MES/SCADA Integration Patterns for Connected Factories
The "connected factory" requires bridging operational technology (OT) and information technology (IT). MES and SCADA systems are the OT layer; cloud, analytics, and AI are the IT layer. Integrating safely and effectively is the engineering challenge.
Key takeaways
- OPC-UA is the integration standard for industrial systems.
- The Purdue model defines architectural separation between OT and IT zones.
- MQTT is the transport for IoT-style cloud-bound data.
- Security between OT and IT is non-negotiable; OT networks are not internet-facing.
- Integration adapters bridge legacy SCADA protocols to modern interfaces.
The systems
SCADA
Supervisory Control and Data Acquisition. Real-time monitoring and control of industrial equipment. Owns PLCs, sensors, actuators.
MES
Manufacturing Execution System. Tracks production, work orders, materials, quality. Sits above SCADA.
Historian
Time-series database for historical SCADA data. OSIsoft PI is dominant.
ERP
Business systems. Above MES.
Modern cloud / IT
Analytics, dashboards, AI. Outside OT.
The Purdue model
Industrial security architecture defines zones:
- Level 0: physical process (sensors, actuators)
- Level 1: basic control (PLCs)
- Level 2: area supervisory (SCADA)
- Level 3: site operations (MES)
- Level 3.5: DMZ (controlled bridge)
- Level 4+: IT, internet
Data flows up; control flows down; with security boundaries between.
Integration approaches
OPC-UA
The standard. Servers expose data; clients consume. Authenticated, encrypted.
Most modern SCADA and MES support OPC-UA. Older systems may need adapters.
MQTT
Lighter protocol; suitable for cloud-bound IoT data. Often used in DMZ to bridge OT to IT.
File-based exports
Some legacy systems only export CSV/XML. Adapters convert to modern formats.
Database queries
For historians and ERPs with database access, direct query is sometimes the path.
Cloud bridge patterns
Edge gateway
Physical or virtual gateway at the DMZ. Collects OT data, normalizes, forwards to cloud.
Pub/sub messaging
OT events publish to message broker. Cloud subscribers consume.
Time-series sync
Historian data syncs to cloud time-series store periodically.
Security
OT networks are not connected to the internet. Period.
DMZ contains the gateway and any IT services that need OT data. Strict firewall rules.
IEC 62443 defines security levels. Plan accordingly.
Common pitfalls
Direct OT-to-internet connection. Catastrophic security risk.
Underestimating protocol diversity. Real factories have many systems.
No data normalization. Each system's data shape differs.
Latency expectations. Some OT operations are millisecond-critical; cloud roundtrips can't be in the loop.
What we recommend
OPC-UA + edge gateway + cloud time-series + analytics. Strict OT/IT separation. Security-first architecture (IEC 62443-aware).
FAQs
Cloud SCADA? Emerging; not yet replacing on-prem for most.
5G in factories? Private cellular is interesting; deployment matters.
Digital twin from OT data? Real; needs serious data infrastructure.