Reading SINUMERIK and HEIDENHAIN via OPC UA: prerequisites, options, security

Anyone who wants to read data from a CNC control today almost always ends up with OPC UA. Siemens offers an OPC UA server for SINUMERIK as an option, HEIDENHAIN offers the OPC UA NC Server. Both are mature, but both need preparation: a licence, a suitable user, a certificate exchange and a sampling rate that does not put load on the control. This article shows how to read SINUMERIK and HEIDENHAIN via OPC UA, which options are required, how the connection is secured and where the limits of the interface lie. The information comes from the manufacturers' configuration manuals and product pages. What a specific machine delivers depends on the software version and on the work of the machine builder, and can only be established at the machine itself.

Which CNC controls need which option

On none of the common controls is OPC UA simply switched on. It is a licensed software option that has to be ordered and enabled.

With HEIDENHAIN it is worth looking closely at the number of options. Every application that connects to the OPC UA NC Server occupies one option. If your plant already uses StateMonitor, an MES or the machine builder's remote service via OPC UA, an additional option may be needed for a further system. Even a laptop that reads the address space during commissioning occupies one for as long as it is connected.

HEIDENHAIN has also announced that TNC 640 and TNC 620 will not be developed further. New functions of the OPC UA NC Server will only appear for the TNC7. List prices for the options of both manufacturers are not public. Ask your machine builder or dealer.

The quickest way to clarity: a photo of the version screen and the options screen. On SINUMERIK you will find both under Diagnostics, on HEIDENHAIN in the options or SIK menu. From these we can see before the appointment whether the option is present and the software version fits. The whole process is described on the page Process and requirements.

The read-only user: only SinuReadAll and AlarmRead

OPC UA servers on CNC controls can do more than read. SINUMERIK has methods for program selection, file transfer and tool management. The HEIDENHAIN OPC UA NC Server offers, among other things, a writable operating mode and methods for program selection and for clearing error messages. None of this is needed for condition monitoring. That is why every connection includes a dedicated user with read-only rights.

SINUMERIK grants rights in areas. According to the manual there are read-only areas such as StateRead, ToolRead, DriveRead, PlcRead, AlarmRead and SinuReadAll. Our recommendation for a read-only user, for example named forbach_ro:

• Grant: SinuReadAll and AlarmRead.
• Do not grant: any area with “Write” in its name, and ApWrite, which allows program selection.
• Do not use anonymous access: Siemens recommends it for commissioning only.

On HEIDENHAIN, a role with read-only rights is created in the control's user administration. The exact name and the operating steps depend on the software version. We work them out on the day together with your operator.

In our system the read-only user is the last of four barriers. The software contains no code that writes to a CNC control. An upstream protection layer only lets through services that cannot change anything: read, browse, subscribe. Writes, method calls and any unknown service are blocked before a single byte reaches the control. Automated tests check with every change that no write path has been introduced. Even if all three layers were to fail, the user would have no write rights on the control. More on this on the page Data security and IT integration.

Basic256Sha256, certificates and port 4840

OPC UA comes with its own security mechanisms. According to the manual, SINUMERIK offers the security policy Basic256Sha256 in the modes “Sign” and “SignAndEncrypt”. By default we connect using Basic256Sha256 and SignAndEncrypt: every message is signed and encrypted.

The basis is a mutual certificate exchange. Both sides must explicitly trust each other:

1. Server certificate of the CNC control: SINUMERIK generates it itself on first start-up. It is exported via the certificate dialogue and stored in the configuration of our edge box. Without this certificate the box refuses an encrypted connection. This means no other device can pose as the control.
2. Client certificate of the edge box: we generate it before the appointment. On the control it is marked as trusted manually, not via automatic trust for all clients. We compare its fingerprint against a printout.
3. Time: on SINUMERIK, the clock of the operator interface must be correct, otherwise certificate validation fails.

HEIDENHAIN also uses X.509 certificates by default and provides a wizard in the control that guides you through the exchange.

On the network side the connection is simple. The OPC UA server listens on TCP port 4840 by default; the port may differ from machine to machine. The edge box opens the connection to the control; the control never has to connect to the box. The read-only user's password is held on the box only as an environment variable, never in a configuration file. Towards the platform, too, there are only outbound connections via MQTT over TLS; the box accepts no inbound connections. The two protocols are compared in the article OPC UA or MQTT.

