IEC 62541 · Utility

Part 14: PubSub

Document number	OPC 10000-14
IEC designation	IEC 62541-14
Colloquially	Part 14
Group	Utility

The configuration model

On the publishing side, a PublishedDataSet names the values to send. A DataSetWriter binds it to a writer identity and an encoding. Writer groups collect writers that share a publishing interval and a security setting, and a PubSubConnection binds a group to a transport address. The subscribing side mirrors this with reader groups and DataSetReaders, each mapping incoming messages into a subscribed dataset. All of it is itself an information model, mounted under a standard PublishSubscribe object, so a running system can be configured over OPC UA - and each element has a state machine whose enable and disable cascades to its children and which refuses to start on invalid configuration.

Encodings and message types

UADP is the binary encoding: compact, deterministic and the only sensible choice for cyclic real-time traffic. JSON is the alternative for broker and cloud consumers, with verbose, compact and raw-data variants. Message types are key frame, carrying every field in the dataset; delta frame, carrying only what changed; keep-alive; event; DataSetMetaData, describing the dataset's fields and types; and discovery request and response messages.

Transports

UDP unicast and multicast on opc.udp, with the default discovery multicast group being opc.udp://224.0.2.14:4840, and a DTLS variant. Raw Ethernet layer 2 on opc.eth using the reserved EtherType 0xB62C with optional VLAN tagging - no IP, no UDP, and root or an equivalent capability on Linux. MQTT 3.1.1 and 5.0 carrying either UADP or JSON. An AMQP mapping is defined and has essentially no open implementations, so treat it as specified but unused. Newer editions add a datagram connection type with a QoS category that maps to the IP DSCP byte, plus message repeat count and delay, which is the hook that matters for time-sensitive networking.

Security is a different system

PubSub has no handshake and no session, so it cannot use the client/server secure channel. Instead messages are protected with symmetric group keys - AES counter mode with an HMAC-SHA-256 signature - distributed by a Security Key Service to the members of a SecurityGroup, in either a pull model where publishers and subscribers fetch keys or a push model where they are provisioned. Replay is handled with sequence numbers and a window. Without an SKS you are choosing between unsecured messages and whatever the transport gives you, and transport TLS protects the hop to the broker, not the message end to end.

What it defines

Concept	What it is
PublishedDataSet	The selection of values to publish, either a flat list of variables or an event source, together with the field metadata describing them.
DataSetWriter and WriterGroup	The writer binds a dataset to an identity and encoding; the group binds writers sharing a publishing interval and security settings to one connection.
PubSubConnection	Transport binding: the address, the transport profile and the publisher id. One connection can carry several writer or reader groups.
DataSetReader and ReaderGroup	The subscriber side. A reader filters incoming messages by publisher id, writer group id and writer id, then maps fields into targets.
SubscribedDataSet	Where a reader puts what it decoded - either into target variables in the address space or into a mirrored object created for the purpose.
UADP encoding	The binary network message format. Small, fixed-layout, and the only realistic choice for cyclic control-grade traffic.
JSON encoding variants	Verbose, compact and raw-data forms. Verbose is self-describing and large; raw data is just the values and needs metadata out of band.
Key frame and delta frame	A key frame carries the whole dataset, a delta frame only the changed fields. KeyFrameCount sets how many deltas pass between key frames.
DataSetMetaData message	Publishes the dataset's field names, data types and version. A subscriber decoding raw or compact payloads is dependent on it.
Security Key Service and SecurityGroup	Symmetric group key distribution, in pull or push form. The only standard way to get authenticated, encrypted PubSub messages.

Do you need to read it?

Anyone moving machine data to a broker, a cloud endpoint or an MES at volume, and anyone doing deterministic controller-to-controller communication. It is also the part to read before an argument about OPC UA versus MQTT, because Part 14 over MQTT is both at once and the real comparison is against Sparkplug B.

Traps that trace back to this part

• Non-reversible and raw JSON lose type information permanently. A UInt64, a Guid, a ByteString or an enumeration comes out as a plain number or string, and a value above the double-precision integer limit loses precision in any JavaScript consumer. The subscriber cannot reconstruct the original types from the payload, so either publish reversible JSON, or publish raw and treat the DataSetMetaData message as mandatory infrastructure rather than an option.
• A subscriber that joins mid-stream sees delta frames until the next key frame, so it holds a partial dataset - and if KeyFrameCount is high or zero it can hold one for a very long time. Set the key frame interval according to how often subscribers are expected to start, not according to bandwidth alone.
• There is no handshake, so there is no error. Get a publisher id, writer group id or DataSetWriterId wrong on the reader and it simply receives nothing forever - no BadNodeIdUnknown, no rejected connection, no log entry. Confirm with a packet capture or a generic subscriber before assuming the publisher is silent.
• Broker TLS is not message security. TLS to an MQTT broker protects the hop and authenticates the broker; it does nothing about a message the broker forwards, and it means the broker sees plaintext. Where the payload has to be protected end to end, that needs PubSub message security and a Security Key Service, which is a much larger deployment than turning TLS on.

Last verified 7 September 2026 against OPC UA 1.05.07. The specification parts themselves are published by the OPC Foundation. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.