Resolving OPC UA Connection Errors in Node-RED with Siemens PLCs

Resolving OPC UA Connection Errors in Node-RED with Siemens PLCs

Node-RED flows connecting to a SIMATIC S7-1500, S7-1200, or ET200SP CPU over OPC UA routinely fail with timeout, "Backoff aborted", or unstable session errors. This reference documents the root causes, affected firmware versions, and verified remediation paths for production gateways running on IoT2040, IoT2050, SIMATIC IPC, or containerised Linux hosts against SIMATIC OPC UA Server V2.0 in CPU firmware 2.6.x (released 2019) and later.

1. Problem Overview

Symptoms reported on industrial gateways running Node-RED against SIMATIC controllers:

• OPC UA client node enters a connecting loop and never reaches connected.
• Status indicator shows Backoff aborted or BadCommunicationError.
• Established sessions drop every 30–60 s even when the LAN is healthy.
• Subscriptions deliver stale data after reconnect, with no diagnostic on the dashboard.
• Multiple parallel client nodes exhaust session slots and the PLC rejects new sessions.
• A catch node attached to the OPC UA tab never fires, so a server outage goes silent.

2. Root Cause Analysis

Connection failures cluster into four categories. Each must be ruled out before tuning the flow.

2.1 Library Wrapper Maturity

The reference node-red-contrib-opcua wrapper exposes fixed reconnection backoff without jitter, and the underlying client's transport errors are emitted on the status channel, not as Node-RED runtime errors. The result is that catch nodes wired to the OPC UA tab never fire, and flows cannot distinguish between server unreachable and Bad_NodeIdUnknown. The IIoT successor addresses both behaviours: exponential backoff with jitter, and a single shared client (connector) that drives multiple reader/writer nodes over one session.

2.2 SIMATIC OPC UA Server Session Limits

SIMATIC S7-1500 CPUs cap concurrent OPC UA sessions. Limits are firmware-dependent and apply across all clients (HMI, SCADA, Node-RED, UA Expert):

Each node-red-contrib-opcua Client node may hold up to two sessions (one for browse, one for read/write/subscribe). A 16-session CPU saturates after ~7 client nodes; subsequent attempts return Bad_ResourceUnavailable (0x80040000). The IIoT package uses a single connector + multiple reader/writer nodes, so the entire flow consumes 1–2 sessions regardless of how many tags are read.

2.3 Endpoint, Security Policy, and Certificate Mismatch

SIMATIC OPC UA servers in firmware 2.6 default to:

• Security Policy: Basic256Sha256
• Security Mode: SignAndEncrypt or None (operator selectable)
• Authentication: Anonymous, Username, or Certificate

The server issues a self-signed certificate that must be trusted by the Node-RED client. In TIA Portal the trust list is under OPC UA → Server → Security → Trusted clients and servers. In firmware 2.6 the trust list is not auto-accepted at runtime; an export/import step is required.

2.4 Network Path, MTU, and Time Sync

OPC UA uses TCP/4840. Common Layer-3 issues that produce intermittent session loss:

• Firewall / nftables – the default node-red systemd unit on IoT20xx images does not open outbound 4840.
• NAT – containerised Node-RED on a Docker bridge cannot reach the PLC subnet without --network host or a macvlan network.
• MTU – OPC UA messages on subscriptions can exceed 1500 B when the address space is large; reduce maxReferencesPerNode or raise the interface MTU to 9000 on the OT switch path.
• Clock skew – certificates with notBefore in the future are rejected. Always run NTP on the gateway.

3. Affected Configurations

4. Diagnostic Procedure

1. Verify reachability. From the gateway: nc -zv <plc-ip> 4840. Must return open.
2. Validate endpoint discovery. Use the OPC Foundation UA Expert client. If UA Expert cannot connect, Node-RED cannot either. Export the endpoints list and verify the SecurityPolicy and SecurityMode match the Node-RED config.
3. Enable status debug. Wire a debug node to the OPC UA node's status output. Common payloads:

   status: {fill:"red",   shape:"dot",  text:"Backoff aborted"}
   status: {fill:"yellow",shape:"ring", text:"connecting (attempt 4)"}
   status: {fill:"green", shape:"dot",  text:"connected"}
   status: {fill:"red",   shape:"dot",  text:"BadCommunicationError"}

