PLC Industry 4.0: OPC UA, MQTT and Real Data Models

A PLC Industry 4.0 project lands on your desk as a request for data, not a request for control. Someone upstairs wants OEE, energy per part and a dashboard, and the assumption is that the controller can simply hand it over. It can, but only if you decide three things first: what the data model looks like, who publishes it, and what you are not going to expose. This walkthrough covers the concrete work on an S7-1500 and a Logix controller, plus the retrofit path for the machines that will still be running in 2035.

Nothing here requires new hardware on a modern controller. Most of it is configuration and one data block.

What changes, and what does not

That last row is the one people underestimate. The moment a tag name leaves the controller it becomes a column in someone’s database and a field in someone’s report. Renaming Temp1 to Zone1_Temp_C after the fact breaks three systems.

Step 1: Turn on the OPC UA server you already have

On an S7-1500 with firmware V2.0 or later, the OPC UA server is a checkbox in the device configuration plus a runtime licence. Three settings decide whether it is useful or a liability:

1. Security policy. Basic256Sha256 with sign and encrypt. Turn off anonymous access and create named users. The default open configuration is for a lab.
2. Tag visibility. A data block member is only published if its Accessible from HMI/OPC UA attribute is set, and it is only writable if Writable is set too. Leave everything else off.
3. Server interface. In TIA Portal V15.1 and later you can define a server interface, which is a small curated namespace pointing at your real variables. Publish that instead of the whole DB tree. The consumer gets Line3.Station6.CycleTime rather than DB47.DBD128.

On the Rockwell side, recent CompactLogix 5380 and 5480 firmware includes an embedded OPC UA server, and support has been rolling out across the 5580 family, so check the release notes for your controller and revision before you promise it. If your controller does not have one, a gateway does the same job. Introduction to OPC for PLC integration explains the client and server split, and Kepware channel configuration walks through the gateway route.

Step 2: Build the data model before you expose a single tag

Make one UDT per machine that is the contract. Everything the plant systems need is inside it, and nothing outside it is published. Write the mapping down in a table like this one and give it to whoever builds the dashboard.

Codes rather than strings. The PLC sends 14, the dashboard looks up “Gripper vacuum low” in a table it can edit without a download. Strings in the controller mean a download to fix a typo, and translations become impossible.

Step 3: Put MQTT at the edge, not in the controller

A PLC can be made to speak MQTT with a library, and occasionally that is the right answer. Usually it is not. The controller is deterministic, the network to the broker is not, and a TCP client that blocks or buffers inside a scan-based program is a problem you do not want on a machine.

The pattern that holds up: the controller publishes its UDT through OPC UA or its native protocol, an edge device reads it and publishes MQTT with Sparkplug B to a broker. Ignition Edge, a Kepware IoT Gateway, an IOT2050 or a groov EPIC all do this. The edge device handles store and forward when the link drops, which is the feature you actually bought.

Sparkplug adds something worth having: birth and death certificates. When the edge connects it publishes the full tag list and current values, so a consumer that joins later knows the whole picture. Which leads to the trap in the field notes below.

Step 4: Publish on change, with a heartbeat

Polling everything every second produces a historian full of identical rows. Publish when a value changes by more than a deadband, and send a heartbeat anyway so a silent machine can be told apart from a dead link.

(* EdgeTask, 200 ms periodic, routine Publish, Structured Text *)
IF ABS(Power_kW - Power_Last) > 2.0 THEN
    Pub.Trigger := 1;
    Power_Last  := Power_kW;
END_IF;

IF StateCurrent <> State_Last THEN
    Pub.Trigger := 1;
    State_Last  := StateCurrent;
END_IF;

HB_Tmr.PRE := 30000;                 (* heartbeat: prove we are alive *)
HB_Tmr.TimerEnable := 1;
TONR(HB_Tmr);
IF HB_Tmr.DN THEN
    Pub.Trigger := 1;
    HB_Tmr.ACC := 0;
END_IF;

IF Pub.Trigger THEN
    Pub.Rec.State     := StateCurrent;
    Pub.Rec.CycleTime := CycleTime_ms;
    Pub.Rec.PowerkW   := Power_kW;
    Pub.Rec.TS        := WallClock_UTC_ms;   (* controller synced to NTP *)
    Pub.Seq           := Pub.Seq + 1;        (* consumer can spot a gap *)
    Pub.Trigger       := 0;
END_IF;

The sequence number costs one DINT and tells the person reading the database whether records were lost or the machine was simply quiet. The timestamp has to come from a clock that is synchronised, otherwise every analysis that joins two machines is wrong.

