OPC UA (Open Platform Communications Unified Architecture) is a vendor-independent communication standard for industrial automation, maintained by the OPC Foundation. It governs how machines, sensors, controllers, and software exchange data securely and with consistent meaning across OT and IT. Security and semantic interoperability sit at its core.
OPC UA: Key takeaways
- OPC UA is a vendor-independent machine-to-machine standard from the OPC Foundation that combines transport, security, and a shared information model, so industrial data keeps the same meaning across every device and system that reads it.
- The OPC UA protocol secures communication by design through certificate-based authentication, end-to-end encryption, and message signing, which addresses the security baselines expected under NIS2 and the EU Cyber Resilience Act.
- OPC UA vs. MQTT: They solve different problems. OPC UA structures rich, semantic data at the machine and line level, while MQTT moves that data efficiently from edge to cloud, and the two run together in most modern Industry 4.0 stacks.
- Cedalo, the company behind the open-source broker Eclipse Mosquitto, supplies the MQTT backbone that carries OPC UA data into a Unified Namespace and on to cloud and analytics systems, giving OT and IT teams one consistent data layer.
What does the OPC UA protocol actually do?
The OPC UA protocol standardizes how industrial systems describe, secure, and transport data, so a controller from one vendor and an MES from another understand each other without custom adapters. It removes the patchwork of proprietary interfaces that kept OT data locked inside individual machines.
At runtime, an OPC UA server exposes data and functions from a machine, Programmable Logic Controller (PLC), or gateway. An OPC UA client, for example a historian or one of your SCADA systems, browses that server’s address space and subscribes to the values it needs.
OPC UA also offers a publish/subscribe pattern for one-to-many distribution, which is where it overlaps with message brokers.
The real differentiator is the information model. Every value in an OPC UA address space carries metadata, data type, units, and relationships to other objects. Companion specifications standardize these models per industry, so a temperature reading is labelled and structured the same way across suppliers.
Why is OPC UA built around security and interoperability?
OPC UA matters for two reasons that rarely came together in older protocols. It encrypts and authenticates communication at the protocol level, and it gives every data point a machine-readable meaning. Together they remove the two biggest obstacles in OT/IT integration, unsecured links and incompatible data formats.
How does OPC UA secure machine-to-machine communication?
OPC UA secures traffic through X.509 certificates for mutual authentication, encryption of the transport channel, and digital signing of every message. Administrators apply security policies per connection and assign user rights, so a compromised client cannot read or write beyond its defined scope.
How does OPC UA enable interoperability across vendors?
Interoperability comes from the shared information model rather than the wire format alone. Because companion specifications define standard object types for robotics, machine tools, or energy systems, an integrator maps a new machine once and every compliant client reads it correctly. This turns isolated machine data into a foundation for IT/OT convergence.
How does OPC UA map to NIS2, the Cyber Resilience Act, and the Data Act?
OPC UA supplies technical building blocks that support compliance with EU industrial regulation, yet it does not make a product compliant on its own. Its authentication, encryption, and logging features map onto the security and interoperability expectations of three frameworks now reshaping industrial IT.
| Regulation | Core requirement | What OPC UA contributes |
|---|---|---|
| NIS2 (Directive 2022/2555) | Risk management and access control for essential and important entities | Mutual authentication, encryption, and audit-ready logging at the machine layer |
| Cyber Resilience Act (Reg. 2024/2847, full application 11 Dec 2027) | Secure-by-design products with managed vulnerabilities | Protocol-level encryption and signing reduce the attack surface on connected devices |
| Data Act (Reg. 2023/2854, applicable since 12 Sept 2025) | User access to and portability of connected-product data | Standardized, self-describing data models make machine data exportable and reusable |
OPC UA vs MQTT: Which protocol fits which job?
