OPC A&E, Alarms and Events, is the OPC Classic standard that defines a common interface for delivering alarm notifications, operator action records, and informational events from industrial control systems to any compliant client application, through a push-based subscription model rather than continuous polling.
Last reviewed: 2026Reading time: ~8 minTopics: OPC A&E, alarms, events, subscription, acknowledgement, OPC UA A&C
What is OPC A&E?
OPC A&E, Alarms and Events, is an OPC Classic specification that provides a standardized way for software applications to receive alarm notifications and event records from industrial control systems. It solves the same interoperability problem for alarm data that OPC DA solved for real-time process values: instead of every alarm management application needing a custom integration with every DCS or SCADA vendor, one standard interface lets any compliant client receive alarms from any compliant server.
Before OPC A&E, accessing alarm data from a DCS or PLC required two things that vary completely between vendors: proprietary tools or APIs for accessing the alarm system, and proprietary message formats defining how alarm information was structured. A third-party alarm management application, sequence-of-events recorder, or compliance audit tool had to be custom-written against each control system vendor's implementation. OPC A&E eliminated that by defining a common alarm message format and a common subscription mechanism.
OPC A&E is the third member of the OPC Classic family. OPC DA handles real-time process values. OPC HDA handles archived historical data. OPC A&E handles alarms and events as they happen, plus the ability to query recent event history and acknowledge outstanding conditions. All three share the same COM/DCOM foundation. TOP Server implements all three on a single installation alongside OPC UA.
Why push, not poll: OPC DA uses subscriptions because polling every tag continuously is inefficient. OPC A&E makes this even more explicit: alarms happen rarely relative to the polling rate that would be needed to detect them in real time, and missing an alarm even briefly is unacceptable. OPC A&E therefore uses an asynchronous callback model where the server pushes notifications to clients the moment an alarm occurs, with no polling latency introduced by the client asking repeatedly.
OPC DA vs OPC A&E: different data, different model
Engineers familiar with OPC DA sometimes try to use tag subscriptions to implement alarm detection: subscribe to a tag, watch for values that exceed a threshold, and treat that as an alarm. This works in simple cases but misses what makes OPC A&E genuinely useful.
OPC DA delivers values. OPC A&E delivers events, and an event is more than a value crossing a threshold. An event has a type, a source, an area, a severity, a timestamp, a category, and for condition-based alarms, a state machine with acknowledgement requirements. An operator looking at an alarm display needs to know not just that a value is high, but whether the alarm is currently active, whether it has been acknowledged, by whom and when, and what the sub-condition is (HIGH vs HIGH-HIGH, for example). None of that state management is in OPC DA.
More importantly, OPC A&E receives alarms that originate inside the DCS or PLC itself, not inferred by an external application watching tag values. A DCS-generated alarm carries the DCS's alarm logic, deadbanding, shelving state, and priority classification. An alarm inferred by polling a DA tag does not.
The three OPC A&E event types
OPC A&E defines three distinct event types. Each serves a different purpose and carries different fields in the event message. Understanding the distinction matters when configuring subscriptions and when evaluating what a particular DCS or SCADA system exposes through its OPC A&E server.
Event type 1
Simple event
A one-time occurrence notification with no persistent state. The server fires a simple event and it is delivered to subscribers once. There is no acknowledgement requirement, no active/inactive state, and no follow-up notification when the condition clears. Simple events are informational: something happened.
Examples: operator login, setpoint change, device communication restored, configuration modified, system startup or shutdown notification.
Event type 2
Tracking event
A record of an operator action or system-initiated change that affects process operation. Tracking events capture who did what and when, creating an audit trail of human interactions with the control system. The Actor ID field identifies which client or operator initiated the action.
Examples: setpoint modified by operator "JSMITH", valve command issued by control system, batch recipe parameter changed, mode switch from automatic to manual, output override applied.
Event type 3
Condition event
The most complex and most important event type for alarm management. A condition event is associated with a persistent state in the process: the alarm is active until the underlying condition returns to normal, and it requires operator acknowledgement. The server sends new condition events whenever the state changes: when active, when acknowledged, when cleared.
