MES Software: Vendors, Features & Costs Compared 2026
MES software compared: vendors, functions per VDI 5600, costs (cloud vs. on-premise) and implementation. Honest market overview 2026.
Alarm Management in Manufacturing: PLC Alarms, MES and OEE
By Martin Brandel · Last updated: March 2026
What Is Alarm Management in Manufacturing?
Alarm management in manufacturing is the systematic process of capturing, analyzing, prioritizing, and acting on machine alarms to reduce unplanned downtime, improve availability, and identify root causes of production losses. In a factory, machines generate hundreds or thousands of alarms per day through their PLCs (Programmable Logic Controllers). Without a structured alarm management system, these alarms are invisible to everyone except the operator standing at the machine at that moment.
In discrete manufacturing, alarm management means: every PLC alarm is captured automatically, transmitted to the MES, recorded with timestamp and duration, ranked by frequency and impact, correlated with downtime events and quality defects, and used to drive systematic improvement actions. The goal is not to eliminate all alarms. The goal is to understand which alarms matter, why they occur, and what to do about the ones that cause the most production loss.
SYMESTIC provides a dedicated Alarms product module that captures PLC alarms via OPC UA or digital alarm signals, displays them in real time on the Alarm Monitor, ranks them by frequency and duration in the Alarm Ranking, and analyzes patterns and correlations in the Alarm Analyzer.
Why Machine Alarms Matter for Production Performance
Every machine alarm represents an event in the production process: a safety interlock triggered, a sensor detected an out-of-range value, a material feed jammed, a temperature exceeded a threshold, a pneumatic cylinder did not reach its end position. Some alarms stop the machine immediately. Others are warnings that do not stop production but indicate a developing problem.
| Alarm type | What it means | Impact on production | Example |
|---|---|---|---|
| Machine stop alarm | A condition has been detected that requires the machine to stop immediately. The PLC halts the production cycle. | Immediate downtime. Machine cannot produce until the alarm is acknowledged and the root cause is resolved. | Safety door opened during cycle. Emergency stop pressed. Motor overload detected. Pneumatic pressure below minimum. |
| Warning alarm | A condition has been detected that does not require an immediate stop but indicates a developing problem. | No immediate downtime, but if ignored, the condition may escalate to a stop alarm. Potential quality impact. | Temperature approaching upper limit. Lubricant level low. Cycle time exceeding target. Vibration level increasing. |
| Informational alarm | A status change has occurred that the PLC records for documentation purposes. | No production impact. Used for logging and traceability. | Mode change (automatic to manual). Tool change completed. Batch counter reached target. Maintenance interval reached. |
| Nuisance alarm (chattering) | An alarm that triggers repeatedly in rapid succession without corresponding to a real production problem. | Alarm fatigue. Operators begin to ignore alarms because too many are meaningless. Real problems get missed. | A sensor with a marginal signal triggers the same alarm 50 times in one hour. Each occurrence lasts less than 2 seconds. |
The critical problem in most factories is not a lack of alarms. It is the opposite: too many alarms, with no way to distinguish the important ones from the noise. In a typical manufacturing plant, a single machine can generate 50 to 200 different alarm codes. A production line with 20 machines can produce thousands of alarm events per shift. Without an alarm management system, this data is lost inside the PLC or scrolls past on a local HMI screen that no one reviews.
How PLC Alarms Are Captured by the MES
| Capture method | How it works | Data captured | Machine requirement |
|---|---|---|---|
| OPC UA alarm subscription | The IoT gateway subscribes to the PLC's OPC UA alarm server. When an alarm fires or clears, the gateway receives the event in real time and transmits it to the cloud MES. | Alarm code, alarm text, alarm category, start time, end time, duration, alarm priority, associated machine/station. | Modern PLC with OPC UA server and alarm functionality exposed (Siemens S7-1500, Beckhoff TwinCAT, etc.). |
| PLC register reading | The gateway reads alarm registers directly from the PLC memory via proprietary protocol (e.g., S7 protocol for Siemens). Alarm codes are mapped to alarm descriptions in the MES configuration. | Alarm code, start time, end time, duration. Alarm text is configured in the MES based on the alarm code mapping. | PLC with Ethernet connectivity. No OPC UA required. Works with older Siemens S7-300/400 and similar controllers. |
| Digital alarm signals | A digital I/O gateway captures one or more dedicated alarm signals (24V) from the machine. Each signal represents a general alarm state (machine in alarm / not in alarm). | Alarm state (active/inactive), start time, end time, duration. No individual alarm code. Sufficient for downtime classification. | Any machine with a 24V alarm output signal. No digital interface required. Works with legacy machines from the 1990s. |
SYMESTIC supports all three methods. At Neoperl, PLC alarms are captured via the SPS alarm interface, providing individual alarm codes with descriptions. At Brita, modern lines are connected to line controllers via OPC UA to capture detailed alarm data. At Klocke, digital I/O gateways capture basic machine states including alarm signals. The capture method is chosen based on the machine's capabilities: OPC UA for modern PLCs, register reading for older PLCs with Ethernet, and digital signals for legacy machines.
