![\"A](\"https://wiki.aspotomasyon.com/assets/diagrams/opc-solutions-context.svg\")
OPC UA Pub/Sub extends the traditional client-server OPC UA model with a publish-subscribe communication pattern. This enables one-to-many data distribution, scalable telemetry architectures, and integration with non-OPC-UA systems via MQTT and AMQP transport protocols. This guide covers practical Pub/Sub configuration for industrial deployments.
The traditional OPC UA client-server model establishes a one-to-one (or one-to-few) connection pair: a client opens a secure channel to a server, requests data, and receives responses. This pattern works well for HMI-to-controller and SCADA-to-PLC communication, where a known set of consumers reads from a known set of producers. However, it becomes inefficient when data must reach many subscribers simultaneously: each additional subscriber requires a separate TCP connection and dedicated bandwidth on the server.
\n\nOPC UA Pub/Sub decouples publishers from subscribers through a message-oriented middleware layer. A publisher sends data messages to a message broker (for MQTT or AMQP) or directly onto the network (for UDP multicast) without knowing which subscribers will consume them. Subscribers receive messages by subscribing to topics or multicast groups. This 1:N model delivers three key advantages:
\nThe OPC UA Pub/Sub specification (IEC 62541-14) defines two key concepts for data organisation:
\nConfigured Dataset is a template that defines which Variables are to be published and how often. It is created and stored on the publisher side, typically during engineering time. For example, a \"Pump Status Dataset\" might include pump speed, discharge pressure, motor current, bearing temperature, and run hours, with a sampling interval of 100 milliseconds.
\nPublished Dataset is the runtime instance of a Configured Dataset: the actual data snapshot that is serialised and transmitted at each publish cycle. The Published Dataset header includes metadata such as a dataset writer ID, sequence number, timestamp, and optional status information. Subscribers use this metadata to detect data loss, ensure ordering, and synchronise time.
\nExample: A PLC configured with an \"Analog Inputs\" dataset (four 4–20 mA channels sampled at 50 ms) publishes a DataSetMessage every 100 ms over MQTT. The message payload contains the current raw counts and scaled engineering values, along with quality flags. An edge gateway subscribes to this MQTT topic and forwards the data to a cloud historian.
\n\n| Protocol | Topology | Latency | Best For | Examples |
|---|---|---|---|---|
| UDP Multicast | LAN, 1:N directly | < 1 ms | Real-time control, high-speed peer-to-peer | Controller-to-controller, fast I/O sharing |
| MQTT | WAN, broker-mediated | 10–100 ms | Cloud/edge IoT, telemetry | AWS IoT Core, Azure IoT Hub, EMQX, Mosquitto |
| AMQP | Enterprise, broker-mediated | 10–50 ms | Enterprise messaging, transactional data | RabbitMQ, ActiveMQ, Azure Service Bus |
UDP multicast is ideal for time-critical data distribution within a single plant network. It requires network switches with IGMP snooping to avoid flooding all ports. The 1:N efficiency comes from the network layer itself handling replication, so even 100 subscribers place minimal load on the publisher.
\nMQTT is the preferred choice for sending OPC UA data beyond the plant firewall. The broker decouples publisher and subscriber lifecycles: a cloud application can subscribe and receive the latest value even if it was published hours ago (retained messages). MQTT Sparkplug extends this with state management and birth/death certificates for industrial use cases.
\nAMQP excels in enterprise environments where message delivery guarantees, transactions, and routing flexibility are required. It supports sophisticated exchange types (direct, topic, fanout, headers) and can integrate with existing enterprise service buses.
\n\nPub/Sub introduces a different threat model than client-server. Key security measures include:
\nConsider a Siemens S7-1500 PLC publishing process data to Azure IoT Hub via MQTT:
\nmqtts://myhub.azure-devices.net:8883).opcua/pubsub/+/ProcessData, and writes incoming values to a time-series database.\nASP OTOMASYON A.Ş. and its subsidiaries OPCTurkey and ASP Dijital provide end-to-end industrial engineering solutions for process automation, data operations and AI.
Follow an ASP project guide to connect the fundamentals with implementation and acceptance.
![\"Engineering](\"https://wiki.aspotomasyon.com/assets/diagrams/opc-solutions-review.svg\")
Use the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.
