Configuring OPC UA NodeID Topics for Siemens Comfort Panels in Node-RED

When a Node-RED Inject node is wired into an node-red-contrib-opcua Read or Subscribe node, the msg.topic property must contain a syntactically correct OPC UA NodeID. A malformed or placeholder string is the most common reason the OPC UA client returns the BadNodeIdUnknown status code (0x80340000) or the read operation is silently dropped. This reference documents the exact ns=4;s=<TagName> addressing convention used by SIMATIC HMI Comfort Panels, the steps to discover NodeIDs without trial-and-error, and the verification path on the IOT2020 gateway.

1. The OPC UA NodeID Addressing Scheme

The NodeID is the unique address of any node in an OPC UA server's address space. The OPC UA Modelling Concepts specification (OPC-11030) defines six possible identifier shapes. The two encountered on Comfort Panels are the string identifier and the numeric identifier:

Three fields are mandatory for every NodeID written into a Node-RED topic:

1. Namespace index – zero-based integer prefixing the address. Index 0 is reserved for the OPC UA base namespace; index 1 is the server's own internal namespace; user-defined tag namespaces start at 2.
2. Identifier type – s= for string, i= for integer, g= for GUID, b= for opaque.
3. Identifier value – the symbolic tag name as it appears in the TIA Portal tag table.

2. Namespace Layout of a SIMATIC Comfort Panel

Comfort Panels expose their internal tag table through an embedded OPC UA server. The address space is published as soon as the OPC UA Server option is activated in the panel project. The published namespace layout follows Siemens' IA namespace assignment:

Because HMI tags land in namespace index 4 by default, the canonical NodeID for a tag named Tag1 is:

ns=4;s=Tag1

If the project owner has reassigned the application namespace URI, use the URI form to remain portable across panel variants:

nsu=http://www.siemens.com/simatic-hmi/Tag1;s=Tag1

3. Prerequisites

• SIMATIC IOT2020 or IOT2040 with the IOT2000 SD card image, Node.js 14.x or 18.x, Node-RED v3.x.
• node-red-contrib-opcua v0.2.x or later installed via the palette manager.
• SIMATIC HMI Comfort Panel (KP700 Comfort, TP900 Comfort, TP1200 Comfort, or similar) with firmware V14.0.0.4 or later. The OPC UA server feature requires a WinCC RT license with the OPC UA Server option activated.
• TIA Portal V16 or later engineering station, project file containing the panel, at least one HMI tag defined in the standard tag table.
• Ethernet connectivity between the IOT2020 and the panel on the same subnet; the panel's OPC UA Server Port (default 4840) must be reachable.
• OPC UA client for discovery – the Unified Automation UA Expert is the de-facto reference browser and is free for non-commercial use.

4. Enabling the OPC UA Server on a Comfort Panel

Open the panel project in TIA Portal and follow the activation steps before attempting any external read.

1. Select the Comfort Panel device in the project tree.
2. Open Properties → General → OPC UA Server.
3. Set Activate OPC UA Server = true.
4. Confirm the Server port (default 4840) and Discovery URL; the resulting endpoint becomes opc.tcp://<Panel-IP>:4840.
5. Under Security policies, at minimum allow None for commissioning; tighten to Basic128Rsa15 or Basic256Sha256 with SignAndEncrypt for production.
6. Compile and download the project to the panel. The OPC UA Server runtime must be running – check the panel's Diagnostics → Runtime view.
7. Verify the server is reachable: telnet <Panel-IP> 4840 from the IOT2020 shell should open a TCP connection.

5. Discovering NodeIDs without Guesswork

5.1 Using UA Expert (recommended)

UA Expert performs a complete address-space browse, removing any ambiguity about namespace index, identifier type, and casing.

1. Add a new server: Add Server → Custom Discovery, enter opc.tcp://<Panel-IP>:4840.
2. Trust the endpoint and connect.
3. Expand Root → Objects → Server; the project namespace appears as a folder named after the project URI.
4. Drill into the project folder to expose every HMI tag from the standard tag table.
5. Drag a tag into the Data Access View; the NodeId column shows the canonical form, e.g. ns=4;s=Tag1. Right-click → Copy NodeId for use in Node-RED.

5.2 Exporting an OPC UA XML file from TIA Portal

For S7-1500 PLCs, TIA Portal exposes PLC properties → OPC UA → Server interfaces → Export OPC UA XML. The exported file lists every NodeID and its data type. Comfort Panels historically do not provide this menu path. The two reliable alternatives are:

• Browse with UA Expert as described above.
• Use the TIA Portal Cross-references and Tag table export (CSV) and prepend ns=4;s= to each tag name manually. This works because the standard tag table is the source of truth for namespace 4.

5.3 Programmatic discovery with a UA client library

For higher-channel-count applications, run a one-off Browse service from any OPC UA client library (open62541, python-opcua, node-opcua) and write the resulting NodeIDs to a CSV that the Node-RED flow consumes at startup.

