UA Part 7: Profiles - 5 Conformance Units

Errata exists for this version of the document.

A ConformanceUnit represents an individually testable entity. For improved clarity, the large list of ConformanceUnits is arranged into named ConformanceGroups. These groups reflect the Service Sets in OPC 10000-4 and the OPC UA information models. Table 2 lists the ConformanceGroups. These groups and the ConformanceUnits that they describe are detailed in the Subclauses of chapter 5 starting with clause 5.2. ConformanceGroups have no impact on testing; they are used only for organizational reasons, i.e. to simplify the readability of this document.

Table 2 – Conformance Groups

Group	Description
Address Space Model	Defines ConformanceUnits for various features of the OPC UA AddressSpace.
Aggregates	All ConformanceUnits that are related to Aggregates, including individual ConformanceUnits for each supported Aggregate as described in Part 13.
Alarms and Conditions	All ConformanceUnits that are associated with the OPC UA Information Model for Conditions, acknowledgeable Conditions, confirmations and Alarms as specified in Part 9.
Attribute Services	Includes ConformanceUnits to read or write current or historical Attribute values.
Auditing	User level security includes support for security audit trails, with traceability between Client and Server audit logs.
Base Information	All information elements as defined in Part 5.
Data Access	ConformanceUnits specific to Clients and Servers that deal with the representation and use of automation data as specified in Part 8.
Discovery Services	ConformanceUnits which focus on Server Endpoint Discovery.
GDS	Conformance Units for a GDS. Includes units for global discovery and global certificate management.
Historical Access	Access to archived data of Node Attribute values or Events.
Method Services	Methods represent the function calls of Objects. Methods are invoked and return only after completion (successful or unsuccessful).
Miscellaneous	This group contains ConformanceUnits that cover miscellaneous subjects, such as recommended behaviours, documentation etc. These ConformanceUnits typically do not fit into any of the other groups.
Monitored Item Services	Clients define MonitoredItems to subscribe to data and Events. Each MonitoredItem identifies the item to be monitored and the Subscription to use to send Notifications.
Node Management Services	Bundles ConformanceUnits for all Services to add and delete OPC UA AddressSpace Nodes and References.
Protocol and Encoding	Covers all transport and encoding combinations that are specified in Part 6.
Redundancy	The design of OPC UA ensures that vendors can create redundant Clients and redundant Servers in a consistent manner. Redundancy may be used for high availability, fault tolerance and load balancing.
Security	Security related ConformanceUnits that can be profiled this includes all aspects of security.
Session Services	An (OPC UA) Session is an application layer connection.
Subscription Services	Subscriptions are used to report Notifications to the Client.
View Services	Clients use the View Service Set to navigate through the OPC UA AddressSpace or through a View (a subset) of the OPC UA AddressSpace.

5.2 Services

The following tables describe ConformanceUnits for the Services specified in OPC 10000-4. The tables correlate with the Service Sets.

A single ConformanceUnit can reference several Services (e.g. CreateSession, ActivateSession and CloseSession) but can also refer to individual aspects of Services (e.g. the use of ActivateSession to impersonate a new user).

Each table includes a listing of the Profile Category to which a ConformanceUnit belongs, the title and description of the ConformanceUnit. In some cases, a ConformanceUnit will be derived from another ConformanceUnit. This parent unit will then be specified in the description of each derived unit. In such cases the derived units inherit all of the tests of its parent plus one or more additional TestCases. These TestCases can only further restrict the existing TestCases. An example would be one in which the number of connections is tested, where the TestCase of the parent required at least one connection and the derived ConformanceUnit would require a TestCase for at least five connections.

The Discovery Service Set is composed of multiple ConformanceUnits (see Table 3). All Servers provide some aspects of this functionality; see Profiles categorized as Server Profiles for details. Clients may support some aspects of this functionality; see Profiles categorized as Client Profiles for details.

Table 3 – Discovery Services

Category	Title	Description
Server	Discovery Get Endpoints	Support the GetEndpoints Service to obtain all Endpoints of the Server. This includes filtering based on Profiles.
Server	Discovery Get Endpoints SessionLess	Support at least one endpoint for issueing SessionLess Services. Support obtaining such endpoints by accepting the Transport URI as a filter to the GetEndpoints Service with the query string "SL" appended to the Transport URI. E.g. "http://opcfoundation.org/UA-Profile/Transport/https-uajson?SL"
Server	Discovery Find Servers Self	Support the FindServers Service only for itself.
Server	Discovery Register	Call the RegisterServer Service to register itself (OPC UA Server) with an external Discovery Service via a secure channel with a SecurityMode other than NONE.
Server	Discovery Register2	Call the RegisterServer2 Service to register with an external Discovery Service via a Secure Channel with a SecurityMode other than "None". This includes passing a list of short capability identifiers. The identifiers and their use are specified in Part 12.
Server	Discovery Server Announcement using mDNS	Provide mDNS functionality to announce a Server with its capabilities. The capability identifiers and the use of mDNS records for the purpose of OPC UA Discovery is specified in Part 12. Note that this functionality is only required for Servers that do not register with an LDS. The capability identifiers and their use in mDNS records are specified in Part 12.
Server	Discovery Configuration	Allow configuration of the Discovery Server URL where the Server will register itself. Allow complete disabling of registration with a Discovery Server.
Client	Discovery Client Find Servers Basic	Uses the FindServers Service to obtain all Servers installed on a given platform.
Client	Discovery Client Find Servers with URI	Use FindServers Service to obtain URLs for specific Server URIs.
Client	Discovery Client Find Servers Dynamic	Detect new Servers after an initial FindServers Service call.
Client	Discovery Client Find Servers on Network	Support one of the options to locate Servers on the network.
Client	Discovery Client Find Servers on Network using LDS-ME	Use FindServersOnNetwork Service to obtain URLs for specific Server URIs. Note that this Service is available via the Local Discovery Server with multicast extension (LDS-ME).
Client	Discovery Client Find Servers on Network using mDNS	Use mDNS based Service Discovery to locate Servers on the same multicast network. The contents of mDNS records for OPC UA Discovery are described in Part 12. Note that this functionality is only required for Clients when there is no Local Discovery Server with multicast extension (LDS-ME). The capability identifiers and their use in mDNS records are specified in Part 12.
Client	Discovery Client Find Servers in GDS	Use the QueryServers Method on the GDS Directory Object to locate Servers that meet filter criteria specified in the request. This Method is specified in Part 12.
Client	Discovery Client Find Applications in GDS	Use the QueryApplications Method on the GDS Directory Object to locate Applications that meet filter criteria specified in the request. This Method is specified in Part 12.
Client	Discovery Client Get Endpoints Basic	Uses the GetEndpoints Service to obtain all Endpoints for a given Server URI.
Client	Discovery Client Get Endpoints SessionLess	Uses the GetEndpoints Service with a filter to obtain Endpoints that can be used for SessionLess Service invocation. The filter is the Transport URI extended with the query string "SL". E.g. http://opcfoundation.org/UA-Profile/Transport/https-uajson?SL.
Client	Discovery Client Get Endpoints Dynamic	Detect changes to the Endpoints after an initial GetEndpoints Service call.
Client	Discovery Client Configure Endpoint	Allow specification of an Endpoint without going through the Discovery Service Set.

The Session Service Set is composed of multiple ConformanceUnits (see Table 4). The CreateSession, ActivateSession, and CloseSession services are supported as a single unit. All Servers and Clients provide this functionality.

Table 4 – Session Services

Category	Title	Description
Server	Session General Service Behaviour	Implement basic Service behaviour. This includes in particular: – checking the authentication token – returning the requestHandle in responses – returning available diagnostic information as requested with the 'returnDiagnostics' parameter – respecting a timeoutHint
Server	Session Base	Support the Session Service Set (CreateSession, ActivateSession, CloseSession) except the use of ActivateSession to change the Session user. This includes correct handling of all parameters that are provided. Note that for the CreateSession and ActivateSession services, if the SecurityMode = None then: 1) The Application Certificate and Nonce are optional. 2) The signatures are null/empty. The details of this are described in Part 4.
Server	Session Change User	Support the use of ActivateSession to change the Session user.
Server	Session Cancel	Support the Cancel Service to cancel outstanding requests.
Server	Session Minimum 1	Support minimum 1 Session (total).
Server	Session Minimum 2 Parallel	Support minimum 2 parallel Sessions (total for all Clients).
Server	Session Minimum 50 Parallel	Support minimum 50 parallel Sessions (total for all Clients).
Server	Session Sessionless Invocation	Defines the support of the SessionlessInvoke Service defined in UA Part 4 to process any of the Services (like Read/Write, Browse, or Call) that are designated for Session-less invocation.
Client	Session Client General Service Behaviour	Implement basic Service behaviour. This includes in particular: – including the proper authentication token of the Session – creating a requestHandle if needed – requesting diagnostic information with the 'returnDiagnostics' parameter – evaluate the serviceResult and operational results
Client	Session Client Base	Use the Session Service Set (CreateSession, ActivateSession, and CloseSession) except the use of ActivateSession to change the Session user. This includes correct handling of all parameters that are provided Note that for the CreateSession and ActivateSession services, if the SecurityMode = None then: 1) The Application Certificate and Nonce are optional. 2) The signatures are null/empty.
Client	Session Client Multiple Connections	Support unlimited connections (client side) with multiple Servers. Any limit on numbers of connections is from server side. May have a memory based limit, but not a software constraint limit.
Client	Session Client Renew NodeIds	This ConformanceUnit applies to Clients that allow persisting NodeIds. Verify that the Namespace Table has not changed for NodeIds that the Client has persisted and is going to re-use beyond a Session lifetime. If changes occurred the Client has to recalculate the Namespace Indices of the respective NodeIds.
Client	Session Client Impersonate	Uses ActivateSession to change the Session user (impersonation).
Client	Session Client KeepAlive	Make periodic requests to keep the Session alive.
Client	Session Client Detect Shutdown	Read or monitor the ServerStatus/State Variable to recognize a potential shutdown of the Server and clean up resources.
Client	Session Client Cancel	Use the Cancel Service to cancel outstanding requests.
Client	Session Client Auto Reconnect	Automatic Client reconnect including: – ActivateSession with new SecureChannel if SecureChannel is no longer valid but Session is still valid – Creation of a new Session only if Session is no longer valid
Client	Session Client Single Session	The Client shall interoperate with Servers that only support one Session.
Client	Session Client SessionLess Service Calls	Defines the use of the SessionlessInvoke Service defined in UA Part 4 to request one of the Services (like Read or Browse) that are allowed for sessionless invocation. UA Part 6 specifies which transports may be used and how.

The Node Management Service Set is composed of multiple ConformanceUnits (see Table 5). Servers may provide some aspects of this functionality; see Profiles categorized as Server Profiles for details. Clients may support some aspects of this functionality; see Profiles categorized as Client Profiles for details.

Table 5 – Node Management Services

Category	Title	Description
Server	Node Management Add Node	Support the AddNodes Service to add one or more Nodes into the OPC UA AddressSpace.
Server	Node Management Delete Node	Support the DeleteNodes Service to delete one or more Nodes from the OPC UA AddressSpace.
Server	Node Management Add Ref	Support the AddReferences Service to add one or more References to one or more Nodes in the OPC UA AddressSpace.
Server	Node Management Delete Ref	Support the DeleteReferences Service to delete one or more References of a Node in the OPC UA AddressSpace.
Client	Node Management Client	Uses Node Management Services to add or delete Nodes and to add or delete References in Server's OPC UA AddressSpace.

The View Service Set is composed of a multiple ConformanceUnits (see Table 6). All Servers support some aspects of this conformance group. Clients may support some aspects of this functionality; see Profiles categorized as Client Profiles for details.

