OPC UA: How Plant Data Actually Moves Between PLCs, SCADA and MES

A plant can have a PLC that knows everything and an MES that knows nothing about it, and the gap between them is almost never a cabling problem. It is a meaning problem. OPC UA exists to close that gap, and on most sites it does, right up until integration testing, when the MES client cannot open a session, the historian is polling 4,000 tags at 100 ms it has no use for, and nobody can say whether DB12.DBD40 is degrees Celsius or bar.

---

What Is OPC UA, and What Does It Actually Standardise?

What is OPC UA, once you strip away the marketing? A platform-independent, service-oriented architecture for industrial data exchange, standardised internationally as IEC 62541 and maintained by the OPC Foundation. Version 1.05 is the current baseline vendors are expected to implement. The OPC UA protocol differs from the fieldbuses you already run by standardising three layers at once: a transport, a set of services (browse, read, write, subscribe, call a method, read history), and an information model that describes what the data means.

The third layer is the whole argument. Strip it away and OPC UA is a slower Modbus with certificates.

A Modbus Register Is a Number. An OPC UA Node Is a Statement.

Pull holding register 40021 off a Modbus TCP slave and you get a 16-bit integer. Everything else, that it is a discharge temperature, scaled 0 to 500 and divided by ten, belonging to compressor K-201, and that it went stale six minutes ago, lives in a spreadsheet or in somebody's memory. Every consumer re-implements that mapping, and the mappings drift apart.

An OPC UA address space is built from nodes. Each node carries a NodeId (a namespace index plus an identifier), a BrowseName, a DisplayName and a NodeClass: eight of them in IEC 62541-3, namely Object, Variable, Method, ObjectType, VariableType, ReferenceType, DataType and View. Nodes are joined by typed References such as HasComponent, HasProperty, Organizes and HasTypeDefinition, and it is the references, not a flat tag list, that make the address space navigable by a machine.

The type definition is where engineering meaning gets attached. A variable typed as AnalogItemType (IEC 62541-8) must carry an EURange property giving the range expected in normal operation, and normally carries EngineeringUnits as an EUInformation structure whose unitId comes from the UNECE Recommendation No. 20 unit codes, under the namespace http://www.opcfoundation.org/UA/units/un/cefact. The unit is an attribute of the node, readable by any OPC UA client without a configuration file.

Every read also returns a DataValue rather than a bare number: the value, a StatusCode, a SourceTimestamp taken where the data originated, and a ServerTimestamp where it was served. That is the difference between a historian that can prove when a batch deviation happened and one that can only prove when it heard about it.

A Modbus register tells you what a number is. An OPC UA node tells you what the number means, how good it is, and when it was true. Only one of those three survives the handover to an MES.

---

What Is the Difference Between OPC UA and OPC DA?

Classic OPC DA moved data over Microsoft COM/DCOM, and that one design decision defines every difference. DCOM tied servers to Windows, negotiated dynamic port ranges that were painful to pass through a firewall, and coupled authentication to Windows domain accounts and launch/activation permissions, which is why a whole category of OPC DA tunnelling products exists to avoid configuring it.

OPC UA replaced that with its own binary transport on one well-known TCP port, platform-independent stacks that run on Linux and controller firmware, and security built into the protocol rather than borrowed from the OS. An OPC DA item is also just a string tag with a value, a quality and a timestamp: no type hierarchy, no methods, no relationships, no history service.

For a brownfield site, OPC DA still works but cannot be extended. If your SCADA already talks OPC DA and you need a read-only feed to a reporting system, a tunneller beats a migration. If you need an MES that understands equipment structure, batch state and OEE across three lines from different builders, OPC DA offers nothing, and the reasoning behind reaching a legacy serial device over Ethernet applies here: decide whether you are extending an interface's life or replacing its purpose.

---

Client/Server: Sessions, Subscriptions and What They Cost the PLC

Client/server is what most people mean when they say OPC UA server. A client discovers endpoints, opens a SecureChannel at the transport layer, then activates a Session with a user identity token. On top of the session it creates Subscriptions, and inside each subscription, MonitoredItems.

