OPC UA

What is OPC UA?

OPC UA (Open Platform Communications Unified Architecture) is an open, platform-independent standard from the OPC Foundation for secure, structured and interoperable data exchange between machines, controllers and software systems, published internationally as IEC 62541. OPC UA combines a service-oriented communication architecture with an object-oriented information model: a server delivers not just values, but also their meaning, unit and context. It is the successor to the Windows-bound OPC Classic standards and was designed with a focus on security, scalability and flexibility. That makes OPC UA one of the key building blocks of industrial automation and Industry 4.0.

🧠 What does OPC UA do?

OPC UA acts as a bridge between different systems and protocols across the OT and IT worlds. It makes it possible to:

• Collect data - securely read values from machines, PLCs and sensors, subscribe to changes and query historical values
• Add meaning - structure data in information models with types, units, ranges and relationships
• Connect systems - link SCADA, MES, ERP, historians and cloud platforms in one uniform way
• Execute actions - call methods, such as starting a recipe or resetting a counter
• Pass on events and alarms - with timestamp, severity and acknowledgement state

Applications range from machine-to-machine communication (M2M) and linking PLCs to SCADA or MES, to data exchange with cloud platforms such as Azure and AWS in IIoT architectures.

🕰️ How did OPC UA come about?

The first OPC standard appeared in 1996 as OLE for Process Control. This OPC Classic family consisted of separate specifications such as OPC DA (live data), OPC HDA (historical data) and OPC A&E (alarms and events). All of them relied on Microsoft COM/DCOM. In practice this caused three problems: OPC only ran on Windows, DCOM was hard to pass through firewalls, and security depended on error-prone Windows settings.

OPC UA was designed from the outset without DCOM, so it runs on Windows, Linux, real-time operating systems and small embedded devices. By the end of 2025 the OPC Foundation had more than 1,000 members and had published 20 new companion specifications that year.

🔧 How does OPC UA work technically?

OPC UA is built from layers that can be chosen independently:

• Address space and information model - all data is a network of nodes (objects, variables, methods, types) with references between them. A client can browse the server and discover for itself what is available.
• Services - standardised services such as Read, Write, Browse, Call and Subscriptions with MonitoredItems, so the server only sends changes instead of the client polling continuously.
• Encoding - compact UA Binary encoding or JSON.
• Transport - opc.tcp (binary over TCP/IP, default port 4840), HTTPS (secure HTTP) and WebSockets for client/server, and UDP, Ethernet, MQTT or AMQP for PubSub.

Client/server or PubSub?

OPC UA PubSub is defined in Part 14 and forms the basis for deterministic communication over TSN (Time-Sensitive Networking).

🧩 What are information models and companion specifications?

The greatest strength of OPC UA is semantics. A base model describes generic concepts such as devices, alarms and programs. Industries add standardised models on top in companion specifications, often together with organisations such as VDMA, NAMUR or PROFIBUS & PROFINET International. There are now dozens of them. Well-known examples:

Other architectures build on these models too. Module Type Package (VDI/VDE/NAMUR 2658) uses OPC UA as the runtime interface between a process module and the orchestration layer. NAMUR Open Architecture exposes process data through an OPC UA information model. The OPC Foundation and the Industrial Digital Twin Association are jointly working on a mapping to the Asset Administration Shell.

🔄 How does OPC UA differ from other protocols?

OPC UA usually does not replace fieldbuses but sits above them. A PLC talks to I/O over PROFINET or EtherNet/IP and to SCADA, MES and the cloud over OPC UA. With OPC UA FX and TSN, however, OPC UA is moving towards the field level.

🔐 How is OPC UA secured?

Unlike most older industrial protocols, OPC UA has security built into the protocol itself. In 2016 the German BSI concluded that the specification contains no systematic weaknesses. Security works at three levels:

• Application authentication - every client and server has its own X.509 application instance certificate. The two parties only trust each other once the certificate is in their trust list. A Global Discovery Server (Part 12) can manage certificates and trust lists centrally; see also certificate management.
• Message security - the security mode is None, Sign (integrity) or SignAndEncrypt (integrity and encryption). The security policy determines the algorithms: Basic128Rsa15 and Basic256 are deprecated, while Basic256Sha256, Aes128_Sha256_RsaOaep and Aes256_Sha256_RsaPss are the current choices.
• User authentication - anonymous, username and password, an X.509 user certificate or an issued token (for example Kerberos or JWT). Access control per node then decides who may read, write or call methods, optionally role-based (RBAC).

OPC UA also supports auditing events and logging of security-relevant actions.

