# Description Nullable reference types are now enabled once, in `common.props`, and every project in the repository builds warning-clean with them. **Configuration** - `<Nullable>enable</Nullable>` lives in `common.props`. All per-project `<Nullable>` settings are removed: 178 project files (enable, annotations, and the `disable` in the three Aot test projects). - 419 per-file `#nullable enable`/`restore` directives and the 4 `#nullable disable` directives are removed. - Kept on purpose: - The 5 `<auto-generated>` schema files (`UANodeSet.cs`, `UA Type Dictionary.cs`, `OPCBinarySchema.cs`, `SecuredApplication.cs`, `PInvokeHelper.cs`) keep `#nullable enable`. The compiler ignores the project setting in generated code, so the directive is required there. - `tests/Opc.Ua.Interop.LegacyPeer` keeps `disable`. It builds against the 1.5.378 packages and does not import the repository props. - `docs/DeveloperGuide.md` and `.github/copilot-instructions.md` now describe the central setting. **Migration** (the 43 unset and 13 annotations-only projects, roughly 10k diagnostics) - **Production code: annotated at the declarations.** Covers `tools/Opc.Ua.SourceGeneration.Core`, `src/Opc.Ua.Lds.Server` and the LDS sample. - Members, parameters and returns are nullable where null actually flows. - Null-check helpers carry `[NotNullWhen]` (`IsNull`, `IsValidXmlName`, `IsMethodTypeDesign`). - `CoreUtils.Format`, `Utils.Format`, `ITemplateWriter.WriteLine` take `params object?[]`. `Template.AddReplacement` takes `string?` (rendering already skips null replacements). - `IRegisteredServerStore.RegisterAsync` returns `Task<RegistrationEntry?>`: it returns null when a registration is removed. - Dereferences backed by an invariant (for example, the validated model) use `!`, so runtime behaviour is unchanged. - **Behavioural changes in production code** (small, deliberate): - `NodeSetToModelDesign` throws `InvalidOperationException` when the file is not a NodeSet. Before, it threw a NullReferenceException on the next line. - `ModelDesignValidator` starts its lookup tables empty instead of null. A redundant `if (m_nodes == null) return;` guard is gone. - **Test code: minimal annotations.** - `?` on values that can be null, `!` where the test asserts non-null. - `= null!` for fixture members assigned in SetUp. - `TryGetStructure<T>(out T? x)` where the inferred `T?` broke the `IEncodeable` constraint. - A few redundant `== null` checks on structs (`NodeId`, `ArrayOf<T>`) folded into the adjacent `IsNull`/`Count` checks. **Notes for reviewers** - The diff is large (~1,500 files) but almost entirely mechanical: `?`, `!` and directive removal. The non-annotation changes are listed above. - Known follow-up, not done here: `IModelDesign.Namespaces/TargetNamespace/NamespaceUris` stay non-nullable even though the validator returns null before it loads a dictionary. Making them nullable would ripple through every generator call site. ## Related Issues - Fixes #4439 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. The "no new warnings" box covers net10.0 and net48: full non-incremental builds of `UA.slnx`, `tools/SourceGeneration.slnx`, `tools/MigrationAnalyzer.slnx` and the Aot test projects finished with 0 warnings and 0 errors under the repository's warnings-as-errors settings. net9.0 and net8.0 also had no nullable diagnostics, but they were not rebuilt after the final fixes. Tests have not been run locally yet. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Robotics samples
Three runnable samples covering the two robotics companion models this stack implements: OPC 40010 Robotics, which describes a robot, and the draft OPC UA — Robot Intent, which commands one.
| Sample | What it is | What it shows |
|---|---|---|
MinimalRobotServer |
A server for a two-robot cell | OPC 40010 topology, RSL/GPOS positioning, and an OpenUSD representation of the whole cell |
IntentEnabledRobot |
A server for one collaborative arm | The Robot Intent command surface end to end, plus an OpenUSD representation you can drive |
IntentViewerClient |
A client with a 3-D viewport | Clicking a target in the OpenUSD viewport and watching the arm execute the intent |
All three are non-production demonstration code. --insecure in the command lines below means an
unsecured endpoint with blanket certificate acceptance; it exists so the samples start without a PKI
dance and must never be used anywhere real.
MinimalRobotServer
A self-contained server exposing a robot cell: two KUKA-style six-axis arms on mobile platforms,
their axes, power trains and safety states modelled per OPC 40010, their positions modelled per
OPC 10000-210 RSL and OPC 10000-211 GPOS, and the whole thing published as an OpenUSD representation
whose assets the server serves over the Part 5 FileType.
dotnet run --project samples/Robotics/MinimalRobotServer -- --host localhost --port 62830
Then render it live with the connector tool:
dotnet run --project tools/Opc.Ua.OpenUsd.Connector -- `
--server opc.tcp://localhost:62830/MinimalRobotServer `
--fetch-assets ./stage --insecure --view
See MinimalRobotServer/README.md for the full walkthrough, the
address-space layout and the USD binding contract.