","markdown":"# OPC UA Pub/Sub Configuration and Deployment Guide\n\n> OPC UA Pub/Sub extends the traditional client-server OPC UA model with a publish-subscribe communication pattern.\n\n- Canonical URL: https://wiki.aspotomasyon.com/article/opc-ua-pub-sub-configuration\n- Publisher: ASP OTOMASYON A.Ş. (ASP OTOMASYON Wiki)\n- Category: OPC Solutions\n- Published: 2026-05-13 · Updated: 2026-09-13\n- Reading time: 6 min · Language: English\n\n**OPC UA Pub/Sub** extends the traditional client-server OPC UA model with a publish-subscribe communication pattern. This enables one-to-many data distribution, scalable telemetry architectures, and integration with non-OPC-UA systems via MQTT and AMQP transport protocols. This guide covers practical Pub/Sub configuration for industrial deployments.\n\n\n\n*A conceptual OPC UA client/server path. Application certificates establish application trust; user authorization controls what a connected user may do.*\n\n---\n\n## Pub/Sub vs Client-Server Architecture\n\nThe traditional OPC UA client-server model establishes a one-to-one (or one-to-few) connection pair: a client opens a secure channel to a server, requests data, and receives responses. This pattern works well for HMI-to-controller and SCADA-to-PLC communication, where a known set of consumers reads from a known set of producers. However, it becomes inefficient when data must reach many subscribers simultaneously: each additional subscriber requires a separate TCP connection and dedicated bandwidth on the server.\n\n**OPC UA Pub/Sub** decouples publishers from subscribers through a message-oriented middleware layer. A publisher sends data messages to a message broker (for MQTT or AMQP) or directly onto the network (for UDP multicast) without knowing which subscribers will consume them. Subscribers receive messages by subscribing to topics or multicast groups. This 1:N model delivers three key advantages:\n\n- **Scalability:** Adding subscribers does not increase load on the publisher. Thousands of subscribers can consume the same data stream.\n- **Latency:** UDP multicast offers the lowest possible latency (~sub-millisecond) for real-time control loops because there is no connection handshake or broker overhead.\n- **Loose coupling:** Publishers and subscribers can be added, removed, or replaced without reconfiguring each other. This is essential for cloud integration, edge analytics, and dynamic system topologies.\n\n## Configured Dataset vs Published Dataset\n\nThe OPC UA Pub/Sub specification (IEC 62541-14) defines two key concepts for data organisation:\n\n**Configured Dataset** is a template that defines which Variables are to be published and how often. It is created and stored on the publisher side, typically during engineering time. For example, a \"Pump Status Dataset\" might include pump speed, discharge pressure, motor current, bearing temperature, and run hours, with a sampling interval of 100 milliseconds.\n\n**Published Dataset** is the runtime instance of a Configured Dataset: the actual data snapshot that is serialised and transmitted at each publish cycle. The Published Dataset header includes metadata such as a dataset writer ID, sequence number, timestamp, and optional status information. Subscribers use this metadata to detect data loss, ensure ordering, and synchronise time.\n\nExample: A PLC configured with an \"Analog Inputs\" dataset (four 4–20 mA channels sampled at 50 ms) publishes a DataSetMessage every 100 ms over MQTT. The message payload contains the current raw counts and scaled engineering values, along with quality flags. An edge gateway subscribes to this MQTT topic and forwards the data to a cloud historian.\n\n## Transport Protocol Selection\n\n| Protocol | Topology | Latency | Best For | Examples |\n| --- | --- | --- | --- | --- |\n| **UDP Multicast** | LAN, 1:N directly | < 1 ms | Real-time control, high-speed peer-to-peer | Controller-to-controller, fast I/O sharing |\n| **MQTT** | WAN, broker-mediated | 10–100 ms | Cloud/edge IoT, telemetry | AWS IoT Core, Azure IoT Hub, EMQX, Mosquitto |\n| **AMQP** | Enterprise, broker-mediated | 10–50 ms | Enterprise messaging, transactional data | RabbitMQ, ActiveMQ, Azure Service Bus |\n\n**UDP multicast** is ideal for time-critical data distribution within a single plant network. It requires network switches with IGMP snooping to avoid flooding all ports. The 1:N efficiency comes from the network layer itself handling replication, so even 100 subscribers place minimal load on the publisher.\n\n**MQTT** is the preferred choice for sending OPC UA data beyond the plant firewall. The broker decouples publisher and subscriber lifecycles: a cloud application can subscribe and receive the latest value even if it was published hours ago (retained messages). MQTT Sparkplug extends this with state management and birth/death certificates for industrial use cases.