Table 6 – View Services

Category	Title	Description
Server	View Basic	Support the View Service Set (Browse, BrowseNext).
Server	View TranslateBrowsePath	Support TranslateBrowsePathsToNodeIds Service.
Server	View RegisterNodes	Support the RegisterNodes and UnregisterNodes Services as a way to optimize access to repeatedly used Nodes in the Server's OPC UA AddressSpace.
Server	View Minimum Continuation Point 01	Support minimum 1 continuation point per Session.
Server	View Minimum Continuation Point 05	Support minimum 5 continuation points per Session. This number has to be supported for at least half of the minimum required sessions.
Client	View Client Basic Browse	Uses Browse and BrowseNext Services to navigate through the Server's OPC UA AddressSpace. Make use of the referenceTypeId and the nodeClassMask to specify the needed References.
Client	View Client Remote Nodes Browse	The Client can browse to nodes that have an extended NodeID that reference a Server different than the originating Server. This includes automatic connection to the remote Server. It is acceptable that the Server configuration information be pre-configured on the Client and / or that the user is prompted to connect.
Client	View Client Basic ResultSet Filtering	Makes use of the resultMask parameter to optimize the result set to be returned by the Server.
Client	View Client TranslateBrowsePath	Uses the TranslateBrowsePathsToNodeIds Service to identify the NodeIds for Nodes where a starting Node and a BrowsePath is known. Makes use of bulk operations rather than multiple calls whenever possible.
Client	View Client Remote Nodes Translate Browse	The Client can translate browse paths that include nodes with extended NodeID that reference a Server different than the originating Server and return them as part of the TranslateBrowsePathsToNodeIds Service. It is acceptable that the Server configuration information be pre-configured on the Client.
Client	View Client RegisterNodes	Uses the RegisterNodes Service to optimize access for Nodes that are used repeatedly. Use UnregisterNodes when Nodes are not used anymore.

The Attribute Service Set is composed of multiple ConformanceUnits (see Table 7). The majority of the Attribute service set is a core functionality of OPC UA and as such is supported by most Servers. Most Clients will also support some aspects of the Attribute Service Set.

Table 7 – Attribute Services

Category	Title	Description
Server	Attribute Read	Supports the Read Service to read one or more Attributes of one or more Nodes. This includes support of the IndexRange parameter to read a single element or a range of elements when the Attribute value is an array.
Server	Attribute Read Complex	Supports reading and encoding Values with structured DataTypes.
Server	Attribute Write Values	Supports writing to values to one or more Attributes of one or more Nodes.
Server	Attribute Write Complex	Supports writing and decoding Values with structured DataTypes.
Server	Attribute Write StatusCode & Timestamp	Supports writing of StatusCode and Timestamps along with the Value.
Server	Attribute Write Index	Supports the IndexRange to write a single element or a range of elements when the Attribute value is an array and partial updates is allowed for this array.
Server	Attribute Alternate Encoding	Supports alternate Data Encoding when reading value Attributes. By default, every Server has to support the Data Encoding of the currently used Stack Profile (i.e. binary with UA Binary Encoding and XML with XML Encoding). This ConformanceUnit - when supported - specifies that the other Data Encoding is supported in addition.
Server	Attribute Historical Read	Supports the HistoryRead Service. The details of what aspects of this service are used are listed in additional ConformanceUnits, but at least one of ReadRaw, ReadProcessed, ReadModified, ReadAtTime or ReadEvents must be supported.
Server	Attribute Historical Update	Supports the HistoryUpdate service. The details of the supported features of this service are described by additional ConformanceUnits, but at least one of the following must be supported: InsertData, InsertEvents, ReplaceData, ReplaceEvents, UpdateData, UpdateEvents, DeleteData, DeleteEvents or DeleteAtTime.
Client	Attribute Client Read Base	Use the Read Service to read one or more Attributes of one or more Nodes. This includes use of an IndexRange to select a single element or a range of elements when the Attribute value is an array. Clients shall use bulk operations whenever possible to reduce the number of Service invocations.
Client	Attribute Client Remote Nodes Attribute Access	The Client can retrieve attributes of nodes that have an extended NodeID that reference a Server different than the originating Server. This requires a connection to the remote Server for access (not necessarily displayed as a connection). It is acceptable that the Server configuration information be pre-configured on the Client.
Client	Attribute Client Read with proper Encoding	This ConformanceUnit refers to the ability of a Client to discover the available encodings and choose a specific one when calling the Read Service.
Client	Attribute Client Read Complex	Read and decode Values with structured DataTypes.
Client	Attribute Client Write Base	Use the Write Service to write values to one or more Attributes of one or more Nodes. This includes use of an IndexRange to select a single element or a range of elements when the Attribute value is an array. Clients shall use bulk operations whenever possible to reduce the number of Service invocations.
Client	Attribute Client Write Complex	Write and Encode Values with structured DataTypes.
Client	Attribute Client Write Quality & Timestamp	Use the Write Service to also write StatusCode and/or Timestamps along with a Value.
Client	Attribute Client Historical Read	The Client makes use of the HistoryRead service. The details of which aspect of this service are used are provided by additional ConformanceUnits, but at least one or more of the following is used ReadRaw, ReadAtTime, ReadProcessed, ReadModified or ReadEvents.
Client	Attribute Client Historical Updates	The Client makes use of the HistoryUpdate service. The details of this usage are provided by additional ConformanceUnits, but at least one or more of the following must be provided InsertData, InsertEvents, ReplaceData, ReplaceEvents, UpdateData, UpdateEvents, DeleteData or DeleteEvents or DeleteAtTime.

The Method Service Set is composed of ConformanceUnits (see Table 8). The primary ConformanceUnits provide support for the call functionality. Servers may provide some aspects of this functionality; see Profiles categorized as Server Profiles for details. Clients may support some aspects of this functionality; see Profiles categorized as Client Profiles for details.

Table 8 – Method Services

Category	Title	Description
Server	Method Call	Support the Call Service to call (invoke) a Method which includes support for Method Parameters.
Client	Method Client Call	Use the Call Service to call one or several Methods.

The MonitoredItem Service Set is composed of multiple ConformanceUnits (see Table 9). Servers may provide some aspects of this functionality; see Profiles categorized as Server Profiles for details. Clients may support some aspects of this functionality; see Profiles categorized as Client Profiles for details.

Table 9 – Monitored Item Services

Category	Title	Description
Server	Monitor Basic	Support the following MonitoredItem Services: CreateMonitoredItems, ModifyMonitoredItems, DeleteMonitoredItems and SetMonitoringMode.
Server	Monitor Value Change	Support creation of MonitoredItems for Attribute value changes. This includes support of the IndexRange to select a single element or a range of elements when the Attribute value is an array.
Server	Monitor Complex Value	Supports monitoring and encoding Values with structured DataTypes.
Server	Monitored Items Deadband Filter	Supports an absolute Deadband filter as a DataChangeFilter for numeric data types.
Server	Monitor Aggregate Filter	Support for Aggregate filters for MonitoredItems. The result of this ConformanceUnit includes a list of Aggregates that are supported as part of the Profile Certificate.
Server	Monitor Alternate Encoding	Support alternate encoding when monitoring value Attributes. By default, every Server has to support the encoding of the currently used Stack Profile (i.e. binary with UA Binary Encoding and XML with XML Encoding). This ConformanceUnit - when supported - specifies that the other encoding is supported in addition.
Server	Monitor Items 2	Support at least 2 MonitoredItems per Subscription where the size of each MonitoredItem is at least equal to size of Double.
Server	Monitor Items 10	Support at least 10 MonitoredItems per Subscription where the size of each MonitoredItem is at least equal to size of Double.
Server	Monitor Items 100	Support at least 100 MonitoredItems per Subscription. This number has to be supported for at least half of the required Subscriptions for half of the required Sessions.
Server	Monitor Items 500	Support at least 500 MonitoredItems per Subscription. This number has to be supported for at least half of the required Subscriptions for half of the required Sessions.
Server	Monitor QueueSize_1	This ConformanceUnit does not require queuing when multiple value changes occur during a "publish period". I.e. the latest change will be sent in the Notification.
Server	Monitor MinQueueSize_02	Support at least 2 queue entries for MonitoredItems. Servers often will adapt the queue size to the number of currently MonitoredItems. However, it is expected that Servers support this minimum queue size for at least one third of the supported MonitoredItems.
Server	Monitor MinQueueSize_05	Support at least 5 queue entries for MonitoredItems. Servers often will adapt the queue size to the number of currently MonitoredItems. However, it is expected that Servers support this minimum queue size for at least one third of the supported MonitoredItems.
Server	Monitor QueueSize_ServerMax	This ConformanceUnit is for events. When the Client requests queuesize=MAXUInt32 the Server is to return the maximum queue size that it can support for event notifications as the revisedQueueSize.
Server	Monitor Triggering	Support the SetTriggering Service to create and/or delete triggering links for a triggering item.
Server	Monitor Events	Support creation of MonitoredItems for an "EventNotifier Attribute" for the purpose of Event Notification. The subscription includes supporting a filter that includes SimpleAttribute Operands and a select list of Operators. The list of Operators includes: Equals, IsNull, GreaterThan, LessThan, GreaterThanorEqual, LessThatorEqual, Like, Not, Between, InList, And, Or, Cast, BitwiseAnd, BitwiseOr.
Server	Monitor Complex Event Filter	Support for the 'TypeOf' complex Event filter operator.
Client	Monitor Client Value Change	Use the MonitoredItem Service Set to register items for changes in Attribute value. Use CreateMonitoredItems to register the Node/Attribute tuple. Set proper sampling interval, Deadband filter and queuing mode. Use disabling / enabling instead of deleting and re-creating a MonitoredItem. Use bulk operations rather than individual service requests to reduce communication overhead.
Client	Monitor Client Complex Value	Monitor and decode Values with structured DataTypes.
Client	Monitor Client Deadband Filter	Uses Absolute Deadband filters for subscriptions.
Client	Monitor Client by Index	Use the IndexRange to select a single element or a range of elements when the Attribute value is an array.
Client	Monitor Client Aggregate Filter	Uses Aggregate filters for Subscriptions.
Client	Monitor Client Events	Use the MonitoredItem Service Set to create MonitoredItems for Event notifications.
Client	Monitor Client Event Filter	Use the Event filter when calling CreateMonitoredItems to filter the desired Events and to select the columns to be provided for each Event Notification.
Client	Monitor Client Complex Event Filter	Use of the 'TypeOf' complex Event filter operator.
Client	Monitor Client Modify	Use ModifyMonitoredItems Service to change the configuration setting. Use SetMonitoringMode Service to disable / enable sampling and / or publishing.
Client	Monitor Client Trigger	Use the Triggering Model if certain items are to be reported only if some other item triggers. Use proper monitoring mode for these items. Use SetTriggering Service to link these items to the trigger item.

The Subscription Service Set is composed of multiple ConformanceUnits (see Table 10). Servers may provide some aspects of this functionality; see Profiles categorized as Server Profiles for details. Clients may support some aspects of this functionality; see Profiles categorized as Client Profiles for details.

Table 10 – Subscription Services

Category	Title	Description
Server	Subscription Basic	Support the following Subscription Services: CreateSubscription, ModifySubscription, DeleteSubscriptions, Publish, Republish and SetPublishingMode.
Server	Subscription Minimum 1	Support at least 1 Subscription per Session. This number has to be supported for all of the minimum required sessions.
Server	Subscription Minimum 02	Support at least 2 Subscriptions per Session. This number has to be supported for at least half of the minimum required sessions.
Server	Subscription Minimum 05	Support at least 5 Subscriptions per Session. This number has to be supported for at least half of the minimum required sessions.
Server	Subscription Publish Min 02	Support at least 2 Publish Service requests per Session. This number has to be supported for all of the minimum required sessions. Support of a NotificationMessage retransmission queue is not required; if not available the Republish Service returns Bad_MessageNotAvailable.
Server	Subscription Publish Min 05	Support at least 5 Publish Service requests per Session. This number has to be supported for at least half of the minimum required sessions. Support, as a minimum, the number of Publish requests per session as the size of the NotificationMessage retransmission queue for Republish.
Server	Subscription Publish Min 10	Support at least 10 Publish Service requests per Session. This number has to be supported for at least half of the minimum required sessions. Support, as a minimum, the number of Publish requests per session as the size of the NotificationMessage retransmission queue for Republish.
Server	Subscription Publish Discard Policy	Respect the specified policy for discarding Publish Service requests. If the maximum number of Publish Service requests has been queued and a new Publish Service request arrives, the "oldest" Publish request has to be discarded by returning the proper error.
Server	Subscription Transfer	Support TransferSubscriptions Service to transfer a Subscription from one Session to another.
Server	Subscription Durable	Support setting Subscriptions in durable mode. This mode requires that collected data and events are stored and delivered even if a Client was disconnected for a longer time or the Server was restarted. Support one of the “Subscription Durable StorageLevel nnn” ConformanceUnits.
Server	Subscription Durable StorageLevel Small	Support at least 20 monitored items with a queue size of 10000 for each item and where the size of each MonitoredItem is at least equal to size of Double. This requires storage capacity for 200 thousand values of DataType Double.
Server	Subscription Durable StorageLevel Medium	Support at least 100 monitored items with a queue size of 50000 for each item and where the size of each MonitoredItem is at least equal to size of Double. This requires storage capacity for 5 million values of DataType Double.
Server	Subscription Durable StorageLevel High	Support at least 2000 monitored items with a queue size of 200000 for each item and where the size of each MonitoredItem is at least equal to size of Double. This requires storage capacity for 400 million values of DataType Double.
Client	Subscription Client Basic	Use the Subscription and MonitoredItem Service Set as an efficient means to detect changes of Attribute values and / or to receive Event occurrences. Set appropriate intervals for publishing, keep alive notifications and total Subscription lifetime. Supply a sufficient number of Publish requests to the Server so that Notifications can be sent whenever a publish timer expires. Acknowledge received Notifications with subsequent Publish requests.
Client	Subscription Client Fallback	The Client shall interoperate with Servers that do not support Subscriptions, or have exhausted Subscription limits, for Monitoring by using Read Service.
Client	Subscription Client Republish	Evaluate the sequence number in Notifications to detect lost Notifications. Use Republish to request missing Notifications.
Client	Subscription Client Modify	Allow modification of the Subscription configuration using the ModifySubscription Service.
Client	Subscription Client TransferSubscriptions	The Client supports transferring Subscription from other Clients. This ConformanceUnit is used as part of redundant Clients.
Client	Subscription Client Multiple	Use multiple Subscriptions to reduce the payload of individual Notifications.
Client	Subscription Client Publish Configurable	Send multiple Publish Service requests to assure that the Server is always able to send Notifications. The number of parallel Publish Service requests per Session shall be configurable.
Client	Subscription Client Durable	Use durable Subscriptions.

