Security token id XY has timed out

[Matthias-SE]

Hi,

I have an OPC client (opcua-asyncio v1.1.5) that is intended to run 24/7. However, after some time it crashes with Security token id XY has timed out. Now, I'm trying to figure out what can cause this error.

Observations

The following table shows some examples when the client crashed:

start client	sec token timed out	duration start to time out	error message	duration / num sec tokens
Apr 15 13:44:39	Apr 17 09:14:44	1d 19h 30m 5s	asyncua.ua.uaerrors._base.UaError: Security token id 58 has timed out (2025-04-17 08:45:29.118000+00:00 < 2025-04-17 09:14:44.543009+00:00)	$\frac{1\text{d } 19\text{h } 30\text{m}}{58} = 45\text{m}$
Apr 22 08:29:00	Apr 22 11:29:01	0d 3h 0m 1s	asyncua.ua.uaerrors._base.UaError: Security token id 4 has timed out (2025-04-22 10:59:50.662000+00:00 < 2025-04-22 11:29:01.335757+00:00)	$\frac{0\text{d } 3\text{h } 0\text{m}}{4} = 45\text{m}$
Apr 23 09:31:15	Apr 23 15:31:16	0d 6h 0m 1s	asyncua.ua.uaerrors._base.UaError: Security token id 8 has timed out (2025-04-23 15:02:06.897000+00:00 < 2025-04-23 15:31:16.481017+00:00)	$\frac{0\text{d } 6\text{h } 0\text{m}}{8} = 45\text{m}$
May 05 15:32:01	May 06 14:47:04	0d 23h 15m 3s	asyncua.ua.uaerrors._base.UaError: Security token id 31 has timed out (2025-05-06 14:18:07.362000+00:00 < 2025-05-06 14:47:04.654193+00:00)	$\frac{0\text{d } 23\text{h } 15\text{m}}{31} = 45\text{m}$

Interpretation

From above observations and the OPC spec 5.5.2.1 I learned:

• Lifetime of security token is one hour in my case
• after 75% (i.e. 45min) the client requests a new security token (duration my client was running / num seucrity tokens = 45 min)
• client shall accept messages even for expired security tokens for up to 25%, i.e. as if the token has an extended lifetime of 1h 15min

However, there's still something I cannot make sense of. Let's consider for example the client I have started at Apr 22 08:29:00:

• the 4th security token timed out
• the assertion was 2025-04-22 10:59:50.662000+00:00 < 2025-04-22 11:29:01.335757+00:00

token id	createdAT	75% (request new token)	100%	125% (accept expired token)
1	08:29	09:14	09:29	09:44
2	09:14	09:59	10:14	10:29
3	09:59	10:44	10:59	11:14
4	10:44	11:29	11:44	11:59

Looking at the source-code I have expected that the timestamp 10:59 appears in the last column. But it appears in the 3rd row and 3rd column. Furthermore, why does the 4th token timed-out at 11:29? From my understanding, at 11:29 the next sec. token should have been requested -- and in particular has nothing to do with expiration.

Questions

• Is there anything wrong with my interpretation?
• In the first table one sees that in the time-out error t_1 < t_2 the time-difference t_2 - t_1 is always 30 minutes +- some seconds. Why is that the case? Where are those 30 minutes coming from?
• Can one in general state that this is a server issue or could there be also a problem on client side? (I have other OPC clients (also v1.1.5) connected to other OPC servers where I have not observed those errors yet)
• Does the configured time format of the client machine and server machine matter? Do they need to be synchronized?

I am grateful for any help.

BR,
Matthias