(endpoint) --BrowseParametersStandardName AllHierarchicalReferences

Example: uaClient browse %(endpoint) --NodeStandardName Objects --BrowseParametersStandardName AllHierarchicalReferences

Call Browse() using various NodeClass filters (e.g. to return Variable nodes only).

Example: uaClient browse %(endpoint) --NodeStandardName Server --NodeClasses Variable

Example: uaClient browse %(endpoint) --NodeStandardName Server --BrowseParametersStandardName DataNodes

Call Browse() with a filter to reduce the result information (e.g. omit BrowseName and ReferenceType).

Not supported (by API).

[obsolete] BrowseNext (Continuation Point)

Example:

uaClient

set IsolatedParameters.SessionParameters.MaximumReferencesPerBrowseNode [Int32]1

browse %(endpoint) --NodeStandardName Server

exit

TranslateBrowsePathToNodeId to determine the NodeID of components (e.g. properties)

Example: uaClient read %(endpoint) --NodeBrowsePath [Server]/0:NamespaceArray

[obsolete] TranslateBrowsePathToNodeId for non-hierarchical References

Not supported (no test due to obsolescence).

Register()/UnregisterNodes() for one or more standard UA-defined Nodes (e.g. "Server") in a single call.

Example:

!diagnostics sources setSwitchValue Verbose OpcLabs.EasyOpc.UA.UAClientSession

uaClient

:: Lock the connection so that the node registration takes effect immediately.

getService uaClientConnectionControl lockConnection %(endpoint)

getService uaClientNodeRegistration registerNode %(endpoint) --NodeStandardName Server_ServerDiagnostics_ServerDiagnosticsSummary_CumulatedSessionCount

!variable let registrationHandle %~

!option UserBreak [Boolean]False

!wait 00:00:05

read %(endpoint) --NodeStandardName Server_ServerDiagnostics_ServerDiagnosticsSummary_CumulatedSessionCount

getService uaClientNodeRegistration unregisterNode %(registrationHandle)

exit

:: If the server had truly registered the node, it will be counted as "transcribed" in the node registration trace entry below.

!diagnostics trace entries? --source OpcLabs.EasyOpc.UA.UAClientSession

Register()/UnregisterNodes() for one or more vendor-defined Nodes in a single call.

Example:

!diagnostics sources setSwitchValue Verbose OpcLabs.EasyOpc.UA.UAClientSession

uaClient

:: Lock the connection so that the node registration takes effect immediately.

getService uaClientConnectionControl lockConnection %(endpoint)

getService uaClientNodeRegistration registerNode %(endpoint) nsu=http://samples.org/UA/memorybuffer/Instance;s=UInt32[0]

!variable let registrationHandle %~

!option UserBreak [Boolean]False

!wait 00:00:05

read %(endpoint) nsu=http://samples.org/UA/memorybuffer/Instance;s=UInt32[0]

getService uaClientNodeRegistration unregisterNode %(registrationHandle)

exit

:: If the server had truly registered the node, it will be counted as "transcribed" in the node registration trace entry below.

!diagnostics trace entries? --source OpcLabs.EasyOpc.UA.UAClientSession

Browse with Views.

Not supported (by API).

Attribute Services

Read() attributes - as supported by the Client - for a standard UA-defined node (e.g. "Server"). Repeat with other nodes.

Example:

uaClient read %(endpoint) --NodeStandardName Server_ServerStatus_State

uaClient read %(endpoint) --NodeStandardName Server_ServerDiagnostics_EnabledFlag

uaClient read %(endpoint) --NodeStandardName Server_ServerStatus

Read() all supported attributes for a given vendor node in a single call. Vary the vendor nodes.

Example:

uaClient read %(endpoint) ns=2;i=10219 multiple --attributeId *

uaClient read %(endpoint) ns=2;i=10854 multiple --attributeId *

Read() all supported attributes on a given node while specifying a MaxAge value.

Example:

uaClient read %(endpoint) ns=2;i=10219 --MaximumAge 1000 multiple --attributeId *

uaClient read %(endpoint) ns=2;i=10854 --MaximumAge 1000 multiple --attributeId *

Read() the value attribute while specifying an encoding (not "default"). Vary the encoding.

Not supported (by API).

Read() a value that is an array while varying the IndexRange to include specific indexes, the first X, the last X, the middle X. Vary the number of dimensions (e.g. "1:2,1:2" or "1:2,1:2,1:2" etc.) - if available.

Example:

uaClient read %(endpoint) i=2255 Value 0:1

uaClient read %(endpoint) "nsu=http://test.org/UA/Data/ ;ns=2;i=10303" Value 2

uaClient read %(endpoint) "nsu=http://test.org/UA/Data/ ;ns=2;i=10303" Value 1:2,1:2

uaClient read %(endpoint) "nsu=http://test.org/UA/Data/ ;ns=2;i=10939" Value 1:2

uaClient read %(endpoint) "nsu=http://test.org/UA/Data/ ;ns=2;i=10939" Value 1:2,1:2

Write() one or more Value attributes (WriteAccess permitted) for one or more nodes in a single call. Vary nodes.