Sampling rate: once per second, never more often than every 0.1 seconds

An OPC UA server runs on the same hardware as the operator interface. Every request costs computing time. The Siemens manuals state clear limits:

Siemens also points out that achievable performance depends on the load on the control. For HEIDENHAIN no fixed minimum value has been published. It has to be determined on the control.

Our edge box therefore reads the control once per second by default. The software technically does not allow an interval shorter than 0.1 seconds. For speed, load, temperatures and alarms that is entirely sufficient, because the fast signals for bearing diagnostics come from the vibration sensor anyway. On the day we ask the operator to compare the responsiveness of the operator interface with and without the box. If it becomes noticeably slower, we lengthen the interval. If other OPC UA clients such as an MES are already running on the machine, they all share the control's budget.

umati, OPC 40501 and browse paths instead of fixed NodeIds

umati is the VDW (German Machine Tool Builders' Association) information model for machine tools, published by the OPC Foundation as Companion Specification OPC 40501. It promises a uniform view of machines from different manufacturers. For condition monitoring you need to know what it contains and what it does not.

• Included: operating mode, channel and spindle status such as “rotating” or “program active”, overrides, program name, tool data, counters and messages. This is valuable context, for example to evaluate only measurements taken in automatic mode.
• Not included: spindle speed, spindle load, torque or drive temperatures. These values come from the manufacturer-specific parts of the address space.
• SINUMERIK: umati is not supplied ready-made. It only exists if the machine builder has created its own model with the Siemens tool SiOME.
• HEIDENHAIN: the OPC UA NC Server uses its own information model. From model version 1.07 for the TNC7 it contains axis and spindle data such as speed, positions and motor temperature, but by default no load, current or torque values. Such values are only available if the machine builder has added them.

This leads to an important rule for any software that reads CNC controls: no fixed NodeIds. The namespace index contained in every NodeId can differ from server to server. The instances of a umati model have no fixed NodeIds; they are found via browse paths. Our edge box therefore resolves the namespace index on every connection via the namespace URI.

On the day, the edge box reads the control's address space through the same read-only barrier as in operation and writes it to a table with path, data type, current value and access right. The table also shows whether umati or the CNC model OPC 40502 is present. The operator then starts a normal program, and we check which values change plausibly with speed and load. Only these verified signals go into the machine's configuration. If the access right column shows “write” for our user, the user is too powerful and its rights are reduced.

Limits: sampling rate, older controls, FANUC

The most important limit is physical. Via OPC UA, SINUMERIK delivers at most ten values per second. Bearing damage, however, produces impacts at frequencies far above that. A worked example of our own: a spindle at 12,000 rpm turns at 200 Hz. For a bearing with 15 balls, the outer race ball pass frequency is then roughly 1,200 Hz. A data stream at 10 Hz can only represent frequencies up to 5 Hz.

The background to envelope analysis is covered in the article Detecting rolling bearing damage early.

iTNC 530 and TNC 320 have no OPC UA NC Server. These controls are still in use in many plants. Access would be possible via the HEIDENHAIN DNC interface, which needs a Windows PC as a bridge. We do not offer this today. The vibration measurement itself is independent of the control. What the lack of control data means for your machine is something we clarify in the introductory call.

FANUC, according to our research, has no confirmed OPC UA server in the CNC. The usual route is the FOCAS interface over Ethernet, which provides spindle load among other values. We plan this connection for a later phase.

Warranty and service contract

The connection uses the OPC UA interface that Siemens and HEIDENHAIN themselves offer and license. Nothing is modified, no software is installed on the control and nothing is written to the control. Even so, one question belongs before every appointment: who is allowed to create users and certificates on your CNC control?

• Some service contracts reserve any intervention on the control to the machine builder. In that case their service team sets up the read-only user, and we tell them which rights are needed.
• Only your operator or the manufacturer's service may operate the control. We watch, document and photograph the user's rights.
• Machine parameters, NC programs, tool and PLC data remain untouched, even on request and even “just briefly”.

It is best to clarify these points with your machine builder in advance. If you wish, we can take part in that conversation. You can send an enquiry via the contact page.

Frequently asked questions