StatusCode catalog
Errors in PDComm OPC UA come in three forms:
- C ABI status: the return value of an SDK function. It tells you how the call itself ended.
- OPC UA StatusCode: the service result and item results in a response body, 32-bit values such as
0x803B0000. - Error text: an English description for people. Read it with
pdcomm_opcua_last_error_copyin C,pdcomm::opcua::error::what()in C++,OpcUaException.Messagein .NET and theerrorof a simulator reply. The wording can change, so don’t branch on it.
C ABI statuses
Section titled “C ABI statuses”| Value | Name | Meaning | What to do |
|---|---|---|---|
| 0 | PDCOMM_OPCUA_OK |
Success, even when the response carries a Bad StatusCode. | Check the results in the response body. |
| 1 | PDCOMM_OPCUA_INVALID_INPUT |
An argument, size, structure version, encoding or request ID is invalid. | Check struct_size and version of the options structure and the request encoding. |
| 2 | PDCOMM_OPCUA_INVALID_HANDLE |
The handle is zero, released or of the wrong kind. | Make sure you don’t use a handle after releasing it. |
| 3 | PDCOMM_OPCUA_INTERNAL_ERROR |
An internal failure. | Read the error text. |
| 4 | PDCOMM_OPCUA_BUFFER_TOO_SMALL |
The output buffer is too small; the required size is reported. | Call again with the reported size. |
| 5 | PDCOMM_OPCUA_RUNTIME_ERROR |
A network, security, protocol or address space failure, including timeouts. | Find the cause in the error text; see the tables below. |
| 6 | PDCOMM_OPCUA_EMPTY |
The response hasn’t arrived yet. | Call pdcomm_opcua_client_poll and check again. |
| 7 | PDCOMM_OPCUA_BUSY |
Another thread uses the handle, requests are outstanding, or a response hasn’t been taken. | Serialize calls on one handle and take every response. |
| 8 | PDCOMM_OPCUA_POISONED |
An earlier call stopped inside the library; the handle can’t be used again. | Release the handle and create a new one. |
| 9 | PDCOMM_OPCUA_LIMIT |
A resource limit was reached: 64 outstanding requests, 1024 handles, 64 MiB of buffers and so on. | Release responses and buffers and try again. |
| 10 | PDCOMM_OPCUA_CLOSED |
The client or server is closed or has failed. | Release the handle and connect again. |
| 11 | PDCOMM_OPCUA_LICENSE_REQUIRED |
There’s no license for this call. pdcomm_opcua_discover and pdcomm_opcua_client_connect need the opcua-client module, and pdcomm_opcua_server_create needs opcua-server. The call is refused before any network I/O, so nothing connected and no port was opened. |
Look up the state in parentheses of the error text in license troubleshooting. Check the module state with pdcomm_opcua_license_status. Clients that are connected and servers that are running keep working. |
The example programs print the status too, as in (SDK status 5).
The error text of status 11 looks like this:
PDComm license required for module 'opcua-client' (missing): no valid license for this module was found. Existing connections keep running. Install a license with the license API, PDCOMM_LICENSE_FILE or a pdcomm.license file.OPC UA StatusCodes
Section titled “OPC UA StatusCodes”| StatusCode | Value | Where | Cause and fix |
|---|---|---|---|
| Good | 0x00000000 |
Every result | Success |
| GoodNoData | 0x00A50000 |
History reads | The period holds no values; check the period. |
| BadUserAccessDenied | 0x801F0000 |
Read and write item results, session activation | An anonymous session touched a node for authenticated users only, the user name or password is wrong, or five failures in a row locked the client out. Connect as a user and check the password; a lockout clears after 10 minutes or when the server restarts. |
| BadIdentityTokenInvalid | 0x80200000 |
Session activation | The server couldn’t decode or decrypt the user token: a token type it doesn’t support, a wrong policyId, or an encryption algorithm that doesn’t match the channel’s policy. The Qt and MFC workers set PDCOMM_OPCUA_USER_SECRET_HEADER_POLICY_ONLY by default, so a password over 64 bytes causes this error with servers that require the algorithm URI; for such a server, set flags to 0. |
| BadIdentityTokenRejected | 0x80210000 |
Session activation | The token is well formed but the server’s policy refuses it. A PDComm server, for example, refuses a user name token on a secure channel with policy None. Connect over a secure channel. |
| BadSecurityChecksFailed | 0x80130000 |
Connecting | The server doesn’t trust the client certificate, or another security check failed. The server deliberately doesn’t say why; first check that the client certificate is in the server’s trust list. |
| BadCertificateUntrusted | 0x801A0000 |
Connecting | The certificate isn’t trusted. A PDComm client reports this as OPC UA security CertificateUntrusted; see Certificate problems. |
| BadCertificateTimeInvalid | 0x80140000 |
Connecting | The certificate has expired or isn’t valid yet. Create a new certificate and check the computer’s clock. |
