In short. An alarm exists only if an operator must act. Too many alarms hide the important ones. Rationalisation defines each alarm’s cause, priority, action and consequence, removes the rest and measures the result with real data.
Criteria for an alarm
- It indicates an abnormal condition.
- It requires an operator action.
- There is time to act.
- The action is defined and documented.
Conditions that fail these tests are events or logs, not alarms.
Priority scheme
| Priority | Meaning | Example |
|---|---|---|
| Critical | Immediate action to prevent loss or harm | Generator failed to start on mains failure |
| High | Action within minutes | Battery low during outage |
| Medium | Action within the shift | Charger fault, standby not in AUTO |
| Low | Maintenance planning | Filter differential pressure rising |
Techniques
- First-out: identify the initial cause in a trip cascade.
- State-based suppression: hide alarms that are consequences of a known state, such as low voltage alarms when a source is deliberately off.
- Deadband and delay: avoid chatter.
- Grouping: combine related minor alarms into one summary.
- Shelving: allow temporary suppression with expiry and logging.
- Response guidance: a short action note for each alarm.
Metrics
- Alarms per operator per hour in normal operation and in upset.
- Most frequent alarms, which are targets for removal or fix.
- Stale alarms standing for long periods.
- Time to acknowledge and to act for critical alarms.
Decision support
Provide help beyond alarms: sequence status, restoration progress, remaining autonomy and recommended actions. See HMI design and sequence of events.
Illustrative example
After a mains failure, a plant sees 140 alarms in a minute, including many voltage alarms that are consequences. Rationalisation groups them under “Mains failure,” highlights “Generator failed to start” as critical and suppresses consequential alarms while a source is intentionally off. The operator sees five alarms and a clear action.
The alarm flood problem
When a bus trips, dozens of alarms can fire in seconds. An operator who must read forty alarms to find the cause loses time when it matters most. Rationalisation reduces alarms to those that need action.
| Question for each alarm | If no, then |
|---|---|
| Does it require operator action? | Make it an event or a log entry |
| Is the action clear and documented? | Write the response |
| Is the priority right? | Assign critical, high, medium or low |
| Is it unique to the situation? | Suppress consequential alarms |
Priority scheme (illustrative)
- Critical: loss of supply, breaker trip on fault, fire.
- High: generator fail to start, low fuel, battery fault.
- Medium: maintenance due, filter restriction.
- Low: information.
Targets
Common guidance suggests few alarms per operator per hour in steady state, and a short list shown during an upset. Use recognised guidance such as ISA-18.2 or EEMUA 191 as the reference for method.
Decision support
Show first-out indication so the first cause is clear, with the probable cause and the first action alongside each critical alarm. Provide a shelve function with logging, not a permanent silence.
Review cycle
Review alarm statistics monthly: most frequent, longest standing, chattering. See sequence of events.
The master engineering question
When things go wrong, does the alarm system point to the cause and the action, or bury it?
What to send us
Send alarm lists and event logs. Send your application details.
Questions engineers ask
How many alarms are acceptable?
Low enough for an operator to respond properly to each; measure and set targets.
Is acknowledging an action?
No. The action is the response to the condition.
Should nuisance alarms be disabled?
Fix the cause or reclassify; do not simply silence safety alarms.
How often to review?
Periodically and after incidents.
This guide gives general principles. Align with recognised alarm-management practice.