Alarm Analysis: From Raw Alarms to Actionable Insights
Capturing alarms is only the first step. The value of alarm management comes from analysis: understanding which alarms cause the most production loss and why.
| Analysis type | What it shows | How it is used |
|---|---|---|
| Alarm Pareto (Top 10) | The alarms ranked by total frequency and total duration over a selected time period. Shows which alarms occur most often and which alarms consume the most production time. | Maintenance and engineering focus on the top 3 to 5 alarms. Systematic elimination starts with the alarm that causes the most cumulative downtime. |
| Alarm-downtime correlation | Links each alarm event to the resulting downtime duration. Distinguishes between alarms that stop the machine (downtime-causing) and alarms that are warnings only. | Identifies which specific alarms are responsible for the highest percentage of unplanned downtime. Drives targeted maintenance actions. |
| Alarm-quality correlation | Correlates machine alarms with quality defects. Shows whether specific alarms coincide with increased scrap or rework rates. | Reveals hidden connections between machine events and quality problems. Example: a specific sensor alarm correlates with a 3x increase in defect rate at the next inspection station. |
| Alarm timeline | Chronological view of all alarms on a machine over a time period. Shows alarm sequences, overlapping alarms, and alarm cascades. | Helps identify root cause vs. symptom. When 5 alarms fire within 2 seconds, the first alarm is likely the root cause and the others are consequential. |
| Alarm trend analysis | Shows how alarm frequency and duration change over time. Reveals whether a problem is getting worse, stable, or improving after a corrective action. | Validates the effectiveness of maintenance actions. If a corrective action was taken in week 12, the trend should show a decrease in alarm frequency from week 13 onward. |
At Neoperl, SYMESTIC's alarm-quality correlation revealed connections between specific PLC alarms and quality defects that were previously invisible. The result: 15% less scrap through targeted actions based on alarm-quality data, and 15% productivity gain through systematic alarm elimination.
Alarm Management and OEE
Alarm management directly impacts all three factors of OEE (Overall Equipment Effectiveness):
| OEE factor | How alarm management helps | Customer evidence |
|---|---|---|
| Availability | Machine stop alarms are the direct cause of unplanned downtime. Alarm Pareto identifies the most frequent stop alarms. Systematic elimination of top alarm causes reduces total unplanned downtime. Alarm notification ensures faster maintenance response. | Neoperl: 10% fewer downtimes, 8% higher availability. Automatic alarm capture replaces manual downtime classification. The machine itself explains why it stopped. |
| Performance | Short alarms (micro-stops) that last only seconds but occur hundreds of times per shift reduce effective cycle time. These are invisible to operators but captured by the alarm system. Alarm analysis reveals the cumulative impact of micro-stops. | Neoperl: 15% productivity gain through targeted elimination of recurring short-duration alarms that collectively consumed significant production time. |
| Quality | Alarm-quality correlation reveals which machine events cause quality defects. When a specific alarm fires, the defect rate at the next inspection station increases. This connection is invisible without data. Alarm analysis makes it visible. | Neoperl: 15% less scrap through alarm-quality correlation. Specific alarms were identified as precursors to quality defects, enabling targeted corrective actions. |
Alarm Notification and Escalation
Capturing and analyzing alarms creates historical insights. But alarm management also has a real-time function: notifying the right people immediately when critical alarms occur.
