Industrial IoT and Business Operations · Study deck

OPC UA: Architecture, Models, and Security

This first route builds the OPC UA architecture from information models and communication patterns through a reviewable security baseline.

Ada is your guide for this deck.

iiot

Ada, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: Neither pattern removes the need for data-quality handling: clients still need source timestamps, server timestamps, status codes, stale-data detection, and explicit behavior when a gateway restarts or a subscription queue overflows.
Explain: A reviewer should be able to trace one value from PLC or gateway source, through OPC UA namespace, secure session or PubSub route, historian or SCADA consumer, and final operational decision.
Explain: Production servers need certificate rotation, trust-list management, user-role mapping, time synchronization, and clear rules for writable nodes because a write to the wrong setpoint can affect real equipment.

Major section

Start With the Story

One means motor turns per minute.

The other means belt metres per second.
Joining the raw tags would create a quiet but dangerous error.
OPC Unified Architecture (OPC UA) gives industrial data shared names, types, units, quality, time, and links.
A protocol is an agreed set of rules for how systems exchange data.

Major section

Start With the Story (continued)

OPC UA becomes useful when the story is semantic interoperability: expose state, commands, alarms, and metadata in a way that another system can trust and maintain.

Transmission Control Protocol (TCP) provides an ordered byte stream between two endpoints.
OPC UA can share meaning.
They do not make two unlike tags mean the same thing.

Major section

For Beginners: OPC-UA Standard

OPC-UA is like a universal translator for factory machines.

In most factories, different machines from different manufacturers speak their own "languages" and cannot talk to each other.
OPC-UA gives them a common language so a robot arm, a temperature sensor, and a cloud computer can all share information securely.
If you have ever used a USB cable that works with many different devices, OPC-UA does the same thing but for industrial communication.

Major section

OPC UA Shared Meaning

For learners, the important shift is from tag collection to information modeling.

OPC Unified Architecture, standardized as IEC 62541, is not just another wire protocol.
Its main value is that it lets a machine describe what its data means.
A raw register list might say that register 40017 is a number.

Major section

OPC UA Shared Meaning (continued)

A client can browse a server, find an asset, read variables, inspect units and data types, and discover methods without relying on a spreadsheet of vendor-specific register numbers.

That makes OPC UA especially useful when a factory needs data to survive vendor changes, PLC upgrades, and multiple generations of analytics tools.
That matters in plants where equipment comes from many vendors and must connect to SCADA, HMI, historian, MES, CMMS, analytics, and cloud systems.
A conveyor drive, robot cell, chiller, or packaging machine can expose a structured address space instead of forcing every integration team to reverse-engineer tags from scratch.

Major section

Model Before Wiring Tags

A practical OPC UA project starts by deciding which objects the client should see.

Model assets such as Line 3, Filler 2, Motor M101, TemperatureSensor A, or BatchRecipe as meaningful objects, then attach variables and methods that operators, engineers, and applications can interpret.
The integration choice depends on the consumer.
Practitioners also need an operating model.

Major section

Model Before Wiring Tags (continued)

For brownfield systems, use gateways deliberately.

A SCADA display may use client-server subscriptions to monitor selected nodes at a defined sampling interval.
A plant historian may collect normalized values with engineering units and quality flags.
A Modbus, PROFIBUS, PROFINET, EtherNet/IP, or vendor-driver gateway should not simply relay every register as a flat tag.

Major section

OPC UA Reads Semantics

Inside an OPC UA server, each node has a NodeId, BrowseName, DisplayName, NodeClass, attributes, and references to other nodes.

A variable can carry a DataType, ValueRank, engineering unit, quality status, timestamp, and access level.
References such as HasComponent, HasProperty, Organizes, and HasTypeDefinition make the model navigable instead of flat.
OPC UA communication choices change the failure mode.

The OPC UA information model gives clients more than a value: browsable object types, objects, variables, methods, properties, and references expose type, unit, timestamp, quality, and relationship context.

Major section

OPC UA Reads Semantics (continued)

Namespaces keep vendor, standard, and site-specific definitions separate, which is why careless NodeId churn can break historians, dashboards, and analytics jobs after a PLC or server update.

The secure channel is also part of the design, not a later wrapper.
Security Policy None is acceptable for a classroom lab but is not a production baseline for plant or pharmaceutical systems.
Client-server subscriptions maintain monitored items, queues, publishing intervals, keep-alives, and sequence numbers.

Major section

OPC UA Reads Semantics (continued)

PubSub decouples publishers from subscribers and may use UADP or JSON mappings over UDP, MQTT, or other transports depending on the deployment.

Neither pattern removes the need for data-quality handling: clients still need source timestamps, server timestamps, status codes, stale-data detection, and explicit behavior when a gateway restarts or a subscription queue overflows.
Implementation choices are concrete.
The difficult work is making the published model stable, secure, and useful across the equipment lifecycle.

