Modern industrial enterprises face a critical limitation: legacy SCADA-MES integrations create isolated data silos. This prevents the scaling of digital solutions, as well as the implementation of AI and predictive analytics without prior unification. While vast volumes of information accumulate in industrial environments, much of it remains unused due to a lack of context. Attempts to build end-to-end analytics by simply copying raw logs to the cloud lead to inefficient resource expenditure on manual data mapping.
Why classic SCADA-MES integration hinders industrial analytics development
Data fragmentation and the lack of semantic compatibility between OT (operational technology) equipment and IT systems force engineers to spend resources on building adapters rather than developing valuable analytical models. Traditional industrial automation protocols transmit raw bytes.
For example, if a system reads a value from a specific register, it receives only a number devoid of semantics. Without a unified standard, IT systems do not understand the meaning of these signals, and direct ad-hoc integrations are extremely fragile. Any change in the programmable logic controller (PLC) configuration or sensor replacement on a production line breaks the data transmission chain. Furthermore, attempts to connect legacy controllers directly to the cloud create critical vulnerabilities in the enterprise security perimeter.
OPC UA semantic interoperability: turning raw signals into meaningful data
To overcome these barriers, the OPC UA (Open Platform Communications Unified Architecture) standard was developed. According to OPC Foundation specifications, OPC UA provides a platform-independent architecture for secure and reliable interoperability between equipment, SCADA/MES, and corporate systems. Its key advantage is ensuring semantic compatibility.
A real-world application is the normalization of data from diverse PLCs from different manufacturers into a unified semantic format before transmission to a predictive maintenance system. Instead of flat tag lists, devices are described as objects with properties and relationships. Information from controllers is normalized at the gateway level into a unified information template containing standardized variables (rotational speed, load current, temperature). The analytical platform receives structured data with context, regardless of the physical equipment brand.
At the same time, implementing the standard does not require the immediate replacement of existing SCADA systems. OPC UA acts as an integration layer that allows existing equipment to be combined into a modern information infrastructure.
Edge-to-cloud architecture: distributing computing between local and cloud environments
Building a reliable industrial internet of things (IIoT) system requires a thoughtful distribution of workloads. According to AWS Well-Architected IoT Lens best practices, the reliability of an IoT solution is established at the device→edge→cloud architecture stage. It is critical to determine which data should be processed at the local edge and which in the cloud environment.
Transmitting the entire array of raw telemetry to the cloud creates excessive load. The solution is to use edge computing to filter high-frequency telemetry (e.g., from vibration sensors) before sending aggregated metrics to the cloud analytical platform. A local gateway collects the data array, performs primary analysis, and transmits only aggregated metrics or signals deviations.
To build such a hybrid architecture, it is advisable to use platforms that support edge data collection and industrial protocols. An example in the technology portfolio of the C-ECO consortium is the AZIOT IoT platform, which provides infrastructure monitoring and integration with SCADA via MQTT, Modbus, and OPC UA. The solution is built on the UnityBase platform, which provides a reliable foundation for enterprise systems. Utilizing UnityBase platform mechanisms (specifically Domain metadata, RBAC/RLS, audit trail) allows for the creation of scalable solutions with flexible domain models, automated REST API, and a high level of action auditing, which is necessary for critical facilities.
IT/OT convergence security: implementing ISA/IEC 62443 and NIST SP 800-82 standards
IT and OT convergence carries specific security risks. According to NIST SP 800-82 recommendations for OT protection, system availability is often prioritized over confidentiality, requiring specific protection approaches distinct from classic IT controls (e.g., sudden controller blocking can lead to an accident).
The foundation of cybersecurity in this area is the ISA/IEC 62443 series of standards. It covers over 20 industries where OT is used and requires a conceptual approach to security. Since OPC UA does not automatically solve all problems without additional firewalls, 62443 standards require the implementation of strict network segmentation between the production floor and the corporate IT network.
In practice, this means creating a demilitarized zone (DMZ) to prevent unauthorized access to critical controllers. Direct traffic is blocked, and information exchange occurs through secure edge gateways.
Practical steps for building a unified production telemetry layer
The transition to a unified IIoT architecture involves the following stages:
- Audit and classification: Identifying equipment that natively supports OPC UA and systems that require the installation of transitional edge gateways.
- Semantic modeling: Developing unified information models (Address Space) for normalizing raw indicators.
- Security and segmentation: Implementing DMZ and security measures in accordance with ISA/IEC 62443 standards and NIST recommendations.
- Edge infrastructure: Deploying local computing nodes for telemetry aggregation and reducing network load.
- Analytical integration: Configuring reliable transmission of cleaned data to predictive maintenance systems.
Optimizing industrial equipment operation based on accurate data also has a direct environmental impact. Preventing emergency shutdowns through predictive analytics reduces energy consumption and decreases the volume of defective products, supporting the sustainable development (eco-digitalisation) of industrial enterprises.
Industrial data integration maturity levels (IT/OT convergence)
| Maturity level | Architecture description |
|---|---|
| Level 0 (Isolated) | Data is locked within local SCADA/PLC. No integration, analytics are manual only. |
| Level 1 (Point-to-point) | Direct ad-hoc integrations via scripts and adapters. High maintenance costs, lack of semantics. |
| Level 2 (Unified Edge) | Use of OPC UA at the shop floor level. Data is normalized, but analytics are limited to the local circuit. |
| Level 3 (Hybrid) | Segmented data transmission via edge gateways to the cloud/MES with filtering and encryption per ISA/IEC 62443. |
| Level 4 (Digital Twin) | Full semantic compatibility. Real-time predictive maintenance based on enterprise platforms (such as AZIOT). |
FAQ
How does OPC UA solve the compatibility problem for equipment from different brands (Siemens, Beckhoff, Rockwell)?
OPC UA uses unified object-oriented models (Address Space). Thanks to this, information from controllers of different manufacturers is normalized into unified information templates, providing IT systems with structured data with clear semantics, regardless of the equipment brand.
Is it safe to connect industrial controllers directly to cloud analytics platforms?
No, direct connection of legacy controllers to the cloud creates critical vulnerabilities in the enterprise security perimeter. For reliable protection, it is necessary to use edge gateways and network segmentation (creating a DMZ) to prevent direct unauthorized access from the IT network to physical equipment.
What is the role of ISA/IEC 62443 standards in protecting legacy systems when implementing IIoT?
The ISA/IEC 62443 series of standards defines architectural requirements for cybersecurity in the OT environment, including requirements for network segmentation and defense-in-depth. This allows for the safe integration of older equipment that does not support modern encryption by separating it with external security barriers.