OPC UA Client and Server

OPC UA stands for "OPC Unified Architecture." OPC itself dates back to 1996 as "OLE for Process Control," and was later reinterpreted as "Open Platform Communications" once it outgrew Microsoft's OLE technology. OPC UA is the modern, platform-independent, service-oriented standard for exchanging data between industrial equipment, applications, and enterprise systems. It goes well beyond a simple point-to-point protocol: it defines a structured information model (an "address space" of nodes, types, and relationships), built-in security, and services for real-time subscriptions, historical access, alarms and events, and method calls. The OPC Foundation maintains it, and virtually every major automation vendor implements it.

An OPC UA server exposes data as a browsable information model that other applications can connect to. That source might be a PLC, a historian, or a piece of software. An OPC UA client is the application that connects to a server to browse, read, write, and subscribe to that data. Many devices and platforms are both: a Siemens S7-1500 typically runs an OPC UA server, while a SCADA package typically runs as a client to consume it.

OPC DA (Data Access) is the original "OPC Classic" standard: a Windows-only, COM/DCOM-based protocol for reading and writing live process values, with no built-in security and no standardized information model. OPC UA replaced it with a platform-independent, secured, structured architecture that also adds historical access, alarms and events, and method calls, capabilities OPC DA never had. OPC DA still runs on a lot of legacy Windows-based SCADA and historian installs, so most real-world integration work involves bridging OPC DA sources into OPC UA (or MQTT) rather than choosing one from scratch.

Yes, in a couple of forms. UaExpert, from Unified Automation, is a free (though closed-source) generic client for browsing a server's address space and testing connectivity, and it's a great first stop. Node-RED, which FlowFuse is built on, also has free, open-source community OPC UA client nodes such as node-red-contrib-opcua. Those take you beyond browsing, so you can build a production flow around what you find at no license cost. FlowFuse also offers a professionally maintained OPC UA Certified Node, built by Sterfive, as part of the FlowFuse Edge offering, for teams that want that node vetted and supported rather than self-maintained.

Neither, and it doesn't replace a PLC either. It's the layer that lets a PLC, a SCADA system, a historian, or an MES expose and exchange data in a common, structured, secured way. Many PLCs expose an OPC UA server alongside their own native protocol (S7comm, EtherNet/IP, and so on). If you're integrating directly with PLC hardware across multiple protocols rather than with OPC UA specifically, see the FlowFuse PLC integration.

OPC UA builds security into the specification rather than bolting it on afterward: application authentication via X.509 certificates, user authentication, and message-level SignAndEncrypt for integrity and confidentiality. The problem in practice isn't the spec. Trust lists get left in "accept all" mode, self-signed certificates never get rotated, and Security Policy gets set to None for convenience during commissioning and never revisited. Our two-part guide covers both sides: how attackers actually exploit these gaps and how to build a defensible architecture with Reverse Connect, proper trust lists, and GDS-managed certificates.

They solve different problems, so the question is usually a category error. OPC UA excels at structured, semantically rich, request/response and subscription-based access to a single source, with strong native security. MQTT excels at lightweight, many-to-many publish/subscribe distribution across a network, brokers, and a Unified Namespace. Most production architectures use both: OPC UA to pull structured data out of a PLC or historian, MQTT to distribute it broadly. Read the full breakdown in MQTT vs OPC UA: Why This Question Never Has a Straight Answer.

OPC UA is technically superior on almost every axis, security, data typing, discoverability, yet Modbus still ships on new field devices because it's simpler, cheaper to implement on constrained hardware, and universally supported without licensing or certificate overhead. See Why OPC UA Is Not Replacing Modbus (Yet) for the full technical and commercial breakdown, and what would actually have to change for that to shift.

Yes, with one restriction. FlowFuse can browse and read/write tags from any third-party OPC UA server as a client, on any deployment, cloud or self-hosted. Acting as a server, exposing FlowFuse's own information model for other OPC UA clients to consume, requires self-hosted FlowFuse. It isn't available on FlowFuse Cloud, since Cloud only exposes HTTP/HTTPS and an OPC UA server needs a raw TCP port. On self-hosted FlowFuse, client and server nodes share one certificate store, so a single deployment can pull data in from a PLC's server and simultaneously re-serve a curated, secured model upstream.

Not necessarily. Kepware and similar products became the default when building an OPC UA server or client from scratch was hard, but per-tag pricing scales badly and recent ownership changes have made long-term cost and support less predictable. FlowFuse can connect to an existing Kepware server as a client on any deployment (see our Kepware connection guide), or replace it outright by building the OPC UA client or server directly in Node-RED, with server hosting requiring self-hosted FlowFuse. See Beyond Kepware: Why Modern Industrial Connectivity Demands a Second Look.

FlowFuse can poll or subscribe to OPC UA nodes and write timestamped values into a time-series database like InfluxDB or TimescaleDB. That gives you a durable, queryable history independent of the PLC's own limited historian buffer. Walk through the full setup in Historical Data Logging with OPC UA and InfluxDB. FlowFuse also supports OPC UA's native Historical Access (HA) service directly, for servers that already maintain their own history.

Yes. Because OPC UA already exposes a structured, browsable information model, it's a natural fit for agentic AI. Instead of an engineer manually browsing an address space to investigate a fault, an AI agent can query the model directly, correlate live values with alarms and history, and surface a root cause. See Agentic AI Reads OPC UA Servers So You Don't Have To for how this works with FlowFuse's MCP support.

Both. Run FlowFuse on FlowFuse Cloud, self-managed on your own infrastructure, or on the FlowFuse Device Agent at the edge, right next to the OPC UA servers you're connecting to. Many teams run the OPC UA client or server on an industrial PC inside the plant network, then forward selected data outward over MQTT or a secured OPC UA Reverse Connect session. Nothing has to accept inbound connections from outside the plant.

Both are available. You can use free, open-source community OPC UA nodes in any FlowFuse deployment, the same packages you'd use in plain Node-RED. FlowFuse also offers a FlowFuse Certified Node for OPC UA, built on node-opcua and developed and maintained by Sterfive, the team behind that stack, delivered through the FlowFuse Edge Certified Nodes catalogue. FlowFuse vets certified nodes for quality, security, and support, and keeps them maintained on an ongoing basis, unlike community packages, which vary in quality and can go unmaintained without warning. See the OPC UA Certified Node documentation for the full capability set, contact us to enable it, or read about how FlowFuse Certified Nodes work.