Mestric logo
069 763 552

Sharing is caring

Learn with us! We want to give you an easy-to-follow guide to manufacturing processes and show you the best optimization process.
Section dividerSection divider
Engineer checking a machine-side industrial controller
October 12, 2026

OPC UA Integration: 6 IEC 62443 Checks for MES Engineers

OPC UA integration gives you secure, vendor-neutral, semantically rich machine data that plugs straight into MES and SCADA systems without custom point-to-point mapping for every device. The benefits stack up quickly: a shared information model, built-in security, and freedom from single-vendor lock-in. Your first action should be straightforward: discover the native OPC UA endpoints already running on your equipment and plan your certificate and security profile before writing a single line of integration code.

TL;DR:

  • Use native OPC UA when available; for legacy equipment, add a gateway only with a defined node mapping and replacement plan.
  • OPC UA supports communication security, but IEC/ISA 62443 also requires organizational controls, secure development practices, and account management from integrators and operators.
  • Use client subscriptions for operational control when only a handful of clients connect, and PubSub for telemetry sent to multiple consumers across a plant.
  • Test certificate renewal in a sandbox before production, because a failure can leave a live endpoint’s data feed offline until someone detects it.
Mestric
Connect Machine Data to Your MES
Mestric connects directly with manufacturing equipment, bringing performance, downtime, quality, and cost metrics into view for production teams.

Explore Mestric

Table of Contents

What OPC UA is and why it matters for industrial integration

OPC UA (Open Platform Communications Unified Architecture) is a machine-to-machine communication standard that sits between the equipment layer and the systems that consume production data, MES, SCADA, ERP and historians among them. It replaces the older OPC Classic specifications, which relied on Microsoft’s DCOM and struggled across firewalls and operating systems.

Teams are moving to OPC UA for a few concrete reasons:

  • It carries structured, self-describing data instead of raw registers, so a temperature reading arrives with its unit, range and type attached.
  • It runs on standard TCP/IP and works across Windows, Linux and embedded platforms without DCOM dependencies.
  • It has security built into the protocol itself rather than bolted on afterwards.

Common use cases include streaming live telemetry from PLCs, raising and acknowledging alarms, retrieving historical values for trend analysis, and reading or writing device configuration parameters remotely. Each of these tasks uses the same underlying model, which is what makes OPC UA attractive for integration work rather than a collection of one-off protocol translators.

OPC UA architecture and core capabilities

Every OPC UA server exposes an address space: a network of nodes representing variables, methods, objects and their relationships. Each node carries a NodeId, sits within a namespace to avoid naming collisions, and is typed through DataTypes defined either by the base specification or a companion standard. This semantic layer is what distinguishes OPC UA from protocols that only move bytes.

The core building blocks you will work with are:

  • Servers and clients: a server exposes data and functionality; a client connects, opens a session, and reads, writes or calls methods against the address space.
  • Subscriptions and monitored items: clients subscribe to specific nodes and receive updates only when values change, which keeps network load predictable.
  • PubSub: a publish-subscribe transport (over UDP or MQTT) suited to high-scale telemetry and multicast scenarios where classic client-server subscriptions would create too many individual connections.
  • Device Integration (OPC 10000-100): a companion specification that standardises how field devices, sensors and actuators describe themselves, so a client can browse device topology without vendor-specific logic.

Choosing between client-subscription and PubSub comes down to scale and purpose: subscriptions suit operational control with a handful of clients, while PubSub suits plant-wide telemetry fan-out to multiple consumers.

Security and standards: mapping OPC UA to IEC/ISA 62443 and practical controls

Security is built into OPC UA rather than added as an afterthought, which matters once you start connecting shop-floor equipment to MES and cloud services. The OPC UA Part 2 security model annex provides an informative mapping between OPC UA mechanisms and ISA/IEC 62443-4-2 control requirements, flagging which controls are covered by the protocol and which remain your responsibility as an integrator.

OPC UA security mapped to IEC 62443 controls

OPC UA secures communication through a SecureChannel, authenticates applications and users (commonly via X.509 certificates), and offers several security policies covering encryption and signing.

A practical security plan for your integration should cover:

  • A certificate lifecycle strategy: issuance, renewal, revocation and trust list management across every endpoint.
  • Secure policy selection matched to each device’s capability, avoiding weaker legacy policies where a stronger one is supported.
  • Session and audit event handling, so you can trace who connected, when, and what they read or wrote.

IEC/ISA 62443 asks for more than OPC UA alone delivers. A primer from PROFIBUS & PROFINET International sets out the standard’s broader scope, including secure development lifecycle obligations and distinct responsibilities for product suppliers, system integrators and plant operators. Treat anything the OPC UA mapping marks as uncovered as a project risk that needs a compensating organisational control, not an oversight to patch later. Our guide to industrial data security risks covers the operational side of this same problem.

How to integrate OPC UA with MES/SCADA: step-by-step checklist

Treat this as a working checklist you can adapt into a project plan rather than a theoretical sequence.

