15.2 TCP/IP, OPC, Addressing, and Architectures

Once the medium is chosen, 4.F still has you specify how packets, tags, and clients are organized. TCP/IP, OPC, and network addressing are the exam’s three named stacks. The PE question is almost never “what does the acronym stand for?” It is “which address is wrong,” “which protocol belongs on which LAN,” and “how does a historian read data without becoming a bridge onto the controllers.”

TCP/IP as the plant packet stack

Internet Protocol (IP) moves packets between networks. Transmission Control Protocol (TCP) adds a session, retransmission, and ordered delivery. User Datagram Protocol (UDP) does not. Industrial Ethernet, OPC UA over TCP (commonly port 4840), and most historian collectors ride this stack. You do not need to recite flag bits. You do need to know that a controller, an HMI, and a laptop can share a cable plant and still be different hosts with different IP addresses, and that a default gateway is how a host leaves its subnet.

A subnet mask (or prefix length) draws the local neighborhood. Hosts on the same subnet resolve each other with ARP and never hit a router. Hosts on different subnets must pass a router or Layer 3 switch. That is the first segmentation tool: put controllers and I/O on one subnet, put printers and guest laptops on another, and do not give the guest network a route to the controller subnet.

A virtual LAN (VLAN) is a switch-level segmentation tool. It splits one physical switch fabric into separate broadcast domains. VLAN 10 can be the control LAN and VLAN 40 the business LAN on the same chassis — but only if the trunk and routing rules actually keep them apart. A VLAN is not a firewall. It is a way to stop every discovery broadcast from waking every port. Treat it as necessary hygiene, then add Layer 3 filtering at the boundary.

MAC versus IP versus device addressing

Three identities get mixed on PE items:

• Media Access Control (MAC) address: the 48-bit identifier on a network interface, used only on the local Layer 2 segment. Switches forward on MAC tables. Replacing a NIC changes the MAC. Duplicate MACs (cloned interfaces, mis-set adapters) cause intermittent “the wrong device answers.”
• IP address: a logical Layer 3 identity you assign (static, DHCP, or a vendor reserved range). Duplicate IPs produce an address conflict: two hosts claim the same logical name on the wire. The symptom is flapping reachability, not a neat error banner on every HMI.
• Device or application addressing: a PROFIBUS station number, a HART long tag, a DeviceNet MAC ID, a DCS tag name, an OPC item path. These are not IP addresses. A remote I/O adapter can have IP 192.168.10.25, PROFIBUS address 12, and a cabinet name RIO-12 at the same time. Changing the IP does not rename the tag. Cloning a PLC project into a second plant without changing device addresses is a 4.A/4.F collision waiting to happen — finished in 15.3.

When a stem says “the technician replaced the switch and now the PLC has a new address,” ask which address. The MAC of the PLC NIC did not change. The switch’s own management IP might have. The PLC IP did not change unless someone edited it. The DCS tag did not change at all.

OPC Classic versus OPC UA, client/server versus publish/subscribe

OPC Classic (OLE for Process Control) is the 1990s Windows family: OPC DA (current values), OPC HDA (history), OPC A&E (alarms and events). It rides COM/DCOM. DCOM wants a wide, poorly documented port range, Windows authentication, and a lot of hope at a firewall. Classic OPC still exists because plants still have it. It is a poor choice for a new path through a DMZ.

OPC Unified Architecture (OPC UA), published as IEC 62541, is the successor: platform-independent (Windows, Linux, embedded), an information model with browseable nodes, and a security model with X.509 certificates, signing, and encryption. The common client/server mapping uses a single configurable port (4840/TCP is the usual default) instead of DCOM’s port spray.

Two communication patterns sit on UA:

• Client/server (IEC 62541 Part 4): a client opens a session, browses, reads, writes, calls methods, and may create a subscription so the server pushes changes. This is the right pattern for engineering clients, alarm clients, and many historian collectors that need acknowledgements and a defined node set.
• Publish/subscribe (IEC 62541 Part 14): a publisher emits datasets; subscribers listen, often over UDP multicast or a broker such as MQTT. This is the right pattern for one-to-many telemetry where you can tolerate a different reliability model than a locked session.

Classic OPC is client/server only. If the stem wants many consumers of the same fast telemetry without each one polling a DA server, UA Pub/Sub is the named modern tool — still behind the same LAN and DMZ rules.

Control network versus business network

Keep Level 2 supervisory (HMI, engineering stations, controller Ethernet) off Level 4 enterprise (email, ERP, office DHCP). The Purdue / ISA-95 mental model is enough for the exam:

• Level 0: field devices and remote I/O.
• Level 1: basic controllers (DCS/PLC).
• Level 2: HMI and engineering.
• Level 3: site operations, manufacturing execution, often the primary historian.
• Level 3.5: DMZ (replicas, jump hosts, reverse-connect OPC).
• Level 4: business.

A dual-homed laptop that sits on both the control VLAN and the office SSID is a human bridge. A trunk that carries VLAN 10 (control) onto the finance access switch is an architecture failure, not a convenience. Firewalls, routers, and network address translation (NAT) belong at the DMZ, not as an excuse to hide a flattened LAN.

Worked example: historian access without flattening the control LAN

Operations wants every unit PV in the corporate historian so planning can build reports. A vendor’s first sketch is: install the historian collector on a Level 4 server, open DCOM through the firewall, and point OPC DA at the DCS OPC server on the control LAN. That sketch flattens the control LAN. Every office compromise path now has a protocol path onto controllers.

The PE design is:

1. Collect on the control or operations LAN (Level 2/3) with the DCS native historian interface or an OPC UA server that already sits beside the controllers.
2. Replicate outbound to a read-only replica in the DMZ (Level 3.5). Prefer OPC UA with a defined port, certificates, and a reverse-connect or broker pattern so the control LAN does not accept inbound sessions from Level 4.
3. Let Level 4 clients read only the replica. No engineering downloads, no writes, no DCOM.
4. Do not trunk the control VLAN to the office. Do not dual-home the historian server on VLAN 10 and VLAN 40 “to make routing easy.”

Native DCS protocols stay on Level 1–2 for closed loop. OPC is the information path at the boundary, not the control path.

When a DCS native protocol is better than OPC

If the exam asks how two controllers in the same DCS family should exchange a 100 ms status bit, the answer is the vendor control network, not a new OPC DA server. If the exam asks how a third-party historian should read 4 000 tags without sitting on the controller backplane, the answer is OPC UA (or the vendor historian interface) through a DMZ, not Classic DCOM from finance.