5.3 Transport and communication related features

Table 11 describes security related ConformanceUnits. All of these ConformanceUnits apply equally to both Clients and Servers, where a Client uses the related security unit and a Server supports the use of it. These items are defined in detail in OPC 10000-6. It is recommended that a Server and Client support as many of these options as possible in order to achieve increased levels of interoperability. It is the task of an administrator to determine which of these ConformanceUnits are exposed in a given deployed Server or Client application.

Table 11 – Security

Category	Title	Description
Security	Security User Name Password	The Server supports User Name/Password combination(s). The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security User X509	The Server supports a public/private key pair for user identity. The use of this feature must be able to be enabled or disabled by an administrator.
Security	Security User IssuedToken Kerberos	The Server supports a Kerberos Server token for User Identity. The use of this feature must be able to be enabled or disabled by an Administrator. The use of this token is defined in Kerberos Token Documentation. The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security User IssuedToken Kerberos Windows	The Server supports the Windows implementation of Kerberos Tokens. This ConformanceUnit only applies if the "Security User IssuedToken Kerberos" is supported. The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security User JWT IssuedToken	The Server supports a JSON Web Token (JWT) for user identity. Part 6 describes OAuth2 and JWTs in more detail. The use of this feature must be able to be enabled or disabled by an Administrator. The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security User Anonymous	The Server provides support for Anonymous access. The use of this feature must be able to be enabled or disabled by an Administrator. By default Anonymous access shall be disabled.
Security	Security User Name Password Client	A Client uses a User Name/Password combination. The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security User X509 Client	A Client uses a public/private key pair for user identity. This includes all validation and trust issues associated with a certificate.
Security	Security User IssuedToken Kerberos Client	A Client uses a Kerberos Server token. The use of this token is defined by the Kerberos documentation. The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security User IssuedToken Kerberos Windows Client	A Client uses the Windows implementation of Kerberos tokens. This ConformanceUnit only applies if the "Security User IssuedToken Kerberos Client" is supported. The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security User JWT IssuedToken Client	A Client uses a JSON Web Token (JWT) for user identity. Part 6 describes OAuth2 and JWTs in more detail. The token will be encrypted if required by the security policy of the User Token Policy or by the security policy of the endpoint. An unencrypted token either requires message encryption or means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.
Security	Security Invalid user token	Servers shall take proper measures to protect against attacks on user identity tokens. Such an attack is assumed if repeated connection attempts with invalid user identity tokens happen. See ActivateSession Service in UA Part 4.
Security	Security User JWT Token Policy	The Server supports one or more Endpoints with a UserTokenPolicy that includes a JWT IssuerEndpointUrl as defined in UA Part 6. For JWT the issuerEndpointUrl is a JSON object that includes all parameters that define the AuthorizationService. As part of the JWT Token Policy, the Server shall support at least one of the following Authority Profile Conformance Units. The URIs defined in the ConformanceUnit shall be exposed in the authorityProfileURI field of the JWT Token Policy.
Security	Security User JWT Token Policy Client	The Client understands and uses the Authorization Service definition inside the JWT UserTokenPolicy returned with GetEndpoints. It shall support at least one of the following Authority Profile Conformance Units. The URIs defined in the ConformanceUnit are in the authorityProfileURI field of the JWT Token Policy exposed in Server Endpoints.
Security	OAuth2 Authority Profile	This unit indicates support of OAuth2 over HTTPS to request access tokens. The URI for the interactions with this authority is "http://opcfoundation.org/UA/Authorization#OAuth2"
Security	OPC UA Authority Profile	This unit indicates support of the OPC UA Methods defined in UA Part 12 to request access tokens. The URI for the interactions with this authority is "http://opcfoundation.org/UA/Authorization#OPCUA"
Security	Azure Identity Provider Authority Profile	This unit indicates support of the Azure identity provider to request access tokens. The URI for the interactions with this authority is "http://opcfoundation.org/UA/Authorization#Azure"
Security	Security Certificate Validation	A certificate will be validated as specified in Part 4. This includes among others structure and signature examination. Allowing for some validation errors to be suppressed by administration directive.
Security	Security Default ApplicationInstance Certificate	An application, when installed, has a default ApplicationInstanceCertificate that is valid. The default ApplicationInstanceCertificate shall either be created as part of the installation or installation instructions explicitly describe the process to create and apply a default ApplicationInstanceCertificate to the application.
Security	Security – No Application Authentication	The Server supports being able to be configured for no application authentication, just User authentication and normal encryption/signing: – Configure Server to accept all certificates – Certificates are just used for message security (signing and encryption) – Users level is used for authentication
Security	Security Policy Required	Support at least Security Policy [A] and Security Policy [B].Support of multiple Security Policies - even obsolete ones - is recommended. This will provide best interoperability and allows the end user to choose the required level of security. Obsolete Security Policies shall not be enabled / usable without administrative intervention.
Security	Security None CreateSession ActivateSession	When SecurityPolicy=None, the CreateSession and ActivateSession service allow for a NULL/empty signature and do not require Application Certificates or a Nonce.
Security	Security None CreateSession ActivateSession 1.0	The Client can connect to Servers that require a certificate being passed on Session establishment. The Client in this case will first try without a certificate and if this fails present a certificate.
Security	Security TLS General	This ConformanceUnit indicates that at least one of the transport security Profiles for TLS is supported by this application. It is used in TLS transport Profiles, but the choice of transport security profile is optional. The actual used security profile will default to the most secure one.
Security	Security TLS_RSA with AES_256_CBC_SHA256	The connection is established using TLS_RSA_WITH_AES_256_CBC_SHA256. That has a MinAsymmetricKeyLength – 2048, MaxAsymmetricKeyLength – 4096, AsymmetricSignatureAlgorithm – RSA_SHA256. (TLS 1.2)
Security	Security TLS_DHE_RSA with AES_nnn_CBC_SHA256	The connection is established using TLS_DHE_RSA with AES_128_CBC_SHA256 or TLS_DHE_RSA with AES_256_CBC_SHA256. That has a MinAsymmetricKeyLength – 2048, MaxAsymmetricKeyLength – 4096, CertificateSignatureAlgorithm – RSA_SHA256. (TLS 1.2). Clients and Servers have to support both algorithms.
Security	Security Encryption Required	Encryption is required using the algorithms provided in the security algorithm suite.
Security	Security Signing Required	Signing is required using the algorithms provided in the security algorithm suite.
Security	Security Time Synch – Configuration	Application supports configuring acceptable clock skew.
Security	Security Time Synch – NTP / OS Based support	Application supports time synchronization, either via an implementation of Network Time Protocol (NTP), or via features of a standard operating system.
Security	Security Time Synch – UA based support	An application makes use of the responses header timestamp provided by a configured well know source, such as a Discovery Server to synchronize the time on the application and that this time synchronization occurs periodically. Use of this TimeSyncing can be configured.
Security	Security Administration	Allow configuration of the following Security related items (when they apply). * select the allowed User identification policy or policies (e.g. User Name/Password or X509). * enable/disable the security policy "None" or other security policies. * enable/disable endpoints with MessageSecurityMode SIGN or SIGNANDENCRYPT. * set the permitted certification authorities. * define how to react to unknown Certificates. * allow accepting any valid Certificate
Security	Security Administration – XML Schema	Support the OPC UA defined XML schema for importing and exporting security configuration information. This schema is defined in Part 6.
Security	Security Certificate Administration	Allow a site administrator to be able to assign a site specific ApplicationInstanceCertificate and if desired to configure a site specific Certificate Authority (CA).
Security	Security Role Server Base	Support the User Authorization Information Model defined in UA Parts 3 and 5 - like Roles - and the RolePermissions and UserRolePermissions Attributes.
Security	Security Role Well Known	Support the well-known Roles "ConfigureAdmin" and "SecurityAdmin" with suggested permissions defined in UA Part 3.
Security	Security Role Server IdentityManagement	Allow authorized users to add and/or remove Identities from Roles with the appropriate Methods.
Security	Security Role Server Management	Allow authorized users to create new Roles and/or remove Roles with the appropriate Methods.
Security	Security Role Server Restrict Applications	Support adding applications to a Role with the appropriate Methods so that only these applications can use this Role.
Security	Security Role Server Restrict Endpoints	Support adding Endpoints to a Role with the appropriate Methods. With this restriction a Role is only applied when a Client connects via one of these Endpoints.
Security	Security Role Server DefaultRolePermissions	Allow authorized users to set the DefaultRolePermissions Property for certain NameSpaces. DefaultRolePermissions are applied if no RolePermissions are associated with a Node.
Security	Security Role Server RolePermissions	Allow authorized users to set the RolePermissions Attribute on Nodes.
Security	Security Role Server Authorization	Restrict access based on the configured Roles and permissions.
Security	Security Role Client Base	Understand and use the User Authorization Information Model defined in UA Part 5 and the RolePermissions Attribute.
Security	Security Role Client Management	Support creating new Roles and adding Identities as well as remove Roles or Identities using the appropriate Methods.
Security	Security Role Client Restrict Applications	Use the appropriate Methods to add applications to a Role so that only these applications can use this Role.
Security	Security Role Client Restrict Endpoints	Use the appropriate Methods to add Endpoints to a Role. With this restriction a Role is only applied when a Client connects via one of these Endpoints.
Security	Security Role Client DefaultRolePermissions	Ability to set the DefaultRolePermissions Property for certain NameSpaces. DefaultRolePermissions are applied if no RolePermissions are associated with a Node.
Security	Security Role Client RolePermissions	Support setting the RolePermissions Attribute on Nodes.
Security	Pull Model for Global Certificate and TrustList Management	Use the Certificate Management Services of UA Part 12 for the Pull model to manage Application Instance Certificates and Trust Lists including Revocation Lists.
Security	Push Model for Global Certificate and TrustList Management	Support the Certificate Management Services of UA Part 12 for the Push model to manage Application Instance Certificates and Trust Lists including Revocation Lists.
Security	Pull Model for KeyCredential Service	Use the Methods on an instance of the KeyCredentialServiceType (Pull model) to obtain KeyCredentials as specified in UA Part 12.
Security	Push Model for KeyCredential Service	Support the KeyCredential Services Push model of UA Part 12 to obtain KeyCredentials. This includes support of one or more instances of the KeyCredentialConfigurationType and the Methods to update or delete credentials.
Security	Authorization Service Configuration Server	Support the Object Types defined in Part 12 to allow configuration of information needed to accept Access Tokens when presented by the Client during session establishment. Access Tokens are issued by Authorization Services.
Security	Authorization Service Client	Use the RequestAccessToken Method defined in UA Part 12.
Security	SymmetricSignatureAlgorithm_None	This algorithm does not apply.
Security	SymmetricSignatureAlgorithm_HMAC-SHA1	A keyed hash which is defined in https://tools.ietf.org/html/rfc2104. The hash algorithm is SHA1 and is described in https://tools.ietf.org/html/rfc3174. The URI is http://www.w3.org/2000/09/xmldsig#hmac-sha1. No known exploits exist when using SHA1 with a keyed hash, however, SHA1 was broken in 2017 so use of this algorithm is not recommended.
Security	SymmetricSignatureAlgorithm_HMAC-SHA2-256	A keyed hash used for message authentication which is defined in https://tools.ietf.org/html/rfc2104. The hash algorithm is SHA2 with 256 bits and described in https://tools.ietf.org/html/rfc4634
Security	SymmetricEncryptionAlgorithm_None	This algorithm does not apply.
Security	SymmetricEncryptionAlgorithm_AES128-CBC	The AES encryption algorithm which is defined in http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf. Multiple blocks encrypted using the CBC mode described in http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf. The key size is 128 bits. The block size is 16 bytes. The URI is http://www.w3.org/2001/04/xmlenc#aes128-cbc.
Security	SymmetricEncryptionAlgorithm_AES256-CBC	The AES encryption algorithm which is defined in http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf. Multiple blocks encrypted using the CBC mode described in http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf. The key size is 256 bits. The block size is 16 bytes. The URI is http://www.w3.org/2001/04/xmlenc#aes256-cbc.
Security	SymmetricEncryptionAlgorithm_AES128-CTR	The AES encryption algorithm which is defined in http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf. Multiple blocks encrypted using the CTR mode described in http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf. The counter block format is defined in https://tools.ietf.org/html/rfc3686. The key size is 128 bits. The block size is 16 bytes. The input nonce length is 4 bytes. The URI is http://opcfoundation.org/UA/security/aes128-ctr.
Security	SymmetricEncryptionAlgorithm_AES256-CTR	The AES encryption algorithm which is defined in http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf. The key size is 256 bits. The block size is 16 bytes. Multiple blocks encrypted using the CTR mode described in http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf. The counter block format is defined in https://tools.ietf.org/html/rfc3686. The key size is 128 bits. The block size is 16 bytes. The input nonce length is 4 bytes. The URI is http://opcfoundation.org/UA/security/aes256-ctr.
Security	AsymmetricSignatureAlgorithm_None	This algorithm does not apply.
Security	AsymmetricSignatureAlgorithm_RSA- PKCS15-SHA1	The RSA signature algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSASSA-PKCS1-v1_5 scheme is used. The hash algorithm is SHA1 and is described in https://tools.ietf.org/html/rfc3174. The URI is http://www.w3.org/2000/09/xmldsig#rsa-sha1. SHA1 was broken in 2017 so this algorithm should not be used.
Security	AsymmetricSignatureAlgorithm_RSA-PKCS15-SHA2-256	The RSA signature algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSASSA-PKCS1-v1_5 scheme is used. The hash algorithm is SHA2 with 256bits and is described in https://tools.ietf.org/html/rfc6234. The URI is http://www.w3.org/2001/04/xmldsig-more#rsa-sha256.
Security	AsymmetricSignatureAlgorithm_RSA-PSS -SHA2-256	The RSA signature algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSASSA-PSS scheme is used. The hash algorithm is SHA2 with 256bits and is described in https://tools.ietf.org/html/rfc6234. The mask generation algorithm also uses SHA2 with 256 bits. The salt length is 32 bytes. The URI is http://opcfoundation.org/UA/security/rsa-pss -sha2-256.
Security	AsymmetricEncryptionAlgorithm_None	This algorithm does not apply.
Security	AsymmetricEncryptionAlgorithm_RSA-PKCS15	The RSA encryption algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSAES-PKCS1-v1_5 scheme is used. The URI is http://www.w3.org/2001/04/xmlenc#rsa-1_5. The RSAES-PKCS1-v1_5 scheme has known weaknesses and is not recommended.
Security	AsymmetricEncryptionAlgorithm_RSA-OAEP-SHA1	The RSA encryption algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSAES-OAEP scheme is used. The hash algorithm is SHA1 and is described in https://tools.ietf.org/html/rfc6234. The mask generation algorithm also uses SHA1. The URI is http://www.w3.org/2001/04/xmlenc#rsa-oaep. No known exploits exist when using SHA1 with RSAES-OAEP, however, SHA1 was broken in 2017 so use of this algorithm is not recommended.
Security	AsymmetricEncryptionAlgorithm_RSA-OAEP-SHA2-256	The RSA encryption algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSAES-OAEP scheme is used. The hash algorithm is SHA2 with 256 bits and is described in https://tools.ietf.org/html/rfc6234. The mask generation algorithm also uses SHA2 with 256 bits. The URI is http://opcfoundation.org/UA/security/rsa-oaep-sha2-256.
Security	KeyDerivationAlgorithm_None	This algorithm does not apply.
Security	KeyDerivationAlgorithm_P-SHA1	The P_SHA-1 pseudo-random function defined in https://tools.ietf.org/html/rfc4346. The URI is http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha1. No known exploits exist when using SHA1 with P-SHA-1, however, SHA1 was broken in 2017 so use of this algorithm is not recommended.
Security	KeyDerivationAlgorithm_P-SHA2-256	The P_SHA256 pseudo-random function defined in https://tools.ietf.org/html/rfc5246. The URI is http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha256.
Security	CertificateSignatureAlgorithm_None	This algorithm does not apply.
Security	CertificateSignatureAlgorithm_RSA-PKCS15-SHA2-256	The RSA signature algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSASSA-PKCS1-v1_5 scheme is used. The hash algorithm is SHA2 with 256bits and is described in https://tools.ietf.org/html/rfc6234. The SHA2 algorithm with 384 or 512 bits may be used instead of SHA2 with 256 bits. The URI is http://www.w3.org/2001/04/xmldsig-more#rsa-sha256.
Security	CertificateSignatureAlgorithm_RSA-PKCS15-SHA1	The RSA signature algorithm which is defined in https://tools.ietf.org/html/rfc3447. The RSASSA-PKCS1-v1_5 scheme is used. The hash algorithm is SHA1 and is described in https://tools.ietf.org/html/rfc3174. The URI is http://www.w3.org/2000/09/xmldsig#rsa-sha1. SHA1 was broken in 2017 so this algorithm should not be used. The SHA2 algorithm with 244, 256, 384 or 512 bits may be used instead of SHA1. The SHA2 algorithm is described in https://tools.ietf.org/html/rfc6234.
Security	SecurtyPolicy_None_Limits	DerivedSignatureKeyLength: 0
Security	Aes128-Sha256-RsaOaep_Limits	-> DerivedSignatureKeyLength: 256 bits -> MinAsymmetricKeyLength: 2048 bits -> MaxAsymmetricKeyLength: 4096 bits -> SecureChannelNonceLength: 32 bytes
Security	Basic256Sha256_Limits	-> DerivedSignatureKeyLength: 256 bits -> MinAsymmetricKeyLength: 2048 bits -> MaxAsymmetricKeyLength: 4096 bits -> SecureChannelNonceLength: 32 bytes
Security	Aes256-Sha256-RsaPss_Limits	-> DerivedSignatureKeyLength: 256 bits -> MinAsymmetricKeyLength: 2048 bits -> MaxAsymmetricKeyLength: 4096 bits -> SecureChannelNonceLength: 32 bytes
Security	Basic128Rsa15_Limits	-> DerivedSignatureKeyLength: 128 bits -> MinAsymmetricKeyLength: 1024 bits -> MaxAsymmetricKeyLength: 2048 bits -> SecureChannelNonceLength: 16 bytes
Security	Basic256_Limits	-> DerivedSignatureKeyLength: 192 bits -> MinAsymmetricKeyLength: 1024 bits -> MaxAsymmetricKeyLength: 2048 bits -> SecureChannelNonceLength: 32 bytes