IntentEnabledRobot
One stationary UR5e-style collaborative arm with an offset wrist — deliberately a different kinematic family from the cell sample's arms — on a workbench with four target locations.
Where MinimalRobotServer shows you what a robot is, this shows you how to ask it to do something:
the server declares an IntentControllerType with its capabilities, frames, tool centre point,
locations, axes, outputs, kinematic description and safety state, and executes submitted intents against
a simulated motion kernel with real kinematics. Every intent is tracked on a Part 10 program instance, so
a motion that takes a minute outlives the Call that started it.
dotnet run --project samples/Robotics/IntentEnabledRobot -- --host localhost --port 62840
IntentViewerClient
The reason the intent surface exists, made visible. The client connects, discovers
Server/RobotIntent/Controllers, reads the controller's capabilities, opens the OpenUSD viewport on the
served stage, and streams live joint and tool-centre-point values into the picture. Click one of the
four target pucks on the bench and the client submits a linear-move intent to that location, then
tracks the resulting IntentOperation to a terminal state while the arm animates on screen.
Start the server first, then:
dotnet run --project samples/Robotics/IntentViewerClient -- `
--server opc.tcp://localhost:62840/IntentEnabledRobot `
--insecure --view
It also runs headless, which is how it is exercised in CI and how it works on a machine without the native OpenUSD payload:
dotnet run --project samples/Robotics/IntentViewerClient -- `
--server opc.tcp://localhost:62840/IntentEnabledRobot --insecure
In headless mode the four targets are offered as a console menu instead of as prims to click, and everything downstream of the pick — submission, tracking, cancellation, command authority — is identical.
Agent-driven pallet stacking
IntentViewerClient --mcp is the agent entry point for the intent sample. Start IntentEnabledRobot,
then run the viewer with MCP over stdio for a headless agent or over HTTP when the OpenUSD viewport is
open. The agent and the human viewer share the same OPC UA SampleSession, so MCP calls, operation
monitoring, payload outputs and OpenUSD live bindings all describe the same robot.
A well-behaved agent starts with discovery, not motion:
robotics_list_controllersrobotics_read_controllerto inspectSupportedIntents,SupportedFacets, frames, tools, locations and outputsrobotics_read_stateto verifyReady, mode, safety and current command ownerrobotics_request_controlbefore any command
The pallet demonstration deliberately proves refusal handling before the successful plan. Another
session holds command authority, the agent submits a move, receives Accepted=false with
Failure=ControlNotOwned, reads the enum and message, releases or waits for the owner, requests
authority itself, and only then replans. It must not retry the refused submission blindly.
The stacking plan uses the published model seam. Parts begin under /World/Payloads/BinParts, the
held part is driven by HeldPartPosition and HeldPartVisible, and completed slots are driven by
PayloadSlotNNFilled. The viewer and connector do not contain pallet logic; they just render the
server-published bindings. The agent can pick from Bin, move the held part to row/layer coordinates
near Fixture, place it, then submit a mission that repeats the sequence for the next slot.
Agents must not assume:
- command authority is implicit;
- a supported tool means the controller supports every intent kind;
SupportedIntents,SupportedFacets, safety state or queue depth can be skipped;- a refusal should be retried without changing the plan;
- a submitted operation is done until
robotics_wait_operationor controller state says so.
How a click becomes an intent
The viewport is rendered by the optional Opc.Ua.OpenUsd.Connector.Viewer
assembly. A pick becomes an intent the same way whichever path resolves it: the viewer raises
UsdViewOptions.PrimPicked, and the client maps that prim path to the LocationType node the server
published under the controller's Locations folder, builds an intent naming that location, and submits it.
UsdViewOptions.PickMode selects how the pick is resolved:
| Mode | Behaviour |
|---|---|
Auto (default) |
Renderer-backed pointer picking first, falling back to the command prim only when renderer picking is unavailable |
Renderer |
Renderer-backed pointer picking only |
CommandPrim |
Watch UsdViewOptions.CommandPrimPath (default /World/IntentCommand) and raise the callback when its targetPrim changes |
Renderer-backed picking works: the OpenUSD viewer owns input handling, DPI scaling, physical-pixel
conversion and stale-revision retry, and reports hits through the host callback. Misses do not submit
intents. The gaps this used to work around were filed as marcschier/openusd-dotnet issues #1, #5, #8,
#9, #10 and #11, and all are fixed in the package version this sample ships against. The command-prim
path remains supported, and is what makes picking work headlessly — which is also how an
MCP agent drives the same robot.
Prerequisites
- .NET SDK 10.0.
- The
--viewoption needs the optional viewer assembly and its native OpenUSD payload, which is supported onwin-x64,linux-x64, andosx-arm64. A RID-less build or publish on a supported host uses that host's payload; publish with an explicit RID for another platform. Everything else, including both servers and the headless client, runs on every platform the stack supports.
See also
- Robotics developer guide — the OPC 40010 model these servers expose.
- Robot Intent — the command surface, its lifecycle and its safety boundary.
- OpenUSD — the binding, the connector tool and the viewport.
- Relative Spatial Location and Global Positioning — how the cell sample places its robots.