Plant-floor data has never been in higher demand, essential to provide a steady information feed for manufacturing execution system (MES), process historian, cloud analytics and Industrial Internet of Things (IIoT) platforms. However, the people running these enterprise-level platforms are rarely the same as those on the manufacturing team, who are more familiar with programmable logic controllers (PLCs) running ladder logic. PLCs represent a sizable percentage of the data sources in a typical plant environment.

There are numerous options for connecting operational technology (OT) data up to enterprise information technology (IT) resources, but doing so has often required gateways, network design and custom integration to create and sustain the link—a degree of overhead only feasible for critical applications, and larger companies able to afford the expense. For applications with smaller PLC-based machines and processes, designers need a better way to efficiently connect OT with IT, without adding interposing PCs, proprietary middleware or impacting deterministic control in the field.

The OPC Unified Architecture (OPC UA) data exchange standard addresses this challenge, and now, a new module is available to leverage this technology and streamline secure data access to small PLCs.

Achieving Cross Platform Clarity

OPC UA is a platform-independent, service-oriented communications architecture, standardized internationally as IEC 62541 and maintained by the OPC Foundation, a vendor-neutral industry consortium. While older industrial protocols simply transported raw values, OPC UA includes provisions for contextualizing data with meaning and structure so the receiving applications can easily use the information. Cybersecurity considerations—mandatory for any modern implementation—are built right in, including authentication and encryption.

READ MORE: Better Device-Level Protocols Build a Stronger Connection

These features make OPC UA useful at just the local OT level, or for connectivity between OT and IT, supporting clients and ecosystems from most any manufacturer without interposing translation layers. Local PLC connections with other PLCs, human-machine interfaces (HMIs), and supervisory control and data acquisition (SCADA) systems commonly remain on-premises, while other connections to remote enterprise computing resources may operate over the internet.

It is important to note that contextualization and cybersecurity functions do impose a compute burden on the devices using OPC UA. Larger PC- and server-based systems easily accommodate this load, and many platforms include OPC UA as a standard interface. However, implementing OPC UA on smaller OT-centric devices, where deterministic performance is essential, presents a small hurdle.

The Case for a Dedicated Module

In an industrial automation context, determinism describes how responsive digital systems must be. Many machine and process control applications demand rigorous determinism, sometimes on the order of milliseconds. On the other hand, for cases such as communicating a room temperature or a large tank level in less-critical applications, a determinism of seconds, minutes or even hours might be acceptable. PLCs are used for all these types of applications, but they are usually valued for their millisecond-level control capabilities.

It is certainly possible to stuff every conceivable communications protocol stack into a PLC, and some models do include many options, but this imposes a monetary and/or performance price. This approach unnecessarily burdens a controller, especially those tailored for smaller applications, with tasks that have nothing to do with running the machine. Adding external gateways, computing devices and cabling is an alternate method for keeping PLCs streamlined, but this means more elements to procure, configure, manage and secure.

Fortunately, there is another way: supplementing a small PLC with a purpose-built add-on module, a device with its own processor that manages specific communications tasks independently to keep the deterministic controller unloaded. An OPC UA module empowers designers to add exactly the connectivity a project needs, without impacting the PLC’s performance (Figure 1).

A communications module transforms the PLC into a full OPC UA v1.04 server. The module runs its own embedded firmware on a dedicated processor, completely independent of the PLC CPU, while exchanging data with it over a high-speed internal bus. This facilitates client polling, session management, data marshaling and other processes void of any competition with the ladder logic for resources.

For typical OT connectivity, the PLC Ethernet port remains available, while the OPC UA module has a completely separate Ethernet port for connecting with higher level systems. Users maintain the expected PLC performance experience and gain dedicated communications processor handling external connectivity. On a local network segment, OPC UA subscription updates typically arrive in the low milliseconds, well within the needs of most monitoring, analytics and supervisory applications.

