Loading header...

OPC UA - Secure Industrial Data Modeling

OPC UA stands for Open Platform Communications Unified Architecture. It is used to move industrial data between PLCs, SCADA systems, historians, edge gateways, MES systems, cloud services, and digital twins.

OPC UA is different from fieldbus protocols like PROFIBUS or cyclic I/O protocols like PROFINET and EtherNet/IP. Its main strength is secure, structured, self-describing data.

Learning Objectives

By the end of this lesson, you should be able to:

  • Explain OPC UA as an industrial information modeling and communication standard.
  • Identify clients, servers, nodes, namespaces, and subscriptions.
  • Understand why certificates and security policies matter.
  • Distinguish OPC UA from Modbus, PROFINET, and EtherNet/IP.
  • Recognize common use cases in SCADA, historians, and edge systems.
  • Troubleshoot browsing, trust, endpoint, and namespace problems.

OPC UA Architecture

flowchart LR classDef field fill:#dcfce7,stroke:#16a34a,color:#14532d classDef server fill:#dbeafe,stroke:#2563eb,color:#1e3a5f classDef client fill:#fef9c3,stroke:#ca8a04,color:#713f12 classDef cloud fill:#fee2e2,stroke:#dc2626,color:#7f1d1d PLC["PLC / Machine"]:::field UAS["OPC UA Server\nAddress space and security"]:::server SCADA["SCADA Client"]:::client HIST["Historian Client"]:::client EDGE["Edge Gateway / Cloud Connector"]:::cloud PLC --> UAS UAS <--> SCADA UAS <--> HIST UAS <--> EDGE

Many devices now include an OPC UA server directly. In other systems, a gateway reads field protocols like Modbus or PROFINET and exposes a clean OPC UA model upward.

Address Space: Nodes, Namespaces, and Browse Paths

OPC UA data is organized as an address space. A client browses the server to discover what data exists.

Concept Meaning
Node Any object, variable, method, type, or view
NodeId Unique identifier for a node
Namespace Prevents naming conflicts between models
Variable Data value such as temperature or speed
Object Structured thing such as a machine, motor, or line
Method Callable operation
Reference Relationship between nodes

Example:

Objects
  Machine_01
    Motor_A
      Speed_rpm
      Current_A
      BearingTemp_degC
    Production
      GoodCount
      RejectCount

This is much richer than a flat list of registers.

Read, Write, and Subscribe

sequenceDiagram participant C as OPC UA Client participant S as OPC UA Server C->>S: Open secure channel S-->>C: Server certificate and endpoint selected C->>S: Create session C->>S: Browse Objects/Machine_01 S-->>C: Node list C->>S: Subscribe Speed_rpm and Current_A loop On change or publishing interval S-->>C: DataChange notification end

Subscriptions are more efficient than repeated polling because the server reports changes according to monitored item settings.

Security Model

OPC UA was designed with security built in:

Security feature Purpose
Application certificates Identify clients and servers
Trust lists Control which applications may connect
Security policies Select signing and encryption algorithms
User authentication Anonymous, username/password, certificate, or external identity
Secure channel Protect messages against tampering and eavesdropping

A common commissioning step is certificate exchange: the client must trust the server certificate, and the server must trust the client certificate if the server requires it.

Sampling, Publishing, and Queues

Subscriptions are controlled by several timing settings. These are easy to confuse.

Setting Meaning
Sampling interval How often the server samples the underlying value
Publishing interval How often the server sends notifications to the client
Queue size How many changes can wait before old values are overwritten
Deadband Minimum change needed before reporting a new value

Worked example:

Sampling interval = 100 ms
Publishing interval = 1000 ms
Queue size = 10
Maximum queued samples per publish = 1000 / 100 = 10

If the queue size were only 1, the client would see the latest value each second but miss intermediate changes. That may be fine for a temperature trend and wrong for a short alarm pulse.

OPC UA vs Field Protocols

Feature OPC UA Modbus TCP PROFINET / EtherNet/IP
Main purpose Structured data exchange Simple register access Real-time machine I/O
Data model Rich nodes and types Registers and coils Device-specific I/O assemblies/modules
Security Built in Limited unless secured externally Depends on profile and network design
Discovery/browse Native browse model Manual register map Engineering-file based
Best location SCADA, edge, IT/OT integration Simple device integration PLC to devices

OPC UA often sits above field protocols. It does not usually replace deterministic I/O networks inside a machine cell.

Worked Example - Gateway Mapping

A gateway reads a Modbus TCP power meter and exposes it through OPC UA.

Modbus register Meaning OPC UA node
30001 Voltage x 10 Meter_01.Voltage_V
30003 Current x 100 Meter_01.Current_A
30005 Active power W Meter_01.Power_W
30009 Energy Wh Meter_01.Energy_Wh

The gateway should also expose engineering units, scaling, quality, and timestamp. That context is the value OPC UA adds.

Namespace Engineering Rules

A useful OPC UA model is not just a folder of tag names. It should preserve meaning so clients can browse it without tribal knowledge.

  • Use stable namespaces and version them when the machine model changes.
  • Keep units, ranges, status, quality, and timestamps with the value.
  • Model real objects such as motors, meters, pumps, conveyors, and lines.
  • Avoid exposing every PLC scratch tag directly to SCADA or cloud systems.
  • Document which nodes are read-only, writable, historical, alarmed, or methods.
  • Test client behavior when the server restarts and sessions must reconnect.

Practical Checks

  • Confirm the endpoint URL, port, and security policy.
  • Verify client and server certificates are trusted.
  • Browse the namespace instead of hardcoding guessed NodeIds.
  • Check data quality and source timestamp, not only the value.
  • Use subscriptions for live data instead of aggressive polling.
  • Document namespace versions when integrating with MES or cloud systems.
  • Disable anonymous access unless it is intentionally allowed on an isolated test system.
  • Check clock synchronization when comparing timestamps between systems.
  • Verify reconnect behavior after certificate renewal or server restart.

Common Mistakes

  • Treating OPC UA as just another register protocol.
  • Ignoring certificates and then disabling security permanently.
  • Hardcoding NodeIds that change between firmware versions.
  • Polling hundreds of tags too quickly instead of using subscriptions.
  • Losing engineering units and quality when mapping from PLC tags.
  • Assuming OPC UA is deterministic enough for fast motion or safety I/O.
  • Treating namespace changes as harmless when clients depend on browse paths.

Summary

OPC UA is the industrial protocol for secure, structured, self-describing data exchange. It is strongest at SCADA, historian, edge, and IT/OT integration layers. It complements field protocols by turning raw device data into browsable nodes with units, quality, timestamps, alarms, events, and security.

Further Reading

Mind Map

mindmap root((OPC UA)) Core concept Secure data model Nodes and namespaces Client server Applications SCADA Historians Edge gateways IT OT integration Calculations Publishing interval Sampling interval Queue size queued = pub/sample Design rules Trust certificates Preserve units Use subscriptions Version namespaces Practical checks Endpoint URL Security policy Data quality Common mistakes Disabling security Hardcoded NodeIds Polling too fast