Table 12 describes protocol and encoding related features that can be profiled. These features are defined in detail in OPC 10000-6. It is recommended that Servers and Clients support as many of these options as possible for greatest interoperability.

Table 12 – Protocol and Encoding

Category	Title	Description
Server	Protocol Reverse Connect Server	Support reverse connectivity by sending a ReverseHello message to a Client. The reverse connect procedure can be applied to several transports as specified in UA Part 6 and shall be supported for all of these that are available in a Server.
Server	Protocol Configuration	Allow administration of the Endpoints and the port number used by the Endpoints.
Client	Protocol Reverse Connect Client	Support reverse connectivity by accepting Reverse Hello messages from Servers and establish a Secure Channel if the URI of the Server is accepted by Client or Client user. The reverse connect procedure can be applied to several transports as specified in UA Part 6 and shall be supported for all of these transports that are supported by the Client.
Transport	Protocol UA TCP	Support the UA TCP transport protocol as defined in UA Part 6.
Transport	Protocol HTTPS	Support the HTTPS protocol as defined in UA Part 6.
Transport	Protocol Web Sockets	Support the WebSocket protocol (WSS) with at least one of the sub-protocols defined in UA Part 6.
Transport	UA Secure Conversation	Support UA Secure Conversation specified in UA Part 6.
Transport	UA Binary Encoding	Support UA Binary Encoding. Values of these data types are encoded in compact binary formats, contiguously and without tagging. I.e. the receiver is assumed to understand the structure it is decoding.
Transport	UA SOAP-XML Encoding	Support Soap V1.2 based Xml Encoding as defined in UA Part 6. The XML elements include all information necessary to convert it back into OPC UA structures of any language.
Transport	JSON Reversible Encoding	Support reversible JSON Encoding as defined in UA Part 6. The JSON object includes all information necessary to convert it back into OPC UA structures of any language.

5.4 Information Model and AddressSpace related features

Table 13 describes base features related items that can be profiled. For additional information about these items, please refer to OPC 10000-3, OPC 10000-5 and OPC 10000-6. Servers with a larger resource capacity would support most of this functionality, but smaller resource constraint Server may omit some of this functionality. Many Clients would utilize some of this functionality and more robust Clients would utilize most of this functionality.

