OPC UA (Open Platform Communications Unified Architecture) is an open, vendor-independent machine-to-machine communication standard that has become the backbone of industrial IoT and the Industry 4.0 concept. Unlike classic industrial protocols such as Modbus or CAN, the OPC UA protocol combines data transport with a rich information model, so a PLC, a sensor, and a cloud application "understand" the same data without manually mapping registers.
In short: OPC UA is the IEC 62541 standard that provides uniform, secure, and semantic communication between industrial devices and IT systems — from the factory floor to the cloud — with built-in encryption, X.509 certificate authentication, and a self-describing data model.
What is OPC UA and where did it come from?
OPC UA is a communication architecture defined in the IEC 62541 standard that unifies the exchange of data and events in industrial environments. It was created as the successor to the OPC Classic protocol (based on Microsoft DCOM technology) in order to make integration independent of the operating system and secure over wide-area networks.
The fundamental difference is that OPC UA does not merely transmit "the number 42," but an object with context: a name, a data type, a unit (e.g., °C), a timestamp, and a quality status. It is exactly this semantics that distinguishes it from lightweight protocols like Modbus RTU and TCP used in machine retrofits.
How does the OPC UA information model work?
The OPC UA information model is an object-oriented address space (AddressSpace) in which every element is a Node connected by relationships. Nodes represent variables, objects, methods, and types, forming a self-describing graph that a client can browse at runtime.
This structure lets an application discover the available data without prior knowledge of the device. On top of the base model, so-called Companion Specifications are built — industry dictionaries (e.g., for robotics, injection molding machines, or energy) that standardize the meaning of data across manufacturers.
- Nodes — the basic elements of the address space.
- References — typed relationships between nodes (e.g., "HasComponent").
- Object types — templates enabling inheritance and reuse.
- Companion Specs — industry dictionaries that ensure interoperability.
Client-Server or PubSub — which mode to choose?
OPC UA offers two communication models: request–response (client-server) and publish–subscribe (PubSub). The choice depends on whether you need one-to-one interaction or efficient broadcasting of data to many recipients.
The client-server mode works well for control and on-demand reads, where a client establishes a session and subscribes to changes. The PubSub mode, added in part 14 of the specification, transmits data over UDP or an MQTT broker, which fits IoT and multi-device telemetry architectures perfectly. Thanks to PubSub, the OPC UA protocol scales from a single machine to thousands of nodes reporting to the cloud.
How does OPC UA secure industrial data?
Security in OPC UA is part of the core of the standard, not an add-on. Every connection establishes a SecureChannel that provides encryption, integrity, and authentication before any application data is exchanged.
Devices and applications mutually authenticate using X.509 certificates in a zero-trust model, and messages can be signed and encrypted according to the chosen Security Policy. This approach fits well with the requirements of the NIS2 directive and the IEC 62443 standard for industrial automation systems.
When to use OPC UA in an IoT project?
OPC UA is worth choosing when you integrate a heterogeneous machine park and need a single, secure data layer with durable semantics. It is the natural choice for industrial IoT (IIoT) solutions connecting OT systems with the IT layer.
Typical scenarios include: aggregating production-line data into a data lake, integrating with MES/SCADA systems, and bridging legacy process control systems (SCADA and PLC) with a modern cloud. In many deployments, an edge gateway translates Modbus or other protocols into OPC UA and then streams the data to an analytics platform.
- Identify the OT data sources (PLCs, sensors, drives) and the required tags.
- Deploy an OPC UA server or gateway on the edge device.
- Configure the security policy and X.509 certificates.
- Choose the PubSub mode (MQTT/UDP) for scalable telemetry to the cloud.
- Map the information model onto the structure of a time-series database.
What performance and determinism does OPC UA offer?
OPC UA can operate in near real time when combined with TSN (Time-Sensitive Networking) technology at the Ethernet layer. A standard client-server stack achieves latencies on the order of a dozen to a few dozen milliseconds, while OPC UA PubSub over TSN makes it possible to go below 1 ms, which opens the way to machine motion control and axis synchronization.
In practice, the choice of transport is critical for throughput. UDP in PubSub mode minimizes overhead, TCP ensures session reliability, and an MQTT broker eases cloud integration and data buffering over an unstable link. A well-designed gateway can handle thousands of tags refreshed every 100 ms while compressing and encrypting the telemetry stream sent to time-series database analytics.
Frequently asked questions (FAQ)
How does OPC UA differ from Modbus?
OPC UA carries not only raw register values, but also a semantic data model: types, units, descriptions, and relationships between objects. Modbus is simpler and lighter, but lacks metadata and built-in encryption. In practice, OPC UA is often layered on top of Modbus devices through a gateway.
Is OPC UA suitable for low-power devices?
The classic client-server stack can be too heavy for microcontrollers, but the OPC UA PubSub profile over MQTT or UDP runs on ESP32 or STM32 chips. Lightweight open62541 implementations under 100 kB of memory are also available, which enables deployment on edge devices.
How does OPC UA ensure communication security?
OPC UA has security built into the specification: X.509 certificate authentication, TLS encryption, and message signing. The SecureChannel layer protects the integrity and confidentiality of data regardless of the transport, and security policies define the permitted cryptographic algorithms.
Summary and key takeaways
OPC UA is today the de facto standard for industrial digitalization: it combines vendor independence, a semantic data model, and enterprise-class security in a single specification. For companies building IIoT solutions, this means shorter integration time, fewer mapping errors, and readiness for regulatory requirements.
At FSS we design the complete chain — from the hardware and firmware of edge devices, through OPC UA gateways, to native cloud backends. If you plan to connect a machine park to the cloud based on OPC UA, explore our industrial and cloud integration services — we will help you design a secure, scalable data architecture.