OPC UA (Unified Architecture) is the IEC 62541 standard for secure, platform-independent industrial data exchange. It has replaced OPC Classic (DCOM-based) as the standard for moving data between OT equipment and enterprise systems, historians, and cloud platforms. Engineers who understand OPC UA architecture can design industrial data pipelines that are secure, scalable, and interoperable across vendors — without custom integration code for every connection.

Why OPC UA Replaced OPC Classic

OPC Classic (OPC DA, OPC HDA, OPC A&E) was built on Microsoft DCOM (Distributed Component Object Model). DCOM worked reasonably well on Windows-only local networks, but it had serious problems in modern environments:

  • DCOM required complex firewall configuration that security teams found difficult to manage — leading to ports being opened too broadly
  • DCOM was Windows-only and could not be implemented on Linux, embedded devices, or cloud services
  • DCOM had no native encryption or authentication, making it unsuitable for connections that cross network boundaries
  • Different OPC Classic servers from different vendors often had subtle incompatibilities that required trial-and-error to resolve

OPC UA was designed from scratch to address all of these problems. It uses standard TCP sockets (or HTTPS), has native security with TLS encryption and X.509 certificate authentication, and can be implemented on any platform including embedded microcontrollers.

OPC UA Architecture: Server and Client

OPC UA uses a client-server model. An OPC UA Server exposes an information model (a browseable tree of nodes representing plant data). An OPC UA Client connects to the server, browses the information model, reads values, subscribes to data changes, and calls methods.

In an industrial context:

  • OPC UA Server: Typically embedded in a PLC, DCS, SCADA, or historian. Siemens S7-1500 PLCs have a built-in OPC UA server. KEPServerEX (now Kepware) acts as a gateway OPC UA server for devices that do not have native OPC UA support.
  • OPC UA Client: A historian (OSIsoft PI, Canary Labs, InfluxDB via connector), a SCADA system (Ignition, WinCC), or a cloud service consuming OT data. Ignition’s OPC UA module is one of the most common OPC UA clients in industrial environments.

The OPC UA Information Model

The information model is what makes OPC UA more than just a data pipe. Rather than exposing raw register addresses (like Modbus), an OPC UA server exposes a hierarchical namespace of typed nodes:

  • Object nodes: Represent real or virtual objects (a pump, a vessel, a PID controller)
  • Variable nodes: Represent data values (PV, SP, output, status). Each variable has a DataType, Value, Timestamp, StatusCode, and user-defined attributes.
  • Method nodes: Represent callable operations (start pump, acknowledge alarm, trigger calibration)
  • Reference types: Define relationships between nodes (HasComponent, HasProperty, Organises)

A browsing OPC UA client sees the information model as a tree. An operator can navigate from “Plant/Area3/ReactorFeed/Pump-101/Speed” and read the current speed value, engineering units, and timestamp without knowing anything about the underlying PLC register map. This self-describing nature makes OPC UA systems much easier to integrate than Modbus or raw Ethernet/IP registers.

OPC UA Security Model

Security is built into OPC UA at the specification level, not added as an afterthought. Every OPC UA connection has three security components:

  • Transport security: All traffic is encrypted using TLS 1.2 or 1.3. The server presents an X.509 certificate; the client can validate it against a trusted certificate store.
  • Message security: Messages can be signed and encrypted end-to-end, independent of the transport layer. Security mode options are None (no security — should not be used in production), Sign (authenticated but not encrypted), and Sign & Encrypt (fully secure).
  • User authentication: Clients authenticate as specific users using username/password, X.509 user certificate, or anonymous access. User roles and access permissions are defined by the server.

In practice, many OT deployments still use OPC UA with Security Mode None, either for legacy compatibility or because the IT/OT team has not enforced secure configuration. This is a known vulnerability. OT security standards (IEC 62443) require that all OPC UA connections on control system boundaries use at minimum Sign mode.

OPC UA Subscriptions and MonitoredItems

OPC UA is efficient for real-time data because it uses a subscription model rather than polling. A client creates a Subscription with a publishing interval (e.g., 500 ms). Within the subscription, the client creates MonitoredItems for specific variable nodes. The server monitors those nodes at a sampling interval and publishes changed values to the client at the publishing interval.

This subscribe-on-change model is far more efficient than polling every register every second. For a historian subscribing to 10,000 tags with typical change rates, subscriptions reduce network traffic by 80-95% compared to cyclic polling at 1 second intervals.

OPC UA Pub/Sub Extension

OPC UA Part 14 (Pub/Sub) extends OPC UA with a publish-subscribe architecture on top of MQTT or UDP multicast, rather than the traditional client-server model. This is designed for IIoT scenarios where many devices publish data to a broker and many consumers subscribe without direct connections between them.

OPC UA Pub/Sub over MQTT is the convergence point between OPC UA’s rich information model and MQTT’s scalable transport. Adoption is growing in new IIoT deployments, though it is still less common than traditional OPC UA client-server in 2025.

Getting Started with OPC UA

For engineers new to OPC UA, the fastest path to hands-on experience is:

  • Install the free OPC UA C++ Demo Server from Unified Automation and use UA Expert (also free) as a client to browse the information model and subscribe to variables
  • Enable the OPC UA server on a Siemens S7-1500 TIA Portal project (it is a built-in feature, enabled in the PLC properties) and connect with UA Expert
  • Deploy Ignition in evaluation mode and connect to an OPC UA source to see how a production OPC UA client handles tag browsing and subscription

OPC UA is the lingua franca of industrial data exchange. Engineers who understand it are equipped to integrate any combination of PLCs, DCS, historians, and cloud platforms without vendor lock-in.