Configuring IOT2040 Node-RED as OPC UA Server: Flow Guide

Overview

The Siemens SIMATIC IOT2040 is an industrial IoT gateway designed for DIN-rail mounting inside control cabinets. Based on an Intel Quark X1020 (x86, single-core, 400 MHz) platform with 1 GB DDR3 RAM and 4 GB on-board eMMC flash, the IOT2040 runs a hardened Yocto-based Linux distribution (Siemens Industrial OS, formerly "Example Industrial OS Image") that supports the Node-RED low-code environment out of the box.

Because Node-RED is delivered as a system service on the IOT2040 firmware image, the device can be turned into a fully functional OPC UA Server with a few flow edits and a single npm install. The reference architecture described here uses the Siemens-maintained node-red-contrib-iiot-opcua package and exposes the following capability set to any OPC UA client on the plant network:

• OPC UA server endpoint with configurable user authentication
• Browseable address space, including the ability to add and delete folders at runtime
• Add/remove variables under those folders at runtime
• Read, subscribe, and write values from a Node-RED Dashboard UI
• Remote restart of the OPC UA server from the Dashboard

The flow described was authored in the Siemens Italy RC-IT DF FA AS IPC department and is fully compatible with Node-RED > 0.17.5. This article generalises the flow, hardens it for production use, and adds the diagnostics steps the original forum thread did not cover.

Hardware Prerequisites

The minimum hardware configuration is the IOT2040 with a bootable SD card and at least one Ethernet network attached to the plant or office LAN. Confirm the following before installing software:

Refer to the SIMATIC IOT2040 operating instructions (Siemens Support entry ID 109741654) for mechanical and electrical installation details.

Software Prerequisites

Install Node-RED, the OPC UA package, and the dashboard package:

1. Connect to the IOT2040 over SSH (default user root, no password on factory image) or via the USB-to-UART debug port.
2. Update the package index: opkg update
3. Install Node-RED and its dependencies: opkg install nodejs node-red
4. Install the OPC UA nodes globally:
   npm install -g node-red-contrib-iiot-opcua
   (alternatively npm install -g node-red-contrib-opcua for the current branch)
5. Install the dashboard nodes: npm install -g node-red-dashboard
6. Restart Node-RED: /etc/init.d/node-red restart

After restart, confirm the OPC UA nodes are loaded by browsing to http://<iot2040-ip>:1880 and confirming that the opcua section appears in the node palette on the left.

Network Topology

The IOT2040 sits at the boundary between the field/PLC network and the office network. OPC UA clients on either side can connect, but the typical deployment keeps the IOT2040 on the same subnet as the SCADA server.

Step 1 - Configure the OPC UA Server Endpoint

From the Node-RED editor, double-click any opcua server node to open its configuration panel. Create a new OPCUA Server Endpoint with the parameters below.

For the initial commissioning keep Security mode = NONE and disable the certificate check. Tighten the policy once the connection is verified, because the self-signed certificate generated on first launch has to be trusted by every client.

Step 2 - Build the Address Space

The reference flow uses the dynamic address-space pattern. Three Folder objects and several variables are created on startup. A user can later add and remove folders and variables from the Dashboard.

Drop an inject node set to fire once at start and wire it to a function node that builds the parent NodeId for the dynamic folder:

// Build a string NodeId for a dynamic folder
msg.payload = {
  nodeId:  "ns=1;s=Devices",
  browseName: "Devices",
  type: "folder"
};
return msg;

Wire the output of this function into an OPCUA-Folder node from the palette. The folder node takes the configuration endpoint from Step 1, and the NodeId from msg.payload.nodeId. Repeat the pattern to create the inner folders (PLC1, PLC2, IO2040).

Step 3 - Add Variables Under a Folder

Variables are added with the OPCUA-Variable node. Three pieces of metadata are required: the nodeId of the variable, its dataType, and the initial value. A useful production pattern is to source all of them from upstream nodes so that a single function can parameterise the entire address space.

// Add a new Double variable under PLC1
msg.payload = {
  nodeId:   "ns=1;s=PLC1.Temperature",
  browseName: "Temperature",
  type:     "variable",
  dataType: "Double",
  value:    21.5
};
return msg;

Supported dataType values include Boolean, SByte, Byte, Int16, Int32, Int64, UInt16, UInt32, UInt64, Float, Double, String, DateTime, Guid, and ByteString. Pick the smallest type that still covers the engineering range; the IOT2040 only has 1 GB RAM and millions of subscribed doubles will strain the heap.

