Alarm Management

What is Alarm Management?

Alarm Management is the ongoing process of designing, rationalising, monitoring and improving the alarms in an industrial installation, so that an operator only receives alarms that call for a timely action, with the right priority and at a moment when intervention is still possible. It covers alarms in SCADA, DCS and PLC-controlled installations and their operator screens. Good alarm management reduces the likelihood of major accidents, prevents unnecessary downtime and keeps control room work manageable, which makes it a cornerstone of process safety. The key standards are ISA-18.2, its international counterpart IEC 62682 and the British guideline EEMUA 191.

Alarm Management = ensuring that only the right alarms reach the right people at the right time.

🧠 What is an alarm, and what is not?

ISA-18.2 defines an alarm as an audible and/or visible means of indicating to the operator an equipment malfunction, process deviation or abnormal condition requiring a response. Those last words are the heart of alarm management. A message that requires no action from the operator is not an alarm but information. Yet many installations still show such messages in the alarm list, because adding an alarm to a modern control system costs nothing.

The distinction with an interlock matters. An interlock or SIS acts automatically, without the operator. An alarm, by contrast, asks for human action. If a risk analysis counts an alarm as a protection layer, you must be able to show that the operator sees the alarm, understands it and can respond in time.

🎯 Why is alarm management important?

In the explosion at the Texaco refinery in Milford Haven on 24 July 1994, 26 people were injured and the damage amounted to around £48 million. According to the investigation by the British regulator HSE, two operators had to recognise, acknowledge and act on 275 alarms in the last eleven minutes. There were too many alarms, the priorities were wrong, the displays gave no overview and training for a sustained plant upset was inadequate.

That picture is familiar in many installations:

When digital control systems arrived in the 1980s, alarms were often set by default at 20% and 80% of the measuring range. A HAZOP also regularly adds extra alarms as a quick fix. Without management, the number of alarms therefore grows every year.

🔄 Which standards and guidelines apply to alarm management?

None of these documents is legally mandatory, but together they form the state of the art against which inspections and audits assess an alarm system, and a reference for demonstrating compliance with safety obligations.

🧱 Which steps make up the alarm lifecycle?

ISA-18.2 describes a lifecycle of ten stages. Simplified, it comes down to six steps:

1. Alarm philosophy - a company document with the definition of an alarm, the number of priorities, colours, roles, targets and the rules for changes.
2. Identification and rationalisation - for each alarm, record the cause, what happens if nobody intervenes, which action the operator takes and how much time is available. Alarms without an action are removed.
3. Detailed design - set limits, hysteresis (deadband), delays and state-based suppression.
4. Implementation - configure the alarms in SCADA or DCS, test them and train operators.
5. Monitoring and improvement - analyse alarm data from the historian, tackle the worst-performing alarms and resolve recurring causes with root cause analysis.
6. Management of change and audit - every change follows a fixed procedure, with periodic checks that practice still matches the philosophy.

The output of step 2 goes into the master alarm database, the single source of truth for all alarm settings.

🔧 How do you run an alarm improvement project in practice?

The HSE recommends a three-step approach: find out whether you have a problem, decide what to do and act, and then manage the result systematically. In concrete terms:

• Measure the baseline - count alarms per operator position per hour and per day, the number of standing alarms and the alarm floods. Ask operators about nuisance alarms and audible alarms that are routinely silenced.
• Tackle the bad actors - in many installations a top 10 of alarms causes a large share of all annunciations. These are the quickest wins.
• Apply quick technical fixes - remove alarms without a defined response, set deadbands and delays, and suppress alarms from plant sections that are out of service.
• Rationalise systematically - with a team of operators, process engineers and instrumentation specialists. A quick first pass covers roughly 50 alarms per shift; a thorough review and redesign can take more than one shift per alarm.
• Base priority on consequence and time - use about three priorities, based on the consequence if the operator fails to respond.
• Sustain the result - bring alarm changes under management of change and measure the KPIs monthly.

Commonly used starting values for deadband and delay in the ISA-18.2 literature are: flow 5% and 15 seconds, level 5% and 60 seconds, pressure 2% and 15 seconds, temperature 1% and 60 seconds. Adjust them per measurement based on the alarm history.

📊 Which KPIs and targets do you use?

The supporting tools are an alarm flood report, a bad actor list, a standing alarm analysis and controlled shelving: the temporary, recorded removal of a nuisance alarm from service by the operator.

🔐 What does alarm management have to do with OT security?

Alarms are also a detection mechanism. An attacker who wants to manipulate the process will try to suppress alarms or shift alarm limits. Stuxnet showed operators normal values while the centrifuges were being damaged, and TRITON targeted the safety system itself in 2017. Therefore:

• Protect the alarm configuration with access control and logging of every change
• Compare the active settings periodically with the master alarm database to find unexplained deviations
• Keep security notifications separate - alerts from a SIEM or IDS belong with the security team, not in the process operator’s alarm list
• Treat unexplained alarm patterns as a possible cyber incident as well

At Seveso establishments in the Netherlands (formerly Brzo companies), the Seveso+ inspectors look at technology and the state of maintenance. Alarm management and the reliability of operator intervention are a standard part of that, as is the independence of the SIS under IEC 61511.

❓ Frequently asked questions

What is alarm fatigue?

Alarm fatigue is the condition in which operators, faced with an excess of alarms, start to ignore them, click them away or silence the horn. It is caused mainly by alarms without an action, chattering alarms and standing alarms. Alarm management cures alarm fatigue by removing unnecessary alarms and prioritising the rest properly.

How many alarms per hour can an operator handle?

According to EEMUA 191 and ISA-18.2, an average of one alarm per ten minutes per operator, about six per hour, is very likely to be acceptable. Two alarms per ten minutes is regarded as the maximum that is still manageable. During a major upset, an operator should receive no more than ten alarms in the first ten minutes.

What is the difference between an alarm and an interlock?

An alarm warns the operator and asks for a human action, such as adjusting a valve. An interlock or SIS acts automatically, for example by stopping a pump when the pressure is too high. A pre-trip alarm warns the operator shortly before such an automatic shutdown takes place.

What is an alarm philosophy?

An alarm philosophy is the foundational document of alarm management in which a company defines what an alarm is, how many priorities exist, which colours and sounds are used and which KPIs apply. It also covers roles, management of change and training. ISA-18.2 treats the alarm philosophy as the first stage of the alarm lifecycle.

How long does alarm rationalisation take?

The duration of alarm rationalisation depends on the number of alarms and the depth of the review. According to the HSE, a quick first pass covers roughly 50 alarms per shift, while a thorough review can take more than one shift per alarm. Start with the bad actors, which cause most of the alarm load.

Is alarm management mandatory?

Alarm management is not laid down as a separate legal requirement in the Netherlands, but standards such as ISA-18.2, IEC 62682 and EEMUA 191 are regarded as the state of the art. At high-risk sites, inspectors check whether the alarm system and operator intervention are reliable. If you count an alarm as a protection layer in a LOPA, you must also be able to justify it.

📌 In summary

Alarm Management uses an alarm philosophy, rationalisation and measurable KPIs to ensure that every alarm demands a clear action and that operators are not overwhelmed. It is essential for safe and manageable process operation, aligns with standards such as ISA-18.2, IEC 62682 and EEMUA 191, and also turns alarms into a valuable means of detecting manipulation of the process.