Examples: temperature HIGH alarm, pressure HIHI trip, level LOW-LOW shutdown, rate of change alarm, deviation from setpoint alarm, equipment fault condition.
The condition alarm lifecycle
Condition events are the foundation of alarm management in OPC A&E. Unlike simple events, a condition has state that persists and changes over time. The OPC A&E specification defines this state machine precisely, and each state change generates a new event notification to all subscribers. This is what allows an alarm management application to display exactly which alarms are currently active, which are unacknowledged, and what the history of each alarm looks like.
Inactive
Normal operating state
The process variable is within limits. No alarm is present. The condition is defined and monitored by the server, but not triggered. This is the baseline state before anything happens.
Active, unacknowledged
Alarm triggers, notification sent
The process variable crosses the alarm threshold. The server immediately sends a condition event to all subscribers with state Active and AckRequired True. Operators see a new unacknowledged alarm on their displays.
NewState: ActiveAckRequired: True
Active, acknowledged
Operator acknowledges the alarm
An operator acknowledges the alarm through an OPC A&E client. The server broadcasts an updated condition event showing AckRequired False. The alarm remains active because the underlying process condition still exists, but the operator has taken responsibility for it. The Acknowledger ID records who acknowledged it.
NewState: ActiveAckRequired: False
Inactive, acknowledged
Process returns to normal
The process variable returns within limits. The server sends another condition event with NewState Inactive. Because the operator already acknowledged it, AckRequired remains False. The alarm is cleared. Normal operations resume.
NewState: InactiveAckRequired: False
Inactive, unacknowledged
Alarm clears before acknowledgement
A special state where the process condition returned to normal before the operator acknowledged the alarm. This state matters for safety-critical environments: the alarm should still appear on the display and require acknowledgement even though the process has already recovered, because an operator needs to know the event occurred.
NewState: InactiveAckRequired: True
How OPC A&E subscriptions work
To receive alarm and event notifications, an OPC A&E client creates a subscription with the server. The subscription defines which events the client wants to receive and how they should be delivered. Once the subscription is active, the server pushes notifications to the client via asynchronous callbacks as events occur, with no polling required.
BufferTime
Minimum interval between callbacks
Defines the minimum time in milliseconds that must elapse between successive event callbacks from the server to this client. Setting a non-zero buffer time allows the server to batch multiple events into a single callback rather than sending them individually, which reduces callback overhead in high-frequency alarm situations without increasing end-to-end latency beyond the buffer interval.
MaxSize
Maximum events per callback
The maximum number of event notifications the server will include in a single callback. During alarm floods, when many alarms trigger in a short period, the server may reach this limit before the buffer time expires and send the callback early. This prevents a single callback from carrying an unmanageable volume of events that would overwhelm the client.
KeepAlive
Heartbeat when no real events occur
The keep-alive time instructs the server to send a heartbeat callback even if no real events have occurred during the interval. This allows the client to distinguish between a quiet period with no alarms and a broken subscription or network issue. If the client expects a heartbeat every 60 seconds and does not receive one, it knows something is wrong with the connection, not just that the plant is quiet.
Filter
Subscription filter criteria
An OPC A&E client can filter its subscription to receive only a subset of all available events. Filters can be applied by area (a logical grouping of equipment within the server), event type (simple, tracking, or condition), severity range (a numeric priority scale, typically 1 to 1000), and category (a server-defined grouping of related alarm types). Server-side filtering reduces unnecessary network traffic and prevents lower-priority events from obscuring critical alarms in the client's event stream.
OPC A&E organizes the alarm namespace into three hierarchical concepts that define where an event comes from and how clients can filter it.
Areas
An area is a logical grouping of equipment within the OPC A&E server's namespace. Areas map to physical or functional plant areas: a reactor building, a distillation column train, a cooling system. Areas are hierarchical and can be nested. A client subscribing to a specific area receives events only from the equipment within that area. This is how a control room operator display for the west production line shows only west production line alarms, while a plant-wide historian captures all areas simultaneously.