Table 13 – Base Information

Category	Title	Description
Server	Base Info Core Structure	The Server supports the Server Object, ServerCapabilities and supports the OPC UA AddressSpace structure.
Server	Base Info Server Capabilities	The Server supports publishing of the Server limitation in the ServerCapabilities, including MaxArrayLength, MaxStringLength, MaxNodePerRead, MaxNodesPerWrite, MaxNodesPerSubscription and MaxNodesPerBrowse.
Server	Base Info Progress Events	The Server exposes if generation of Progress events for long running service calls such as HistoryRead or Query is supported. If it is listed as supported in ServerCapabilities, than the actual events are verified.
Server	Base Info Diagnostics	The Server supports the collection of diagnostic information. The EnabledFlag in the ServerDiagnostics Object can be set TRUE and in that case all static and dynamic Objects and Variables for diagnostic data as defined in UA Part 5 are supported.
Server	Base Info System Status	The Server supports generating SystemStatusChangeEventType indicating shutdown of the Server (SourceNode=Server).
Server	Base Info Estimated Return Time	Server supports the EstimatedReturnTime Property. It indicates the time at which the Server is expected to have a ServerStatus.State of RUNNING_0. Clients can use this information to govern the reconnect logic.
Server	Base Info System Status Underlying System	The Server supports generating SystemStatusChangeEventType indicating changes to an Underlying System (SourceNode = Server). This event can also be used to indicate that the OPC UA Server has underlying systems.
Server	Base Info Device Failure	The Server supports generating DeviceFailureEventType indicating changes to individual devices in an underlying system.
Server	Base Info GetMonitoredItems Method	The Server supports obtaining subscription information via GetMonitoredItems Method on the Server object.
Server	Base Info ResendData Method	Support the standard Method ResendData (defined in UA Part 5) to get the latest value of the monitored items of a Subscription.
Server	Base Info Type System	The Server exposes a Type System with DataTypes, ReferenceTypes, ObjectTypes and VariableTypes including all of the OPC UA (namespace 0) types that are used by the Server, as defined in Part 5. Items that are defined in Namespace 0 but are defined in other specification parts are tested as part of the other information models.
Server	Base Info Custom Type System	The Server supports custom types (i.e. types that are derived from well-known ObjectTypes, VariableTypes, ReferenceTypes or DataTypes). Supporting this conformance unit requires that the custom types with their full inheritance tree are exposed in the AddressSpace.
Server	Base Info Model Change	The Server supports ModelChange Event and NodeVersion Property for all Nodes that the server allows Model changes for.
Server	Base Info Placeholder Modelling Rules	The Server supports defining custom Object or Variables that include the use of OptionalPlaceholder or MandatoryPlaceholder modelling rules.
Server	Base Info SemanticChange	The Server supports SemanticChangeEvent for some Properties. This includes setting the SemanticChange Bit in the status when a semantic change occurs, such as a change in the engineering unit associated with a value.
Server	Base Info EventQueueOverflow EventType	The Server supports the EventQueueOverflowEventType as defined in Part 4.
Server	Base Info OptionSet	The Server supports the VariableType OptionSet.
Server	Base Info ValueAsText	The Server supports the Property ValueAsText for enumerated DataTypes.
Server	Base Info Engineering Units	The Server supports defining Variables that include the Engineering Units Property. This property makes use of the EUInformation data structure. This structure by default represents the UN/CEFACT "Codes for Units of Measurement". If a different EU representation is required then the EUInformation.namespaceUri will indicate the alternate namespace.
Server	Base Info Selection List	The Server supports Variables of the SelectionListType VariableType.
Server	Base Info FileType Base	The Server supports the FileType Object (see Part 5). File writing may be restricted.
Server	Base Info FileType Write	The Server supports the FileType Object, including writing of files. Also included is the support of user access control on FileType Object.
Server	Base Info RequestServerStateChange Method	The Server supports the RequestServerStateChange Method.
Server	Base Info State Machine Instance	Support instances of the StateMachineType or a sub-type in the AddressSpace. Generate Events when significant state changes occur. At least one GeneratesEvent Reference exists to define the Event(s) triggered on state changes.
Server	Base Info Finite State Machine Instance	Support instances of the FiniteStateMachineType or a sub-type in the AddressSpace.
Server	Base Info Available States and Transitions	Support the Properties AvailableStates and AvailableTransitions defined for the FiniteStateMachineType.
Client	Base Info Client Basic	The Client uses the defined OPC UA AddressSpace. Access or provide access to Server information like the Server's state, BuildInfo, capabilities, Namespace Table and Type Model.
Client	Base Info Client Honour Operation Limits	The Client shall honour Server limits described in ServerCapabilites Object of Server.
Client	Base Info Event Processing	The Client is able to subscribe for and process base OPC UA Events.
Client	Base Info Client System Status	The Client makes use of SystemStatusChangeEventType to detect server shutdowns.
Client	Base Info Client Estimated Return Time	Client uses the EstimatedReturnTime Property to govern the reconnect logic.
Client	Base Info Client System Status Underlying System	The Client makes use of SystemStatusChangeEventType to detect changes to an Underlying System (SourceNode = Server).
Client	Base Info Client Device Failure	The Client makes use of DeviceFailureEventType to detect failed devices in underlying systems
Client	Base Info Client Progress Events	The Client makes use of ProgressEvents, including checking for their support.
Client	Base Info Client Diagnostics	The Client provides interactive or programmatic access to the Server's diagnostic information.
Client	Base Info Client Type Programming	The Client programmatically process instances of Objects or Variables by using their type definitions. This includes custom DataTypes, ObjectTypes and VariableTypes.
Client	Base Info Client Type Pre-Knowledge	The Client shall interoperate with Servers that do not expose OPC UA Types in AddressSpace.
Client	Base Info Client Remote Nodes	The Client can access Nodes that have an extended NodeID that reference a Server different then the orginating Server. It is acceptable that the Server configuration information be pre-configured on the Client.
Client	Base Info Client Change Events	The Client processes ModelChangeEvents to detect changes in the Server's OPC UA AddressSpace and take appropriate action for a given change.
Client	Base Info Client GetMonitoredItems Method	The Client makes use of GetMonitoredItems Method to recover for communication interruptions and/or to recover subscription information.
Client	Base Data Client ResendData Method	The Client makes use of ResendData Method to fetch the last value of the data monitored items.
Client	Base Info Client Selection List	The Client uses and understands Variables of the SelectionListType VariableType.
Client	Base Info Client FileType Base	The Client can access a FileType Object to transfer a file from the Server to the Client. This includes large files.
Client	Base Info Client FileType Write	The Client can access a FileType Object to transfer a file from the Client to the Server. This includes large files.
Client	Base Info Client RequestServerStateChange	The Client can invoke the RequestServerStateChange Method.
Client	Base Info Client State Machine Instance	Use instances of the StateMachineType or a sub-type. Monitor either the CurrentState component Variable of the instance or the Events triggered as effect of state changes. Use Methods when defined for the StateMachineType to affect the state.
Client	Base Info Client Finite State Machine Instance	Use instances of the FinitStateMachineType or a sub-type. Monitor either the CurrentState component Variable of the instance or the Events triggered as effect of state changes.
Client	Base Info Client Available States and Transitions	Use the Properties AvailableStates and AvailableTransitions when exposed by a Server.

Table 14 describes Address Space Model information related items that can be profiled. The details of these model items are defined in OPC 10000-3 and OPC 10000-5. This includes Server Facets that describe what a Server exposes and Client Facets that describe what a Client consumes.

Table 14 – Address Space Model

Category	Title	Description
Server	Address Space Base	Support the NodeClasses with their Attributes and References as defined in Part 3. This includes for instance: Object, ObjectType, Variable, VariableType, References and DataType.
Server	Address Space Atomicity	Support setting the NonatomicRead and NonatomicWrite flags in the AccessLevelEx Attribute for Variable Nodes to indicate whether Read or Write operations can be performed in atomic manner. If the flags are set to '1', atomicity cannot be assured.
Server	Address Space Full Array Only	Support setting the WriteFullArrayOnly flag in the AccessLevelEx Attribute for Variable Nodes of non-scalar data types to indicate whether write operations for an array can be performed with an IndexRange.
Server	Address Space Events	Support OPC UA AddressSpace elements for generating Event notifications. This includes at least one Node with an EventNotifier Attribute set to True (Server Node).
Server	Address Space Complex Data Dictionary	Support structured DataTypes with a Data Dictionary. Note that V1.04 of OPC UA Part 3 specifies a simplified approach using the new DataTypeDefinition Attribute. The "Address Space DataTypeDefinition Attribute" Conformance Unit requires support of the DataTypeDefinition Attribute. Support of a DataDictionary will be deprecated in one of the next OPC UA versions.
Server	Address Space DataTypeDefinition Attribute	Support structured DataTypes and expose the meta data and encoding information with a StructureDefinitionType via the DataTypeDefinition Attribute.
Server	Address Space Method	Support Method Nodes.
Server	Address Space Notifier Hierarchy	Supports using the HasNotifier reference to build a hierarchy of Object Nodes that are notifiers with other notifier Object Nodes.
Server	Address Space Source Hierarchy	Supports hierarchies of event sources where each hierarchy roots in an Object Node that is a notifier. The HasEventSource Reference is used to relate the Nodes within a hierarchy. If Conditions are supported, the hierarchy shall include HasCondition References.
Server	Address Space WriteMask	Supports WriteMask indicating the write access availability for all attributes, including not supported attributes.
Server	Address Space UserWriteMask	Supports UserWriteMask indicating the write access availability for all attributes for the given user, including not supported attributes. Support includes at least two levels of users.
Server	Address Space UserWriteMask Multilevel	Supports UserWriteMask indicating the write access availability for all attributes for the given user, including not supported attributes. This includes supporting multiple levels of access control for all nodes in the system.
Server	Address Space User Access Level Full	Implements User Access Level security, this includes supporting multiple levels of access control for Variable nodes in the system. This includes an indication of read, write, Historical read and Historical write access to the Value Attribute.
Server	Address Space User Access Level Base	Implements User Access Level Security for Variable nodes, this includes at least two users in the system. This includes an indication of read, write, historical read and Historical write access to the value attribute
Client	Address Space Client Base	Uses and understands the NodeClasses with their Attributes and behaviour as defined in Part 3. This includes for instance: Object, ObjectType, Variable, VariableType, References and DataType. This includes treating BrowseNames and String NodeIds as case sensitive.
Client	Address Space Client Atomicity	Access the NonatomicRead or NonatomicWrite flags in the AccessLevelEx Attribute of Variable Nodes to determine whether Read or Write operations can be performed in atomic manner. This information will typically be shown to a user for further action.
Client	Address Space Client Full Array Only	Access the WriteFullArrayOnly flag in the AccessLevelEx Attribute of Variable Nodes with non-scalar data types to determine whether writing to an array with an IndexRange is allowed.
Client	Address Space Client Complex Data Dictionary	Uses and understands arbitrary structured DataTypes via Data Dictionary. Note that V1.04 of OPC UA Part 3 specifies a simplified approach using the new DataTypeDefinition Attribute. The "Address Space Client DataTypeDefinition Attribute" Conformance Unit requires support of the DataTypeDefinition Attribute.
Client	Address Space Client DataTypeDefinition Attribute	Uses and understands arbitrary structured DataTypes where the meta data and encoding information are exposed with the StructureDefinitionType via the DataTypeDefinition Attribute.
Client	Address Space Client Notifier Hierarchy	Uses hierarchy of Object Nodes that are notifiers to detect specific areas where the Client can subscribe for Events.
Client	Address Space Client Source Hierarchy	Detect and use the hierarchy of event sources exposed for specific Object Nodes that are event notifiers.

Table 15 describes Data Access information model related items that can be profiled. The details of this model are defined in OPC 10000-8. Servers could expose this information model and Clients could utilize this information model.

Table 15 – Data Access

Category	Title	Description
Server	Data Access DataItems	Provide Variables of DataItemType or one of its subtypes. Support the StatusCodes specified in Part 8. Support of optional Properties (e.g. "InstrumentRange") shall be verified during certification testing and will be shown in the Certificate.
Server	Data Access AnalogItems	Support AnalogItemType Variables with corresponding Properties. The support of optional properties will be listed.
Server	Data Access PercentDeadband	Support PercentDeadband filter when monitoring AnalogItemType Variables.
Server	Data Access Semantic Changes	Support semantic changes of AnalogItemType items (EURange Property and/or EngineeringUnits Property). Support semantic change StatusCode bits where appropriate.
Server	Data Access TwoState	Support TwoStateDiscreteType Variables with corresponding Properties.
Server	Data Access MultiState	Support MultiStateDiscreteType Variables with corresponding Properties.
Server	Data Access MultiStateValueDiscrete	Support MultiStateValueDiscreteType Variables with corresponding Properties.
Server	Data Access ArrayItemType	Provide Variables of ArrayItemType or one of its subtypes (YArrayItemType, XYArrayItemType, ImageArrayType, CubeArrayType and NDimensionArrayType). The supported subtypes will be listed. Support for this type includes supporting all of the mandatory properties including AxisInformation.
Server	Data Access Complex Number	Supports the Complex Number data type. This data type is available for any variable types that do not have other explicit restrictions.
Server	Data Access DoubleComplex Number	Supports the DoubleComplex Number data type. This data type is available for any variable types that do not have other explicit restrictions.
Client	Data Access Client Basic	Understand the DataAccess Variable Types. Make use of the standard Properties if applicable.
Client	Data Access Client AnalogItems	Understand AnalogItemType Variables with corresponding Properties.
Client	Data Access Client TwoState	Understand TwoStateDiscreteType Variables with corresponding Properties.
Client	Data Access Client MultiState	Understand MultiStateDiscreteType Variables with corresponding Properties.
Client	Data Access Client MultiStateValueDiscrete	Understand MultiStateValueDiscreteType Variables with corresponding Properties.
Client	Data Access Client Deadband	Use PercentDeadband to filter value changes of AnalogItemType Variables.
Client	Data Access Client SemanticChange	Recognize the semantic change bit in the StatusCode while monitoring items and take proper action. Typically, the Client has to re-read Properties that define type-specific semantic like the EURange and EngineeringUnits Properties.

Table 16 describes Alarm and Conditions information model related items that can be profiled. The details of this model are defined in OPC 10000-9. Servers that deal with Alarm and Conditions would expose this information model and Clients that process Alarms and Conditions would utilize this information model.

