SCADA alarms, events, audit trail and reports

Alarms at plant level

The SCADA alarm server evaluates limits or receives alarm states from PLCs, then manages acknowledgement, history, routing (by area/operator station) and notification (e-mail/SMS to on-call staff). Alarm philosophy, priorities and rationalization follow ISA-18.2 / IEC 62682 — see HMI alarms for the operator side.

Decide once where alarms are detected: limits in the PLC (fast, works without SCADA, one source of truth) or in SCADA (flexible, needs reliable communication). Mixing both for the same signal produces duplicates.

Events and sequence of events

Events record what happened without needing action: start/stop, mode changes, operator commands, communication loss. For trip analysis a sequence of events (SOE) with millisecond source timestamps from the controller or RTU shows which signal changed first.

Audit trail and users

• Every operator action (command, setpoint change, acknowledgement, bypass) is logged with user, time, object, old and new value.
• Roles and permissions per area; separate engineering rights from operation.
• Regulated industries require tamper-evident records and electronic signatures; check applicable regulations early in the project.

Scripts and reports

Scripts add logic (calculations, automatic report generation, data exchange). Keep them few, documented and versioned — control logic belongs in the PLC. Reports (shift, daily, batch) should read from the historian with defined aggregation, so numbers are reproducible.

Maintainability

Store the project in version control or the vendor's change management, keep a test system, and document every alarm and interface. A SCADA that only one person understands becomes a risk within a year.