Glossary · Alarms

Severity

Severity is a mandatory UInt16 field on every OPC UA event, valued 1 to 1000, where 1 is least significant and 1000 most urgent. It is a hint, not a priority queue: the numbers are vendor-assigned and only broad bands are suggested, so never map them to your own alarm classes without checking the server.

The scale and the suggested bands

The range is 1 to 1000 inclusive. The specification suggests interpreting it in bands rather than as exact numbers, with the top of the range reserved for events demanding immediate operator action and the bottom for informational notifications. Servers commonly cluster values on round numbers such as 100, 250, 500, 700 and 900, which is a convention rather than a requirement.

LastSeverity and severity changes

On a Condition, Severity is current and LastSeverity holds the previous value, with a source timestamp for when it changed. A severity change is itself a reportable state change, so escalation shows up as a new event for the same ConditionId. Analytics that treat each event as a distinct incident will double-count an escalating alarm; deduplicate on ConditionId.

Using it as a filter

Severity is the cheapest useful where-clause operand, because it is on BaseEventType and every server supports comparing it. A GreaterThanOrEqual against a literal is the standard way to keep an event subscription's volume survivable. For a downtime system, filter high and subscribe separately at lower thresholds if you need the informational traffic.

Do not confuse it with StatusCode severity

Event Severity is an operational urgency number on an event. The Good, Uncertain and Bad prefixes on a StatusCode are a data-quality classification on a value. They are unrelated, they use different mechanisms, and a Good value can accompany a severity 900 alarm just as an Uncertain value can accompany no alarm at all.

Example

A typical vendor severity map and a severity where clause

Observed on one machine builder's server (a convention, not a standard):
  900-1000  immediate action, safety or line stop
  700-899   unplanned stop, operator required
  500-699   degraded operation, attention needed
  250-499   warning, no production impact yet
    1-249   information, state transitions, logging

Keep event volume survivable:
  WhereClause = OfType(ConditionType)
                AND GreaterThanOrEqual( /Severity , Literal(500) )

Escalation on one condition (same ConditionId, two events):
  t0  Severity=500  LastSeverity=1
  t1  Severity=900  LastSeverity=500
The mistake people make: Hardcoding a severity-to-priority mapping learned on one machine and reusing it across a plant. Vendors assign the numbers freely, so 500 can mean a warning on one server and a line stop on another. Derive the mapping per server from ConditionClassId and the vendor's documentation, then verify it against real faults.

Defined in: Part 5 - Information Model defines the event field; Part 9 discusses the severity bands.

Last verified 7 September 2026 against OPC UA 1.05.07. OPC UA Connect is an educational resource and is not affiliated with the OPC Foundation.

Free download
OPC UA Server Acceptance Test Pack
A 40-check acceptance test you run against a vendor's server before commissioning sign-off. Weighted scoring, three hard gates, and a one-page verdict for the supplier meeting.
Get the free test pack →
Free, no course, no login