  1. Inventory your endpoints. Run GetEndpoints and Browse against every candidate device to catalogue supported services, security policies and data models before committing to an approach.
  2. Set your security baseline. Decide on security policies per device class, place your PKI infrastructure, and define how certificates will be issued and trusted across the plant.
  3. Plan the network. Decide on segmentation between OT and IT networks, where edge gateways sit, and which firewall rules apply; our guide to IoT gateways covers placement patterns in more depth.
  4. Model the data. Map OPC UA nodes and namespaces onto MES entities and KPI definitions, so a tag on the shop floor lines up with a defined metric in your reporting layer.
  5. Build a test plan. Load-test sessions and subscriptions under realistic volumes, run resilience tests against network interruptions, and test certificate renewal before it happens in production.
  6. Deploy and operate. Put monitoring and alerting on connection health, keep audit records of configuration changes, and schedule routine certificate rotation rather than waiting for expiry notices.

Pro Tip: Run your certificate renewal test in a sandbox environment first; a failed renewal on a live production endpoint can take a whole data feed offline until someone notices.

For plants with older equipment that has no native OPC UA server, our piece on connecting legacy machines walks through gateway and protocol-bridging patterns that fit into this same checklist at the network-planning stage. Our automation architecture guide is a useful companion when deciding how OPC UA fits alongside your existing OT/IT layering.

Developer tools, stacks and reference implementations

You rarely need to build an OPC UA stack from scratch. The OPC Foundation maintains UA-.NETStandard, an official reference implementation covering client, server, PubSub, Global Discovery Service and Device Integration features, with NuGet packages and container images ready for sandbox use.

Practical starting points include:

  • Console reference servers and clients from the UA-.NETStandard repository, useful for reproducing production scenarios before touching the plant network.
  • Dockerised quickstarts that spin up a working server-client pair in minutes for early-stage testing.
  • Device Integration documentation covering DiNodeManager and DiDeviceClient patterns for building device-aware servers and clients that follow the OPC 10000-100 companion specification.
  • Endpoint discovery and secure channel validation utilities bundled with the reference stack, which save you from writing low-level connection handling yourself.

How Mestric™ MES connects to OPC UA

We built Mestric™ MES to connect directly to shop-floor equipment, capturing real-time KPIs, downtime and quality parameters as they happen rather than through manual logging. Our AI-powered optimisation tools then turn that live feed into process recommendations your production team can act on the same shift.

Our recommended integration pattern follows the same logic as the checklist above:

  • Discover the OPC UA endpoints and address space your equipment already exposes.
  • Map the relevant nodes to the KPIs and quality parameters you want visible on your dashboards.
  • Ingest the data into Mestric™ and validate it against known production values before switching reporting over fully.

If you want to see this running on real equipment rather than in the abstract, our onsite demonstration shows OPC UA data flowing into live MES dashboards on a working production line.

Choosing native OPC UA vs gateway translation

Use native OPC UA wherever your equipment supports it: you get the full semantic model and security stack without translation loss. Reach for a gateway only for legacy devices, with a clear node-mapping plan and a lifecycle for replacing it. Favour PubSub for high-scale telemetry, and client-subscriptions where you need tight operational control.

— Andraž

How to evaluate Mestric™ for your OPC UA integration

A connected MES removes manual data collection from your shift handovers and gets KPIs onto a dashboard as production happens, not hours later. If your equipment already speaks OPC UA, that connection work is largely done before you start.

Mestric

We’d suggest requesting an onsite demonstration of Mestric™ to see this against your own equipment rather than a generic setup. Bring along:

  • A short list of your OPC UA endpoints and their security policies.
  • A handful of sample NodeIds from the machines you want connected first.
  • The KPIs you most want visible on day one, downtime, quality rate or throughput are common starting points.

FAQ

What is OPC UA used for in manufacturing?

OPC UA is used to move structured, semantically described machine data between equipment and systems such as MES, SCADA and ERP, covering telemetry, alarms, historical values and device configuration. It is widely adopted because the data arrives typed and self-describing rather than as raw register values.

How does OPC UA differ from OPC Classic?

OPC UA replaces the DCOM-dependent transport of OPC Classic with standard TCP/IP, works across Windows and Linux, and adds built-in security through certificates and SecureChannel encryption. It also introduces a richer information model, including namespaces and companion specifications for specific device types.

Does OPC UA fully satisfy IEC/ISA 62443 requirements?

OPC UA covers much of the authentication, authorisation and communication security described in ISA/IEC 62443-4-2, but it does not cover everything the standard family asks for. Organisational controls, secure development lifecycle practices and account management are left to the integrator and operator, as set out in the IEC 62443 primer.

Which developer stack should I use to build an OPC UA integration?

The OPC Foundation’s UA-.NETStandard stack is the official reference implementation, supporting client, server, PubSub and Device Integration features with ready-to-use console servers and clients. It is a practical starting point for sandbox testing before connecting to live plant equipment.

Can Mestric™ MES connect directly to OPC UA equipment?

Yes. Our MES connects directly to equipment exposing OPC UA, capturing KPIs, downtime and quality data in real time for display on live dashboards. Pricing and onboarding details are available on request through an onsite demonstration.

Sources


crossmenu