In the MQTT vs. OPC UA question, the honest answer is that the two are complementary. OPC UA excels at structured, semantically rich communication at the machine and production-line level. MQTT is a lightweight publish/subscribe protocol built to move many small messages efficiently from edge devices to cloud and analytics platforms.
| Dimension | OPC UA | MQTT |
|---|---|---|
| Architecture | Client/server plus pub/sub | Publish/subscribe via a central broker |
| Data model | Rich, self-describing information model | Payload-agnostic, defined by the application |
| Footprint | Heavier, more compute on devices | Minimal, runs on constrained hardware |
| Typical role | Machine and line-level data access | Edge-to-cloud transport and fan-out |
| Strength | Semantic interoperability and security | Scalability and low bandwidth use |
How do OPC UA and MQTT work together in practice?
In a typical Industry 4.0 stack, OPC UA collects and structures data at the machine, and an MQTT broker distributes it across the plant and up to the cloud. A common pattern publishes OPC UA values onto MQTT topics, often encoded with MQTT Sparkplug to keep payloads structured, feeding a Unified Namespace that every system subscribes to.
This is where the Pro Edition for Eclipse Mosquitto™ and the Cedalo MQTT Platform come in. They give engineers a battle-tested broker to implement a Unified Namespace with MQTT, while OPC UA handles the device-side semantics. The result is one live data layer instead of dozens of point-to-point connections.
How to bring OPC UA and MQTT together in my data architecture?
OPC UA gives industrial data a secure, vendor-neutral structure at the source, which answers the interoperability and security questions that older fieldbus protocols left open. Its features support, without fully satisfying, the obligations introduced by NIS2, the Cyber Resilience Act, and the Data Act.
For most plants the practical setup pairs OPC UA at the machine with an MQTT backbone for distribution. That keeps OT data structured, secure, and available wherever your IT and cloud systems need it. Your advantages with Cedalo:
- A broker your engineers already trust: Eclipse Mosquitto has over 600 million downloads, so adoption needs little new training.
- One consistent data layer: OPC UA values flow through MQTT into a Unified Namespace your whole organization reads from.
- Enterprise security without a rebuild: clustering, high availability, and fine-grained role-based access control extend the open-source broker you already run.
- Room to grow: the same backbone scales from a first rollout to global IIoT installations and use cases like predictive maintenance.
Get Mosquitto CRA-Ready Before the September 2026 Deadline
Test the Pro Edition for Eclipse Mosquitto™ on your own infrastructure. See how role-based access, audit trails, high-availability clustering, and a maintained update path cover the technical groundwork the CRA expects from your products.
OPC UA: frequently asked questions
Is OPC UA replacing fieldbus protocols like PROFIBUS and Modbus?
OPC UA sits above fieldbus protocols rather than replacing them. Gateways translate PROFIBUS, Modbus, or other field-level signals into the OPC UA information model, so legacy equipment joins a modern data architecture and keeps running.
Does OPC UA work over the public internet and through firewalls?
Yes. OPC UA runs over TCP and can be tunnelled through HTTPS, and its pub/sub mode suits cloud connections. For wider distribution across networks, teams often pair it with MQTT, which was designed for unreliable, high-latency links.
What is the difference between OPC UA and OPC Classic?
OPC Classic relied on Microsoft DCOM, which tied it to Windows and made firewall traversal difficult. OPC UA is platform-independent, runs on Linux, embedded devices, and the cloud, and builds security into the protocol itself.
Can OPC UA and MQTT run in the same architecture?
They are frequently used together. OPC UA structures data at the machine, and an MQTT broker such as Eclipse Mosquitto distributes it across the plant and to the cloud, which is the standard pattern behind a Unified Namespace.
Which MQTT broker suits an OPC-UA-to-cloud pipeline?
For production environments you want a broker with high availability, security, and central monitoring. The Pro Edition for Eclipse Mosquitto™ adds clustering and fine-grained access control on top of the open-source broker, and the Cedalo Management Center adds central monitoring, so OPC UA data reaches the cloud reliably.