Table 16 – Alarms and Conditions

Category	Title	Description
Server	A & C Basic	Supports Alarm & Condition model ConditionType.
Server	A & C Enable	Supports Enable and Disable Methods.
Server	A & C Refresh	Supports ConditionRefresh Method and the concept of a refresh.
Server	A & C Refresh2	Supports ConditionRefresh2 Method and the concept of a monitored item based refresh.
Server	A & C Instances	Support exposing of A&C Condition instances in the AddressSpace.
Server	A & C ConditionClasses	Supports multiple Condition classes for grouping and filtering of Alarms.
Server	A & C Condition Sub-Classes	Support assigning multiple Condition sub-classes for grouping and filtering of Alarms.
Server	A & C Acknowledge	Supports the Acknowledge concept, Acknowledge Method, and AcknowledgeableCondition Type.
Server	A & C Confirm	Supports the concept of Confirm and the Confirm Method.
Server	A & C Comment	Supports the concept of Comments and the AddComment Method.
Server	A & C Alarm	Supports the mandatory features of the AlarmCondition Type.
Server	A & C Alarm Metrics	Support the collection of alarm metrics data as defined in UA Part 9. This implies one of more instances of the AlarmMetricsType.
Server	A & C Branch	Support for branching of Condition Types and any subtypes, such as AcknowledgeableConditionType and AlarmConditionType etc.
Server	A & C Shelving	Support the concept of shelving and the TimedShelve, OneShotShelve and Unshelve Methods.
Server	A & C Suppression	Support the SuppressedState.
Server	A & C Suppression by Operator	Support the Suppress and UnSuppress Methods to allow an operator control over the SuppressedState.
Server	A & C Silencing	Support the concept of silencing and the Silence Method.
Server	A & C Out Of Service	Support the OutOfService state and the OutOfService Method.
Server	A & C On-Off Delay	Support the OnDelay and OffDelay Properties to eliminate nuisance Alarms.
Server	A & C Re-Alarming	Support the ReAlarmTime and ReAlarmRepeatCount Properties that define automatic re-annunciation of Alarms in certain conditions.
Server	A & C First in Group Alarm	Support the "FirstInGroup" elements for an Alarm, indicating which Alarm of a group was the trigger.
Server	A & C Audible Sound	Support the AudibleSound Property. This Property contains the sound file that is to be played if an audible Alarm is to be generated.
Server	A & C Exclusive Level	Supports Exclusive Level Alarm type.
Server	A & C Exclusive Limit	Supports Exclusive Limit Alarms. A Server that supports this must support at least one of the sub-types: Level, Deviation or RateofChange.
Server	A & C Exclusive Deviation	Supports Exclusive Deviation Alarm type.
Server	A & C Exclusive RateOfChange	Supports Exclusive RateOfChange Alarm type.
Server	A & C Non-Exclusive Limit	Supports Non-Exclusive Limit Alarms. A Server that supports this must support at least one of the sub-types: Level, Deviation or RateofChange.
Server	A & C Non-Exclusive Level	Supports Non-Exclusive Level Alarm type.
Server	A & C Non-Exclusive Deviation	Supports Non-Exclusive Deviation Alarm type.
Server	A & C Non-Exclusive RateOfChange	Supports Non-Exclusive RateOfChange Alarm type.
Server	A & C Discrete	Supports Discrete Alarm types.
Server	A & C OffNormal	Supports OffNormalAlarmType.
Server	A & C SystemOffNormal	Supports SystemOffNormalAlarmType.
Server	A & C Trip	Supports Trip Alarm type.
Server	A & C Discrepancy	Supports Discrepancy Alarm type.
Server	A & C Dialog	Supports DialogConditionType including Respond Method.
Server	A & C CertificateExpiration	Supports CertificateExpirationAlarmType.
Server	A & E Wrapper Mapping	The Server uses the COM A&E mapping specified in the annex of Part 9 to map OPC-COM Events to A&C Events. This includes Condition Class mapping.
Client	A & C Basic Client	Uses the Alarm & Condition model ConditionType.
Client	A & C Enable Client	Uses Enable and Disable Methods.
Client	A & C Refresh Client	Uses ConditionRefresh Method and the concept of a refresh.
Client	A & C Refresh2 Client	Uses ConditionRefresh2 Method and the concept of a monitored item based refresh.
Client	A & C Instances Client	Uses A&C Condition instances when they are exposed in the AddressSpace.
Client	A & C ConditionClasses Client	Uses Condition classes to group Alarms.
Client	A & C Condition Sub-Classes Client	Uses Condition sub-classes to group or filter Alarms.
Client	A & C Acknowledge Client	Understands the Acknowledge concept and the AcknowledgeableCondition Type, and uses the Acknowledge Method if requested.
Client	A & C Confirm Client	Understands the concept of confirming Conditions and uses the Confirm Method.
Client	A & C Comment Client	Understands the concept of Comments and uses the AddComment Method.
Client	A & C Alarm Client	Understands the concept of Alarms and uses the mandatory features of the AlarmCondition Type,
Client	A & C Alarm Metrics Client	Understand and use Alarm metrics data as defined in UA Part 9. This implies discovery of instances of the AlarmMetricsType that can exist anywhere in the HasNotifier hierarchy.
Client	A & C Branch Client	Can make use of and process Condition Branches, including all actions associated with previous Condition instances.
Client	A & C Shelving Client	Understand the shelving model and use the TimedShelve, OneShotShelve and Unshelve Methods.
Client	A & C Suppression Client	Understand the SuppressedState model.
Client	A & C Suppression by Operator Client	Use the Suppress and UnSuppress Methods to allow an operator control over the SuppressedState.
Client	A & C Silencing Client	Understand the SilencedState model and use the Silence Method.
Client	A & C Out Of Service Client	Understand the OutOfServiceState model and use the OutOfService Method.
Client	A & C On-Off Delay Client	Uses the OnDelay and OffDelay Properties to eliminate nuisance Alarms.
Client	A & C Re-Alarming Client	Understand and use the ReAlarmTime and ReAlarmRepeatCount Properties. Configure the ReAlarmTime Property for automatic re-annunciation of an Alarm. Note that configuration is only possible for Servers that expose Alarm instances.
Client	A & C First in Group Alarm Client	Use the "FirstInGroup" elements for an Alarm to determine which Alarm of a group was the trigger.
Client	A & C Audible Sound Client	Use the AudibleSound Property and - if reported - play the sound file.
Client	A & C Exclusive Level Client	Uses Exclusive Level Alarms.
Client	A & C Exclusive Limit Client	Uses Exclusive Limit Alarms. Requires that at least one of the sub-types be used.
Client	A & C Exclusive Deviation Client	Uses Exclusive Deviation Alarms.
Client	A & C Exclusive RateOfChange Client	Uses Exclusive RateOfChange Alarms.
Client	A & C Non-Exclusive Level Client	Uses Non-Exclusive Level Alarms.
Client	A & C Non-Exclusive Limit Client	Uses Non-Exclusive Limit Alarms. Requires that at least one of the sub-types be used.
Client	A & C Non-Exclusive Deviation Client	Uses Non-Exclusive Deviation Alarms.
Client	A & C Non-Exclusive RateOfChange Client	Uses Non-Exclusive RateOfChange Alarms.
Client	A & C Discrete Client	Uses Discrete Alarm types.
Client	A & C OffNormal Client	Uses OffNormalAlarmType.
Client	A & C SystemOffNormal Client	Uses SystemOffNormalAlarmType.
Client	A & C Trip Client	Uses TripAlarmType.
Client	A & C Discrepancy Client	Uses Discrepancy Alarm type.
Client	A & C Dialog Client	Uses DialogConditionType including Respond Method.
Client	A & C CertificateExpiration Client	Uses CertificateExpirationAlarmType.

Table 17 describes Historical Data Access information model related items that can be profiled. The details of this model are defined in OPC 10000-11. Servers that support some level of historical data would expose this information model and Clients that utilize historical data would utilize this information model.

Table 17 – Historical Access

Category	Title	Description
Server	Historical Access Read Raw	General support for basic historical access, reading raw data using the ReadRawModifiedDetails structure. Where the time range is specified using a start time, stop time and number of values (a minimum of two of the three parameters must be provided) and the ReadModified flag is set to False.
Server	Historical Access Data Max Nodes Read Continuation Point	Supports enough continuation points to cover the number of supported points indicated in the MaxNodesPerHistoryReadData Server OperationLimits Property for historical data access.
Server	Historical Access Time Instance	Supports reading historical data at a specified instance in time using the ReadAtTimeDetails structure.
Server	Historical Access Aggregates	Supports reading one or more Aggregates of historical values of Variables using the ReadProcessedDetails structure. At least one of the Aggregates described in Part 13 must be supported.
Server	Historical Access Insert Value	Supports inserting historical values of Variables.
Server	Historical Access Delete Value	Supports deleting historical values of Variables.
Server	Historical Access Update Value	Supports updating historical values of Variables.
Server	Historical Access Replace Value	Supports replacing historical values of Variables.
Server	Historical Access Modified Values	Supports maintaining old values for historical data that have been updated and the retrieval of these values using the ReadRawModifiedDetails structure (ReadModified flag set to true).
Server	Historical Access Annotations	Supports the entry and retrieval of Annotations for historical data. The retrieval is accomplished using the standard historical read raw functionality (ReadRawModifiedDetails). The entry uses the standard historical update (UpdateStructureDataDetails) functionality.
Server	Historical Access ServerTimestamp	Supports providing a ServerTimestamp (as well as the default SourceTimestamp).
Server	Historical Access Structured Data Read Raw	Supports ReadRawModified historical access for structured data. Supporting the structure for an annotation is not considered supporting generic structured data.
Server	Historical Access Structured Data Time Instance	Supports historical access for structured data. Supporting ReadAtTimeDetails for structured data. Supporting the structure for an annotation is not considered supporting generic structured data.
Server	Historical Access Structured Data Insert	Supports historical access for structured data. Inserting Structured data. Supporting the structure for an annotation is not considered supporting generic structured data.
Server	Historical Access Structured Data Delete	Supports historical access for structured data. Delete of existing data. Supporting the structure for an annotation is not considered supporting generic structured data.
Server	Historical Access Structured Data Update	Supports historical access for structured data. Updates of existing data. Supporting the structure for an annotation is not considered supporting generic structured data.
Server	Historical Access Structured Data Replace	Supports replacing structured historical data. Supporting the structure for an annotation is not considered supporting generic structured data.
Server	Historical Access Structured Data Read Modified	Supports maintaining old values for historical structured data that have been updated and the retrieval of these values. Using the ReadRawModifiedDetails structure (ReadModified flag set to true) for structured data. Supporting the structure for an annotation is not considered supporting generic structured data.
Server	Historical Access Events	Supports the retrieval of historical Events using the ReadEventDetails structure. This includes support for simple filtering of Events. The Event fields that are stored are server specific, but at least the mandatory fields of BaseEventType are required.
Server	Historical Access Event Max Events Read Continuation Point	Supports enough continuation points to cover the number of supported Event reads indicated in the MaxNodesPerHistoryReadEvents Server OperationLimits Property for Historical Event access.
Server	Historical Access Insert Event	Supports inserting historical Events.
Server	Historical Access Update Event	Supports updating historical Events.
Server	Historical Access Replace Event	Supports replacing historical Events.
Server	Historical Access Delete Event	Supports deleting of historical Events.
Client	Historical Access Client Browse	Uses the View Service Set to discover Nodes with historical data.
Client	Historical Access Client Read Raw	Uses the HistoryRead Service to read raw historical data using the ReadRawModifiedDetails Structure (ReadModified Flag set to False).
Client	Historical Access Client Read Modified	Uses the HistoryRead Service to read modified historical data using the ReadRawModifiedDetails Structure (ReadModified Flag set to True).
Client	Historical Access Client Read Aggregates	Uses the HistoryRead Service to read Aggregated historical data. This includes using at least one of the Aggregates defined in Part 13.
Client	Historical Access Client Structure Data Raw	Uses the HistoryRead Service to read raw historical data using the ReadRawModifiedDetails Structure (ReadModified Flag set to False) for structured data.
Client	Historical Access Client Structure Data Read Modified	Uses the HistoryRead Service to read modified structured historical data using the ReadRawModifiedDetails Structure (ReadModified Flag set to True).
Client	Historical Access Client Structure Data Insert	Uses the HistoryUpdate Service to insert historical data values for structured data.
Client	Historical Access Client Structure Data Delete	Uses the HistoryUpdate Service to delete historical data values for structured data.
Client	Historical Access Client Structure Data Update	Uses the HistoryUpdate Service to update historical data values for structured data.
Client	Historical Access Client Structure Data Replace	Uses the HistoryUpdate Service to replace historical data values for structured data.
Client	Historical Access Client Structure Data Time Instance	Reads historical data at a specified instance in time for structured data. Using the ReadAtTimeDetails structure.
Client	Historical Access Client Read Events	Uses the HistoryRead Service to read historical Event data using the ReadEventDetails Structure.
Client	Historical Access Client Event Inserts	Uses the HistoryUpdate Service to insert historical Events.
Client	Historical Access Client Event Updates	Uses the HistoryUpdate Service to update historical Events.
Client	Historical Access Client Event Replaces	Uses the HistoryUpdate Service to replace historical Events.
Client	Historical Access Client Event Deletes	Uses the HistoryUpdate Service to delete historical Events.
Client	Historical Access Client Data Insert	Uses the HistoryUpdate Service to insert historical data values.
Client	Historical Access Client Data Delete	Uses the HistoryUpdate Service to delete historical data values.
Client	Historical Access Client Data Update	Uses the HistoryUpdate Service to update historical data values.
Client	Historical Access Client Data Replace	Uses the HistoryUpdate Service to replace historical data values.
Client	Historical Access Client Annotations	Enters and retrieves Annotations of historical data. The retrieval is accomplished using the standard historical read raw functionality (ReadRawModifiedDetails). The entry uses the standard Historical Update (UpdateStructureDataDetails) functionality.
Client	Historical Access Client Time Instance	Reads historical data at a specified instance in time using the ReadAtTimeDetails structure.
Client	Historical Access Client Server Timestamp	Uses the ServerTimestamp (as well as the default SourceTimestamp), if it is provided by the Server.