Two intervals govern everything, and confusing them is the most common performance mistake in the field. The sampling interval belongs to the MonitoredItem and sets how often the server samples the variable. The publishing interval belongs to the Subscription and sets how often the server sends what changed. Sampling at 50 ms and publishing at 1,000 ms does not give the client 50 ms data; it gives a queue that buffers twenty samples per item or discards the oldest, depending on a DiscardOldest setting nobody touched.

Deadbands are the cheapest optimisation available and the least used. Across a few thousand values, a DataChangeFilter set to 0.5 percent cuts notification traffic by an order of magnitude with no loss a process engineer would notice.

None of this is free for the controller. An OPC UA server embedded in a PLC CPU shares that CPU with the scan. Siemens publishes OPC UA system limits per CPU and firmware version for the S7-1200 and S7-1500 families (Industry Online Support entry 109755846): ceilings in the tens of sessions and subscriptions per CPU, not hundreds. Every consumer that opens its own session spends part of that budget, and communication load is a configurable share of cycle time: push it and scan time rises. Same trade that governs how much work you load onto a PLC and SCADA layer generally.

If SCADA, MES, a historian and an energy dashboard each open their own session to the same PLC, you have not built four integrations. You have built one controller doing four jobs it was not sized for.

---

What Is OPC UA PubSub, and When Does It Beat Client/Server?

OPC UA PubSub is the publish/subscribe model defined in IEC 62541-14, first published in 2020 and reissued as a second edition in 2026, complementing rather than replacing the client/server services in IEC 62541-4. A publisher builds a PublishedDataSet, a DataSetWriter inside a WriterGroup encodes it into a NetworkMessage, and that message goes out with no session, no subscription negotiation and no per-consumer state on the publisher.

Two transport families matter. Datagram transports carry UADP binary NetworkMessages over UDP or directly over Ethernet, including multicast (the IANA-registered IPv4 multicast address for PubSub discovery is 224.0.2.14), the deterministic, low-latency path that pairs with TSN. Broker transports carry the payload over MQTT or AMQP as binary UADP or JSON, what most sites deploy when the destination is a historian or analytics platform.

The architectural case for OPC UA PubSub is fan-out. Client/server load on the publisher scales with the number of consumers; PubSub load does not. One publisher pushing a 200-value dataset every second to an MQTT broker costs the same whether two systems subscribe or twenty.

The tradeoffs are real. PubSub is one-directional: you publish, you do not browse or call methods, so you still need a client/server endpoint for engineering access. Reliability over UDP is whatever the network gives you. Security differs too: instead of a per-session secure channel, PubSub uses group keys from a Security Key Service, one more component to run and get wrong.

For controller-to-controller work, the OPC Foundation's UA FX (Field eXchange) specifications, OPC 10000-80 through 10000-84, add connection management and offline engineering on top of PubSub, certified since November 2024.

---

Comparing the Four Ways Plant Data Actually Moves

---

Is OPC UA Secure? What the Standard Gives You and What You Configure

Yes: the protocol is sound, and the configurations found in the field usually are not. Germany's Federal Office for Information Security (BSI) analysed the specification and the open62541 reference stack and concluded that OPC UA contains no systematic security vulnerabilities, first in 2016 and again in a 2022 update against version 1.04.

The field evidence points the other way. An internet-wide scan published at ACM IMC 2020 by Dahlmanns and colleagues found problematic configurations on 92 percent of reachable OPC UA deployments: missing access control on 24 percent of hosts, deprecated cryptographic primitives on 25 percent, hundreds of devices sharing one certificate. A 2025 study by Yaben and Vasilomanolakis at WTMC found 62 percent of the 1,812 internet-facing OPC UA servers on port 4840 carrying vulnerabilities tied to misconfiguration and abandonment.

Three settings account for most of it.

MessageSecurityMode. None means plaintext on the wire. Sign authenticates and integrity-protects. SignAndEncrypt adds confidentiality. Almost every product ships with a None endpoint enabled so first-boot connection works, and too many plants never remove it. Delete it at commissioning, not at the next audit.

