IEC 62541 · Core

Part 6: Mappings

Document number	OPC 10000-6
IEC designation	IEC 62541-6
Colloquially	Part 6
Group	Core

Encodings

Three data encodings. UA Binary is compact, deterministic and what essentially every production system uses. UA JSON exists in reversible and non-reversible forms - reversible carries enough type information to decode back into the original types, non-reversible drops it in exchange for readability - and newer errata add compact and verbose variants. UA XML is defined and largely unused for live traffic, though the XML type schemas are still published. The encoding is negotiated by the transport profile, not chosen per message.

Secure conversation and chunking

The UA Secure Conversation layer sits between the transport and the services. It carries the OpenSecureChannel handshake, applies the security policy's signature and encryption, and splits large messages into chunks. Both peers advertise limits during the Hello exchange - maximum message size, maximum chunk count, buffer sizes - and violating them produces BadTcpMessageTooLarge, BadEncodingLimitsExceeded or BadResponseTooLarge. Those limits are why a browse of a large address space can fail on message size while every individual node is perfectly readable.

Transports

The primary transport is uatcp-uasc-uabinary on opc.tcp, default port 4840. Over HTTP there are https-uabinary, which keeps the secure channel inside the HTTP body, and https-uajson, which does not. WebSocket variants mirror them with sub-protocols opcua+uacp and opcua+uajson. Newer errata add the OpenAPI mappings, https-uajson-openapi and wss-uajson-openapi, where each service is a POST to a path named after it and the body is the bare request structure. Port 4843 is the registered default for the secure WebSocket and DTLS cases.

Reverse connect and NodeSet2

Reverse connect inverts who opens the TCP socket: the server connects out to a listening client and sends a ReverseHello, after which the normal handshake proceeds with the roles unchanged. This is how you reach a machine behind NAT or a one-way firewall without inbound rules. Separately, Part 6 carries the normative UANodeSet XML schema in an annex, which is the reason every companion model on earth ships as a NodeSet2 file, and the annex defining the OpenAPI mapping of the service set.

What it defines

Concept	What it is
UA Binary encoding	The default and only encoding you should assume in production. Deterministic field order, no self-description, and the reason a Wireshark dissector is genuinely useful.
Reversible and non-reversible JSON	Reversible JSON keeps type and encoding information so a decoder can reconstruct the original values. Non-reversible drops it for human readability and cannot be round-tripped.
UASC secure conversation	The layer that carries OpenSecureChannel, applies the security policy and manages token renewal. Independent of the session above it.
Chunking and message limits	MaxMessageSize and MaxChunkCount negotiated in Hello. Exceeding them fails the message, not the connection, and the resulting errors look nothing like size problems.
uatcp-uasc-uabinary	The opc.tcp transport profile, default port 4840. Supports MessageSecurityMode None, Sign and SignAndEncrypt.
https-uabinary and wss-uasc-uabinary	UA Binary carried in an HTTPS body or a WebSocket binary frame under the opcua+uacp sub-protocol, with a real UA secure channel inside. All three security modes available, and the practical choice when only 443 is open outbound.
https-uajson and wss-uajson	UA JSON over TLS with no UA secure channel at all. Advertised with MessageSecurityMode None; all protection comes from TLS.
OpenAPI mappings	The REST-shaped surface where each service is a POST to its own path and the body is the bare request. Registered as profiles 2338 for HTTPS and 2339 for WebSockets.
ReverseHello	The message a server sends when it initiates the TCP connection to a listening client. Client-side listeners commonly sit on port 65300.
UANodeSet XML schema	The normative serialisation for information models, defined in an annex here rather than in Part 5. Every NodeSet2 file validates against it.

Do you need to read it?

Anyone doing packet-level debugging, anyone choosing a transport for a constrained network, and anyone building a gateway. Network engineers need the port and direction facts. Modellers need the NodeSet2 annex, because it defines what a valid nodeset file is - and it is the part that decides whether your model loads into somebody else's tool.

Traps that trace back to this part

• The JSON and OpenAPI transports do not negotiate a UA secure channel. Servers advertise them with MessageSecurityMode None and the None security policy, so all confidentiality and integrity come from TLS and all authentication comes from a bearer token, HTTP basic credentials or mutual TLS. Treat such an endpoint as an exposed web API with the corresponding controls, not as a secure OPC UA endpoint.
• Non-reversible JSON loses type information permanently. Encode a UInt64, a Guid or a nested structure through it and the far side sees a string or a plain number with no way to recover what it was. Use it for dashboards and logs; never use it as an integration boundary you have to decode.
• Chunk and message limits produce errors that look like anything but size limits. A browse or a read of a large structure returns BadResponseTooLarge or BadEncodingLimitsExceeded, and engineers spend a day on permissions before checking MaxMessageSize on either side. Raise the limits or page the operation.
• Reverse connect changes only the direction of the TCP connection. The server is still the server, the client still needs to trust the server's certificate and the server still needs to trust the client's, and the client-side listener port has to be reachable from the plant network. Half-configured trust is the usual failure and it looks like a connection that opens and immediately drops.

Last verified 7 September 2026 against OPC UA 1.05.07. The specification parts themselves are published by the OPC Foundation. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.