\n\n**AMQP** excels in enterprise environments where message delivery guarantees, transactions, and routing flexibility are required. It supports sophisticated exchange types (direct, topic, fanout, headers) and can integrate with existing enterprise service buses.\n\n## Security Considerations for Pub/Sub\n\nPub/Sub introduces a different threat model than client-server. Key security measures include:\n\n- **Authentication:** MQTT supports username/password, X.509 certificates, and OAuth 2.0. For UDP multicast, network-level isolation (VLANs, ACLs) is typically used since there is no built-in authentication.\n- **Encryption:** MQTT over TLS (port 8883) encrypts the entire broker connection. AMQP supports TLS natively. UDP multicast messages can be encrypted using AES-256-GCM at the application layer via OPC UA security mechanisms.\n- **Message signing:** OPC UA Pub/Sub supports asymmetric and symmetric signing of DataSetMessages to prevent tampering and replay attacks.\n- **Key management:** For large-scale deployments, a PKI infrastructure is essential to issue, renew, and revoke certificates for publishers and subscribers. The OPC UA Global Discovery Server (GDS) can automate certificate lifecycle management.\n\n## Configuration Example: PLC Publisher to Cloud Subscriber\n\nConsider a Siemens S7-1500 PLC publishing process data to Azure IoT Hub via MQTT:\n\n1. On the PLC, create a Configured Dataset named \"ProcessData\" containing reactor temperature, pressure, and valve position.\n2. Configure a PubSub connection with the MQTT broker URL (e.g., `mqtts://myhub.azure-devices.net:8883` ).\n3. Set the publish interval to 500 ms. Each Published Dataset includes the current values, a sequence number, and a UTC timestamp.\n4. On the cloud side, deploy an OPC UA MQTT subscriber application that connects to the same broker, subscribes to the topic `opcua/pubsub/+/ProcessData` , and writes incoming values to a time-series database.\n5. Verify message delivery: the subscriber checks that sequence numbers are contiguous (gap indicates a lost message). Retained messages allow late-joining subscribers to receive the last known value immediately.\n\n> ASP OTOMASYON A.Ş. and its subsidiaries OPCTurkey and ASP Dijital provide end-to-end industrial engineering solutions for process automation, data operations and AI.\n\n---\n\n## References & Further Reading\n\n1. [OPC UA Part 14: PubSub — IEC 62541-14](https://reference.opcfoundation.org/Core/Part14/v105/docs/) — Official OPC Foundation specification for publish-subscribe communication, covering UDP multicast, MQTT, and AMQP transport protocol mappings.\n2. [OPC Foundation — OPC UA Overview and Architecture](https://reference.opcfoundation.org/specs/OPC-10000-1) — Official technical overview of OPC UA architecture, comparing client-server and Pub/Sub communication patterns for industrial automation.\n3. [OASIS MQTT — Message Queuing Telemetry Transport Standard](https://mqtt.org) — Official MQTT protocol specification (OASIS Standard), the primary transport protocol for OPC UA Pub/Sub deployments over wide-area networks.\n4. [OASIS AMQP — Advanced Message Queuing Protocol Standard](https://www.amqp.org) — Official AMQP 1.0 specification, an alternative transport protocol for OPC UA Pub/Sub in enterprise messaging environments.\n5. [OPC Foundation — Companion Specifications Directory](https://reference.opcfoundation.org/) — Official directory of OPC UA companion specifications that leverage Pub/Sub for industry-specific information models and data integration.\n\n## Apply this to your project\n\n- Record the endpoint, supported security policies, application identity, certificate expiry, and user permissions.\n- Verify the value, engineering unit, StatusCode, and source timestamp together at the receiving application.\n- Test disconnection and recovery with representative subscriptions; preserve evidence of any data gaps or repeated values.\n\n[Follow an ASP project guide](https://wiki.aspotomasyon.com/guides) to connect the fundamentals with implementation and acceptance.\n\n\n\n*Engineering review sequence: Discover → Authenticate → Subscribe → Recover. Keep the recorded evidence with the accepted configuration.*\n\n## Primary references and further reading\n\nUse the original specifications and product documentation for implementation details. The examples in this guide are illustrative engineering scenarios, not published project results.\n\n- [OPC Foundation — OPC UA Part 4: Services](https://reference.opcfoundation.org/specs/OPC-10000-4/)\n- [OPC Foundation — OPC UA Part 2: Security Model](https://reference.opcfoundation.org/specs/OPC-10000-2/)\n\n---\n\nCite the canonical article: https://wiki.aspotomasyon.com/article/opc-ua-pub-sub-configuration (OPC UA Pub/Sub Configuration and Deployment Guide, ASP OTOMASYON, updated 2026-09-13).