Example:

uaClient write %(endpoint) nsu=http://test.org/UA/Data/;i=10221 [Int32]3141

uaClient read %(endpoint) nsu=http://test.org/UA/Data/;i=10221

uaClient write %(endpoint) nsu=http://test.org/UA/Data/;i=10474 [String[]]{first,second,third}

uaClient read %(endpoint) nsu=http://test.org/UA/Data/;i=10474

Write() a value that is an array using the IndexRange to vary the number of elements, e.g. all, first X, last X, middle X. Repeat for multi-dimension arrays, if available.

Example:

uaClient write %(endpoint) nsu=http://test.org/UA/Data/;i=10302 [Byte[]]{42,43,44} Value 2:4

uaClient read %(endpoint) nsu=http://test.org/UA/Data/;i=10302

uaClient write %(endpoint) nsu=http://test.org/UA/Data/;i=10474 [String[]]{first,second,third}

uaClient write %(endpoint) nsu=http://test.org/UA/Data/;i=10474 [String[]]{new2} Value 1

uaClient read %(endpoint) nsu=http://test.org/UA/Data/;i=10474

Read() a Value that is a structured DataType, use vendor specific structures if possible.

(tbd)

Write() a Value that is a structured DataType, use vendor specific structures if possible.

(tbd)

Method Services

Call() a method defined by the vendor (not any of the OPC UA defined methods). Vary the methods to ensure different method signatures are covered, e.g. no parameters, in-parameters only, out-parameters only, in and out parameters etc.

Example: uaClient call %(endpoint) nsu=http://test.org/UA/Data/;i=10755 nsu=http://test.org/UA/Data/;i=10756 [Boolean]False [SByte]1 [Byte]2 [Int16]3 [UInt16]4 [Int32]5 [UInt32]6 [Int64]7 [UInt64]8 [Float]9 [Double]10

Call() a Method that uses a structured DataType as Input- or Output-Arguments, use a Method with a vendor specific structure if possible.

(tbd)

Information Model

Browse() for standard folders: Objects, Types, ReferenceTypes, ObjectTypes, VariableTypes, DataTypes, and Views.

Example:

uaClient browse %(endpoint) --NodeStandardName ObjectsFolder

uaClient browse %(endpoint) --NodeStandardName TypesFolder

uaClient browse %(endpoint) --NodeStandardName ReferenceTypesFolder

uaClient browse %(endpoint) --NodeStandardName ObjectTypesFolder

uaClient browse %(endpoint) --NodeStandardName VariableTypesFolder

uaClient browse %(endpoint) --NodeStandardName DataTypesFolder

uaClient browse %(endpoint) --NodeStandardName ViewsFolder

Browse() the Types folder and verify standard types are exposed, e.g. BaseObjectType, FolderType, Reference Types, Data Types (scalar types and standard structures).

Example:

uaClient browse %(endpoint) --NodeStandardName TypesFolder --BrowseDirections Forward --ReferenceTypeId i=35 --ReferenceTypeId i=45 --tree

Browse() the Server Object for ServerCapabilities, ServerDiagnostics, ServerStatus, VendorServerInfo, and any other standardized components.

Example:

uaClient browse %(endpoint) --NodeStandardName Server

Browse() the ServerDiagnostics.SessionDiagnosticsArray and verify the Client connection and its details can be read

Example:

uaClient browse %(endpoint) --NodeStandardName Server_ServerDiagnostics

uaClient browse %(endpoint) --NodeStandardName Server_ServerDiagnostics_SessionsDiagnosticsSummary

uaClient read %(endpoint) --NodeStandardName Server_ServerDiagnostics_SessionsDiagnosticsSummary_SessionDiagnosticsArray

Subscription Services

[obsolete] Create empty Subscription

Not supported (by API).

Modify an existing subscription by varying subscription properties (e.g. publishingInterval and keepAlive etc.) and verify subscription behavior.

Not supported (by OpcCmd).

Delete an existing Subscription

Example:

!diagnostics sources setSwitchValue Verbose OpcLabs.EasyOpc.UA.UAClientSession

!option UserBreak [Boolean]False

uaClient subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10849 !wait 5000

traceEntries?

In the trace entries, look for an entry from "UAClientSession" indicating SDK subscription remove success or failure.

SetPublishingMode() to enable/disable publishing. Test with multiple subscriptions if available.

Not supported (by API).

[obsolete] Publish Service to request attribute value changes

Not supported (not clear).

Publish() returns after keep-alive interval (no data-changes; hint: subscribe to static items).