Sources
A source is a specific piece of equipment or system within an area that generates events. Sources are identified by name and sit within an area hierarchy. When an event fires, it carries the source identifier so the client always knows exactly which piece of equipment the alarm originated from. In TOP Server's OPC A&E plug-in, sources map directly to the tags and devices already configured in TOP Server's driver configuration.
Categories
A category is a server-defined grouping of related event types with a common set of attributes. For example, a "temperature alarms" category might include all high and low temperature conditions across the plant and define that temperature-specific attributes (engineering units, setpoint value) are carried in every event of that category. A "batch tracking" category might define batch ID and recipe version as standard attributes. Categories are specific to each OPC A&E server's configuration.
OPC A&E in TOP Server
The TOP Server OPC A&E plug-in enables engineers to define custom alarm conditions directly against any tag already configured in TOP Server, without needing a separate alarm management system. Because TOP Server connects to 140+ device types, the A&E plug-in effectively brings standardized alarm delivery to any device that TOP Server can communicate with, including legacy hardware that has no native alarm export capability.
OPC A&E specification V1.10
Full implementation of the OPC Foundation A&E 1.10 specification, including all required interfaces and the condition state machine. Tested for interoperability with third-party OPC A&E client applications.
Tag browsing and import
Create alarm sources by browsing existing TOP Server tags and selecting the monitored item directly. No manual tag entry. Any tag visible to TOP Server from any connected device can become an alarm source.
Condition and sub-condition support
Full support for multi-level conditions including HIGH_HIGH, HIGH, LOW, LOW_LOW, rate of change (ROC_HIGH, ROC_LOW), and deviation alarms (DEV_HIGH, DEV_LOW). Each sub-condition has independently configurable thresholds and severity levels.
Severity and priority
Each alarm source and sub-condition carries a user-defined severity value on the OPC A&E standard 1-to-1000 scale. Clients can filter subscriptions by severity range to focus on critical alarms during high-activity periods.
Acknowledgement support
OPC A&E client applications can acknowledge conditions through the standard interface. TOP Server tracks acknowledgement state and propagates state changes to all connected subscribers, so every client display reflects the current acknowledged status simultaneously.
Event log exposure
TOP Server exposes its internal event log data to OPC A&E clients as simple events in three categories: Information, Warning, and Error. This gives OPC A&E clients visibility into the connectivity health of the OPC server itself alongside process alarms.
Need OPC UA Alarms & Conditions instead? If your client applications support OPC UA, Cogent DataHub's Notifications feature provides OPC UA A&C (Alarms and Conditions) functionality working alongside TOP Server. This is the OPC UA successor to OPC A&E, running over TCP/IP without DCOM, and is the recommended path for new alarm integration projects where OPC UA clients are in use.
OPC A&E vs OPC UA Alarms and Conditions
OPC UA carries alarm and event capability in its Alarms and Conditions (A&C) specification, defined in OPC UA Part 9. A&C is the functional successor to OPC A&E and carries the same core concepts forward: condition state machines, acknowledgement, subscriptions, filtering. The differences are architectural.
OPC A&E, OPC Classic
The established standard
Built on COM/DCOM, Windows-only
Separate specification from OPC DA and HDA
Three event types: simple, tracking, condition
Alarm areas and sources organize the namespace
DCOM configuration required across network boundaries
Widely deployed across all major DCS, SCADA, and PLC platforms
Still the dominant standard in installed base
Requires OPC tunneling for cross-network delivery
OPC UA Alarms & Conditions
The modern successor
Built on TCP/IP, cross-platform
Integrated with OPC UA address space and information model
Condition types defined through UA object types
Rich semantic context through UA companion specifications
Works across firewalls on a single configured port
Supported by newer UA-native control systems
Recommended for new alarm integration projects
No DCOM configuration or Windows domain dependency
Frequently asked questions
What's the difference between simple, tracking, and condition events?+−
Simple events are one-time notifications with no persistent state or acknowledgement requirement. They report that something happened: an operator logged in, a communication link restored, a system started. Once delivered, they're done.