Table 18 describes Aggregate related items that can be profiled. Servers that support the Aggregates would expose this functionality and Clients that utilize Aggregates would implement some of this functionality.

Table 18 – Aggregates

Category	Title	Description
Server	Aggregate Master Configuration	Supports an AggregateConfigurationType Object as part of the HistoricalServerCapabilities (defined in UA Part 11).
Server	Aggregate Historical Configuration	Supports at least one AggregateConfigurationType Object. AggregateConfigurationType Objects occur as part of an HistoricalConfiguration Object, allowing Variable specific configurations.
Server	Aggregate – Interpolative	Supports the Interpolative Aggregate for Historical access.
Server	Aggregate – Average	Supports the Average Aggregate for Historical access.
Server	Aggregate – TimeAverage	Supports the TimeAverage Aggregate for Historical access.
Server	Aggregate – TimeAverage2	Supports the TimeAverage2 Aggregate for Historical access.
Server	Aggregate – Total	Supports the Total Aggregate for Historical access.
Server	Aggregate – Total2	Supports the Total2 Aggregate for Historical access.
Server	Aggregate – Minimum	Supports the Minimum Aggregate for Historical access.
Server	Aggregate – MinimumActualTime	Supports the MinimumActualTime Aggregate for Historical access.
Server	Aggregate – Minimum2	Supports the Minimum2 Aggregate for Historical access.
Server	Aggregate – MinimumActualTime2	Supports the MinimumActualTime2 Aggregate for Historical access.
Server	Aggregate – Maximum	Supports the Maximum Aggregate for Historical access.
Server	Aggregate – MaximumActualTime	Supports the MaximumActualTime Aggregate for Historical access.
Server	Aggregate – Maximum2	Supports the Maximum2 Aggregate for Historical access.
Server	Aggregate – MaximumActualTime2	Supports the MaximumActualTime2 Aggregate for Historical access.
Server	Aggregate – Range	Supports the Range Aggregate for Historical access.
Server	Aggregate – Range2	Supports the Range2 Aggregate for Historical access.
Server	Aggregate – Count	Supports the Count Aggregate for Historical access.
Server	Aggregate – DurationInStateZero	Supports the DurationInStateZero Aggregate for Historical access.
Server	Aggregate – DurationInStateNonZero	Supports the DurationInStateNonZero Aggregate for Historical access.
Server	Aggregate – NumberOfTransitions	Supports the NumberOfTransitions Aggregate for Historical access.
Server	Aggregate – Start	Supports the Start Aggregate for Historical access.
Server	Aggregate – StartBound	Supports the StartBound Aggregate for Historical access.
Server	Aggregate – End	Supports the End Aggregate for Historical access.
Server	Aggregate – EndBound	Supports the EndBound Aggregate for Historical access.
Server	Aggregate – Delta	Supports the Delta Aggregate for Historical access.
Server	Aggregate – DeltaBounds	Supports the DeltaBounds Aggregate for Historical access.
Server	Aggregate – DurationGood	Supports the DurationGood Aggregate for Historical access.
Server	Aggregate – DurationBad	Supports the DurationBad Aggregate for Historical access.
Server	Aggregate – PercentGood	Supports the PercentGood Aggregate for Historical access.
Server	Aggregate – PercentBad	Supports the PercentBad Aggregate for Historical access.
Server	Aggregate – WorstQuality	Supports the WorstQuality Aggregate for Historical access.
Server	Aggregate – WorstQuality2	Supports the WorstQuality2 Aggregate for Historical access.
Server	Aggregate – AnnotationCount	Supports the AnnotationCount Aggregate for Historical access.
Server	Aggregate – StandardDeviationSample	Supports the StandardDeviationSample Aggregate for Historical access.
Server	Aggregate – VarianceSample	Supports the VarianceSample Aggregate for Historical access.
Server	Aggregate – StandardDeviationPopulation	Supports the StandardDeviationPopulation for Historical access.
Server	Aggregate – VariancePopulation	Supports the VariancePopulation for Historical access.
Server	Aggregate – Custom	The Server supports custom Aggregates for Historical access that do not have standard tests defined. These Aggregates are list as untested by this ConformanceUnit.
Server	Aggregate Subscription – Filter	Supports Aggregate subscription filters which requires at least one of the defined Aggregates is supported as defined in Part 13.
Server	Aggregate Subscription – Interpolative	Supports subscription filter for the Interpolative Aggregate.
Server	Aggregate Subscription – Average	Supports subscription filter for the Average Aggregate.
Server	Aggregate Subscription – TimeAverage	Supports subscription filter for the TimeAverage Aggregate.
Server	Aggregate Subscription – TimeAverage2	Supports subscription filter for the TimeAverage2 Aggregate.
Server	Aggregate Subscription – Total	Supports subscription filter for the Total Aggregate.
Server	Aggregate Subscription – Total2	Supports subscription filter for the Total2 Aggregate.
Server	Aggregate Subscription – Minimum	Supports subscription filter for the Minimum Aggregate.
Server	Aggregate Subscription – MinimumActualTime	Supports subscription filter for the MinimumActualTime Aggregate.
Server	Aggregate Subscription – Minimum2	Supports subscription filter for the Minimum2 Aggregate.
Server	Aggregate Subscription – MinimumActualTime2	Supports subscription filter for the MinimumActualTime2 Aggregate.
Server	Aggregate Subscription – Maximum	Supports subscription filter for the Maximum Aggregate.
Server	Aggregate Subscription – MaximumActualTime	Supports subscription filter for the MaximumActualTime Aggregate.
Server	Aggregate Subscription – Maximum2	Supports subscription filter for the Maximum2 Aggregate.
Server	Aggregate Subscription – MaximumActualTime2	Supports subscription filter for the MaximumActualTime2 Aggregate.
Server	Aggregate Subscription – Range	Supports subscription filter for the Range Aggregate.
Server	Aggregate Subscription – Range2	Supports subscription filter for the Range2 Aggregate.
Server	Aggregate Subscription – Count	Supports subscription filter for the Count Aggregate.
Server	Aggregate Subscription – DurationInStateZero	Supports subscription filter for the DurationInStateZero Aggregate.
Server	Aggregate Subscription – DurationInStateNonZero	Supports subscription filter for the DurationInStateNonZero Aggregate.
Server	Aggregate Subscription – NumberOfTransitions	Supports subscription filter for the NumberOfTransitions Aggregate.
Server	Aggregate Subscription – Start	Supports subscription filter for the Start Aggregate.
Server	Aggregate Subscription – StartBound	Supports subscription filter for the StartBound Aggregate.
Server	Aggregate Subscription – End	Supports subscription filter for the End Aggregate.
Server	Aggregate Subscription – EndBound	Supports subscription filter for the EndBound Aggregate.
Server	Aggregate Subscription – Delta	Supports subscription filter for the Delta Aggregate.
Server	Aggregate Subscription – DeltaBounds	Supports subscription filter for the DeltaBounds Aggregate.
Server	Aggregate Subscription – DurationGood	Supports subscription filter for the DurationGood Aggregate.
Server	Aggregate Subscription – DurationBad	Supports subscription filter for the DurationBad Aggregate.
Server	Aggregate Subscription – PercentGood	Supports subscription filter for the PercentGood Aggregate.
Server	Aggregate Subscription – PercentBad	Supports subscription filter for the PercentBad Aggregate.
Server	Aggregate Subscription – WorstQuality	Supports subscription filter for the WorstQuality Aggregate.
Server	Aggregate Subscription – WorstQuality2	Supports subscription filter for the WorstQuality2 Aggregate.
Server	Aggregate Subscription – AnnotationCount	Supports subscription filter for the AnnotationCount Aggregate.
Server	Aggregate Subscription – StandardDeviationSample	Supports subscription filter for the StandardDeviationSample Aggregate.
Server	Aggregate Subscription – VarianceSample	Supports subscription filter for the VarianceSample Aggregate.
Server	Aggregate Subscription – StandardDeviationPopulation	Supports subscription filter for the StandardDeviationPopulation Aggregate.
Server	Aggregate Subscription – VariancePopulation	Supports subscription filter for the VariancePopulation Aggregate.
Server	Aggregate Subscription – Custom	The Server supports subscribing to custom Aggregates that do not have standard tests defined. These Aggregates are listed as untested by this ConformanceUnit.
Client	Aggregate – Client Usage	Uses Historical access to Aggregate which requires at least one of the defined Aggregates is supported as defined in Part 13.
Client	Aggregate – Client Interpolative	Uses Historical access to the Interpolative Aggregate.
Client	Aggregate – Client Average	Uses Historical access to the Average Aggregate.
Client	Aggregate – Client TimeAverage	Uses Historical access to the TimeAverage Aggregate.
Client	Aggregate – Client TimeAverage2	Uses Historical access to the TimeAverage2 Aggregate.
Client	Aggregate – Client Total	Uses Historical access to the Total Aggregate.
Client	Aggregate – Client Total2	Uses Historical access to the Total2 Aggregate.
Client	Aggregate – Client Minimum	Uses Historical access to the Minimum Aggregate.
Client	Aggregate – Client MinimumActualTime	Uses Historical access to the MinimumActualTime Aggregate.
Client	Aggregate – Client Minimum2	Uses Historical access to the Minimum2 Aggregate.
Client	Aggregate – Client MinimumActualTime2	Uses Historical access to the MinimumActualTime2 Aggregate.
Client	Aggregate – Client Maximum	Uses Historical access to the Maximum Aggregate.
Client	Aggregate – Client MaximumActualTime	Uses Historical access to the MaximumActualTime Aggregate.
Client	Aggregate – Client Maximum2	Uses Historical access to the Maximum2 Aggregate.
Client	Aggregate – Client MaximumActualTime2	Uses Historical access to the MaximumActualTime2 Aggregate.
Client	Aggregate – Client Range	Uses Historical access to the Range Aggregate.
Client	Aggregate – Client Range2	Uses Historical access to the Range2 Aggregate.
Client	Aggregate – Client Count	Uses Historical access to the Count Aggregate.
Client	Aggregate – Client DurationInStateZero	Uses Historical access to the DurationInStateZero Aggregate.
Client	Aggregate – Client DurationInStateNonZero	Uses Historical access to the DurationInStateNonZero Aggregate.
Client	Aggregate – Client NumberOfTransitions	Uses Historical access to the NumberOfTransitions Aggregate.
Client	Aggregate – Client Start	Uses Historical access to the Start Aggregate.
Client	Aggregate – Client StartBound	Uses Historical access to the StartBound Aggregate.
Client	Aggregate – Client End	Uses Historical access to the End Aggregate.
Client	Aggregate – Client EndBound	Uses Historical access to the EndBound Aggregate.
Client	Aggregate – Client Delta	Uses Historical access to the Delta Aggregate.
Client	Aggregate – Client DeltaBounds	Uses Historical access to the DeltaBounds Aggregate.
Client	Aggregate – Client DurationGood	Uses Historical access to the DurationGood Aggregate.
Client	Aggregate – Client DurationBad	Uses Historical access to the DurationBad Aggregate.
Client	Aggregate – Client PercentGood	Uses Historical access to the PercentGood Aggregate.
Client	Aggregate – Client PercentBad	Uses Historical access to the PercentBad Aggregate.
Client	Aggregate – Client WorstQuality	Uses Historical access to the WorstQuality Aggregate.
Client	Aggregate – Client WorstQuality2	Uses Historical access to the WorstQuality2 Aggregate.
Client	Aggregate – Client AnnotationCount	Uses Historical access to the AnnotationCount Aggregate.
Client	Aggregate – Client StandardDeviationSample	Uses Historical access to the StandardDeviationSample Aggregate.
Client	Aggregate – Client VarianceSample	Uses Historical access to the VarianceSample Aggregate.
Client	Aggregate – Client StandardDeviationPopulation	Uses Historical access to the StandardDeviationPopulation Aggregate.
Client	Aggregate – Client VariancePopulation	Uses Historical access to the VariancePopulation Aggregate.
Client	Aggregate – Client Custom Aggregates	The Client can make use of all custom Aggregates in the list of Aggregates, via Historical access, exposed by the Server. This includes displaying or utilizing the data in some manner.
Client	Aggregate Subscription – Client Filter	Subscribes for data using Aggregate filters which requires at least one of the Aggregates defined in Part 13 is supported.
Client	Aggregate Subscription – Client Interpolative	Subscribes for data using the Interpolative Aggregate filter.
Client	Aggregate Subscription – Client Average	Subscribes for data using the Average Aggregate filter.
Client	Aggregate Subscription – Client TimeAverage	Subscribes for data using the TimeAverage Aggregate filter.
Client	Aggregate Subscription – Client TimeAverage2	Subscribes for data using the TimeAverage2 Aggregate filter.
Client	Aggregate Subscription – Client Total	Subscribes for data using the Total Aggregate filter.
Client	Aggregate Subscription – Client Total2	Subscribes for data using the Total2 Aggregate filter.
Client	Aggregate Subscription – Client Minimum	Subscribes for data using the Minimum Aggregate filter.
Client	Aggregate Subscription – Client MinimumActualTime	Subscribes for data using the MinimumActualTime Aggregate filter.
Client	Aggregate Subscription – Client Minimum2	Subscribes for data using the Minimum2 Aggregate filter.
Client	Aggregate Subscription – Client MinimumActualTime2	Subscribes for data using the MinimumActualTime2 Aggregate filter.
Client	Aggregate Subscription – Client Maximum	Subscribes for data using the Maximum Aggregate filter.
Client	Aggregate Subscription – Client MaximumActualTime	Subscribes for data using the MaximumActualTime Aggregate filter.
Client	Aggregate Subscription – Client MaximumActualTime2	Subscribes for data using the MaximumActualTime2 Aggregate filter.
Client	Aggregate Subscription – Client Maximum2	Subscribes for data using the Maximum2 Aggregate filter.
Client	Aggregate Subscription – Client Range	Subscribes for data using the Range Aggregate filter.
Client	Aggregate Subscription – Client Range2	Subscribes for data using the Range2 Aggregate filter.
Client	Aggregate Subscription – Client Count	Subscribes for data using the Count Aggregate filter.
Client	Aggregate Subscription – Client DurationInStateZero	Subscribes for data using the DurationInStateZero Aggregate filter.
Client	Aggregate Subscription – Client DurationInStateNonZero	Subscribes for data using the DurationInStateNonZero Aggregate filter.
Client	Aggregate Subscription – Client NumberOfTransitions	Subscribes for data using the NumberOfTransitions Aggregate filter.
Client	Aggregate Subscription – Client Start	Subscribes for data using the Start Aggregate filter.
Client	Aggregate Subscription – Client StartBound	Subscribes for data using the StartBound Aggregate filter.
Client	Aggregate Subscription – Client End	Subscribes for data using the End Aggregate filter.
Client	Aggregate Subscription – Client EndBound	Subscribes for data using the EndBound Aggregate filter.
Client	Aggregate Subscription – Client Delta	Subscribes for data using the Delta Aggregate filter.
Client	Aggregate Subscription – Client DeltaBounds	Subscribes for data using the DeltaBounds Aggregate filter.
Client	Aggregate Subscription – Client DurationGood	Subscribes for data using the DurationGood Aggregate filter.
Client	Aggregate Subscription – Client DurationBad	Subscribes for data using the DurationBad Aggregate filter.
Client	Aggregate Subscription – Client PercentGood	Subscribes for data using the PercentGood Aggregate filter.
Client	Aggregate Subscription – Client PercentBad	Subscribes for data using the PercentBad Aggregate filter.
Client	Aggregate Subscription – Client WorstQuality	Subscribes for data using the WorstQuality Aggregate filter.
Client	Aggregate Subscription – Client WorstQuality2	Subscribes for data using the WorstQuality2 Aggregate filter.
Client	Aggregate Subscription – Client AnnotationCount	Subscribes for data using the AnnotationCount Aggregate filter.
Client	Aggregate Subscription – Client StandardDeviationSample	Subscribes for data using the StandardDeviationSample Aggregate filter.
Client	Aggregate Subscription – Client VarianceSample	Subscribes for data using the VarianceSample Aggregate filter.
Client	Aggregate Subscription – Client StandardDeviationPopulation	Subscribes for data using the StandardDeviationPopulation Aggregate filter.
Client	Aggregate Subscription – Client VariancePopulation	Subscribes for data using the VariancePopulation Aggregate filter.
Client	Aggregate Subscription – Client Custom Aggregates	The Client supports subscribing to all custom Aggregates in the list of Aggregates exposed by the Server. This includes displaying or utilizing the data in some manner.