SecurityPolicy. Basic128Rsa15 and Basic256 were deprecated in version 1.04 because SHA-1 is no longer defensible. Basic256Sha256 is the widely interoperable minimum today; Aes256_Sha256_RsaPss is the current recommendation. A device that offers only a deprecated policy is a procurement finding, not a configuration preference.

User identity token. Anonymous, username/password, or X.509 certificate. Anonymous access to a server that permits writes is a direct path from a compromised office PC to a setpoint change.

IEC 62541-2 version 1.05 carries an informative annex mapping OPC UA security functionality onto the ISA/IEC 62443-4-2 component requirements, the cleanest way to answer an auditor. Note what it does not say: OPC UA supplies the primitives, but Security Level (SL 1 to SL 4 in IEC 62443-3-3) is a property of zone and conduit design, not of the OPC UA protocol. In Saudi Arabia, critical-infrastructure operators work to the National Cybersecurity Authority's OTCC-1:2022 controls, which press hard on segmentation and secure remote access; an endpoint published straight from a process cell to an enterprise network fails that review whatever its SecurityPolicy says.

---

Companion Specifications: Where the Semantics Come From

A companion specification is an agreed information model for a domain, built on the base OPC UA types. OPC UA for Machinery supplies the cross-domain identification and machine-list structures the umati community adopted; PackML defines the packaging state machine as UA types; PA-DIM standardises process-instrument data independent of the field protocol underneath; EUROMAP 83 and 84 cover plastics machinery, MDIS subsea, ISA-95 the enterprise-to-control interface itself.

The commercial value is blunt. If two filling machines from two builders both expose OPC UA for Machinery plus PackML, an MES reads identification and state from both with one driver. If they do not, you pay an integrator for two mappings, and again every time either builder changes firmware. Name the companion specification and its version in the purchase order, or you will not get it.

---

A Real-World Scenario: Three Filling Lines and a Week of Lost Commissioning

A beverage plant near Dammam ran three filling lines, each on an S7-1500 CPU with SCADA on a local server, and bought an MES for OEE and batch genealogy. Scoped at four weeks, it produced no data at all in week one.

Failure one: certificate trust. The MES OPC UA client connected, was rejected, and logged BadSecurityChecksFailed. Its application instance certificate had landed in the server's rejected folder, where every OPC UA server puts an unknown certificate on first contact. Nothing moves it to trusted automatically; a human does, or a Global Discovery Server. Two of the three CPUs were fixed in ten minutes once someone opened that directory.

Failure two: hostname. The third line failed with BadCertificateHostNameInvalid. IT had rebuilt the SCADA virtual machine and the DNS name changed, so the client connected by IP while the certificate carried only the old hostname in its SubjectAltName. IEC 62541 requires the ApplicationUri in the ApplicationDescription to match the URI in the certificate, and the endpoint host to appear in SubjectAltName. Regenerating with both cleared it.

Failure three: the one that mattered. With all three lines connected, filler cycle time on line 2 drifted up roughly 4 percent and HMI updates turned sluggish. SCADA, the MES, a historian and an energy dashboard had each opened their own session against the same CPU with their own subscriptions, monitoring the same 900-odd analogue values four times over at 100 ms sampling with no deadbands. The controller was spending real cycle time serving duplicate data.

The fix was architectural, not parametric. One aggregating OPC UA server went on the line edge holding a single session per CPU, feeding the other three consumers: historian and energy dashboard by OPC UA PubSub over MQTT at a one-second publishing interval, the MES over client/server because it needed methods and history. Communication load dropped back, cycle time recovered, and a fifth consumer added six months later cost nothing on the PLC side.

The number of systems that need your data is not the number of sessions your PLC should carry. Aggregate once at the edge, fan out from there.