Example:

uaClient

set IsolatedParameters.SubscriptionParameters.KeepAliveCount [Int32]1

subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10393

If the keep-alive fails, there would be an additional event with the error

Issue multiple Publish() requests that are to be queued by the Server.

Not supported (by API).

[obsolete] Republish Service

Not supported (by API).

Create subscriptions with varying number of monitored items and different rate settings as supported by the client. Verify that the server provides updates according to the specified publishing rate. Optionally use Write() service to trigger data changes.

Example:

uaClient subscribe %(endpoint) --NodeStandardName Server_ServerStatus_CurrentTime --Aggregates StateStatistics

uaClient subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10849 --Aggregates StateStatistics multiple

uaClient subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10849 200 --Aggregates StateStatistics multiple

Redundancy

TransferSubscription() to change ownership of a subscription to another Client.

Not supported (by API).

Successfully switched to exposed transparent redundant server

(tbd)

Successfully switched to exposed non-transparent redundant server

(tbd)

Eventing

Subscribe to the Server Object's EventNotifier attribute. Specify some basic event fields in the select clause. Verify that events are notified.

Not supported (by OpcCmd).

Subscribe with a filter for EventType, Priority etc. Verify that events match the filter criteria.

Not supported (by OpcCmd).

[obsolete] Publish Service delivers event notifications matching the filter.

Not supported (by OpcCmd).

Browse the address space for other nodes that support event subscriptions (other than the Server object). Subscribe to any of these.

Example:

uaClient browse %(endpoint) --NodeStandardName Server --BrowseDirections Forward --ReferenceTypeId i=36 --tree

Receiving all supported Audit events

(tbd)

Data Change

Add Monitored Items (value attribute of variables)

Example:

uaClient subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10849 multiple --repeat 2

Modify the state of One or more monitored items in a single SetMonitoringMode() call, e.g. disabled, reporting, or sampling.

Not supported (by API).

[obsolete] Enable / disable publishing

Not supported (by API).

Create a trigger (SetTriggering()) to configure linked items. Verify that linked items are reported when the triggering item changes.

Not supported (by API).

Absolute Deadband filter.

Example:

uaClient subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10853 200 --DeadbandType Absolute --DeadbandValue 1E10

Modify an existing trigger (SetTriggering()) by adding/removing items to/from the trigger. Verify behavior.

Not supported (by API).

Node Management

Add one or more nodes in a single AddNodes() call. Verify address-space for changes.

Not supported (by API).

Delete one or more nodes in a single DeleteNodes() call. Verify address-space for changes.

Not supported (by API).

Add one or more references in a single AddReferences() call. Verify address-space for changes.

Not supported (by API).

Delete one or more references in a single DeleteReferences() call. Verify address-space for changes.

Not supported (by API).

Alarm and Condition

Browse() the Types folder for supported Alarm types and Condition types.

Example:

uaClient browse %(endpoint) --NodeStandardName BaseEventType --BrowseDirections Forward --ReferenceTypeId i=45 --tree

Call CreateMonitoredItems() for an Event Notifier. Specify event fields to be returned. Specify a simple filter (e.g. if (Severity > 400)). Vary the selection and the filter.

Not supported (by OpcCmd).

[obsolete] Publish service delivers Alarm and Condition events

Not supported (by OpcCmd).

Call ConditionRefresh for a subscription while at least one Condition is in an interesting state (e.g. an Alarm is active). Verify that this Condition state is reported.

Not supported (by OpcCmd).

Modify the state of a Condition by calling the Enable/Disable methods. Verify the reporting behaviour.

Not supported (by OpcCmd).

Call the Acknowledge Method for an Alarm that requires acknowledgement.

Not supported (by OpcCmd).

Call the Confirm Method for an Alarm that requires confirmation.

Not supported (by OpcCmd).

[obsolete] Dialog Condition including Respond Method

Not supported (by OpcCmd).

Historical Access

Historical Raw Data Facet -- basic historical access, ReadRaw. Where the time range is specified using a start time, stop time and number of values (a minimum of two of the three).

Not supported (by API).

Historical Raw Data Facet -- support minimum 2 continuation points

Not supported (by API).

HistoricalDataAtTime Server Facet -- Support reading historical data at a specified instance in time.

Not supported (by API).

HistoricalModifiedData Server Facet -- Supports maintaining old values for historical data that have been updated and the retrieval of these values.

Not supported (by API).

HistoricalAnnotation Server Facet -- Supports the entry and retrieval of annotations for historical data using the standard historical read raw functionality.

Not supported (by API).

HistoricalDataUpdate Server Facet -- Support Insert, Delete and Replace.

Not supported (by API).

HistoricalStructuredData Server Facet -- Support historical access for structured data. IF this is support structured data must be supported for all other historical conformance units (i.e. read raw, read at time etc).