Step 5: Retrofit the old controllers without opening their logic

Half the plant is an SLC 500, an S7-300 or something with a serial port. You do not need to migrate them to get data.

1. Read them with an OPC server. Kepware or Ignition speak DF1, Modbus and the S7 protocol, and the old controller does not know it is being read.
2. Meter instead of asking. A power meter and a photo-eye on the discharge give you energy per part and a production count without touching a validated program.
3. Add a small controller as a translator when you need more. A CompactLogix or a S7-1200 sitting alongside, reading a few words and publishing a clean model, is cheaper than a migration and lower risk.
4. Change nothing in the old program unless there is no other way. Every edit to a machine that has run for fifteen years is a shutdown risk and, in a regulated plant, revalidation.

Step 6: Decide what leaves the cell, and lock the rest

Every one of these steps punches a hole between the control network and everything else. Three rules cover most of the exposure:

• Segment first. The controller talks to an edge device in its own zone, the edge device talks outward. Nothing in the office VLAN opens a session directly to a PLC. That is the zones and conduits idea from IEC 62443, and it is worth the drawing.
• Read only by default. If a system does not need to write a setpoint, it does not get a writable tag. Turn the write attribute off in the controller, not just in the client.
• Keep the key switch in RUN, keep controller change detection or an audit log on, and make sure someone gets the alert. The detail is in implementing cybersecurity measures for PLC systems.

A digital twin deserves the same honesty. A model that runs the real PLC code against simulated mechanics, for commissioning or for testing a change before a shutdown, pays for itself. See introduction to PLC simulation and virtual commissioning. A rotating 3D picture fed by live tags is a nice screen, and calling it a twin only confuses the budget conversation.

Field notes

Four thousand tags at 100 ms. An integrator configured an OPC client to poll every tag in the controller at 100 ms because the field allowed it. The controller’s communication load pushed the HMI update rate into the seconds and an operator reported the screen was frozen. Ninety percent of those tags changed once a shift. Subscriptions with sensible publishing intervals fixed it in an afternoon.

The birth certificate nobody sent. After a download that added two members to the machine UDT, the edge device kept publishing but the consumer still had the old metadata, so two tags read as stale and one read garbage. Sparkplug wants a rebirth after a structure change. We added a first-scan bit that forces the edge to rebirth, and the problem has not come back.

Timestamps from a controller that thought it was Tuesday. A line’s records arrived at the historian four minutes ahead of everything else. The controller’s clock had never been synchronised and had drifted since installation. Events sorted into the wrong order, and the root cause analysis for a quality escape went down the wrong path for a week. Sync the controller to NTP, and test that it holds after a power cycle.

Anonymous access left on over a holiday. A commissioning engineer enabled the OPC UA server with anonymous access to get going, and it stayed that way. During the shutdown a contractor’s laptop browsed the namespace and wrote a value into a test tag while looking around. Nothing broke. It could have.

Frequently asked questions

Do I have to replace my PLCs for Industry 4.0?
No. Most of the value comes from the data you already have and a meter or two. Replace a controller when it fails, when spares are gone, or when the control job itself needs it.

OPC UA or MQTT?
Both, for different jobs. OPC UA is a session where a client browses and asks, which suits SCADA, MES and engineering. MQTT is publish and subscribe through a broker, which suits many machines reporting to something far away over a link that drops. IIoT data from PLC systems compares them on real traffic.

Does running an OPC UA server slow the controller?
It costs communication budget, not program scan, until you abuse it. Thousands of tags at fast intervals will show up in your HMI response and in the controller’s task overhead. Watch it after you turn it on rather than assuming.

What should I collect first on a machine that has nothing?
State, cycle time, good and scrap counts with a reason code, first-out alarm, and power. That set answers most questions people ask in the first year, and it is small enough to model properly.

Who owns the tag names?
You do, and write the convention down before the first machine. Machines added later copy the first one, correct or not.

Next step

The data model above is exactly what a plant system wants to consume, so the next move is connecting it upward: integrating PLC with MES. If the machines are spread across sites instead of one building, remote monitoring and control of PLC systems covers the access side without opening the cell to the internet.