Priority allocation, and why most systems have too many high alarms

Priority exists to answer one question under load: when several alarms are active and there is not time for all of them, which one does the operator handle first? A priority scheme that does not answer that question is not doing anything.

Most do not. Benchmark a typical unrationalised alarm system and the distribution will be something like a quarter high, a half medium and a quarter low — or, on systems where priority was assigned by whoever configured each alarm, close to uniform. Under those distributions an upset produces forty high-priority alarms and the scheme provides no ordering at all.

The distribution to aim at

The widely cited target distribution — roughly five percent high, fifteen percent medium and eighty percent low, with a small number of emergency-level alarms above that where a scheme uses four levels — is not arbitrary. It is derived from the requirement that during an upset the high-priority alarms remain a short enough list to be worked through.

Transparent monitoring policies help employees understand what information is collected and why. Further details are available on this page.

The wider alarm-management lifecycle is described in the ISA-18 alarm management standards.

The precise ratios matter less than the shape: high priority must be rare enough that its appearance is genuinely informative. An operator who sees a high-priority alarm three times a shift treats it differently from one who sees it three times a year.

Priority is consequence times urgency

The defensible method assigns priority from two factors established during rationalisation.

Consequence severity: what happens if the operator does not act. This is normally banded against the site's existing risk framework — the same categories used for incident classification — so that alarm priority is consistent with how the organisation already talks about severity. Categories typically span personnel safety, environmental release, equipment damage and production loss.

Time to respond: how long the operator has between the alarm and the consequence. A severe consequence with two hours of margin is a lower priority than a moderate consequence with ninety seconds, because the scheme is ordering work in time rather than ranking importance in the abstract.

A simple matrix of the two, agreed in advance and applied consistently, produces a distribution that approximates the target without anyone aiming at the target directly. Aiming at the distribution rather than at the criteria produces gaming.

Why priorities inflate

Priority inflation has consistent causes, and recognising them is most of the defence.

Configuration-time assignment. When priority is set by the person configuring each alarm, in isolation, each one seems important. Nobody configuring an alarm thinks the condition it detects is unimportant.

Priority as advocacy. A process engineer who wants their unit's alarms noticed sets them high. This is rational behaviour in a system where attention is scarce, and it is a tragedy of the commons.

Post-incident promotion. After an event where an alarm was missed, the immediate remedy is often to raise its priority. This is understandable and it addresses the symptom; the underlying cause is usually that there were too many high alarms for the missed one to stand out.

Priority as a substitute for rationalisation. Where an alarm cannot be justified but nobody wants to remove it, raising its priority is sometimes offered as a compromise. This is the worst outcome available.

Presentation has to match

Priority that is not clearly distinguishable on the display does nothing. The scheme needs a small number of levels with unambiguous visual and audible differentiation.

Three levels is the common recommendation, with four where an emergency category is genuinely needed. More than four cannot be reliably distinguished under pressure, particularly by colour, and particularly by operators with colour vision deficiency.

Audible differentiation matters more than most designs allow for. An operator working away from the screen should be able to tell from the tone alone whether the alarm needs immediate attention. A single tone for all priorities discards a channel that costs nothing to use.

Sorting the list

The alarm list should be sortable by priority and should default to it. This sounds obvious and a surprising number of systems default to chronological order, which under flood conditions places the most recent alarm at the top regardless of what it is.

Chronological order is useful for diagnosis after the fact. During the event, priority order is what the operator needs, with time as the secondary sort within a priority.

Auditing the distribution

The priority distribution is one of the easiest alarm metrics to produce and one of the most diagnostic. Two versions are worth reporting.

The configured distribution: what proportion of alarms in the database carry each priority. This measures the design.

The annunciated distribution: what proportion of alarms actually raised over a period carried each priority. This measures the experience, and it can differ sharply from the configured distribution when a small number of high-priority alarms are also frequent repeaters.

A system with a good configured distribution and a poor annunciated one has a bad-actor problem in its high-priority set, which is the most damaging place to have one.

Resisting the ratchet

Because promotions are easy and demotions are uncomfortable, the distribution drifts upward unless something resists it.

The mechanisms that work are procedural. A priority change is a change, subject to the same management of change process as any other modification, with the rationalisation record updated. Promotions above a threshold require a named approver rather than an engineer's judgement. And the distribution appears in the monthly alarm report, so that drift is visible while it is still small.

None of that prevents a genuine promotion where one is warranted. It prevents the accumulation of promotions that nobody would defend individually.