August 11, 2026 · Reference

OPC UA Information Model Explained: Nodes, Address Space, and How to Browse a Server

By Dzulfikar Ats Tsauri, founder of Voltrus / JoyoDigitama. He builds the protocol tools covered in these posts. Updated October 28, 2026.

Classic OPC exposed a list of tags. OPC UA exposes a structured, object-oriented information model: a graph of nodes representing objects, variables, methods, and types, connected by typed references, all browsable at runtime. This self-description is the biggest conceptual leap UA makes over DA, and the reason a UA client can connect to a server it has never seen and understand not just what the values are, but what the data means.

This guide covers the building blocks (nodes, the address space, objects vs variables, the type system, companion specifications), then walks through browsing a real server step by step.

Nodes: the Atomic Unit

Everything in a UA server is a node. A temperature reading is a node. The sensor object that contains it is a node. The data type "TemperatureSensor" is a node. Each node has a unique NodeId and a set of attributes: BrowseName, DisplayName, Value, and so on. There are several node classes; the ones you touch daily are:

• Object: a container that groups related nodes. Has no value of its own.
• Variable: holds a value. This is where the actual data lives.
• Method: a callable function on the server.
• ObjectType / DataType / ReferenceType: the type system that describes the others.

The Address Space

The collection of all nodes in a server is its address space. Nodes are linked by references: typed relationships like HasComponent, HasProperty, Organizes. The address space is therefore a graph, not a list, and a client explores it by browsing: start at a node, follow its references, discover its children.

The Type System

UA is strongly typed. Every variable has a DataType (built-in like Int32, Double, String, or a custom structure). Every object is an instance of an ObjectType. Types themselves are nodes, so the type hierarchy is part of the same browsable address space. A client reading Motor.Speed knows the type is Double and the engineering units are RPM, without an external mapping document.

Standard Namespaces and Companion Specs

UA defines a base information model (the standard server object, standard types) in the UA namespace. On top of that, companion specifications add agreed domain models: OPC UA for Machinery, Robotics, Machine Vision, Plastics, Oil & Gas, and more. A vendor that implements "OPC UA for Machinery" exposes machine state, modes, and jobs using the standard object types the spec defines, so a client built against the companion spec works against any conformant machine, regardless of vendor.

Why This Matters

• Self-describing. No external register map or tag spreadsheet. The server tells the client what exists and what it means.
• Type-safe. You know a variable is a Double before you read it.
• Structured. Objects and references model real equipment hierarchy, not a flat list.
• Interoperable. Companion specs let multi-vendor equipment expose a common model.

Browsing a Server Step by Step

1. Connect and discover endpoints

A UA server is reached at an opc.tcp:// URL, usually on port 4840 (for example opc.tcp://192.168.1.10:4840). The first call is GetEndpoints, which lists every endpoint the server offers with its security mode and policy. Pick the one that matches your requirements; see UA security and certificates.

2. Open a SecureChannel and a Session

The SecureChannel is the (optionally encrypted) transport; the Session is the application context that holds subscriptions and state, and where you authenticate as a user if the server requires it. Every later call (Browse, Read, Subscribe) runs inside the session.

3. Browse from a root node

Browse takes a node and returns its children plus the reference types linking them. Three starting points matter:

• Objects folder: the server's exposed instances. Almost everything you want is under here.
• Server object: status, diagnostics, capabilities, and the namespace array.
• Types folder: object types, data types, and reference types.

From Objects you follow HasComponent, Organizes, and HasProperty down into the vendor's hierarchy, for example Objects → Line1 → Motor3 → Speed. Each Browse call returns one level, so a tree UI calls it as you expand nodes, while a programmatic client walks depth-first or filters by node class.

4. Read or subscribe

With a Variable's NodeId you can Read its value (with status code and timestamp) for a snapshot, or subscribe so the server pushes changes; see monitored items. Do not read in a loop once you know what you want.

Tips for large servers

• Filter by node class to find Variables without expanding every Object.
• Use the namespace array in the Server object to decode the namespace index in each NodeId (ns=2;s=Line1.Motor3.Speed) into a vendor namespace.
• Read the DataType attribute before the value so you decode it correctly.

Browsing on macOS

UA Expert from Unified Automation is the best-known GUI client and is distributed for Windows (with Linux support), so on a Mac the usual options are a VM, a Java client such as Prosys, or writing code against a library like open62541 or a Python or Node.js binding. MacTools OPC UA Explorer is a native macOS client built in Rust on the async-opcua stack. It covers each step above: enter the endpoint URL, choose a security mode and policy, review the server certificate before trusting it, then expand the address-space tree from the Objects folder, read and write variables, and create monitored items with a chosen sampling interval and queue size. Navigation is by clicking, so you never type NodeIds by hand.

Two uses come up most. Many PLCs, including Siemens S7-1500 and Beckhoff TwinCAT, ship a built-in UA server, so you can browse their tags and subscribe without the vendor engineering software; check the PLC's security settings and enabled endpoints first. And when you run an aggregation gateway that consolidates several PLCs, browse its address space to confirm every point is mapped and readable before SCADA depends on it.

Further Reading

• OPC UA Subscriptions and Monitored Items
• OPC UA Security: Certificates and Encryption
• OPC UA vs OPC Classic (DA)