6. Step-by-Step: Wiring the Node-RED Flow

The complete flow consists of three nodes: an Inject that sets the topic, an OpcUa-Client configured as Read, and a Debug tab to display the response.

1. Inject node. Drag Inject from the function palette. Set Payload = timestamp (or any value – it is ignored by the Read node). Open msg properties and add topic = ns=4;s=Tag1. Multiple tags are supported by entering one NodeID per line.
2. OpcUa-Client (Read) node. Create a new Endpoint: opc.tcp://<Panel-IP>:4840, set Security Policy and Security Mode to match the panel, leave Authentication as Anonymous during commissioning. Set Action = read and check Use topic from input message so the Inject msg.topic drives the read list.
3. Debug node. Set Output = complete msg object to expose the StatusCodes, timestamps, and DataValue objects returned by the server.
4. Wire Inject → OpcUa-Read → Debug and deploy.

The Inject payload in JSON form:

{
  "payload": 1700000000000,
  "topic": "ns=4;s=Tag1"
}

For batch reads, the topic accepts a line-delimited list:

ns=4;s=Tag1
ns=4;s=Tag2
ns=4;s=TemperatureSensor

7. Verification

Confirm the flow is reading real values, not status placeholders:

1. Click the Inject button. The Debug pane must show a msg.payload object containing StatusCode: Good (0x00000000) and a numeric value matching the live tag.
2. Change the tag value in the panel runtime or in the TIA simulation; a second Inject click must reflect the new value within the configured sampling interval (default 1000 ms).
3. Cross-check with UA Expert: read the same NodeID in the Data Access View; values must agree to the bit.
4. Force a malformed read by setting topic = ns=4;s=DoesNotExist. The Debug pane must surface StatusCode: BadNodeIdUnknown (0x80340000), proving the read path is functional and the error is purely a string issue.

8. Node-RED Function-Node Patterns

When the topic is built dynamically from upstream context (e.g. a dashboard dropdown or a CSV lookup), place a function node between the Inject and the OpcUa-Read node to assemble the NodeID:

// Build NodeID from a human-readable tag name
const tagName = msg.payload.name;   // e.g. "MotorSpeed"
msg.topic = "ns=4;s=" + tagName;
return msg;

For Subscribe-mode use cases (continuous monitoring), the same topic format applies, but the action on the OpcUa-Client node is set to Subscribe and the Interval is set in milliseconds.

9. Troubleshooting Matrix

10. Security Considerations for Production

Anonymous-Plus-None is convenient for commissioning but exposes every tag to any device on the network. Hardening steps:

• Move to Security Policy = Basic256Sha256 with SignAndEncrypt. Both the panel firmware and the IOT2020 must support the cipher; Comfort Panels support it from V14.0.0.4 onwards.
• Issue an OPC UA user credential on the panel under Properties → OPC UA Server → User administration and assign only the read access level required by the gateway.
• Restrict the OPC UA port at the network layer. The IOT2020 can apply an iptables rule limiting the source IP range:

iptables -A INPUT -p tcp --dport 4840 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP

• Replace the panel's self-signed certificate with one issued by the plant PKI; both the OPC UA client and the OPC UA server certificate stores must be updated accordingly.
• For industrial edge-to-cloud scenarios, the panel can serve as the OPC UA data source for a downstream Azure IoT Operations OPC UA Connector; the same ns=4;s=<TagName> addressing is used when mapping the asset endpoint profile.

11. Extending the Flow

Once the basic Read flow is operational, the same NodeID format extends to:

• Subscribe – set the OpcUa-Client action to Subscribe, specify the Interval in milliseconds, and the Debug pane emits a new message on every change of value within the server's sampling cycle.
• Write – set the action to Write and provide a msg.payload whose value field matches the tag's data type. Used to drive setpoints from the IOT2020 back into the panel.
• Browse – set the action to Browse with no msg.topic to enumerate the full address space, then cache the results in a function node for diagnostic dashboards.
• Multi-server aggregation – configure one OpcUa-Client endpoint per panel and use a function node to merge results; the topic carries the same ns=4;s=<Tag> shape across all panels.

12. Validation Checklist

• [ ] OPC UA Server is activated in the panel project and the runtime reports OPC UA server running.
• [ ] Port 4840 is reachable from the IOT2020 (confirmed by telnet).
• [ ] Certificates are mutually trusted on both sides.
• [ ] UA Expert can browse and read the target tag with the same NodeID that Node-RED uses.
• [ ] Inject node carries a non-empty msg.topic in the form ns=4;s=<TagName>.
• [ ] OpcUa-Read node has Use topic from input message enabled.
• [ ] Debug pane shows StatusCode: Good (0x00000000) and a numeric value.
• [ ] Forcing a known-bad NodeID returns BadNodeIdUnknown (0x80340000), confirming the read path is functional.

13. Frequently Asked Questions