Definition
OPC UA (Open Platform Communications Unified Architecture) is an industrial Ethernet protocol developed by the OPC Foundation, used for data exchange between industrial equipment such as CNC machines, robots, AGVs, SCADA systems, and upper-level computers or cloud platforms. Compared with OPC DA, OPC UA supports cross-platform operation, secure encryption, and information modeling, making it a mainstream protocol for the Industrial Internet of Things (IIoT).
Core Features
OPC UA is based on TCP or HTTPS and supports Windows, Linux, and embedded systems. Its information model uses nodes, references, objects, and variables, which can describe device structures, types, and relationships. It supports secure channels (encryption, signatures) and user authentication. It supports both client/server and PubSub modes. Industrial devices (PLC, robots, CNC machines) can directly provide OPC UA servers, or convert Modbus, EtherNet/IP, etc., to OPC UA through gateways.
Use Cases
SCADA, DCS, MES data acquisition; cloud platform and digital twin device access; Industry 4.0 and IIoT interconnection standards. The integration of OPC UA with MQTT (PubSub over MQTT) can simplify cloud-edge data exchange. When selecting, it is necessary to confirm the OPC UA support of the equipment or gateway and the information model specifications (such as Companion Specs).
Secure Channel and Address Space
A node graph adds a layer of meaning over a flat point list
In the unified architecture, device data lives in an address space. Each node has an identifier, a type, and access rights. References between nodes say "this is one axis of a machine tool" or "this alarm belongs to a particular job." A client can browse along the references, or read a variable directly by a known identifier. Compared with a protocol that only offers a register number, what is added is type and structure: the same number can carry its unit, its range, and its place in the device. If nobody maintains the structure, browsing still returns a pile of unnamed variables. The semantic advantage does not appear by itself.
Transport can be a binary long-lived connection, or secure HTTP that passes a proxy more easily. Subscriptions exist only after a session is open. A subscription packs data that has changed into notifications on a publishing interval. Interval and sampling interval are two layers. Sampling decides how often the server looks at the underlying value. Publishing decides how often that value is sent to the client. Slow the publishing down while sampling stays fast, and changes pile up in server memory. Slow both down, and a short-pulse alarm is lost.
Encryption and the user token have to be configured as a pair
The security policy decides whether messages are signed and whether they are encrypted. The user token decides anonymous, username, or certificate. Both ends have to accept the same pair. Tick only the highest security level on the server, and fail to import the client certificate into the trust list, and the session fails before it opens. The symptom is often misread as a network that is down. Certificates also have a validity period and a revocation list. An industrial PC that stays offline for a long time will not renew an expired certificate by itself. After one reboot, every reading stops.
It suits controllers, machine tools, or robots that already expose a server, where the collector needs to read for a long time from different operating systems. When an old device has no server, a gateway turns other field protocols into nodes. Names on the gateway have to stay stable. Identifiers must not change across a reboot. When the path has to cross a network that opens only web ports, consider an endpoint based on secure HTTP, and separately judge whether a proxy is buffering notifications that were supposed to be timely.
Browse storms and subscription interval
During commissioning it is easy to browse without limit from the root. On a large address space, one browse fills the controller's communication task and the control cycle is affected. The client should cache node identifiers it has already confirmed, and during normal running subscribe only to those variables. Second, a security policy left at "none" is never turned off after debugging. Any host that can reach the port can read, and even write, setpoints. Third, the subscription interval is treated as the control cycle and used to close a loop. Jitter in the interval makes the actuator hunt.
When migrating from OPC DA, quality codes do not match the old system's quality enumeration word for word. Display logic has to be redone. If a gateway also folds EtherNet/IP objects into variables, write the folding rule into the point list so the same signal does not appear as two nodes. Restrict writes to a separate user token, and keep the session timeout short, so an offline maintenance laptop does not hold write permission indefinitely.