LADX
Start free
← Resources
HMI & SCADA·7 min read·

Alarm floods: why one fault produces two hundred alarms

Where floods come from, the four mechanisms that suppress them, and why shelving needs an expiry.

Short answer

A flood happens when one root cause trips many correlated alarms at once, typically after a trip or a power dip. The four tools are suppression by design, where a downstream alarm is disabled while the upstream unit is off; state based alarming, where limits change with operating mode; delays and deadbands to remove transients; and shelving, which lets an operator silence a known nuisance temporarily and automatically returns it.

An alarm has four states, not twoNormalActiveUnackedActiveAckedClearedUnackedacknowledged and goneA condition that clears itself before anyone looks still needs recording.

A pump trips. The operator gets a pump alarm, which is useful. They also get low flow, low discharge pressure, low level downstream, high level upstream, a filter differential alarm, three temperature alarms and a control valve saturation alarm.

All of them are true. Exactly one of them is worth reading, and it is now somewhere in a list of two hundred.

Why floods happen

The alarms are correlated because the plant is. Everything downstream of a stopped pump is genuinely abnormal, and the alarm system, which knows nothing about causality, announces each fact separately.

The system is behaving correctly and producing a useless result, which is the definition of a design problem rather than a fault.

Suppression by design

The first and best tool. If a pump is stopped, its low flow alarm carries no information and should not be announced.

This is configured, not decided at the moment. The alarm is suppressed while a defined condition holds, and the suppression itself is visible so nobody wonders why an alarm did not appear.

The rule of thumb: if you can write down the condition under which an alarm is guaranteed to be meaningless, that condition belongs in the configuration rather than in the operator's head.

State based alarming

The same idea, generalised. A batch reactor heating up has different reasonable limits than one holding at temperature, which has different limits again from one cooling.

One set of fixed limits across all three either alarms constantly during the transitions or is too wide to be useful at the hold. State based alarming switches the limits with the mode.

It costs more to configure and it is the single most effective change on a batch plant.

Delays and deadbands

Covered at length elsewhere, and they belong on this list because they remove the class of flood caused by everything wobbling at once after a disturbance.

A three second on delay across the board eliminates transients that would have cleared themselves. It costs three seconds of notification on the alarms that are real.

Shelving, with an expiry

The operator's tool. A known nuisance, a faulty transmitter waiting for a spare, an alarm that will keep arriving all shift for a reason everybody already understands.

Three rules make shelving safe rather than dangerous.

  • It is temporary and it expires automatically. Hours, not days.
  • It is recorded, with who shelved it and why.
  • Shelved alarms are visible in their own list, so the state is inspectable rather than hidden.
An alarm system with no shelving does not have fewer disabled alarms. It has the same number, disabled by an engineer at a keyboard, permanently, with no record.

What to measure

You cannot manage this without numbers, and four are enough.

  • Average alarm rate per operator per hour in steady state.
  • Peak rate in the ten minutes after a trip.
  • The ten most frequent alarms, which is almost always where the win is.
  • Standing alarms: how many are active and unacknowledged right now, all the time.

The last one is the most diagnostic. A control room with forty permanently standing alarms has an alarm system that has already been abandoned in practice, whatever the design documents say.

Common questions

What counts as an alarm flood?
EEMUA 191 defines it as more than ten alarms in ten minutes per operator, which is beyond what a person can read, let alone act on. In practice a trip on a large unit can produce several hundred in the first minute, and everything after the first few is noise.
What is the difference between shelving and suppression?
Suppression is designed in: the system disables an alarm automatically because it is known to be meaningless in the current state, such as a low flow alarm on a stopped pump. Shelving is an operator action on a specific nuisance alarm, it is temporary, it expires, and it is recorded.
Why must shelving expire?
Because a shelved alarm is a disabled protection, and the failure mode is that it is shelved during a shift and never restored. An automatic expiry, typically hours rather than days, turns forgetting into a temporary condition rather than a permanent one.

Keep reading