Major section

OPC UA Reads Semantics (continued)

Model stability: Version namespaces and NodeIds deliberately so dashboards and historians do not break after every PLC or server update.

A reviewer should be able to trace one value from PLC or gateway source, through OPC UA namespace, secure session or PubSub route, historian or SCADA consumer, and final operational decision.
If that trace loses units, quality, ownership, or write authorization, the deployment is only connected, not integrated.
Production servers need certificate rotation, trust-list management, user-role mapping, time synchronization, and clear rules for writable nodes because a write to the wrong setpoint can affect real equipment.

Major section

OPC-UA Architecture

They use browse, read, write, method-call, and subscription services rather than reaching directly into controller memory.

Inside the server, the address space relates objects, variables, methods, types, and references so plant data keeps its meaning.
Certificates and the secure channel establish trust, a session identifies the conversation, and user authorization limits each operation.

Major section

Information Model

Object types, objects, variables, methods and properties are the shared vocabulary any client can walk.

A plain read gives a number.
This model gives the number plus the context needed to judge it, so a new client can learn the machine without a hand-written map.

Major section

Communication Patterns

The left column is the client, the right column is the server, and the band between them holds the secure channel and the session.

Nothing useful happens until both exist: the channel proves the certificates, and the session carries the user identity and permissions.
Monitor: Server sends notifications when subscribed values change.
Decoupling: Publishers don't need to know subscribers.

Client-server communication separates discovery, read/write access, subscriptions, notifications, and secure-channel handling.

Major section

Security Features

The trust authority at the top is not only an issuer; somebody has to run revocation and renewal, or certificates quietly expire in a running plant.

Server and client trust each need their own certificate and trust list, so both ends can refuse a stranger.
Widely supported, but verify whether it remains approved by the site security policy.

OPC UA trust record showing trust authority, server trust, client trust, user identity, roles, and endpoint policy before release. — OPC-UA security needs certificate ownership, trust-list management, user identity, authorization roles, and endpoint policy evidence, not only a checkbox that says encryption is enabled.

Deck summary

Key takeaways

One means motor turns per minute.

OPC UA becomes useful when the story is semantic interoperability: expose state, commands, alarms, and metadata in a way that another system can trust and maintain.
OPC-UA is like a universal translator for factory machines.
For learners, the important shift is from tag collection to information modeling.
A client can browse a server, find an asset, read variables, inspect units and data types, and discover methods without relying on a spreadsheet of vendor-specific register numbers.

Retrieval practice

Recall check 1 of 3

Ada says: answer from memory, then check your reasoning.

Q1A gateway exposes only raw register values. What should its information model add?

AA longer list of unlabeled registers

BA faster screen refresh without metadata across assets

CA model adds meaning, unit, asset, time and quality.

DA new register number for every client

Show answer

Answer: C Context lets clients interpret a value and link it to a decision.

Retrieval practice

Recall check 2 of 3

Ada says: answer from memory, then check your reasoning.

Q2A smart factory needs to send real-time sensor data from 500 machines to both a local SCADA system and a cloud analytics platform. The SCADA system needs direct request-response access to individual machines, while the cloud platform only needs aggregated data streams. Which combination of OPC-UA communication patterns is most appropriate?

AUse client-server for SCADA's direct machine access and edge MQTT pub-sub for aggregated cloud streams.

BUse client-server for everything -- the SCADA system and cloud platform both connect directly to each machine's OPC-UA server.

CUse pub-sub for everything -- all machines publish data to an MQTT broker, and both SCADA and cloud subscribe to the relevant topics.

DUse OPC-UA Classic for SCADA and REST for cloud, bypassing edge pub-sub aggregation entirely.

Show answer

Answer: A Client-server supports targeted SCADA reads and commands; a gateway can publish aggregated data upstream, decoupling the cloud from individual machine sessions.

Retrieval practice

Recall check 3 of 3

Ada says: answer from memory, then check your reasoning.

Q3An engineer is configuring OPC-UA security for a regulated batch-control system. Which policy and authentication combination is most appropriate?

AAes256-Sha256-RsaPss with certificate-based application and user authentication, plus audit logging.

BSecurity Policy 'None' with username/password authentication for ease of development and deployment.

CBasic128Rsa15 with username/password authentication to maintain compatibility with older equipment.

DBasic256Sha256 with Kerberos tokens, but audit logging disabled to reduce server load.

Show answer

Answer: A This combines a strong endpoint policy, application identity, named user identity, and audit evidence, which is the right design direction for a regulated control environment.

Print reference

Answers

Answer key.

C · Context lets clients interpret a value and link it to a decision.
A · Client-server supports targeted SCADA reads and commands; a gateway can publish aggregated data upstream, decoupling the cloud from individual machine sessions.
A · This combines a strong endpoint policy, application identity, named user identity, and audit evidence, which is the right design direction for a regulated control environment.