Table 19 describes auditing related items that can be profiled. Most full function Servers would support these features, although some resource constrained Servers may not provide this functionality. Clients that are security aware or are used to support security logging would support these features

Table 19 – Auditing

Category	Title	Description
Server	Auditing Base	Support AuditEvents. The list of supported AuditEvents shall be verified during certification testing and will be shown in the certification test result. Base AuditEvents are defined in Part 3 and in Part 5.
Client	Auditing Client Audit ID	Client supports generating AuditEvents ids and providing them to Servers.
Client	Auditing Client Subscribes	The Client supports subscribing for AuditEvents and storing / processing them in a secure manner.

Table 20 describes Redundancy related items that are profiled. Servers that support redundancy would support appropriate ConformanceUnits based on the type of redundancy they support. Clients that are capable of handling redundancy would support the appropriate ConformanceUnits based of the type of redundancy they support.

Table 20 – Redundancy

Category	Title	Description
Server	Redundancy Server	Supports Server based redundancy.
Server	Redundancy Server Transparent	Supports transparent Server redundancy.
Client	Redundancy Client	Client supports Client redundancy. Clients that support Client redundancy can failover to another Client (requires some out of band communication).
Client	Redundancy Client Switch	Clients supporting this ConformanceUnit monitor the redundancy status for non-transparent redundancy Servers and switch to the backup Server when they recognize a change in server status.

Table 21 describes items for a Global Discovery Server (GDS). Servers that act as a GDS would support these ConformanceUnits.

Table 21 – Global Discovery Server

Category	Title	Description
Global Directory Service	GDS Application Directory	Supports the Directory Object with all Methods like RegisterApplication and QueryServers.
Global Directory Service	GDS Query Applications	Supports the QueryApplications Method on the Directory Object specified in Part 12.
Global Directory Service	GDS LDS-ME Connectivity	The GDS can be configured to use specific LDS-ME installations for semi-automatic application registration for all Servers on a subnet.
Global Directory Service	GDS Certificate Manager Pull Model	This Conformance Unit requires support of the complete Information Model and Services for Certificate management including the Pull Model as specified in Part 12.
Global Directory Service	GDS Certificate Manager Push Model	This Conformance Unit requires use of the complete Information model and Services for the Certificate management Push Model as specified in UA Part 12.
Global Directory Service	GDS Key Credential Service Pull Model	This Conformance Unit requires support of the complete Information Model and Services for KeyCredential Pull Management as specified in UA Part 12.
Global Directory Service	GDS Key Credential Service Push Model	This Conformance Unit requires use of the complete Information model and Services for KeyCredential Push Management as specified in UA Part 12.
Global Directory Service	GDS Authorization Service Server	This Conformance Unit requires support of AuthorizationServiceType Objects as specified in Part 12. UA Clients use the RequestAccessToken Method on these Objects to request an Access Token from an Identity Provider.

5.5 Miscellaneous

The following table describes miscellaneous ConformanceUnits.

Table 22 – Miscellaneous

Category	Title	Description
Server	Documentation – Supported Profiles	The documentation includes a description of the profiles supported by the product. This description includes the level of Certification testing the product has passed.
Server	Documentation – Multiple Languages	The documentation is available in multiple languages. The results of this conformance unit include the list of supported languages.
Server	Documentation – Users Guide	The application includes documentation that describes the available functionality provided by the application. For Servers it includes a summary of all functionality provided by the Server.
Server	Documentation – On-line	The documentation provided by the application is available in electronic format as part of the application. The electronic documentation, could be a WEB page, installed document or CD/DVD, but in all case it can be accessed from the application or from a link installed with the application.
Server	Documentation – Installation	The application includes installation instructions that are sufficient to easily install the application. This includes descriptions of any and all possible configuration items. Instructions for loading or configuring security related items such as Application Instance Certificates.
Server	Documentation – Trouble Shooting Guide	The application includes documentation that describes typical problems a user may encounter and actions that the user could perform to resolve the problem. It could also describe tip, tricks or other actions that could help a user diagnose or fix a problem. It could also describe tools or other items that can be used in diagnosing or repairing problems. The actual Trouble Shooting Guide can be part of other documentation, but should be complete enough to provide useful information to a novice user.
Client	Documentation Client – Supported Profiles	The documentation includes a description of the profiles supported by the product. This description includes any software certificates that describes the level of Certification testing the product has passed.
Client	Documentation Client – Multiple Languages	The documentation is available in multiple languages. The results of this conformance unit include the list of supported languages.
Client	Documentation Client – Users Guide	The application includes documentation that describes the available functionality provided by the application. For client applications this includes any operator restrictions or general functionality that the client application makes use of.
Client	Documentation Client – On-line	The documentation provided by the application is available in electronic format as part of the application. The electronic documentation could be a WEB page, installed document or CD/DVD, but in all cases it can be accessed from the application or from a link installed with the application.
Client	Documentation Client – Installation	The application includes installation instructions that are sufficient to easily install the application. This includes descriptions of any and all possible configuration items. Instructions for loading or configuring security related items such as Application Instance Certificates.
Client	Documentation Client – Trouble Shooting Guide	The application includes documentation that describes typical problems a user may encounter and actions that the user could perform to resolve the problem. It could also describe tips, tricks or other actions that could help a user diagnose or fix a problem. It could also describe tools or other items that can be used in diagnosing or repairing problems. The actual Trouble Shooting Guide can be part of other documentation, but should be complete enough to provide useful information to a novice user.
Security	Best Practice – Timeouts	The user is able to configure reasonable timeouts for Secure Channels, sessions and subscriptions to limit Denial of Service and resource consumption issues (see Part 2 for additional details).
Security	Best Practice – Strict Message Handling	The application assures that messages that are illegally or incorrectly formed are rejected with appropriate error code or appropriate actions as specified in Part 4 and Part 6.
Security	Best Practice – Random Numbers	All random numbers that are required for security use appropriate cryptographic library based random number generators.
Security	Best Practice – Administrative Access	The Server and Client allow for appropriate restriction of access to administrative personnel. This includes multiple levels of administrative access on platforms that support multiple administrative roles (such as Windows or Linux).
Security	Best Practice – Alarm Handling	A Server should restrict critical alarm functionality to users that have the appropriate rights to perform these actions. This would include disabling or alarms, shelving of alarms and generation of dialog messages. It would also include other security related functionality such maintaining appropriate timeouts for shelving and dialogs and preventing an overload of dialog messages.
Security	Best Practice – Audit Events	Subscriptions for Audit Events are restricted to authorized personnel. A Server may also reject a Subscription for Audit Events that is not over a Secure Channel if one is available.
Security	Best Practice – Audit Events Client	Audit tracking system connects to a Server using a Secure Channel and under the appropriate administrative rights to allow access to Audit Events.