---

The Commissioning Details That Decide Whether Week One Goes Well

Namespace stability. A NodeId is a namespace index plus an identifier, and the index is valid only for the session in which it was read. Clients must resolve the namespace URI from the NamespaceArray and map it to the current index at connect time. Hard-coded ns=3 breaks the first time someone adds a namespace in the engineering tool, the commonest cause of "it worked yesterday" after a PLC download.

Direction of connection. OPC UA binary uses TCP 4840 by default, one firewall rule instead of DCOM's port ranges, but a well-designed plant opens no inbound port from a DMZ into a process cell. Use Reverse Connect: the server dials outward and sends a ReverseHello, the client establishes the SecureChannel over that socket, and the process cell keeps zero inbound rules, the zone-and-conduit behaviour IEC 62443 and the Gulf OT frameworks ask for.

Time source. SourceTimestamp is only as good as the clock behind it. If controllers are not disciplined to a common NTP or PTP source, batch records will not reconcile across lines, and no MES logic fixes that later.

Buffering across power events. In South Africa, scheduled load shedding removes upstream connectivity on a predictable timetable. Size edge-gateway buffers for the worst realistic outage and confirm the historian backfills through OPC UA HistoryRead rather than leaving a hole in the trend, the same discipline that applies wherever the SCADA layer can go offline while production continues.

Where the model gets built. The structure has to live somewhere. In the PLC it costs memory and scan time; in an edge server or the SCADA platform it costs a mapping layer but keeps the controller lean. For most brownfield plants the edge server wins, and that belongs in the SCADA and HMI architecture discussion, not with whoever writes the PLC code last. Specify the industrial-temperature variant for that gateway: an unconditioned panel in a Gulf summer runs well above 50 °C inside, and the thermal failure gets blamed on the architecture.

---

Where This Lands for a Plant That Has to Choose

OPC UA is not a replacement for your fieldbus and should not be. PROFINET, EtherNet/IP and 4-20 mA with HART keep doing what they do well at the sensor and drive layer. OPC UA earns its place one level up, where the question stops being "what is the value" and becomes "what is this thing, what state is it in, and can I prove it". Use client/server where something needs to browse, write, call methods or read history; use OPC UA PubSub where many systems need the same data and none need to talk back; aggregate at the edge before four enterprise systems reach a controller that also has a filler to run.

Getting that right at design stage costs a few days of engineering. Getting it wrong shows up as a controller running hot on communication load, an MES project that slips a month on certificates, and a dataset nobody upstream trusts. TCC's engineering team works on exactly these handovers: specifying controller, edge and network layers together, confirming that the instrumentation and control data carries usable engineering meaning, and commissioning the industrial automation architecture so PLC, SCADA and MES agree before the first batch runs. If you are scoping an MES connection, a SCADA migration or a greenfield control system build, have that conversation before the hardware is ordered.

Frequently Asked Questions

What is OPC UA?

OPC UA is a platform-independent, service-oriented architecture for industrial data exchange, standardised as IEC 62541. It standardises three things at once: a transport, a set of services such as browse, read, subscribe and call, and an information model describing what the data actually means, the part that separates it from a plain fieldbus register.

What is the difference between OPC UA and OPC DA?

Classic OPC DA ran over Microsoft's COM/DCOM, tying it to Windows and to firewall-unfriendly dynamic ports. OPC UA replaced that with a platform-independent transport and protocol-level security, and carries type, units and relationships with each value instead of a bare tag, quality and timestamp.

What is OPC UA PubSub, and when does it beat client/server?

OPC UA PubSub, defined in IEC 62541-14, lets a publisher broadcast data with no per-consumer session or state, over UDP/Ethernet or through an MQTT or AMQP broker. It wins on fan-out: one publisher can feed twenty subscribers at the same cost as feeding two, at the price of being one-directional, so client/server access is still needed for engineering work.

Is OPC UA secure?

The protocol itself has been independently reviewed and found sound: Germany's BSI found no systematic vulnerabilities in the specification. The problem is deployment: independent scans have found the large majority of internet-facing OPC UA servers running with weak or default security settings, most commonly a plaintext None security mode left enabled after commissioning.