← Resources
Compliance·7 min read·

ALCOA+ as a design checklist, not an audit finding

Nine words, what each one means for a control system, and the design decisions that satisfy them before anybody asks.

Short answer

Attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available. Applied to a control system: every record traceable to a person, readable without the original software, recorded at the time rather than later, kept as first captured, correct, whole, in a consistent order, retrievable for its full retention period, and accessible when asked for.

The five IEC 61131-3 languagesLDLadder Diagramgraphical, relay heritageFBDFunction Block Diagramgraphical, signal flowSFCSequential Function Chartsteps and transitionsSTStructured Texttextual, Pascal-likeILInstruction Listtextual, deprecatedOne standard, five notations. Most projects use two.

ALCOA+ appears in audit findings, which is the worst place to encounter it. Read at the design stage it is a short and genuinely useful checklist.

Attributable

Every record traceable to the person responsible.

In a control system that means individual accounts rather than a shared operator login, and it means the audit trail records the person rather than the terminal.

The objection is always that individual logins slow operators down. The answer is badge readers and sensible session timeouts, not abandoning attribution.

Legible

Readable, and readable for the whole retention period.

The trap is proprietary format. A record readable only by the software that created it, in the version that created it, is a record that becomes unreadable when the software is upgraded or the supplier disappears.

Export to something durable. A CSV or a PDF/A alongside the native record is not elegant and it is what remains readable in ten years.

Contemporaneous

Recorded when it happened, not afterwards.

For a control system this is a timestamping question, and it is the one most often got wrong: a value polled every thirty seconds and timestamped when the poller received it carries an error of up to thirty seconds.

For a trend, harmless. For a sequence of events analysis after an incident, it makes the record useless, because two events a second apart can be recorded in the wrong order.

Timestamp at source where the ordering matters, carry that timestamp through every layer, and synchronise clocks. An audit trail with an unsynchronised clock is a defective audit trail.

Original

The first capture, kept as captured.

Transformations produce copies. If a value is scaled, filtered or averaged before storage, the stored value is not the original, and where the original matters it has to be kept too.

This is also why an audit trail must not be editable from the application. A record that can be changed without trace is not an original.

Accurate

Correct, and demonstrably so.

Calibration records for instruments, verification that scaling is right, checks that the value stored matches the value measured.

The quiet failure is a scaling error that has been present since commissioning. Every record is internally consistent and all of them are wrong, and only a calibration against a reference finds it.

The plus

Complete. Nothing missing, including the data from failed or aborted attempts. Deleting a failed batch's record because it was not used is the classic finding.

Consistent. Sequence and dates in order, and the same units and conventions throughout. A system holding some timestamps in local time and some in UTC is inconsistent, and the difference shows up twice a year.

Enduring. Kept for the retention period, on media that survives it. Frequently longer than the life of the system, which is a planning problem rather than a technical one.

Available. Retrievable when asked for, in a reasonable time. Data on a backup tape that takes three weeks to restore is not available.

Reading a design against it

The practical use is as nine questions asked of a proposed system before it is built.

  • Can every record be traced to a person?
  • Will it be readable in ten years without this software?
  • Is it timestamped at the moment and at the source?
  • Is the first capture preserved, and is the audit trail tamper evident?
  • Is there a calibration and verification record behind the numbers?
  • Are failed attempts kept as well as successful ones?
  • Is everything in one timezone and one set of units?
  • Where will this live for the whole retention period?
  • How long does it take to produce it on request?

Nine questions, twenty minutes, and they find most of what an audit would find two years later at considerably greater expense.

Common questions

What does contemporaneous mean for a PLC record?
Recorded at the moment the event happened, with the time of the event rather than the time it was written to a database. A value polled every thirty seconds and timestamped on arrival is not contemporaneous, and it cannot support a sequence of events analysis.
What does original mean when everything is electronic?
The first capture of the data, in the form it was captured. A printout of a trend is a copy; the recorded values are the original. Where a system produces a record only as a report, that report is the original and it has to be retained rather than regenerated later from data that may have changed.
How long does data have to be kept?
Whatever the predicate rule requires, which is commonly the product shelf life plus a year, and often several years. The practical difficulty is that a retention period frequently exceeds the life of the system holding the data, which has to be planned for rather than discovered.

Keep reading