| Function | How it works | Benefit |
|---|---|---|
| Real-time alarm notification | When a machine alarm fires, the MES sends a notification (email, push notification, SMS) to the responsible maintenance technician or production manager within seconds. | Maintenance response time drops from minutes or hours (operator walks to find technician) to seconds (notification arrives on phone). |
| Alarm escalation | If the first notification is not acknowledged within a defined time (e.g., 10 minutes), the alarm escalates to the next level: shift leader, maintenance manager, plant manager. | No alarm goes unattended. Critical alarms that are not resolved quickly are automatically escalated to management. |
| Alarm Monitor (dashboard) | A real-time dashboard showing all active alarms across all machines in the plant. Color-coded by priority. Visible on shopfloor TV screens, office monitors, and mobile devices. | Plant-wide alarm visibility. Production managers see the alarm status of all machines on one screen instead of walking to each machine's HMI. |
| Automatic downtime classification | When a machine stops and a PLC alarm is active, the MES automatically classifies the downtime reason based on the alarm code. No manual input by the operator required. | Eliminates manual downtime logging. Downtime reasons are objective and consistent. Neoperl: "Begrundung technischer Stillstande durch die Anlage ohne Eingriff der Mitarbeitenden." |
Manual vs. MES-Based Alarm Management
| Dimension | Manual (without MES) | MES-based alarm management |
|---|---|---|
| Alarm visibility | Alarms are only visible on the local HMI of the machine. Only the operator at the machine sees them. Once acknowledged, the alarm history scrolls away. | All alarms are captured centrally, visible on dashboards, and stored permanently. Every alarm from every machine is accessible for analysis. |
| Alarm history | PLC alarm buffers are limited (typically 100 to 500 entries). Older alarms are overwritten. No long-term alarm history available for analysis. | Complete alarm history stored in the cloud. Months or years of alarm data available for trend analysis and pattern recognition. |
| Alarm ranking | Not available. No way to determine which alarms occur most frequently or cause the most downtime without manual counting. | Automatic Alarm Pareto: top alarms ranked by frequency and duration. Available per machine, per line, per plant, per time period. |
| Correlation analysis | Not possible. No way to correlate alarms with quality defects or downtime patterns without manual data compilation. | Automatic alarm-downtime and alarm-quality correlation. Hidden connections between machine events and production losses become visible. |
| Notification | Operator must walk to find maintenance. Or call by phone. Delay of minutes to hours. No escalation mechanism. | Automatic notification to maintenance within seconds. Escalation if no response. Every critical alarm reaches the right person. |
Frequently Asked Questions About Alarm Management
What is alarm fatigue and how does alarm management address it?
Alarm fatigue occurs when operators are exposed to so many alarms that they begin to ignore them, including critical ones. This happens when alarm systems are not properly configured: too many nuisance alarms, chattering alarms (the same alarm firing and clearing repeatedly), and informational alarms mixed with critical ones. Alarm management addresses this through alarm Pareto analysis (identifying nuisance alarms for elimination), alarm prioritization (distinguishing critical from informational), and alarm rationalization (reviewing whether each alarm serves a purpose and requires operator action).
Can alarms be captured from old machines without OPC UA?
Yes. For machines without OPC UA but with Ethernet, alarms can be read directly from PLC registers. For machines without any digital interface, a digital I/O gateway can capture a general alarm signal (24V). This provides basic alarm state information (machine in alarm / not in alarm) with timestamp and duration. At Klocke, SYMESTIC uses digital I/O gateways on packaging lines with no LAN infrastructure (LTE connectivity only).
How does alarm management relate to downtime analysis?
Alarm management and downtime analysis are complementary. Downtime analysis answers: how long was the machine stopped? Alarm management answers: why did the machine stop? When PLC alarms are captured, the MES can automatically classify each downtime event with the alarm code that was active at the time of the stop. This eliminates manual downtime reason entry and provides objective, consistent downtime classification. At Neoperl, technical downtimes are classified automatically by the machine's own alarm data, with no operator input required.
What is alarm-quality correlation?
Alarm-quality correlation is the analysis of relationships between machine alarms and quality defects. The MES compares alarm events on a machine with quality results (scrap, rework, defect type) at downstream inspection stations. If a specific alarm correlates with an increase in a specific defect type, this reveals a causal connection that is invisible without data. At Neoperl, this analysis led to 15% less scrap by identifying which PLC alarms were precursors to specific quality problems.
Is alarm management part of an MES or part of SCADA?
Both. SCADA systems handle alarm management at the process control level: displaying alarms on the HMI, allowing operators to acknowledge alarms, and controlling alarm suppression during startup/shutdown. An MES handles alarm management at the production management level: capturing alarms from all machines centrally, storing long-term alarm history, performing alarm Pareto and correlation analysis, sending notifications, and linking alarms to downtime events and quality data. In many factories, SCADA handles the real-time alarm display at the machine while MES provides the plant-wide alarm analytics.
About the author:
Martin Brandel
MES Consultant at SYMESTIC. Over 30 years in industrial automation. Dipl.-Ing. Nachrichtentechnik.
LinkedIn
Start working with SYMESTIC today to boost your productivity, efficiency, and quality!
