Alarm Systems Must Support Action: Control the Flood Before the Upset

An alarm is a request for operator attention

The UK Health and Safety Executive states that alarms should be useful and relevant, guide a defined response and activate early enough for that response to be completed before the condition escalates. This makes alarm design a human-performance issue as well as an instrumentation issue.

An alarm is not simply a tag crossing a configured value. It creates work: notice the signal, understand the condition, distinguish cause from consequence, choose a response, coordinate with others and confirm whether the action worked. If many alarms arrive together, the workload can exceed what one person can reliably process.

The objective is not a silent control room. It is a system that makes abnormal conditions more understandable. Every configured alarm should have a documented purpose, priority, operating context and response. Matters that do not require operator attention should not compete with those that do.

Design for the upset, not only the normal day

A system may look manageable during steady operation and fail during a trip, startup, utility disturbance or equipment cascade. One initiating event can produce many consequential alarms. Without rationalisation and suitable processing, the first useful indication may be buried beneath predictable follow-on messages.

Review foreseeable operating modes. An alarm relevant during normal production may be expected and distracting while equipment is shut down. Suppression, shelving, grouping, first-up indication and deadband can help when they are engineered, authorised and controlled. They can also hide risk if used informally or left active after the condition ends.

Human capability is a design constraint. Priority should help the operator identify what demands attention first. The interface, sound, message and navigation should support diagnosis without depending solely on colour or memory. The response should be available, current and usable under pressure.

Measure performance where weakness becomes visible

Alarm-system performance needs routine review, not only investigation after an event. Useful measures can include presentation rate, standing alarm count and duration, repeat or nuisance alarms, operator response time, shelving and suppression status, and alarm behaviour during specific abnormal events.

Numbers require context. A low average rate can hide one severe ten-minute flood. A reduction in alarm count can be misleading if alarms were suppressed without resolving their causes. Operator feedback matters because the people using the system can identify unclear messages, duplicated consequences and alarms that repeatedly add no decision value.

Treat poor performance as a system problem to improve. Blaming an operator for missing one signal in a flood does not correct the configuration, workload or abnormal-situation support that made the miss predictable.

A hypothetical example: one disturbance, dozens of demands

Hypothetical teaching scenario—not a reported incident: During restart, a utility fluctuation slows several pumps. Low-flow, pressure, level and equipment-status alarms appear across connected units. A standing instrument fault is already active, and a chattering level signal repeatedly re-enters the list. The operator sees many symptoms but cannot immediately identify the initiating condition.

The shift team moves the plant to the authorised stable state, uses the approved abnormal-operating response and obtains field confirmation. Afterwards, the review does more than count alarms. It reconstructs the sequence, identifies which alarm first indicated the disturbance, tests whether priority matched consequence and checks whether the standing and repeating alarms distracted diagnosis.

Engineering changes follow the site’s alarm-management and management-of-change processes. The team does not delete inconvenient alarms or improvise setpoints. It documents the alarm purpose, response time, consequence of no action, relationship to other alarms and conditions for any suppression. The lesson is that alarm quality is managed across design, operation, maintenance and review.

Frontline actions during normal and abnormal operation

• Know the defined response and escalation path for the alarms assigned to your role.
• Report standing, repeating, unclear or apparently irrelevant alarms through the approved route.
• Do not acknowledge automatically; use the signal to confirm the plant condition and required action.
• Control workload during an upset: communicate priorities, limit nonessential interruptions and obtain support early.
• Use shelving or suppression only when authorised, recorded, time-bounded and restored under the approved process.

When the plant state becomes too difficult to manage, follow the authorised route for stabilisation or shutdown. Alarm acknowledgement is not evidence that the underlying condition is controlled.

Leadership and engineering actions that preserve attention

Maintain an alarm philosophy that defines what qualifies as an alarm, how priority is assigned, what documentation is required and how changes are approved. Rationalise alarms with operators, engineers and maintainers who understand both process consequence and actual response conditions.

Review alarm performance after startups, trips and significant disturbances, not only across monthly averages. Resolve bad actors and standing alarms. Verify that alarm-response procedures remain aligned with the operating envelope and that training covers foreseeable abnormal situations.

Protect control-room attention during high workload. Define how extra support is mobilised, how field information is prioritised and who has authority to place the process in a safer state. Ensure fatigue, staffing and interface design are considered together.

Connect this lesson with fatigue risk management, actionable operational data and management of change. An alarm system depends on alert people, meaningful information and controlled configuration.

Team discussion

Which standing, repeating or unclear alarm consumes the most attention in our area—and what evidence do we need to determine whether its cause, configuration, priority or response should be formally reviewed?