4. Check the SIMATIC diagnostic buffer. TIA Portal → Online & Diagnostics → Diagnostic buffer → filter on OPC UA. Look for Session limit reached, Certificate rejected, Security policy not supported.
5. Check the Node-RED log. On systemd: journalctl -u nodered -f. On containers: docker logs -f <id>. Look for OpenSecureChannel failures, Bad_SecurityChecksFailed, or repeated ECONNRESET.
6. Count active sessions. In TIA Portal: OPC UA → Server → Diagnostics. Correlate with the number of Client nodes deployed.
7. Capture a network trace. tcpdump -i any -w /tmp/opcua.pcap host <plc-ip> and port 4840. Inspect with Wireshark → Decode As → OpcUa. Confirm OpenSecureChannel / CreateSession / ActivateSession complete in order.

5. Solution Path A — Migrate to OPC UA IIoT Nodes

The node-red-contrib-iiot-opcua package uses the same node-opcua stack but adds:

• Exponential reconnection with jitter, surfaced on the status channel.
• Single connector (one session) shared across N reader/writer nodes.
• Certificate management via the opcua-certificate node.
• Subscription parameters exposed in node config: publishingInterval, samplingInterval, queueSize, deadbandType, deadbandValue, maxKeepAliveCount, maxLifetimeCount.

5.1 Installation

cd ~/.node-red
npm install node-red-contrib-iiot-opcua
sudo systemctl restart nodered

5.2 Read Flow (single session, multiple tags)

[opcua-connector]   endpoint: opc.tcp://192.168.0.10:4840
       securityPolicy: Basic256Sha256
       securityMode:   SignAndEncrypt
       authMode:       Certificate
       cert:           /opt/node-red/certs/client_cert.pem
       key:            /opt/node-red/certs/client_key.pem
       |
       v
[opcua-browser]     browse ServerInterfaces, pick DataItem nodes
       |
       v
[opcua-reader]      reads all items, publishes as array
       publishingInterval: 500 ms
       samplingInterval:   250 ms
       queueSize:          10
       |
       v
[function]          split array, attach unit metadata
       |
       +--> [debug]        (sample)
       +--> [mqtt out]     (publish to broker)
       +--> [ui-chart]     (dashboard)

5.3 Recommended Subscription Parameters

6. Solution Path B — Configure the Original OPC UA Nodes

If migration is not possible, configure the original node-red-contrib-opcua nodes to minimise failures.

6.1 Use a Single Shared Client

One OPC UA Client node per PLC, routed through with multiple OPC UA Item definitions. Do not deploy more than one client per endpoint; this caps the session count and avoids the multi-session exhaustion on S7-1500 firmware 2.6.

6.2 Endpoint Configuration

Endpoint:        opc.tcp://192.168.0.10:4840
SecurityPolicy:  Basic256Sha256
SecurityMode:    SignAndEncrypt
AuthMode:        Certificate
Login:           (blank for cert auth)
Certificate:     /opt/node-red/certs/client_cert.pem
PrivateKey:      /opt/node-red/certs/client_key.pem

6.3 Reconnection Tuning (flow JSON)

{
  "endpoint": "opc.tcp://192.168.0.10:4840",
  "keepSessionAlive": true,
  "reconnectDelay": 5000,
  "connectionTimeout": 10000,
  "requestedSessionTimeout": 120000,
  "maxOperationsPerRequest": 100,
  "endpointTimeout": 10000
}

6.4 Wiring a Status Listener (Catch Alternative)

A catch node attached to the OPC UA tab rarely fires because the transport errors are emitted on the status channel, not as Node-RED runtime errors. Use the status output instead:

[opc ua client] .status --> [function]
   if (msg.payload === "BadCommunicationError" ||
       msg.payload === "connectionError"       ||
       msg.payload === "Backoff aborted") {
       msg.payload = "PLC offline";
       msg.color   = "red";
   } else if (msg.payload === "connected") {
       msg.payload = "PLC online";
       msg.color   = "green";
   }
   return msg;
   |
   v
[ui-notification] or [ui-text]

7. Error Code Reference

8. Siemens S7-1500 OPC UA Server Configuration (Firmware 2.6)

To make a SIMATIC CPU reachable from Node-RED:

1. TIA Portal → Device configuration of the CPU → OPC UA tab.
2. Activate OPC UA server (default off in firmware 2.6).
3. Set Port = 4840 (default).
4. Under Security: leave None disabled in production; set policy to Basic256Sha256 and SignAndEncrypt.
5. Under Server certificate: accept the self-signed cert, export it as .der to the Node-RED host's trust folder /opt/node-red/certs/trusted/.
6. Under User authentication: choose Certificate or Username/password depending on the Node-RED client config.
7. Under Runtime licences: ensure the CPU has an OPC UA server licence. S7-1500 CPUs from FW 2.6 onward ship with the runtime licence by default; older 1511/1513 may need an upgrade.
8. Compile and download to the CPU.