⚠️ What vulnerabilities and risks does OPC UA have?

Strong security in the standard does not mean every installation is secure. The weak spots lie mainly in configuration and implementation:

• Insecure configuration - an internet-wide scan from 2020 found that 92% of reachable OPC UA servers had deficiencies: a quarter without access control, a quarter with security disabled and a quarter using deprecated cryptography. Hundreds of devices even shared the same certificate.
• Implementation flaws - researchers at Claroty Team82 found around 50 vulnerabilities in roughly 15 OPC UA stacks and products, including during Pwn2Own ICS 2022 and 2023. Many have been published as CVEs and call for patch management.
• Attack tools - the ICS malware PIPEDREAM, discovered in 2022, contains the MOUSEHOLE module, which finds OPC UA servers, connects with default or stolen credentials and can read and modify tags.
• Discovery and availability - in its 2022 update the BSI pointed to unauthenticated mDNS discovery and limited protection against overload (DoS).

🧭 How do you set up OPC UA securely?

A practical approach, in line with IEC 62443 and hardening:

1. Inventory endpoints - map all OPC UA servers and clients, including embedded servers in PLCs and edge gateways.
2. Disable None - use SignAndEncrypt with at least Basic256Sha256 and remove deprecated policies.
3. Forbid anonymous access - require user authentication and grant only the rights that are needed; make write and method rights explicit.
4. Manage certificates - use unique certificates per application, do not auto-accept unknown certificates, and arrange renewal and revocation (CRL), preferably through a GDS.
5. Segment the network - place servers in zones according to IEC 62443-3-3 and network segmentation; open port 4840 only between known systems and use a DMZ or Reverse Connect for IT access, where the server initiates the connection outwards.
6. Patch and monitor - keep stacks and products up to date, follow vendor advisories and log failed connections and certificate errors.

In the Netherlands many OPC UA users fall under NIS2, implemented nationally as the Cyberbeveiligingswet. Manufacturers of products with an OPC UA interface also face the Cyber Resilience Act: the reporting obligation for actively exploited vulnerabilities has applied since 11 September 2026, with the full requirements following on 11 December 2027.

🏗️ What does a typical OPC UA architecture look like?

• Field and control level - sensors and actuators communicate with the PLC over fieldbuses. Many modern PLCs have a built-in OPC UA server; older systems get a gateway or an embedded server.
• Supervisory level - SCADA and HMI act as OPC UA clients that subscribe to tags and alarms.
• Operations level - MES and the historian read production and process data, often through an aggregating server.
• Enterprise and cloud level - ERP and cloud platforms receive data through an edge gateway or via OPC UA PubSub over MQTT.

❓ Frequently asked questions

Which port does OPC UA use?

OPC UA uses TCP port 4840 by default for the binary opc.tcp protocol; this port is registered with IANA and is also used by the Local Discovery Server. Many products additionally run on their own port, such as 49320 for Kepware. Only open the ports in your firewall that are actually in use.

Is OPC UA the same as IEC 62541?

OPC UA is developed by the OPC Foundation and then published as the international standard IEC 62541. The IEC parts follow the OPC specifications with some delay. In practice, vendors usually refer to the OPC version, such as 1.04 or 1.05.

Is OPC UA secure by default?

OPC UA offers strong security with certificates, signing and encryption, but it has to be switched on. Many installations still run with security mode None or with anonymous access. OPC UA is therefore only as secure as its configuration.

What is the difference between OPC UA and MQTT?

MQTT is a lightweight messaging protocol that only transports bytes, without any defined meaning. OPC UA also defines the information model, the services and the security. Through OPC UA PubSub, OPC UA can actually use MQTT as its transport, so the two complement each other.

What is OPC UA FX?

OPC UA FX (Field eXchange) is an extension of OPC UA for communication at the field level, with the first specifications released in November 2022. OPC UA FX focuses first on controller-to-controller communication via PubSub over UDP, with TSN for deterministic behaviour. Controller-to-device and functional safety use cases follow later.

Does OPC UA replace OPC Classic?

OPC UA is the successor to OPC Classic (OPC DA, HDA and A&E) and works on any platform without DCOM. Existing OPC Classic servers can still be exposed through OPC UA using wrappers or gateways. For new projects, OPC UA is the logical choice.

📌 In summary

OPC UA is the open standard (IEC 62541) that not only transports industrial data, but also gives it meaning and security. With client/server and PubSub, industry-specific companion specifications and certificate-based security, OPC UA forms the backbone of Industry 4.0, provided you actually enable and manage its security.