\n","headings":[{"id":"pubsub-vs-client-server-architecture","title":"Pub/Sub vs Client-Server Architecture"},{"id":"configured-dataset-vs-published-dataset","title":"Configured Dataset vs Published Dataset"},{"id":"transport-protocol-selection","title":"Transport Protocol Selection"},{"id":"security-considerations-for-pubsub","title":"Security Considerations for Pub/Sub"},{"id":"configuration-example-plc-publisher-to-cloud-subscriber","title":"Configuration Example: PLC Publisher to Cloud Subscriber"},{"id":"references-further-reading","title":"References & Further Reading"},{"id":"apply-this-to-your-project","title":"Apply this to your project"},{"id":"primary-references-and-further-reading","title":"Primary references and further reading"}],"faq":[],"references":[{"name":"OPC UA Part 14: PubSub — IEC 62541-14","url":"https://reference.opcfoundation.org/Core/Part14/v105/docs/"},{"name":"OPC Foundation — OPC UA Overview and Architecture","url":"https://reference.opcfoundation.org/specs/OPC-10000-1"},{"name":"OASIS MQTT — Message Queuing Telemetry Transport Standard","url":"https://mqtt.org"},{"name":"OASIS AMQP — Advanced Message Queuing Protocol Standard","url":"https://www.amqp.org"},{"name":"OPC Foundation — Companion Specifications Directory","url":"https://reference.opcfoundation.org/"},{"name":"OPC Foundation — OPC UA Part 4: Services","url":"https://reference.opcfoundation.org/specs/OPC-10000-4/"},{"name":"OPC Foundation — OPC UA Part 2: Security Model","url":"https://reference.opcfoundation.org/specs/OPC-10000-2/"}],"related":[{"slug":"industrial-communication-protocol-selection-guide","title":"Choosing an Industrial Communication Protocol: A Decision Guide","summary":"Pick an industrial protocol by the job it must do (cyclic control, device access, plant data, or telemetry), then match timing, data model, and security to…","category":{"slug":"modern-connectivity","name":"Modern Connectivity"},"url":"https://wiki.aspotomasyon.com/article/industrial-communication-protocol-selection-guide","markdown_url":"https://wiki.aspotomasyon.com/article/industrial-communication-protocol-selection-guide.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/industrial-communication-protocol-selection-guide","published":"2026-10-11T11:46:21+00:00","modified":"2026-10-11T11:46:21+00:00","reading_minutes":9,"word_count":1767,"image":"https://wiki.aspotomasyon.com/assets/social/industrial-communication-protocol-selection-guide-bbf4fa97587d.png"},{"slug":"time-sensitive-networking-industrial","title":"Time-Sensitive Networking (TSN) for Industrial Ethernet","summary":"Time-Sensitive Networking (TSN) is a set of IEEE 802.1 standards that make standard Ethernet deterministic: bounded latency, low jitter, and scheduled delivery…","category":{"slug":"modern-connectivity","name":"Modern Connectivity"},"url":"https://wiki.aspotomasyon.com/article/time-sensitive-networking-industrial","markdown_url":"https://wiki.aspotomasyon.com/article/time-sensitive-networking-industrial.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/time-sensitive-networking-industrial","published":"2026-08-06T12:26:37+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":5,"word_count":905,"image":"https://wiki.aspotomasyon.com/assets/social/time-sensitive-networking-industrial-39edbbf6e746.png"},{"slug":"opc-ua-mqtt-bridge-patterns","title":"OPC UA to MQTT Bridge Patterns","summary":"Industrial automation environments increasingly demand a two-tier data strategy: OPC UA for real-time, deterministic plant-floor communication and MQTT for…","category":{"slug":"opc-solutions","name":"OPC Solutions"},"url":"https://wiki.aspotomasyon.com/article/opc-ua-mqtt-bridge-patterns","markdown_url":"https://wiki.aspotomasyon.com/article/opc-ua-mqtt-bridge-patterns.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-ua-mqtt-bridge-patterns","published":"2026-05-13T12:01:15+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":8,"word_count":1649,"image":"https://wiki.aspotomasyon.com/assets/social/opc-ua-mqtt-bridge-patterns-b71382141389.png"},{"slug":"opc-ua-security-best-practices","title":"OPC UA Security Best Practices","summary":"OPC UA was designed with security as a foundational requirement, not an afterthought.","category":{"slug":"opc-solutions","name":"OPC Solutions"},"url":"https://wiki.aspotomasyon.com/article/opc-ua-security-best-practices","markdown_url":"https://wiki.aspotomasyon.com/article/opc-ua-security-best-practices.md","api_url":"https://wiki.aspotomasyon.com/api/v1/articles/opc-ua-security-best-practices","published":"2026-07-21T14:45:28+00:00","modified":"2026-09-13T11:07:23+00:00","reading_minutes":4,"word_count":860,"image":"https://wiki.aspotomasyon.com/assets/social/opc-ua-security-best-practices-8eff8da783a4.png"}],"citation":"ASP OTOMASYON. OPC UA Pub/Sub Configuration and Deployment Guide. Updated 2026-09-13. https://wiki.aspotomasyon.com/article/opc-ua-pub-sub-configuration"}}