Connecting Securely, Without Re-engineering

The CLICK PLUS platform already uses ladder logic programming with free development software (aligned with the IEC 61131-3 standard), and adding OPC UA only requires inserting the option module and performing light configuration in the same environment (Figure 2).

Users define what data is exposed by configuring up to 1,204 data nodes, and the module supports up to five simultaneous OPC UA client connections. Each node can represent a range of up to 128 elements of any PLC data type—bits, integers, floats and more—providing significant flexibility in how machine data is organized and exposed to edge applications. This information can be entered directly, or via CSV import/export files, to manage large node counts efficiently.

Updates between the PLC CPU and the OPC UA module via internal high-speed bus are near-real-time, and users simply need to configure appropriate OPC UA subscription publication intervals to avoid over-polling. A microSD slot supports cards up to 32GB, providing meaningful local storage for buffering of SNTP timestamped data (although more extended store-and-forward capability is usually implemented in higher-level clients). For most machine-level data acquisition applications, the OPC UA module’s data volume and bandwidth are more than sufficient for transferring process values, status bits, counters, setpoints and much more. The client’s polling rate is typically the limiting factor.

Because OPC UA treats security as a core requirement, the communications module supports:

• An IP allow list
• Username/password authentication for up to eight accounts
• Both Sign and Sign & Encrypt security policies with modern encryption algorithms
• Self-signed application certificates in configurable key lengths, ranging from 2,048 to 4,096 bits
• Ability to disable ping responses

Together, these features give users a solid, layered security base well-suited for industrial environments connecting OT systems to IT networks, narrowing the attack surface considerably. Combined with the dedicated Ethernet port, the OPC UA module effectively enforces a demilitarized zone between the factory floor and the enterprise network without requiring a managed switch or a separate firewall appliance.

Built For the OT World, Not the Data Center

A multitude of applications can benefit from OPC UA connectivity but simply can’t support the expense of overspecifying a controller, or the complexity of adding additional gateway and networking layers. The ability to size a PLC to the automation workload and add an OPC UA module for an uplink provides a massive advantage for OEMs and systems integrators because it gives them and their end-users more data integration and analytics options.

However, this approach is only valid if the components can survive challenging industrial environments. In this case, application architects can obtain the best of both worlds because the OPC UA module is designed to work with a proven PLC platform.

READ MORE: Sending Signals: Sorting Out Single-Cable Sensor Connectivity

The hardware carries the certifications machine builders look for in industrial hardware, including UL listing (File No. E157382), CE marking (EN61131-2), CUL certification (Canadian C22.2) and RoHS compliance, along with a Pollution Degree 2 environmental rating plus IEC vibration (5-150 Hz, 3 axes) and shock (15G peak) ratings. It operates across the same 0° to 55°C range expected of DIN-rail-mounted PLCs, and its low-power design saves energy and minimizes heat generation.

Because the module’s firmware is developed and supported directly by the supplier, rather than tied to a third-party Linux distribution's update calendar, machine builders specifying equipment with a 10- to 20-year service life gain a clearer, more controllable path for firmware and security updates over that lifespan.

An Open Path Forward

Choosing an open, internationally standardized protocol over a closed or proprietary one is almost always the safer long-term bet for machines that will spend potentially decades on a factory floor. An open architecture protects end-users’ flexibility to change SCADA vendors, connect to new analytics platforms, migrate to different cloud providers and much more without enduring a proprietary integration with every change.

Standardized add-on modules also help users preserve existing hardware and engineering investments by adding simple components to previously validated systems already running proven PLC logic. This is an additive capability—not a disruptive replacement—bringing the power of the edge to legacy and small-scale devices, enhancing them with enterprise-grade data connectivity and analytics.

As OT/IT convergence extends down to ever smaller machines and systems, the combination of proven automation hardware along with ruggedized components supporting standard protocols is an ideal way to create modern connectivity alongside reliable deterministic control, while minimizing the cost and risk.