P-06 — OPC UA

Modern, secure, vendor-neutral. The IT/OT bridge.

Estimated 14 minutes.

Why OPC UA exists

Modbus and Profinet move bytes. They have no idea what those bytes mean. OPC UA carries the bytes AND the meaning — a self-describing model the receiver can browse without a manual.

A short history

Classic OPC (DA, HDA, A&E) was built on Microsoft DCOM in the 1990s. It worked, but it was Windows-only, hard to firewall, and impossible on a PLC. OPC UA (Unified Architecture, 2006) is a clean rewrite — platform-neutral, transport-agnostic, designed for the next 30 years.

One protocol, three layers

Think of OPC UA as a stack: a transport (TCP or HTTPS), a security layer (SecureChannel), and an information model (the address space + services). Vendors implement all three; you only see the top.

The address space

Every OPC UA server exposes a tree of typed nodes. A node has a NodeId, a NodeClass (Object, Variable, Method, ObjectType…), and references to other nodes. Walk the tree and you discover the entire device.

NodeId — the unique handle

A NodeId is a pair: namespace index + identifier. Identifiers can be numeric (i=85), string (ns=2;s=Boiler1.Temp), GUID, or opaque bytes. Namespace 0 is reserved for the standard nodes; vendors use ns=1, ns=2, etc.

Read this NodeId

You see "ns=3;s=Line2.Speed". What does it tell you?

  • Numeric ID 3 in the default namespace
  • String ID "Line2.Speed" in namespace index 3
  • GUID node, version 3

References connect nodes

HasComponent, HasMethod, HasTypeDefinition, Organizes — references carry meaning.

References are first-class

Unlike most protocols where relationships are implicit, in OPC UA every relationship is an explicit, typed, browsable reference. Want to know what is inside Boiler1? Browse its HasComponent references. Want its type? Follow HasTypeDefinition. The model is fully introspectable.

Browse the address space

Click any node to inspect its NodeId, NodeClass, and (for Variables) live value.

Which NodeClass?

"Boiler1.Start" is something the client invokes with arguments and gets a result back. What NodeClass is it?

  • Variable
  • Method
  • Object
  • ObjectType

Types vs instances

BoilerType is a template. Boiler1, Boiler2, Boiler3 are instances of it — each created by following HasTypeDefinition. This is identical to classes and objects in software: define once, reuse many times. Companion specifications (PackML, EUROMAP, AutoID…) standardise these types so any vendor's boiler looks the same.

Sessions: stateful by design

Unlike Modbus, OPC UA is connection-oriented. A client opens a Secure Channel, then a Session (with credentials), then activates it. Only then can it read, write, or browse.

Why three steps?

Separating channel, session and activation isolates concerns: the channel handles encryption and keys, the session handles user identity, activation binds them together. If the network drops, the client can reopen a channel and reactivate the same session — no need to re-authenticate from scratch.

Subscriptions beat polling

Instead of "read me Temp 10× per second", the client says "tell me when Temp changes by more than 0.5°C". The server publishes updates only when something actually moves. Massive bandwidth savings.

MonitoredItems do the filtering

A Subscription is a delivery channel. The actual filters live on MonitoredItems: sampling interval (how often the server checks), deadband (how much change is "interesting"), queue size (how many missed values to buffer). Tune them per tag — fast for control values, slow for ambient temperature.

Walk a real session

Tap each step to see the seven services that take a client from TCP connect to live data.

Connection dropped — what survives?

TCP drops between Publish messages. The client reconnects within 10 seconds. What state is preserved?

  • Nothing — the client must redo everything
  • The Subscription and its MonitoredItems are kept; the client transfers them to the new channel
  • Only the Session is kept; subscriptions must be recreated

Three security policies

OPC UA bakes security into the spec — not bolted on by IT later. You pick None, Sign, or SignAndEncrypt when you open the Secure Channel, and the server enforces it for every message that follows.

Certificates everywhere

Both client and server hold X.509 certificates. On first connect they exchange them; you must "trust" the other side once (a click in the engineering tool, a file in a trust folder). After that, every message proves who sent it. Lose the cert, lose access — much harder than guessing a password.

Compare the three modes

Toggle each policy and watch what changes on the wire and what the server demands of you.

Pick the right policy

You are publishing recipe data from a plant PLC to a cloud MES across the public internet. Which security policy?

  • None — simplest setup
  • Sign — proves origin
  • SignAndEncrypt — only safe choice

PubSub: the modern alternative

Classic OPC UA is client-server (one talks, one listens). OPC UA PubSub adds a brokered model: servers publish to MQTT or UDP multicast, any number of subscribers consume. Better for one-to-many cloud telemetry; client-server is still king for control and engineering.

Client-server or PubSub?

You want 50 SCADA stations and 3 cloud analytics platforms to all see the same plant tags in real time. Which transport fits best?

  • Client-server — open 53 sessions to the PLC
  • PubSub over MQTT — one publisher, many subscribers

Final challenge

A SCADA app needs the temperature of 200 tags updated whenever any of them moves more than 1%. The most efficient way is:

  • ReadRequest in a 100 ms loop
  • One Subscription with 200 MonitoredItems and a deadband filter
  • Open 200 separate sessions, one per tag
  • CallRequest on a "GetAll" method

What you learned

  • OPC UA exposes a typed, browsable address space — nodes connected by typed references.
  • NodeIds combine namespace index + identifier (numeric, string, GUID).
  • NodeClasses: Object, Variable, Method, ObjectType, Folder. Types vs instances.
  • Communication is session-based: SecureChannel → Session → Activate → use.
  • Subscriptions + MonitoredItems push only changes — far better than polling.
  • Security policies: None, Sign, SignAndEncrypt. Encrypt anything off-network. Certificates pin identity.
  • PubSub adds a brokered one-to-many model on top of MQTT or UDP.

OPC UA complete

  • You can read an OPC UA address space and decode a NodeId.
  • You understand sessions, subscriptions, and monitored items.
  • You can pick the right security policy and transport for a given network.