Your namespace is a floor plan

The first time I wrote about a stranger on a plant network, the stranger moved a pump. Twelve bytes onto the wire, a running pump changed speed, and nobody at the screen had touched anything. This is the same stranger on the same kind of network, except this time they send nothing at all. They sit on the wire and listen, and when they leave they have the floor plan of the plant.

You might reasonably think that does not matter very much. A tag name is just a label. Knowing that a value is called pumpA/speed is not the same as being able to change it, and it feels like the sort of thing only a paranoid auditor would flag. That instinct is where the trouble starts, because a name is not a label to the person who does not yet understand your plant. A name is the plant explaining itself, and with enough of them you do not need the values at all.

The safest protocol is the oldest one#

Everything else in this series ranked the protocols by how easily someone could write to them, and by that measure Modbus was the worst. It is from 1979, it has no way to ask who is calling, and it honours any write. On the measure in this piece it is the best of the lot, for exactly the same reason. Modbus has no room in it for a name. It speaks in numbered registers, and a number gives nothing away.

When the stranger from the first article moved that pump, the write landed on holding register ten. Read the capture and you can see register ten change. What you cannot see anywhere on the wire is that register ten is a pump speed, because that fact lives in the software talking to the plant and never travels. Someone listening learns that the plant has registers and what they hold this second. They learn nothing about what a single one of them is for.

The names begin, and then they do not stop#

Move up to a modern name-brand controller speaking EtherNet/IP and the first words appear. You do not even need to decode the protocol to find them. A plain text search of the capture is enough to surface MOTOR_CMD and SETPOINT, sitting in the open. The values were already readable. Now the listener knows which values to care about, and knows it in the plant's own vocabulary.

Go up one more step, to an OPC UA server, and a label becomes a full introduction. This server offered two ways in on the same address, an unprotected one and an encrypted one, and through the unprotected one the word pump shows up twenty-nine times. That is not one node named twenty-nine times. It is the server telling you its product name, its network address, the identifiers for its application and its namespace, the names of its nodes, and, for good measure, the identity of the other program already connected to it. In a single unsecured session the server hands over what it is, where it is, what it contains, and who else is in the room.

None of that is a defect in OPC UA. Every one of those strings is there so the server can be discovered and understood, which is exactly what you want a server to be. The only mistake is the door that stayed open, and shutting it is a single setting. Switch the client to sign and encrypt and all twenty-nine of those strings leave the wire at once.

The whole plant, written down for you#

The top of the ladder is the one that should give an integrator pause, because it earns its place by being done well. A Unified Namespace is meant to be readable by a human. The entire promise of it is that someone new can look at the tree and understand the site without a manual. That promise is kept. It is just kept for the stranger on the wire as faithfully as for your own team, whenever the broker underneath has no encryption on it.

Twenty-six topic names came off one broker, and the names alone rebuild the plant. There is an operator and a site and a tank. There are two pumps, each reporting whether it is running, how fast, how many hours it has logged, and whether it has faulted, and the words duty and mode next to them say the two are a lead and a standby rather than a pair running together. There is a valve that reports both a command and a position, so it modulates. A complete accounting of what goes in and out. An alarm scheme with four levels, and the setpoints that start the pumps, stop them, and trip them.

That is a piping and instrumentation diagram, and it was assembled from a list of topic names before a single reading was opened. Everything in your naming convention that you are proud of did the drawing.

The part nobody wants to hear#

The neat conclusion would be that the modern stack is careless and the old one was safer all along. That is wrong, and it is worth saying why, because the wrong conclusion leads to a bad fix. Modbus is not more secure. It is merely mute. OPC UA and the UNS are not careless. They are articulate, on purpose, because being articulate is what makes them worth the money. The tension is real and it does not resolve by making one side worse. Legibility and confidentiality pull against each other, and the good stack chose legibility deliberately.

So keep the names, and hide the wire#

The instinct at this point is to make the names cryptic, and it is the wrong instinct. Obscure tags fight the whole reason you built a readable namespace, they collapse the moment someone lines up two values, and they swap a control that works for one that only feels like it does. The readable names are not the problem. They are a symptom, and what they are a symptom of is a wire nobody encrypted.

Which means the fix sits on the transport, not the vocabulary. Where the protocol can protect itself, let it, and OPC UA sign-and-encrypt or a broker with TLS will take the words off the wire and let you keep every descriptive name behind them. Where the protocol cannot, which is the cleartext fieldbuses, you are back to the defence this series keeps landing on, that a tap must not be possible on that segment at all. And carry one question into the next design review. Not whether a name says too much, but what boundary it crosses before anyone has proven who is listening on the other side.

The stranger who moved the pump needed a way onto the segment and twelve bytes. The stranger who mapped the plant needed only the segment, and the patience to read. The same wall stops both of them, and it was never the names. The companion lab has every decode and the commands that produced them, and it is the confidentiality reading of the scorecard from the other week.