Step 4 - Read, Subscribe, and Write Variables

Three OPC UA nodes cover the read, subscribe, and write operations. Each takes the same nodeId string and an action property:

• OPCUA-Read — one-shot read triggered by an upstream inject or dashboard button.
• OPCUA-Subscribe — registers a monitored item; the server pushes value changes at the configured sampling interval.
• OPCUA-Write — writes msg.payload.value into the target NodeId.

Set the samplingInterval on the Subscribe node to 500 ms for dashboard gauges, 100 ms for high-speed process data, or 5000 ms for energy and counter tags. Setting the interval below 100 ms on the Quark CPU will quickly saturate the OPC UA stack.

Step 5 - Build the Dashboard UI

Drop a UI Tab and a UI Group named OPCUA Browser. The Browse command is wired as follows:

1. UI Button (label: Browse) → function that sets msg.payload = { nodeId: "ns=0;i=84" } → OPCUA-Browser node → UI Table.
2. UI Form with two text inputs (Folder name, Variable name) → function that concatenates the NodeId → OPCUA-Folder and OPCUA-Variable nodes.
3. UI Slider (0–100) → OPCUA-Write for live tuning.
4. UI Button (label: Restart Server) → OPCUA-Server node with action: "restart".

Open the dashboard at http://<iot2040-ip>:1880/ui. You should see the address-space table populate within a second of pressing Browse.

Step 6 - Authentication

User authentication is mandatory before exposing the server on a plant network. Configure it on the OPCUA Server endpoint as follows:

1. Enable User Identity Token → Username / Password on the server endpoint.
2. Define the credentials in a separate file (for example /home/root/.node-red/opcua/users.json) and reference it from the server config node with an env lookup:

OPCUA_USER=opcuauser
OPCUA_PASS=<strong-password-here>

3. In the server config node set User = ${OPCUA_USER} and Password = ${OPCUA_PASS}.
4. Set the file permissions to chmod 600 /home/root/.node-red/opcua/users.json.

Troubleshooting Matrix

Verification Procedure

1. Open the Node-RED editor and check the OPCUA Server node. Its status indicator should show a green dot labelled active.
2. Open a terminal on any client machine with opcua-client or Prosys OPC UA Browser installed, and connect to opc.tcp://<iot2040-ip>:4840.
3. Browse to Root → Objects → Devices → PLC1. Confirm that Temperature, Pressure, and Status are present and writable.
4. Subscribe to Temperature at 1000 ms. Move the Dashboard slider connected to Setpoint and confirm the subscribed value updates within one cycle.
5. Press the Restart Server button. Within 5 seconds the status indicator should briefly go red, then green again with the same address space.
6. Tail the server log: node-red-log -f | grep -i opcua. There should be no ERROR lines and no Unhandled rejection entries.

Performance and Limits

For workloads above these numbers, plan a migration to the SIMATIC IOT2050 (ARM Cortex-A53 quad-core, 1 GB / 2 GB RAM options) which runs the same Node-RED image and the same flow file. No code changes are required.

Migration to node-red-contrib-opcua (current branch)

If the IOT2040 firmware has been updated to Node-RED 3.x and Node.js 14/16, the legacy node-red-contrib-iiot-opcua package is no longer installable. The successor package is functionally identical but uses a different configuration namespace:

The flow JSON can be migrated with a global find-and-replace on the node type strings; the underlying node-opcua client library is the same in both packages.

Security Hardening Checklist

• Replace the self-signed certificate with a CA-signed certificate from the plant PKI.
• Set Security mode to SIGNANDENCRYPT and Security policy to Basic256Sha256.
• Set the IOT2040 to listen on a single internal interface (e.g. opc.tcp://192.168.10.50:4840) instead of 0.0.0.0.
• Disable the Node-RED editor (httpAdminRoot) on the same port and only enable the dashboard (httpNodeRoot) for read-only users.
• Add adminAuth with bcrypt-hashed credentials to settings.js to require login before the editor or dashboard is reachable.
• Enable the Siemens IOT2040 firewall (iptables) and only allow TCP 4840 from the SCADA subnet.

Refer to the OPC UA Security specification for the complete list of recommended settings.

FAQ