Client certificate handling (Node-RED side):

# The IIoT node creates a self-signed client cert on first connect:
ls /opt/node-red/certs/
# client_cert.pem  client_key.pem  trusted/
#
# Copy client_cert.pem into TIA Portal:
#  OPC UA > Trusted clients > Add certificate
# Restart the OPC UA server on the CPU after import.

9. Connection Stability Best Practices

• Use exactly one OPC UA client per PLC, and route all reads/writes through it. This caps session count at 1–2 per CPU regardless of the number of tags.
• Set the PLC's OPC UA session timeout to 300 000 ms (5 min). Set the client maxLifetimeCount to 100 × publishingInterval, i.e. 50 s at 500 ms.
• Prefer subscriptions over polling. A single subscription with 100 items consumes one session; the same 100 items polled individually consumes 100 read requests per cycle on the same session and is a host-side performance penalty.
• Place Node-RED on the same Layer-2 broadcast domain as the PLC. Routed paths add latency and packet reordering that OPC UA interprets as keep-alive misses.
• Disable IPv6 OPC UA listeners if the network is IPv4-only; S7-1500 firmware 2.6 sometimes prefers IPv6 when both are present and times out on dual-stack setups.
• Set the host clock with NTP; OPC UA certificates with notBefore more than 5 min in the future are rejected.
• Use a unique Application URI per client (e.g. urn:company:gateway:nodered:1) to avoid certificate collisions when multiple gateways run identical Node-RED images.

10. Verification Procedure

1. Restart Node-RED; the OPC UA node's status must go connecting → connected within 5 s on a healthy LAN.
2. Force a PLC reboot; the client must auto-reconnect and the dashboard must flip from "PLC offline" to live values without manual intervention.
3. Check session count in TIA Portal matches the number of opcua-connector instances deployed. One connector = 1–2 sessions.
4. Pull a 24 h log of the OPC UA node's status payloads; if the connect/disconnect count exceeds 5, raise maxLifetimeCount or investigate network stability.
5. Inject a synthetic bad read: configure a wrong NodeId in the reader; the flow must return Bad_NodeIdUnknown status, not crash.
6. Run opcua-client-cli (from node-opcua) against the same endpoint from the gateway host to confirm the credentials and certs are correct independently of Node-RED.

11. When the PLC Firmware is Older than 2.6

S7-1500 firmware 2.5 and earlier does not ship an OPC UA server by default; the runtime licence is a separate purchase. S7-1200 firmware 4.2 introduced the OPC UA server. ET200SP CPUs gained it in firmware 2.5. For these versions, expect:

• Older certificate handling (Basic128Rsa15 only — deprecated and disabled by default in modern clients).
• Lower session counts (2–4 typical).
• No subscription support; polling only.
• Client cert support added in FW 2.5; earlier 2.0–2.4 require Anonymous authentication.

Plan a firmware upgrade to 2.6+ for any new Node-RED integration. See the Siemens Industry Online Support firmware update portal for the latest CPU image.

12. Alternative Controllers

Same patterns apply when Node-RED targets non-Siemens controllers:

13. Deployment and Container Notes

When Node-RED runs in Docker or balenaCloud:

• Use --network host on Linux so the container shares the host's network stack and reaches the OT subnet without NAT.
• On macvlan, assign a static IP inside the OT VLAN and ensure the gateway's firewall allows 4840 outbound to the PLC.
• Mount the cert directory as a volume: -v /opt/opcua-certs:/data/certs:ro. The IIoT node writes the client cert under /data by default in the official container image.
• Add a healthcheck that pings tcp://<plc-ip>:4840 every 30 s; a container restart then propagates reconnect logic to the flow.
• Reserve at least 256 MB RAM for Node-RED; OPC UA subscriptions holding 100+ items with 250 ms sampling can grow the heap quickly.

14. Troubleshooting Matrix

15. FAQ