Not supported (by API).

AggregateHistorical Server Facet -- Support historical read with aggregates

Not supported (by API).

EnhancedHistoricalData Server Facet -- Support at least 5 Continuation Points; support providing a ServerTimestamp in addition to the SourceTimestamp.

Not supported (by API).

BaseHistoricalEvent Server Facet -- Support retrieval of historical Events. This includes support for simple filtering of events.

Not supported (by API).

EnhancedHistoricalEvent Server Facet -- Support Insert, Replace, Update; support at least 5 continuation points.

Not supported (by API).

Discovery

Call FindServers() on a remote LDS and specify a ServerURI to get a specific Server application.

Not supported (by API).

Call GetEndpoints() on the Server application that is the testee. Specify the desired transport profile in the request. Verify that only endpoints are returned that include this profile.

Not supported (by API).

Call FindServers() on a remote LDS to get the list of available Server applications. Verify that the Server application that is the testee is in this list.

Example:

uaClient discover localApplications opcua.demo-this.com

Call GetEndpoints() on the Server application that is the testee.

Example:

uaClient read %(endpoint) --NodeStandardName Server_ServerCapabilities_MaxArrayLength

The ability to create a session in this way is a proof of test success here

Challenge

Connect to multiple products in parallel, each with 10 or more items (more is better).

Not supported (by OpcCmd).

Client and Servers recover from short network-interruption, i.e. 10-seconds. Session is not closed, Subscriptions continue to send notifications.

Example:

!diagnostics sources setSwitchValue Verbose OpcLabs.EasyOpc.UA.UAClientSession

uaClient subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10849 !wait 01:00:00

traceEntries?

Client and Servers recover from long network-interruption, i.e. 1-minute.

Example:

uaClient subscribe %(endpoint) nsu=http://test.org/UA/Data/;i=10849 !wait 01:00:00

Reverse Connect

Server sends the ReverseHello message to the Client and Client successfully establishes a connection to the Server.

(tbd)

After a connection break, the Server sends a new ReverseHello message to the Client to allow it to reestablish the connection.

(tbd)

Sessionless Services

Use Browse via a Sessionless Service call

(tbd)

Use BrowseNext via a Sessionless Service call

(tbd)

Use TranslateBrowsePathsToNodeIds via a Sessionless Service call

(tbd)

Use Read via a Sessionless Service call

(tbd)

Use HistoryRead via a Sessionless Service call

(tbd)

Use Write via a Sessionless Service call

(tbd)

Use HistoryUpdate via a Sessionless Service call

(tbd)

Use Call via a Sessionless Service call

(tbd)

Use AddNodes via a Sessionless Service call

(tbd)

Use AddReferences via a Sessionless Service call

(tbd)

Use DeleteNodes via a Sessionless Service call

(tbd)

Use DeleteReferences via a Sessionless Service call

(tbd)

Use QueryFirst via a Sessionless Service call

(tbd)

Use QueryNext via a Sessionless Service call

(tbd)

GDS

[obsolete] Application registers itself using the RegisterApplication method of the GDS.

(tbd)

[obsolete] Application updates its information using the UpdateApplication method of the GDS.

(tbd)

[obsolete] Application unregisters itself using the UnregisterApplication method of the GDS.

(tbd)

[obsolete] Application gets a list from the GDS with all registered applications.

(tbd)

[obsolete] Application gets a filtered list from the GDS with all registered applications matching its query.

(tbd)

[obsolete] Pull Management - Certificate Update: Application receives a new certificate via the pull management interface.

(tbd)

[obsolete] Pull Management - Revoke Certificate: Application revokes a certificate.

(tbd)

[obsolete] Pull Management - GetCertificateGroups: Application gets the list of instances of the CertificateGroupType in the server.

(tbd)

[obsolete] Pull Management - GetTrustList: Application gets its Trust Lists.

(tbd)

[obsolete] Pull Management - GetCertificateStatus: Application checks whether its certificate needs to be updated.

(tbd)

Push Management - UpdateCertificate: Application receives and uses a new certificate.

(tbd)

Push Management - CreateSigningRequest: Application generates a signing request as a result for the CreateSigningRequest.

(tbd)

Push Management - GetRejectedList: GDS receives the rejected list from the Application.

(tbd)

Push Management - ResetToServerDefaults: Application resets its configuration.

(tbd)

Push Management - SetAdminPassword: Application updates the password for the specified user.

(tbd)

Push Management - AddEndpoint: Application adds the specified Endpoint

(tbd)

Push Management - RemoveEndpoint: Application removes the specified Endpoint

(tbd)

Push Management - AddUserTokenPolicy: Application adds the specified UserToken.

(tbd)

[obsolete] Push Management - RemoveUserTokenPolicy: Application removes the specified UserToken

(tbd)