| BadCertificateHostNameInvalid | 0x80160000 |
Connecting | The server certificate doesn’t contain the host name used to connect. |
| BadCertificateUriInvalid | 0x80170000 |
Connecting | The certificate’s URI differs from the ApplicationUri. |
| BadCertificateUseNotAllowed | 0x80180000 |
Connecting | The keyUsage or extendedKeyUsage doesn’t meet OPC UA’s requirements; recreate the certificate from the template. |
| BadTcpEndpointUrlInvalid | 0x80830000 |
Discovery, connecting | The endpoint URL path doesn’t match the server; the simulator’s path, for example, is /pdcomm/simulator. |
| BadNodeIdUnknown | 0x80340000 |
Reads and writes, history | The node doesn’t exist; check the namespace index and identifier. |
| BadHistoryOperationUnsupported | 0x80720000 |
History | The node exists but its history isn’t stored, or the server doesn’t support the requested history operation. In the simulator, only Simulator.Double and Simulator.Counter are historized. |
| BadNotWritable | 0x803B0000 |
Writes | The variable is read-only. |
| BadTypeMismatch | 0x80740000 |
Writes, method arguments | The value’s type differs from the variable’s, such as an Int32 written to a Double variable. |
| BadArgumentsMissing | 0x80760000 |
Method calls | Input arguments are missing. |
| BadTooManyArguments | 0x80E50000 |
Method calls | There are too many input arguments. |
| BadInvalidArgument | 0x80AB0000 |
Method calls | An argument value is invalid; the per-argument results (input_results) tell you which. |
| BadOutOfRange | 0x803C0000 |
Method calls | An argument is out of range; Simulator.Delay accepts up to 10000 ms. |
| BadContinuationPointInvalid | 0x804A0000 |
History reads | The continuation point is unknown, already used or released, or the details differ from the first request. |
| BadEventIdUnknown | 0x809A0000 |
Condition methods | No such EventId; use the EventId of a received event exactly. |
| BadConditionBranchAlreadyAcked | 0x80CF0000 |
Acknowledge | The state is already acknowledged. |
| BadConditionBranchAlreadyConfirmed | 0x80D00000 |
Confirm | The state is already confirmed. |
Security error names
Section titled “Security error names”When a PDComm client fails while checking a certificate itself, it reports an error name instead of a StatusCode, in the form OPC UA security <name>.
| Error name | Matching StatusCode | Cause |
|---|---|---|
CertificateUntrusted |
BadCertificateUntrusted | The peer certificate isn’t in the trust list. |
CertificateHostInvalid |
BadCertificateHostNameInvalid | The URL’s host isn’t among the DNS and IP entries of the server certificate. |
CertificateUriInvalid |
BadCertificateUriInvalid | There isn’t exactly one URI, or it differs from the ApplicationUri. The client checks its own certificate too. |
CertificateTimeInvalid |
BadCertificateTimeInvalid | Outside the validity period; checked for both the own and the peer certificate. |
CertificateUseNotAllowed |
BadCertificateUseNotAllowed | The key usage, extended key usage or a required field such as CN or O doesn’t fit. |
CertificatePolicyInvalid |
BadSecurityChecksFailed | The RSA key length (2048 to 4096 bits) or the signature algorithm (SHA-2) doesn’t fit the policy. |
CertificateChainIncomplete |
BadSecurityChecksFailed | The certificate path can’t be built. |
InvalidKey |
None | The private key doesn’t belong to the certificate, or isn’t an RSA key. |
Errors in simulator replies
Section titled “Errors in simulator replies”The simulator puts a message in the error of a failed action. When the service ran but an item result is Bad, ok is true and good is false.
| Error text | Cause and fix |
|---|---|
The client is not connected |
You sent a client action before connect. |
The server is not running |
You sent a server action without a server, or connected without a URL. |
The server does not offer the selected security policy and mode |
The server doesn’t advertise that policy and mode; check with discover. |
OPC UA protocol: identity token not advertised |
The server doesn’t advertise the user name token; check that the server was started with a password. |
OPC UA protocol: anonymous identity not supported |
The server doesn’t advertise the anonymous token. |
OPC UA protocol: credentials require authenticated server |
You tried to send a password over a secure channel with policy None; change the security policy. |
A password is required for the user name identity |
identity is username but connect has no password. |
OPC UA status BadUserAccessDenied (0x801F0000) |
User authentication failed. |
Timeout (client connection closed) |
A request didn’t finish in time, so the connection was closed; see Timeouts and diagnostics. |
Stop the endpoint before changing its configuration |
You tried to change the configuration of a running server, client or PubSub. |
Unknown service action |
The action name is wrong. |