Tracking events capture operator actions for audit trails. They record who did what and when, creating a permanent record of human interactions with the control system for compliance and investigation purposes.
Condition events are persistent alarm states that require acknowledgement. A condition event fires when an alarm becomes active, fires again when acknowledged, and fires a third time when the underlying process condition returns to normal. This state machine is the foundation of alarm management systems.
Can I use OPC A&E to forward alarms from one system to another?+−
Yes. This is a common integration pattern where an OPC A&E client subscribes to alarms from a DCS or PLC through its native OPC A&E server, then republishes those events to downstream alarm management systems, notification routing platforms, or historians. TOP Server and Cogent DataHub both support this use case.
The receiving system sees the forwarded alarms exactly as if it were subscribed directly to the original source. Acknowledgements can be propagated back upstream through the same path, so an operator acknowledging an alarm in the downstream system marks it acknowledged in the source DCS as well.
Does OPC A&E work across firewalls or only on local networks?+−
OPC A&E uses the same COM/DCOM foundation as OPC DA, which means it has the same firewall challenges. DCOM requires dynamic port allocation and Windows domain authentication that do not work cleanly through firewalls between IT and OT networks.
The solution is the same as for OPC DA: OPC tunneling. Cogent DataHub tunnels OPC A&E alongside OPC DA and HDA over a single TCP connection, allowing alarm notifications to flow across firewalls and DMZs without DCOM configuration. For new projects, OPC UA Alarms and Conditions (A&C) is the better architecture because it works natively across networks with no tunneling required.
How does TOP Server's A&E plug-in generate alarms for devices that don't have native alarms?+−
TOP Server's OPC A&E plug-in allows you to define condition-based alarms directly against any tag visible through TOP Server. You configure threshold values (HIGH, HIGH-HIGH, LOW, LOW-LOW), deadbands, and severity levels through the TOP Server configuration interface.
When a tag value crosses a threshold, TOP Server generates the appropriate OPC A&E condition event and pushes it to all subscribed clients. The alarm state machine, acknowledgement handling, and notification callbacks are all managed by TOP Server. From the client's perspective, these alarms are indistinguishable from alarms generated natively by a DCS.
What is the relationship between OPC A&E and ISA-18.2 alarm management?+−
ISA-18.2 is the standard for the management of alarm systems in process industries. It defines best practices for alarm philosophy, rationalization, prioritization, and performance measurement. OPC A&E is the technical interface that delivers alarm data from control systems to the applications that implement ISA-18.2 compliance.
OPC A&E's severity field maps directly to ISA-18.2 alarm priority. OPC A&E's acknowledgement model supports the ISA-18.2 requirement that operators take responsibility for alarms. OPC A&E's event history capability provides the audit trail needed for ISA-18.2 compliance documentation. Many alarm rationalization and compliance tools accept OPC A&E as their primary data source.
Is OPC A&E still relevant or has OPC UA replaced it?+−
OPC A&E remains in widespread use across all major DCS, SCADA, and PLC platforms. The installed base is enormous, and working OPC A&E integrations are not being replaced simply because a newer technology exists. Plants that have alarm management systems successfully integrated via OPC A&E see no operational reason to migrate those connections.
OPC UA Alarms and Conditions (Part 9) is the correct choice for new alarm integration projects, especially where cross-network delivery or cross-platform clients are involved. Most modern control system vendors now expose both OPC A&E and OPC UA A&C interfaces simultaneously, letting legacy clients continue using A&E while new systems migrate to UA.
Need OPC A&E connectivity for your alarm systems?
Software Toolbox has integrated OPC A&E alarm delivery across DCS, SCADA, and PLC platforms since the specification was published. Whether you need to forward alarms from legacy systems, implement ISA-18.2 compliant alarm management, or bridge Classic A&E to OPC UA A&C, we can help.