OPC UA Explained for Automation Engineers: What It Is, How It Works, and When to Use It
Why OPC UA matters now
Ten years ago a plant's data lived in the PLC and stayed there. Today the same data is wanted by the SCADA, the MES, the maintenance dashboard, the energy meter report and, increasingly, a cloud analytics platform. Each of those used to need its own driver, its own tag mapping and its own argument about who owned the PLC's serial port.
OPC UA (Open Platform Communications Unified Architecture) is the answer the industry settled on. It is an open, vendor-neutral standard (IEC 62541) for exchanging data and its meaning between industrial systems. Siemens, Rockwell, Beckhoff, Schneider, Mitsubishi and Omron all ship it in their current controllers, and every serious SCADA and IIoT platform speaks it as a client.
If you are learning PLC programming in 2026, OPC UA is no longer an advanced topic. It is the interface you will be asked to configure on your first commissioning job.
What OPC UA actually is
OPC UA is three things at once, and most explanations muddle them:
- A transport. A defined way to move data over TCP/IP, with built-in security (certificates, signing, encryption) and session management.
- An information model. Data is not just a register number. A tag is a node with a name, a data type, engineering units, a description, a browse path and relationships to other nodes. A client can discover what a server offers.
- A set of services. Read, write, subscribe, browse, call a method, get history. The same services work whether the server is a PLC, a drive, a SCADA or a database.
The practical consequence: an OPC UA client can connect to a PLC it has never seen, browse the tag tree, subscribe to the tags it wants and receive changes as they happen, with no offline register map.
Server and client, in plain terms
- The server holds the data. In most plants the PLC is the server: an S7-1500, a CompactLogix with a gateway, a Beckhoff CX, or a PC-based server such as KEPServerEX standing in front of older controllers.
- The client asks for data. SCADA (Ignition, WinCC, FactoryTalk), MES, historians, Node-RED, Python scripts, and cloud connectors are clients.
One server can serve many clients at once, each with its own session and its own subscriptions. That alone removes the old problem of two systems fighting over a single serial link.
Subscriptions, not polling
A Modbus client asks "what is register 40001?" every 500 ms whether or not anything changed. An OPC UA client subscribes: "tell me when Tank1_Level changes by more than 0.5, no faster than every 250 ms". The server does the work, the network carries only changes, and a thousand tags stop being a problem.
Security is built in, and you cannot skip it
Every OPC UA connection has a security policy and a security mode. In a real plant you will see:
- None for a bench test, never for production.
- Basic256Sha256, Sign and Encrypt for production.
- Certificates exchanged and trusted on both sides. The first time a client connects, the server rejects its certificate until an engineer moves it to the trusted list. This step catches out everybody once.
- User authentication with username and password or a user certificate, on top of the application certificate.
This is why OPC UA is the protocol the IEC 62443 auditors like: the security is part of the standard rather than bolted on.
Setting up an OPC UA server on a Siemens S7-1200 or S7-1500
The steps in TIA Portal, which our free Siemens TIA Portal course walks through with a simulator:
- In the CPU properties, enable the OPC UA server and note the endpoint address, which has the form opc.tcp://192.168.0.1:4840.
- Set the security policies. Keep None off unless you are on a bench.
- Mark the tags to expose. In a data block, the Accessible from HMI/OPC UA column decides what a client can see; Writable decides what it can change.
- Create a server interface if you want a clean, curated tag tree instead of exposing whole DBs.
- Download, then connect a client (UaExpert is the free standard) and browse.
- Trust the certificates on both sides, connect with Sign and Encrypt, and subscribe.
The S7-1200 runs the server from firmware V4.4 onward; the S7-1500 has had it for years and adds methods and companion specifications. Runtime licences apply on Siemens hardware, which surprises people at ordering time.
Where OPC UA beats the alternatives, and where it does not
Use OPC UA when:
- Several systems need the same data with its meaning intact.
- You need security on the wire.
- You want to browse rather than map registers.
- Data leaves the control network, towards MES, ERP or cloud.
Stay with the fieldbus when:
- You are controlling I/O in real time. Profinet, EtherNet/IP and EtherCAT do that; OPC UA does not replace them at the I/O level.
- The device is tiny. A temperature transmitter speaks HART or Modbus, not OPC UA.
The pairing that works in most Indian plants today is Profinet or EtherNet/IP for control, OPC UA from the PLC upward, and MQTT from the edge to the cloud, which we cover in MQTT and Sparkplug B.
Interview questions you will be asked
- What port does OPC UA use? 4840 by default, over TCP.
- Difference between OPC DA and OPC UA? DA was Windows-only and COM based; UA is platform independent, secure and models information.
- Can OPC UA replace Profinet? No. Different layer, different job.
- What is a companion specification? An agreed information model for a device class, so every robot or every injection moulding machine exposes the same nodes.
Frequently asked questions
Is OPC UA free to use? The standard is open. Vendors charge for server licences on some hardware, and PC-based servers are commercial products; clients such as UaExpert are free for engineering use.
Does OPC UA work over the internet? It can, with encryption and certificates, but most plants keep it inside the plant network and use MQTT for the cloud leg.
Which free course covers this? The Industrial Communication course covers OPC UA alongside Modbus and Profinet, and the Node-RED IIoT course uses an OPC UA client node to read a PLC.
