Why alarm floods happen, and why they happen at the worst moment
An alarm system that is merely busy in steady state becomes unusable during an upset, which is precisely the condition it was installed to help with.
Read the guideSection · 8 guides
Alarm management
Rationalisation, priorities, floods, shelving and the measurements that tell you whether operators can actually keep up.
Home/Alarm management
The alarm system is the part of a control system that most directly determines whether an operator can act in time. It is also the part that degrades fastest, because adding an alarm is nearly free and removing one requires a decision somebody has to sign.
Twenty years of that arithmetic produces the condition almost every ageing plant is in: thousands of configured alarms, a standing list nobody clears, and floods during exactly the upsets the system exists to help with.
This section works through the discipline that reverses it — rationalisation, honest priority allocation, measurement against achievable targets, and the suppression techniques that are legitimate rather than merely convenient.
Covert monitoring requires careful legal, ethical and policy review before any technical implementation. Further details are available in this overview.
The wider alarm-management lifecycle is described in the ISA-18 alarm management standards.
Timing references can be cross-checked against NIST time services.
Rationalisation: deciding which alarms deserve to exist
Rationalisation is a slow, structured argument about every alarm in the database. It is tedious, it is the only method that works, and most attempts fail for predictable reasons.
Read the guidePriority allocation, and why most systems have too many high alarms
If a third of the alarms are high priority, there is no priority scheme. There is a list with decoration.
Read the guideThe alarm metrics worth reporting monthly
Six numbers describe the health of an alarm system. Most sites report none of them and discuss alarm performance anecdotally.
Read the guideStanding alarms, and the list that is permanently red
An alarm that has been active for three weeks is not telling the operator anything. It is occupying the space where a new alarm would have been noticed.
Read the guideShelving, suppression and the difference that matters
Turning an alarm off is sometimes correct engineering and sometimes the removal of a safeguard. The distinction is procedural, not technical.
Read the guidePresenting alarms so the operator can act on them
A rationalised alarm database displayed badly is still an unusable alarm system.
Read the guideAuditing an alarm system you have inherited
A structured audit turns an impression that the alarm system is bad into a costed list of specific work.
Read the guide